changed materio_serach_api, query configuration by query

updated search feature
updated search_api and search_api_solr
2016-03-16 12:35:55 +01:00 · 2016-03-02 10:15:50 +01:00 · 2016-03-01 16:23:45 +01:00 · 2016-01-21 12:02:55 +01:00 · 2016-01-20 18:15:38 +01:00 · 2016-01-19 19:23:16 +01:00
649 changed files with 42566 additions and 20103 deletions
@@ -20,3 +20,5 @@ _base_d7.tmproj
 node_modules

 .sass-cache
+typescript
+.directory
@@ -3,7 +3,7 @@
 #

 # Protect files and directories from prying eyes.
-<FilesMatch "\.(engine|inc|info|install|make|module|profile|test|po|sh|.*sql|theme|tpl(\.php)?|xtmpl)$|^(\..*|Entries.*|Repository|Root|Tag|Template)$">
+<FilesMatch "\.(engine|inc|info|install|make|module|profile|test|po|sh|.*sql|theme|tpl(\.php)?|xtmpl)(~|\.sw[op]|\.bak|\.orig|\.save)?$|^(\..*|Entries.*|Repository|Root|Tag|Template)$|^#.*#$|\.php(~|\.sw[op]|\.bak|\.orig\.save)$">
  Order allow,deny
 </FilesMatch>

@@ -20,7 +20,7 @@ ErrorDocument 404 /index.php
 DirectoryIndex index.php index.html index.htm

 # Override PHP settings that cannot be changed at runtime. See
-# sites/default/default.settings.php and drupal_initialize_variables() in
+# sites/default/default.settings.php and drupal_environment_initialize() in
 # includes/bootstrap.inc for settings that can be changed at runtime.

 # PHP 5, Apache 1 and 2.
@@ -56,6 +56,17 @@ DirectoryIndex index.php index.html index.htm
 <IfModule mod_rewrite.c>
  RewriteEngine on

+  # Set "protossl" to "s" if we were accessed via https://.  This is used later
+  # if you enable "www." stripping or enforcement, in order to ensure that
+  # you don't bounce between http and https.
+  RewriteRule ^ - [E=protossl]
+  RewriteCond %{HTTPS} on
+  RewriteRule ^ - [E=protossl:s]
+
+  # Make sure Authorization HTTP header is available to PHP
+  # even when running as CGI or FastCGI.
+  RewriteRule ^ - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]
+
  # Block access to "hidden" directories whose names begin with a period. This
  # includes directories used by version control systems such as Subversion or
  # Git to store control files. Files whose names begin with a period, as well
@@ -71,18 +82,6 @@ DirectoryIndex index.php index.html index.htm
  # downloaded.
  RewriteRule "(^|/)\." - [F]

-# custom
-  RewriteCond %{HTTP_HOST} ^basebeta\.materio\.com [OR]
-  RewriteCond %{HTTP_HOST} ^materio\.com [OR]
-  RewriteCond %{HTTP_HOST} ^www\.materio\.fr [OR]
-  RewriteCond %{HTTP_HOST} ^materio\.fr [OR]
-  RewriteCond %{HTTP_HOST} ^www\.materio\.net [OR]
-  RewriteCond %{HTTP_HOST} ^materio\.net [OR]
-  RewriteCond %{HTTP_HOST} ^www\.materio\.eu [OR]
-  RewriteCond %{HTTP_HOST} ^materio\.eu [NC]
-  RewriteRule ^ http://www.materio.com%{REQUEST_URI} [L,R=301]
-
-
  # If your site can be accessed both with and without the 'www.' prefix, you
  # can use one of the following settings to redirect users to your preferred
  # URL, either WITH or WITHOUT the 'www.' prefix. Choose ONLY one option:
@@ -90,14 +89,32 @@ DirectoryIndex index.php index.html index.htm
  # To redirect all users to access the site WITH the 'www.' prefix,
  # (http://example.com/... will be redirected to http://www.example.com/...)
  # uncomment the following:
+  # RewriteCond %{HTTP_HOST} .
  # RewriteCond %{HTTP_HOST} !^www\. [NC]
-  # RewriteRule ^ http://www.%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
-  #
+  # RewriteRule ^ http%{ENV:protossl}://www.%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
+
  # To redirect all users to access the site WITHOUT the 'www.' prefix,
  # (http://www.example.com/... will be redirected to http://example.com/...)
  # uncomment the following:
  # RewriteCond %{HTTP_HOST} ^www\.(.+)$ [NC]
-  # RewriteRule ^ http://%1%{REQUEST_URI} [L,R=301]
+  # RewriteRule ^ http%{ENV:protossl}://%1%{REQUEST_URI} [L,R=301]
+
+  # redirect all materiau domains to materio.com
+  RewriteCond %{HTTP_HOST} ^basebeta\.materio\.com [OR]
+  RewriteCond %{HTTP_HOST} ^www\.materio\.fr [OR]
+  RewriteCond %{HTTP_HOST} ^materio\.fr [OR]
+  RewriteCond %{HTTP_HOST} ^www\.materio\.net [OR]
+  RewriteCond %{HTTP_HOST} ^materio\.net [OR]
+  RewriteCond %{HTTP_HOST} ^www\.materio\.eu [OR]
+  RewriteCond %{HTTP_HOST} ^materio\.eu [OR]
+  RewriteCond %{HTTP_HOST} ^www\.materio\.com
+  # RewriteRule ^ http%{ENV:protossl}://materio.com%{REQUEST_URI} [L,R=301]
+  RewriteRule ^ https://materio.com%{REQUEST_URI} [L,R=301]
+
+  # Redirect to HTTPS
+  # RewriteCond %{HTTPS} off
+  # RewriteCond %{HTTP:X-Forwarded-Proto} !https
+  # RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

