update to 7.21

Signed-off-by: bachy <git@g-u-i.net>

.htaccess

@@ -71,6 +71,18 @@ DirectoryIndex index.php index.html index.htm
   # downloaded.
   RewriteRule "(^|/)\." - [F]
 
+# custom
+  RewriteCond %{HTTP_HOST} ^basebeta\.materio\.com [OR]
+  RewriteCond %{HTTP_HOST} ^materio\.com [OR]
+  RewriteCond %{HTTP_HOST} ^www\.materio\.fr [OR]
+  RewriteCond %{HTTP_HOST} ^materio\.fr [OR]
+  RewriteCond %{HTTP_HOST} ^www\.materio\.net [OR]
+  RewriteCond %{HTTP_HOST} ^materio\.net [OR]
+  RewriteCond %{HTTP_HOST} ^www\.materio\.eu [OR]
+  RewriteCond %{HTTP_HOST} ^materio\.eu [NC]
+  RewriteRule ^ http://www.materio.com%{REQUEST_URI} [L,R=301]
+
+
   # If your site can be accessed both with and without the 'www.' prefix, you
   # can use one of the following settings to redirect users to your preferred
   # URL, either WITH or WITHOUT the 'www.' prefix. Choose ONLY one option:

1754162-15-language-in-login-cancel-links.patch

@@ -0,0 +1,155 @@
+diff --git a/modules/user/user.module b/modules/user/user.module
+index 47ac642..c204f6d 100644
+--- a/modules/user/user.module
++++ b/modules/user/user.module
+@@ -2286,14 +2286,26 @@ function user_external_login_register($name, $module) {
+  *
+  * @param object $account
+  *   An object containing the user account.
++ * @param array $options
++ *   (optional) A keyed array of settings. Supported options are:
++ *   - langcode: A language code to be used when generating locale-sensitive
++ *    urls. If langcode is NULL the users preferred language is used.
+  *
+  * @return
+  *   A unique URL that provides a one-time log in for the user, from which
+  *   they can change their password.
+  */
+-function user_pass_reset_url($account) {
++function user_pass_reset_url($account, $options = array()) {
+   $timestamp = REQUEST_TIME;
+-  return url("user/reset/$account->uid/$timestamp/" . user_pass_rehash($account->pass, $timestamp, $account->login), array('absolute' => TRUE));
++  $url_options = array('absolute' => TRUE);
++  if (isset($options['langcode'])) {
++    $languages = language_list();
++    $url_options['language'] = $languages[$options['langcode']];
++  }
++  else {
++    $url_options['language'] = user_preferred_language($account);
++  }
++  return url("user/reset/$account->uid/$timestamp/" . user_pass_rehash($account->pass, $timestamp, $account->login), $url_options);
+ }
+ 
+ /**
+@@ -2305,6 +2317,10 @@ function user_pass_reset_url($account) {
+  *   - uid: The user uid number.
+  *   - pass: The hashed user password string.
+  *   - login: The user login name.
++ * @param array $options
++ *   (optional) A keyed array of settings. Supported options are:
++ *   - langcode: A language code to be used when generating locale-sensitive
++  *    urls. If langcode is NULL the users preferred language is used.
+  *
+  * @return
+  *   A unique URL that may be used to confirm the cancellation of the user
+@@ -2313,9 +2329,17 @@ function user_pass_reset_url($account) {
+  * @see user_mail_tokens()
+  * @see user_cancel_confirm()
+  */
+-function user_cancel_url($account) {
++function user_cancel_url($account, $options = array()) {
+   $timestamp = REQUEST_TIME;
+-  return url("user/$account->uid/cancel/confirm/$timestamp/" . user_pass_rehash($account->pass, $timestamp, $account->login), array('absolute' => TRUE));
++  $url_options = array('absolute' => TRUE);
++  if (isset($options['langcode'])) {
++    $languages = language_list();
++    $url_options['language'] = $languages[$options['langcode']];
++  }
++  else {
++    $url_options['language'] = user_preferred_language($account);
++  }
++  return url("user/$account->uid/cancel/confirm/$timestamp/" . user_pass_rehash($account->pass, $timestamp, $account->login), $url_options);
+ }
+ 
+ /**
+@@ -2752,7 +2776,7 @@ Your account on [site:name] has been canceled.
+   if ($replace) {
+     // We do not sanitize the token replacement, since the output of this
+     // replacement is intended for an e-mail message, not a web browser.
+-    return token_replace($text, $variables, array('language' => $language, 'callback' => 'user_mail_tokens', 'sanitize' => FALSE, 'clear' => TRUE));
++    return token_replace($text, $variables, array('langcode' => $langcode, 'callback' => 'user_mail_tokens', 'sanitize' => FALSE, 'clear' => TRUE));
+   }
+ 
+   return $text;
+@@ -2779,8 +2803,8 @@ Your account on [site:name] has been canceled.
+  */
+ function user_mail_tokens(&$replacements, $data, $options) {
+   if (isset($data['user'])) {
+-    $replacements['[user:one-time-login-url]'] = user_pass_reset_url($data['user']);
+-    $replacements['[user:cancel-url]'] = user_cancel_url($data['user']);
++    $replacements['[user:one-time-login-url]'] = user_pass_reset_url($data['user'], $options);
++    $replacements['[user:cancel-url]'] = user_cancel_url($data['user'], $options);
+   }
+ }
+ 
+diff --git a/modules/user/user.test b/modules/user/user.test
+index b53db07..0417642 100644
+--- a/modules/user/user.test
++++ b/modules/user/user.test
+@@ -2012,6 +2012,26 @@ class UserTokenReplaceTestCase extends DrupalWebTestCase {
+     );
+   }
+ 
++  public function setUp() {
++    parent::setUp('locale');
++
++    $account = $this->drupalCreateUser(array('access administration pages', 'administer languages'));
++    $this->drupalLogin($account);
++
++    // Add language.
++    $edit = array('langcode' => 'de');
++    $this->drupalPost('admin/config/regional/language/add', $edit, t('Add language'));
++
++    // Enable URL language detection and selection.
++    $edit = array('language[enabled][locale-url]' => 1);
++    $this->drupalPost('admin/config/regional/language/configure', $edit, t('Save settings'));
++
++    // Reset static caching.
++    drupal_static_reset('language_list');
++    drupal_static_reset('locale_url_outbound_alter');
++    drupal_static_reset('locale_language_url_rewrite_url');
++  }
++
+   /**
+    * Creates a user, then tests the tokens generated from it.
+    */
+@@ -2062,6 +2082,39 @@ class UserTokenReplaceTestCase extends DrupalWebTestCase {
+       $output = token_replace($input, array('user' => $account), array('language' => $language, 'sanitize' => FALSE));
+       $this->assertEqual($output, $expected, t('Unsanitized user token %token replaced.', array('%token' => $input)));
+     }
++
++    $languages = language_list();
++
++    // Generate login and cancel link.
++    $tests = array();
++    $tests['[user:one-time-login-url]'] = user_pass_reset_url($account);
++    $tests['[user:cancel-url]'] = user_cancel_url($account);
++
++    // Generate tokens with interface language.
++    $link = url('user', array('absolute' => TRUE));
++    foreach ($tests as $input => $expected) {
++      $output = token_replace($input, array('user' => $account), array('langcode' => $language->language, 'callback' => 'user_mail_tokens', 'sanitize' => FALSE, 'clear' => TRUE));
++      $this->assertTrue(strpos($output, $link) === 0, 'Generated URL is in interface language.');
++    }
++
++    // Generate tokens with the user's preferred language.
++    $edit['language'] = 'de';
++    $account = user_save($account, $edit);
++    $link = url('user', array('language' => $languages[$account->language], 'absolute' => TRUE));
++    foreach ($tests as $input => $expected) {
++      $output = token_replace($input, array('user' => $account), array('callback' => 'user_mail_tokens', 'sanitize' => FALSE, 'clear' => TRUE));
++      $this->assertTrue(strpos($output, $link) === 0, "Generated URL is in the user's preferred language.");
++    }
++
++    // Generate tokens with one specific language.
++    $link = url('user', array('language' => $languages['de'], 'absolute' => TRUE));
++    foreach ($tests as $input => $expected) {
++      foreach (array($user1, $user2) as $account) {
++        $output = token_replace($input, array('user' => $account), array('langcode' => 'de', 'callback' => 'user_mail_tokens', 'sanitize' => FALSE, 'clear' => TRUE));
++        $this->assertTrue(strpos($output, $link) === 0, "Generated URL in in the requested language.");
++      }
++    }
++
+   }
+ }
+ 

