bachir/edlp_d8
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

updated core to 9.5.11

Browse Source
This commit is contained in:
bachir
2024-09-17 12:48:11 +02:00
parent 4a39f21140
commit 902ee2adb3
11 changed files with 1086 additions and 901 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.gitattributes
+8 -8
View File
@@ -19,24 +19,24 @@
*.config text eol=lf whitespace=blank-at-eol,-blank-at-eof,-space-before-tab,tab-in-indent,tabwidth=2
*.css text eol=lf whitespace=blank-at-eol,-blank-at-eof,-space-before-tab,tab-in-indent,tabwidth=2
*.dist text eol=lf whitespace=blank-at-eol,-blank-at-eof,-space-before-tab,tab-in-indent,tabwidth=2
*.engine text eol=lf whitespace=blank-at-eol,-blank-at-eof,-space-before-tab,tab-in-indent,tabwidth=2 diff=php
*.engine text eol=lf whitespace=blank-at-eol,-blank-at-eof,-space-before-tab,tab-in-indent,tabwidth=2 diff=php linguist-language=php
*.html text eol=lf whitespace=blank-at-eol,-blank-at-eof,-space-before-tab,tab-in-indent,tabwidth=2 diff=html
*.inc text eol=lf whitespace=blank-at-eol,-blank-at-eof,-space-before-tab,tab-in-indent,tabwidth=2 diff=php
*.install text eol=lf whitespace=blank-at-eol,-blank-at-eof,-space-before-tab,tab-in-indent,tabwidth=2 diff=php
*.inc text eol=lf whitespace=blank-at-eol,-blank-at-eof,-space-before-tab,tab-in-indent,tabwidth=2 diff=php linguist-language=php
*.install text eol=lf whitespace=blank-at-eol,-blank-at-eof,-space-before-tab,tab-in-indent,tabwidth=2 diff=php linguist-language=php
*.js text eol=lf whitespace=blank-at-eol,-blank-at-eof,-space-before-tab,tab-in-indent,tabwidth=2
*.json text eol=lf whitespace=blank-at-eol,-blank-at-eof,-space-before-tab,tab-in-indent,tabwidth=2
*.lock text eol=lf whitespace=blank-at-eol,-blank-at-eof,-space-before-tab,tab-in-indent,tabwidth=2
*.map text eol=lf whitespace=blank-at-eol,-blank-at-eof,-space-before-tab,tab-in-indent,tabwidth=2
*.md text eol=lf whitespace=blank-at-eol,-blank-at-eof,-space-before-tab,tab-in-indent,tabwidth=2
*.module text eol=lf whitespace=blank-at-eol,-blank-at-eof,-space-before-tab,tab-in-indent,tabwidth=2 diff=php
*.php text eol=lf whitespace=blank-at-eol,-blank-at-eof,-space-before-tab,tab-in-indent,tabwidth=2 diff=php
*.module text eol=lf whitespace=blank-at-eol,-blank-at-eof,-space-before-tab,tab-in-indent,tabwidth=2 diff=php linguist-language=php
*.php text eol=lf whitespace=blank-at-eol,-blank-at-eof,-space-before-tab,tab-in-indent,tabwidth=2 diff=php linguist-language=php
*.po text eol=lf whitespace=blank-at-eol,-blank-at-eof,-space-before-tab,tab-in-indent,tabwidth=2
*.profile text eol=lf whitespace=blank-at-eol,-blank-at-eof,-space-before-tab,tab-in-indent,tabwidth=2 diff=php
*.profile text eol=lf whitespace=blank-at-eol,-blank-at-eof,-space-before-tab,tab-in-indent,tabwidth=2 diff=php linguist-language=php
