updated core and modules

core/includes/bootstrap.inc

@@ -1,4 +1,5 @@
 <?php
+
 /**
  * @file
  * Functions that need to be loaded on every Drupal request.
@@ -8,9 +9,11 @@ use Drupal\Component\Utility\Crypt;
 use Drupal\Component\Utility\Html;
 use Drupal\Component\Utility\SafeMarkup;
 use Drupal\Component\Utility\Unicode;
+use Drupal\Core\Config\BootstrapConfigStorageFactory;
 use Drupal\Core\Logger\RfcLogLevel;
 use Drupal\Core\Render\Markup;
 use Drupal\Component\Render\MarkupInterface;
+use Drupal\Core\Test\TestDatabase;
 use Drupal\Core\Session\AccountInterface;
 use Drupal\Core\Site\Settings;
 use Drupal\Core\Utility\Error;
@@ -56,6 +59,8 @@ const ERROR_REPORTING_DISPLAY_VERBOSE = 'verbose';
  * @deprecated in Drupal 8.0.0, will be removed before Drupal 9.0.0.
  *   Use Drupal\Core\Session\AccountInterface::ANONYMOUS_ROLE or
  *   \Drupal\user\RoleInterface::ANONYMOUS_ID instead.
+ *
+ * @see https://www.drupal.org/node/1619504
  */
 const DRUPAL_ANONYMOUS_RID = AccountInterface::ANONYMOUS_ROLE;
 
@@ -65,6 +70,8 @@ const DRUPAL_ANONYMOUS_RID = AccountInterface::ANONYMOUS_ROLE;
  * @deprecated in Drupal 8.0.0, will be removed before Drupal 9.0.0.
  *   Use Drupal\Core\Session\AccountInterface::AUTHENTICATED_ROLE or
  *   \Drupal\user\RoleInterface::AUTHENTICATED_ID instead.
+ *
+ * @see https://www.drupal.org/node/1619504
  */
 const DRUPAL_AUTHENTICATED_RID = AccountInterface::AUTHENTICATED_ROLE;
 
@@ -82,6 +89,11 @@ const DRUPAL_EXTENSION_NAME_MAX_LENGTH = 50;
  *
  * @see http://php.net/manual/reserved.variables.server.php
  * @see http://php.net/manual/function.time.php
+ *
+ * @deprecated in Drupal 8.3.0, will be removed before Drupal 9.0.0.
+ *   Use \Drupal::time()->getRequestTime();
+ *
+ * @see https://www.drupal.org/node/2785211
  */
 define('REQUEST_TIME', (int) $_SERVER['REQUEST_TIME']);
 
@@ -99,6 +111,8 @@ const DRUPAL_PHP_FUNCTION_PATTERN = '[a-zA-Z_\x7f-\xff][a-zA-Z0-9_\x7f-\xff]*';
  *
  * @deprecated in Drupal 8.0.x and will be removed before 9.0.0. Drupal core no
  *   longer creates an active directory.
+ *
+ * @see https://www.drupal.org/node/2501187
  */
 const CONFIG_ACTIVE_DIRECTORY = 'active';
 
@@ -117,6 +131,8 @@ const CONFIG_SYNC_DIRECTORY = 'sync';
  *
  * @deprecated in Drupal 8.0.x and will be removed before 9.0.0. The staging
  *   directory was renamed to sync.
+ *
+ * @see https://www.drupal.org/node/2574957
  */
 const CONFIG_STAGING_DIRECTORY = 'staging';
 
@@ -191,7 +207,7 @@ function config_get_config_directory($type) {
 function drupal_get_filename($type, $name, $filename = NULL) {
   // The location of files will not change during the request, so do not use
   // drupal_static().
-  static $files = array();
+  static $files = [];
 
   // Type 'core' only exists to simplify application-level logic; it always maps
   // to the /core directory, whereas $name is ignored. It is only requested via
@@ -207,7 +223,7 @@ function drupal_get_filename($type, $name, $filename = NULL) {
     $type = 'module';
   }
   if (!isset($files[$type])) {
-    $files[$type] = array();
+    $files[$type] = [];
   }
 
   if (isset($filename)) {
@@ -227,11 +243,11 @@ function drupal_get_filename($type, $name, $filename = NULL) {
     // system_rebuild_module_data() and
     // \Drupal\Core\Extension\ThemeHandlerInterface::rebuildThemeData().
     if (!isset($files[$type][$name]) && \Drupal::hasService('state')) {
-      $files[$type] += \Drupal::state()->get('system.' . $type . '.files', array());
+      $files[$type] += \Drupal::state()->get('system.' . $type . '.files', []);
     }
     // If still unknown, create a user-level error message.
     if (!isset($files[$type][$name])) {
-      trigger_error(SafeMarkup::format('The following @type is missing from the file system: @name', array('@type' => $type, '@name' => $name)), E_USER_WARNING);
+      trigger_error(SafeMarkup::format('The following @type is missing from the file system: @name', ['@type' => $type, '@name' => $name]), E_USER_WARNING);
     }
   }
 
