diff -Naur drupal-7.52/.htaccess drupal-7.58/.htaccess --- drupal-7.52/.htaccess 2016-11-16 19:53:45.000000000 +0100 +++ drupal-7.58/.htaccess 2018-03-27 21:28:19.000000000 +0200 @@ -3,8 +3,13 @@ # # Protect files and directories from prying eyes. - - Order allow,deny + + + Require all denied + + + Order allow,deny + # Don't show directory listings for URLs which map to a directory. @@ -80,7 +85,7 @@ # If you do not have mod_rewrite installed, you should remove these # directories from your webroot or otherwise protect them from being # downloaded. - RewriteRule "(^|/)\." - [F] + RewriteRule "/\.|^\.(?!well-known/)" - [F] # If your site can be accessed both with and without the 'www.' prefix, you # can use one of the following settings to redirect users to your preferred diff -Naur drupal-7.52/CHANGELOG.txt drupal-7.58/CHANGELOG.txt --- drupal-7.52/CHANGELOG.txt 2016-11-16 19:53:45.000000000 +0100 +++ drupal-7.58/CHANGELOG.txt 2018-03-27 21:28:19.000000000 +0200 @@ -1,4 +1,56 @@ +Drupal 7.58, 2018-03-28 +----------------------- +- Fixed security issues (multiple vulnerabilities). See SA-CORE-2018-002. + +Drupal 7.57, 2018-02-21 +----------------------- +- Fixed security issues (multiple vulnerabilities). See SA-CORE-2018-001. + +Drupal 7.56, 2017-06-21 +----------------------- +- Fixed security issues (access bypass). See SA-CORE-2017-003. + +Drupal 7.55, 2017-06-07 +----------------------- +- Fixed incompatibility with PHP versions 7.0.19 and 7.1.5 due to duplicate + DATE_RFC7231 definition. +- Made Drupal core pass all automated tests on PHP 7.1. +- Allowed services such as Let's Encrypt to work with Drupal on Apache, by + making Drupal's .htaccess file allow access to the .well-known directory + defined by RFC 5785. +- Made new Drupal sites work correctly on Apache 2.4 when the mod_access_compat + Apache module is disabled. +- Fixed Drupal's URL-generating functions to always encode '[' and ']' so that + the URLs will pass HTML5 validation. +- Various additional bug fixes. +- Various API documentation improvements. +- Additional automated test coverage. + +Drupal 7.54, 2017-02-01 +----------------------- +- Modules are now able to define theme engines (API addition: + https://www.drupal.org/node/2826480). +- Logging of searches can now be disabled (new option in the administrative + interface). +- Added menu tree render structure to (pre-)process hooks for theme_menu_tree() + (API addition: https://www.drupal.org/node/2827134). +- Added new function for determining whether an HTTPS request is being served + (API addition: https://www.drupal.org/node/2824590). +- Fixed incorrect default value for short and medium date formats on the date + type configuration page. +- File validation error message is now removed after subsequent upload of valid + file. +- Numerous bug fixes. +- Numerous API documentation improvements. +- Additional performance improvements. +- Additional automated test coverage. + +Drupal 7.53, 2016-12-07 +----------------------- +- Fixed drag and drop support on newer Chrome/IE 11+ versions after 7.51 update + when jQuery is updated to 1.7-1.11.0. + Drupal 7.52, 2016-11-16 ----------------------- - Fixed security issues (multiple vulnerabilities). See SA-CORE-2016-005. diff -Naur drupal-7.52/includes/bootstrap.inc drupal-7.58/includes/bootstrap.inc --- drupal-7.52/includes/bootstrap.inc 2016-11-16 19:53:45.000000000 +0100 +++ drupal-7.58/includes/bootstrap.inc 2018-03-27 21:28:19.000000000 +0200 @@ -8,7 +8,7 @@ /** * The current system version. */ -define('VERSION', '7.52'); +define('VERSION', '7.58'); /** * Core API compatibility. @@ -254,8 +254,13 @@ * http://tools.ietf.org/html/rfc7231#section-7.1.1.1 * * Example: Sun, 06 Nov 1994 08:49:37 GMT + * + * This constant was introduced in PHP 7.0.19 and PHP 7.1.5 but needs to be + * defined by Drupal for earlier PHP versions. */ -define('DATE_RFC7231', 'D, d M Y H:i:s \G\M\T'); +if (!defined('DATE_RFC7231')) { + define('DATE_RFC7231', 'D, d M Y H:i:s \G\M\T'); +} /** * Provides a caching wrapper to be used in place of large array structures. @@ -719,6 +724,16 @@ } /** + * Checks whether an HTTPS request is being served. + * + * @return bool + * TRUE if the request is HTTPS, FALSE otherwise. + */ +function drupal_is_https() { + return isset($_SERVER['HTTPS']) && strtolower($_SERVER['HTTPS']) == 'on'; +} + +/** * Sets the base URL, cookie domain, and session name from configuration. */ function drupal_settings_initialize() { @@ -731,7 +746,7 @@ if (file_exists(DRUPAL_ROOT . '/' . conf_path() . '/settings.php')) { include_once DRUPAL_ROOT . '/' . conf_path() . '/settings.php'; } - $is_https = isset($_SERVER['HTTPS']) && strtolower($_SERVER['HTTPS']) == 'on'; + $is_https = drupal_is_https(); if (isset($base_url)) { // Parse fixed base URL from settings.php. @@ -2617,6 +2632,10 @@ timer_start('page'); // Initialize the configuration, including variables from settings.php. drupal_settings_initialize(); + + // Sanitize unsafe keys from the request. + require_once DRUPAL_ROOT . '/includes/request-sanitizer.inc'; + DrupalRequestSanitizer::sanitize(); } /** diff -Naur drupal-7.52/includes/cache.inc drupal-7.58/includes/cache.inc --- drupal-7.52/includes/cache.inc 2016-11-16 19:53:45.000000000 +0100 +++ drupal-7.58/includes/cache.inc 2018-03-27 21:28:19.000000000 +0200 @@ -122,7 +122,12 @@ * the administrator panel. * - cache_path: Stores the system paths that have an alias. * @param $expire - * (optional) One of the following values: + * (optional) Controls the maximum lifetime of this cache entry. Note that + * caches might be subject to clearing at any time, so this setting does not + * guarantee a minimum lifetime. With this in mind, the cache should not be + * used for data that must be kept during a cache clear, like sessions. + * + * Use one of the following values: * - CACHE_PERMANENT: Indicates that the item should never be removed unless * explicitly told to using cache_clear_all() with a cache ID. * - CACHE_TEMPORARY: Indicates that the item should be removed at the next @@ -262,7 +267,12 @@ * 1MB in size to be stored by default. When caching large arrays or * similar, take care to ensure $data does not exceed this size. * @param $expire - * (optional) One of the following values: + * (optional) Controls the maximum lifetime of this cache entry. Note that + * caches might be subject to clearing at any time, so this setting does not + * guarantee a minimum lifetime. With this in mind, the cache should not be + * used for data that must be kept during a cache clear, like sessions. + * + * Use one of the following values: * - CACHE_PERMANENT: Indicates that the item should never be removed unless * explicitly told to using cache_clear_all() with a cache ID. * - CACHE_TEMPORARY: Indicates that the item should be removed at the next diff -Naur drupal-7.52/includes/common.inc drupal-7.58/includes/common.inc --- drupal-7.52/includes/common.inc 2016-11-16 19:53:45.000000000 +0100 +++ drupal-7.58/includes/common.inc 2018-03-27 21:28:19.000000000 +0200 @@ -487,7 +487,7 @@ $params = array(); foreach ($query as $key => $value) { - $key = ($parent ? $parent . '[' . rawurlencode($key) . ']' : rawurlencode($key)); + $key = $parent ? $parent . rawurlencode('[' . $key . ']') : rawurlencode($key); // Recurse into children. if (is_array($value)) { @@ -2236,8 +2236,11 @@ 'prefix' => '' ); + // Determine whether this is an external link, but ensure that the current + // path is always treated as internal by default (to prevent external link + // injection vulnerabilities). if (!isset($options['external'])) { - $options['external'] = url_is_external($path); + $options['external'] = $path === $_GET['q'] ? FALSE : url_is_external($path); } // Preserve the original path before altering or aliasing. @@ -3986,7 +3989,11 @@ // be merged with content already on the base page. The HTML IDs must be // unique for the fully merged content. Therefore, initialize $seen_ids to // take into account IDs that are already in use on the base page. - $seen_ids_init = &drupal_static(__FUNCTION__ . ':init'); + static $drupal_static_fast; + if (!isset($drupal_static_fast['seen_ids_init'])) { + $drupal_static_fast['seen_ids_init'] = &drupal_static(__FUNCTION__ . ':init'); + } + $seen_ids_init = &$drupal_static_fast['seen_ids_init']; if (!isset($seen_ids_init)) { // Ideally, Drupal would provide an API to persist state information about // prior page requests in the database, and we'd be able to add this @@ -4031,7 +4038,10 @@ } } } - $seen_ids = &drupal_static(__FUNCTION__, $seen_ids_init); + if (!isset($drupal_static_fast['seen_ids'])) { + $drupal_static_fast['seen_ids'] = &drupal_static(__FUNCTION__, $seen_ids_init); + } + $seen_ids = &$drupal_static_fast['seen_ids']; $id = strtr(drupal_strtolower($id), array(' ' => '-', '_' => '-', '[' => '-', ']' => '')); diff -Naur drupal-7.52/includes/database/pgsql/database.inc drupal-7.58/includes/database/pgsql/database.inc --- drupal-7.52/includes/database/pgsql/database.inc 2016-11-16 19:53:45.000000000 +0100 +++ drupal-7.58/includes/database/pgsql/database.inc 2018-03-27 21:28:19.000000000 +0200 @@ -11,7 +11,7 @@ */ /** - * The name by which to obtain a lock for retrive the next insert id. + * The name by which to obtain a lock for retrieving the next insert id. */ define('POSTGRESQL_NEXTID_LOCK', 1000); @@ -55,7 +55,7 @@ $connection_options['pdo'] += array( // Prepared statements are most effective for performance when queries // are recycled (used several times). However, if they are not re-used, - // prepared statements become ineffecient. Since most of Drupal's + // prepared statements become inefficient. Since most of Drupal's // prepared queries are not re-used, it should be faster to emulate // the preparation than to actually ready statements for re-use. If in // doubt, reset to FALSE and measure performance. @@ -175,14 +175,14 @@ } /** - * Retrive a the next id in a sequence. + * Retrieve the next id in a sequence. * * PostgreSQL has built in sequences. We'll use these instead of inserting * and updating a sequences table. */ public function nextId($existing = 0) { - // Retrive the name of the sequence. This information cannot be cached + // Retrieve the name of the sequence. This information cannot be cached // because the prefix may change, for example, like it does in simpletests. $sequence_name = $this->makeSequenceName('sequences', 'value'); @@ -194,7 +194,7 @@ } // PostgreSQL advisory locks are simply locks to be used by an - // application such as Drupal. This will prevent other Drupal proccesses + // application such as Drupal. This will prevent other Drupal processes // from altering the sequence while we are. $this->query("SELECT pg_advisory_lock(" . POSTGRESQL_NEXTID_LOCK . ")"); @@ -209,7 +209,7 @@ // Reset the sequence to a higher value than the existing id. $this->query("ALTER SEQUENCE " . $sequence_name . " RESTART WITH " . ($existing + 1)); - // Retrive the next id. We know this will be as high as we want it. + // Retrieve the next id. We know this will be as high as we want it. $id = $this->query("SELECT nextval('" . $sequence_name . "')")->fetchField(); $this->query("SELECT pg_advisory_unlock(" . POSTGRESQL_NEXTID_LOCK . ")"); diff -Naur drupal-7.52/includes/database/pgsql/install.inc drupal-7.58/includes/database/pgsql/install.inc --- drupal-7.52/includes/database/pgsql/install.inc 2016-11-16 19:53:45.000000000 +0100 +++ drupal-7.58/includes/database/pgsql/install.inc 2018-03-27 21:28:19.000000000 +0200 @@ -165,7 +165,7 @@ LANGUAGE \'sql\'' ); - // Using || to concatenate in Drupal is not recommeneded because there are + // Using || to concatenate in Drupal is not recommended because there are // database drivers for Drupal that do not support the syntax, however // they do support CONCAT(item1, item2) which we can replicate in // PostgreSQL. PostgreSQL requires the function to be defined for each diff -Naur drupal-7.52/includes/database/pgsql/select.inc drupal-7.58/includes/database/pgsql/select.inc --- drupal-7.52/includes/database/pgsql/select.inc 2016-11-16 19:53:45.000000000 +0100 +++ drupal-7.58/includes/database/pgsql/select.inc 2018-03-27 21:28:19.000000000 +0200 @@ -80,7 +80,7 @@ } // If a table loads all fields, it can not be added again. It would - // result in an ambigious alias error because that field would be loaded + // result in an ambiguous alias error because that field would be loaded // twice: Once through table_alias.* and once directly. If the field // actually belongs to a different table, it must be added manually. foreach ($this->tables as $table) { @@ -90,7 +90,7 @@ } // If $field contains an characters which are not allowed in a field name - // it is considered an expression, these can't be handeld automatically + // it is considered an expression, these can't be handled automatically // either. if ($this->connection->escapeField($field) != $field) { return $return; diff -Naur drupal-7.52/includes/database/query.inc drupal-7.58/includes/database/query.inc --- drupal-7.52/includes/database/query.inc 2016-11-16 19:53:45.000000000 +0100 +++ drupal-7.58/includes/database/query.inc 2018-03-27 21:28:19.000000000 +0200 @@ -845,8 +845,8 @@ /** * Executes the DELETE query. * - * @return - * The return value is dependent on the database connection. + * @return int + * The number of rows affected by the delete query. */ public function execute() { $values = array(); @@ -1242,7 +1242,7 @@ * MergeQuery::updateFields() and MergeQuery::insertFields() needs to be called * instead. MergeQuery::fields() can also be called which calls both of these * methods as the common case is to use the same column-value pairs for both - * INSERT and UPDATE. However, this is not mandatory. Another convinient + * INSERT and UPDATE. However, this is not mandatory. Another convenient * wrapper is MergeQuery::key() which adds the same column-value pairs to the * condition and the INSERT query part. * diff -Naur drupal-7.52/includes/database/schema.inc drupal-7.58/includes/database/schema.inc --- drupal-7.52/includes/database/schema.inc 2016-11-16 19:53:45.000000000 +0100 +++ drupal-7.58/includes/database/schema.inc 2018-03-27 21:28:19.000000000 +0200 @@ -164,6 +164,9 @@ * @see drupal_install_schema() */ +/** + * Base class for database schema definitions. + */ abstract class DatabaseSchema implements QueryPlaceholderInterface { protected $connection; @@ -291,7 +294,7 @@ protected function buildTableNameCondition($table_name, $operator = '=', $add_prefix = TRUE) { $info = $this->connection->getConnectionOptions(); - // Retrive the table name and schema + // Retrieve the table name and schema $table_info = $this->getPrefixInfo($table_name, $add_prefix); $condition = new DatabaseCondition('AND'); diff -Naur drupal-7.52/includes/database/sqlite/query.inc drupal-7.58/includes/database/sqlite/query.inc --- drupal-7.52/includes/database/sqlite/query.inc 2016-11-16 19:53:45.000000000 +0100 +++ drupal-7.58/includes/database/sqlite/query.inc 2018-03-27 21:28:19.000000000 +0200 @@ -99,16 +99,15 @@ /** * SQLite specific implementation of DeleteQuery. - * - * When the WHERE is omitted from a DELETE statement and the table being deleted - * has no triggers, SQLite uses an optimization to erase the entire table content - * without having to visit each row of the table individually. - * - * Prior to SQLite 3.6.5, SQLite does not return the actual number of rows deleted - * by that optimized "truncate" optimization. */ class DeleteQuery_sqlite extends DeleteQuery { public function execute() { + // When the WHERE is omitted from a DELETE statement and the table being + // deleted has no triggers, SQLite uses an optimization to erase the entire + // table content without having to visit each row of the table individually. + // Prior to SQLite 3.6.5, SQLite does not return the actual number of rows + // deleted by that optimized "truncate" optimization. But we want to return + // the number of rows affected, so we calculate it directly. if (!count($this->condition)) { $total_rows = $this->connection->query('SELECT COUNT(*) FROM {' . $this->connection->escapeTable($this->table) . '}')->fetchField(); parent::execute(); diff -Naur drupal-7.52/includes/database/sqlite/schema.inc drupal-7.58/includes/database/sqlite/schema.inc --- drupal-7.52/includes/database/sqlite/schema.inc 2016-11-16 19:53:45.000000000 +0100 +++ drupal-7.58/includes/database/sqlite/schema.inc 2018-03-27 21:28:19.000000000 +0200 @@ -244,7 +244,7 @@ // database. So the syntax '...RENAME TO database.table' would fail. // So we must determine the full table name here rather than surrounding // the table with curly braces incase the db_prefix contains a reference - // to a database outside of our existsing database. + // to a database outside of our existing database. $info = $this->getPrefixInfo($new_name); $this->connection->query('ALTER TABLE {' . $table . '} RENAME TO ' . $info['table']); diff -Naur drupal-7.52/includes/date.inc drupal-7.58/includes/date.inc --- drupal-7.52/includes/date.inc 2016-11-16 19:53:45.000000000 +0100 +++ drupal-7.58/includes/date.inc 2018-03-27 21:28:19.000000000 +0200 @@ -14,11 +14,6 @@ // Short date formats. $formats[] = array( 'type' => 'short', - 'format' => 'Y-m-d H:i', - 'locales' => array(), - ); - $formats[] = array( - 'type' => 'short', 'format' => 'm/d/Y - H:i', 'locales' => array('en-us'), ); @@ -39,6 +34,11 @@ ); $formats[] = array( 'type' => 'short', + 'format' => 'Y-m-d H:i', + 'locales' => array(), + ); + $formats[] = array( + 'type' => 'short', 'format' => 'm/d/Y - g:ia', 'locales' => array(), ); @@ -86,11 +86,6 @@ // Medium date formats. $formats[] = array( 'type' => 'medium', - 'format' => 'D, Y-m-d H:i', - 'locales' => array(), - ); - $formats[] = array( - 'type' => 'medium', 'format' => 'D, m/d/Y - H:i', 'locales' => array('en-us'), ); @@ -106,6 +101,11 @@ ); $formats[] = array( 'type' => 'medium', + 'format' => 'D, Y-m-d H:i', + 'locales' => array(), + ); + $formats[] = array( + 'type' => 'medium', 'format' => 'F j, Y - H:i', 'locales' => array(), ); diff -Naur drupal-7.52/includes/errors.inc drupal-7.58/includes/errors.inc --- drupal-7.52/includes/errors.inc 2016-11-16 19:53:45.000000000 +0100 +++ drupal-7.58/includes/errors.inc 2018-03-27 21:28:19.000000000 +0200 @@ -66,7 +66,7 @@ _drupal_log_error(array( '%type' => isset($types[$error_level]) ? $severity_msg : 'Unknown error', // The standard PHP error handler considers that the error messages - // are HTML. We mimick this behavior here. + // are HTML. We mimic this behavior here. '!message' => filter_xss_admin($message), '%function' => $caller['function'], '%file' => $caller['file'], @@ -114,7 +114,7 @@ return array( '%type' => get_class($exception), // The standard PHP exception handler considers that the exception message - // is plain-text. We mimick this behavior here. + // is plain-text. We mimic this behavior here. '!message' => check_plain($message), '%function' => $caller['function'], '%file' => $caller['file'], @@ -233,7 +233,7 @@ } else { // Display the message if the current error reporting level allows this type - // of message to be displayed, and unconditionnaly in update.php. + // of message to be displayed, and unconditionally in update.php. if (error_displayable($error)) { $class = 'error'; diff -Naur drupal-7.52/includes/file.inc drupal-7.58/includes/file.inc --- drupal-7.52/includes/file.inc 2016-11-16 19:53:45.000000000 +0100 +++ drupal-7.58/includes/file.inc 2018-03-27 21:28:19.000000000 +0200 @@ -535,7 +535,18 @@ EOF; if ($private) { - $lines = "Deny from all\n\n" . $lines; + $lines = << + Require all denied + + +# Deny all requests from Apache 2.0-2.2. + + Deny from all + +EOF + . "\n\n" . $lines; } return $lines; @@ -889,7 +900,6 @@ */ function file_unmanaged_copy($source, $destination = NULL, $replace = FILE_EXISTS_RENAME) { $original_source = $source; - $original_destination = $destination; // Assert that the source file actually exists. if (!file_exists($source)) { @@ -1604,6 +1614,20 @@ // If we made it this far it's safe to record this file in the database. if ($file = file_save($file)) { + // Track non-public files in the session if they were uploaded by an + // anonymous user. This allows modules such as the File module to only + // grant view access to the specific anonymous user who uploaded the file. + // See file_file_download(). + // The 'file_public_schema' variable is used to allow other publicly + // accessible file schemes to be treated the same as the public:// scheme + // provided by Drupal core and to avoid adding unnecessary data to the + // session (and the resulting bypass of the page cache) in those cases. For + // security reasons, only schemes that are completely publicly accessible, + // with no download restrictions, should be added to this variable. See + // file_managed_file_value(). + if (!