diff -Naur drupal-5.2/.htaccess drupal-5.23/.htaccess --- drupal-5.2/.htaccess 2007-05-21 03:34:59.000000000 +0200 +++ drupal-5.23/.htaccess 2009-02-26 08:03:29.000000000 +0100 @@ -3,7 +3,7 @@ # # Protect files and directories from prying eyes. - + Order allow,deny @@ -13,9 +13,14 @@ # Follow symbolic links in this directory. Options +FollowSymLinks -# Customized error messages. +# Make Drupal handle any 404 errors. ErrorDocument 404 /index.php +# Force simple error message for requests for non-existent favicon.ico. + + ErrorDocument 404 "The requested file favicon.ico was not found. + + # Set the default handler. DirectoryIndex index.php @@ -78,13 +83,19 @@ # # To redirect all users to access the site WITHOUT the 'www.' prefix, # (http://www.example.com/... will be redirected to http://example.com/...) - # adapt and uncomment the following: + # uncomment and adapt the following: # RewriteCond %{HTTP_HOST} ^www\.example\.com$ [NC] # RewriteRule ^(.*)$ http://example.com/$1 [L,R=301] - # Modify the RewriteBase if you are using Drupal in a subdirectory and - # the rewrite rules are not working properly. - #RewriteBase /drupal + # Modify the RewriteBase if you are using Drupal in a subdirectory or in a + # VirtualDocumentRoot and the rewrite rules are not working properly. + # For example if your site is at http://example.com/drupal uncomment and + # modify the following line: + # RewriteBase /drupal + # + # If your site is running in a VirtualDocumentRoot at http://example.com/, + # uncomment the following line: + # RewriteBase / # Rewrite old-style URLs of the form 'node.php?id=x'. #RewriteCond %{REQUEST_FILENAME} !-f @@ -98,10 +109,11 @@ #RewriteCond %{QUERY_STRING} ^mod=([^&]+)$ #RewriteRule module.php index.php?q=%1 [L] - # Rewrite current-style URLs of the form 'index.php?q=x'. + # Rewrite current-style URLs of the form 'x' to the form 'index.php?q=x'. RewriteCond %{REQUEST_FILENAME} !-f RewriteCond %{REQUEST_FILENAME} !-d + RewriteCond %{REQUEST_URI} !=/favicon.ico RewriteRule ^(.*)$ index.php?q=$1 [L,QSA] -# $Id: .htaccess,v 1.81.2.2 2007/05/21 01:34:59 drumm Exp $ +# $Id: .htaccess,v 1.81.2.6 2009/02/26 07:03:29 drumm Exp $ diff -Naur drupal-5.2/CHANGELOG.txt drupal-5.23/CHANGELOG.txt --- drupal-5.2/CHANGELOG.txt 2007-07-26 21:16:45.000000000 +0200 +++ drupal-5.23/CHANGELOG.txt 2010-08-11 22:37:49.000000000 +0200 @@ -1,4 +1,124 @@ -// $Id: CHANGELOG.txt,v 1.173.2.8 2007/07/26 19:16:45 drumm Exp $ +// $Id: CHANGELOG.txt,v 1.173.2.50 2010/08/11 20:37:49 drumm Exp $ + +Drupal 5.23, 2010-08-11 +----------------------- +- Fixed security issues (File download access bypass, Comment unpublishing + bypass), see SA-CORE-2010-002. + +Drupal 5.22, 2010-03-03 +----------------------- +- Fixed security issues (Open redirection, Locale module cross site scripting, + Blocked user session regeneration), see SA-CORE-2010-001. + +Drupal 5.21, 2009-12-16 +----------------------- +- Fixed a security issue (Cross site scripting), see SA-CORE-2009-009. +- Fixed a variety of small bugs. + +Drupal 5.20, 2009-09-16 +----------------------- +- Avoid security problems resulting from writing Drupal 6-style menu + declarations. +- Fixed security issues (session fixation), see SA-CORE-2009-008. +- Fixed a variety of small bugs. + +Drupal 5.19, 2009-07-01 +----------------------- +- Fixed security issues (Cross site scripting and Password leakage in URL), see + SA-CORE-2009-007. +- Fixed a variety of small bugs. + +Drupal 5.18, 2009-05-13 +----------------------- +- Fixed security issues (Cross site scripting), see SA-CORE-2009-006. +- Fixed a variety of small bugs. + +Drupal 5.17, 2009-04-29 +----------------------- +- Fixed security issues (Cross site scripting and limited information + disclosure) see SA-CORE-2009-005. +- Fixed a variety of small bugs. + +Drupal 5.16, 2009-02-25 +----------------------- +- Fixed a security issue, (Local file inclusion on