*.script text eol=lf whitespace=blank-at-eol,-blank-at-eof,-space-before-tab,tab-in-indent,tabwidth=2
*.sh text eol=lf whitespace=blank-at-eol,-blank-at-eof,-space-before-tab,tab-in-indent,tabwidth=2 diff=php
*.sh text eol=lf whitespace=blank-at-eol,-blank-at-eof,-space-before-tab,tab-in-indent,tabwidth=2 diff=php linguist-language=php
*.sql text eol=lf whitespace=blank-at-eol,-blank-at-eof,-space-before-tab,tab-in-indent,tabwidth=2
*.svg text eol=lf whitespace=blank-at-eol,-blank-at-eof,-space-before-tab,tab-in-indent,tabwidth=2
*.theme text eol=lf whitespace=blank-at-eol,-blank-at-eof,-space-before-tab,tab-in-indent,tabwidth=2 diff=php
*.theme text eol=lf whitespace=blank-at-eol,-blank-at-eof,-space-before-tab,tab-in-indent,tabwidth=2 diff=php linguist-language=php
*.twig text eol=lf whitespace=blank-at-eol,-blank-at-eof,-space-before-tab,tab-in-indent,tabwidth=2
*.txt text eol=lf whitespace=blank-at-eol,-blank-at-eof,-space-before-tab,tab-in-indent,tabwidth=2
*.xml text eol=lf whitespace=blank-at-eol,-blank-at-eof,-space-before-tab,tab-in-indent,tabwidth=2
composer.json
+3 -3
View File
@@ -36,9 +36,9 @@
"drupal/config_filter": "^1.6",
"drupal/config_ignore": "^3.3",
"drupal/context": "^4.1",
"drupal/core-composer-scaffold": "9.1.0",
"drupal/core-project-message": "9.1.0",
"drupal/core-recommended": "9.1.0",
"drupal/core-composer-scaffold": "^9.1.0",
"drupal/core-project-message": "^9.1.0",
"drupal/core-recommended": "^9.1.0",
"drupal/ctools": "^3.4",
"drupal/date_range_formatter": "^4.0",
"drupal/devel": "^4.0",
composer.lock
Generated
+851 -764
View File
File diff suppressed because it is too large Load Diff
web/.ht.router.php
+6
View File
@@ -24,6 +24,12 @@
* @see http://php.net/manual/en/features.commandline.webserver.php
*/
if (PHP_SAPI !== 'cli-server') {
// Bail out if this is not PHP's Development Server.
header($_SERVER['SERVER_PROTOCOL'] . ' 403 Forbidden');
exit;
}
$url = parse_url($_SERVER['REQUEST_URI']);
if (file_exists(__DIR__ . $url['path'])) {
// Serve the requested resource as-is.
web/.htaccess
+9 -4
View File
@@ -3,7 +3,7 @@
#
# Protect files and directories from prying eyes.
<FilesMatch "\.(engine|inc|install|make|module|profile|po|sh|.*sql|theme|twig|tpl(\.php)?|xtmpl|yml)(~|\.sw[op]|\.bak|\.orig|\.save)?$|^(\.(?!well-known).*|Entries.*|Repository|Root|Tag|Template|composer\.(json|lock)|web\.config)$|^#.*#$|\.php(~|\.sw[op]|\.bak|\.orig|\.save)$">
<FilesMatch "\.(engine|inc|install|make|module|profile|po|sh|.*sql|theme|twig|tpl(\.php)?|xtmpl|yml)(~|\.sw[op]|\.bak|\.orig|\.save)?$|^(\.(?!well-known).*|Entries.*|Repository|Root|Tag|Template|composer\.(json|lock)|web\.config|yarn\.lock|package\.json)$|^#.*#$|\.php(~|\.sw[op]|\.bak|\.orig|\.save)$">