$user->uid && !in_array($destination_scheme, variable_get('file_public_schema', array('public')))) { + $_SESSION['anonymous_allowed_file_ids'][$file->fid] = $file->fid; + } // Add file to the cache. $upload_cache[$form_field_name] = $file; return $file; @@ -2553,7 +2577,6 @@ * An associative array of headers, as expected by file_transfer(). */ function file_get_content_headers($file) { - $name = mime_header_encode($file->filename); $type = mime_header_encode($file->filemime); return array( diff -Naur drupal-7.52/includes/form.inc drupal-7.58/includes/form.inc --- drupal-7.52/includes/form.inc 2016-11-16 19:53:45.000000000 +0100 +++ drupal-7.58/includes/form.inc 2018-03-27 21:28:19.000000000 +0200 @@ -1176,7 +1176,7 @@ // If the session token was set by drupal_prepare_form(), ensure that it // matches the current user's session. This is duplicate to code in // form_builder() but left to protect any custom form handling code. - if (isset($form['#token'])) { + if (!empty($form['#token'])) { if (!drupal_valid_token($form_state['values']['form_token'], $form['#token']) || !empty($form_state['invalid_token'])) { _drupal_invalid_token_set_form_error(); // Stop here and don't run any further validation handlers, because they @@ -1837,7 +1837,7 @@ // If the session token was set by drupal_prepare_form(), ensure that it // matches the current user's session. $form_state['invalid_token'] = FALSE; - if (isset($element['#token'])) { + if (!empty($element['#token'])) { if (empty($form_state['input']['form_token']) || !drupal_valid_token($form_state['input']['form_token'], $element['#token'])) { // Set an early form error to block certain input processing since that // opens the door for CSRF vulnerabilities. diff -Naur drupal-7.52/includes/menu.inc drupal-7.58/includes/menu.inc --- drupal-7.52/includes/menu.inc 2016-11-16 19:53:45.000000000 +0100 +++ drupal-7.58/includes/menu.inc 2018-03-27 21:28:19.000000000 +0200 @@ -1606,6 +1606,7 @@ * Implements template_preprocess_HOOK() for theme_menu_tree(). */ function template_preprocess_menu_tree(&$variables) { + $variables['#tree'] = $variables['tree']; $variables['tree'] = $variables['tree']['#children']; } @@ -2682,7 +2683,7 @@ } /** - * Clears the cached cached data for a single named menu. + * Clears the cached data for a single named menu. */ function menu_cache_clear($menu_name = 'navigation') { $cache_cleared = &drupal_static(__FUNCTION__, array()); diff -Naur drupal-7.52/includes/request-sanitizer.inc drupal-7.58/includes/request-sanitizer.inc --- drupal-7.52/includes/request-sanitizer.inc 1970-01-01 01:00:00.000000000 +0100 +++ drupal-7.58/includes/request-sanitizer.inc 2018-03-27 21:28:19.000000000 +0200 @@ -0,0 +1,82 @@ + implode(', ', $get_sanitized_keys))), E_USER_NOTICE); + } + + // Process request body parameters. + $post_sanitized_keys = array(); + $_POST = self::stripDangerousValues($_POST, $whitelist, $post_sanitized_keys); + if ($log_sanitized_keys && $post_sanitized_keys) { + _drupal_trigger_error_with_delayed_logging(format_string('Potentially unsafe keys removed from request body parameters (POST): @keys', array('@keys' => implode(', ', $post_sanitized_keys))), E_USER_NOTICE); + } + + // Process cookie parameters. + $cookie_sanitized_keys = array(); + $_COOKIE = self::stripDangerousValues($_COOKIE, $whitelist, $cookie_sanitized_keys); + if ($log_sanitized_keys && $cookie_sanitized_keys) { + _drupal_trigger_error_with_delayed_logging(format_string('Potentially unsafe keys removed from cookie parameters (COOKIE): @keys', array('@keys' => implode(', ', $cookie_sanitized_keys))), E_USER_NOTICE); + } + + $request_sanitized_keys = array(); + $_REQUEST = self::stripDangerousValues($_REQUEST, $whitelist, $request_sanitized_keys); + + self::$sanitized = TRUE; + } + } + + /** + * Strips dangerous keys from the provided input. + * + * @param mixed $input + * The input to sanitize. + * @param string[] $whitelist + * An array of keys to whitelist as safe. + * @param string[] $sanitized_keys + * An array of keys that have been removed. + * + * @return mixed + * The sanitized input. + */ + protected static function stripDangerousValues($input, array $whitelist, array &$sanitized_keys) { + if (is_array($input)) { + foreach ($input as $key => $value) { + if ($key !== '' && $key[0] === '#' && !in_array($key, $whitelist, TRUE)) { + unset($input[$key]); + $sanitized_keys[] = $key; + } + else { + $input[$key] = self::stripDangerousValues($input[$key], $whitelist, $sanitized_keys); + } + } + } + return $input; + } + +} diff -Naur drupal-7.52/includes/stream_wrappers.inc drupal-7.58/includes/stream_wrappers.inc --- drupal-7.52/includes/stream_wrappers.inc 2016-11-16 19:53:45.000000000 +0100 +++ drupal-7.58/includes/stream_wrappers.inc 2018-03-27 21:28:19.000000000 +0200 @@ -133,7 +133,7 @@ * @param $uri * A string containing the URI that should be used for this instance. */ - function setUri($uri); + public function setUri($uri); /** * Returns the stream resource URI. @@ -219,7 +219,6 @@ public function dirname($uri = NULL); } - /** * Drupal stream wrapper base class for local files. * @@ -550,6 +549,155 @@ } /** + * Sets metadata on the stream. + * + * WARNING: Do not call this method directly! It will be called internally by + * PHP itself when one of the following functions is called on a stream URL: + * + * @param string $uri + * A string containing the URI to the file to set metadata on. + * @param int $option + * One of: + * - STREAM_META_TOUCH: The method was called in response to touch(). + * - STREAM_META_OWNER_NAME: The method was called in response to chown() + * with string parameter. + * - STREAM_META_OWNER: The method was called in response to chown(). + * - STREAM_META_GROUP_NAME: The method was called in response to chgrp(). + * - STREAM_META_GROUP: The method was called in response to chgrp(). + * - STREAM_META_ACCESS: The method was called in response to chmod(). + * @param mixed $value + * If option is: + * - STREAM_META_TOUCH: Array consisting of two arguments of the touch() + * function. + * - STREAM_META_OWNER_NAME or STREAM_META_GROUP_NAME: The name of the owner + * user/group as string. + * - STREAM_META_OWNER or STREAM_META_GROUP: The value of the owner + * user/group as integer. + * - STREAM_META_ACCESS: The argument of the chmod() as integer. + * + * @return bool + * Returns TRUE on success or FALSE on failure. If $option is not + * implemented, FALSE should be returned. + * + * @see touch() + * @see chmod() + * @see chown() + * @see chgrp() + * @link http://php.net/manual/streamwrapper.stream-metadata.php + */ + public function stream_metadata($uri, $option, $value) { + $target = $this->getLocalPath($uri); + $return = FALSE; + switch ($option) { + case STREAM_META_TOUCH: + if (!empty($value)) { + $return = touch($target, $value[0], $value[1]); + } + else { + $return = touch($target); + } + break; + + case STREAM_META_OWNER_NAME: + case STREAM_META_OWNER: + $return = chown($target, $value); + break; + + case STREAM_META_GROUP_NAME: + case STREAM_META_GROUP: + $return = chgrp($target, $value); + break; + + case STREAM_META_ACCESS: + $return = chmod($target, $value); + break; + } + if ($return) { + // For convenience clear the file status cache of the underlying file, + // since metadata operations are often followed by file status checks. + clearstatcache(TRUE, $target); + } + return $return; + } + + /** + * Truncate stream. + * + * Will respond to truncation; e.g., through ftruncate(). + * + * @param int $new_size + * The new size. + * + * @return bool + * TRUE on success, FALSE otherwise. + */ + public function stream_truncate($new_size) { + return ftruncate($this->handle, $new_size); + } + + /** + * Retrieve the underlying stream resource. + * + * This method is called in response to stream_select(). + * + * @param int $cast_as + * Can be STREAM_CAST_FOR_SELECT when stream_select() is calling + * stream_cast() or STREAM_CAST_AS_STREAM when stream_cast() is called for + * other uses. + * + * @return resource|false + * The underlying stream resource or FALSE if stream_select() is not + * supported. + * + * @see stream_select() + * @link http://php.net/manual/streamwrapper.stream-cast.php + */ + public function stream_cast($cast_as) { + return $this->handle ? $this->handle : FALSE; + } + + /** + * Change stream options. + * + * This method is called to set options on the stream. + * + * Since Windows systems do not allow it and it is not needed for most use + * cases anyway, this method is not supported on local files and will trigger + * an error and return false. If needed, custom subclasses can provide + * OS-specific implementations for advanced use cases. + * + * @param int $option + * One of: + * - STREAM_OPTION_BLOCKING: The method was called in response to + * stream_set_blocking(). + * - STREAM_OPTION_READ_TIMEOUT: The method was called in response to + * stream_set_timeout(). + * - STREAM_OPTION_WRITE_BUFFER: The method was called in response to + * stream_set_write_buffer(). + * @param int $arg1 + * If option is: + * - STREAM_OPTION_BLOCKING: The requested blocking mode: + * - 1 means blocking. + * - 0 means not blocking. + * - STREAM_OPTION_READ_TIMEOUT: The timeout in seconds. + * - STREAM_OPTION_WRITE_BUFFER: The buffer mode, STREAM_BUFFER_NONE or + * STREAM_BUFFER_FULL. + * @param int $arg2 + * If option is: + * - STREAM_OPTION_BLOCKING: This option is not set. + * - STREAM_OPTION_READ_TIMEOUT: The timeout in microseconds. + * - STREAM_OPTION_WRITE_BUFFER: The requested buffer size. + * + * @return bool + * TRUE on success, FALSE otherwise. If $option is not implemented, FALSE + * should be returned. + */ + public function stream_set_option($option, $arg1, $arg2) { + trigger_error('stream_set_option() not supported for local file based stream wrappers', E_USER_WARNING); + return FALSE; + } + + /** * Support for unlink(). * * @param $uri diff -Naur drupal-7.52/misc/drupal.js drupal-7.58/misc/drupal.js --- drupal-7.52/misc/drupal.js 2016-11-16 19:53:45.000000000 +0100 +++ drupal-7.58/misc/drupal.js 2018-03-27 21:28:19.000000000 +0200 @@ -28,6 +28,42 @@ $.fn.init.prototype = jquery_init.prototype; /** + * Pre-filter Ajax requests to guard against XSS attacks. + * + * See https://github.com/jquery/jquery/issues/2432 + */ +if ($.ajaxPrefilter) { + // For newer versions of jQuery, use an Ajax prefilter to prevent + // auto-executing script tags from untrusted domains. This is similar to the + // fix that is built in to jQuery 3.0 and higher. + $.ajaxPrefilter(function (s) { + if (s.crossDomain) { + s.contents.script = false; + } + }); +} +else if ($.httpData) { + // For the version of jQuery that ships with Drupal core, override + // jQuery.httpData to prevent auto-detecting "script" data types from + // untrusted domains. + var jquery_httpData = $.httpData; + $.httpData = function (xhr, type, s) { + // @todo Consider backporting code from newer jQuery versions to check for + // a cross-domain request here, rather than using Drupal.urlIsLocal() to + // block scripts from all URLs that are not on the same site. + if (!type && !Drupal.urlIsLocal(s.url)) { + var content_type = xhr.getResponseHeader('content-type') || ''; + if (content_type.indexOf('javascript') >= 0) { + // Default to a safe data type. + type = 'text'; + } + } + return jquery_httpData.call(this, xhr, type, s); + }; + $.httpData.prototype = jquery_httpData.prototype; +} + +/** * Attach all registered behaviors to a page element. * * Behaviors are event-triggered actions that attach to page elements, enhancing @@ -137,7 +173,7 @@ */ Drupal.checkPlain = function (str) { var character, regex, - replace = { '&': '&', '"': '"', '<': '<', '>': '>' }; + replace = { '&': '&', "'": ''', '"': '"', '<': '<', '>': '>' }; str = String(str); for (character in replace) { if (replace.hasOwnProperty(character)) { @@ -168,23 +204,76 @@ Drupal.formatString = function(str, args) { // Transform arguments before inserting them. for (var key in args) { - switch (key.charAt(0)) { - // Escaped only. - case '@': - args[key] = Drupal.checkPlain(args[key]); - break; - // Pass-through. - case '!': - break; - // Escaped and placeholder. - case '%': - default: - args[key] = Drupal.theme('placeholder', args[key]); - break; + if (args.hasOwnProperty(key)) { + switch (key.charAt(0)) { + // Escaped only. + case '@': + args[key] = Drupal.checkPlain(args[key]); + break; + // Pass-through. + case '!': + break; + // Escaped and placeholder. + default: + args[key] = Drupal.theme('placeholder', args[key]); + break; + } } - str = str.replace(key, args[key]); } - return str; + + return Drupal.stringReplace(str, args, null); +}; + +/** + * Replace substring. + * + * The longest keys will be tried first. Once a substring has been replaced, + * its new value will not be searched again. + * + * @param {String} str + * A string with placeholders. + * @param {Object} args + * Key-value pairs. + * @param {Array|null} keys + * Array of keys from the "args". Internal use only. + * + * @return {String} + * Returns the replaced string. + */ +Drupal.stringReplace = function (str, args, keys) { + if (str.length === 0) { + return str; + } + + // If the array of keys is not passed then collect the keys from the args. + if (!$.isArray(keys)) { + keys = []; + for (var k in args) { + if (args.hasOwnProperty(k)) { + keys.push(k); + } + } + + // Order the keys by the character length. The shortest one is the first. + keys.sort(function (a, b) { return a.length - b.length; }); + } + + if (keys.length === 0) { + return str; + } + + // Take next longest one from the end. + var key = keys.pop(); + var fragments = str.split(key); + + if (keys.length) { + for (var i = 0; i < fragments.length; i++) { + // Process each fragment with a copy of remaining keys. + fragments[i] = Drupal.stringReplace(fragments[i], args, keys.slice(0)); + } + } + + return fragments.join(args[key]); }; /** @@ -251,7 +340,7 @@ * A translated string. */ Drupal.formatPlural = function (count, singular, plural, args, options) { - var args = args || {}; + args = args || {}; args['@count'] = count; // Determine the index of the plural form. var index = Drupal.locale.pluralFormula ? Drupal.locale.pluralFormula(args['@count']) : ((args['@count'] == 1) ? 0 : 1); diff -Naur drupal-7.52/misc/tabledrag.js drupal-7.58/misc/tabledrag.js --- drupal-7.52/misc/tabledrag.js 2016-11-16 19:53:45.000000000 +0100 +++ drupal-7.58/misc/tabledrag.js 2018-03-27 21:28:19.000000000 +0200 @@ -580,12 +580,20 @@ * Get the mouse coordinates from the event (allowing for browser differences). */ Drupal.tableDrag.prototype.mouseCoords = function (event) { + // Complete support for pointer events was only introduced to jQuery in + // version 1.11.1; between versions 1.7 and 1.11.0 pointer events have the + // clientX and clientY properties undefined. In those cases, the properties + // must be retrieved from the event.originalEvent object instead. + var clientX = event.clientX || event.originalEvent.clientX; + var clientY = event.clientY || event.originalEvent.clientY; + if (event.pageX || event.pageY) { return { x: event.pageX, y: event.pageY }; } + return { - x: event.clientX + document.body.scrollLeft - document.body.clientLeft, - y: event.clientY + document.body.scrollTop - document.body.clientTop + x: clientX + document.body.scrollLeft - document.body.clientLeft, + y: clientY + document.body.scrollTop - document.body.clientTop }; }; diff -Naur drupal-7.52/modules/aggregator/aggregator.info drupal-7.58/modules/aggregator/aggregator.info --- drupal-7.52/modules/aggregator/aggregator.info 2016-11-16 20:02:02.000000000 +0100 +++ drupal-7.58/modules/aggregator/aggregator.info 2018-03-28 21:06:59.000000000 +0200 @@ -7,8 +7,8 @@ configure = admin/config/services/aggregator/settings stylesheets[all][] = aggregator.css -; Information added by Drupal.org packaging script on 2016-11-16 -version = "7.52" +; Information added by Drupal.org packaging script on 2018-03-28 +version = "7.58" project = "drupal" -datestamp = "1479322922" +datestamp = "1522264019" diff -Naur drupal-7.52/modules/aggregator/aggregator.module drupal-7.58/modules/aggregator/aggregator.module --- drupal-7.52/modules/aggregator/aggregator.module 2016-11-16 19:53:45.000000000 +0100 +++ drupal-7.58/modules/aggregator/aggregator.module 2018-03-27 21:28:19.000000000 +0200 @@ -455,6 +455,14 @@ db_delete('aggregator_category') ->condition('cid', $edit['cid']) ->execute(); + // Remove category from feeds. + db_delete('aggregator_category_feed') + ->condition('cid', $edit['cid']) + ->execute(); + // Remove category from feed items. + db_delete('aggregator_category_item') + ->condition('cid', $edit['cid']) + ->execute(); // Make sure there is no active block for this category. if (module_exists('block')) { db_delete('block') diff -Naur drupal-7.52/modules/aggregator/aggregator.test drupal-7.58/modules/aggregator/aggregator.test --- drupal-7.52/modules/aggregator/aggregator.test 2016-11-16 19:53:45.000000000 +0100 +++ drupal-7.58/modules/aggregator/aggregator.test 2018-03-27 21:28:19.000000000 +0200 @@ -418,7 +418,7 @@ } /** - * Creates a feed and makes sure you can add more than one category to it. + * Creates a feed and makes sure you can add/delete categories to it. */ function testCategorizeFeed() { @@ -448,7 +448,31 @@ // Assert the feed has two categories. $this->getFeedCategories($db_feed); $this->assertEqual(count($db_feed->categories), 2, 'Feed has 2 categories'); + + // Use aggregator_save_feed() to delete a category. + $category = reset($categories); + aggregator_save_category(array('cid' => $category->cid)); + + // Assert that category is deleted. + $db_category = db_query("SELECT COUNT(*) FROM {aggregator_category} WHERE cid = :cid", array(':cid' => $category->cid))->fetchField(); + $this->assertFalse($db_category, format_string('The category %title has been deleted.', array('%title' => $category->title))); + + // Assert that category has been removed from feed. + $categorized_feeds = db_query("SELECT COUNT(*) FROM {aggregator_category_feed} WHERE cid = :cid", array(':cid' => $category->cid))->fetchField(); + $this->assertFalse($categorized_feeds, format_string('The category %title has been removed from feed %feed_title.', array('%title' => $category->title, '%feed_title' => $feed['title']))); + + // Assert that no broken links (associated with the deleted category) + // appear on one of the other category pages. + $this->createSampleNodes(); + $this->drupalGet('admin/config/services/aggregator'); + $this->clickLink('update items'); + $categories = $this->getCategories(); + $category = reset($categories); + $this->drupalGet('aggregator/categories/' . $category->cid); + global $base_path; + $this->assertNoRaw(','); } + } /** @@ -685,9 +709,21 @@ } } + // Delete category from feed