  # Modify the RewriteBase if you are using Drupal in a subdirectory or in a
  # VirtualDocumentRoot and the rewrite rules are not working properly.
@@ -116,24 +133,6 @@ DirectoryIndex index.php index.html index.htm
  RewriteCond %{REQUEST_URI} !=/favicon.ico
  RewriteRule ^ index.php [L]

-  ## local
-  # RewriteCond %{REMOTE_ADDR} !^127\.0\.0\.1
-  ## maison quentin
-  # RewriteCond %{REMOTE_ADDR} !^86\.68\.188\.175
-  ## materio
-  # RewriteCond %{REMOTE_ADDR} !^212\.198\.136\.215
-  ## maison bach
-  # RewriteCond %{REMOTE_ADDR} !^82\.230\.62\.145
-  # RewriteRule !maintenance http://www.materio.com/maintenance [L,R=302,E=nocache:1]
-
-  ## http://mark.koli.ch/2010/12/set-cache-control-and-expires-headers-on-a-redirect-with-mod-rewrite.html
-  ## Set the response header if the "nocache" environment variable is set
-  ## in the RewriteRule above.
-  # Header always set Cache-Control "no-store, no-cache, must-revalidate" env=nocache
-  ## Set Expires too ...
-  # Header always set Expires "Thu, 01 Jan 1970 00:00:00 GMT" env=nocache
-
-
  # Rules to correctly serve gzip compressed CSS and JS files.
  # Requires both mod_rewrite and mod_headers to be enabled.
  <IfModule mod_headers.c>
@@ -160,94 +159,138 @@ DirectoryIndex index.php index.html index.htm
  </IfModule>
 </IfModule>

+# Add headers to all responses.
+<IfModule mod_headers.c>
+  # Disable content sniffing, since it's an attack vector.
+  Header always set X-Content-Type-Options nosniff
+</IfModule>

+# from boiler plate V5.02

-# FROM Html5 BoilerPlate 4.0
+# ######################################################################
+# # MEDIA TYPES AND CHARACTER ENCODINGS                                #
+# ######################################################################

 # ----------------------------------------------------------------------
-# Proper MIME type for all files
+# | Media types                                                        |
 # ----------------------------------------------------------------------

-# JavaScript
-#   Normalize to standard type (it's sniffed in IE anyways)
-#   tools.ietf.org/html/rfc4329#section-7.2
-AddType application/javascript         js jsonp
-AddType application/json               json
+# Serve resources with the proper media types (f.k.a. MIME types).
+#
+# https://www.iana.org/assignments/media-types/media-types.xhtml
+# https://httpd.apache.org/docs/current/mod/mod_mime.html#addtype

-# Audio
-AddType audio/ogg                      oga ogg
-AddType audio/mp4                      m4a f4a f4b
+<IfModule mod_mime.c>

-# Video
-AddType video/ogg                      ogv
-AddType video/mp4                      mp4 m4v f4v f4p
-AddType video/webm                     webm
-AddType video/x-flv                    flv
+  # Data interchange