@@ -295,7 +311,7 @@ function drupal_get_path($type, $name) {
  *
  * @ingroup sanitization
  */
-function t($string, array $args = array(), array $options = array()) {
+function t($string, array $args = [], array $options = []) {
   return new TranslatableMarkup($string, $args, $options);
 }
 
@@ -309,6 +325,8 @@ function t($string, array $args = array(), array $options = array()) {
  *
  * @deprecated in Drupal 8.0.0, will be removed before Drupal 9.0.0.
  *   Use \Drupal\Component\Render\FormattableMarkup.
+ *
+ * @see https://www.drupal.org/node/2302363
  */
 function format_string($string, array $args) {
   return SafeMarkup::format($string, $args);
@@ -342,6 +360,8 @@ function format_string($string, array $args) {
  *
  * @deprecated in Drupal 8.0.0, will be removed before Drupal 9.0.0.
  *   Use \Drupal\Component\Utility\Unicode::validateUtf8().
+ *
+ * @see https://www.drupal.org/node/1992584
  */
 function drupal_validate_utf8($text) {
   return Unicode::validateUtf8($text);
@@ -370,7 +390,7 @@ function drupal_validate_utf8($text) {
  *
  * @see \Drupal\Core\Utility\Error::decodeException()
  */
-function watchdog_exception($type, Exception $exception, $message = NULL, $variables = array(), $severity = RfcLogLevel::ERROR, $link = NULL) {
+function watchdog_exception($type, Exception $exception, $message = NULL, $variables = [], $severity = RfcLogLevel::ERROR, $link = NULL) {
 
   // Use a default value if $message is not set.
   if (empty($message)) {
@@ -441,7 +461,7 @@ function watchdog_exception($type, Exception $exception, $message = NULL, $varia
 function drupal_set_message($message = NULL, $type = 'status', $repeat = FALSE) {
   if (isset($message)) {
     if (!isset($_SESSION['messages'][$type])) {
-      $_SESSION['messages'][$type] = array();
+      $_SESSION['messages'][$type] = [];
     }
 
     // Convert strings which are safe to the simplest Markup objects.
@@ -495,7 +515,7 @@ function drupal_get_messages($type = NULL, $clear_queue = TRUE) {
         unset($_SESSION['messages'][$type]);
       }
       if (isset($messages[$type])) {
-        return array($type => $messages[$type]);
+        return [$type => $messages[$type]];
       }
     }
     else {
@@ -505,7 +525,7 @@ function drupal_get_messages($type = NULL, $clear_queue = TRUE) {
       return $messages;
     }
   }
-  return array();
+  return [];
 }
 
 /**
@@ -599,7 +619,7 @@ function _drupal_exception_handler_additional($exception, $exception2) {
  * @param string $new_prefix
  *   Internal use only. A new prefix to be stored.
  *
- * @return string|FALSE
+ * @return string|false
  *   Either the simpletest prefix (the string "simpletest" followed by any
  *   number of digits) or FALSE if the user agent does not contain a valid
  *   HMAC and timestamp.
@@ -622,7 +642,7 @@ function drupal_valid_test_ua($new_prefix = NULL) {
   // string.
   $http_user_agent = isset($_SERVER['HTTP_USER_AGENT']) ? $_SERVER['HTTP_USER_AGENT'] : NULL;
   $user_agent = isset($_COOKIE['SIMPLETEST_USER_AGENT']) ? $_COOKIE['SIMPLETEST_USER_AGENT'] : $http_user_agent;
-  if (isset($user_agent) && preg_match("/^(simpletest\d+):(.+):(.+):(.+)$/", $user_agent, $matches)) {
+  if (isset($user_agent) && preg_match("/^simple(\w+\d+):(.+):(.+):(.+)$/", $user_agent, $matches)) {
     list(, $prefix, $time, $salt, $hmac) = $matches;
     $check_string = $prefix . ':' . $time . ':' . $salt;
     // Read the hash salt prepared by drupal_generate_test_ua().
@@ -630,7 +650,8 @@ function drupal_valid_test_ua($new_prefix = NULL) {
     // handlers are set up. While Drupal's error handling may be properly
     // configured on production sites, the server's PHP error_reporting may not.
     // Ensure that no information leaks on production sites.
-    $key_file = DRUPAL_ROOT . '/sites/simpletest/' . substr($prefix, 10) . '/.htkey';
+    $test_db = new TestDatabase($prefix);
+    $key_file = DRUPAL_ROOT . '/' . $test_db->getTestSitePath() . '/.htkey';
     if (!is_readable($key_file)) {
       header($_SERVER['SERVER_PROTOCOL'] . ' 403 Forbidden');
       exit;
@@ -640,11 +661,15 @@ function drupal_valid_test_ua($new_prefix = NULL) {
     $key = $private_key . filectime(__FILE__) . fileinode(__FILE__);
     $time_diff = REQUEST_TIME - $time;
     $test_hmac = Crypt::hmacBase64($check_string, $key);
-    // Since we are making a local request a 5 second time window is allowed,
+    // Since we are making a local request a 600 second time window is allowed,
     // and the HMAC must match.
-    if ($time_diff >= 0 && $time_diff <= 5 && $hmac === $test_hmac) {
+    if ($time_diff >= 0 && $time_diff <= 600 && $hmac === $test_hmac) {
       $test_prefix = $prefix;
     }
+    else {
+      header($_SERVER['SERVER_PROTOCOL'] . ' 403 Forbidden (SIMPLETEST_USER_AGENT invalid)');
+      exit;
+    }
   }
   return $test_prefix;
 }
@@ -657,7 +682,8 @@ function drupal_generate_test_ua($prefix) {
 