items when category is deleted. + $cid = reset($feed->categories); + $categories = $this->getCategories(); + $category_title = $categories[$cid]->title; + + // Delete category. + aggregator_save_category(array('cid' => $cid)); + + // Assert category has been removed from feed items. + $categorized_count = db_query("SELECT COUNT(*) FROM {aggregator_category_item} WHERE cid = :cid", array(':cid' => $cid))->fetchField(); + $this->assertFalse($categorized_count, format_string('The category %title has been removed from feed items.', array('%title' => $category_title))); // Delete feed. $this->deleteFeed($feed); } + } /** diff -Naur drupal-7.52/modules/aggregator/tests/aggregator_test.info drupal-7.58/modules/aggregator/tests/aggregator_test.info --- drupal-7.52/modules/aggregator/tests/aggregator_test.info 2016-11-16 20:02:02.000000000 +0100 +++ drupal-7.58/modules/aggregator/tests/aggregator_test.info 2018-03-28 21:06:59.000000000 +0200 @@ -5,8 +5,8 @@ core = 7.x hidden = TRUE -; Information added by Drupal.org packaging script on 2016-11-16 -version = "7.52" +; Information added by Drupal.org packaging script on 2018-03-28 +version = "7.58" project = "drupal" -datestamp = "1479322922" +datestamp = "1522264019" diff -Naur drupal-7.52/modules/block/block.info drupal-7.58/modules/block/block.info --- drupal-7.52/modules/block/block.info 2016-11-16 20:02:02.000000000 +0100 +++ drupal-7.58/modules/block/block.info 2018-03-28 21:06:59.000000000 +0200 @@ -6,8 +6,8 @@ files[] = block.test configure = admin/structure/block -; Information added by Drupal.org packaging script on 2016-11-16 -version = "7.52" +; Information added by Drupal.org packaging script on 2018-03-28 +version = "7.58" project = "drupal" -datestamp = "1479322922" +datestamp = "1522264019" diff -Naur drupal-7.52/modules/block/block.module drupal-7.58/modules/block/block.module --- drupal-7.52/modules/block/block.module 2016-11-16 19:53:45.000000000 +0100 +++ drupal-7.58/modules/block/block.module 2018-03-27 21:28:19.000000000 +0200 @@ -432,23 +432,20 @@ drupal_alter('block_info', $current_blocks, $theme, $code_blocks); foreach ($current_blocks as $module => $module_blocks) { foreach ($module_blocks as $delta => $block) { - if (!isset($block['pages'])) { - // {block}.pages is type 'text', so it cannot have a - // default value, and not null, so we need to provide - // value if the module did not. - $block['pages'] = ''; - } - // Make sure weight is set. - if (!isset($block['weight'])) { - $block['weight'] = 0; - } + // Make sure certain attributes are set. + $block += array( + 'pages' => '', + 'weight' => 0, + 'status' => 0, + ); + // Check for active blocks in regions that are not available. if (!empty($block['region']) && $block['region'] != BLOCK_REGION_NONE && !isset($regions[$block['region']]) && $block['status'] == 1) { drupal_set_message(t('The block %info was assigned to the invalid region %region and has been disabled.', array('%info' => $block['info'], '%region' => $block['region'])), 'warning'); // Disabled modules are moved into the BLOCK_REGION_NONE later so no // need to move the block to another region. $block['status'] = 0; } - // Set region to none if not enabled and make sure status is set. + // Set region to none if not enabled. if (empty($block['status'])) { $block['status'] = 0; $block['region'] = BLOCK_REGION_NONE; diff -Naur drupal-7.52/modules/block/tests/block_test.info drupal-7.58/modules/block/tests/block_test.info --- drupal-7.52/modules/block/tests/block_test.info 2016-11-16 20:02:02.000000000 +0100 +++ drupal-7.58/modules/block/tests/block_test.info 2018-03-28 21:06:59.000000000 +0200 @@ -5,8 +5,8 @@ core = 7.x hidden = TRUE -; Information added by Drupal.org packaging script on 2016-11-16 -version = "7.52" +; Information added by Drupal.org packaging script on 2018-03-28 +version = "7.58" project = "drupal" -datestamp = "1479322922" +datestamp = "1522264019" diff -Naur drupal-7.52/modules/block/tests/themes/block_test_theme/block_test_theme.info drupal-7.58/modules/block/tests/themes/block_test_theme/block_test_theme.info --- drupal-7.52/modules/block/tests/themes/block_test_theme/block_test_theme.info 2016-11-16 20:02:02.000000000 +0100 +++ drupal-7.58/modules/block/tests/themes/block_test_theme/block_test_theme.info 2018-03-28 21:06:59.000000000 +0200 @@ -13,8 +13,8 @@ regions[highlighted] = Highlighted regions[help] = Help -; Information added by Drupal.org packaging script on 2016-11-16 -version = "7.52" +; Information added by Drupal.org packaging script on 2018-03-28 +version = "7.58" project = "drupal" -datestamp = "1479322922" +datestamp = "1522264019" diff -Naur drupal-7.52/modules/blog/blog.info drupal-7.58/modules/blog/blog.info --- drupal-7.52/modules/blog/blog.info 2016-11-16 20:02:02.000000000 +0100 +++ drupal-7.58/modules/blog/blog.info 2018-03-28 21:06:59.000000000 +0200 @@ -5,8 +5,8 @@ core = 7.x files[] = blog.test -; Information added by Drupal.org packaging script on 2016-11-16 -version = "7.52" +; Information added by Drupal.org packaging script on 2018-03-28 +version = "7.58" project = "drupal" -datestamp = "1479322922" +datestamp = "1522264019" diff -Naur drupal-7.52/modules/book/book.info drupal-7.58/modules/book/book.info --- drupal-7.52/modules/book/book.info 2016-11-16 20:02:02.000000000 +0100 +++ drupal-7.58/modules/book/book.info 2018-03-28 21:06:59.000000000 +0200 @@ -7,8 +7,8 @@ configure = admin/content/book/settings stylesheets[all][] = book.css -; Information added by Drupal.org packaging script on 2016-11-16 -version = "7.52" +; Information added by Drupal.org packaging script on 2018-03-28 +version = "7.58" project = "drupal" -datestamp = "1479322922" +datestamp = "1522264019" diff -Naur drupal-7.52/modules/color/color.info drupal-7.58/modules/color/color.info --- drupal-7.52/modules/color/color.info 2016-11-16 20:02:02.000000000 +0100 +++ drupal-7.58/modules/color/color.info 2018-03-28 21:06:59.000000000 +0200 @@ -5,8 +5,8 @@ core = 7.x files[] = color.test -; Information added by Drupal.org packaging script on 2016-11-16 -version = "7.52" +; Information added by Drupal.org packaging script on 2018-03-28 +version = "7.58" project = "drupal" -datestamp = "1479322922" +datestamp = "1522264019" diff -Naur drupal-7.52/modules/color/color.test drupal-7.58/modules/color/color.test --- drupal-7.52/modules/color/color.test 2016-11-16 19:53:45.000000000 +0100 +++ drupal-7.58/modules/color/color.test 2018-03-27 21:28:19.000000000 +0200 @@ -122,7 +122,7 @@ $edit['palette[bg]'] = $color; $this->drupalPost($settings_path, $edit, t('Save configuration')); - if($is_valid) { + if ($is_valid) { $this->assertText('The configuration options have been saved.'); } else { diff -Naur drupal-7.52/modules/comment/comment.info drupal-7.58/modules/comment/comment.info --- drupal-7.52/modules/comment/comment.info 2016-11-16 20:02:02.000000000 +0100 +++ drupal-7.58/modules/comment/comment.info 2018-03-28 21:06:59.000000000 +0200 @@ -9,8 +9,8 @@ configure = admin/content/comment stylesheets[all][] = comment.css -; Information added by Drupal.org packaging script on 2016-11-16 -version = "7.52" +; Information added by Drupal.org packaging script on 2018-03-28 +version = "7.58" project = "drupal" -datestamp = "1479322922" +datestamp = "1522264019" diff -Naur drupal-7.52/modules/comment/comment.test drupal-7.58/modules/comment/comment.test --- drupal-7.52/modules/comment/comment.test 2016-11-16 19:53:45.000000000 +0100 +++ drupal-7.58/modules/comment/comment.test 2018-03-27 21:28:19.000000000 +0200 @@ -11,7 +11,13 @@ protected $node; function setUp() { - parent::setUp('comment', 'search'); + $modules = func_get_args(); + if (isset($modules[0]) && is_array($modules[0])) { + $modules = $modules[0]; + } + $modules[] = 'comment'; + parent::setUp($modules); + // Create users and test node. $this->admin_user = $this->drupalCreateUser(array('administer content types', 'administer comments', 'administer blocks', 'administer actions', 'administer fields')); $this->web_user = $this->drupalCreateUser(array('access comments', 'post comments', 'create article content', 'edit own comments')); @@ -1490,7 +1496,7 @@ } function setUp() { - DrupalWebTestCase::setUp('comment', 'search', 'node_access_test'); + parent::setUp('search', 'node_access_test'); node_access_rebuild(); // Create users and test node. diff -Naur drupal-7.52/modules/contact/contact.info drupal-7.58/modules/contact/contact.info --- drupal-7.52/modules/contact/contact.info 2016-11-16 20:02:02.000000000 +0100 +++ drupal-7.58/modules/contact/contact.info 2018-03-28 21:06:59.000000000 +0200 @@ -6,8 +6,8 @@ files[] = contact.test configure = admin/structure/contact -; Information added by Drupal.org packaging script on 2016-11-16 -version = "7.52" +; Information added by Drupal.org packaging script on 2018-03-28 +version = "7.58" project = "drupal" -datestamp = "1479322922" +datestamp = "1522264019" diff -Naur drupal-7.52/modules/contact/contact.module drupal-7.58/modules/contact/contact.module --- drupal-7.52/modules/contact/contact.module 2016-11-16 19:53:45.000000000 +0100 +++ drupal-7.58/modules/contact/contact.module 2018-03-27 21:28:19.000000000 +0200 @@ -234,7 +234,14 @@ * Implements hook_user_presave(). */ function contact_user_presave(&$edit, $account, $category) { - $edit['data']['contact'] = isset($edit['contact']) ? $edit['contact'] : variable_get('contact_default_status', 1); + if (isset($edit['contact'])) { + // Set new value. + $edit['data']['contact'] = $edit['contact']; + } + elseif (!isset($account->data['contact'])) { + // Use default if none has been set. + $edit['data']['contact'] = variable_get('contact_default_status', 1); + } } /** diff -Naur drupal-7.52/modules/contact/contact.test drupal-7.58/modules/contact/contact.test --- drupal-7.52/modules/contact/contact.test 2016-11-16 19:53:45.000000000 +0100 +++ drupal-7.58/modules/contact/contact.test 2018-03-27 21:28:19.000000000 +0200 @@ -346,6 +346,28 @@ $this->drupalGet('user/' . $this->contact_user->uid . '/contact'); $this->assertResponse(200); + // Test that users can disable their contact form. + $this->drupalLogin($this->contact_user); + $edit = array('contact' => FALSE); + $this->drupalPost('user/' . $this->contact_user->uid . '/edit', $edit, 'Save'); + $this->drupalLogout(); + $this->drupalGet('user/' . $this->contact_user->uid . '/contact'); + $this->assertResponse(403); + + // Test that user's contact status stays disabled when saving. + $contact_user_temp = user_load($this->contact_user->uid, TRUE); + user_save($contact_user_temp); + $this->drupalGet('user/' . $this->contact_user->uid . '/contact'); + $this->assertResponse(403); + + // Test that users can enable their contact form. + $this->drupalLogin($this->contact_user); + $edit = array('contact' => TRUE); + $this->drupalPost('user/' . $this->contact_user->uid . '/edit', $edit, 'Save'); + $this->drupalLogout(); + $this->drupalGet('user/' . $this->contact_user->uid . '/contact'); + $this->assertResponse(200); + // Revoke the personal contact permission for the anonymous user. user_role_revoke_permissions(DRUPAL_ANONYMOUS_RID, array('access user contact forms')); $this->drupalGet('user/' . $this->contact_user->uid . '/contact'); diff -Naur drupal-7.52/modules/contextual/contextual.info drupal-7.58/modules/contextual/contextual.info --- drupal-7.52/modules/contextual/contextual.info 2016-11-16 20:02:02.000000000 +0100 +++ drupal-7.58/modules/contextual/contextual.info 2018-03-28 21:06:59.000000000 +0200 @@ -5,8 +5,8 @@ core = 7.x files[] = contextual.test -; Information added by Drupal.org packaging script on 2016-11-16 -version = "7.52" +; Information added by Drupal.org packaging script on 2018-03-28 +version = "7.58" project = "drupal" -datestamp = "1479322922" +datestamp = "1522264019" diff -Naur drupal-7.52/modules/dashboard/dashboard.info drupal-7.58/modules/dashboard/dashboard.info --- drupal-7.52/modules/dashboard/dashboard.info 2016-11-16 20:02:02.000000000 +0100 +++ drupal-7.58/modules/dashboard/dashboard.info 2018-03-28 21:06:59.000000000 +0200 @@ -7,8 +7,8 @@ dependencies[] = block configure = admin/dashboard/customize -; Information added by Drupal.org packaging script on 2016-11-16 -version = "7.52" +; Information added by Drupal.org packaging script on 2018-03-28 +version = "7.58" project = "drupal" -datestamp = "1479322922" +datestamp = "1522264019" diff -Naur drupal-7.52/modules/dblog/dblog.admin.inc drupal-7.58/modules/dblog/dblog.admin.inc --- drupal-7.52/modules/dblog/dblog.admin.inc 2016-11-16 19:53:45.000000000 +0100 +++ drupal-7.58/modules/dblog/dblog.admin.inc 2018-03-27 21:28:19.000000000 +0200 @@ -420,6 +420,6 @@ */ function dblog_clear_log_submit() { $_SESSION['dblog_overview_filter'] = array(); - db_delete('watchdog')->execute(); + db_truncate('watchdog')->execute(); drupal_set_message(t('Database log cleared.')); } diff -Naur drupal-7.52/modules/dblog/dblog.info drupal-7.58/modules/dblog/dblog.info --- drupal-7.52/modules/dblog/dblog.info 2016-11-16 20:02:02.000000000 +0100 +++ drupal-7.58/modules/dblog/dblog.info 2018-03-28 21:06:59.000000000 +0200 @@ -5,8 +5,8 @@ core = 7.x files[] = dblog.test -; Information added by Drupal.org packaging script on 2016-11-16 -version = "7.52" +; Information added by Drupal.org packaging script on 2018-03-28 +version = "7.58" project = "drupal" -datestamp = "1479322922" +datestamp = "1522264019" diff -Naur drupal-7.52/modules/field/field.info drupal-7.58/modules/field/field.info --- drupal-7.52/modules/field/field.info 2016-11-16 20:02:02.000000000 +0100 +++ drupal-7.58/modules/field/field.info 2018-03-28 21:06:59.000000000 +0200 @@ -11,8 +11,8 @@ required = TRUE stylesheets[all][] = theme/field.css -; Information added by Drupal.org packaging script on 2016-11-16 -version = "7.52" +; Information added by Drupal.org packaging script on 2018-03-28 +version = "7.58" project = "drupal" -datestamp = "1479322922" +datestamp = "1522264019" diff -Naur drupal-7.52/modules/field/modules/field_sql_storage/field_sql_storage.info drupal-7.58/modules/field/modules/field_sql_storage/field_sql_storage.info --- drupal-7.52/modules/field/modules/field_sql_storage/field_sql_storage.info 2016-11-16 20:02:02.000000000 +0100 +++ drupal-7.58/modules/field/modules/field_sql_storage/field_sql_storage.info 2018-03-28 21:06:59.000000000 +0200 @@ -7,8 +7,8 @@ files[] = field_sql_storage.test required = TRUE -; Information added by Drupal.org packaging script on 2016-11-16 -version = "7.52" +; Information added by Drupal.org packaging script on 2018-03-28 +version = "7.58" project = "drupal" -datestamp = "1479322922" +datestamp = "1522264019" diff -Naur drupal-7.52/modules/field/modules/list/list.info drupal-7.58/modules/field/modules/list/list.info --- drupal-7.52/modules/field/modules/list/list.info 2016-11-16 20:02:02.000000000 +0100 +++ drupal-7.58/modules/field/modules/list/list.info 2018-03-28 21:06:59.000000000 +0200 @@ -7,8 +7,8 @@ dependencies[] = options files[] = tests/list.test -; Information added by Drupal.org packaging script on 2016-11-16 -version = "7.52" +; Information added by Drupal.org packaging script on 2018-03-28 +version = "7.58" project = "drupal" -datestamp = "1479322922" +datestamp = "1522264019" diff -Naur drupal-7.52/modules/field/modules/list/tests/list_test.info drupal-7.58/modules/field/modules/list/tests/list_test.info --- drupal-7.52/modules/field/modules/list/tests/list_test.info 2016-11-16 20:02:02.000000000 +0100 +++ drupal-7.58/modules/field/modules/list/tests/list_test.info 2018-03-28 21:06:59.000000000 +0200 @@ -5,8 +5,8 @@ version = VERSION hidden = TRUE -; Information added by Drupal.org packaging script on 2016-11-16 -version = "7.52" +; Information added by Drupal.org packaging script on 2018-03-28 +version = "7.58" project = "drupal" -datestamp = "1479322922" +datestamp = "1522264019" diff -Naur drupal-7.52/modules/field/modules/number/number.info drupal-7.58/modules/field/modules/number/number.info --- drupal-7.52/modules/field/modules/number/number.info 2016-11-16 20:02:02.000000000 +0100 +++ drupal-7.58/modules/field/modules/number/number.info 2018-03-28 21:06:59.000000000 +0200 @@ -6,8 +6,8 @@ dependencies[] = field files[] = number.test -; Information added by Drupal.org packaging script on 2016-11-16 -version = "7.52" +; Information added by Drupal.org packaging script on 2018-03-28 +version = "7.58" project = "drupal" -datestamp = "1479322922" +datestamp = "1522264019" diff -Naur drupal-7.52/modules/field/modules/number/number.module drupal-7.58/modules/field/modules/number/number.module --- drupal-7.52/modules/field/modules/number/number.module 2016-11-16 19:53:45.000000000 +0100 +++ drupal-7.58/modules/field/modules/number/number.module 2018-03-27 21:28:19.000000000 +0200 @@ -164,6 +164,15 @@ } } } + if ($field['type'] == 'number_float') { + // Remove the decimal point from float values with decimal + // point but no decimal numbers. + foreach ($items as $delta => $item) { + if (isset($item['value'])) { + $items[$delta]['value'] = floatval($item['value']); + } + } + } } /** diff -Naur drupal-7.52/modules/field/modules/number/number.test drupal-7.58/modules/field/modules/number/number.test --- drupal-7.52/modules/field/modules/number/number.test 2016-11-16 19:53:45.000000000 +0100 +++ drupal-7.58/modules/field/modules/number/number.test 2018-03-27 21:28:19.000000000 +0200 @@ -152,4 +152,50 @@ ); $this->drupalPost(NULL, $edit, t('Save')); } + + /** + * Test number_float field. + */ + function testNumberFloatField() { + $this->field = array( + 'field_name' => drupal_strtolower($this->randomName()), + 'type' => 'number_float', + 'settings' => array( + 'precision' => 8, 'scale' => 4, 'decimal_separator' => '.', + ) + ); + field_create_field($this->field); + $this->instance = array( + 'field_name' => $this->field['field_name'], + 'entity_type' => 'test_entity', + 'bundle' => 'test_bundle', + 'widget' => array( + 'type' => 'number', + ), + 'display' => array( + 'default' => array( + 'type' => 'number_float', + ), + ), + ); + field_create_instance($this->instance); + + $langcode = LANGUAGE_NONE; + $value = array( + '9.' => '9', + '.' => '0', + '123.55' => '123.55', + '.55' => '0.55', + '-0.55' => '-0.55', + ); + foreach($value as $key => $value) { + $edit = array( + "{$this->field['field_name']}[$langcode][0][value]" => $key, + ); + $this->drupalPost('test-entity/add/test-bundle', $edit, t('Save')); + $this->assertNoText("PDOException"); + $this->assertRaw($value, 'Correct value is displayed.'); + } + } + } diff -Naur drupal-7.52/modules/field/modules/options/options.info drupal-7.58/modules/field/modules/options/options.info --- drupal-7.52/modules/field/modules/options/options.info 2016-11-16 20:02:02.000000000 +0100 +++ drupal-7.58/modules/field/modules/options/options.info 2018-03-28 21:06:59.000000000 +0200 @@ -6,8 +6,8 @@ dependencies[] = field files[] = options.test -; Information added by Drupal.org packaging script on 2016-11-16 -version = "7.52" +; Information added by Drupal.org packaging script on 2018-03-28 +version = "7.58" project = "drupal" -datestamp = "1479322922" +datestamp = "1522264019" diff -Naur drupal-7.52/modules/field/modules/options/options.test drupal-7.58/modules/field/modules/options/options.test --- drupal-7.52/modules/field/modules/options/options.test 2016-11-16 19:53:45.000000000 +0100 +++ drupal-7.58/modules/field/modules/options/options.test 2018-03-27 21:28:19.000000000 +0200 @@ -23,8 +23,15 @@ 'type' => 'list_integer', 'cardinality' => 1, 'settings' => array( - // Make sure that 0 works as an option. - 'allowed_values' => array(0 => 'Zero', 1 => 'One', 2 => 'Some & unescaped markup', 3 => 'Some HTML encoded markup with < & >'), + 'allowed_values' => array( + // Make sure that 0 works as an option. + 0 => 'Zero', + 1 => 'One', + // Make sure that option text is properly