CHANGELOG.txt

@@ -1,4 +1,21 @@
 
+Drupal 7.21, 2013-03-06
+-----------------------
+- Allowed sites using the 'image_allow_insecure_derivatives' variable to still
+  have partial protection from the security issues fixed in Drupal 7.20.
+
+Drupal 7.20, 2013-02-20
+-----------------------
+- Fixed security issues (denial of service). See SA-CORE-2013-002.
+
+Drupal 7.19, 2013-01-16
+-----------------------
+- Fixed security issues (multiple vulnerabilities). See SA-CORE-2013-001.
+
+Drupal 7.18, 2012-12-19
+-----------------------
+- Fixed security issues (multiple vulnerabilities). See SA-CORE-2012-004.
+
 Drupal 7.17, 2012-11-07
 -----------------------
 - Changed the default value of the '404_fast_html' variable to have a DOCTYPE

includes/bootstrap.inc

@@ -8,7 +8,7 @@
 /**
  * The current system version.
  */
-define('VERSION', '7.17');
+define('VERSION', '7.21');
 
 /**
  * Core API compatibility.

includes/file.inc

@@ -1113,6 +1113,9 @@ function file_munge_filename($filename, $extensions, $alerts = TRUE) {
 
   // Allow potentially insecure uploads for very savvy users and admin
   if (!variable_get('allow_insecure_uploads', 0)) {
+    // Remove any null bytes. See http://php.net/manual/en/security.filesystem.nullbytes.php
+    $filename = str_replace(chr(0), '', $filename);
+
     $whitelist = array_unique(explode(' ', trim($extensions)));
 
     // Split the filename up by periods. The first part becomes the basename

misc/collapse.js

@@ -58,9 +58,9 @@ Drupal.behaviors.collapse = {
     $('fieldset.collapsible', context).once('collapse', function () {
       var $fieldset = $(this);
       // Expand fieldset if there are errors inside, or if it contains an
-      // element that is targeted by the URI fragment identifier. 
+      // element that is targeted by the URI fragment identifier.
       var anchor = location.hash && location.hash != '#' ? ', ' + location.hash : '';
-      if ($('.error' + anchor, $fieldset).length) {
+      if ($fieldset.find('.error' + anchor).length) {
         $fieldset.removeClass('collapsed');
       }
 

misc/drupal.js

@@ -6,6 +6,27 @@ jQuery.noConflict();
 
 (function ($) {
 
+/**
+ * Override jQuery.fn.init to guard against XSS attacks.
+ *
+ * See http://bugs.jquery.com/ticket/9521
+ */
+var jquery_init = $.fn.init;
+$.fn.init = function (selector, context, rootjQuery) {
+  // If the string contains a "#" before a "<", treat it as invalid HTML.
+  if (selector && typeof selector === 'string') {
+    var hash_position = selector.indexOf('#');
+    if (hash_position >= 0) {
+      var bracket_position = selector.indexOf('<');
+      if (bracket_position > hash_position) {
+        throw 'Syntax error, unrecognized expression: ' + selector;
+      }
+    }
+  }
+  return jquery_init.call(this, selector, context, rootjQuery);
+};
+$.fn.init.prototype = jquery_init.prototype;
+
 /**
  * Attach all registered behaviors to a page element.
  *

misc/vertical-tabs.js

@@ -50,8 +50,8 @@ Drupal.behaviors.verticalTabs = {
       if (!tab_focus) {
         // If the current URL has a fragment and one of the tabs contains an
         // element that matches the URL fragment, activate that tab.
-        if (window.location.hash && $(window.location.hash, this).length) {
-          tab_focus = $(window.location.hash, this).closest('.vertical-tabs-pane');
+        if (window.location.hash && $(this).find(window.location.hash).length) {
+          tab_focus = $(this).find(window.location.hash).closest('.vertical-tabs-pane');
         }
         else {
           tab_focus = $('> .vertical-tabs-pane:first', this);

modules/aggregator/aggregator.info

@@ -7,8 +7,8 @@ files[] = aggregator.test
 configure = admin/config/services/aggregator/settings
 stylesheets[all][] = aggregator.css
 
-; Information added by drupal.org packaging script on 2012-11-07
-version = "7.17"
+; Information added by drupal.org packaging script on 2013-03-07
+version = "7.21"
 project = "drupal"
-datestamp = "1352325357"
+datestamp = "1362616996"
 

modules/aggregator/tests/aggregator_test.info

@@ -5,8 +5,8 @@ version = VERSION
 core = 7.x
 hidden = TRUE
 
-; Information added by drupal.org packaging script on 2012-11-07
-version = "7.17"
+; Information added by drupal.org packaging script on 2013-03-07
+version = "7.21"
 project = "drupal"
-datestamp = "1352325357"
+datestamp = "1362616996"
 

modules/block/block.info

@@ -6,8 +6,8 @@ core = 7.x
 files[] = block.test
 configure = admin/structure/block
 
-; Information added by drupal.org packaging script on 2012-11-07
-version = "7.17"
+; Information added by drupal.org packaging script on 2013-03-07
+version = "7.21"
 project = "drupal"
-datestamp = "1352325357"
+datestamp = "1362616996"
 

modules/block/tests/block_test.info

@@ -5,8 +5,8 @@ version = VERSION
 core = 7.x
 hidden = TRUE
 
-; Information added by drupal.org packaging script on 2012-11-07
-version = "7.17"
+; Information added by drupal.org packaging script on 2013-03-07
+version = "7.21"
 project = "drupal"
-datestamp = "1352325357"
+datestamp = "1362616996"
 

modules/block/tests/themes/block_test_theme/block_test_theme.info

@@ -13,8 +13,8 @@ regions[footer] = Footer
 regions[highlighted] = Highlighted
 regions[help] = Help
 
-; Information added by drupal.org packaging script on 2012-11-07
-version = "7.17"
+; Information added by drupal.org packaging script on 2013-03-07
+version = "7.21"
 project = "drupal"
-datestamp = "1352325357"
+datestamp = "1362616996"
 

modules/blog/blog.info

@@ -5,8 +5,8 @@ version = VERSION
 core = 7.x
 files[] = blog.test
 
-; Information added by drupal.org packaging script on 2012-11-07
-version = "7.17"
+; Information added by drupal.org packaging script on 2013-03-07
+version = "7.21"
 project = "drupal"
-datestamp = "1352325357"
+datestamp = "1362616996"
 

modules/book/book.info

@@ -7,8 +7,8 @@ files[] = book.test
 configure = admin/content/book/settings
 stylesheets[all][] = book.css
 
-; Information added by drupal.org packaging script on 2012-11-07
-version = "7.17"
+; Information added by drupal.org packaging script on 2013-03-07
+version = "7.21"
 project = "drupal"
-datestamp = "1352325357"
+datestamp = "1362616996"
 

modules/book/book.pages.inc

@@ -38,6 +38,15 @@ function book_render() {
  *   format determined by the $type parameter.
  */
 function book_export($type, $nid) {
+  // Check that the node exists and that the current user has access to it.
+  $node = node_load($nid);
+  if (!$node) {
+    return MENU_NOT_FOUND;
+  }
+  if (!node_access('view', $node)) {
+    return MENU_ACCESS_DENIED;
+  }
+
   $type = drupal_strtolower($type);
 
   $export_function = 'book_export_' . $type;

modules/book/book.test

@@ -258,6 +258,13 @@ class BookTestCase extends DrupalWebTestCase {
     // Try getting the URL directly, and verify it fails.
     $this->drupalGet('book/export/html/' . $this->book->nid);
     $this->assertResponse('403', t('Anonymous user properly forbidden.'));
+
+    // Now grant anonymous users permission to view the printer-friendly
+    // version and verify that node access restrictions still prevent them from
+    // seeing it.
+    user_role_grant_permissions(DRUPAL_ANONYMOUS_RID, array('access printer-friendly version'));
+    $this->drupalGet('book/export/html/' . $this->book->nid);
+    $this->assertResponse('403', 'Anonymous user properly forbidden from seeing the printer-friendly version when denied by node access.');
   }
 
   /**

modules/color/color.info

@@ -5,8 +5,8 @@ version = VERSION
 core = 7.x
 files[] = color.test
 
-; Information added by drupal.org packaging script on 2012-11-07
-version = "7.17"
+; Information added by drupal.org packaging script on 2013-03-07
+version = "7.21"
 project = "drupal"
-datestamp = "1352325357"
+datestamp = "1362616996"
 

modules/comment/comment.info

@@ -9,8 +9,8 @@ files[] = comment.test
 configure = admin/content/comment
 stylesheets[all][] = comment.css
 
-; Information added by drupal.org packaging script on 2012-11-07
-version = "7.17"
+; Information added by drupal.org packaging script on 2013-03-07
+version = "7.21"
 project = "drupal"
-datestamp = "1352325357"
+datestamp = "1362616996"
 

modules/contact/contact.info

@@ -6,8 +6,8 @@ core = 7.x
 files[] = contact.test
 configure = admin/structure/contact
 
