uppdated modules

sites/all/modules/contrib/dev/entity/modules/callbacks.inc

@@ -29,7 +29,7 @@ function entity_metadata_book_get_properties($node, array $options, $name, $enti
 
     case 'book_ancestors':
       $ancestors = array();
-      while (!empty($node->book['plid'])) {
+      while (!empty($node->book['plid']) && $node->book['plid'] != -1) {
         $link = book_link_load($node->book['plid']);
         array_unshift($ancestors, $link['nid']);
         $node = node_load($link['nid']);
@@ -670,9 +670,11 @@ function entity_metadata_field_file_validate_item($items, $context) {
 function entity_metadata_no_hook_node_access($op, $node = NULL, $account = NULL) {
   // First deal with the case where a $node is provided.
   if (isset($node)) {
-    if ($op == 'create') {
+    if (empty($node->vid) && in_array($op, array('create', 'update'))) {
+      // This is a new node or the original node.
       if (isset($node->type)) {
-        return node_access($op, $node->type, $account);
+        $op = !empty($node->is_new) && $node->is_new ? 'create' : 'update';
+        return node_access($op, $op == 'create' ? $node->type : $node, $account);
       }
       else {
         throw new EntityMalformedException('Permission to create a node was requested but no node type was given.');
@@ -703,13 +705,14 @@ function entity_metadata_no_hook_node_access($op, $node = NULL, $account = NULL)
 /**
  * Access callback for the user entity.
  */
-function entity_metadata_user_access($op, $entity = NULL, $account = NULL, $entity_type) {
+function entity_metadata_user_access($op, $entity = NULL, $account = NULL, $entity_type = NULL) {
   $account = isset($account) ? $account : $GLOBALS['user'];
   // Grant access to the users own user account and to the anonymous one.
-  if (isset($entity) && $op != 'delete' && (($entity->uid == $account->uid && $entity->uid) || (!$entity->uid && $op == 'view'))) {
+  if (isset($entity->uid) && $op != 'delete' && (($entity->uid == $account->uid && $entity->uid) || (!$entity->uid && $op == 'view'))) {
     return TRUE;
   }
-  if (user_access('administer users', $account) || user_access('access user profiles', $account) && $op == 'view' && $entity->status) {
+  if (user_access('administer users', $account)
+    || user_access('access user profiles', $account) && $op == 'view' && (empty($entity) || !empty($entity->status))) {
     return TRUE;
   }
   return FALSE;
@@ -724,7 +727,7 @@ function entity_metadata_user_properties_access($op, $property, $entity = NULL,
   }
   $account = isset($account) ? $account : $GLOBALS['user'];
   // Flag to indicate if this user entity is the own user account.
-  $is_own_account = isset($entity) && $account->uid == $entity->uid;
+  $is_own_account = isset($entity->uid) && $account->uid == $entity->uid;
   switch ($property) {
     case 'name':
       // Allow view access to anyone with access to the entity.
@@ -794,15 +797,36 @@ function entity_metadata_comment_properties_access($op, $property, $entity = NUL
 /**
  * Access callback for the taxonomy entities.
  */
-function entity_metadata_taxonomy_access($op, $entity = NULL, $account = NULL, $entity_type) {
-  if ($entity_type == 'taxonomy_vocabulary') {
-    return user_access('administer taxonomy', $account);
-  }
-  if (isset($entity) && $op == 'update' && !isset($account) && taxonomy_term_edit_access($entity)) {
+function entity_metadata_taxonomy_access($op, $entity = NULL, $account = NULL, $entity_type = NULL) {
+  // If user has administer taxonomy permission then no further checks.
+  if (user_access('administer taxonomy', $account)) {
     return TRUE;
   }
-  if (user_access('administer taxonomy', $account) || user_access('access content', $account) && $op == 'view') {
-    return TRUE;
+  switch ($op) {
+    case "view":
+      if (user_access('access content', $account)) {
+        return TRUE;
+      }
+      break;
+    case "update":
+      if ($entity_type == 'taxonomy_term') {
+        return user_access("edit terms in $entity->vid", $account);
+      }
+      break;
+    case "create":
+      if ($entity_type == 'taxonomy_term') {
+        // Check for taxonomy_access_fix contrib module which adds additional
+        // permissions to create new terms in a given vocabulary.
+        if (function_exists('taxonomy_access_fix_access')) {
+          return taxonomy_access_fix_access('add terms', $entity->vocabulary_machine_name);
+        }
+      }
+      break;
+    case "delete":
+      if ($entity_type == 'taxonomy_term') {
+        return user_access("delete terms in $entity->vid", $account);
+      }
+      break;
   }
   return FALSE;
 }

sites/all/modules/contrib/dev/entity/modules/field.info.inc

@@ -51,7 +51,10 @@ function entity_metadata_field_default_property_callback(&$info, $entity_type, $
     $property = &$info[$entity_type]['bundles'][$instance['bundle']]['properties'][$name];
     $instance += array('property info' => array());
     $property = $instance['property info'] + array(
-      'label' => $instance['label'],
+      // Since the label will be exposed via hook_token_info() and it is not
+      // clearly defined if that should be sanitized already we prevent XSS
+      // right here (field labels are user provided text).
+      'label' => filter_xss_admin($instance['label']),
       'type' => $field_type['property_type'],
       'description' => t('Field "@name".', array('@name' => $name)),
       'getter callback' => 'entity_metadata_field_property_get',
@@ -164,7 +167,7 @@ function entity_metadata_field_image_callback(&$info, $entity_type, $field, $ins
   if (empty($instance['settings']['alt_field'])) {
     unset($property['property info']['alt']);
   }
-  if (empty($field['settings']['title_field'])) {
+  if (empty($instance['settings']['title_field'])) {
     unset($property['property info']['title']);
   }
 }

sites/all/modules/contrib/dev/entity/modules/node.info.inc

@@ -163,4 +163,10 @@ function entity_metadata_node_entity_property_info_alter(&$info) {
     'auto creation' => 'entity_property_create_array',
     'field' => TRUE,
   );
+
+  // Make it a list if cardinality is not 1.
+  $field_body = field_info_field('body');
+  if (isset($field_body) && $field_body['cardinality'] != 1) {
+    $info['node']['properties']['body']['type'] = 'list<text_formatted>';
+  }
 }