updated core to 8.6.3

core/modules/user/src/AccountForm.php

@@ -161,7 +161,7 @@ abstract class AccountForm extends ContentEntityForm {
 
     // When not building the user registration form, prevent web browsers from
     // autofilling/prefilling the email, username, and password fields.
-    if ($this->getOperation() != 'register') {
+    if (!$register) {
       foreach (['mail', 'name', 'pass'] as $key) {
         if (isset($form['account'][$key])) {
           $form['account'][$key]['#attributes']['autocomplete'] = 'off';

core/modules/user/src/Plugin/Action/CancelUser.php

@@ -35,7 +35,7 @@ class CancelUser extends ActionBase implements ContainerFactoryPluginInterface {
   protected $currentUser;
 
   /**
-   * Constructs a DeleteNode object.
+   * Constructs a CancelUser object.
    *
    * @param array $configuration
    *   A configuration array containing information about the plugin instance.

core/modules/user/src/Plugin/Block/UserLoginBlock.php

@@ -96,7 +96,7 @@ class UserLoginBlock extends BlockBase implements ContainerFactoryPluginInterfac
     // will be replaced at the very last moment. This ensures forms with
     // dynamically generated action URLs don't have poor cacheability.
     // Use the proper API to generate the placeholder, when we have one. See
-    // https://www.drupal.org/node/2562341. The placholder uses a fixed string
+    // https://www.drupal.org/node/2562341. The placeholder uses a fixed string
     // that is
     // Crypt::hashBase64('\Drupal\user\Plugin\Block\UserLoginBlock::build');
     // This is based on the implementation in

core/modules/user/src/Plugin/EntityReferenceSelection/UserSelection.php

@@ -242,7 +242,7 @@ class UserSelection extends DefaultSelection {
           $value_part->condition('anonymous_name', $condition['value'], $condition['operator']);
           $value_part->compile($this->connection, $query);
           $or->condition((new Condition('AND'))
-            ->where(str_replace('anonymous_name', ':anonymous_name', (string) $value_part), $value_part->arguments() + [':anonymous_name' => \Drupal::config('user.settings')->get('anonymous')])
+            ->where(str_replace($query->escapeField('anonymous_name'), ':anonymous_name', (string) $value_part), $value_part->arguments() + [':anonymous_name' => \Drupal::config('user.settings')->get('anonymous')])
             ->condition('base_table.uid', 0)
           );
           $query->condition($or);

core/modules/user/src/Plugin/LanguageNegotiation/LanguageNegotiationUser.php

@@ -30,10 +30,9 @@ class LanguageNegotiationUser extends LanguageNegotiationMethodBase {
 
     // User preference (only for authenticated users).
     if ($this->languageManager && $this->currentUser->isAuthenticated()) {
-      $preferred_langcode = $this->currentUser->getPreferredLangcode();
-      $default_langcode = $this->languageManager->getDefaultLanguage()->getId();
+      $preferred_langcode = $this->currentUser->getPreferredLangcode(FALSE);
       $languages = $this->languageManager->getLanguages();
-      if (!empty($preferred_langcode) && $preferred_langcode != $default_langcode && isset($languages[$preferred_langcode])) {
+      if (!empty($preferred_langcode) && isset($languages[$preferred_langcode])) {
         $langcode = $preferred_langcode;
       }
     }

core/modules/user/src/Plugin/LanguageNegotiation/LanguageNegotiationUserAdmin.php

@@ -127,10 +127,14 @@ class LanguageNegotiationUserAdmin extends LanguageNegotiationMethodBase impleme
       $route_match = $this->stackedRouteMatch->getRouteMatchFromRequest($request);
       if ($route_match && !$route_object = $route_match->getRouteObject()) {
         try {
+          // Some inbound path processors make changes to the request. Make a
+          // copy as we're not actually routing the request so we do not want to
+          // make changes.
+          $cloned_request = clone $request;
           // Process the path as an inbound path. This will remove any language
           // prefixes and other path components that inbound processing would
           // clear out, so we can attempt to load the route clearly.
-          $path = $this->pathProcessorManager->processInbound(urldecode(rtrim($request->getPathInfo(), '/')), $request);
+          $path = $this->pathProcessorManager->processInbound(urldecode(rtrim($cloned_request->getPathInfo(), '/')), $cloned_request);
           $attributes = $this->router->match($path);
         }
         catch (ResourceNotFoundException $e) {