<IfModule mod_authz_core.c>
Require all denied
</IfModule>
@@ -32,12 +32,17 @@ AddEncoding gzip svgz
php_value assert.active 0
</IfModule>
# PHP 8, Apache 1 and 2.
<IfModule mod_php.c>
php_value assert.active 0
</IfModule>
# Requires mod_expires to be enabled.
<IfModule mod_expires.c>
# Enable expirations.
ExpiresActive On
# Cache all files for 2 weeks after access (A).
# Cache all files and redirects for 2 weeks after access (A).
ExpiresDefault A1209600
<FilesMatch \.php$>
@@ -153,12 +158,12 @@ AddEncoding gzip svgz
# Serve gzip compressed CSS files if they exist and the client accepts gzip.
RewriteCond %{HTTP:Accept-encoding} gzip
RewriteCond %{REQUEST_FILENAME}\.gz -s
RewriteRule ^(.*)\.css $1\.css\.gz [QSA]
RewriteRule ^(.*css_[a-zA-Z0-9-_]+)\.css$ $1\.css\.gz [QSA]
# Serve gzip compressed JS files if they exist and the client accepts gzip.
RewriteCond %{HTTP:Accept-encoding} gzip
RewriteCond %{REQUEST_FILENAME}\.gz -s
RewriteRule ^(.*)\.js $1\.js\.gz [QSA]
RewriteRule ^(.*js_[a-zA-Z0-9-_]+)\.js$ $1\.js\.gz [QSA]
# Serve correct content types, and prevent double compression.
RewriteRule \.css\.gz$ - [T=text/css,E=no-gzip:1,E=no-brotli:1]
web/robots.txt
+4
View File
@@ -49,6 +49,8 @@ Disallow: /user/register
Disallow: /user/password
Disallow: /user/login
Disallow: /user/logout
Disallow: /media/oembed
Disallow: /*/media/oembed
# Paths (no clean URLs)
Disallow: /index.php/admin/
Disallow: /index.php/comment/reply/
@@ -59,3 +61,5 @@ Disallow: /index.php/user/password
Disallow: /index.php/user/register
Disallow: /index.php/user/login
Disallow: /index.php/user/logout
Disallow: /index.php/media/oembed
Disallow: /index.php/*/media/oembed
web/sites/default/default.services.yml
+63 -21
View File
@@ -11,10 +11,11 @@ parameters:
# @default 100
gc_divisor: 100
#
# Set session lifetime (in seconds), i.e. the time from the user's last
# visit to the active session may be deleted by the session garbage
# collector. When a session is deleted, authenticated users are logged out,
# and the contents of the user's $_SESSION variable is discarded.
# Set session lifetime (in seconds), i.e. the grace period for session
# data. Sessions are deleted by the session garbage collector after one
# session lifetime has elapsed since the user's last visit. When a session
# is deleted, authenticated users are logged out, and the contents of the
# user's session is discarded.
# @default 200000
gc_maxlifetime: 200000
#
@@ -36,6 +37,22 @@ parameters:
# @default none
# cookie_domain: '.example.com'
#
# Set the session ID string length. The length can be between 22 to 256. The
# PHP recommended value is 48. See
# https://www.php.net/manual/session.security.ini.php for more information.
# This value should be kept in sync with
# \Drupal\Core\Session\SessionConfiguration::__construct()
# @default 48
sid_length: 48
#
# Set the number of bits in encoded session ID character. The possible
# values are '4' (0-9, a-f), '5' (0-9, a-v), and '6' (0-9, a-z, A-Z, "-",
# ","). The PHP recommended value is 6. See
# https://www.php.net/manual/session.security.ini.php for more information.
# This value should be kept in sync with
# \Drupal\Core\Session\SessionConfiguration::__construct()
# @default 6
sid_bits_per_character: 6
twig.config:
# Twig debugging:
#
@@ -53,7 +70,7 @@ parameters:
# For more information about debugging Twig templates, see
# https://www.drupal.org/node/1906392.
#
# Not recommended in production environments
# Enabling Twig debugging is not recommended in production environments.
# @default false
debug: false
# Twig auto-reload:
@@ -62,7 +79,7 @@ parameters:
# If you don't provide a value for auto_reload, it will be determined
# based on the value of debug.
#
# Not recommended in production environments
# Enabling auto-reload is not recommended in production environments.
# @default null
auto_reload: null
# Twig cache:
@@ -73,9 +90,24 @@ parameters:
