core security update 8.5.3

hover audio link -> node_popup on map
index sort title
corpus map : white safety zone arround squares
aside squares not collisioning
square faded not interactive (article filtre)
node_popup show chutier icon only if action not add
fade not active entries in entrees block
closing notice|index doesn't close entree on block
and many little things

.gitignore

@@ -44,3 +44,6 @@ dbbackups
 *.mysql
 *.tar.gz
 *.zip
+
+# this is not working as missing config a simply delete on import
+# sites/default/config/sync/system.performance.yml

composer.json

@@ -6,11 +6,11 @@
     "require": {
         "composer/installers": "^1.0.24",
         "wikimedia/composer-merge-plugin": "^1.4",
+        "drupal/core": "^8.5",
         "drupal/console": "^1.7",
         "drush/drush": "^9"
     },
     "replace": {
-        "drupal/core": "^8.5"
     },
     "minimum-stability": "dev",
     "prefer-stable": true,

core/core.libraries.yml

@@ -24,7 +24,7 @@ classList:
 
 ckeditor:
   remote: https://github.com/ckeditor/ckeditor-dev
-  version: "4.8.0"
+  version: "4.8.0+2018-04-18-security-patch"
   license:
     name: GNU-GPL-2.0-or-later
     url: https://github.com/ckeditor/ckeditor-dev/blob/4.8.0/LICENSE.md

core/lib/Drupal.php

@@ -82,7 +82,7 @@ class Drupal {
   /**
    * The current system version.
    */
-  const VERSION = '8.5.0';
+  const VERSION = '8.5.3';
 
   /**
    * Core API compatibility.

core/lib/Drupal/Core/DrupalKernel.php

@@ -20,6 +20,7 @@ use Drupal\Core\File\MimeType\MimeTypeGuesser;
 use Drupal\Core\Http\TrustedHostsRequestFactory;
 use Drupal\Core\Installer\InstallerRedirectTrait;
 use Drupal\Core\Language\Language;
+use Drupal\Core\Security\RequestSanitizer;
 use Drupal\Core\Site\Settings;
 use Drupal\Core\Test\TestDatabase;
 use Symfony\Cmf\Component\Routing\RouteObjectInterface;
@@ -542,6 +543,12 @@ class DrupalKernel implements DrupalKernelInterface, TerminableInterface {
    * {@inheritdoc}
    */
   public function preHandle(Request $request) {
+    // Sanitize the request.
+    $request = RequestSanitizer::sanitize(
+      $request,
+      (array) Settings::get(RequestSanitizer::SANITIZE_WHITELIST, []),
+      (bool) Settings::get(RequestSanitizer::SANITIZE_LOG, FALSE)
+    );
 
     $this->loadLegacyIncludes();
 