core/modules/user/src/Plugin/migrate/process/UserLangcode.php

@@ -33,7 +33,7 @@ class UserLangcode extends ProcessPluginBase implements ContainerFactoryPluginIn
    * @param string $plugin_id
    *   The plugin ID.
    * @param mixed $plugin_definition
-   *   The plugin definiiton.
+   *   The plugin definition.
    * @param \Drupal\Core\Language\LanguageManager $language_manager
    *   The language manager service.
    */

core/modules/user/src/Tests/UserResetEmailTestTrait.php

@@ -2,10 +2,17 @@
 
 namespace Drupal\user\Tests;
 
+@trigger_error(__NAMESPACE__ . '\UserResetEmailTestTrait is deprecated and scheduled for removal before Drupal 9.0.0. Add the method to the test class instead, see https://www.drupal.org/node/2999766', E_USER_DEPRECATED);
+
 use Drupal\Core\Test\AssertMailTrait;
 
 /**
  * Helper function for logging in from reset password email.
+ *
+ * @deprecated Scheduled for removal before Drupal 9.0.0.
+ *   Add the method to the test class instead.
+ *
+ * @see https://www.drupal.org/node/2999766
  */
 trait UserResetEmailTestTrait {
 

core/modules/user/tests/modules/user_hooks_test/user_hooks_test.module

@@ -6,11 +6,12 @@
  */
 
 use Drupal\Component\Render\FormattableMarkup;
+use Drupal\Core\Session\AccountInterface;
 
 /**
  * Implements hook_user_format_name_alter().
  */
-function user_hooks_test_user_format_name_alter(&$name, $account) {
+function user_hooks_test_user_format_name_alter(&$name, AccountInterface $account) {
   if (\Drupal::state()->get('user_hooks_test_user_format_name_alter', FALSE)) {
     if (\Drupal::state()->get('user_hooks_test_user_format_name_alter_safe', FALSE)) {
       $name = new FormattableMarkup('<em>@uid</em>', ['@uid' => $account->id()]);

core/modules/user/tests/src/Functional/UserAdminLanguageTest.php

@@ -1,16 +1,16 @@
 <?php
 
-namespace Drupal\user\Tests;
+namespace Drupal\Tests\user\Functional;
 
 use Drupal\Core\Language\LanguageInterface;
-use Drupal\simpletest\WebTestBase;
+use Drupal\Tests\BrowserTestBase;
 
 /**
  * Tests users' ability to change their own administration language.
  *
  * @group user
  */
-class UserAdminLanguageTest extends WebTestBase {
+class UserAdminLanguageTest extends BrowserTestBase {
 
   /**
    * A user with permission to access admin pages and administer languages.

core/modules/user/tests/src/Functional/UserBlocksTest.php

@@ -1,16 +1,16 @@
 <?php
 
-namespace Drupal\user\Tests;
+namespace Drupal\Tests\user\Functional;
 
 use Drupal\dynamic_page_cache\EventSubscriber\DynamicPageCacheSubscriber;
-use Drupal\simpletest\WebTestBase;
+use Drupal\Tests\BrowserTestBase;
 
 /**
  * Tests user blocks.
  *
  * @group user
  */
-class UserBlocksTest extends WebTestBase {
+class UserBlocksTest extends BrowserTestBase {
 
   /**
    * Modules to enable.
@@ -69,7 +69,7 @@ class UserBlocksTest extends WebTestBase {
     // Log in using the block.
     $edit = [];
     $edit['name'] = $user->getUsername();
-    $edit['pass'] = $user->pass_raw;
+    $edit['pass'] = $user->passRaw;
     $this->drupalPostForm('admin/people/permissions', $edit, t('Log in'));
     $this->assertNoText(t('User login'), 'Logged in.');
 

core/modules/user/tests/src/Functional/UserCreateTest.php

@@ -1,17 +1,22 @@
 <?php
 
-namespace Drupal\user\Tests;
+namespace Drupal\Tests\user\Functional;
 
+use Drupal\Core\Test\AssertMailTrait;
 use Drupal\field\Entity\FieldConfig;
-use Drupal\simpletest\WebTestBase;
 use Drupal\field\Entity\FieldStorageConfig;
+use Drupal\Tests\BrowserTestBase;
 