# auto_reload setting above should be enabled rather than disabling the
# Twig cache.
#
# Not recommended in production environments
# Disabling the Twig cache is not recommended in production environments.
# @default true
cache: true
# File extensions:
#
# List of file extensions the Twig system is allowed to load via the
# twig.loader.filesystem service. Files with other extensions will not be
# loaded unless they are added here. For example, to allow a file named
# 'example.partial' to be loaded, add 'partial' to this list. To load files
# with no extension, add an empty string '' to the list.
#
# @default ['css', 'html', 'js', 'svg', 'twig']
allowed_file_extensions:
- css
- html
- js
- svg
- twig
renderer.config:
# Renderer required cache contexts:
#
@@ -115,6 +147,14 @@ parameters:
#
# @default []
tags: []
# Renderer cache debug:
#
# Allows cache debugging output for each rendered element.
#
# Enabling render cache debugging is not recommended in production
# environments.
# @default false
debug: false
# Cacheability debugging:
#
# Responses with cacheability metadata (CacheableResponseInterface instances)
@@ -124,19 +164,20 @@ parameters:
# For more information about debugging cacheable responses, see
# https://www.drupal.org/developing/api/8/response/cacheable-response-interface
#
# Not recommended in production environments
# Enabling cacheability debugging is not recommended in production
# environments.
# @default false
http.response.debug_cacheability_headers: false
factory.keyvalue: {}
# Default key/value storage service to use.
# @default keyvalue.database
# default: keyvalue.database
# Collection-specific overrides.
# state: keyvalue.database
# Default key/value storage service to use.
# @default keyvalue.database
# default: keyvalue.database
# Collection-specific overrides.
# state: keyvalue.database
factory.keyvalue.expirable: {}
# Default key/value expirable storage service to use.
# @default keyvalue.database.expirable
# default: keyvalue.database.expirable
# Default key/value expirable storage service to use.
# @default keyvalue.database.expirable
# default: keyvalue.database.expirable
# Allowed protocols for URL generation.
filter_protocols:
- http
@@ -153,17 +194,18 @@ parameters:
- webcal
- rtsp
# Configure Cross-Site HTTP requests (CORS).
# Read https://developer.mozilla.org/en-US/docs/Web/HTTP/Access_control_CORS
# for more information about the topic in general.
# Note: By default the configuration is disabled.
# Configure Cross-Site HTTP requests (CORS).
# Read https://developer.mozilla.org/en-US/docs/Web/HTTP/Access_control_CORS
# for more information about the topic in general.
# Note: By default the configuration is disabled.
cors.config:
enabled: false
# Specify allowed headers, like 'x-allowed-header'.
allowedHeaders: []
# Specify allowed request methods, specify ['*'] to allow all possible ones.
allowedMethods: []
# Configure requests allowed from specific origins.
# Configure requests allowed from specific origins. Do not include trailing
# slashes with URLs.
allowedOrigins: ['*']
# Sets the Access-Control-Expose-Headers header.
exposedHeaders: false
web/sites/default/default.settings.php
+138 -85
View File
@@ -1,6 +1,6 @@
<?php
// @codingStandardsIgnoreFile
// phpcs:ignoreFile
/**
* @file
@@ -138,50 +138,32 @@ $databases = [];
* request as needed. The fourth line creates a new database with a name of
* "extra".
*
* You can optionally set prefixes for some or all database table names
* by using the 'prefix' setting. If a prefix is specified, the table
* name will be prepended with its value. Be sure to use valid database
* characters only, usually alphanumeric and underscore. If no prefixes
* are desired, leave it as an empty string ''.
* For MySQL, MariaDB or equivalent databases the 'isolation_level' option can
* be set. The recommended transaction isolation level for Drupal sites is
* 'READ COMMITTED'. The 'REPEATABLE READ' option is supported but can result
* in deadlocks, the other two options are 'READ UNCOMMITTED' and 'SERIALIZABLE'.
* They are available but not supported; use them at your own risk. For more
* info:
* https://dev.mysql.com/doc/refman/5.7/en/innodb-transaction-isolation-levels.html
*
* To have all database names prefixed, set 'prefix' as a string:
* On your settings.php, change the isolation level:
* @code
* $databases['default']['default']['init_commands'] = [
* 'isolation_level' => 'SET SESSION TRANSACTION ISOLATION LEVEL READ COMMITTED',
* ];
* @endcode
*
* You can optionally set a prefix for all database table names by using the
* 'prefix' setting. If a prefix is specified, the table name will be prepended
* with its value. Be sure to use valid database characters only, usually
* alphanumeric and underscore. If no prefix is desired, do not set the 'prefix'
* key or set its value to an empty string ''.