-# SVG
-#   Required for svg webfonts on iPad
-#   twitter.com/FontSquirrel/status/14855840545
-AddType     image/svg+xml              svg svgz
-AddEncoding gzip                       svgz
-
-# Webfonts
-AddType application/vnd.ms-fontobject  eot
-AddType application/x-font-ttf         ttf ttc
-AddType font/opentype                  otf
-AddType application/x-font-woff        woff
-
-# Assorted types
-AddType image/x-icon                        ico
-AddType image/webp                          webp
-AddType text/cache-manifest                 appcache manifest
-AddType text/x-component                    htc
-AddType application/xml                     rss atom xml rdf
-AddType application/x-chrome-extension      crx
-AddType application/x-opera-extension       oex
-AddType application/x-xpinstall             xpi
-AddType application/octet-stream            safariextz
-AddType application/x-web-app-manifest+json webapp
-AddType text/x-vcard                        vcf
-AddType application/x-shockwave-flash       swf
-AddType text/vtt                            vtt
+  AddType application/atom+xml                        atom
+  AddType application/json                            json map topojson
+  AddType application/ld+json                         jsonld
+  AddType application/rss+xml                         rss
+  AddType application/vnd.geo+json                    geojson
+  AddType application/xml                             rdf xml


+  # JavaScript
+
+  # Normalize to standard type.
+  # https://tools.ietf.org/html/rfc4329#section-7.2
+
+  AddType application/javascript                      js
+
+
+  # Manifest files
+
+  AddType application/manifest+json                   webmanifest
+  AddType application/x-web-app-manifest+json         webapp
+  AddType text/cache-manifest                         appcache
+
+
+  # Media files
+
+  AddType audio/mp4                                   f4a f4b m4a
+  AddType audio/ogg                                   oga ogg opus
+  AddType image/bmp                                   bmp
+  AddType image/svg+xml                               svg svgz
+  AddType image/webp                                  webp
+  AddType video/mp4                                   f4v f4p m4v mp4
+  AddType video/ogg                                   ogv
+  AddType video/webm                                  webm
+  AddType video/x-flv                                 flv
+
+  # Serving `.ico` image files with a different media type
+  # prevents Internet Explorer from displaying then as images:
+  # https://github.com/h5bp/html5-boilerplate/commit/37b5fec090d00f38de64b591bcddcb205aadf8ee
+
+  AddType image/x-icon                                cur ico
+
+
+  # Web fonts
+
+  AddType application/font-woff                       woff
+  AddType application/font-woff2                      woff2
+  AddType application/vnd.ms-fontobject               eot
+
+  # Browsers usually ignore the font media types and simply sniff
+  # the bytes to figure out the font type.
+  # https://mimesniff.spec.whatwg.org/#matching-a-font-type-pattern
+  #
+  # However, Blink and WebKit based browsers will show a warning
+  # in the console if the following font types are served with any
+  # other media types.
+
+  AddType application/x-font-ttf                      ttc ttf
+  AddType font/opentype                               otf
+
+
+  # Other
+
+  AddType application/octet-stream                    safariextz
+  AddType application/x-bb-appworld                   bbaw
+  AddType application/x-chrome-extension              crx
+  AddType application/x-opera-extension               oex
+  AddType application/x-xpinstall                     xpi
+  AddType text/vcard                                  vcard vcf
+  AddType text/vnd.rim.location.xloc                  xloc
+  AddType text/vtt                                    vtt
+  AddType text/x-component                            htc
+
+</IfModule>

 # ----------------------------------------------------------------------
-# UTF-8 encoding
+# | Character encodings                                                |
 # ----------------------------------------------------------------------

-# Use UTF-8 encoding for anything served text/plain or text/html
+# Serve all resources labeled as `text/html` or `text/plain`
+# with the media type `charset` parameter set to `UTF-8`.
+#
+# https://httpd.apache.org/docs/current/mod/core.html#adddefaultcharset
+
 AddDefaultCharset utf-8

-# Force UTF-8 for a number of file formats
-AddCharset utf-8 .atom .css .js .json .rss .vtt .xml
+# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

+# Serve the following file types with the media type `charset`
+# parameter set to `UTF-8`.
+#
+# https://httpd.apache.org/docs/current/mod/mod_mime.html#addcharset