   if (!isset($key) || $last_prefix != $prefix) {
     $last_prefix = $prefix;
-    $key_file = DRUPAL_ROOT . '/sites/simpletest/' . substr($prefix, 10) . '/.htkey';
+    $test_db = new TestDatabase($prefix);
+    $key_file = DRUPAL_ROOT . '/' . $test_db->getTestSitePath() . '/.htkey';
     // When issuing an outbound HTTP client request from within an inbound test
     // request, then the outbound request has to use the same User-Agent header
     // as the inbound request. A newly generated private key for the same test
@@ -682,7 +708,7 @@ function drupal_generate_test_ua($prefix) {
   // Generate a moderately secure HMAC based on the database credentials.
   $salt = uniqid('', TRUE);
   $check_string = $prefix . ':' . time() . ':' . $salt;
-  return $check_string . ':' . Crypt::hmacBase64($check_string, $key);
+  return 'simple' . $check_string . ':' . Crypt::hmacBase64($check_string, $key);
 }
 
 /**
@@ -716,12 +742,22 @@ function drupal_installation_attempted() {
  * When this function is called during Drupal's initial installation process,
  * the name of the profile that's about to be installed is stored in the global
  * installation state. At all other times, the "install_profile" setting will be
- * available in settings.php.
+ * available in container as a parameter.
  *
- * @return string|null $profile
+ * @return string|null
  *   The name of the installation profile or NULL if no installation profile is
  *   currently active. This is the case for example during the first steps of
  *   the installer or during unit tests.
+ *
+ * @deprecated in Drupal 8.3.0, will be removed before Drupal 9.0.0.
+ *   Use the install_profile container parameter or \Drupal::installProfile()
+ *   instead. If you are accessing the value before it is written to
+ *   configuration during the installer use the $install_state global. If you
+ *   need to access the value before container is available you can use
+ *   BootstrapConfigStorageFactory to load the value directly from
+ *   configuration.
+ *
+ * @see https://www.drupal.org/node/2538996
  */
 function drupal_get_profile() {
   global $install_state;
@@ -736,8 +772,18 @@ function drupal_get_profile() {
     }
   }
   else {
-    // Fall back to NULL, if there is no 'install_profile' setting.
-    $profile = Settings::get('install_profile');
+    if (\Drupal::hasContainer()) {
+      $profile = \Drupal::installProfile();
+    }
+    else {
+      $profile = BootstrapConfigStorageFactory::getDatabaseStorage()->read('core.extension')['profile'];
+    }
+
+    // A BC layer just in in case this only exists in Settings. Introduced in
+    // Drupal 8.3.x and will be removed before Drupal 9.0.0.
+    if (empty($profile)) {
+      $profile = Settings::get('install_profile');
+    }
   }
 
   return $profile;
@@ -869,7 +915,7 @@ function drupal_classloader_register($name, $path) {
  * @see drupal_static_reset()
  */
 function &drupal_static($name, $default_value = NULL, $reset = FALSE) {
-  static $data = array(), $default = array();
+  static $data = [], $default = [];
   // First check if dealing with a previously defined static variable.
   if (isset($data[$name]) || array_key_exists($name, $data)) {
     // Non-NULL $name and both $data[$name] and $default[$name] statics exist.
@@ -922,7 +968,7 @@ function drupal_static_reset($name = NULL) {
  *   string and therefore has few valid use-cases. Note also, that this method
  *   does not mark the string as safe.
  *
- * @see \Drupal\Component\Utility\SafeMarkup::format()
+ * @see https://www.drupal.org/node/2302363
  */
 function drupal_placeholder($text) {
   return '<em class="placeholder">' . Html::escape($text) . '</em>';
@@ -948,7 +994,7 @@ function drupal_placeholder($text) {
 function &drupal_register_shutdown_function($callback = NULL) {
   // We cannot use drupal_static() here because the static cache is reset during
   // batch processing, which breaks batch handling.
-  static $callbacks = array();
+  static $callbacks = [];
 
   if (isset($callback)) {
     // Only register the internal shutdown function once.
@@ -959,7 +1005,7 @@ function &drupal_register_shutdown_function($callback = NULL) {
     // Remove $callback from the arguments.
     unset($args[0]);
     // Save callback and arguments
-    $callbacks[] = array('callback' => $callback, 'arguments' => $args);
+    $callbacks[] = ['callback' => $callback, 'arguments' => $args];
   }
   return $callbacks;
 }