-; Information added by drupal.org packaging script on 2012-11-07
-version = "7.17"
+; Information added by drupal.org packaging script on 2013-03-07
+version = "7.21"
 project = "drupal"
-datestamp = "1352325357"
+datestamp = "1362616996"
 

modules/contextual/contextual.info

@@ -5,8 +5,8 @@ version = VERSION
 core = 7.x
 files[] = contextual.test
 
-; Information added by drupal.org packaging script on 2012-11-07
-version = "7.17"
+; Information added by drupal.org packaging script on 2013-03-07
+version = "7.21"
 project = "drupal"
-datestamp = "1352325357"
+datestamp = "1362616996"
 

modules/dashboard/dashboard.info

@@ -7,8 +7,8 @@ files[] = dashboard.test
 dependencies[] = block
 configure = admin/dashboard/customize
 
-; Information added by drupal.org packaging script on 2012-11-07
-version = "7.17"
+; Information added by drupal.org packaging script on 2013-03-07
+version = "7.21"
 project = "drupal"
-datestamp = "1352325357"
+datestamp = "1362616996"
 

modules/dblog/dblog.info

@@ -5,8 +5,8 @@ version = VERSION
 core = 7.x
 files[] = dblog.test
 
-; Information added by drupal.org packaging script on 2012-11-07
-version = "7.17"
+; Information added by drupal.org packaging script on 2013-03-07
+version = "7.21"
 project = "drupal"
-datestamp = "1352325357"
+datestamp = "1362616996"
 

modules/field/field.info

@@ -10,8 +10,8 @@ dependencies[] = field_sql_storage
 required = TRUE
 stylesheets[all][] = theme/field.css
 
-; Information added by drupal.org packaging script on 2012-11-07
-version = "7.17"
+; Information added by drupal.org packaging script on 2013-03-07
+version = "7.21"
 project = "drupal"
-datestamp = "1352325357"
+datestamp = "1362616996"
 

modules/field/modules/field_sql_storage/field_sql_storage.info

@@ -7,8 +7,8 @@ dependencies[] = field
 files[] = field_sql_storage.test
 required = TRUE
 
-; Information added by drupal.org packaging script on 2012-11-07
-version = "7.17"
+; Information added by drupal.org packaging script on 2013-03-07
+version = "7.21"
 project = "drupal"
-datestamp = "1352325357"
+datestamp = "1362616996"
 

modules/field/modules/list/list.info

@@ -7,8 +7,8 @@ dependencies[] = field
 dependencies[] = options
 files[] = tests/list.test
 
-; Information added by drupal.org packaging script on 2012-11-07
-version = "7.17"
+; Information added by drupal.org packaging script on 2013-03-07
+version = "7.21"
 project = "drupal"
-datestamp = "1352325357"
+datestamp = "1362616996"
 

modules/field/modules/list/tests/list_test.info

@@ -5,8 +5,8 @@ package = Testing
 version = VERSION
 hidden = TRUE
 
-; Information added by drupal.org packaging script on 2012-11-07
-version = "7.17"
+; Information added by drupal.org packaging script on 2013-03-07
+version = "7.21"
 project = "drupal"
-datestamp = "1352325357"
+datestamp = "1362616996"
 

modules/field/modules/number/number.info

@@ -6,8 +6,8 @@ core = 7.x
 dependencies[] = field
 files[] = number.test
 
-; Information added by drupal.org packaging script on 2012-11-07
-version = "7.17"
+; Information added by drupal.org packaging script on 2013-03-07
+version = "7.21"
 project = "drupal"
-datestamp = "1352325357"
+datestamp = "1362616996"
 

modules/field/modules/options/options.info

@@ -6,8 +6,8 @@ core = 7.x
 dependencies[] = field
 files[] = options.test
 
-; Information added by drupal.org packaging script on 2012-11-07
-version = "7.17"
+; Information added by drupal.org packaging script on 2013-03-07
+version = "7.21"
 project = "drupal"
-datestamp = "1352325357"
+datestamp = "1362616996"
 

modules/field/modules/text/text.info

@@ -7,8 +7,8 @@ dependencies[] = field
 files[] = text.test
 required = TRUE
 
-; Information added by drupal.org packaging script on 2012-11-07
-version = "7.17"
+; Information added by drupal.org packaging script on 2013-03-07
+version = "7.21"
 project = "drupal"
-datestamp = "1352325357"
+datestamp = "1362616996"
 

modules/field/tests/field_test.info

@@ -6,8 +6,8 @@ files[] = field_test.entity.inc
 version = VERSION
 hidden = TRUE
 
-; Information added by drupal.org packaging script on 2012-11-07
-version = "7.17"
+; Information added by drupal.org packaging script on 2013-03-07
+version = "7.21"
 project = "drupal"
-datestamp = "1352325357"
+datestamp = "1362616996"
 

modules/field_ui/field_ui.info

@@ -6,8 +6,8 @@ core = 7.x
 dependencies[] = field
 files[] = field_ui.test
 
-; Information added by drupal.org packaging script on 2012-11-07
-version = "7.17"
+; Information added by drupal.org packaging script on 2013-03-07
+version = "7.21"
 project = "drupal"
-datestamp = "1352325357"
+datestamp = "1362616996"
 

modules/file/file.info

@@ -6,8 +6,8 @@ core = 7.x
 dependencies[] = field
 files[] = tests/file.test
 
-; Information added by drupal.org packaging script on 2012-11-07
-version = "7.17"
+; Information added by drupal.org packaging script on 2013-03-07
+version = "7.21"
 project = "drupal"
-datestamp = "1352325357"
+datestamp = "1362616996"
 

modules/file/tests/file_module_test.info

@@ -5,8 +5,8 @@ version = VERSION
 core = 7.x
 hidden = TRUE
 
-; Information added by drupal.org packaging script on 2012-11-07
-version = "7.17"
+; Information added by drupal.org packaging script on 2013-03-07
+version = "7.21"
 project = "drupal"
-datestamp = "1352325357"
+datestamp = "1362616996"
 

modules/filter/filter.info

@@ -7,8 +7,8 @@ files[] = filter.test
 required = TRUE
 configure = admin/config/content/formats
 
-; Information added by drupal.org packaging script on 2012-11-07
-version = "7.17"
+; Information added by drupal.org packaging script on 2013-03-07
+version = "7.21"
 project = "drupal"
-datestamp = "1352325357"
+datestamp = "1362616996"
 

modules/forum/forum.info

@@ -9,8 +9,8 @@ files[] = forum.test
 configure = admin/structure/forum
 stylesheets[all][] = forum.css
 
-; Information added by drupal.org packaging script on 2012-11-07
-version = "7.17"
+; Information added by drupal.org packaging script on 2013-03-07
+version = "7.21"
 project = "drupal"
-datestamp = "1352325357"
+datestamp = "1362616996"
 

modules/help/help.info

@@ -5,8 +5,8 @@ version = VERSION
 core = 7.x
 files[] = help.test
 
-; Information added by drupal.org packaging script on 2012-11-07
-version = "7.17"
+; Information added by drupal.org packaging script on 2013-03-07
+version = "7.21"
 project = "drupal"
-datestamp = "1352325357"
+datestamp = "1362616996"
 

modules/image/image.info

@@ -7,8 +7,8 @@ dependencies[] = file
 files[] = image.test
 configure = admin/config/media/image-styles
 
-; Information added by drupal.org packaging script on 2012-11-07
-version = "7.17"
+; Information added by drupal.org packaging script on 2013-03-07
+version = "7.21"
 project = "drupal"
-datestamp = "1352325357"
+datestamp = "1362616996"
 

modules/image/image.module

@@ -30,6 +30,11 @@ define('IMAGE_STORAGE_EDITABLE', IMAGE_STORAGE_NORMAL | IMAGE_STORAGE_OVERRIDE);
  */
 define('IMAGE_STORAGE_MODULE', IMAGE_STORAGE_OVERRIDE | IMAGE_STORAGE_DEFAULT);
 
+/**
+ * The name of the query parameter for image derivative tokens.
+ */
+define('IMAGE_DERIVATIVE_TOKEN', 'itok');
+
 // Load all Field module hooks for Image.
 require_once DRUPAL_ROOT . '/modules/image/image.field.inc';
 
@@ -292,7 +297,8 @@ function image_file_download($uri) {
     if ($info = image_get_info($uri)) {
       // Check the permissions of the original to grant access to this image.
       $headers = module_invoke_all('file_download', $original_uri);
-      if (!in_array(-1, $headers)) {
+      // Confirm there's at least one module granting access and none denying access.
+      if (!empty($headers) && !in_array(-1, $headers)) {
         return array(
           // Send headers describing the image's size, and MIME-type...
           'Content-Type' => $info['mime_type'],
@@ -765,16 +771,26 @@ function image_style_options($include_empty = TRUE) {
  *   The image style
  */
 function image_style_deliver($style, $scheme) {
-  // Check that the style is defined and the scheme is valid.
-  if (!$style || !file_stream_wrapper_valid_scheme($scheme)) {
-    drupal_exit();
-  }
-
   $args = func_get_args();
   array_shift($args);
   array_shift($args);
   $target = implode('/', $args);
 