core/lib/Drupal/Core/Security/RequestSanitizer.php

@@ -0,0 +1,157 @@
+<?php
+
+namespace Drupal\Core\Security;
+
+use Drupal\Component\Utility\UrlHelper;
+use Symfony\Component\HttpFoundation\ParameterBag;
+use Symfony\Component\HttpFoundation\Request;
+
+/**
+ * Sanitizes user input.
+ */
+class RequestSanitizer {
+
+  /**
+   * Request attribute to mark the request as sanitized.
+   */
+  const SANITIZED = '_drupal_request_sanitized';
+
+  /**
+   * The name of the setting that configures the whitelist.
+   */
+  const SANITIZE_WHITELIST = 'sanitize_input_whitelist';
+
+  /**
+   * The name of the setting that determines if sanitized keys are logged.
+   */
+  const SANITIZE_LOG = 'sanitize_input_logging';
+
+  /**
+   * Strips dangerous keys from user input.
+   *
+   * @param \Symfony\Component\HttpFoundation\Request $request
+   *   The incoming request to sanitize.
+   * @param string[] $whitelist
+   *   An array of keys to whitelist as safe. See default.settings.php.
+   * @param bool $log_sanitized_keys
+   *   (optional) Set to TRUE to log an keys that are sanitized.
+   *
+   * @return \Symfony\Component\HttpFoundation\Request
+   *   The sanitized request.
+   */
+  public static function sanitize(Request $request, $whitelist, $log_sanitized_keys = FALSE) {
+    if (!$request->attributes->get(self::SANITIZED, FALSE)) {
+      $update_globals = FALSE;
+      $bags = [
+        'query' => 'Potentially unsafe keys removed from query string parameters (GET): %s',
+        'request' => 'Potentially unsafe keys removed from request body parameters (POST): %s',
+        'cookies' => 'Potentially unsafe keys removed from cookie parameters: %s',
+      ];
+      foreach ($bags as $bag => $message) {
+        if (static::processParameterBag($request->$bag, $whitelist, $log_sanitized_keys, $bag, $message)) {
+          $update_globals = TRUE;
+        }
+      }
+      if ($update_globals) {
+        $request->overrideGlobals();
+      }
+      $request->attributes->set(self::SANITIZED, TRUE);
+    }
+    return $request;
+  }
+
+  /**
+   * Processes a request parameter bag.
+   *
+   * @param \Symfony\Component\HttpFoundation\ParameterBag $bag
+   *   The parameter bag to process.
+   * @param string[] $whitelist
+   *   An array of keys to whitelist as safe.
+   * @param bool $log_sanitized_keys
+   *   Set to TRUE to log keys that are sanitized.
+   * @param string $bag_name
+   *   The request parameter bag name. Either 'query', 'request' or 'cookies'.
+   * @param string $message
+   *   The message to log if the parameter bag contains keys that are removed.
+   *   If the message contains %s that is replaced by a list of removed keys.
+   *
+   * @return bool
+   *   TRUE if the parameter bag has been sanitized, FALSE if not.
+   */
+  protected static function processParameterBag(ParameterBag $bag, $whitelist, $log_sanitized_keys, $bag_name, $message) {
+    $sanitized = FALSE;
+    $sanitized_keys = [];
+    $bag->replace(static::stripDangerousValues($bag->all(), $whitelist, $sanitized_keys));
+    if (!empty($sanitized_keys)) {
+      $sanitized = TRUE;
+      if ($log_sanitized_keys) {
+        trigger_error(sprintf($message, implode(', ', $sanitized_keys)));
+      }
+    }
+
+    if ($bag->has('destination')) {
+      $destination_dangerous_keys = static::checkDestination($bag->get('destination'), $whitelist);
+      if (!empty($destination_dangerous_keys)) {
+        // The destination is removed rather than sanitized because the URL
+        // generator service is not available and this method is called very
+        // early in the bootstrap.
+        $bag->remove('destination');
+        $sanitized = TRUE;
+        if ($log_sanitized_keys) {
+          trigger_error(sprintf('Potentially unsafe destination removed from %s parameter bag because it contained the following keys: %s', $bag_name, implode(', ', $destination_dangerous_keys)));
+        }
+      }
+    }
+    return $sanitized;
+  }
+
+  /**
+   * Checks a destination string to see if it is dangerous.
+   *
+   * @param string $destination
+   *   The destination string to check.
+   * @param array $whitelist
+   *   An array of keys to whitelist as safe.
+   *
+   * @return array
+   *   The dangerous keys found in the destination parameter.
+   */
+  protected static function checkDestination($destination, array $whitelist) {
+    $dangerous_keys = [];
+    $parts = UrlHelper::parse($destination);
+    // If there is a query string, check its query parameters.
+    if (!empty($parts['query'])) {
+      static::stripDangerousValues($parts['query'], $whitelist, $dangerous_keys);
+    }
+    return $dangerous_keys;
+  }
+
+  /**
+   * Strips dangerous keys from $input.
+   *
+   * @param mixed $input
+   *   The input to sanitize.
+   * @param string[] $whitelist
+   *   An array of keys to whitelist as safe.
+   * @param string[] $sanitized_keys
+   *   An array of keys that have been removed.
+   *
+   * @return mixed
+   *   The sanitized input.
+   */
+  protected static function stripDangerousValues($input, array $whitelist, array &$sanitized_keys) {
+    if (is_array($input)) {
+      foreach ($input as $key => $value) {
+        if ($key !== '' && $key[0] === '#' && !in_array($key, $whitelist, TRUE)) {
+          unset($input[$key]);
+          $sanitized_keys[] = $key;
+        }
+        else {
+          $input[$key] = static::stripDangerousValues($input[$key], $whitelist, $sanitized_keys);
+        }
+      }
+    }
+    return $input;
+  }
+
+}

core/modules/action/action.info.yml

@@ -2,12 +2,6 @@ name: Actions
 type: module
 description: 'Perform tasks on specific events triggered within the system.'
 package: Core
-# version: VERSION
-# core: 8.x
+version: VERSION
+core: 8.x
 configure: entity.action.collection
-
-# Information added by Drupal.org packaging script on 2018-03-07
-version: '8.5.0'
-core: '8.x'
-project: 'drupal'
-datestamp: 1520457826

core/modules/action/tests/action_bulk_test/action_bulk_test.info.yml

@@ -2,15 +2,9 @@ name: 'Action bulk form test'
 type: module
 description: 'Support module for action bulk form testing.'
 package: Testing
-# version: VERSION
-# core: 8.x
+version: VERSION
+core: 8.x
 dependencies:
   - action
   - views
   - node
-
-# Information added by Drupal.org packaging script on 2018-03-07
-version: '8.5.0'
-core: '8.x'
-project: 'drupal'
-datestamp: 1520457826

core/modules/action/tests/action_form_ajax_test/action_form_ajax_test.info.yml

@@ -2,12 +2,6 @@ name: action_form_ajax_test
 type: module
 description: 'module used for testing ajax in action config entity forms.'
 package: Core
-# version: VERSION
-# core: 8.x
+version: VERSION
+core: 8.x
 hidden: true
-
-# Information added by Drupal.org packaging script on 2018-03-07
-version: '8.5.0'
-core: '8.x'
-project: 'drupal'
-datestamp: 1520457826