Windows), see SA-CORE-2009-004. +- Fixed a variety of small bugs. + +Drupal 5.15, 2009-01-14 +----------------------- +- Fixed security issues, (Hardening against SQL injection), see + SA-CORE-2009-001 +- Fixed HTTP_HOST checking to work again with HTTP 1.0 clients and basic shell + scripts. +- Fixed a variety of small bugs. + +Drupal 5.14, 2008-12-11 +----------------------- +- removed a previous change incompatible with PHP 5.1.x and lower. + +Drupal 5.13, 2008-12-10 +----------------------- +- fixed a variety of small bugs. +- fixed security issues, (Cross site request forgery and Cross site scripting), see SA-2008-073 +- updated robots.txt and .htaccess to match current file use. + +Drupal 5.12, 2008-10-22 +----------------------- +- fixed security issues, (File inclusion), see SA-2008-067 + +Drupal 5.11, 2008-10-08 +----------------------- +- fixed a variety of small bugs. +- fixed security issues, (File upload access bypass, Access rules bypass, + BlogAPI access bypass, Node validation bypass), see SA-2008-060 + +Drupal 5.10, 2008-08-13 +----------------------- +- fixed a variety of small bugs. +- fixed security issues, (Cross site scripting, Arbitrary file uploads via + BlogAPI and Cross site request forgery), see SA-2008-047 + +Drupal 5.9, 2008-07-23 +---------------------- +- fixed a variety of small bugs. +- fixed security issues, (Session fixation), see SA-2008-046 + +Drupal 5.8, 2008-07-09 +---------------------- +- fixed a variety of small bugs. +- fixed security issues, (Cross site scripting, cross site request forgery, and + session fixation), see SA-2008-044 + +Drupal 5.7, 2008-01-28 +---------------------- +- fixed the input format configuration page. +- fixed a variety of small bugs. + +Drupal 5.6, 2008-01-10 +---------------------- +- fixed a variety of small bugs. +- fixed a security issue (Cross site request forgery), see SA-2008-005 +- fixed a security issue (Cross site scripting, UTF8), see SA-2008-006 +- fixed a security issue (Cross site scripting, register_globals), see SA-2008-007 + +Drupal 5.5, 2007-12-06 +---------------------- +- fixed missing missing brackets in a query in the user module. +- fixed taxonomy feed bug introduced by SA-2007-031 + +Drupal 5.4, 2007-12-05 +---------------------- +- fixed a variety of small bugs. +- fixed a security issue (SQL injection), see SA-2007-031 + +Drupal 5.3, 2007-10-17 +---------------------- +- fixed a variety of small bugs. +- fixed a security issue (HTTP response splitting), see SA-2007-024 +- fixed a security issue (Arbitrary code execution via installer), see SA-2007-025 +- fixed a security issue (Cross site scripting via uploads), see SA-2007-026 +- fixed a security issue (User deletion cross site request forgery), see SA-2007-029 +- fixed a security issue (API handling of unpublished comment), see SA-2007-030 Drupal 5.2, 2007-07-26 ---------------------- @@ -89,6 +209,26 @@ * added nested lists generation. * added a self-clearing block class. +Drupal 4.7.11, 2008-01-10 +------------------------- +- fixed a security issue (Cross site request forgery), see SA-2008-005 +- fixed a security issue (Cross site scripting, UTF8), see SA-2008-006 +- fixed a security issue (Cross site scripting, register_globals), see SA-2008-007 + +Drupal 4.7.10, 2007-12-06 +------------------------- +- fixed taxonomy feed bug introduced by SA-2007-031 + +Drupal 4.7.9, 2007-12-05 +------------------------ +- fixed a security issue (SQL injection), see SA-2007-031 + +Drupal 4.7.8, 2007-10-17 +------------------------ +- fixed a security issue (HTTP response splitting), see SA-2007-024 +- fixed a security issue (Cross site scripting via uploads), see SA-2007-026 +- fixed a security issue (API handling of unpublished comment), see SA-2007-030 + Drupal 4.7.7, 2007-07-26 ------------------------ - fixed security issue (XSS), see SA-2007-018 diff -Naur drupal-5.2/INSTALL.txt drupal-5.23/INSTALL.txt --- drupal-5.2/INSTALL.txt 2007-07-26 07:29:58.000000000 +0200 +++ drupal-5.23/INSTALL.txt 2008-01-10 23:14:24.000000000 +0100 @@ -1,4 +1,4 @@ -// $Id: INSTALL.txt,v 1.39.2.2 2007/07/26 05:29:58 drumm Exp $ +// $Id: INSTALL.txt,v 1.39.2.3 2008/01/10 22:14:24 drumm Exp $ CONTENTS OF THIS FILE --------------------- @@ -22,7 +22,7 @@ REQUIREMENTS ------------ -Drupal requires a web server, PHP4 (4.3.3 or greater) or PHP5 +Drupal requires a web server, PHP4 (4.3.5 or greater) or PHP5 (http://www.php.net/) and either MySQL (http://www.mysql.com/) or PostgreSQL (http://www.postgresql.org/). The Apache web server and MySQL database are recommended; other web server and database combinations such as IIS and diff -Naur drupal-5.2/LICENSE.txt drupal-5.23/LICENSE.txt --- drupal-5.2/LICENSE.txt 2006-07-09 13:33:06.000000000 +0200 +++ drupal-5.23/LICENSE.txt 2009-01-14 06:56:37.000000000 +0100 @@ -1,14 +1,13 @@ -// $Id: LICENSE.txt,v 1.5 2006/07/09 11:33:06 dries Exp $ +// $Id: LICENSE.txt,v 1.5.2.1 2009/01/14 05:56:37 drumm Exp $ + GNU GENERAL PUBLIC LICENSE + Version 2, June 1991 - GNU GENERAL PUBLIC LICENSE - Version 2, June 1991 - - Copyright (C) 1989, 1991 Free Software Foundation, Inc. - 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA + Copyright (C) 1989, 1991 Free Software Foundation, Inc., + 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA Everyone is permitted to copy and distribute verbatim copies of this license document, but changing it is not allowed. - Preamble + Preamble The licenses for most software are designed to take away your freedom to share and change it. By contrast, the GNU General Public @@ -58,7 +57,7 @@ The precise terms and conditions for copying, distribution and modification follow. - GNU GENERAL PUBLIC LICENSE + GNU GENERAL PUBLIC LICENSE TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION 0. This License applies to any program or other work which contains @@ -257,7 +256,7 @@ of preserving the free status of all derivatives of our free software and of promoting the sharing and reuse of software generally. - NO WARRANTY + NO WARRANTY 11. BECAUSE THE PROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN @@ -279,9 +278,9 @@ PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. - END OF TERMS AND CONDITIONS + END OF TERMS AND CONDITIONS - How to Apply These Terms to Your New Programs + How to Apply These Terms to Your New Programs If you develop a new program, and you want it to be of the greatest possible use to the public, the best way to achieve this is to make it @@ -305,10 +304,9 @@ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. - You should have received a copy of the GNU General Public License - along with this program; if not, write to the Free Software - Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA - + You should have received a copy of the GNU General Public License along + with this program; if not, write to the Free Software Foundation, Inc., + 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. Also add information on how to contact you by electronic and paper mail. diff -Naur drupal-5.2/includes/bootstrap.inc drupal-5.23/includes/bootstrap.inc --- drupal-5.2/includes/bootstrap.inc 2007-07-26 21:16:45.000000000 +0200 +++ drupal-5.23/includes/bootstrap.inc 2009-04-30 02:13:48.000000000 +0200 @@ -1,5 +1,5 @@ = $phases[0]) { + $current_phase = array_shift($phases); _drupal_bootstrap($current_phase); - if ($phase == $current_phase) { - return; - } } } diff -Naur drupal-5.2/includes/cache.inc drupal-5.23/includes/cache.inc --- drupal-5.2/includes/cache.inc 2007-06-27 05:35:48.000000000 +0200 +++ drupal-5.23/includes/cache.inc 2009-07-10 07:41:24.000000000 +0200 @@ -1,5 +1,5 @@ cache = time(); - $cache_flush = variable_get('cache_flush', 0); + $cache_flush = variable_get('cache_flush_'. $table, 0); if ($cache_flush == 0) { // This is the first request to clear the cache, start