+  // Check that the style is defined, the scheme is valid, and the image
+  // derivative token is valid. (Sites which require image derivatives to be
+  // generated without a token can set the 'image_allow_insecure_derivatives'
+  // variable to TRUE to bypass the latter check, but this will increase the
+  // site's vulnerability to denial-of-service attacks. To prevent this
+  // variable from leaving the site vulnerable to the most serious attacks, a
+  // token is always required when a derivative of a derivative is requested.)
+  $valid = !empty($style) && file_stream_wrapper_valid_scheme($scheme);
+  if (!variable_get('image_allow_insecure_derivatives', FALSE) || strpos(ltrim($target, '\/'), 'styles/') === 0) {
+    $valid = $valid && isset($_GET[IMAGE_DERIVATIVE_TOKEN]) && $_GET[IMAGE_DERIVATIVE_TOKEN] === image_style_path_token($style['name'], $scheme . '://' . $target);
+  }
+  if (!$valid) {
+    return MENU_ACCESS_DENIED;
+  }
+
   $image_uri = $scheme . '://' . $target;
   $derivative_uri = image_style_path($style['name'], $image_uri);
 
@@ -853,6 +869,11 @@ function image_style_deliver($style, $scheme) {
  * @see image_style_load()
  */
 function image_style_create_derivative($style, $source, $destination) {
+  // If the source file doesn't exist, return FALSE without creating folders.
+  if (!$image = image_load($source)) {
+    return FALSE;
+  }
+
   // Get the folder for the final location of this style.
   $directory = drupal_dirname($destination);
 
@@ -862,10 +883,6 @@ function image_style_create_derivative($style, $source, $destination) {
     return FALSE;
   }
 
-  if (!$image = image_load($source)) {
-    return FALSE;
-  }
-
   foreach ($style['effects'] as $effect) {
     image_effect_apply($image, $effect);
   }
@@ -959,6 +976,10 @@ function image_style_flush($style) {
  */
 function image_style_url($style_name, $path) {
   $uri = image_style_path($style_name, $path);
+  // The token query is added even if the 'image_allow_insecure_derivatives'
+  // variable is TRUE, so that the emitted links remain valid if it is changed
+  // back to the default FALSE.
+  $token_query = array(IMAGE_DERIVATIVE_TOKEN => image_style_path_token($style_name, $path));
 
   // If not using clean URLs, the image derivative callback is only available
   // with the query string. If the file does not exist, use url() to ensure
@@ -966,10 +987,33 @@ function image_style_url($style_name, $path) {
   // actual file path, this avoids bootstrapping PHP once the files are built.
   if (!variable_get('clean_url') && file_uri_scheme($uri) == 'public' && !file_exists($uri)) {
     $directory_path = file_stream_wrapper_get_instance_by_uri($uri)->getDirectoryPath();
-    return url($directory_path . '/' . file_uri_target($uri), array('absolute' => TRUE));
+    return url($directory_path . '/' . file_uri_target($uri), array('absolute' => TRUE, 'query' => $token_query));
   }
 
-  return file_create_url($uri);
+  $file_url = file_create_url($uri);
+  // Append the query string with the token.
+  return $file_url . (strpos($file_url, '?') !== FALSE ? '&' : '?') . drupal_http_build_query($token_query);
+}
+
+/**
+ * Generates a token to protect an image style derivative.
+ *
+ * This prevents unauthorized generation of an image style derivative,
+ * which can be costly both in CPU time and disk space.
+ *
+ * @param $style_name
+ *   The name of the image style.
+ * @param $uri
+ *   The URI of the image for this style, for example as returned by
+ *   image_style_path().
+ *
+ * @return
+ *   An eight-character token which can be used to protect image style
+ *   derivatives against denial-of-service attacks.
+ */
+function image_style_path_token($style_name, $uri) {
+  // Return the first eight characters.
+  return substr(drupal_hmac_base64($style_name . ':' . $uri, drupal_get_private_key() . drupal_get_hash_salt()), 0, 8);
 }
 
 /**

modules/image/image.test

@@ -192,13 +192,19 @@ class ImageStylesPathAndUrlTestCase extends DrupalWebTestCase {
     $this->assertNotIdentical(FALSE, $original_uri, t('Created the generated image file.'));
 
     // Get the URL of a file that has not been generated and try to create it.
-    $generated_uri = $scheme . '://styles/' . $this->style_name . '/' . $scheme . '/'. drupal_basename($original_uri);
+    $generated_uri = image_style_path($this->style_name, $original_uri);
     $this->assertFalse(file_exists($generated_uri), t('Generated file does not exist.'));
     $generate_url = image_style_url($this->style_name, $original_uri);
 
     if (!$clean_url) {
       $this->assertTrue(strpos($generate_url, '?q=') !== FALSE, 'When using non-clean URLS, the system path contains the query string.');
     }
+    // Add some extra chars to the token.
+    $this->drupalGet(str_replace(IMAGE_DERIVATIVE_TOKEN . '=', IMAGE_DERIVATIVE_TOKEN . '=Zo', $generate_url));
+    $this->assertResponse(403, 'Image was inaccessible at the URL wih an invalid token.');
+    // Change the parameter name so the token is missing.
+    $this->drupalGet(str_replace(IMAGE_DERIVATIVE_TOKEN . '=', 'wrongparam=', $generate_url));
+    $this->assertResponse(403, 'Image was inaccessible at the URL wih a missing token.');
 
     // Fetch the URL that generates the file.
     $this->drupalGet($generate_url);
@@ -238,6 +244,56 @@ class ImageStylesPathAndUrlTestCase extends DrupalWebTestCase {
         $this->assertNoRaw( chr(137) . chr(80) . chr(78) . chr(71) . chr(13) . chr(10) . chr(26) . chr(10), 'No PNG signature found in the response body.');
       }
     }
+    elseif ($clean_url) {
+      // Add some extra chars to the token.
+      $this->drupalGet(str_replace(IMAGE_DERIVATIVE_TOKEN . '=', IMAGE_DERIVATIVE_TOKEN . '=Zo', $generate_url));
+      $this->assertResponse(200, 'Existing image was accessible at the URL wih an invalid token.');
+    }
+
+    // Allow insecure image derivatives to be created for the remainder of this
+    // test.
+    variable_set('image_allow_insecure_derivatives', TRUE);
+
+    // Create another working copy of the file.
+    $files = $this->drupalGetTestFiles('image');
+    $file = array_shift($files);
+    $image_info = image_get_info($file->uri);
+    $original_uri = file_unmanaged_copy($file->uri, $scheme . '://', FILE_EXISTS_RENAME);
+    // Let the image_module_test module know about this file, so it can claim
+    // ownership in hook_file_download().
+    variable_set('image_module_test_file_download', $original_uri);
+
+    // Get the URL of a file that has not been generated and try to create it.
+    $generated_uri = image_style_path($this->style_name, $original_uri);
+    $this->assertFalse(file_exists($generated_uri), 'Generated file does not exist.');
+    $generate_url = image_style_url($this->style_name, $original_uri);
+
+    // Check that the image is accessible even without the security token.
+    $this->drupalGet(str_replace(IMAGE_DERIVATIVE_TOKEN . '=', 'wrongparam=', $generate_url));
+    $this->assertResponse(200, 'Image was accessible at the URL with a missing token.');
+
+    // Check that a security token is still required when generating a second
+    // image derivative using the first one as a source.
+    $nested_uri = image_style_path($this->style_name, $generated_uri);
+    $nested_url = image_style_url($this->style_name, $generated_uri);
+    $nested_url_with_wrong_token = str_replace(IMAGE_DERIVATIVE_TOKEN . '=', 'wrongparam=', $nested_url);
+    $this->drupalGet($nested_url_with_wrong_token);
+    $this->assertResponse(403, 'Image generated from an earlier derivative was inaccessible at the URL with a missing token.');
+    // Check that this restriction cannot be bypassed by adding extra slashes
+    // to the URL.
+    $this->drupalGet(substr_replace($nested_url_with_wrong_token, '//styles/', strrpos($nested_url_with_wrong_token, '/styles/'), strlen('/styles/')));
+    $this->assertResponse(403, 'Image generated from an earlier derivative was inaccessible at the URL with a missing token, even with an extra forward slash in the URL.');
+    $this->drupalGet(substr_replace($nested_url_with_wrong_token, '/\styles/', strrpos($nested_url_with_wrong_token, '/styles/'), strlen('/styles/')));
+    $this->assertResponse(403, 'Image generated from an earlier derivative was inaccessible at the URL with a missing token, even with an extra backslash in the URL.');
+    // Make sure the image can still be generated if a correct token is used.
+    $this->drupalGet($nested_url);
+    $this->assertResponse(200, 'Image was accessible when a correct token was provided in the URL.');
+
+    // Check that requesting a nonexistent image does not create any new
+    // directories in the file system.
+    $directory = $scheme . '://styles/' . $this->style_name . '/' . $scheme . '/' . $this->randomName();
+    $this->drupalGet(file_create_url($directory . '/' . $this->randomName()));
+    $this->assertFalse(file_exists($directory), 'New directory was not created in the filesystem when requesting an unauthorized image.');
   }
 }
 