*
* For example, to have all database table prefixed with 'main_', set:
* @code
* 'prefix' => 'main_',
* @endcode
*
* Per-table prefixes are deprecated as of Drupal 8.2, and will be removed in
* Drupal 9.0. After that, only a single prefix for all tables will be
* supported.
*
* To provide prefixes for specific tables, set 'prefix' as an array.
* The array's keys are the table names and the values are the prefixes.
* The 'default' element is mandatory and holds the prefix for any tables
* not specified elsewhere in the array. Example:
* @code
* 'prefix' => [
* 'default' => 'main_',
* 'users' => 'shared_',
* 'sessions' => 'shared_',
* 'role' => 'shared_',
* 'authmap' => 'shared_',
* ],
* @endcode
* You can also use a reference to a schema/database as a prefix. This may be
* useful if your Drupal installation exists in a schema that is not the default
* or you want to access several databases from the same code base at the same
* time.
* Example:
* @code
* 'prefix' => [
* 'default' => 'main.',
* 'users' => 'shared.',
* 'sessions' => 'shared.',
* 'role' => 'shared.',
* 'authmap' => 'shared.',
* ];
* @endcode
* NOTE: MySQL and SQLite's definition of a schema is a database.
*
* Advanced users can add or override initial commands to execute when
* connecting to the database server, as well as PDO connection settings. For
* example, to enable MySQL SELECT queries to exceed the max_join_size system
@@ -203,9 +185,9 @@ $databases = [];
* information on these defaults and the potential issues.
*
* More details can be found in the constructor methods for each driver:
* - \Drupal\Core\Database\Driver\mysql\Connection::__construct()
* - \Drupal\Core\Database\Driver\pgsql\Connection::__construct()
* - \Drupal\Core\Database\Driver\sqlite\Connection::__construct()
* - \Drupal\mysql\Driver\Database\mysql\Connection::__construct()
* - \Drupal\pgsql\Driver\Database\pgsql\Connection::__construct()
* - \Drupal\sqlite\Driver\Database\sqlite\Connection::__construct()
*
* Sample Database configuration format for PostgreSQL (pgsql):
* @code
@@ -308,16 +290,18 @@ $settings['hash_salt'] = '';
$settings['update_free_access'] = FALSE;
/**
* Fallback to HTTP for Update Manager.
* Fallback to HTTP for Update Manager and for fetching security advisories.
*
* If your Drupal site fails to connect to updates.drupal.org using HTTPS to
* fetch Drupal core, module and theme update status, you may uncomment this
* setting and set it to TRUE to allow an insecure fallback to HTTP. Note that
* doing so will open your site up to a potential man-in-the-middle attack. You
* should instead attempt to resolve the issues before enabling this option.
* If your site fails to connect to updates.drupal.org over HTTPS (either when
* fetching data on available updates, or when fetching the feed of critical
* security announcements), you may uncomment this setting and set it to TRUE to
* allow an insecure fallback to HTTP. Note that doing so will open your site up
* to a potential man-in-the-middle attack. You should instead attempt to
* resolve the issues before enabling this option.
* @see https://www.drupal.org/docs/system-requirements/php-requirements#openssl
* @see https://en.wikipedia.org/wiki/Man-in-the-middle_attack
* @see \Drupal\update\UpdateFetcher
* @see \Drupal\system\SecurityAdvisories\SecurityAdvisoriesFetcher
*/
# $settings['update_fetch_with_http_fallback'] = TRUE;
@@ -374,10 +358,13 @@ $settings['update_free_access'] = FALSE;
# $settings['reverse_proxy'] = TRUE;
/**
* Specify every reverse proxy IP address in your environment.
* This setting is required if $settings['reverse_proxy'] is TRUE.
* Reverse proxy addresses.
*
* Specify every reverse proxy IP address in your environment, as an array of
* IPv4/IPv6 addresses or subnets in CIDR notation. This setting is required if
* $settings['reverse_proxy'] is TRUE.