sanitized. + 2 => 'Some & unescaped markup', + // Make sure that HTML entities in option text are not double-encoded. + 3 => 'Some HTML encoded markup with < & >', + ), ), ); $this->card_1 = field_create_field($this->card_1); @@ -35,8 +42,13 @@ 'type' => 'list_integer', 'cardinality' => 2, 'settings' => array( - // Make sure that 0 works as an option. - 'allowed_values' => array(0 => 'Zero', 1 => 'One', 2 => 'Some & unescaped markup'), + 'allowed_values' => array( + // Make sure that 0 works as an option. + 0 => 'Zero', + 1 => 'One', + // Make sure that option text is properly sanitized. + 2 => 'Some & unescaped markup', + ), ), ); $this->card_2 = field_create_field($this->card_2); @@ -47,8 +59,12 @@ 'type' => 'list_boolean', 'cardinality' => 1, 'settings' => array( - // Make sure that 0 works as a 'on' value'. - 'allowed_values' => array(1 => 'Zero', 0 => 'Some & unescaped markup'), + 'allowed_values' => array( + // Make sure that 1 works as a 'on' value'. + 1 => 'Zero', + // Make sure that option text is properly sanitized. + 0 => 'Some & unescaped markup', + ), ), ); $this->bool = field_create_field($this->bool); diff -Naur drupal-7.52/modules/field/modules/text/text.info drupal-7.58/modules/field/modules/text/text.info --- drupal-7.52/modules/field/modules/text/text.info 2016-11-16 20:02:02.000000000 +0100 +++ drupal-7.58/modules/field/modules/text/text.info 2018-03-28 21:06:59.000000000 +0200 @@ -7,8 +7,8 @@ files[] = text.test required = TRUE -; Information added by Drupal.org packaging script on 2016-11-16 -version = "7.52" +; Information added by Drupal.org packaging script on 2018-03-28 +version = "7.58" project = "drupal" -datestamp = "1479322922" +datestamp = "1522264019" diff -Naur drupal-7.52/modules/field/tests/field_test.info drupal-7.58/modules/field/tests/field_test.info --- drupal-7.52/modules/field/tests/field_test.info 2016-11-16 20:02:02.000000000 +0100 +++ drupal-7.58/modules/field/tests/field_test.info 2018-03-28 21:06:59.000000000 +0200 @@ -6,8 +6,8 @@ version = VERSION hidden = TRUE -; Information added by Drupal.org packaging script on 2016-11-16 -version = "7.52" +; Information added by Drupal.org packaging script on 2018-03-28 +version = "7.58" project = "drupal" -datestamp = "1479322922" +datestamp = "1522264019" diff -Naur drupal-7.52/modules/field/theme/field.tpl.php drupal-7.58/modules/field/theme/field.tpl.php --- drupal-7.52/modules/field/theme/field.tpl.php 2016-11-16 19:53:45.000000000 +0100 +++ drupal-7.58/modules/field/theme/field.tpl.php 2018-03-27 21:28:19.000000000 +0200 @@ -4,8 +4,10 @@ * @file field.tpl.php * Default template implementation to display the value of a field. * - * This file is not used and is here as a starting point for customization only. - * @see theme_field() + * This file is not used by Drupal core, which uses theme functions instead for + * performance reasons. The markup is the same, though, so if you want to use + * template files rather than functions to extend field theming, copy this to + * your custom theme. See theme_field() for a discussion of performance. * * Available variables: * - $items: An array of field values. Use render() to output them. @@ -45,7 +47,7 @@ */ ?> ' placeholder. if ($mode) { $content = $match[1]; - $hash = md5($content); + $hash = hash('sha256', $content); $comments[$hash] = $content; return ""; } diff -Naur drupal-7.52/modules/forum/forum.info drupal-7.58/modules/forum/forum.info --- drupal-7.52/modules/forum/forum.info 2016-11-16 20:02:02.000000000 +0100 +++ drupal-7.58/modules/forum/forum.info 2018-03-28 21:06:59.000000000 +0200 @@ -9,8 +9,8 @@ configure = admin/structure/forum stylesheets[all][] = forum.css -; Information added by Drupal.org packaging script on 2016-11-16 -version = "7.52" +; Information added by Drupal.org packaging script on 2018-03-28 +version = "7.58" project = "drupal" -datestamp = "1479322922" +datestamp = "1522264019" diff -Naur drupal-7.52/modules/help/help.info drupal-7.58/modules/help/help.info --- drupal-7.52/modules/help/help.info 2016-11-16 20:02:02.000000000 +0100 +++ drupal-7.58/modules/help/help.info 2018-03-28 21:06:59.000000000 +0200 @@ -5,8 +5,8 @@ core = 7.x files[] = help.test -; Information added by Drupal.org packaging script on 2016-11-16 -version = "7.52" +; Information added by Drupal.org packaging script on 2018-03-28 +version = "7.58" project = "drupal" -datestamp = "1479322922" +datestamp = "1522264019" diff -Naur drupal-7.52/modules/image/image.info drupal-7.58/modules/image/image.info --- drupal-7.52/modules/image/image.info 2016-11-16 20:02:02.000000000 +0100 +++ drupal-7.58/modules/image/image.info 2018-03-28 21:06:59.000000000 +0200 @@ -7,8 +7,8 @@ files[] = image.test configure = admin/config/media/image-styles -; Information added by Drupal.org packaging script on 2016-11-16 -version = "7.52" +; Information added by Drupal.org packaging script on 2018-03-28 +version = "7.58" project = "drupal" -datestamp = "1479322922" +datestamp = "1522264019" diff -Naur drupal-7.52/modules/image/tests/image_module_test.info drupal-7.58/modules/image/tests/image_module_test.info --- drupal-7.52/modules/image/tests/image_module_test.info 2016-11-16 20:02:02.000000000 +0100 +++ drupal-7.58/modules/image/tests/image_module_test.info 2018-03-28 21:06:59.000000000 +0200 @@ -6,8 +6,8 @@ files[] = image_module_test.module hidden = TRUE -; Information added by Drupal.org packaging script on 2016-11-16 -version = "7.52" +; Information added by Drupal.org packaging script on 2018-03-28 +version = "7.58" project = "drupal" -datestamp = "1479322922" +datestamp = "1522264019" diff -Naur drupal-7.52/modules/locale/locale.info drupal-7.58/modules/locale/locale.info --- drupal-7.52/modules/locale/locale.info 2016-11-16 20:02:02.000000000 +0100 +++ drupal-7.58/modules/locale/locale.info 2018-03-28 21:06:59.000000000 +0200 @@ -6,8 +6,8 @@ files[] = locale.test configure = admin/config/regional/language -; Information added by Drupal.org packaging script on 2016-11-16 -version = "7.52" +; Information added by Drupal.org packaging script on 2018-03-28 +version = "7.58" project = "drupal" -datestamp = "1479322922" +datestamp = "1522264019" diff -Naur drupal-7.52/modules/locale/locale.test drupal-7.58/modules/locale/locale.test --- drupal-7.52/modules/locale/locale.test 2016-11-16 19:53:45.000000000 +0100 +++ drupal-7.58/modules/locale/locale.test 2018-03-27 21:28:19.000000000 +0200 @@ -819,7 +819,7 @@ * Additional options to pass to the translation import form. */ function importPoFile($contents, array $options = array()) { - $name = tempnam('temporary://', "po_") . '.po'; + $name = drupal_tempnam('temporary://', "po_") . '.po'; file_put_contents($name, $contents); $options['files[file]'] = $name; $this->drupalPost('admin/config/regional/translate/import', $options, t('Import')); @@ -1113,7 +1113,7 @@ * Additional options to pass to the translation import form. */ function importPoFile($contents, array $options = array()) { - $name = tempnam('temporary://', "po_") . '.po'; + $name = drupal_tempnam('temporary://', "po_") . '.po'; file_put_contents($name, $contents); $options['files[file]'] = $name; $this->drupalPost('admin/config/regional/translate/import', $options, t('Import')); @@ -1340,7 +1340,7 @@ function testExportTranslation() { // First import some known translations. // This will also automatically enable the 'fr' language. - $name = tempnam('temporary://', "po_") . '.po'; + $name = drupal_tempnam('temporary://', "po_") . '.po'; file_put_contents($name, $this->getPoFile()); $this->drupalPost('admin/config/regional/translate/import', array( 'langcode' => 'fr', diff -Naur drupal-7.52/modules/locale/tests/locale_test.info drupal-7.58/modules/locale/tests/locale_test.info --- drupal-7.52/modules/locale/tests/locale_test.info 2016-11-16 20:02:02.000000000 +0100 +++ drupal-7.58/modules/locale/tests/locale_test.info 2018-03-28 21:06:59.000000000 +0200 @@ -5,8 +5,8 @@ version = VERSION hidden = TRUE -; Information added by Drupal.org packaging script on 2016-11-16 -version = "7.52" +; Information added by Drupal.org packaging script on 2018-03-28 +version = "7.58" project = "drupal" -datestamp = "1479322922" +datestamp = "1522264019" diff -Naur drupal-7.52/modules/menu/menu.info drupal-7.58/modules/menu/menu.info --- drupal-7.52/modules/menu/menu.info 2016-11-16 20:02:02.000000000 +0100 +++ drupal-7.58/modules/menu/menu.info 2018-03-28 21:06:59.000000000 +0200 @@ -6,8 +6,8 @@ files[] = menu.test configure = admin/structure/menu -; Information added by Drupal.org packaging script on 2016-11-16 -version = "7.52" +; Information added by Drupal.org packaging script on 2018-03-28 +version = "7.58" project = "drupal" -datestamp = "1479322922" +datestamp = "1522264019" diff -Naur drupal-7.52/modules/node/node.info drupal-7.58/modules/node/node.info --- drupal-7.52/modules/node/node.info 2016-11-16 20:02:02.000000000 +0100 +++ drupal-7.58/modules/node/node.info 2018-03-28 21:06:59.000000000 +0200 @@ -9,8 +9,8 @@ configure = admin/structure/types stylesheets[all][] = node.css -; Information added by Drupal.org packaging script on 2016-11-16 -version = "7.52" +; Information added by Drupal.org packaging script on 2018-03-28 +version = "7.58" project = "drupal" -datestamp = "1479322922" +datestamp = "1522264019" diff -Naur drupal-7.52/modules/node/tests/node_access_test.info drupal-7.58/modules/node/tests/node_access_test.info --- drupal-7.52/modules/node/tests/node_access_test.info 2016-11-16 20:02:02.000000000 +0100 +++ drupal-7.58/modules/node/tests/node_access_test.info 2018-03-28 21:06:59.000000000 +0200 @@ -5,8 +5,8 @@ core = 7.x hidden = TRUE -; Information added by Drupal.org packaging script on 2016-11-16 -version = "7.52" +; Information added by Drupal.org packaging script on 2018-03-28 +version = "7.58" project = "drupal" -datestamp = "1479322922" +datestamp = "1522264019" diff -Naur drupal-7.52/modules/node/tests/node_test.info drupal-7.58/modules/node/tests/node_test.info --- drupal-7.52/modules/node/tests/node_test.info 2016-11-16 20:02:02.000000000 +0100 +++ drupal-7.58/modules/node/tests/node_test.info 2018-03-28 21:06:59.000000000 +0200 @@ -5,8 +5,8 @@ core = 7.x hidden = TRUE -; Information added by Drupal.org packaging script on 2016-11-16 -version = "7.52" +; Information added by Drupal.org packaging script on 2018-03-28 +version = "7.58" project = "drupal" -datestamp = "1479322922" +datestamp = "1522264019" diff -Naur drupal-7.52/modules/node/tests/node_test_exception.info drupal-7.58/modules/node/tests/node_test_exception.info --- drupal-7.52/modules/node/tests/node_test_exception.info 2016-11-16 20:02:02.000000000 +0100 +++ drupal-7.58/modules/node/tests/node_test_exception.info 2018-03-28 21:06:59.000000000 +0200 @@ -5,8 +5,8 @@ core = 7.x hidden = TRUE -; Information added by Drupal.org packaging script on 2016-11-16 -version = "7.52" +; Information added by Drupal.org packaging script on 2018-03-28 +version = "7.58" project = "drupal" -datestamp = "1479322922" +datestamp = "1522264019" diff -Naur drupal-7.52/modules/openid/openid.info drupal-7.58/modules/openid/openid.info --- drupal-7.52/modules/openid/openid.info 2016-11-16 20:02:02.000000000 +0100 +++ drupal-7.58/modules/openid/openid.info 2018-03-28 21:06:59.000000000 +0200 @@ -5,8 +5,8 @@ core = 7.x files[] = openid.test -; Information added by Drupal.org packaging script on 2016-11-16 -version = "7.52" +; Information added by Drupal.org packaging script on 2018-03-28 +version = "7.58" project = "drupal" -datestamp = "1479322922" +datestamp = "1522264019" diff -Naur drupal-7.52/modules/openid/tests/openid_test.info drupal-7.58/modules/openid/tests/openid_test.info --- drupal-7.52/modules/openid/tests/openid_test.info 2016-11-16 20:02:02.000000000 +0100 +++ drupal-7.58/modules/openid/tests/openid_test.info 2018-03-28 21:06:59.000000000 +0200 @@ -6,8 +6,8 @@ dependencies[] = openid hidden = TRUE -; Information added by Drupal.org packaging script on 2016-11-16 -version = "7.52" +; Information added by Drupal.org packaging script on 2018-03-28 +version = "7.58" project = "drupal" -datestamp = "1479322922" +datestamp = "1522264019" diff -Naur drupal-7.52/modules/overlay/overlay.info drupal-7.58/modules/overlay/overlay.info --- drupal-7.52/modules/overlay/overlay.info 2016-11-16 20:02:02.000000000 +0100 +++ drupal-7.58/modules/overlay/overlay.info 2018-03-28 21:06:59.000000000 +0200 @@ -4,8 +4,8 @@ version = VERSION core = 7.x -; Information added by Drupal.org packaging script on 2016-11-16 -version = "7.52" +; Information added by Drupal.org packaging script on 2018-03-28 +version = "7.58" project = "drupal" -datestamp = "1479322922" +datestamp = "1522264019" diff -Naur drupal-7.52/modules/path/path.info drupal-7.58/modules/path/path.info --- drupal-7.52/modules/path/path.info 2016-11-16 20:02:02.000000000 +0100 +++ drupal-7.58/modules/path/path.info 2018-03-28 21:06:59.000000000 +0200 @@ -6,8 +6,8 @@ files[] = path.test configure = admin/config/search/path -; Information added by Drupal.org packaging script on 2016-11-16 -version = "7.52" +; Information added by Drupal.org packaging script on 2018-03-28 +version = "7.58" project = "drupal" -datestamp = "1479322922" +datestamp = "1522264019" diff -Naur drupal-7.52/modules/php/php.info drupal-7.58/modules/php/php.info --- drupal-7.52/modules/php/php.info 2016-11-16 20:02:02.000000000 +0100 +++ drupal-7.58/modules/php/php.info 2018-03-28 21:06:59.000000000 +0200 @@ -5,8 +5,8 @@ core = 7.x files[] = php.test -; Information added by Drupal.org packaging script on 2016-11-16 -version = "7.52" +; Information added by Drupal.org packaging script on 2018-03-28 +version = "7.58" project = "drupal" -datestamp = "1479322922" +datestamp = "1522264019" diff -Naur drupal-7.52/modules/poll/poll.info drupal-7.58/modules/poll/poll.info --- drupal-7.52/modules/poll/poll.info 2016-11-16 20:02:02.000000000 +0100 +++ drupal-7.58/modules/poll/poll.info 2018-03-28 21:06:59.000000000 +0200 @@ -6,8 +6,8 @@ files[] = poll.test stylesheets[all][] = poll.css -; Information added by Drupal.org packaging script on 2016-11-16 -version = "7.52" +; Information added by Drupal.org packaging script on 2018-03-28 +version = "7.58" project = "drupal" -datestamp = "1479322922" +datestamp = "1522264019" diff -Naur drupal-7.52/modules/profile/profile.info drupal-7.58/modules/profile/profile.info --- drupal-7.52/modules/profile/profile.info 2016-11-16 20:02:02.000000000 +0100 +++ drupal-7.58/modules/profile/profile.info 2018-03-28 21:06:59.000000000 +0200 @@ -11,8 +11,8 @@ ; See user_system_info_alter(). hidden = TRUE -; Information added by Drupal.org packaging script on 2016-11-16 -version = "7.52" +; Information added by Drupal.org packaging script on 2018-03-28 +version = "7.58" project = "drupal" -datestamp = "1479322922" +datestamp = "1522264019" diff -Naur drupal-7.52/modules/rdf/rdf.info drupal-7.58/modules/rdf/rdf.info --- drupal-7.52/modules/rdf/rdf.info 2016-11-16 20:02:02.000000000 +0100 +++ drupal-7.58/modules/rdf/rdf.info 2018-03-28 21:06:59.000000000 +0200 @@ -5,8 +5,8 @@ core = 7.x files[] = rdf.test -; Information added by Drupal.org packaging script on 2016-11-16 -version = "7.52" +; Information added by Drupal.org packaging script on 2018-03-28 +version = "7.58" project = "drupal" -datestamp = "1479322922" +datestamp = "1522264019" diff -Naur drupal-7.52/modules/rdf/tests/rdf_test.info drupal-7.58/modules/rdf/tests/rdf_test.info --- drupal-7.52/modules/rdf/tests/rdf_test.info 2016-11-16 20:02:02.000000000 +0100 +++ drupal-7.58/modules/rdf/tests/rdf_test.info 2018-03-28 21:06:59.000000000 +0200 @@ -6,8 +6,8 @@ hidden = TRUE dependencies[] = blog -; Information added by Drupal.org packaging script on 2016-11-16 -version = "7.52" +; Information added by Drupal.org packaging script on 2018-03-28 +version = "7.58" project = "drupal" -datestamp = "1479322922" +datestamp = "1522264019" diff -Naur drupal-7.52/modules/search/search.admin.inc drupal-7.58/modules/search/search.admin.inc --- drupal-7.52/modules/search/search.admin.inc 2016-11-16 19:53:45.000000000 +0100 +++ drupal-7.58/modules/search/search.admin.inc 2018-03-27 21:28:19.000000000 +0200 @@ -125,6 +125,16 @@ '#options' => $module_options, '#description' => t('Choose which search module is the default.') ); + $form['logging'] = array( + '#type' => 'fieldset', + '#title' => t('Logging') + ); + $form['logging']['search_logging'] = array( + '#type' => 'checkbox', + '#title' => t('Log searches'), + '#default_value' => variable_get('search_logging', 1), + '#description' => t('If checked, all searches will be logged. Uncheck to skip logging. Logging may affect performance.'), + ); $form['#validate'][] = 'search_admin_settings_validate'; $form['#submit'][] = 'search_admin_settings_submit'; diff -Naur drupal-7.52/modules/search/search.info drupal-7.58/modules/search/search.info --- drupal-7.52/modules/search/search.info 2016-11-16 20:02:02.000000000 +0100 +++ drupal-7.58/modules/search/search.info 2018-03-28 21:06:59.000000000 +0200 @@ -8,8 +8,8 @@ configure = admin/config/search/settings stylesheets[all][] = search.css -; Information added by Drupal.org packaging script on 2016-11-16 -version = "7.52" +; Information added by Drupal.org packaging script on 2018-03-28 +version = "7.58" project = "drupal" -datestamp = "1479322922" +datestamp = "1522264019" diff -Naur drupal-7.52/modules/search/search.install drupal-7.58/modules/search/search.install --- drupal-7.52/modules/search/search.install 2016-11-16 19:53:45.000000000 +0100 +++ drupal-7.58/modules/search/search.install 2018-03-27 21:28:19.000000000 +0200 @@ -12,6 +12,7 @@ variable_del('minimum_word_size'); variable_del('overlap_cjk'); variable_del('search_cron_limit'); + variable_del('search_logging'); } /** diff -Naur drupal-7.52/modules/search/search.pages.inc drupal-7.58/modules/search/search.pages.inc --- drupal-7.52/modules/search/search.pages.inc 2016-11-16 19:53:45.000000000 +0100 +++ drupal-7.58/modules/search/search.pages.inc 2018-03-27 21:28:19.000000000 +0200 @@ -57,9 +57,10 @@ } // Only search if there are keywords or non-empty conditions. if ($keys || !empty($conditions)) { - // Log the search keys. - watchdog('search', 'Searched %type for %keys.', array('%keys' => $keys, '%type' => $info['title']), WATCHDOG_NOTICE, l(t('results'), 'search/' . $info['path'] . '/' . $keys)); - + if (variable_get('search_logging', TRUE)) { + // Log the search keys. + watchdog('search', 'Searched %type for %keys.', array('%keys' => $keys, '%type' => $info['title']), WATCHDOG_NOTICE, l(t('results'), 'search/' . $info['path'] . '/' . $keys)); + } // Collect the search results. $results = search_data($keys, $info['module'], $conditions); } diff -Naur drupal-7.52/modules/search/search.test drupal-7.58/modules/search/search.test --- drupal-7.52/modules/search/search.test 2016-11-16 19:53:45.000000000 +0100 +++ drupal-7.58/modules/search/search.test 2018-03-27 21:28:19.000000000 +0200 @@ -1453,7 +1453,7 @@ parent::setUp('search', 'search_extra_type'); // Login as a user that can create and search content. - $this->search_user = $this->drupalCreateUser(array('search content', 'administer search', 'administer nodes', 'bypass node access', 'access user profiles', 'administer users', 'administer blocks')); + $this->search_user = $this->drupalCreateUser(array('search content', 'administer search', 'administer nodes', 'bypass node access', 'access user profiles', 'administer users', 'administer blocks', 'access site reports')); $this->drupalLogin($this->search_user); // Add a single piece of content and index it. @@ -1502,6 +1502,19 @@ ); $this->drupalPost('admin/config/search/settings', $edit, t('Save configuration')); $this->assertNoText(t('The configuration options have been saved.'), 'Form does not save with an invalid word length.'); + + // Test logging setting. It should