@@ -661,7 +717,7 @@ class ImageAdminStylesUnitTest extends ImageFieldTestCase {
 
     // Test that image is displayed using newly created style.
     $this->drupalGet('node/' . $nid);
-    $this->assertRaw(image_style_url($style_name, $node->{$field_name}[LANGUAGE_NONE][0]['uri']), t('Image displayed using style @style.', array('@style' => $style_name)));
+    $this->assertRaw(check_plain(image_style_url($style_name, $node->{$field_name}[LANGUAGE_NONE][0]['uri'])), t('Image displayed using style @style.', array('@style' => $style_name)));
 
     // Rename the style and make sure the image field is updated.
     $new_style_name = strtolower($this->randomName(10));
@@ -671,7 +727,7 @@ class ImageAdminStylesUnitTest extends ImageFieldTestCase {
     $this->drupalPost('admin/config/media/image-styles/edit/' . $style_name, $edit, t('Update style'));
     $this->assertText(t('Changes to the style have been saved.'), t('Style %name was renamed to %new_name.', array('%name' => $style_name, '%new_name' => $new_style_name)));
     $this->drupalGet('node/' . $nid);
-    $this->assertRaw(image_style_url($new_style_name, $node->{$field_name}[LANGUAGE_NONE][0]['uri']), t('Image displayed using style replacement style.'));
+    $this->assertRaw(check_plain(image_style_url($new_style_name, $node->{$field_name}[LANGUAGE_NONE][0]['uri'])), t('Image displayed using style replacement style.'));
 
     // Delete the style and choose a replacement style.
     $edit = array(
@@ -682,7 +738,7 @@ class ImageAdminStylesUnitTest extends ImageFieldTestCase {
     $this->assertRaw($message, $message);
 
     $this->drupalGet('node/' . $nid);
-    $this->assertRaw(image_style_url('thumbnail', $node->{$field_name}[LANGUAGE_NONE][0]['uri']), t('Image displayed using style replacement style.'));
+    $this->assertRaw(check_plain(image_style_url('thumbnail', $node->{$field_name}[LANGUAGE_NONE][0]['uri'])), t('Image displayed using style replacement style.'));
   }
 }
 
@@ -775,7 +831,9 @@ class ImageFieldDisplayTestCase extends ImageFieldTestCase {
     // Ensure the derivative image is generated so we do not have to deal with
     // image style callback paths.
     $this->drupalGet(image_style_url('thumbnail', $image_uri));
-    $image_info['path'] = image_style_path('thumbnail', $image_uri);
+    // Need to create the URL again since it will change if clean URLs
+    // are disabled.
+    $image_info['path'] = image_style_url('thumbnail', $image_uri);
     $image_info['width'] = 100;
     $image_info['height'] = 50;
     $default_output = theme('image', $image_info);
@@ -1061,7 +1119,7 @@ class ImageDimensionsTestCase extends DrupalWebTestCase {
 
     image_effect_save($effect);
     $img_tag = theme_image_style($variables);
-    $this->assertEqual($img_tag, '<img typeof="foaf:Image" src="' . $url . '" width="120" height="60" alt="" />', t('Expected img tag was found.'));
+    $this->assertEqual($img_tag, '<img typeof="foaf:Image" src="' . check_plain($url) . '" width="120" height="60" alt="" />', t('Expected img tag was found.'));
     $this->assertFalse(file_exists($generated_uri), t('Generated file does not exist.'));
     $this->drupalGet($url);
     $this->assertResponse(200, t('Image was generated at the URL.'));
@@ -1082,7 +1140,7 @@ class ImageDimensionsTestCase extends DrupalWebTestCase {
 
     image_effect_save($effect);
     $img_tag = theme_image_style($variables);
-    $this->assertEqual($img_tag, '<img typeof="foaf:Image" src="' . $url . '" width="60" height="120" alt="" />', t('Expected img tag was found.'));
+    $this->assertEqual($img_tag, '<img typeof="foaf:Image" src="' . check_plain($url) . '" width="60" height="120" alt="" />', t('Expected img tag was found.'));
     $this->assertFalse(file_exists($generated_uri), t('Generated file does not exist.'));
     $this->drupalGet($url);
     $this->assertResponse(200, t('Image was generated at the URL.'));
@@ -1104,7 +1162,7 @@ class ImageDimensionsTestCase extends DrupalWebTestCase {
 
     image_effect_save($effect);
     $img_tag = theme_image_style($variables);
-    $this->assertEqual($img_tag, '<img typeof="foaf:Image" src="' . $url . '" width="45" height="90" alt="" />', t('Expected img tag was found.'));
+    $this->assertEqual($img_tag, '<img typeof="foaf:Image" src="' . check_plain($url) . '" width="45" height="90" alt="" />', t('Expected img tag was found.'));
     $this->assertFalse(file_exists($generated_uri), t('Generated file does not exist.'));
     $this->drupalGet($url);
     $this->assertResponse(200, t('Image was generated at the URL.'));
@@ -1126,7 +1184,7 @@ class ImageDimensionsTestCase extends DrupalWebTestCase {
 
     image_effect_save($effect);
     $img_tag = theme_image_style($variables);
-    $this->assertEqual($img_tag, '<img typeof="foaf:Image" src="' . $url . '" width="45" height="90" alt="" />', t('Expected img tag was found.'));
+    $this->assertEqual($img_tag, '<img typeof="foaf:Image" src="' . check_plain($url) . '" width="45" height="90" alt="" />', t('Expected img tag was found.'));
     $this->assertFalse(file_exists($generated_uri), t('Generated file does not exist.'));
     $this->drupalGet($url);
     $this->assertResponse(200, t('Image was generated at the URL.'));
@@ -1144,7 +1202,7 @@ class ImageDimensionsTestCase extends DrupalWebTestCase {
 
     image_effect_save($effect);
     $img_tag = theme_image_style($variables);
-    $this->assertEqual($img_tag, '<img typeof="foaf:Image" src="' . $url . '" width="45" height="90" alt="" />', t('Expected img tag was found.'));
+    $this->assertEqual($img_tag, '<img typeof="foaf:Image" src="' . check_plain($url) . '" width="45" height="90" alt="" />', t('Expected img tag was found.'));
     $this->assertFalse(file_exists($generated_uri), t('Generated file does not exist.'));
     $this->drupalGet($url);
     $this->assertResponse(200, t('Image was generated at the URL.'));
@@ -1165,7 +1223,7 @@ class ImageDimensionsTestCase extends DrupalWebTestCase {
 
     image_effect_save($effect);
     $img_tag = theme_image_style($variables);
-    $this->assertEqual($img_tag, '<img typeof="foaf:Image" src="' . $url . '" alt="" />', t('Expected img tag was found.'));
+    $this->assertEqual($img_tag, '<img typeof="foaf:Image" src="' . check_plain($url) . '" alt="" />', t('Expected img tag was found.'));
     $this->assertFalse(file_exists($generated_uri), t('Generated file does not exist.'));
     $this->drupalGet($url);
     $this->assertResponse(200, t('Image was generated at the URL.'));
@@ -1185,7 +1243,7 @@ class ImageDimensionsTestCase extends DrupalWebTestCase {
 
     image_effect_save($effect);
     $img_tag = theme_image_style($variables);
-    $this->assertEqual($img_tag, '<img typeof="foaf:Image" src="' . $url . '" width="30" height="30" alt="" />', t('Expected img tag was found.'));
+    $this->assertEqual($img_tag, '<img typeof="foaf:Image" src="' . check_plain($url) . '" width="30" height="30" alt="" />', t('Expected img tag was found.'));
     $this->assertFalse(file_exists($generated_uri), t('Generated file does not exist.'));
     $this->drupalGet($url);
     $this->assertResponse(200, t('Image was generated at the URL.'));
@@ -1206,7 +1264,7 @@ class ImageDimensionsTestCase extends DrupalWebTestCase {
 