 /**
  * Tests the create user administration page.
  *
  * @group user
  */
-class UserCreateTest extends WebTestBase {
+class UserCreateTest extends BrowserTestBase {
+
+  use AssertMailTrait {
+    getMails as drupalGetMails;
+  }
 
   /**
    * Modules to enable.
@@ -109,7 +114,7 @@ class UserCreateTest extends WebTestBase {
       $this->drupalGet('admin/people');
       $this->assertText($edit['name'], 'User found in list of users');
       $user = user_load_by_name($name);
-      $this->assertEqual($user->isActive(), 'User is not blocked');
+      $this->assertTrue($user->isActive(), 'User is not blocked');
     }
 
     // Test that the password '0' is considered a password.

core/modules/user/tests/src/Functional/UserLoginHttpTest.php

@@ -3,10 +3,10 @@
 namespace Drupal\Tests\user\Functional;
 
 use Drupal\Core\Flood\DatabaseBackend;
+use Drupal\Core\Test\AssertMailTrait;
 use Drupal\Core\Url;
 use Drupal\Tests\BrowserTestBase;
 use Drupal\user\Controller\UserAuthenticationController;
-use Drupal\user\Tests\UserResetEmailTestTrait;
 use GuzzleHttp\Cookie\CookieJar;
 use Psr\Http\Message\ResponseInterface;
 use Symfony\Component\Serializer\Encoder\JsonEncoder;
@@ -21,7 +21,9 @@ use Symfony\Component\Serializer\Serializer;
  */
 class UserLoginHttpTest extends BrowserTestBase {
 
-  use UserResetEmailTestTrait;
+  use AssertMailTrait {
+    getMails as drupalGetMails;
+  }
 
   /**
    * Modules to install.
@@ -526,4 +528,17 @@ class UserLoginHttpTest extends BrowserTestBase {
     $this->drupalLogout();
   }
 
+  /**
+   * Login from reset password email.
+   */
+  protected function loginFromResetEmail() {
+    $_emails = $this->drupalGetMails();
+    $email = end($_emails);
+    $urls = [];
+    preg_match('#.+user/reset/.+#', $email['body'], $urls);
+    $resetURL = $urls[0];
+    $this->drupalGet($resetURL);
+    $this->drupalPostForm(NULL, NULL, 'Log in');
+  }
+
 }

core/modules/user/tests/src/Functional/UserPasswordResetTest.php

@@ -1,6 +1,6 @@
 <?php
 
-namespace Drupal\user\Tests\Functional;
+namespace Drupal\Tests\user\Functional;
 
 use Drupal\Component\Render\FormattableMarkup;
 use Drupal\Core\Test\AssertMailTrait;

core/modules/user/tests/src/Functional/UserRegistrationTest.php

@@ -1,20 +1,20 @@
 <?php
 
-namespace Drupal\user\Tests;
+namespace Drupal\Tests\user\Functional;
 
-use Drupal\Core\Entity\Entity\EntityFormDisplay;
 use Drupal\Component\Render\FormattableMarkup;
+use Drupal\Core\Entity\Entity\EntityFormDisplay;
 use Drupal\Core\Field\FieldStorageDefinitionInterface;
 use Drupal\field\Entity\FieldConfig;
 use Drupal\field\Entity\FieldStorageConfig;
-use Drupal\simpletest\WebTestBase;
+use Drupal\Tests\BrowserTestBase;
 
 /**
  * Tests registration of user under different configurations.
  *
  * @group user
  */
-class UserRegistrationTest extends WebTestBase {
+class UserRegistrationTest extends BrowserTestBase {
 
   /**
    * Modules to enable.

core/modules/user/tests/src/FunctionalJavascript/UserPasswordResetTest.php

@@ -1,6 +1,6 @@
 <?php
 
-namespace Drupal\user\Tests\FunctionalJavascript;
+namespace Drupal\Tests\user\FunctionalJavascript;
 
 use Drupal\Core\Test\AssertMailTrait;
 use Drupal\Core\Url;

core/modules/user/tests/src/Kernel/UserAdminSettingsFormTest.php

@@ -1,6 +1,6 @@
 <?php
 
-namespace Drupal\user\Tests;
+namespace Drupal\Tests\user\Kernel;
 
 use Drupal\KernelTests\ConfigFormTestBase;
 use Drupal\user\AccountSettingsForm;

core/modules/user/tests/src/Kernel/UserEntityReferenceTest.php

@@ -2,9 +2,9 @@
 
 namespace Drupal\Tests\user\Kernel;
 