*/
# $settings['reverse_proxy_addresses'] = ['a.b.c.d', ...];
# $settings['reverse_proxy_addresses'] = ['a.b.c.d', 'e.f.g.h/24', ...];
/**
* Reverse proxy trusted headers.
@@ -385,17 +372,20 @@ $settings['update_free_access'] = FALSE;
* Sets which headers to trust from your reverse proxy.
*
* Common values are:
* - \Symfony\Component\HttpFoundation\Request::HEADER_X_FORWARDED_ALL
* - \Symfony\Component\HttpFoundation\Request::HEADER_X_FORWARDED_FOR
* - \Symfony\Component\HttpFoundation\Request::HEADER_X_FORWARDED_HOST
* - \Symfony\Component\HttpFoundation\Request::HEADER_X_FORWARDED_PORT
* - \Symfony\Component\HttpFoundation\Request::HEADER_X_FORWARDED_PROTO
* - \Symfony\Component\HttpFoundation\Request::HEADER_FORWARDED
*
* Note the default value of
* @code
* \Symfony\Component\HttpFoundation\Request::HEADER_X_FORWARDED_ALL | \Symfony\Component\HttpFoundation\Request::HEADER_FORWARDED
* \Symfony\Component\HttpFoundation\Request::HEADER_X_FORWARDED_FOR | \Symfony\Component\HttpFoundation\Request::HEADER_X_FORWARDED_HOST | \Symfony\Component\HttpFoundation\Request::HEADER_X_FORWARDED_PORT | \Symfony\Component\HttpFoundation\Request::HEADER_X_FORWARDED_PROTO | \Symfony\Component\HttpFoundation\Request::HEADER_FORWARDED
* @endcode
* is not secure by default. The value should be set to only the specific
* headers the reverse proxy uses. For example:
* @code
* \Symfony\Component\HttpFoundation\Request::HEADER_X_FORWARDED_ALL
* \Symfony\Component\HttpFoundation\Request::HEADER_X_FORWARDED_FOR | \Symfony\Component\HttpFoundation\Request::HEADER_X_FORWARDED_HOST | \Symfony\Component\HttpFoundation\Request::HEADER_X_FORWARDED_PORT | \Symfony\Component\HttpFoundation\Request::HEADER_X_FORWARDED_PROTO
* @endcode
* This would trust the following headers:
* - X_FORWARDED_FOR
@@ -403,11 +393,14 @@ $settings['update_free_access'] = FALSE;
* - X_FORWARDED_PROTO
* - X_FORWARDED_PORT
*
* @see \Symfony\Component\HttpFoundation\Request::HEADER_X_FORWARDED_ALL
* @see \Symfony\Component\HttpFoundation\Request::HEADER_X_FORWARDED_FOR
* @see \Symfony\Component\HttpFoundation\Request::HEADER_X_FORWARDED_HOST
* @see \Symfony\Component\HttpFoundation\Request::HEADER_X_FORWARDED_PORT
* @see \Symfony\Component\HttpFoundation\Request::HEADER_X_FORWARDED_PROTO
* @see \Symfony\Component\HttpFoundation\Request::HEADER_FORWARDED
* @see \Symfony\Component\HttpFoundation\Request::setTrustedProxies
*/
# $settings['reverse_proxy_trusted_headers'] = \Symfony\Component\HttpFoundation\Request::HEADER_X_FORWARDED_ALL | \Symfony\Component\HttpFoundation\Request::HEADER_FORWARDED;
# $settings['reverse_proxy_trusted_headers'] = \Symfony\Component\HttpFoundation\Request::HEADER_X_FORWARDED_FOR | \Symfony\Component\HttpFoundation\Request::HEADER_X_FORWARDED_HOST | \Symfony\Component\HttpFoundation\Request::HEADER_X_FORWARDED_PORT | \Symfony\Component\HttpFoundation\Request::HEADER_X_FORWARDED_PROTO | \Symfony\Component\HttpFoundation\Request::HEADER_FORWARDED;
/**
@@ -515,6 +508,48 @@ $settings['update_free_access'] = FALSE;
*/
# $settings['file_public_path'] = 'sites/default/files';
/**
* Additional public file schemes:
*
* Public schemes are URI schemes that allow download access to all users for
* all files within that scheme.