     $effect = image_effect_save($effect);
     $img_tag = theme_image_style($variables);
-    $this->assertEqual($img_tag, '<img typeof="foaf:Image" src="' . $url . '" alt="" />', t('Expected img tag was found.'));
+    $this->assertEqual($img_tag, '<img typeof="foaf:Image" src="' . check_plain($url) . '" alt="" />', t('Expected img tag was found.'));
     $this->assertFalse(file_exists($generated_uri), t('Generated file does not exist.'));
     $this->drupalGet($url);
     $this->assertResponse(200, t('Image was generated at the URL.'));
@@ -1224,7 +1282,7 @@ class ImageDimensionsTestCase extends DrupalWebTestCase {
 
     image_effect_save($effect);
     $img_tag = theme_image_style($variables);
-    $this->assertEqual($img_tag, '<img typeof="foaf:Image" src="' . $url . '" alt="" />', t('Expected img tag was found.'));
+    $this->assertEqual($img_tag, '<img typeof="foaf:Image" src="' . check_plain($url) . '" alt="" />', t('Expected img tag was found.'));
   }
 }
 
@@ -1642,7 +1700,7 @@ class ImageThemeFunctionWebTestCase extends DrupalWebTestCase {
       ),
     );
     $rendered_element = render($element);
-    $expected_result = '<a href="' . url($path) . '"><img typeof="foaf:Image" src="' . $url . '" alt="" /></a>';
+    $expected_result = '<a href="' . url($path) . '"><img typeof="foaf:Image" src="' . check_plain($url) . '" alt="" /></a>';
     $this->assertEqual($expected_result, $rendered_element, 'theme_image_formatter() correctly renders without title, alt, or path options.');
 
     // Link the image to a fragment on the page, and not a full URL.
@@ -1653,7 +1711,7 @@ class ImageThemeFunctionWebTestCase extends DrupalWebTestCase {
       'fragment' => $fragment,
     );
     $rendered_element = render($element);
-    $expected_result = '<a href="#' . $fragment . '"><img typeof="foaf:Image" src="' . $url . '" alt="" /></a>';
+    $expected_result = '<a href="#' . $fragment . '"><img typeof="foaf:Image" src="' . check_plain($url) . '" alt="" /></a>';
     $this->assertEqual($expected_result, $rendered_element, 'theme_image_formatter() correctly renders a link fragment.');
   }
 

modules/image/tests/image_module_test.info

@@ -6,8 +6,8 @@ core = 7.x
 files[] = image_module_test.module
 hidden = TRUE
 
-; Information added by drupal.org packaging script on 2012-11-07
-version = "7.17"
+; Information added by drupal.org packaging script on 2013-03-07
+version = "7.21"
 project = "drupal"
-datestamp = "1352325357"
+datestamp = "1362616996"
 

modules/locale/locale.info

@@ -6,8 +6,8 @@ core = 7.x
 files[] = locale.test
 configure = admin/config/regional/language
 
-; Information added by drupal.org packaging script on 2012-11-07
-version = "7.17"
+; Information added by drupal.org packaging script on 2013-03-07
+version = "7.21"
 project = "drupal"
-datestamp = "1352325357"
+datestamp = "1362616996"
 

modules/locale/tests/locale_test.info

@@ -5,8 +5,8 @@ package = Testing
 version = VERSION
 hidden = TRUE
 
-; Information added by drupal.org packaging script on 2012-11-07
-version = "7.17"
+; Information added by drupal.org packaging script on 2013-03-07
+version = "7.21"
 project = "drupal"
-datestamp = "1352325357"
+datestamp = "1362616996"
 

modules/menu/menu.info

@@ -6,8 +6,8 @@ core = 7.x
 files[] = menu.test
 configure = admin/structure/menu
 
-; Information added by drupal.org packaging script on 2012-11-07
-version = "7.17"
+; Information added by drupal.org packaging script on 2013-03-07
+version = "7.21"
 project = "drupal"
-datestamp = "1352325357"
+datestamp = "1362616996"
 

modules/node/node.info

@@ -9,8 +9,8 @@ required = TRUE
 configure = admin/structure/types
 stylesheets[all][] = node.css
 
-; Information added by drupal.org packaging script on 2012-11-07
-version = "7.17"
+; Information added by drupal.org packaging script on 2013-03-07
+version = "7.21"
 project = "drupal"
-datestamp = "1352325357"
+datestamp = "1362616996"
 

modules/node/tests/node_access_test.info

@@ -5,8 +5,8 @@ version = VERSION
 core = 7.x
 hidden = TRUE
 
-; Information added by drupal.org packaging script on 2012-11-07
-version = "7.17"
+; Information added by drupal.org packaging script on 2013-03-07
+version = "7.21"
 project = "drupal"
-datestamp = "1352325357"
+datestamp = "1362616996"
 

modules/node/tests/node_test.info

@@ -5,8 +5,8 @@ version = VERSION
 core = 7.x
 hidden = TRUE
 
-; Information added by drupal.org packaging script on 2012-11-07
-version = "7.17"
+; Information added by drupal.org packaging script on 2013-03-07
+version = "7.21"
 project = "drupal"
-datestamp = "1352325357"
+datestamp = "1362616996"
 

modules/node/tests/node_test_exception.info

@@ -5,8 +5,8 @@ version = VERSION
 core = 7.x
 hidden = TRUE
 
-; Information added by drupal.org packaging script on 2012-11-07
-version = "7.17"
+; Information added by drupal.org packaging script on 2013-03-07
+version = "7.21"
 project = "drupal"
-datestamp = "1352325357"
+datestamp = "1362616996"
 

modules/openid/openid.info

@@ -5,8 +5,8 @@ package = Core
 core = 7.x
 files[] = openid.test
 
-; Information added by drupal.org packaging script on 2012-11-07
-version = "7.17"
+; Information added by drupal.org packaging script on 2013-03-07
+version = "7.21"
 project = "drupal"
-datestamp = "1352325357"
+datestamp = "1362616996"
 

modules/openid/tests/openid_test.info

@@ -6,8 +6,8 @@ core = 7.x
 dependencies[] = openid
 hidden = TRUE
 
-; Information added by drupal.org packaging script on 2012-11-07
-version = "7.17"
+; Information added by drupal.org packaging script on 2013-03-07
+version = "7.21"
 project = "drupal"
-datestamp = "1352325357"
+datestamp = "1362616996"
 

modules/overlay/overlay.info

@@ -4,8 +4,8 @@ package = Core
 version = VERSION
 core = 7.x
 
-; Information added by drupal.org packaging script on 2012-11-07
-version = "7.17"
+; Information added by drupal.org packaging script on 2013-03-07
+version = "7.21"
 project = "drupal"
-datestamp = "1352325357"
+datestamp = "1362616996"
 

modules/path/path.info

@@ -6,8 +6,8 @@ core = 7.x
 files[] = path.test
 configure = admin/config/search/path
 
-; Information added by drupal.org packaging script on 2012-11-07
-version = "7.17"
+; Information added by drupal.org packaging script on 2013-03-07
+version = "7.21"
 project = "drupal"
-datestamp = "1352325357"
+datestamp = "1362616996"
 

modules/php/php.info

@@ -5,8 +5,8 @@ version = VERSION
 core = 7.x
 files[] = php.test
 
-; Information added by drupal.org packaging script on 2012-11-07
-version = "7.17"
+; Information added by drupal.org packaging script on 2013-03-07
+version = "7.21"
 project = "drupal"
-datestamp = "1352325357"
+datestamp = "1362616996"
 

modules/poll/poll.info

@@ -6,8 +6,8 @@ core = 7.x
 files[] = poll.test
 stylesheets[all][] = poll.css
 
-; Information added by drupal.org packaging script on 2012-11-07
-version = "7.17"
+; Information added by drupal.org packaging script on 2013-03-07
+version = "7.21"
 project = "drupal"
-datestamp = "1352325357"
+datestamp = "1362616996"
 

modules/profile/profile.info

@@ -11,8 +11,8 @@ configure = admin/config/people/profile
 ; See user_system_info_alter().
 hidden = TRUE
 
-; Information added by drupal.org packaging script on 2012-11-07
-version = "7.17"
+; Information added by drupal.org packaging script on 2013-03-07
+version = "7.21"
 project = "drupal"
-datestamp = "1352325357"
+datestamp = "1362616996"
 

modules/rdf/rdf.info

@@ -5,8 +5,8 @@ version = VERSION
 core = 7.x
 files[] = rdf.test
 
-; Information added by drupal.org packaging script on 2012-11-07
-version = "7.17"
+; Information added by drupal.org packaging script on 2013-03-07
+version = "7.21"
 project = "drupal"
-datestamp = "1352325357"
+datestamp = "1362616996"
 

modules/rdf/tests/rdf_test.info

@@ -5,8 +5,8 @@ version = VERSION
 core = 7.x
 hidden = TRUE
 
-; Information added by drupal.org packaging script on 2012-11-07
-version = "7.17"
+; Information added by drupal.org packaging script on 2013-03-07
+version = "7.21"
 project = "drupal"
-datestamp = "1352325357"
+datestamp = "1362616996"
 

modules/search/search.info

@@ -8,8 +8,8 @@ files[] = search.test
 configure = admin/config/search/settings
 stylesheets[all][] = search.css
 