a timer. - variable_set('cache_flush', time()); + variable_set('cache_flush_'. $table, time()); } else if (time() > ($cache_flush + variable_get('cache_lifetime', 0))) { - // Clear the cache for everyone, cache_flush_delay seconds have + // Clear the cache for everyone, cache_lifetime seconds have // passed since the first request to clear the cache. db_query("DELETE FROM {". $table. "} WHERE expire != %d AND expire < %d", CACHE_PERMANENT, time()); - variable_set('cache_flush', 0); + variable_set('cache_flush_'. $table, 0); } } else { diff -Naur drupal-5.2/includes/common.inc drupal-5.23/includes/common.inc --- drupal-5.2/includes/common.inc 2007-07-26 21:16:45.000000000 +0200 +++ drupal-5.23/includes/common.inc 2010-03-04 01:16:02.000000000 +0100 @@ -1,5 +1,5 @@ ]*>/i', "\$0\n", $content, 1); +} + +/** * Add a feed URL for the current page. * * @param $url @@ -267,9 +276,8 @@ * 'user login'-block in a sidebar. The function drupal_get_destination() * can be used to help set the destination URL. * - * It is advised to use drupal_goto() instead of PHP's header(), because - * drupal_goto() will append the user's session ID to the URI when PHP is - * compiled with "--enable-trans-sid". + * Drupal will ensure that messages set by drupal_set_message() and other + * session data are written to the database before the user is redirected. * * This function ends the request; use it rather than a print theme('page') * statement in your menu callback. @@ -294,18 +302,35 @@ * @see drupal_get_destination() */ function drupal_goto($path = '', $query = NULL, $fragment = NULL, $http_response_code = 302) { + + $destination = FALSE; if (isset($_REQUEST['destination'])) { - extract(parse_url(urldecode($_REQUEST['destination']))); + $destination = $_REQUEST['destination']; } else if (isset($_REQUEST['edit']['destination'])) { - extract(parse_url(urldecode($_REQUEST['edit']['destination']))); + $destination = $_REQUEST['edit']['destination']; + } + + if ($destination) { + // Do not redirect to an absolute URL originating from user input. + $colonpos = strpos($destination, ':'); + $absolute = ($colonpos !== FALSE && !preg_match('![/?#]!', substr($destination, 0, $colonpos))); + if (!$absolute) { + extract(parse_url(urldecode($destination))); + } } $url = url($path, $query, $fragment, TRUE); + // Remove newlines from the URL to avoid header injection attacks. + $url = str_replace(array("\n", "\r"), '', $url); // Before the redirect, allow modules to react to the end of the page request. module_invoke_all('exit', $url); + // Even though session_write_close() is registered as a shutdown function, we + // need all session data written to the database before redirecting. + session_write_close(); + header('Location: '. $url, TRUE, $http_response_code); // The "Location" header sends a REDIRECT status code to the http @@ -347,8 +372,10 @@ menu_set_active_item(''); } - if (empty($return)) { + if (empty($return) || $return == MENU_NOT_FOUND || $return == MENU_ACCESS_DENIED) { drupal_set_title(t('Page not found')); + menu_set_active_item(''); + $return = ''; } // To conserve CPU and bandwidth, omit the blocks print theme('page', $return, FALSE); @@ -361,7 +388,7 @@ drupal_set_header('HTTP/1.1 403 Forbidden'); watchdog('access denied', check_plain($_GET['q']), WATCHDOG_WARNING); -// Keep old path for reference + // Keep old path for reference if (!isset($_REQUEST['destination'])) { $_REQUEST['destination'] = $_GET['q']; } @@ -376,8 +403,9 @@ menu_set_active_item(''); } - if (empty($return)) { + if (empty($return) || $return == MENU_NOT_FOUND || $return == MENU_ACCESS_DENIED) { drupal_set_title(t('Access denied')); + menu_set_active_item(''); $return = t('You are not authorized to access this page.'); } print theme('page', $return); @@ -410,6 +438,18 @@ // Parse the URL, and make sure we can handle the schema. $uri = parse_url($url); + if ($uri == FALSE) { + $result->error = 'unable to parse URL'; + $result->code = -1001; + return $result; + } + + if (!isset($uri['scheme'])) { + $result->error = 'missing schema'; + $result->code = -1002; + return $result; + } + switch ($uri['scheme']) { case 'http': $port = isset($uri['port']) ? $uri['port'] : 80; @@ -424,6 +464,7 @@ break; default: $result->error = 'invalid schema '. $uri['scheme']; + $result->code = -1003; return $result; } @@ -450,6 +491,11 @@ 'Content-Length' => 'Content-Length: '. strlen($data) ); + // If the server url has a user then attempt to use basic authentication + if (isset($uri['user'])) { + $defaults['Authorization'] = 'Authorization: Basic '. base64_encode($uri['user'] . (!empty($uri['pass']) ? ":". $uri['pass'] : '')); + } + foreach ($headers as $header => $value) { $defaults[$header] = $header .': '. $value; } @@ -544,7 +590,7 @@ } if ($errno & (E_ALL ^ E_NOTICE)) { - $types = array(1 => 'error', 2 => 'warning', 4 => 'parse error', 8 => 'notice', 16 => 'core error', 32 => 'core warning', 64 => 'compile error', 128 => 'compile warning', 256 => 'user error', 512 => 'user warning', 1024 => 'user notice', 2048 => 'strict warning'); + $types = array(1 => 'error', 2 => 'warning', 4 => 'parse error', 8 => 'notice', 16 => 'core error', 32 => 'core warning', 64 => 'compile error', 128 => 'compile warning', 256 => 'user error', 512 => 'user warning', 1024 => 'user notice', 2048 => 'strict warning', 4096 => 'recoverable fatal error'); $entry = $types[$errno] .': '. $message .' in '. $filename .' on line '. $line .'.'; // Force display of error messages in update.php @@ -629,8 +675,8 @@ /** * Translate strings to the current locale. * - * All human-readable text that will be displayed somewhere within a page should be - * run through the t() function. + * Human-readable text that will be displayed somewhere within a page should + * be run through the t() function. * * Examples: * @code @@ -666,27 +712,27 @@ * $message[] = t("If you don't want to receive such e-mails, you can change your settings at !url.", array('!url' => url("user/$account->uid", NULL, NULL, TRUE))); * @endcode * - * - @variable, which indicates that the text should be run through check_plain, - * to strip out HTML characters. Use this for any output that's displayed within - * a Drupal page. + * - @variable, which indicates that the text should be run through + * check_plain, to escape HTML characters. Use this for any output that's + * displayed within a Drupal page. * @code * drupal_set_title($title = t("@name's blog", array('@name' => $account->name))); * @endcode * - * - %variable, which indicates that the string should be highlighted with - * theme_placeholder() which shows up by default as emphasized. + * - %variable, which indicates that the string should be HTML escaped and + * highlighted with theme_placeholder() which shows up by default as + * emphasized. * @code - * watchdog('mail', t('%name-from sent %name-to an e-mail.', array('%name-from' => $user->name, '%name-to' => $account->name))); + * $message = t('%name-from sent %name-to an e-mail.', array('%name-from' => $user->name, '%name-to' => $account->name)); * @endcode * * When using t(), try to put entire sentences and strings in one t() call. * This makes it easier for translators, as it provides context as to what - * each word refers to. HTML markup within translation strings is allowed, - * but should be avoided if possible. The exception is embedded links; link - * titles add additional context for translators so should be kept in the main - * string. + * each word refers to. HTML markup within translation strings is allowed, but + * should be avoided if possible. The exception are embedded links; link + * titles add a context for translators, so should be kept in the main string. * - * Here is an example of an incorrect use if t(): + * Here is an example of incorrect usage of t(): * @code * $output .= t('