be on by default. + $text = $this->randomName(5); + $this->drupalPost('search/node', array('keys' => $text), t('Search')); + $this->drupalGet('admin/reports/dblog'); + $this->assertLink('Searched Content for ' . $text . '.', 0, 'Search was logged'); + + // Turn off logging. + variable_set('search_logging', FALSE); + $text = $this->randomName(5); + $this->drupalPost('search/node', array('keys' => $text), t('Search')); + $this->drupalGet('admin/reports/dblog'); + $this->assertNoLink('Searched Content for ' . $text . '.', 'Search was not logged'); } /** diff -Naur drupal-7.52/modules/search/tests/search_embedded_form.info drupal-7.58/modules/search/tests/search_embedded_form.info --- drupal-7.52/modules/search/tests/search_embedded_form.info 2016-11-16 20:02:02.000000000 +0100 +++ drupal-7.58/modules/search/tests/search_embedded_form.info 2018-03-28 21:06:59.000000000 +0200 @@ -5,8 +5,8 @@ core = 7.x hidden = TRUE -; Information added by Drupal.org packaging script on 2016-11-16 -version = "7.52" +; Information added by Drupal.org packaging script on 2018-03-28 +version = "7.58" project = "drupal" -datestamp = "1479322922" +datestamp = "1522264019" diff -Naur drupal-7.52/modules/search/tests/search_extra_type.info drupal-7.58/modules/search/tests/search_extra_type.info --- drupal-7.52/modules/search/tests/search_extra_type.info 2016-11-16 20:02:02.000000000 +0100 +++ drupal-7.58/modules/search/tests/search_extra_type.info 2018-03-28 21:06:59.000000000 +0200 @@ -5,8 +5,8 @@ core = 7.x hidden = TRUE -; Information added by Drupal.org packaging script on 2016-11-16 -version = "7.52" +; Information added by Drupal.org packaging script on 2018-03-28 +version = "7.58" project = "drupal" -datestamp = "1479322922" +datestamp = "1522264019" diff -Naur drupal-7.52/modules/search/tests/search_node_tags.info drupal-7.58/modules/search/tests/search_node_tags.info --- drupal-7.52/modules/search/tests/search_node_tags.info 2016-11-16 20:02:02.000000000 +0100 +++ drupal-7.58/modules/search/tests/search_node_tags.info 2018-03-28 21:06:59.000000000 +0200 @@ -5,8 +5,8 @@ core = 7.x hidden = TRUE -; Information added by Drupal.org packaging script on 2016-11-16 -version = "7.52" +; Information added by Drupal.org packaging script on 2018-03-28 +version = "7.58" project = "drupal" -datestamp = "1479322922" +datestamp = "1522264019" diff -Naur drupal-7.52/modules/shortcut/shortcut.info drupal-7.58/modules/shortcut/shortcut.info --- drupal-7.52/modules/shortcut/shortcut.info 2016-11-16 20:02:02.000000000 +0100 +++ drupal-7.58/modules/shortcut/shortcut.info 2018-03-28 21:06:59.000000000 +0200 @@ -6,8 +6,8 @@ files[] = shortcut.test configure = admin/config/user-interface/shortcut -; Information added by Drupal.org packaging script on 2016-11-16 -version = "7.52" +; Information added by Drupal.org packaging script on 2018-03-28 +version = "7.58" project = "drupal" -datestamp = "1479322922" +datestamp = "1522264019" diff -Naur drupal-7.52/modules/simpletest/drupal_web_test_case.php drupal-7.58/modules/simpletest/drupal_web_test_case.php --- drupal-7.52/modules/simpletest/drupal_web_test_case.php 2016-11-16 19:53:45.000000000 +0100 +++ drupal-7.58/modules/simpletest/drupal_web_test_case.php 2018-03-27 21:28:19.000000000 +0200 @@ -40,6 +40,13 @@ protected $originalFileDirectory = NULL; /** + * URL to the verbose output file directory. + * + * @var string + */ + protected $verboseDirectoryUrl; + + /** * Time limit for the test. */ protected $timeLimit = 500; @@ -461,8 +468,11 @@ protected function verbose($message) { if ($id = simpletest_verbose($message)) { $class_safe = str_replace('\\', '_', get_class($this)); - $url = file_create_url($this->originalFileDirectory . '/simpletest/verbose/' . $class_safe . '-' . $id . '.html'); - $this->error(l(t('Verbose message'), $url, array('attributes' => array('target' => '_blank'))), 'User notice'); + $url = $this->verboseDirectoryUrl . '/' . $class_safe . '-' . $id . '.html'; + // Not using l() to avoid invoking the theme system, so that unit tests + // can use verbose() as well. + $link = '' . t('Verbose message') . ''; + $this->error($link, 'User notice'); } } @@ -719,10 +729,17 @@ * method. */ protected function setUp() { - global $conf; + global $conf, $language; // Store necessary current values before switching to the test environment. $this->originalFileDirectory = variable_get('file_public_path', conf_path() . '/files'); + $this->verboseDirectoryUrl = file_create_url($this->originalFileDirectory . '/simpletest/verbose'); + + // Set up English language. + $this->originalLanguage = $language; + $this->originalLanguageDefault = variable_get('language_default'); + unset($conf['language_default']); + $language = language_default(); // Reset all statics so that test is performed with a clean environment. drupal_static_reset(); @@ -764,7 +781,7 @@ } protected function tearDown() { - global $conf; + global $conf, $language; // Get back to the original connection. Database::removeConnection('default'); @@ -775,6 +792,12 @@ if (isset($this->originalModuleList)) { module_list(TRUE, FALSE, FALSE, $this->originalModuleList); } + + // Reset language. + $language = $this->originalLanguage; + if ($this->originalLanguageDefault) { + $GLOBALS['conf']['language_default'] = $this->originalLanguageDefault; + } } } @@ -1374,12 +1397,14 @@ * @see DrupalWebTestCase::tearDown() */ protected function prepareEnvironment() { - global $user, $language, $conf; + global $user, $language, $language_url, $conf; // Store necessary current values before switching to prefixed database. $this->originalLanguage = $language; + $this->originalLanguageUrl = $language_url; $this->originalLanguageDefault = variable_get('language_default'); $this->originalFileDirectory = variable_get('file_public_path', conf_path() . '/files'); + $this->verboseDirectoryUrl = file_create_url($this->originalFileDirectory . '/simpletest/verbose'); $this->originalProfile = drupal_get_profile(); $this->originalCleanUrl = variable_get('clean_url', 0); $this->originalUser = $user; @@ -1387,7 +1412,7 @@ // Set to English to prevent exceptions from utf8_truncate() from t() // during install if the current language is not 'en'. // The following array/object conversion is copied from language_default(). - $language = (object) array('language' => 'en', 'name' => 'English', 'native' => 'English', 'direction' => 0, 'enabled' => 1, 'plurals' => 0, 'formula' => '', 'domain' => '', 'prefix' => '', 'weight' => 0, 'javascript' => ''); + $language_url = $language = (object) array('language' => 'en', 'name' => 'English', 'native' => 'English', 'direction' => 0, 'enabled' => 1, 'plurals' => 0, 'formula' => '', 'domain' => '', 'prefix' => '', 'weight' => 0, 'javascript' => ''); // Save and clean the shutdown callbacks array because it is static cached // and will be changed by the test run. Otherwise it will contain callbacks @@ -1445,7 +1470,7 @@ * @see DrupalWebTestCase::prepareEnvironment() */ protected function setUp() { - global $user, $language, $conf; + global $user, $language, $language_url, $conf; // Create the database prefix for this test. $this->prepareDatabasePrefix(); @@ -1542,7 +1567,7 @@ // Set up English language. unset($conf['language_default']); - $language = language_default(); + $language_url = $language = language_default(); // Use the test mail class instead of the default mail handler class. variable_set('mail_system', array('default-system' => 'TestingMailSystem')); @@ -1636,7 +1661,7 @@ * and reset the database prefix. */ protected function tearDown() { - global $user, $language; + global $user, $language, $language_url; // In case a fatal error occurred that was not in the test process read the // log to pick up any fatal errors. @@ -1701,6 +1726,7 @@ // Reset language. $language = $this->originalLanguage; + $language_url = $this->originalLanguageUrl; if ($this->originalLanguageDefault) { $GLOBALS['conf']['language_default'] = $this->originalLanguageDefault; } diff -Naur drupal-7.52/modules/simpletest/simpletest.info drupal-7.58/modules/simpletest/simpletest.info --- drupal-7.52/modules/simpletest/simpletest.info 2016-11-16 20:02:02.000000000 +0100 +++ drupal-7.58/modules/simpletest/simpletest.info 2018-03-28 21:06:59.000000000 +0200 @@ -57,8 +57,8 @@ files[] = tests/upgrade/update.field.test files[] = tests/upgrade/update.user.test -; Information added by Drupal.org packaging script on 2016-11-16 -version = "7.52" +; Information added by Drupal.org packaging script on 2018-03-28 +version = "7.58" project = "drupal" -datestamp = "1479322922" +datestamp = "1522264019" diff -Naur drupal-7.52/modules/simpletest/tests/actions_loop_test.info drupal-7.58/modules/simpletest/tests/actions_loop_test.info --- drupal-7.52/modules/simpletest/tests/actions_loop_test.info 2016-11-16 20:02:02.000000000 +0100 +++ drupal-7.58/modules/simpletest/tests/actions_loop_test.info 2018-03-28 21:06:59.000000000 +0200 @@ -5,8 +5,8 @@ core = 7.x hidden = TRUE -; Information added by Drupal.org packaging script on 2016-11-16 -version = "7.52" +; Information added by Drupal.org packaging script on 2018-03-28 +version = "7.58" project = "drupal" -datestamp = "1479322922" +datestamp = "1522264019" diff -Naur drupal-7.52/modules/simpletest/tests/ajax_forms_test.info drupal-7.58/modules/simpletest/tests/ajax_forms_test.info --- drupal-7.52/modules/simpletest/tests/ajax_forms_test.info 2016-11-16 20:02:02.000000000 +0100 +++ drupal-7.58/modules/simpletest/tests/ajax_forms_test.info 2018-03-28 21:06:59.000000000 +0200 @@ -5,8 +5,8 @@ version = VERSION hidden = TRUE -; Information added by Drupal.org packaging script on 2016-11-16 -version = "7.52" +; Information added by Drupal.org packaging script on 2018-03-28 +version = "7.58" project = "drupal" -datestamp = "1479322922" +datestamp = "1522264019" diff -Naur drupal-7.52/modules/simpletest/tests/ajax_test.info drupal-7.58/modules/simpletest/tests/ajax_test.info --- drupal-7.52/modules/simpletest/tests/ajax_test.info 2016-11-16 20:02:02.000000000 +0100 +++ drupal-7.58/modules/simpletest/tests/ajax_test.info 2018-03-28 21:06:59.000000000 +0200 @@ -5,8 +5,8 @@ core = 7.x hidden = TRUE -; Information added by Drupal.org packaging script on 2016-11-16 -version = "7.52" +; Information added by Drupal.org packaging script on 2018-03-28 +version = "7.58" project = "drupal" -datestamp = "1479322922" +datestamp = "1522264019" diff -Naur drupal-7.52/modules/simpletest/tests/batch_test.info drupal-7.58/modules/simpletest/tests/batch_test.info --- drupal-7.52/modules/simpletest/tests/batch_test.info 2016-11-16 20:02:02.000000000 +0100 +++ drupal-7.58/modules/simpletest/tests/batch_test.info 2018-03-28 21:06:59.000000000 +0200 @@ -5,8 +5,8 @@ core = 7.x hidden = TRUE -; Information added by Drupal.org packaging script on 2016-11-16 -version = "7.52" +; Information added by Drupal.org packaging script on 2018-03-28 +version = "7.58" project = "drupal" -datestamp = "1479322922" +datestamp = "1522264019" diff -Naur drupal-7.52/modules/simpletest/tests/boot_test_1.info drupal-7.58/modules/simpletest/tests/boot_test_1.info --- drupal-7.52/modules/simpletest/tests/boot_test_1.info 2016-11-16 20:02:02.000000000 +0100 +++ drupal-7.58/modules/simpletest/tests/boot_test_1.info 2018-03-28 21:06:59.000000000 +0200 @@ -5,8 +5,8 @@ version = VERSION hidden = TRUE -; Information added by Drupal.org packaging script on 2016-11-16 -version = "7.52" +; Information added by Drupal.org packaging script on 2018-03-28 +version = "7.58" project = "drupal" -datestamp = "1479322922" +datestamp = "1522264019" diff -Naur drupal-7.52/modules/simpletest/tests/boot_test_2.info drupal-7.58/modules/simpletest/tests/boot_test_2.info --- drupal-7.52/modules/simpletest/tests/boot_test_2.info 2016-11-16 20:02:02.000000000 +0100 +++ drupal-7.58/modules/simpletest/tests/boot_test_2.info 2018-03-28 21:06:59.000000000 +0200 @@ -5,8 +5,8 @@ version = VERSION hidden = TRUE -; Information added by Drupal.org packaging script on 2016-11-16 -version = "7.52" +; Information added by Drupal.org packaging script on 2018-03-28 +version = "7.58" project = "drupal" -datestamp = "1479322922" +datestamp = "1522264019" diff -Naur drupal-7.52/modules/simpletest/tests/common.test drupal-7.58/modules/simpletest/tests/common.test --- drupal-7.52/modules/simpletest/tests/common.test 2016-11-16 19:53:45.000000000 +0100 +++ drupal-7.58/modules/simpletest/tests/common.test 2018-03-27 21:28:19.000000000 +0200 @@ -76,7 +76,7 @@ class CommonURLUnitTest extends DrupalWebTestCase { public static function getInfo() { return array( - 'name' => 'URL generation tests', + 'name' => 'URL generation unit tests', 'description' => 'Confirm that url(), drupal_get_query_parameters(), drupal_http_build_query(), and l() work correctly with various input.', 'group' => 'System', ); @@ -169,7 +169,7 @@ $this->assertEqual(drupal_http_build_query(array('a' => ' &#//+%20@Ûž')), 'a=%20%26%23//%2B%2520%40%DB%9E', 'Value was properly encoded.'); $this->assertEqual(drupal_http_build_query(array(' &#//+%20@Ûž' => 'a')), '%20%26%23%2F%2F%2B%2520%40%DB%9E=a', 'Key was properly encoded.'); $this->assertEqual(drupal_http_build_query(array('a' => '1', 'b' => '2', 'c' => '3')), 'a=1&b=2&c=3', 'Multiple values were properly concatenated.'); - $this->assertEqual(drupal_http_build_query(array('a' => array('b' => '2', 'c' => '3'), 'd' => 'foo')), 'a[b]=2&a[c]=3&d=foo', 'Nested array was properly encoded.'); + $this->assertEqual(drupal_http_build_query(array('a' => array('b' => '2', 'c' => '3'), 'd' => 'foo')), 'a%5Bb%5D=2&a%5Bc%5D=3&d=foo', 'Nested array was properly encoded.'); } /** @@ -373,6 +373,38 @@ } /** + * Web tests for URL generation functions. + */ +class CommonURLWebTest extends DrupalWebTestCase { + public static function getInfo() { + return array( + 'name' => 'URL generation web tests', + 'description' => 'Confirm that URL-generating functions work correctly on specific site paths.', + 'group' => 'System', + ); + } + + function setUp() { + parent::setUp('common_test'); + } + + /** + * Tests the url() function on internal paths which mimic external URLs. + */ + function testInternalPathMimicsExternal() { + // Ensure that calling url(current_path()) on "/http://example.com" (an + // internal path which mimics an external URL) always links to the internal + // path, not the external URL. This helps protect against external URL link + // injection vulnerabilities. + variable_set('common_test_link_to_current_path', TRUE); + $this->drupalGet('/http://example.com'); + $this->clickLink('link which should point to the current path'); + $this->assertUrl('/http://example.com'); + $this->assertText('link which should point to the current path'); + } +} + +/** * Tests url_is_external(). */ class UrlIsExternalUnitTest extends DrupalUnitTestCase { diff -Naur drupal-7.52/modules/simpletest/tests/common_test.info drupal-7.58/modules/simpletest/tests/common_test.info --- drupal-7.52/modules/simpletest/tests/common_test.info 2016-11-16 20:02:02.000000000 +0100 +++ drupal-7.58/modules/simpletest/tests/common_test.info 2018-03-28 21:06:59.000000000 +0200 @@ -7,8 +7,8 @@ stylesheets[print][] = common_test.print.css hidden = TRUE -; Information added by Drupal.org packaging script on 2016-11-16 -version = "7.52" +; Information added by Drupal.org packaging script on 2018-03-28 +version = "7.58" project = "drupal" -datestamp = "1479322922" +datestamp = "1522264019" diff -Naur drupal-7.52/modules/simpletest/tests/common_test.module drupal-7.58/modules/simpletest/tests/common_test.module --- drupal-7.52/modules/simpletest/tests/common_test.module 2016-11-16 19:53:45.000000000 +0100 +++ drupal-7.58/modules/simpletest/tests/common_test.module 2018-03-27 21:28:19.000000000 +0200 @@ -99,6 +99,9 @@ if (variable_get('common_test_redirect_current_path', FALSE)) { drupal_goto(current_path()); } + if (variable_get('common_test_link_to_current_path', FALSE)) { + drupal_set_message(l('link which should point to the current path', current_path())); + } } /** diff -Naur drupal-7.52/modules/simpletest/tests/common_test_cron_helper.info drupal-7.58/modules/simpletest/tests/common_test_cron_helper.info --- drupal-7.52/modules/simpletest/tests/common_test_cron_helper.info 2016-11-16 20:02:02.000000000 +0100 +++ drupal-7.58/modules/simpletest/tests/common_test_cron_helper.info 2018-03-28 21:06:59.000000000 +0200 @@ -5,8 +5,8 @@ core = 7.x hidden = TRUE -; Information added by Drupal.org packaging script on 2016-11-16 -version = "7.52" +; Information added by Drupal.org packaging script on 2018-03-28 +version = "7.58" project = "drupal" -datestamp = "1479322922" +datestamp = "1522264019" diff -Naur drupal-7.52/modules/simpletest/tests/database_test.info drupal-7.58/modules/simpletest/tests/database_test.info --- drupal-7.52/modules/simpletest/tests/database_test.info 2016-11-16 20:02:02.000000000 +0100 +++ drupal-7.58/modules/simpletest/tests/database_test.info 2018-03-28 21:06:59.000000000 +0200 @@ -5,8 +5,8 @@ version = VERSION hidden = TRUE -; Information added by Drupal.org packaging script on 2016-11-16 -version = "7.52" +; Information added by Drupal.org packaging script on 2018-03-28 +version = "7.58" project = "drupal" -datestamp = "1479322922" +datestamp = "1522264019" diff -Naur drupal-7.52/modules/simpletest/tests/drupal_autoload_test/drupal_autoload_test.info drupal-7.58/modules/simpletest/tests/drupal_autoload_test/drupal_autoload_test.info --- drupal-7.52/modules/simpletest/tests/drupal_autoload_test/drupal_autoload_test.info 2016-11-16 20:02:02.000000000 +0100 +++ drupal-7.58/modules/simpletest/tests/drupal_autoload_test/drupal_autoload_test.info 2018-03-28 21:06:59.000000000 +0200 @@ -7,8 +7,8 @@ core = 7.x hidden = TRUE -; Information added by Drupal.org packaging script on 2016-11-16 -version = "7.52" +; Information added by Drupal.org packaging script on 2018-03-28 +version = "7.58" project = "drupal" -datestamp = "1479322922" +datestamp = "1522264019" diff -Naur drupal-7.52/modules/simpletest/tests/drupal_system_listing_compatible_test/drupal_system_listing_compatible_test.info drupal-7.58/modules/simpletest/tests/drupal_system_listing_compatible_test/drupal_system_listing_compatible_test.info --- drupal-7.52/modules/simpletest/tests/drupal_system_listing_compatible_test/drupal_system_listing_compatible_test.info 2016-11-16 20:02:02.000000000 +0100 +++ drupal-7.58/modules/simpletest/tests/drupal_system_listing_compatible_test/drupal_system_listing_compatible_test.info 2018-03-28 21:06:59.000000000 +0200 @@ -5,8 +5,8 @@ core = 7.x hidden = TRUE -; Information added by Drupal.org packaging script on 2016-11-16 -version = "7.52" +; Information added by Drupal.org packaging script on 2018-03-28 +version = "7.58" project = "drupal" -datestamp = "1479322922" +datestamp = "1522264019" diff -Naur drupal-7.52/modules/simpletest/tests/drupal_system_listing_incompatible_test/drupal_system_listing_incompatible_test.info drupal-7.58/modules/simpletest/tests/drupal_system_listing_incompatible_test/drupal_system_listing_incompatible_test.info --- drupal-7.52/modules/simpletest/tests/drupal_system_listing_incompatible_test/drupal_system_listing_incompatible_test.info 2016-11-16 20:02:02.000000000 +0100 +++ drupal-7.58/modules/simpletest/tests/drupal_system_listing_incompatible_test/drupal_system_listing_incompatible_test.info 2018-03-28 21:06:59.000000000 +0200 @@ -5,8 +5,8 @@ core = 7.x hidden = TRUE -; Information added by Drupal.org packaging script on 2016-11-16 -version = "7.52" +; Information added by Drupal.org packaging script on 2018-03-28 +version = "7.58" project = "drupal" -datestamp = "1479322922" +datestamp = "1522264019" diff -Naur drupal-7.52/modules/simpletest/tests/entity_cache_test.info drupal-7.58/modules/simpletest/tests/entity_cache_test.info --- drupal-7.52/modules/simpletest/tests/entity_cache_test.info 