-use Drupal\field\Tests\EntityReference\EntityReferenceTestTrait;
 use Drupal\field\Entity\FieldConfig;
 use Drupal\KernelTests\Core\Entity\EntityKernelTestBase;
+use Drupal\Tests\field\Traits\EntityReferenceTestTrait;
 use Drupal\user\Entity\Role;
 
 /**

core/modules/user/user.api.php

@@ -5,6 +5,9 @@
  * Hooks provided by the User module.
  */
 
+use Drupal\Core\Session\AccountInterface;
+use Drupal\user\UserInterface;
+
 /**
  * @addtogroup hooks
  * @{
@@ -28,7 +31,7 @@
  *
  * @param array $edit
  *   The array of form values submitted by the user.
- * @param \Drupal\Core\Session\AccountInterface $account
+ * @param \Drupal\user\UserInterface $account
  *   The user object on which the operation is being performed.
  * @param string $method
  *   The account cancellation method.
@@ -36,7 +39,7 @@
  * @see user_cancel_methods()
  * @see hook_user_cancel_methods_alter()
  */
-function hook_user_cancel($edit, $account, $method) {
+function hook_user_cancel($edit, UserInterface $account, $method) {
   switch ($method) {
     case 'user_cancel_block_unpublish':
       // Unpublish nodes (current revisions).
@@ -120,7 +123,7 @@ function hook_user_cancel_methods_alter(&$methods) {
  * @see \Drupal\Core\Session\AccountInterface::getDisplayName()
  * @see sanitization
  */
-function hook_user_format_name_alter(&$name, $account) {
+function hook_user_format_name_alter(&$name, AccountInterface $account) {
   // Display the user's uid instead of name.
   if ($account->id()) {
     $name = t('User @uid', ['@uid' => $account->id()]);
@@ -130,10 +133,10 @@ function hook_user_format_name_alter(&$name, $account) {
 /**
  * The user just logged in.
  *
- * @param object $account
+ * @param \Drupal\user\UserInterface $account
  *   The user object on which the operation was just performed.
  */
-function hook_user_login($account) {
+function hook_user_login(UserInterface $account) {
   $config = \Drupal::config('system.date');
   // If the user has a NULL time zone, notify them to set a time zone.
   if (!$account->getTimezone() && $config->get('timezone.user.configurable') && $config->get('timezone.user.warn')) {
@@ -151,10 +154,10 @@ function hook_user_login($account) {
 /**
  * The user just logged out.
  *
- * @param $account
+ * @param \Drupal\Core\Session\AccountInterface $account
  *   The user object on which the operation was just performed.
  */
-function hook_user_logout($account) {
+function hook_user_logout(AccountInterface $account) {
   db_insert('logouts')
     ->fields([
       'uid' => $account->id(),

core/modules/user/user.module

@@ -569,7 +569,7 @@ function user_login_finalize(UserInterface $account) {
 /**
  * Implements hook_user_login().
  */
-function user_user_login($account) {
+function user_user_login(UserInterface $account) {
   // Reset static cache of default variables in template_preprocess() to reflect
   // the new user.
   drupal_static_reset('template_preprocess');
@@ -578,7 +578,7 @@ function user_user_login($account) {
 /**
  * Implements hook_user_logout().
  */
-function user_user_logout($account) {
+function user_user_logout(AccountInterface $account) {
   // Reset static cache of default variables in template_preprocess() to reflect
   // the new user.
   drupal_static_reset('template_preprocess');

core/modules/user/user.views_execution.inc

@@ -10,7 +10,7 @@ use Drupal\views\ViewExecutable;
 /**
  * Implements hook_views_query_substitutions().
  *
- * Allow replacement of current userid so we can cache these queries.
+ * Allow replacement of current user ID so we can cache these queries.
  */
 function user_views_query_substitutions(ViewExecutable $view) {
   return ['***CURRENT_USER***' => \Drupal::currentUser()->id()];