Go to the @contact-page.

', array('@contact-page' => l(t('contact page'), 'contact'))); * @endcode @@ -696,7 +742,7 @@ * $output .= '

'. t('Go to the contact page.', array('@contact-page' => url('contact'))) .'

'; * @endcode * - * Also avoid escaping quotation marks wherever possible. + * Avoid escaping quotation marks wherever possible. * * Incorrect: * @code @@ -708,6 +754,101 @@ * $output .= t("Don't click me."); * @endcode * + * Because t() is designed for handling code-based strings, in almost all + * cases, the actual string and not a variable must be passed through t(). + * + * Extraction of translations is done based on the strings contained in t() + * calls. If a variable is passed through t(), the content of the variable + * cannot be extracted from the file for translation. + * + * Incorrect: + * @code + * $message = 'An error occurred.'; + * drupal_set_message(t($message), 'error'); + * $output .= t($message); + * @endcode + * + * Correct: + * @code + * $message = t('An error occurred.'); + * drupal_set_message($message, 'error'); + * $output .= $message; + * @endcode + * + * The only case in which variables can be passed safely through t() is when + * code-based versions of the same strings will be passed through t() (or + * otherwise extracted) elsewhere. + * + * In some cases, modules may include strings in code that can't use t() + * calls. For example, a module may use an external PHP application that + * produces strings that are loaded into variables in Drupal for output. + * In these cases, module authors may include a dummy file that passes the + * relevant strings through t(). This approach will allow the strings to be + * extracted. + * + * Sample external (non-Drupal) code: + * @code + * class Time { + * public $yesterday = 'Yesterday'; + * public $today = 'Today'; + * public $tomorrow = 'Tomorrow'; + * } + * @endcode + * + * Sample dummy file. + * @code + * // Dummy function included in example.potx.inc. + * function example_potx() { + * $strings = array( + * t('Yesterday'), + * t('Today'), + * t('Tomorrow'), + * ); + * // No return value needed, since this is a dummy function. + * } + * @endcode + * + * Having passed strings through t() in a dummy function, it is then + * okay to pass variables through t(). + * + * Correct (if a dummy file was used): + * @code + * $time = new Time(); + * $output .= t($time->today); + * @endcode + * + * However tempting it is, custom data from user input or other non-code + * sources should not be passed through t(). Doing so leads to the following + * problems and errors: + * - The t() system doesn't support updates to existing strings. When user + * data is updated, the next time it's passed through t() a new record is + * created instead of an update. The database bloats over time and any + * existing translations are orphaned with each update. + * - The t() system assumes any data it receives is in English. User data may + * be in another language, producing translation errors. + * - The "Built-in interface" text group in the locale system is used to + * produce translations for storage in .po files. When non-code strings are + * passed through t(), they are added to this text group, which is rendered + * inaccurate since it is a mix of actual interface strings and various user + * input strings of uncertain origin. + * + * Incorrect: + * @code + * $item = item_load(); + * $output .= check_plain(t($item['title'])); + * @endcode + * + * Instead, translation of these data can be done through the locale system, + * either directly or through helper functions provided by contributed + * modules. + * @see hook_locale() + * + * During installation, st() is used in place of t(). Code that may be called + * during installation or during normal operation should use the get_t() + * helper function. + * @see st() + * @see get_t() + * * @param $string * A string containing the English string to translate. * @param $args @@ -780,7 +921,7 @@ * * This function should only be used on actual URLs. It should not be used for * Drupal menu paths, which can contain arbitrary characters. - * + * Valid values per RFC 3986. * @param $url * The URL to verify. * @param $absolute @@ -789,12 +930,26 @@ * TRUE if the URL is in a valid format. */ function valid_url($url, $absolute = FALSE) { - $allowed_characters = '[a-z0-9\/:_\-_\.\?\$,;~=#&%\+]'; if ($absolute) { - return preg_match("/^(http|https|ftp):\/\/". $allowed_characters ."+$/i", $url); + return (bool)preg_match(" + /^ # Start at the beginning of the text + (?:ftp|https?):\/\/ # Look for ftp, http, or https schemes + (?: # Userinfo (optional) which is typically + (?:(?:[\w\.\-\+!