-; Information added by drupal.org packaging script on 2012-11-07
-version = "7.17"
+; Information added by drupal.org packaging script on 2013-03-07
+version = "7.21"
 project = "drupal"
-datestamp = "1352325357"
+datestamp = "1362616996"
 

modules/search/tests/search_embedded_form.info

@@ -5,8 +5,8 @@ version = VERSION
 core = 7.x
 hidden = TRUE
 
-; Information added by drupal.org packaging script on 2012-11-07
-version = "7.17"
+; Information added by drupal.org packaging script on 2013-03-07
+version = "7.21"
 project = "drupal"
-datestamp = "1352325357"
+datestamp = "1362616996"
 

modules/search/tests/search_extra_type.info

@@ -5,8 +5,8 @@ version = VERSION
 core = 7.x
 hidden = TRUE
 
-; Information added by drupal.org packaging script on 2012-11-07
-version = "7.17"
+; Information added by drupal.org packaging script on 2013-03-07
+version = "7.21"
 project = "drupal"
-datestamp = "1352325357"
+datestamp = "1362616996"
 

modules/shortcut/shortcut.info

@@ -6,8 +6,8 @@ core = 7.x
 files[] = shortcut.test
 configure = admin/config/user-interface/shortcut
 
-; Information added by drupal.org packaging script on 2012-11-07
-version = "7.17"
+; Information added by drupal.org packaging script on 2013-03-07
+version = "7.21"
 project = "drupal"
-datestamp = "1352325357"
+datestamp = "1362616996"
 

modules/simpletest/simpletest.info

@@ -55,8 +55,8 @@ files[] = tests/upgrade/update.trigger.test
 files[] = tests/upgrade/update.field.test
 files[] = tests/upgrade/update.user.test
 
-; Information added by drupal.org packaging script on 2012-11-07
-version = "7.17"
+; Information added by drupal.org packaging script on 2013-03-07
+version = "7.21"
 project = "drupal"
-datestamp = "1352325357"
+datestamp = "1362616996"
 

modules/simpletest/tests/actions_loop_test.info

@@ -5,8 +5,8 @@ version = VERSION
 core = 7.x
 hidden = TRUE
 
-; Information added by drupal.org packaging script on 2012-11-07
-version = "7.17"
+; Information added by drupal.org packaging script on 2013-03-07
+version = "7.21"
 project = "drupal"
-datestamp = "1352325357"
+datestamp = "1362616996"
 

modules/simpletest/tests/ajax_forms_test.info

@@ -5,8 +5,8 @@ package = Testing
 version = VERSION
 hidden = TRUE
 
-; Information added by drupal.org packaging script on 2012-11-07
-version = "7.17"
+; Information added by drupal.org packaging script on 2013-03-07
+version = "7.21"
 project = "drupal"
-datestamp = "1352325357"
+datestamp = "1362616996"
 

modules/simpletest/tests/ajax_test.info

@@ -5,8 +5,8 @@ version = VERSION
 core = 7.x
 hidden = TRUE
 
-; Information added by drupal.org packaging script on 2012-11-07
-version = "7.17"
+; Information added by drupal.org packaging script on 2013-03-07
+version = "7.21"
 project = "drupal"
-datestamp = "1352325357"
+datestamp = "1362616996"
 

modules/simpletest/tests/batch_test.info

@@ -5,8 +5,8 @@ version = VERSION
 core = 7.x
 hidden = TRUE
 
-; Information added by drupal.org packaging script on 2012-11-07
-version = "7.17"
+; Information added by drupal.org packaging script on 2013-03-07
+version = "7.21"
 project = "drupal"
-datestamp = "1352325357"
+datestamp = "1362616996"
 

modules/simpletest/tests/common_test.info

@@ -7,8 +7,8 @@ stylesheets[all][] = common_test.css
 stylesheets[print][] = common_test.print.css
 hidden = TRUE
 
-; Information added by drupal.org packaging script on 2012-11-07
-version = "7.17"
+; Information added by drupal.org packaging script on 2013-03-07
+version = "7.21"
 project = "drupal"
-datestamp = "1352325357"
+datestamp = "1362616996"
 

modules/simpletest/tests/common_test_cron_helper.info

@@ -5,8 +5,8 @@ version = VERSION
 core = 7.x
 hidden = TRUE
 
-; Information added by drupal.org packaging script on 2012-11-07
-version = "7.17"
+; Information added by drupal.org packaging script on 2013-03-07
+version = "7.21"
 project = "drupal"
-datestamp = "1352325357"
+datestamp = "1362616996"
 

modules/simpletest/tests/database_test.info

@@ -5,8 +5,8 @@ package = Testing
 version = VERSION
 hidden = TRUE
 
-; Information added by drupal.org packaging script on 2012-11-07
-version = "7.17"
+; Information added by drupal.org packaging script on 2013-03-07
+version = "7.21"
 project = "drupal"
-datestamp = "1352325357"
+datestamp = "1362616996"
 

modules/simpletest/tests/drupal_system_listing_compatible_test/drupal_system_listing_compatible_test.info

@@ -5,8 +5,8 @@ version = VERSION
 core = 7.x
 hidden = TRUE
 
-; Information added by drupal.org packaging script on 2012-11-07
-version = "7.17"
+; Information added by drupal.org packaging script on 2013-03-07
+version = "7.21"
 project = "drupal"
-datestamp = "1352325357"
+datestamp = "1362616996"
 

modules/simpletest/tests/drupal_system_listing_incompatible_test/drupal_system_listing_incompatible_test.info

@@ -5,8 +5,8 @@ version = VERSION
 core = 7.x
 hidden = TRUE
 
-; Information added by drupal.org packaging script on 2012-11-07
-version = "7.17"
+; Information added by drupal.org packaging script on 2013-03-07
+version = "7.21"
 project = "drupal"
-datestamp = "1352325357"
+datestamp = "1362616996"
 

modules/simpletest/tests/entity_cache_test.info

@@ -6,8 +6,8 @@ core = 7.x
 dependencies[] = entity_cache_test_dependency
 hidden = TRUE
 
-; Information added by drupal.org packaging script on 2012-11-07
-version = "7.17"
+; Information added by drupal.org packaging script on 2013-03-07
+version = "7.21"
 project = "drupal"
-datestamp = "1352325357"
+datestamp = "1362616996"
 

modules/simpletest/tests/entity_cache_test_dependency.info

@@ -5,8 +5,8 @@ version = VERSION
 core = 7.x
 hidden = TRUE
 
-; Information added by drupal.org packaging script on 2012-11-07
-version = "7.17"
+; Information added by drupal.org packaging script on 2013-03-07
+version = "7.21"
 project = "drupal"
-datestamp = "1352325357"
+datestamp = "1362616996"
 

modules/simpletest/tests/entity_crud_hook_test.info

@@ -5,8 +5,8 @@ package = Testing
 version = VERSION
 hidden = TRUE
 
-; Information added by drupal.org packaging script on 2012-11-07
-version = "7.17"
+; Information added by drupal.org packaging script on 2013-03-07
+version = "7.21"
 project = "drupal"
-datestamp = "1352325357"
+datestamp = "1362616996"
 

modules/simpletest/tests/entity_query_access_test.info

@@ -5,8 +5,8 @@ version = VERSION
 core = 7.x
 hidden = TRUE
 
-; Information added by drupal.org packaging script on 2012-11-07
-version = "7.17"
+; Information added by drupal.org packaging script on 2013-03-07
+version = "7.21"
 project = "drupal"
-datestamp = "1352325357"
+datestamp = "1362616996"
 

modules/simpletest/tests/error_test.info

@@ -5,8 +5,8 @@ version = VERSION
 core = 7.x
 hidden = TRUE
 
-; Information added by drupal.org packaging script on 2012-11-07
-version = "7.17"
+; Information added by drupal.org packaging script on 2013-03-07
+version = "7.21"
 project = "drupal"
-datestamp = "1352325357"
+datestamp = "1362616996"
 

modules/simpletest/tests/file_test.info

@@ -6,8 +6,8 @@ core = 7.x
 files[] = file_test.module
 hidden = TRUE
 
-; Information added by drupal.org packaging script on 2012-11-07
-version = "7.17"
+; Information added by drupal.org packaging script on 2013-03-07
+version = "7.21"
 project = "drupal"
-datestamp = "1352325357"
+datestamp = "1362616996"
 

modules/simpletest/tests/filter_test.info

@@ -5,8 +5,8 @@ version = VERSION
 core = 7.x
 hidden = TRUE
 
-; Information added by drupal.org packaging script on 2012-11-07
-version = "7.17"
+; Information added by drupal.org packaging script on 2013-03-07
+version = "7.21"
 project = "drupal"
-datestamp = "1352325357"
+datestamp = "1362616996"
 