core/modules/aggregator/aggregator.info.yml

@@ -2,15 +2,9 @@ name: Aggregator
 type: module
 description: 'Aggregates syndicated content (RSS, RDF, and Atom feeds) from external sources.'
 package: Core
-# version: VERSION
-# core: 8.x
+version: VERSION
+core: 8.x
 configure: aggregator.admin_settings
 dependencies:
   - file
   - options
-
-# Information added by Drupal.org packaging script on 2018-03-07
-version: '8.5.0'
-core: '8.x'
-project: 'drupal'
-datestamp: 1520457826

core/modules/aggregator/tests/modules/aggregator_test/aggregator_test.info.yml

@@ -2,11 +2,5 @@ name: 'Aggregator module tests'
 type: module
 description: 'Support module for aggregator related testing.'
 package: Testing
-# version: VERSION
-# core: 8.x
-
-# Information added by Drupal.org packaging script on 2018-03-07
-version: '8.5.0'
-core: '8.x'
-project: 'drupal'
-datestamp: 1520457826
+version: VERSION
+core: 8.x

core/modules/aggregator/tests/modules/aggregator_test_views/aggregator_test_views.info.yml

@@ -2,14 +2,8 @@ name: 'Aggregator test views'
 type: module
 description: 'Provides default views for views aggregator tests.'
 package: Testing
-# version: VERSION
-# core: 8.x
+version: VERSION
+core: 8.x
 dependencies:
   - aggregator
   - views
-
-# Information added by Drupal.org packaging script on 2018-03-07
-version: '8.5.0'
-core: '8.x'
-project: 'drupal'
-datestamp: 1520457826

core/modules/automated_cron/automated_cron.info.yml

@@ -2,12 +2,6 @@ name: 'Automated Cron'
 type: module
 description: 'Provides an automated way to run cron jobs, by executing them at the end of a server response.'
 package: Core
-# version: VERSION
-# core: 8.x
+version: VERSION
+core: 8.x
 configure: system.cron_settings
-
-# Information added by Drupal.org packaging script on 2018-03-07
-version: '8.5.0'
-core: '8.x'
-project: 'drupal'
-datestamp: 1520457826

core/modules/ban/ban.info.yml

@@ -2,12 +2,6 @@ name: Ban
 type: module
 description: 'Enables banning of IP addresses.'
 package: Core
-# version: VERSION
-# core: 8.x
+version: VERSION
+core: 8.x
 configure: ban.admin_page
-
-# Information added by Drupal.org packaging script on 2018-03-07
-version: '8.5.0'
-core: '8.x'
-project: 'drupal'
-datestamp: 1520457826

core/modules/basic_auth/basic_auth.info.yml

@@ -2,13 +2,7 @@ name: 'HTTP Basic Authentication'
 type: module
 description: 'Provides the HTTP Basic authentication provider'
 package: Web services
-# version: VERSION
-# core: 8.x
+version: VERSION
+core: 8.x
 dependencies:
   - user
-
-# Information added by Drupal.org packaging script on 2018-03-07
-version: '8.5.0'
-core: '8.x'
-project: 'drupal'
-datestamp: 1520457826

core/modules/basic_auth/tests/modules/basic_auth_test/basic_auth_test.info.yml

@@ -2,11 +2,5 @@ name: 'HTTP Basic Authentication test'
 type: module
 description: 'Support module for HTTP Basic Authentication testing.'
 package: Testing
-# version: VERSION
-# core: 8.x
-
-# Information added by Drupal.org packaging script on 2018-03-07
-version: '8.5.0'
-core: '8.x'
-project: 'drupal'
-datestamp: 1520457826
+version: VERSION
+core: 8.x

core/modules/big_pipe/big_pipe.info.yml

@@ -2,11 +2,5 @@ name: BigPipe
 type: module
 description: 'Sends pages using the BigPipe technique that allows browsers to show them much faster.'
 package: Core
-# version: VERSION
-# core: 8.x
-
-# Information added by Drupal.org packaging script on 2018-03-07
-version: '8.5.0'
-core: '8.x'
-project: 'drupal'
-datestamp: 1520457826
+version: VERSION
+core: 8.x

core/modules/big_pipe/tests/modules/big_pipe_regression_test/big_pipe_regression_test.info.yml

@@ -2,11 +2,5 @@ name: 'BigPipe regression test'
 type: module
 description: 'Support module for BigPipe regression testing.'
 package: Testing
-# version: VERSION
-# core: 8.x
-
-# Information added by Drupal.org packaging script on 2018-03-07
-version: '8.5.0'
-core: '8.x'
-project: 'drupal'
-datestamp: 1520457826
+version: VERSION
+core: 8.x

core/modules/big_pipe/tests/modules/big_pipe_test/big_pipe_test.info.yml

@@ -2,11 +2,5 @@ name: 'BigPipe test'
 type: module
 description: 'Support module for BigPipe testing.'
 package: Testing
-# version: VERSION
-# core: 8.x
-
-# Information added by Drupal.org packaging script on 2018-03-07
-version: '8.5.0'
-core: '8.x'
-project: 'drupal'
-datestamp: 1520457826
+version: VERSION
+core: 8.x