$&'\(\)*\+,;=]|%[0-9a-f]{2})+:)* # a username or a username and password + (?:[\w\.\-\+%!$&'\(\)*\+,;=]|%[0-9a-f]{2})+@ # combination + )? + (?: + (?:[a-z0-9\-\.]|%[0-9a-f]{2})+ # A domain name or a IPv4 address + |(?:\[(?:[0-9a-f]{0,4}:)*(?:[0-9a-f]{0,4})\]) # or a well formed IPv6 address + ) + (?::[0-9]+)? # Server port number (optional) + (?:[\/|\?] + (?:[\w#!:\.\?\+=&@$'~*,;\/\(\)\[\]\-]|%[0-9a-f]{2}) # The path and query (optional) + *)? + $/xi", $url); } else { - return preg_match("/^". $allowed_characters ."+$/i", $url); + return (bool)preg_match("/^(?:[\w#!:\.\?\+=&@$'~*,;\/\(\)\[\]\-]|%[0-9a-f]{2})+$/i", $url); } } @@ -1262,7 +1417,7 @@ * an HTML string containing a link to the given path. */ function l($text, $path, $attributes = array(), $query = NULL, $fragment = NULL, $absolute = FALSE, $html = FALSE) { - if ($path == $_GET['q']) { + if (($path == $_GET['q']) || ($path == '' && drupal_is_front_page())) { if (isset($attributes['class'])) { $attributes['class'] .= ' active'; } @@ -1511,6 +1666,8 @@ foreach ($type as $file => $cache) { if ($cache) { $contents = file_get_contents($file); + // Remove multiple charset declarations for standards compliance (and fixing Safari problems) + $contents = preg_replace('/^@charset\s+[\'"](\S*)\b[\'"];/i', '', $contents); // Return the path to where this CSS file originated from, stripping off the name of the file at the end of the path. $path = base_path() . substr($file, 0, strrpos($file, '/')) .'/'; // Wraps all @import arguments in url(). @@ -1545,6 +1702,8 @@ */ function drupal_clear_css_cache() { file_scan_directory(file_create_path('css'), '.*', array('.', '..', 'CVS'), 'file_delete', TRUE); + // Clear the page cache, so cached pages do not reference nonexistent CSS. + cache_clear_all(); } /** @@ -1644,10 +1803,10 @@ * are added to the page. Then, all settings are output, followed by 'inline' * JavaScript code. * - * @parameter $scope + * @param $scope * (optional) The scope for which the JavaScript rules should be returned. * Defaults to 'header'. - * @parameter $javascript + * @param $javascript * (optional) An array with all JavaScript code. Defaults to the default * JavaScript array for the given scope. * @return @@ -1912,7 +2071,7 @@ * @param $body * Message to be sent. Drupal will format the correct line endings for you. * @param $from - * Sets From, Reply-To, Return-Path and Error-To to this value, if given. + * Sets From to this value, if given. * @param $headers * Associative array containing the headers to add. This is typically * used to add extra headers (From, Cc, and Bcc). @@ -1932,10 +2091,10 @@ // SMTP server. Errors-To is redundant, but shouldn't hurt. $default_from = variable_get('site_mail', ini_get('sendmail_from')); if ($default_from) { - $defaults['From'] = $defaults['Reply-To'] = $defaults['Sender'] = $defaults['Return-Path'] = $defaults['Errors-To'] = $default_from; + $defaults['From'] = $defaults['Sender'] = $defaults['Return-Path'] = $defaults['Errors-To'] = $default_from; } if ($from) { - $defaults['From'] = $defaults['Reply-To'] = $from; + $defaults['From'] = $from; } $headers = array_merge($defaults, $headers); // Custom hook traversal to allow pass by reference diff -Naur drupal-5.2/includes/database.inc drupal-5.23/includes/database.inc --- drupal-5.2/includes/database.inc 2007-07-12 08:25:47.000000000 +0200 +++ drupal-5.23/includes/database.inc 2008-01-07 01:55:44.000000000 +0100 @@ -1,5 +1,5 @@ We were unable to use the MySQL database because the MySQL extension for PHP is not installed. Check your PHP.ini to see how you can enable it.

For more help, see the Installation and upgrading handbook. If you are unsure what these terms mean you should probably contact your hosting provider.

'); @@ -105,7 +106,7 @@ drupal_set_header('HTTP/1.1 503 Service Unavailable'); drupal_set_title('Unable to connect to database server'); print theme('maintenance_page', '

If you still have to install Drupal, proceed to the installation page.

-

If you have already finished installed Drupal, this either means that the username and password information in your settings.php file is incorrect or that we can\'t connect to the MySQL database server. This could mean your hosting provider\'s database server is down.

+

If you have already finished installing Drupal, this either means that the username and password information in your settings.php file is incorrect or that we can\'t connect to the MySQL database server. This could mean your hosting provider\'s database server is down.

The MySQL error was: '. theme('placeholder', mysql_error()) .'.

Currently, the username is '. theme('placeholder', $url['user']) .' and the database server is '. theme('placeholder', $url['host']) .'.