*
* The "public" scheme is always public, and the "private" scheme is always
* private, but other schemes, such as "https", "s3", "example", or others,
* can be either public or private depending on the site. By default, they're
* private, and access to individual files is controlled via
* hook_file_download().
*
* Typically, if a scheme should be public, a module makes it public by
* implementing hook_file_download(), and granting access to all users for all
* files. This could be either the same module that provides the stream wrapper
* for the scheme, or a different module that decides to make the scheme
* public. However, in cases where a site needs to make a scheme public, but
* is unable to add code in a module to do so, the scheme may be added to this
* variable, the result of which is that system_file_download() grants public
* access to all files within that scheme.
*/
# $settings['file_additional_public_schemes'] = ['example'];
/**
* File schemes whose paths should not be normalized:
*
* Normally, Drupal normalizes '/./' and '/../' segments in file URIs in order
* to prevent unintended file access. For example, 'private://css/../image.png'
* is normalized to 'private://image.png' before checking access to the file.
*
* On Windows, Drupal also replaces '\' with '/' in URIs for the local
* filesystem.
*
* If file URIs with one or more scheme should not be normalized like this, then
* list the schemes here. For example, if 'porcelain://china/./plate.png' should
* not be normalized to 'porcelain://china/plate.png', then add 'porcelain' to
* this array. In this case, make sure that the module providing the 'porcelain'
* scheme does not allow unintended file access when using '/../' to move up the
* directory tree.
*/
# $settings['file_sa_core_2023_005_schemes'] = ['porcelain'];
/**
* Private file path:
*
@@ -578,7 +613,7 @@ $settings['update_free_access'] = FALSE;
*
* Note: This setting does not apply to installation and update pages.
*/
# $settings['maintenance_theme'] = 'bartik';
# $settings['maintenance_theme'] = 'claro';
/**
* PHP settings:
@@ -628,33 +663,6 @@ $settings['update_free_access'] = FALSE;
# $config['system.site']['name'] = 'My Drupal site';
# $config['user.settings']['anonymous'] = 'Visitor';
/**
* Fast 404 pages:
*
* Drupal can generate fully themed 404 pages. However, some of these responses
* are for images or other resource files that are not displayed to the user.
* This can waste bandwidth, and also generate server load.
*
* The options below return a simple, fast 404 page for URLs matching a
* specific pattern:
* - $config['system.performance']['fast_404']['exclude_paths']: A regular
* expression to match paths to exclude, such as images generated by image
* styles, or dynamically-resized images. The default pattern provided below
* also excludes the private file system. If you need to add more paths, you
* can add '|path' to the expression.
* - $config['system.performance']['fast_404']['paths']: A regular expression to
* match paths that should return a simple 404 page, rather than the fully
* themed 404 page. If you don't have any aliases ending in htm or html you
* can add '|s?html?' to the expression.
* - $config['system.performance']['fast_404']['html']: The html to return for
* simple 404 pages.
*
* Remove the leading hash signs if you would like to alter this functionality.
*/
# $config['system.performance']['fast_404']['exclude_paths'] = '/\/(?:styles)|(?:system\/files)\//';
# $config['system.performance']['fast_404']['paths'] = '/\.(?:txt|png|gif|jpe?g|css|js|ico|swf|flv|cgi|bat|pl|dll|exe|asp)$/i';
# $config['system.performance']['fast_404']['html'] = '<!DOCTYPE html><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL "@path" was not found on this server.</p></body></html>';
/**
* Load services definition file.
*/
@@ -713,6 +721,8 @@ $settings['container_yamls'][] = $app_root . '/' . $site_path . '/services.yml';
* @endcode
* will allow the site to run off of all variants of example.com and
* example.org, with all subdomains included.
*
* @see https://www.drupal.org/docs/installing-drupal/trusted-host-settings
*/
/**
@@ -762,6 +772,49 @@ $settings['entity_update_backup'] = TRUE;
*/
$settings['migrate_node_migrate_type_classic'] = FALSE;
/**
* The default settings for migration sources.