2016-11-16 20:02:02.000000000 +0100 +++ drupal-7.58/modules/simpletest/tests/entity_cache_test.info 2018-03-28 21:06:59.000000000 +0200 @@ -6,8 +6,8 @@ dependencies[] = entity_cache_test_dependency hidden = TRUE -; Information added by Drupal.org packaging script on 2016-11-16 -version = "7.52" +; Information added by Drupal.org packaging script on 2018-03-28 +version = "7.58" project = "drupal" -datestamp = "1479322922" +datestamp = "1522264019" diff -Naur drupal-7.52/modules/simpletest/tests/entity_cache_test_dependency.info drupal-7.58/modules/simpletest/tests/entity_cache_test_dependency.info --- drupal-7.52/modules/simpletest/tests/entity_cache_test_dependency.info 2016-11-16 20:02:02.000000000 +0100 +++ drupal-7.58/modules/simpletest/tests/entity_cache_test_dependency.info 2018-03-28 21:06:59.000000000 +0200 @@ -5,8 +5,8 @@ core = 7.x hidden = TRUE -; Information added by Drupal.org packaging script on 2016-11-16 -version = "7.52" +; Information added by Drupal.org packaging script on 2018-03-28 +version = "7.58" project = "drupal" -datestamp = "1479322922" +datestamp = "1522264019" diff -Naur drupal-7.52/modules/simpletest/tests/entity_crud_hook_test.info drupal-7.58/modules/simpletest/tests/entity_crud_hook_test.info --- drupal-7.52/modules/simpletest/tests/entity_crud_hook_test.info 2016-11-16 20:02:02.000000000 +0100 +++ drupal-7.58/modules/simpletest/tests/entity_crud_hook_test.info 2018-03-28 21:06:59.000000000 +0200 @@ -5,8 +5,8 @@ version = VERSION hidden = TRUE -; Information added by Drupal.org packaging script on 2016-11-16 -version = "7.52" +; Information added by Drupal.org packaging script on 2018-03-28 +version = "7.58" project = "drupal" -datestamp = "1479322922" +datestamp = "1522264019" diff -Naur drupal-7.52/modules/simpletest/tests/entity_query_access_test.info drupal-7.58/modules/simpletest/tests/entity_query_access_test.info --- drupal-7.52/modules/simpletest/tests/entity_query_access_test.info 2016-11-16 20:02:02.000000000 +0100 +++ drupal-7.58/modules/simpletest/tests/entity_query_access_test.info 2018-03-28 21:06:59.000000000 +0200 @@ -5,8 +5,8 @@ core = 7.x hidden = TRUE -; Information added by Drupal.org packaging script on 2016-11-16 -version = "7.52" +; Information added by Drupal.org packaging script on 2018-03-28 +version = "7.58" project = "drupal" -datestamp = "1479322922" +datestamp = "1522264019" diff -Naur drupal-7.52/modules/simpletest/tests/error_test.info drupal-7.58/modules/simpletest/tests/error_test.info --- drupal-7.52/modules/simpletest/tests/error_test.info 2016-11-16 20:02:02.000000000 +0100 +++ drupal-7.58/modules/simpletest/tests/error_test.info 2018-03-28 21:06:59.000000000 +0200 @@ -5,8 +5,8 @@ core = 7.x hidden = TRUE -; Information added by Drupal.org packaging script on 2016-11-16 -version = "7.52" +; Information added by Drupal.org packaging script on 2018-03-28 +version = "7.58" project = "drupal" -datestamp = "1479322922" +datestamp = "1522264019" diff -Naur drupal-7.52/modules/simpletest/tests/file_test.info drupal-7.58/modules/simpletest/tests/file_test.info --- drupal-7.52/modules/simpletest/tests/file_test.info 2016-11-16 20:02:02.000000000 +0100 +++ drupal-7.58/modules/simpletest/tests/file_test.info 2018-03-28 21:06:59.000000000 +0200 @@ -6,8 +6,8 @@ files[] = file_test.module hidden = TRUE -; Information added by Drupal.org packaging script on 2016-11-16 -version = "7.52" +; Information added by Drupal.org packaging script on 2018-03-28 +version = "7.58" project = "drupal" -datestamp = "1479322922" +datestamp = "1522264019" diff -Naur drupal-7.52/modules/simpletest/tests/filter_test.info drupal-7.58/modules/simpletest/tests/filter_test.info --- drupal-7.52/modules/simpletest/tests/filter_test.info 2016-11-16 20:02:02.000000000 +0100 +++ drupal-7.58/modules/simpletest/tests/filter_test.info 2018-03-28 21:06:59.000000000 +0200 @@ -5,8 +5,8 @@ core = 7.x hidden = TRUE -; Information added by Drupal.org packaging script on 2016-11-16 -version = "7.52" +; Information added by Drupal.org packaging script on 2018-03-28 +version = "7.58" project = "drupal" -datestamp = "1479322922" +datestamp = "1522264019" diff -Naur drupal-7.52/modules/simpletest/tests/form.test drupal-7.58/modules/simpletest/tests/form.test --- drupal-7.52/modules/simpletest/tests/form.test 2016-11-16 19:53:45.000000000 +0100 +++ drupal-7.58/modules/simpletest/tests/form.test 2018-03-27 21:28:19.000000000 +0200 @@ -691,6 +691,14 @@ } /** + * Tests that a form with a disabled CSRF token can be validated. + */ + function testDisabledToken() { + $this->drupalPost('form-test/validate-no-token', array(), 'Save'); + $this->assertText('The form_test_validate_no_token form has been submitted successfully.'); + } + + /** * Tests partial form validation through #limit_validation_errors. */ function testValidateLimitErrors() { diff -Naur drupal-7.52/modules/simpletest/tests/form_test.info drupal-7.58/modules/simpletest/tests/form_test.info --- drupal-7.52/modules/simpletest/tests/form_test.info 2016-11-16 20:02:02.000000000 +0100 +++ drupal-7.58/modules/simpletest/tests/form_test.info 2018-03-28 21:06:59.000000000 +0200 @@ -5,8 +5,8 @@ core = 7.x hidden = TRUE -; Information added by Drupal.org packaging script on 2016-11-16 -version = "7.52" +; Information added by Drupal.org packaging script on 2018-03-28 +version = "7.58" project = "drupal" -datestamp = "1479322922" +datestamp = "1522264019" diff -Naur drupal-7.52/modules/simpletest/tests/form_test.module drupal-7.58/modules/simpletest/tests/form_test.module --- drupal-7.52/modules/simpletest/tests/form_test.module 2016-11-16 19:53:45.000000000 +0100 +++ drupal-7.58/modules/simpletest/tests/form_test.module 2018-03-27 21:28:19.000000000 +0200 @@ -37,6 +37,13 @@ 'access callback' => TRUE, 'type' => MENU_CALLBACK, ); + $items['form-test/validate-no-token'] = array( + 'title' => 'Form validation without a CSRF token', + 'page callback' => 'drupal_get_form', + 'page arguments' => array('form_test_validate_no_token'), + 'access callback' => TRUE, + 'type' => MENU_CALLBACK, + ); $items['form-test/limit-validation-errors'] = array( 'title' => 'Form validation with some error suppression', 'page callback' => 'drupal_get_form', @@ -455,6 +462,27 @@ } /** + * Form builder for testing submission of a form without a CSRF token. + */ +function form_test_validate_no_token($form, &$form_state) { + $form['submit'] = array( + '#type' => 'submit', + '#value' => 'Save', + ); + + $form['#token'] = FALSE; + + return $form; +} + +/** + * Form submission handler for form_test_validate_no_token(). + */ +function form_test_validate_no_token_submit($form, &$form_state) { + drupal_set_message('The form_test_validate_no_token form has been submitted successfully.'); +} + +/** * Builds a simple form with a button triggering partial validation. */ function form_test_limit_validation_errors_form($form, &$form_state) { diff -Naur drupal-7.52/modules/simpletest/tests/image_test.info drupal-7.58/modules/simpletest/tests/image_test.info --- drupal-7.52/modules/simpletest/tests/image_test.info 2016-11-16 20:02:02.000000000 +0100 +++ drupal-7.58/modules/simpletest/tests/image_test.info 2018-03-28 21:06:59.000000000 +0200 @@ -5,8 +5,8 @@ core = 7.x hidden = TRUE -; Information added by Drupal.org packaging script on 2016-11-16 -version = "7.52" +; Information added by Drupal.org packaging script on 2018-03-28 +version = "7.58" project = "drupal" -datestamp = "1479322922" +datestamp = "1522264019" diff -Naur drupal-7.52/modules/simpletest/tests/menu_test.info drupal-7.58/modules/simpletest/tests/menu_test.info --- drupal-7.52/modules/simpletest/tests/menu_test.info 2016-11-16 20:02:02.000000000 +0100 +++ drupal-7.58/modules/simpletest/tests/menu_test.info 2018-03-28 21:06:59.000000000 +0200 @@ -5,8 +5,8 @@ core = 7.x hidden = TRUE -; Information added by Drupal.org packaging script on 2016-11-16 -version = "7.52" +; Information added by Drupal.org packaging script on 2018-03-28 +version = "7.58" project = "drupal" -datestamp = "1479322922" +datestamp = "1522264019" diff -Naur drupal-7.52/modules/simpletest/tests/module_test.info drupal-7.58/modules/simpletest/tests/module_test.info --- drupal-7.52/modules/simpletest/tests/module_test.info 2016-11-16 20:02:02.000000000 +0100 +++ drupal-7.58/modules/simpletest/tests/module_test.info 2018-03-28 21:06:59.000000000 +0200 @@ -5,8 +5,8 @@ core = 7.x hidden = TRUE -; Information added by Drupal.org packaging script on 2016-11-16 -version = "7.52" +; Information added by Drupal.org packaging script on 2018-03-28 +version = "7.58" project = "drupal" -datestamp = "1479322922" +datestamp = "1522264019" diff -Naur drupal-7.52/modules/simpletest/tests/path_test.info drupal-7.58/modules/simpletest/tests/path_test.info --- drupal-7.52/modules/simpletest/tests/path_test.info 2016-11-16 20:02:02.000000000 +0100 +++ drupal-7.58/modules/simpletest/tests/path_test.info 2018-03-28 21:06:59.000000000 +0200 @@ -5,8 +5,8 @@ core = 7.x hidden = TRUE -; Information added by Drupal.org packaging script on 2016-11-16 -version = "7.52" +; Information added by Drupal.org packaging script on 2018-03-28 +version = "7.58" project = "drupal" -datestamp = "1479322922" +datestamp = "1522264019" diff -Naur drupal-7.52/modules/simpletest/tests/psr_0_test/psr_0_test.info drupal-7.58/modules/simpletest/tests/psr_0_test/psr_0_test.info --- drupal-7.52/modules/simpletest/tests/psr_0_test/psr_0_test.info 2016-11-16 20:02:02.000000000 +0100 +++ drupal-7.58/modules/simpletest/tests/psr_0_test/psr_0_test.info 2018-03-28 21:06:59.000000000 +0200 @@ -5,8 +5,8 @@ hidden = TRUE package = Testing -; Information added by Drupal.org packaging script on 2016-11-16 -version = "7.52" +; Information added by Drupal.org packaging script on 2018-03-28 +version = "7.58" project = "drupal" -datestamp = "1479322922" +datestamp = "1522264019" diff -Naur drupal-7.52/modules/simpletest/tests/psr_4_test/psr_4_test.info drupal-7.58/modules/simpletest/tests/psr_4_test/psr_4_test.info --- drupal-7.52/modules/simpletest/tests/psr_4_test/psr_4_test.info 2016-11-16 20:02:02.000000000 +0100 +++ drupal-7.58/modules/simpletest/tests/psr_4_test/psr_4_test.info 2018-03-28 21:06:59.000000000 +0200 @@ -5,8 +5,8 @@ hidden = TRUE package = Testing -; Information added by Drupal.org packaging script on 2016-11-16 -version = "7.52" +; Information added by Drupal.org packaging script on 2018-03-28 +version = "7.58" project = "drupal" -datestamp = "1479322922" +datestamp = "1522264019" diff -Naur drupal-7.52/modules/simpletest/tests/requirements1_test.info drupal-7.58/modules/simpletest/tests/requirements1_test.info --- drupal-7.52/modules/simpletest/tests/requirements1_test.info 2016-11-16 20:02:02.000000000 +0100 +++ drupal-7.58/modules/simpletest/tests/requirements1_test.info 2018-03-28 21:06:59.000000000 +0200 @@ -5,8 +5,8 @@ core = 7.x hidden = TRUE -; Information added by Drupal.org packaging script on 2016-11-16 -version = "7.52" +; Information added by Drupal.org packaging script on 2018-03-28 +version = "7.58" project = "drupal" -datestamp = "1479322922" +datestamp = "1522264019" diff -Naur drupal-7.52/modules/simpletest/tests/requirements2_test.info drupal-7.58/modules/simpletest/tests/requirements2_test.info --- drupal-7.52/modules/simpletest/tests/requirements2_test.info 2016-11-16 20:02:02.000000000 +0100 +++ drupal-7.58/modules/simpletest/tests/requirements2_test.info 2018-03-28 21:06:59.000000000 +0200 @@ -7,8 +7,8 @@ core = 7.x hidden = TRUE -; Information added by Drupal.org packaging script on 2016-11-16 -version = "7.52" +; Information added by Drupal.org packaging script on 2018-03-28 +version = "7.58" project = "drupal" -datestamp = "1479322922" +datestamp = "1522264019" diff -Naur drupal-7.52/modules/simpletest/tests/session_test.info drupal-7.58/modules/simpletest/tests/session_test.info --- drupal-7.52/modules/simpletest/tests/session_test.info 2016-11-16 20:02:02.000000000 +0100 +++ drupal-7.58/modules/simpletest/tests/session_test.info 2018-03-28 21:06:59.000000000 +0200 @@ -5,8 +5,8 @@ core = 7.x hidden = TRUE -; Information added by Drupal.org packaging script on 2016-11-16 -version = "7.52" +; Information added by Drupal.org packaging script on 2018-03-28 +version = "7.58" project = "drupal" -datestamp = "1479322922" +datestamp = "1522264019" diff -Naur drupal-7.52/modules/simpletest/tests/system_dependencies_test.info drupal-7.58/modules/simpletest/tests/system_dependencies_test.info --- drupal-7.52/modules/simpletest/tests/system_dependencies_test.info 2016-11-16 20:02:02.000000000 +0100 +++ drupal-7.58/modules/simpletest/tests/system_dependencies_test.info 2018-03-28 21:06:59.000000000 +0200 @@ -6,8 +6,8 @@ hidden = TRUE dependencies[] = _missing_dependency -; Information added by Drupal.org packaging script on 2016-11-16 -version = "7.52" +; Information added by Drupal.org packaging script on 2018-03-28 +version = "7.58" project = "drupal" -datestamp = "1479322922" +datestamp = "1522264019" diff -Naur drupal-7.52/modules/simpletest/tests/system_incompatible_core_version_dependencies_test.info drupal-7.58/modules/simpletest/tests/system_incompatible_core_version_dependencies_test.info --- drupal-7.52/modules/simpletest/tests/system_incompatible_core_version_dependencies_test.info 2016-11-16 20:02:02.000000000 +0100 +++ drupal-7.58/modules/simpletest/tests/system_incompatible_core_version_dependencies_test.info 2018-03-28 21:06:59.000000000 +0200 @@ -6,8 +6,8 @@ hidden = TRUE dependencies[] = system_incompatible_core_version_test -; Information added by Drupal.org packaging script on 2016-11-16 -version = "7.52" +; Information added by Drupal.org packaging script on 2018-03-28 +version = "7.58" project = "drupal" -datestamp = "1479322922" +datestamp = "1522264019" diff -Naur drupal-7.52/modules/simpletest/tests/system_incompatible_core_version_test.info drupal-7.58/modules/simpletest/tests/system_incompatible_core_version_test.info --- drupal-7.52/modules/simpletest/tests/system_incompatible_core_version_test.info 2016-11-16 20:02:02.000000000 +0100 +++ drupal-7.58/modules/simpletest/tests/system_incompatible_core_version_test.info 2018-03-28 21:06:59.000000000 +0200 @@ -5,8 +5,8 @@ core = 5.x hidden = TRUE -; Information added by Drupal.org packaging script on 2016-11-16 -version = "7.52" +; Information added by Drupal.org packaging script on 2018-03-28 +version = "7.58" project = "drupal" -datestamp = "1479322922" +datestamp = "1522264019" diff -Naur drupal-7.52/modules/simpletest/tests/system_incompatible_module_version_dependencies_test.info drupal-7.58/modules/simpletest/tests/system_incompatible_module_version_dependencies_test.info --- drupal-7.52/modules/simpletest/tests/system_incompatible_module_version_dependencies_test.info 2016-11-16 20:02:02.000000000 +0100 +++ drupal-7.58/modules/simpletest/tests/system_incompatible_module_version_dependencies_test.info 2018-03-28 21:06:59.000000000 +0200 @@ -7,8 +7,8 @@ ; system_incompatible_module_version_test declares version 1.0 dependencies[] = system_incompatible_module_version_test (>2.0) -; Information added by Drupal.org packaging script on 2016-11-16 -version = "7.52" +; Information added by Drupal.org packaging script on 2018-03-28 +version = "7.58" project = "drupal" -datestamp = "1479322922" +datestamp = "1522264019" diff -Naur drupal-7.52/modules/simpletest/tests/system_incompatible_module_version_test.info drupal-7.58/modules/simpletest/tests/system_incompatible_module_version_test.info --- drupal-7.52/modules/simpletest/tests/system_incompatible_module_version_test.info 2016-11-16 20:02:02.000000000 +0100 +++ drupal-7.58/modules/simpletest/tests/system_incompatible_module_version_test.info 2018-03-28 21:06:59.000000000 +0200 @@ -5,8 +5,8 @@ core = 7.x hidden = TRUE -; Information added by Drupal.org packaging script on 2016-11-16 -version = "7.52" +; Information added by Drupal.org packaging script on 2018-03-28 +version = "7.58" project = "drupal" -datestamp = "1479322922" +datestamp = "1522264019" diff -Naur drupal-7.52/modules/simpletest/tests/system_project_namespace_test.info drupal-7.58/modules/simpletest/tests/system_project_namespace_test.info --- drupal-7.52/modules/simpletest/tests/system_project_namespace_test.info 2016-11-16 20:02:02.000000000 +0100 +++ drupal-7.58/modules/simpletest/tests/system_project_namespace_test.info 2018-03-28 21:06:59.000000000 +0200 @@ -6,8 +6,8 @@ hidden = TRUE dependencies[] = drupal:filter -; Information added by Drupal.org packaging script on 2016-11-16 -version = "7.52" +; Information added by Drupal.org packaging script on 2018-03-28 +version = "7.58" project = "drupal" -datestamp = "1479322922" +datestamp = "1522264019" diff -Naur drupal-7.52/modules/simpletest/tests/system_test.info drupal-7.58/modules/simpletest/tests/system_test.info --- drupal-7.52/modules/simpletest/tests/system_test.info 2016-11-16 20:02:02.000000000 +0100 +++ drupal-7.58/modules/simpletest/tests/system_test.info 2018-03-28 21:06:59.000000000 +0200 @@ -6,8 +6,8 @@ files[] = system_test.module hidden = TRUE -; Information added by Drupal.org packaging script on 2016-11-16 -version = "7.52" +; Information added by Drupal.org packaging script on 2018-03-28 +version = "7.58" project = "drupal" -datestamp = "1479322922" +datestamp = "1522264019" diff -Naur drupal-7.52/modules/simpletest/tests/taxonomy_test.info drupal-7.58/modules/simpletest/tests/taxonomy_test.info --- drupal-7.52/modules/simpletest/tests/taxonomy_test.info 2016-11-16 20:02:02.000000000 +0100 +++ drupal-7.58/modules/simpletest/tests/taxonomy_test.info 2018-03-28 21:06:59.000000000 +0200 @@ -6,8 +6,8 @@ hidden = TRUE dependencies[] = taxonomy -; Information added by Drupal.org packaging script on 2016-11-16 -version = "7.52" +; Information added by Drupal.org packaging script on 2018-03-28 +version = "7.58" project = "drupal" -datestamp = "1479322922" +datestamp = "1522264019" diff -Naur drupal-7.52/modules/simpletest/tests/theme.test drupal-7.58/modules/simpletest/tests/theme.test --- drupal-7.52/modules/simpletest/tests/theme.test 2016-11-16 19:53:45.000000000 +0100 +++ drupal-7.58/modules/simpletest/tests/theme.test 2018-03-27 21:28:19.000000000 +0200 @@ -646,3 +646,34 @@ } } + +/** + * Tests module-provided theme engines. + */ +class ModuleProvidedThemeEngineTestCase extends DrupalWebTestCase { + + public static function getInfo() { + return array( + 'name' => 'Theme engine test', + 'description' => 'Tests module-provided theme engines.', + 'group' => 'Theme', + ); + } + + function setUp() { + parent::setUp('theme_test'); + theme_enable(array('test_theme', 'test_theme_nyan_cat')); + } + + /** + * Ensures that the module provided theme engine is found and used by core. + */ + function testEngineIsFoundAndWorking() { + variable_set('theme_default', 'test_theme_nyan_cat'); + variable_set('admin_theme', 'test_theme_nyan_cat'); + + $this->drupalGet('theme-test/engine-info-test'); + $this->assertText('Miaou'); + } + +} diff -Naur drupal-7.52/modules/simpletest/tests/theme_test.info drupal-7.58/modules/simpletest/tests/theme_test.info --- drupal-7.52/modules/simpletest/tests/theme_test.info 2016-11-16 20:02:02.000000000 +0100 +++ drupal-7.58/modules/simpletest/tests/theme_test.info 2018-03-28 21:06:59.000000000 +0200 @@ -5,8 +5,8 @@ core = 7.x hidden = TRUE -; Information added by Drupal.org packaging script on 2016-11-16 -version = "7.52" +; Information added by Drupal.org packaging script on 2018-03-28 +version = "7.58" project = "drupal" -datestamp = "1479322922" +datestamp = "1522264019" diff -Naur drupal-7.52/modules/simpletest/tests/theme_test.module drupal-7.58/modules/simpletest/tests/theme_test.module --- drupal-7.52/modules/simpletest/tests/theme_test.module 2016-11-16 19:53:45.000000000 +0100 +++ drupal-7.58/modules/simpletest/tests/theme_test.module 2018-03-27 21:28:19.000000000 +0200 @@ -27,10 +27,19 @@ $themes['test_theme'] = drupal_get_path('module', 'theme_test') . '/themes/test_theme/test_theme.info'; $themes['test_basetheme'] = drupal_get_path('module', 'theme_test') . '/themes/test_basetheme/test_basetheme.info'; $themes['test_subtheme'] = drupal_get_path('module', 'theme_test') . '/themes/test_subtheme/test_subtheme.info'; + $themes['test_theme_nyan_cat'] = drupal_get_path('module', 'theme_test') . '/themes/test_theme_nyan_cat/test_theme_nyan_cat.info'; return $themes; } /** + * Implements hook_system_theme_engine_info(). + */ +function theme_test_system_theme_engine_info() { + $theme_engines['nyan_cat'] = drupal_get_path('module', 'theme_test') . '/themes/engines/nyan_cat/nyan_cat.engine'; + return $theme_engines; +} + +/** * Implements hook_menu(). */ function theme_test_menu() { @@ -58,6 +67,12 @@ 'access callback' => TRUE, 'type' => MENU_CALLBACK, ); + $items['theme-test/engine-info-test'] = array( + 'description' => "Serves a simple page rendered using a Nyan Cat theme engine template.", + 'page callback' => '_theme_test_engine_info_test', + 'access callback' => TRUE, + 'type' => MENU_CALLBACK, + ); return $items; } @@ -140,6 +155,15 @@ } /** + * Serves a simple page renderered using a Nyan Cat theme engine template. + */ +function _theme_test_engine_info_test() { + return array( + '#markup' => theme('theme_test_template_test'), + ); +} + +/** * Theme function for testing theme('theme_test_foo'). */ function theme_theme_test_foo($variables) { diff -Naur drupal-7.52/modules/simpletest/tests/themes/engines/nyan_cat/nyan_cat.engine drupal-7.58/modules/simpletest/tests/themes/engines/nyan_cat/nyan_cat.engine --- drupal-7.52/modules/simpletest/tests/themes/engines/nyan_cat/nyan_cat.engine 1970-01-01 01:00:00.000000000 +0100 +++ drupal-7.58/modules/simpletest/tests/themes/engines/nyan_cat/nyan_cat.engine 2018-03-27 21:28:19.000000000 +0200 @@ -0,0 +1,53 @@ +filename) . '/template.theme'; + if (file_exists($file)) { + include_once DRUPAL_ROOT . '/' . $file; + } +} + +/** + * Implements hook_theme(). + */ +function nyan_cat_theme($existing, $type, $theme, $path) { + $templates = drupal_find_theme_functions($existing, array($theme)); + $templates += drupal_find_theme_templates($existing, '.nyan-cat.html', $path); + return $templates; +} + +/** + * Implements hook_extension(). + */ +function nyan_cat_extension() { + return '.nyan-cat.html'; +} + +/** + * Implements hook_render_template(). + * + * @param string $template_file + * The filename of the template to render. + * @param mixed[] $variables + * A keyed array of variables that will appear in the output. + * + * @return string + * The output generated by the template. + */ +function nyan_cat_render_template($template_file, $variables) { + $output = str_replace('div', 'nyancat', file_get_contents(DRUPAL_ROOT . '/' . $template_file)); + foreach ($variables as $key => $variable) { + if (strpos($output, '9' . $key) !