modules/simpletest/tests/form_test.info

@@ -5,8 +5,8 @@ version = VERSION
 core = 7.x
 hidden = TRUE
 
-; Information added by drupal.org packaging script on 2012-11-07
-version = "7.17"
+; Information added by drupal.org packaging script on 2013-03-07
+version = "7.21"
 project = "drupal"
-datestamp = "1352325357"
+datestamp = "1362616996"
 

modules/simpletest/tests/image_test.info

@@ -5,8 +5,8 @@ version = VERSION
 core = 7.x
 hidden = TRUE
 
-; Information added by drupal.org packaging script on 2012-11-07
-version = "7.17"
+; Information added by drupal.org packaging script on 2013-03-07
+version = "7.21"
 project = "drupal"
-datestamp = "1352325357"
+datestamp = "1362616996"
 

modules/simpletest/tests/menu_test.info

@@ -5,8 +5,8 @@ version = VERSION
 core = 7.x
 hidden = TRUE
 
-; Information added by drupal.org packaging script on 2012-11-07
-version = "7.17"
+; Information added by drupal.org packaging script on 2013-03-07
+version = "7.21"
 project = "drupal"
-datestamp = "1352325357"
+datestamp = "1362616996"
 

modules/simpletest/tests/module_test.info

@@ -5,8 +5,8 @@ version = VERSION
 core = 7.x
 hidden = TRUE
 
-; Information added by drupal.org packaging script on 2012-11-07
-version = "7.17"
+; Information added by drupal.org packaging script on 2013-03-07
+version = "7.21"
 project = "drupal"
-datestamp = "1352325357"
+datestamp = "1362616996"
 

modules/simpletest/tests/path_test.info

@@ -5,8 +5,8 @@ version = VERSION
 core = 7.x
 hidden = TRUE
 
-; Information added by drupal.org packaging script on 2012-11-07
-version = "7.17"
+; Information added by drupal.org packaging script on 2013-03-07
+version = "7.21"
 project = "drupal"
-datestamp = "1352325357"
+datestamp = "1362616996"
 

modules/simpletest/tests/requirements1_test.info

@@ -5,8 +5,8 @@ version = VERSION
 core = 7.x
 hidden = TRUE
 
-; Information added by drupal.org packaging script on 2012-11-07
-version = "7.17"
+; Information added by drupal.org packaging script on 2013-03-07
+version = "7.21"
 project = "drupal"
-datestamp = "1352325357"
+datestamp = "1362616996"
 

modules/simpletest/tests/requirements2_test.info

@@ -7,8 +7,8 @@ version = VERSION
 core = 7.x
 hidden = TRUE
 
-; Information added by drupal.org packaging script on 2012-11-07
-version = "7.17"
+; Information added by drupal.org packaging script on 2013-03-07
+version = "7.21"
 project = "drupal"
-datestamp = "1352325357"
+datestamp = "1362616996"
 

modules/simpletest/tests/session_test.info

@@ -5,8 +5,8 @@ version = VERSION
 core = 7.x
 hidden = TRUE
 
-; Information added by drupal.org packaging script on 2012-11-07
-version = "7.17"
+; Information added by drupal.org packaging script on 2013-03-07
+version = "7.21"
 project = "drupal"
-datestamp = "1352325357"
+datestamp = "1362616996"
 

modules/simpletest/tests/system_dependencies_test.info

@@ -6,8 +6,8 @@ core = 7.x
 hidden = TRUE
 dependencies[] = _missing_dependency
 
-; Information added by drupal.org packaging script on 2012-11-07
-version = "7.17"
+; Information added by drupal.org packaging script on 2013-03-07
+version = "7.21"
 project = "drupal"
-datestamp = "1352325357"
+datestamp = "1362616996"
 

modules/simpletest/tests/system_incompatible_core_version_dependencies_test.info

@@ -6,8 +6,8 @@ core = 7.x
 hidden = TRUE
 dependencies[] = system_incompatible_core_version_test
 
-; Information added by drupal.org packaging script on 2012-11-07
-version = "7.17"
+; Information added by drupal.org packaging script on 2013-03-07
+version = "7.21"
 project = "drupal"
-datestamp = "1352325357"
+datestamp = "1362616996"
 

modules/simpletest/tests/system_incompatible_core_version_test.info

@@ -5,8 +5,8 @@ version = VERSION
 core = 5.x
 hidden = TRUE
 
-; Information added by drupal.org packaging script on 2012-11-07
-version = "7.17"
+; Information added by drupal.org packaging script on 2013-03-07
+version = "7.21"
 project = "drupal"
-datestamp = "1352325357"
+datestamp = "1362616996"
 

modules/simpletest/tests/system_incompatible_module_version_dependencies_test.info

@@ -7,8 +7,8 @@ hidden = TRUE
 ; system_incompatible_module_version_test declares version 1.0
 dependencies[] = system_incompatible_module_version_test (>2.0)
 
-; Information added by drupal.org packaging script on 2012-11-07
-version = "7.17"
+; Information added by drupal.org packaging script on 2013-03-07
+version = "7.21"
 project = "drupal"
-datestamp = "1352325357"
+datestamp = "1362616996"
 

modules/simpletest/tests/system_incompatible_module_version_test.info

@@ -5,8 +5,8 @@ version = 1.0
 core = 7.x
 hidden = TRUE
 
-; Information added by drupal.org packaging script on 2012-11-07
-version = "7.17"
+; Information added by drupal.org packaging script on 2013-03-07
+version = "7.21"
 project = "drupal"
-datestamp = "1352325357"
+datestamp = "1362616996"
 

modules/simpletest/tests/system_test.info

@@ -6,8 +6,8 @@ core = 7.x
 files[] = system_test.module
 hidden = TRUE
 
-; Information added by drupal.org packaging script on 2012-11-07
-version = "7.17"
+; Information added by drupal.org packaging script on 2013-03-07
+version = "7.21"
 project = "drupal"
-datestamp = "1352325357"
+datestamp = "1362616996"
 

modules/simpletest/tests/taxonomy_test.info

@@ -6,8 +6,8 @@ core = 7.x
 hidden = TRUE
 dependencies[] = taxonomy
 
-; Information added by drupal.org packaging script on 2012-11-07
-version = "7.17"
+; Information added by drupal.org packaging script on 2013-03-07
+version = "7.21"
 project = "drupal"
-datestamp = "1352325357"
+datestamp = "1362616996"
 

modules/simpletest/tests/theme_test.info

@@ -5,8 +5,8 @@ version = VERSION
 core = 7.x
 hidden = TRUE
 
-; Information added by drupal.org packaging script on 2012-11-07
-version = "7.17"
+; Information added by drupal.org packaging script on 2013-03-07
+version = "7.21"
 project = "drupal"
-datestamp = "1352325357"
+datestamp = "1362616996"
 

modules/simpletest/tests/themes/test_basetheme/test_basetheme.info

@@ -6,8 +6,8 @@ hidden = TRUE
 settings[basetheme_only] = base theme value
 settings[subtheme_override] = base theme value
 
-; Information added by drupal.org packaging script on 2012-11-07
-version = "7.17"
+; Information added by drupal.org packaging script on 2013-03-07
+version = "7.21"
 project = "drupal"
-datestamp = "1352325357"
+datestamp = "1362616996"
 

modules/simpletest/tests/themes/test_subtheme/test_subtheme.info

@@ -6,8 +6,8 @@ hidden = TRUE
 
 settings[subtheme_override] = subtheme value
 
-; Information added by drupal.org packaging script on 2012-11-07
-version = "7.17"
+; Information added by drupal.org packaging script on 2013-03-07
+version = "7.21"
 project = "drupal"
-datestamp = "1352325357"
+datestamp = "1362616996"
 

modules/simpletest/tests/themes/test_theme/test_theme.info

@@ -17,8 +17,8 @@ stylesheets[all][] = system.base.css
 
 settings[theme_test_setting] = default value
 
-; Information added by drupal.org packaging script on 2012-11-07
-version = "7.17"
+; Information added by drupal.org packaging script on 2013-03-07
+version = "7.21"
 project = "drupal"
-datestamp = "1352325357"
+datestamp = "1362616996"
 

modules/simpletest/tests/update_script_test.info

@@ -5,8 +5,8 @@ version = VERSION
 core = 7.x
 hidden = TRUE
 
-; Information added by drupal.org packaging script on 2012-11-07
-version = "7.17"
+; Information added by drupal.org packaging script on 2013-03-07
+version = "7.21"
 project = "drupal"
-datestamp = "1352325357"
+datestamp = "1362616996"
 

modules/simpletest/tests/update_test_1.info

@@ -5,8 +5,8 @@ version = VERSION
 core = 7.x
 hidden = TRUE
 
-; Information added by drupal.org packaging script on 2012-11-07
-version = "7.17"
+; Information added by drupal.org packaging script on 2013-03-07
+version = "7.21"
 project = "drupal"
-datestamp = "1352325357"
+datestamp = "1362616996"