*
* These settings are used as the default settings on the Credential form at
* /upgrade/credentials.
*
* - migrate_source_version - The version of the source database. This can be
* '6' or '7'. Defaults to '7'.
* - migrate_source_connection - The key in the $databases array for the source
* site.
* - migrate_file_public_path - The location of the source Drupal 6 or Drupal 7
* public files. This can be a local file directory containing the source
* Drupal 6 or Drupal 7 site (e.g /var/www/docroot), or the site address
* (e.g http://example.com).
* - migrate_file_private_path - The location of the source Drupal 7 private
* files. This can be a local file directory containing the source Drupal 7
* site (e.g /var/www/docroot), or empty to use the same value as Public
* files directory.
*
* Sample configuration for a drupal 6 source site with the source files in a
* local directory.
*
* @code
* $settings['migrate_source_version'] = '6';
* $settings['migrate_source_connection'] = 'migrate';
* $settings['migrate_file_public_path'] = '/var/www/drupal6';
* @endcode
*
* Sample configuration for a drupal 7 source site with public source files on
* the source site and the private files in a local directory.
*
* @code
* $settings['migrate_source_version'] = '7';
* $settings['migrate_source_connection'] = 'migrate';
* $settings['migrate_file_public_path'] = 'https://drupal7.com';
* $settings['migrate_file_private_path'] = '/var/www/drupal7';
* @endcode
*/
# $settings['migrate_source_connection'] = '';
# $settings['migrate_source_version'] = '';
# $settings['migrate_file_public_path'] = '';
# $settings['migrate_file_private_path'] = '';
/**
* Load local development override configuration, if available.
*
web/sites/example.settings.local.php
+2 -2
View File
@@ -1,6 +1,6 @@
<?php
// @codingStandardsIgnoreFile
// phpcs:ignoreFile
/**
* @file
@@ -33,7 +33,7 @@
* @see https://wiki.php.net/rfc/expectations
*/
assert_options(ASSERT_ACTIVE, TRUE);
\Drupal\Component\Assertion\Handle::register();
assert_options(ASSERT_EXCEPTION, TRUE);
/**
* Enable local development services.
web/sites/example.sites.php
+1 -1
View File
@@ -1,6 +1,6 @@
<?php
// @codingStandardsIgnoreFile
// phpcs:ignoreFile
/**
* @file
web/web.config
+1 -13
View File
@@ -22,7 +22,7 @@
<rewrite>
<rules>
<rule name="Protect files and directories from prying eyes" stopProcessing="true">
<match url="\.(engine|inc|install|module|profile|po|sh|.*sql|theme|twig|tpl(\.php)?|xtmpl|yml|svn-base)$|^(code-style\.pl|Entries.*|Repository|Root|Tag|Template|all-wcprops|entries|format|composer\.(json|lock)|\.htaccess)$" />
<match url="\.(engine|inc|install|module|profile|po|sh|.*sql|theme|twig|tpl(\.php)?|xtmpl|yml|svn-base)$|^(code-style\.pl|Entries.*|Repository|Root|Tag|Template|all-wcprops|entries|format|composer\.(json|lock)|\.htaccess|yarn.lock|package.json)$" />
<action type="CustomResponse" statusCode="403" subStatusCode="0" statusReason="Forbidden" statusDescription="Access is forbidden." />
</rule>
@@ -33,18 +33,6 @@
<add input="{REQUEST_FILENAME}" matchType="IsFile" negate="true" />
</conditions>
</rule>
<!-- If running on a PHP version affected by httpoxy vulnerability
uncomment the following rule to mitigate it's impact. To make this
rule work, you will also need to add HTTP_PROXY to the allowed server
variables manually in IIS. See https://www.drupal.org/node/2783079.
<rule name="Erase HTTP_PROXY" patternSyntax="Wildcard">
<match url="*.*" />
<serverVariables>
<set name="HTTP_PROXY" value="" />
</serverVariables>
<action type="None" />
</rule>
-->
<!-- To redirect all users to access the site WITH the 'www.' prefix,
http://example.com/foo will be redirected to http://www.example.com/foo)
adapt and uncomment the following: -->