== FALSE) { + $output = str_replace('9' . $key, $variable, $output); + } + } + return $output; +} diff -Naur drupal-7.52/modules/simpletest/tests/themes/test_basetheme/test_basetheme.info drupal-7.58/modules/simpletest/tests/themes/test_basetheme/test_basetheme.info --- drupal-7.52/modules/simpletest/tests/themes/test_basetheme/test_basetheme.info 2016-11-16 20:02:02.000000000 +0100 +++ drupal-7.58/modules/simpletest/tests/themes/test_basetheme/test_basetheme.info 2018-03-28 21:06:59.000000000 +0200 @@ -6,8 +6,8 @@ settings[basetheme_only] = base theme value settings[subtheme_override] = base theme value -; Information added by Drupal.org packaging script on 2016-11-16 -version = "7.52" +; Information added by Drupal.org packaging script on 2018-03-28 +version = "7.58" project = "drupal" -datestamp = "1479322922" +datestamp = "1522264019" diff -Naur drupal-7.52/modules/simpletest/tests/themes/test_subtheme/test_subtheme.info drupal-7.58/modules/simpletest/tests/themes/test_subtheme/test_subtheme.info --- drupal-7.52/modules/simpletest/tests/themes/test_subtheme/test_subtheme.info 2016-11-16 20:02:02.000000000 +0100 +++ drupal-7.58/modules/simpletest/tests/themes/test_subtheme/test_subtheme.info 2018-03-28 21:06:59.000000000 +0200 @@ -6,8 +6,8 @@ settings[subtheme_override] = subtheme value -; Information added by Drupal.org packaging script on 2016-11-16 -version = "7.52" +; Information added by Drupal.org packaging script on 2018-03-28 +version = "7.58" project = "drupal" -datestamp = "1479322922" +datestamp = "1522264019" diff -Naur drupal-7.52/modules/simpletest/tests/themes/test_theme/test_theme.info drupal-7.58/modules/simpletest/tests/themes/test_theme/test_theme.info --- drupal-7.52/modules/simpletest/tests/themes/test_theme/test_theme.info 2016-11-16 20:02:02.000000000 +0100 +++ drupal-7.58/modules/simpletest/tests/themes/test_theme/test_theme.info 2018-03-28 21:06:59.000000000 +0200 @@ -17,8 +17,8 @@ settings[theme_test_setting] = default value -; Information added by Drupal.org packaging script on 2016-11-16 -version = "7.52" +; Information added by Drupal.org packaging script on 2018-03-28 +version = "7.58" project = "drupal" -datestamp = "1479322922" +datestamp = "1522264019" diff -Naur drupal-7.52/modules/simpletest/tests/themes/test_theme_nyan_cat/templates/theme_test_template_test.nyan-cat.html drupal-7.58/modules/simpletest/tests/themes/test_theme_nyan_cat/templates/theme_test_template_test.nyan-cat.html --- drupal-7.52/modules/simpletest/tests/themes/test_theme_nyan_cat/templates/theme_test_template_test.nyan-cat.html 1970-01-01 01:00:00.000000000 +0100 +++ drupal-7.58/modules/simpletest/tests/themes/test_theme_nyan_cat/templates/theme_test_template_test.nyan-cat.html 2018-03-27 21:28:19.000000000 +0200 @@ -0,0 +1 @@ +Miaou \ No newline at end of file diff -Naur drupal-7.52/modules/simpletest/tests/themes/test_theme_nyan_cat/test_theme_nyan_cat.info drupal-7.58/modules/simpletest/tests/themes/test_theme_nyan_cat/test_theme_nyan_cat.info --- drupal-7.52/modules/simpletest/tests/themes/test_theme_nyan_cat/test_theme_nyan_cat.info 1970-01-01 01:00:00.000000000 +0100 +++ drupal-7.58/modules/simpletest/tests/themes/test_theme_nyan_cat/test_theme_nyan_cat.info 2018-03-28 21:06:59.000000000 +0200 @@ -0,0 +1,11 @@ +name = Nyan cat engine based test theme +description = Theme for testing the module-provided theme engines. +core = 7.x +hidden = TRUE +engine = nyan_cat + +; Information added by Drupal.org packaging script on 2018-03-28 +version = "7.58" +project = "drupal" +datestamp = "1522264019" + diff -Naur drupal-7.52/modules/simpletest/tests/update_script_test.info drupal-7.58/modules/simpletest/tests/update_script_test.info --- drupal-7.52/modules/simpletest/tests/update_script_test.info 2016-11-16 20:02:02.000000000 +0100 +++ drupal-7.58/modules/simpletest/tests/update_script_test.info 2018-03-28 21:06:59.000000000 +0200 @@ -5,8 +5,8 @@ core = 7.x hidden = TRUE -; Information added by Drupal.org packaging script on 2016-11-16 -version = "7.52" +; Information added by Drupal.org packaging script on 2018-03-28 +version = "7.58" project = "drupal" -datestamp = "1479322922" +datestamp = "1522264019" diff -Naur drupal-7.52/modules/simpletest/tests/update_test_1.info drupal-7.58/modules/simpletest/tests/update_test_1.info --- drupal-7.52/modules/simpletest/tests/update_test_1.info 2016-11-16 20:02:02.000000000 +0100 +++ drupal-7.58/modules/simpletest/tests/update_test_1.info 2018-03-28 21:06:59.000000000 +0200 @@ -5,8 +5,8 @@ core = 7.x hidden = TRUE -; Information added by Drupal.org packaging script on 2016-11-16 -version = "7.52" +; Information added by Drupal.org packaging script on 2018-03-28 +version = "7.58" project = "drupal" -datestamp = "1479322922" +datestamp = "1522264019" diff -Naur drupal-7.52/modules/simpletest/tests/update_test_2.info drupal-7.58/modules/simpletest/tests/update_test_2.info --- drupal-7.52/modules/simpletest/tests/update_test_2.info 2016-11-16 20:02:02.000000000 +0100 +++ drupal-7.58/modules/simpletest/tests/update_test_2.info 2018-03-28 21:06:59.000000000 +0200 @@ -5,8 +5,8 @@ core = 7.x hidden = TRUE -; Information added by Drupal.org packaging script on 2016-11-16 -version = "7.52" +; Information added by Drupal.org packaging script on 2018-03-28 +version = "7.58" project = "drupal" -datestamp = "1479322922" +datestamp = "1522264019" diff -Naur drupal-7.52/modules/simpletest/tests/update_test_3.info drupal-7.58/modules/simpletest/tests/update_test_3.info --- drupal-7.52/modules/simpletest/tests/update_test_3.info 2016-11-16 20:02:02.000000000 +0100 +++ drupal-7.58/modules/simpletest/tests/update_test_3.info 2018-03-28 21:06:59.000000000 +0200 @@ -5,8 +5,8 @@ core = 7.x hidden = TRUE -; Information added by Drupal.org packaging script on 2016-11-16 -version = "7.52" +; Information added by Drupal.org packaging script on 2018-03-28 +version = "7.58" project = "drupal" -datestamp = "1479322922" +datestamp = "1522264019" diff -Naur drupal-7.52/modules/simpletest/tests/url_alter_test.info drupal-7.58/modules/simpletest/tests/url_alter_test.info --- drupal-7.52/modules/simpletest/tests/url_alter_test.info 2016-11-16 20:02:02.000000000 +0100 +++ drupal-7.58/modules/simpletest/tests/url_alter_test.info 2018-03-28 21:06:59.000000000 +0200 @@ -5,8 +5,8 @@ version = VERSION hidden = TRUE -; Information added by Drupal.org packaging script on 2016-11-16 -version = "7.52" +; Information added by Drupal.org packaging script on 2018-03-28 +version = "7.58" project = "drupal" -datestamp = "1479322922" +datestamp = "1522264019" diff -Naur drupal-7.52/modules/simpletest/tests/xmlrpc_test.info drupal-7.58/modules/simpletest/tests/xmlrpc_test.info --- drupal-7.52/modules/simpletest/tests/xmlrpc_test.info 2016-11-16 20:02:02.000000000 +0100 +++ drupal-7.58/modules/simpletest/tests/xmlrpc_test.info 2018-03-28 21:06:59.000000000 +0200 @@ -5,8 +5,8 @@ core = 7.x hidden = TRUE -; Information added by Drupal.org packaging script on 2016-11-16 -version = "7.52" +; Information added by Drupal.org packaging script on 2018-03-28 +version = "7.58" project = "drupal" -datestamp = "1479322922" +datestamp = "1522264019" diff -Naur drupal-7.52/modules/statistics/statistics.info drupal-7.58/modules/statistics/statistics.info --- drupal-7.52/modules/statistics/statistics.info 2016-11-16 20:02:02.000000000 +0100 +++ drupal-7.58/modules/statistics/statistics.info 2018-03-28 21:06:59.000000000 +0200 @@ -6,8 +6,8 @@ files[] = statistics.test configure = admin/config/system/statistics -; Information added by Drupal.org packaging script on 2016-11-16 -version = "7.52" +; Information added by Drupal.org packaging script on 2018-03-28 +version = "7.58" project = "drupal" -datestamp = "1479322922" +datestamp = "1522264019" diff -Naur drupal-7.52/modules/statistics/statistics.module drupal-7.58/modules/statistics/statistics.module --- drupal-7.52/modules/statistics/statistics.module 2016-11-16 19:53:45.000000000 +0100 +++ drupal-7.58/modules/statistics/statistics.module 2018-03-27 21:28:19.000000000 +0200 @@ -245,7 +245,7 @@ * Implements hook_cron(). */ function statistics_cron() { - $statistics_timestamp = variable_get('statistics_day_timestamp', ''); + $statistics_timestamp = variable_get('statistics_day_timestamp', 0); if ((REQUEST_TIME - $statistics_timestamp) >= 86400) { // Reset day counts. diff -Naur drupal-7.52/modules/syslog/syslog.info drupal-7.58/modules/syslog/syslog.info --- drupal-7.52/modules/syslog/syslog.info 2016-11-16 20:02:02.000000000 +0100 +++ drupal-7.58/modules/syslog/syslog.info 2018-03-28 21:06:59.000000000 +0200 @@ -6,8 +6,8 @@ files[] = syslog.test configure = admin/config/development/logging -; Information added by Drupal.org packaging script on 2016-11-16 -version = "7.52" +; Information added by Drupal.org packaging script on 2018-03-28 +version = "7.58" project = "drupal" -datestamp = "1479322922" +datestamp = "1522264019" diff -Naur drupal-7.52/modules/system/system.api.php drupal-7.58/modules/system/system.api.php --- drupal-7.52/modules/system/system.api.php 2016-11-16 19:53:45.000000000 +0100 +++ drupal-7.58/modules/system/system.api.php 2018-03-27 21:28:19.000000000 +0200 @@ -2051,6 +2051,22 @@ } /** + * Return additional theme engines provided by modules. + * + * This hook is invoked from _system_rebuild_theme_data() and allows modules to + * register additional theme engines outside of the regular 'themes/engines' + * directories of a Drupal installation. + * + * @return + * An associative array. Each key is the system name of a theme engine and + * each value is the corresponding path to the theme engine's .engine file. + */ +function hook_system_theme_engine_info() { + $theme_engines['izumi'] = drupal_get_path('module', 'mymodule') . '/izumi/izumi.engine'; + return $theme_engines; +} + +/** * Alter the information parsed from module and theme .info files * * This hook is invoked in _system_rebuild_module_data() and in diff -Naur drupal-7.52/modules/system/system.info drupal-7.58/modules/system/system.info --- drupal-7.52/modules/system/system.info 2016-11-16 20:02:02.000000000 +0100 +++ drupal-7.58/modules/system/system.info 2018-03-28 21:06:59.000000000 +0200 @@ -12,8 +12,8 @@ required = TRUE configure = admin/config/system -; Information added by Drupal.org packaging script on 2016-11-16 -version = "7.52" +; Information added by Drupal.org packaging script on 2018-03-28 +version = "7.58" project = "drupal" -datestamp = "1479322922" +datestamp = "1522264019" diff -Naur drupal-7.52/modules/system/system.install drupal-7.58/modules/system/system.install --- drupal-7.52/modules/system/system.install 2016-11-16 19:53:45.000000000 +0100 +++ drupal-7.58/modules/system/system.install 2018-03-27 21:28:19.000000000 +0200 @@ -160,7 +160,7 @@ if (empty($drivers)) { $database_ok = FALSE; $pdo_message = $t('Your web server does not appear to support any common PDO database extensions. Check with your hosting provider to see if they support PDO (PHP Data Objects) and offer any databases that Drupal supports.', array( - '@drupal-databases' => 'http://drupal.org/node/270#database', + '@drupal-databases' => 'https://www.drupal.org/requirements/database', )); } // Make sure the native PDO extension is available, not the older PEAR diff -Naur drupal-7.52/modules/system/system.module drupal-7.58/modules/system/system.module --- drupal-7.52/modules/system/system.module 2016-11-16 19:53:45.000000000 +0100 +++ drupal-7.58/modules/system/system.module 2018-03-27 21:28:19.000000000 +0200 @@ -2521,6 +2521,16 @@ // Find theme engines $engines = drupal_system_listing('/^' . DRUPAL_PHP_FUNCTION_PATTERN . '\.engine$/', 'themes/engines'); + // Allow modules to add further theme engines. + if ($module_engines = module_invoke_all('system_theme_engine_info')) { + foreach ($module_engines as $name => $theme_engine_path) { + $engines[$name] = (object) array( + 'uri' => $theme_engine_path, + 'filename' => basename($theme_engine_path), + 'name' => $name, + ); + } + } // Set defaults for theme info. $defaults = array( diff -Naur drupal-7.52/modules/system/system.test drupal-7.58/modules/system/system.test --- drupal-7.52/modules/system/system.test 2016-11-16 19:53:45.000000000 +0100 +++ drupal-7.58/modules/system/system.test 2018-03-27 21:28:19.000000000 +0200 @@ -1461,6 +1461,60 @@ } } +/** + * Tests date format configuration. + */ +class DateFormatTestCase extends DrupalWebTestCase { + public static function getInfo() { + return array( + 'name' => 'Date format', + 'description' => 'Test date format configuration and defaults.', + 'group' => 'System', + ); + } + + function setUp() { + parent::setUp(); + + // Create admin user and log in admin user. + $this->admin_user = $this->drupalCreateUser(array('administer site configuration')); + $this->drupalLogin($this->admin_user); + } + + /** + * Test the default date type formats are consistent. + */ + function testDefaultDateFormats() { + // These are the default format values from format_date(). + $default_formats = array( + 'short' => 'm/d/Y - H:i', + 'medium' => 'D, m/d/Y - H:i', + 'long' => 'l, F j, Y - H:i', + ); + + // Clear the date format variables. + variable_del('date_format_short'); + variable_del('date_format_medium'); + variable_del('date_format_long'); + + $this->drupalGet('admin/config/regional/date-time'); + + foreach ($default_formats as $format_name => $format_value) { + $id = 'edit-date-format-' . $format_name; + // Check that the configuration fields match the default format. + $this->assertOptionSelected( + $id, + $format_value, + format_string('The @type format type matches the expected format @format.', + array( + '@type' => $format_name, + '@format' => $format_value, + ) + )); + } + } +} + class PageTitleFiltering extends DrupalWebTestCase { protected $content_user; protected $saved_title; diff -Naur drupal-7.52/modules/system/tests/cron_queue_test.info drupal-7.58/modules/system/tests/cron_queue_test.info --- drupal-7.52/modules/system/tests/cron_queue_test.info 2016-11-16 20:02:02.000000000 +0100 +++ drupal-7.58/modules/system/tests/cron_queue_test.info 2018-03-28 21:06:59.000000000 +0200 @@ -5,8 +5,8 @@ core = 7.x hidden = TRUE -; Information added by Drupal.org packaging script on 2016-11-16 -version = "7.52" +; Information added by Drupal.org packaging script on 2018-03-28 +version = "7.58" project = "drupal" -datestamp = "1479322922" +datestamp = "1522264019" diff -Naur drupal-7.52/modules/system/tests/system_cron_test.info drupal-7.58/modules/system/tests/system_cron_test.info --- drupal-7.52/modules/system/tests/system_cron_test.info 2016-11-16 20:02:02.000000000 +0100 +++ drupal-7.58/modules/system/tests/system_cron_test.info 2018-03-28 21:06:59.000000000 +0200 @@ -5,8 +5,8 @@ core = 7.x hidden = TRUE -; Information added by Drupal.org packaging script on 2016-11-16 -version = "7.52" +; Information added by Drupal.org packaging script on 2018-03-28 +version = "7.58" project = "drupal" -datestamp = "1479322922" +datestamp = "1522264019" diff -Naur drupal-7.52/modules/taxonomy/taxonomy.info drupal-7.58/modules/taxonomy/taxonomy.info --- drupal-7.52/modules/taxonomy/taxonomy.info 2016-11-16 20:02:02.000000000 +0100 +++ drupal-7.58/modules/taxonomy/taxonomy.info 2018-03-28 21:06:59.000000000 +0200 @@ -8,8 +8,8 @@ files[] = taxonomy.test configure = admin/structure/taxonomy -; Information added by Drupal.org packaging script on 2016-11-16 -version = "7.52" +; Information added by Drupal.org packaging script on 2018-03-28 +version = "7.58" project = "drupal" -datestamp = "1479322922" +datestamp = "1522264019" diff -Naur drupal-7.52/modules/toolbar/toolbar.info drupal-7.58/modules/toolbar/toolbar.info --- drupal-7.52/modules/toolbar/toolbar.info 2016-11-16 20:02:02.000000000 +0100 +++ drupal-7.58/modules/toolbar/toolbar.info 2018-03-28 21:06:59.000000000 +0200 @@ -4,8 +4,8 @@ package = Core version = VERSION -; Information added by Drupal.org packaging script on 2016-11-16 -version = "7.52" +; Information added by Drupal.org packaging script on 2018-03-28 +version = "7.58" project = "drupal" -datestamp = "1479322922" +datestamp = "1522264019" diff -Naur drupal-7.52/modules/tracker/tracker.info drupal-7.58/modules/tracker/tracker.info --- drupal-7.52/modules/tracker/tracker.info 2016-11-16 20:02:02.000000000 +0100 +++ drupal-7.58/modules/tracker/tracker.info 2018-03-28 21:06:59.000000000 +0200 @@ -6,8 +6,8 @@ core = 7.x files[] = tracker.test -; Information added by Drupal.org packaging script on 2016-11-16 -version = "7.52" +; Information added by Drupal.org packaging script on 2018-03-28 +version = "7.58" project = "drupal" -datestamp = "1479322922" +datestamp = "1522264019" diff -Naur drupal-7.52/modules/translation/tests/translation_test.info drupal-7.58/modules/translation/tests/translation_test.info --- drupal-7.52/modules/translation/tests/translation_test.info 2016-11-16 20:02:02.000000000 +0100 +++ drupal-7.58/modules/translation/tests/translation_test.info 2018-03-28 21:06:59.000000000 +0200 @@ -5,8 +5,8 @@ version = VERSION hidden = TRUE -; Information added by Drupal.org packaging script on 2016-11-16 -version = "7.52" +; Information added by Drupal.org packaging script on 2018-03-28 +version = "7.58" project = "drupal" -datestamp = "1479322922" +datestamp = "1522264019" diff -Naur drupal-7.52/modules/translation/translation.info drupal-7.58/modules/translation/translation.info --- drupal-7.52/modules/translation/translation.info 2016-11-16 20:02:02.000000000 +0100 +++ drupal-7.58/modules/translation/translation.info 2018-03-28 21:06:59.000000000 +0200 @@ -6,8 +6,8 @@ core = 7.x files[] = translation.test -; Information added by Drupal.org packaging script on 2016-11-16 -version = "7.52" +; Information added by Drupal.org packaging script on 2018-03-28 +version = "7.58" project = "drupal" -datestamp = "1479322922" +datestamp = "1522264019" diff -Naur drupal-7.52/modules/trigger/tests/trigger_test.info drupal-7.58/modules/trigger/tests/trigger_test.info --- drupal-7.52/modules/trigger/tests/trigger_test.info 2016-11-16 20:02:02.000000000 +0100 +++ drupal-7.58/modules/trigger/tests/trigger_test.info 2018-03-28 21:06:59.000000000 +0200 @@ -4,8 +4,8 @@ core = 7.x hidden = TRUE -; Information added by Drupal.org packaging script on 2016-11-16 -version = "7.52" +; Information added by Drupal.org packaging script on 2018-03-28 +version = "7.58" project = "drupal" -datestamp = "1479322922" +datestamp = "1522264019" diff -Naur drupal-7.52/modules/trigger/trigger.info drupal-7.58/modules/trigger/trigger.info --- drupal-7.52/modules/trigger/trigger.info 2016-11-16 20:02:02.000000000 +0100 +++ drupal-7.58/modules/trigger/trigger.info 2018-03-28 21:06:59.000000000 +0200 @@ -6,8 +6,8 @@ files[] = trigger.test configure = admin/structure/trigger -; Information added by Drupal.org packaging script on 2016-11-16 -version = "7.52" +; Information added by Drupal.org packaging script on 2018-03-28 +version = "7.58" project = "drupal" -datestamp = "1479322922" +datestamp = "1522264019" diff -Naur drupal-7.52/modules/update/tests/aaa_update_test.info drupal-7.58/modules/update/tests/aaa_update_test.info --- drupal-7.52/modules/update/tests/aaa_update_test.info 2016-11-16 20:02:02.000000000 +0100 +++ drupal-7.58/modules/update/tests/aaa_update_test.info 2018-03-28 21:06:59.000000000 +0200 @@ -4,8 +4,8 @@ core = 7.x hidden = TRUE -; Information added by Drupal.org packaging script on 2016-11-16 -version = "7.52" +; Information added by Drupal.org packaging script on 2018-03-28 +version = "7.58" project = "drupal" -datestamp = "1479322922" +datestamp = "1522264019" diff -Naur drupal-7.52/modules/update/tests/bbb_update_test.info drupal-7.58/modules/update/tests/bbb_update_test.info --- drupal-7.52/modules/update/tests/bbb_update_test.info 2016-11-16 20:02:02.000000000 +0100 +++ drupal-7.58/modules/update/tests/bbb_update_test.info 2018-03-28 21:06:59.000000000 +0200 @@ -4,8 +4,8 @@ core = 7.x hidden = TRUE -; Information added by Drupal.org packaging script on 2016-11-16 -version = "7.52" +; Information added by Drupal.org packaging script on 2018-03-28 +version = "7.58" project = "drupal" -datestamp = "1479322922" +datestamp = "1522264019" diff -Naur drupal-7.52/modules/update/tests/ccc_update_test.info drupal-7.58/modules/update/tests/ccc_update_test.info --- drupal-7.52/modules/update/tests/ccc_update_test.info 2016-11-16 20:02:02.000000000 +0100 +++ drupal-7.58/modules/update/tests/ccc_update_test.info 2018-03-28 21:06:59.000000000 +0200 @@ -4,8 +4,8 @@ core = 7.x hidden = TRUE -; Information added by Drupal.org packaging script on 2016-11-16 -version = "7.52" +; Information added by Drupal.org packaging script on 2018-03-28 +version = "7.58" project = "drupal" -datestamp = "1479322922" +datestamp = "1522264019" diff -Naur drupal-7.52/modules/update/tests/themes/update_test_admintheme/update_test_admintheme.info drupal-7.58/modules/update/tests/themes/update_test_admintheme/update_test_admintheme.info --- drupal-7.52/modules/update/tests/themes/update_test_admintheme/update_test_admintheme.info 2016-11-16 20:02:02.000000000 +0100 +++ drupal-7.58/modules/update/tests/themes/update_test_admintheme/update_test_admintheme.info 2018-03-28 21:06:59.000000000 +0200 @@ -3,8 +3,8 @@ core = 7.x hidden = TRUE -; Information added by Drupal.org packaging script on 2016-11-16 -version = "7.52" +; Information added by Drupal.org packaging script on 2018-03-28 +version = "7.58" project = "drupal" -datestamp = "1479322922" +datestamp = "1522264019" diff -Naur drupal-7.52/modules/update/tests/themes/update_test_basetheme/update_test_basetheme.info drupal-7.58/modules/update/tests/themes/update_test_basetheme/update_test_basetheme.info --- drupal-7.52/modules/update/tests/themes/update_test_basetheme/update_test_basetheme.info 2016-11-16 20:02:02.000000000 +0100 +++ drupal-7.58/modules/update/tests/themes/update_test_basetheme/update_test_basetheme.info 2018-03-28 21:06:59.000000000 +0200 @@ -3,8 +3,8 @@ core = 7.x hidden = TRUE -; Information added by Drupal.org packaging script on 2016-11-16 -version = "7.52" +; Information added by Drupal.org packaging script on 2018-03-28 +version = "7.58" project = "drupal" -datestamp = "1479322922" +datestamp = "1522264019" diff -Naur drupal-7.52/modules/update/tests/themes/update_test_subtheme/update_test_subtheme.info drupal-7.58/modules/update/tests/themes/update_test_subtheme/update_test_subtheme.info --- drupal-7.52/modules/update/tests/themes/update_test_subtheme/update_test_subtheme.info 2016-11-16 20:02:02.000000000 +0100 +++ drupal-7.58/modules/update/tests/themes/update_test_subtheme/update_test_subtheme.info 2018-03-28 21:06:59.000000000 +0200 @@ -4,8 +4,8 @@ base theme = update_test_basetheme hidden = TRUE -; Information added by Drupal.org packaging script on 2016-11-16 -version = "7.52" +; Information added by Drupal.org packaging script on 2018-03-28 +version = "7.58" project = "drupal" -datestamp = "1479322922" +datestamp = "1522264019" diff -Naur drupal-7.52/modules/update/tests/update_test.info drupal-7.58/modules/update/tests/update_test.info --- drupal-7.52/modules/update/tests/update_test.info 2016-11-16 20:02:02.000000000 +0100 +++ drupal-7.58/modules/update/tests/update_test.info 2018-03-28 21:06:59.000000000 +0200 @@ -5,8 +5,8 @@ core = 7.x hidden = TRUE -; Information added by Drupal.org packaging script on 2016-11-16 -version = "7.52" +; Information added by Drupal.org packaging script on 2018-03-28 +version = "7.58" project = "drupal" -datestamp = "1479322922" +datestamp = "1522264019" diff -Naur drupal-7.52/modules/update/update.info drupal-7.58/modules/update/update.info --- drupal-7.52/modules/update/update.info 2016-11-16 20:02:02.000000000 +0100 +++ drupal-7.58/modules/update/update.info 2018-03-28 21:06:59.000000000 +0200 @@ -6,8 +6,8 @@ files[] = update.test configure = admin/reports/updates/settings -; Information added by Drupal.org packaging script on 2016-11-16 -version = "7.52" +; Information added by Drupal.org packaging script on 2018-03-28 +version = "7.58" project = "drupal" -datestamp = "1479322922" +datestamp = "1522264019" diff -Naur drupal-7.52/modules/user/tests/user_form_test.info drupal-7.58/modules/user/tests/user_form_test.info --- drupal-7.52/modules/user/tests/user_form_test.info 2016-11-16 20:02:02.000000000 +0100 +++ drupal-7.58/modules/user/tests/user_form_test.info 2018-03-28 21:06:59.000000000 +0200 @@ -5,8 +5,8 @@ core = 7.x hidden = TRUE -; Information added by Drupal.org packaging script on 2016-11-16 -version = "7.52" +; Information added by Drupal.org packaging script on 2018-03-28 +version = "7.58" project = "drupal" -datestamp = "1479322922" +datestamp = "1522264019" diff -Naur drupal-7.52/modules/user/user.info drupal-7.58/modules/user/user.info --- drupal-7.52/modules/user/user.info 2016-11-16 20:02:02.000000000 +0100 +++ drupal-7.58/modules/user/user.info 2018-03-28 21:06:59.000000000 +0200 @@ -9,8 +9,8 @@ configure = admin/config/people stylesheets[all][] = user.css -; Information added by Drupal.org packaging script on 2016-11-16 -version = "7.52" +; Information added by Drupal.org packaging script on 2018-03-28 +version = "7.58" project = "drupal" -datestamp = "1479322922" +datestamp = "1522264019" diff -Naur drupal-7.52/modules/user/user.module drupal-7.58/modules/user/user.module --- drupal-7.52/modules/user/user.module 2016-11-16 19:53:45.000000000 +0100 +++ drupal-7.58/modules/user/user.module 2018-03-27 21:28:19.000000000 +0200 @@ -1088,13 +1088,16 @@ '#description' => t('To change the current user password, enter the new password in both fields.'), ); // To skip the current password field, the user must have logged in via a - // one-time link and have the token in the URL. - $pass_reset = isset($_SESSION['pass_reset_' . $account->uid]) && isset($_GET['pass-reset-token']) && ($_GET['pass-reset-token'] == $_SESSION['pass_reset_' . $account->uid]); + // one-time link and have the token in the URL. Store this in $form_state + // so it persists even on subsequent Ajax requests. + if (!isset($form_state['user_pass_reset'])) { + $form_state['user_pass_reset'] = isset($_SESSION['pass_reset_' . $account->uid]) && isset($_GET['pass-reset-token']) && ($_GET['pass-reset-token'] == $_SESSION['pass_reset_' . $account->uid]); + } $protected_values = array(); $current_pass_description = ''; // The user may only change their own password without their current // password if they logged in via a one-time login link. - if (!$pass_reset) { + if (!$form_state['user_pass_reset']) { $protected_values['mail'] = $form['account']['mail']['#title']; $protected_values['pass'] = t('Password'); $request_new = l(t('Request new password'), 'user/password', array('attributes' => array('title' => t('Request new password via e-mail.')))); diff -Naur drupal-7.52/modules/user/user.test drupal-7.58/modules/user/user.test --- drupal-7.52/modules/user/user.test 2016-11-16 19:53:45.000000000 +0100 +++ drupal-7.58/modules/user/user.test 2018-03-27 21:28:19.000000000 +0200 @@ -466,6 +466,19 @@ } /** + * Retrieves password reset email and extracts the login link. + */ + public function getResetURL() { + // Assume the most recent email. + $_emails = $this->drupalGetMails(); + $email = end($_emails); + $urls = array(); + preg_match('#.+user/reset/.+#', $email['body'], $urls); + + return $urls[0]; + } + + /** * Tests password reset functionality. */ function testUserPasswordReset() { @@ -478,6 +491,49 @@ $this->drupalPost('user/password', $edit, t('E-mail new password')); // Confirm the password reset. $this->assertText(t('Further instructions have been sent to your e-mail address.'), 'Password reset instructions mailed message displayed.'); + + // Create an image field to enable an Ajax request on the user profile page. + $field = array( + 'field_name' => 'field_avatar', + 'type' => 'image', + 'settings' => array(), + 'cardinality' => 1, + ); + field_create_field($field); + + $instance = array( + 'field_name' => $field['field_name'], + 'entity_type' => 'user', + 'label' => 'Avatar', + 'bundle' => 'user', + 'required' => FALSE, + 'settings' => array(), + 'widget' => array( + 'type' => 'image_image', + 'settings' => array(), + ), + ); + field_create_instance($instance); + + $resetURL = $this->getResetURL(); + $this->drupalGet($resetURL); + + // Check successful login. + $this->drupalPost(NULL, NULL, t('Log in')); + + // Make sure the Ajax request from uploading a file does not invalidate the + // reset token. + $image = current($this->drupalGetTestFiles('image')); + $edit = array( + 'files[field_avatar_und_0]' => drupal_realpath($image->uri), + ); + $this->drupalPostAJAX(NULL, $edit, 'field_avatar_und_0_upload_button'); + + // Change the forgotten password. + $password = user_password(); + $edit = array('pass[pass1]' => $password, 'pass[pass2]' => $password); + $this->drupalPost(NULL, $edit, t('Save')); + $this->assertText(t('The changes have been saved.'), 'Forgotten password changed.'); } /** @@ -1529,7 +1585,13 @@ // Setup date/time settings for Los Angeles time. variable_set('date_default_timezone', 'America/Los_Angeles'); variable_set('configurable_timezones', 1); - variable_set('date_format_medium', 'Y-m-d H:i T'); + + // Override the 'medium' date format, which is the default for node + // creation time. Since we are testing time zones with Daylight Saving + // Time, and need to future proof against changes to the zoneinfo database, + // we choose the 'I' format placeholder instead of a human-readable zone + // name. With 'I', a 1 means the date is in DST, and 0 if not. + variable_set('date_format_medium', 'Y-m-d H:i I'); // Create a user account and login. $web_user = $this->drupalCreateUser(); @@ -1547,11 +1609,11 @@ // Confirm date format and time zone. $this->drupalGet("node/$node1->nid"); - $this->assertText('2007-03-09 21:00 PST', 'Date should be PST.'); + $this->assertText('2007-03-09 21:00 0', 'Date should be PST.'); $this->drupalGet("node/$node2->nid"); - $this->assertText('2007-03-11 01:00 PST', 'Date should be PST.'); + $this->assertText('2007-03-11 01:00 0', 'Date should be PST.'); $this->drupalGet("node/$node3->nid"); - $this->assertText('2007-03-20 21:00 PDT', 'Date should be PDT.'); + $this->assertText('2007-03-20 21:00 1', 'Date should be PDT.'); // Change user time zone to Santiago time. $edit = array(); @@ -1562,11 +1624,11 @@ // Confirm date format and time zone. $this->drupalGet("node/$node1->nid"); - $this->assertText('2007-03-10 02:00 CLST', 'Date should be Chile summer time; five hours ahead of PST.'); + $this->assertText('2007-03-10 02:00 1', 'Date should be Chile summer time; five hours ahead of PST.'); $this->drupalGet("node/$node2->nid"); - $this->assertText('2007-03-11 05:00 CLT', 'Date should be Chile time; four hours ahead of PST'); + $this->assertText('2007-03-11 05:00 0', 'Date should be Chile time; four hours ahead of PST'); $this->drupalGet("node/$node3->nid"); - $this->assertText('2007-03-21 00:00 CLT', 'Date should be Chile time; three hours ahead of PDT.'); + $this->assertText('2007-03-21 00:00 0', 'Date should be Chile time; three hours ahead of PDT.'); } } diff -Naur drupal-7.52/profiles/minimal/minimal.info drupal-7.58/profiles/minimal/minimal.info --- drupal-7.52/profiles/minimal/minimal.info 2016-11-16 20:02:02.000000000 +0100 +++ drupal-7.58/profiles/minimal/minimal.info 2018-03-28 21:06:59.000000000 +0200 @@ -5,8 +5,8 @@ dependencies[] = block dependencies[] = dblog -; Information added by Drupal.org packaging script on 2016-11-16 -version = "7.52" +; Information added by Drupal.org packaging script on 2018-03-28 +version = "7.58" project = "drupal" -datestamp = "1479322922" +datestamp = "1522264019" diff -Naur drupal-7.52/profiles/standard/standard.info drupal-7.58/profiles/standard/standard.info --- drupal-7.52/profiles/standard/standard.info 2016-11-16 20:02:02.000000000 +0100 +++ drupal-7.58/profiles/standard/standard.info 2018-03-28 21:06:59.000000000 +0200 @@ -24,8 +24,8 @@ dependencies[] = file dependencies[] = rdf -; Information added by Drupal.org packaging script on 2016-11-16 -version = "7.52" +; Information added by Drupal.org packaging script on 2018-03-28 +version = "7.58" project = "drupal" -datestamp = "1479322922" +datestamp = "1522264019" diff -Naur drupal-7.52/profiles/testing/modules/drupal_system_listing_compatible_test/drupal_system_listing_compatible_test.info drupal-7.58/profiles/testing/modules/drupal_system_listing_compatible_test/drupal_system_listing_compatible_test.info --- drupal-7.52/profiles/testing/modules/drupal_system_listing_compatible_test/drupal_system_listing_compatible_test.info 2016-11-16 20:02:02.000000000 +0100 +++ drupal-7.58/profiles/testing/modules/drupal_system_listing_compatible_test/drupal_system_listing_compatible_test.info 2018-03-28 21:06:59.000000000 +0200 @@ -6,8 +6,8 @@ hidden = TRUE files[] = drupal_system_listing_compatible_test.test -; Information added by Drupal.org packaging script on 2016-11-16 -version = "7.52" +; Information added by Drupal.org packaging script on 2018-03-28 +version = "7.58" project = "drupal" -datestamp = "1479322922" +datestamp = "1522264019" diff -Naur drupal-7.52/profiles/testing/modules/drupal_system_listing_incompatible_test/drupal_system_listing_incompatible_test.info drupal-7.58/profiles/testing/modules/drupal_system_listing_incompatible_test/drupal_system_listing_incompatible_test.info --- drupal-7.52/profiles/testing/modules/drupal_system_listing_incompatible_test/drupal_system_listing_incompatible_test.info 2016-11-16 20:02:02.000000000 +0100 +++ drupal-7.58/profiles/testing/modules/drupal_system_listing_incompatible_test/drupal_system_listing_incompatible_test.info 2018-03-28 21:06:59.000000000 +0200 @@ -8,8 +8,8 @@ core = 6.x hidden = TRUE -; Information added by Drupal.org packaging script on 2016-11-16 -version = "7.52" +; Information added by Drupal.org packaging script on 2018-03-28 +version = "7.58" project = "drupal" -datestamp = "1479322922" +datestamp = "1522264019" diff -Naur drupal-7.52/profiles/testing/testing.info drupal-7.58/profiles/testing/testing.info --- drupal-7.52/profiles/testing/testing.info 2016-11-16 20:02:02.000000000 +0100 +++ drupal-7.58/profiles/testing/testing.info 2018-03-28 21:06:59.000000000 +0200 @@ -4,8 +4,8 @@ core = 7.x hidden = TRUE -; Information added by Drupal.org packaging script on 2016-11-16 -version = "7.52" +; Information added by Drupal.org packaging script on 2018-03-28 +version = "7.58" project = "drupal" -datestamp = "1479322922" +datestamp = "1522264019" diff -Naur drupal-7.52/themes/bartik/bartik.info drupal-7.58/themes/bartik/bartik.info --- drupal-7.52/themes/bartik/bartik.info 2016-11-16 20:02:02.000000000 +0100 +++ drupal-7.58/themes/bartik/bartik.info 2018-03-28 21:06:59.000000000 +0200 @@ -34,8 +34,8 @@ settings[shortcut_module_link] = 0 -; Information added by Drupal.org packaging script on 2016-11-16 -version = "7.52" +; Information added by Drupal.org packaging script on 2018-03-28 +version = "7.58" project = "drupal" -datestamp = "1479322922" +datestamp = "1522264019" diff -Naur drupal-7.52/themes/garland/garland.info drupal-7.58/themes/garland/garland.info --- drupal-7.52/themes/garland/garland.info 2016-11-16 20:02:02.000000000 +0100 +++ drupal-7.58/themes/garland/garland.info 2018-03-28 21:06:59.000000000 +0200 @@ -7,8 +7,8 @@ stylesheets[print][] = print.css settings[garland_width] = fluid -; Information added by Drupal.org packaging script on 2016-11-16 -version = "7.52" +; Information added by Drupal.org packaging script on 2018-03-28 +version = "7.58" project = "drupal" -datestamp = "1479322922" +datestamp = "1522264019" diff -Naur drupal-7.52/themes/seven/seven.info drupal-7.58/themes/seven/seven.info --- drupal-7.52/themes/seven/seven.info 2016-11-16 20:02:02.000000000 +0100 +++ drupal-7.58/themes/seven/seven.info 2018-03-28 21:06:59.000000000 +0200 @@ -13,8 +13,8 @@ regions[sidebar_first] = First sidebar regions_hidden[] = sidebar_first -; Information added by Drupal.org packaging script on 2016-11-16 -version = "7.52" +; Information added by Drupal.org packaging script on 2018-03-28 +version = "7.58" project = "drupal" -datestamp = "1479322922" +datestamp = "1522264019" diff -Naur drupal-7.52/themes/stark/stark.info drupal-7.58/themes/stark/stark.info --- drupal-7.52/themes/stark/stark.info 2016-11-16 20:02:02.000000000 +0100 +++ drupal-7.58/themes/stark/stark.info 2018-03-28 21:06:59.000000000 +0200 @@ -5,8 +5,8 @@ core = 7.x stylesheets[all][] = layout.css -; Information added by Drupal.org packaging script on 2016-11-16 -version = "7.52" +; Information added by Drupal.org packaging script on 2018-03-28 +version = "7.58" project = "drupal" -datestamp = "1479322922" +datestamp = "1522264019"