-# ----------------------------------------------------------------------
-# A little more security
-# ----------------------------------------------------------------------
-
-
-# Block access to "hidden" directories or files whose names begin with a
-# period. This includes directories used by version control systems such as
-# Subversion or Git.
-<IfModule mod_rewrite.c>
-  RewriteCond %{SCRIPT_FILENAME} -d [OR]
-  RewriteCond %{SCRIPT_FILENAME} -f
-  RewriteRule "(^|/)\." - [F]
-</IfModule>
-
-# Block access to backup and source files. These files may be left by some
-# text/html editors and pose a great security danger, when anyone can access
-# them.
-<FilesMatch "(\.(bak|config|sql|fla|psd|ini|log|sh|inc|swp|dist)|~)$">
-  Order allow,deny
-  Deny from all
-  Satisfy All
-</FilesMatch>
-
-# Increase cookie security
-<IfModule php5_module>
-  php_value session.cookie_httponly true
+<IfModule mod_mime.c>
+    AddCharset utf-8 .atom \
+                     .bbaw \
+                     .css \
+                     .geojson \
+                     .js \
+                     .json \
+                     .jsonld \
+                     .manifest \
+                     .rdf \
+                     .rss \
+                     .topojson \
+                     .vtt \
+                     .webapp \
+                     .webmanifest \
+                     .xloc \
+                     .xml
 </IfModule>
@@ -1,4 +1,12 @@

+Drupal 7.39, 2015-08-19
+-----------------------
+- Fixed security issues (multiple vulnerabilities). See SA-CORE-2015-003.
+
+Drupal 7.38, 2015-06-17
+-----------------------
+- Fixed security issues (multiple vulnerabilities). See SA-CORE-2015-002.
+
 Drupal 7.37, 2015-05-07
 -----------------------
 - Fixed a regression in Drupal 7.36 which caused certain kinds of content types
@@ -0,0 +1,339 @@
+                    GNU GENERAL PUBLIC LICENSE
+                       Version 2, June 1991
+
+ Copyright (C) 1989, 1991 Free Software Foundation, Inc.,
+ 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
+ Everyone is permitted to copy and distribute verbatim copies
+ of this license document, but changing it is not allowed.
+
+                            Preamble
+
+  The licenses for most software are designed to take away your
+freedom to share and change it.  By contrast, the GNU General Public
+License is intended to guarantee your freedom to share and change free
+software--to make sure the software is free for all its users.  This
+General Public License applies to most of the Free Software
+Foundation's software and to any other program whose authors commit to
+using it.  (Some other Free Software Foundation software is covered by
+the GNU Lesser General Public License instead.)  You can apply it to
+your programs, too.
+
+  When we speak of free software, we are referring to freedom, not
+price.  Our General Public Licenses are designed to make sure that you
+have the freedom to distribute copies of free software (and charge for
+this service if you wish), that you receive source code or can get it
+if you want it, that you can change the software or use pieces of it
+in new free programs; and that you know you can do these things.
+
+  To protect your rights, we need to make restrictions that forbid
+anyone to deny you these rights or to ask you to surrender the rights.
+These restrictions translate to certain responsibilities for you if you
+distribute copies of the software, or if you modify it.
+
+  For example, if you distribute copies of such a program, whether
+gratis or for a fee, you must give the recipients all the rights that
+you have.  You must make sure that they, too, receive or can get the
+source code.  And you must show them these terms so they know their
+rights.
+
+  We protect your rights with two steps: (1) copyright the software, and
+(2) offer you this license which gives you legal permission to copy,
+distribute and/or modify the software.
+
+  Also, for each author's protection and ours, we want to make certain
+that everyone understands that there is no warranty for this free
+software.  If the software is modified by someone else and passed on, we
+want its recipients to know that what they have is not the original, so
+that any problems introduced by others will not reflect on the original
+authors' reputations.
+
+  Finally, any free program is threatened constantly by software
+patents.  We wish to avoid the danger that redistributors of a free
+program will individually obtain patent licenses, in effect making the
+program proprietary.  To prevent this, we have made it clear that any
+patent must be licensed for everyone's free use or not licensed at all.
+
+  The precise terms and conditions for copying, distribution and
+modification follow.
+
+                    GNU GENERAL PUBLIC LICENSE
+   TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION
+
+  0. This License applies to any program or other work which contains
+a notice placed by the copyright holder saying it may be distributed
+under the terms of this General Public License.  The "Program", below,
+refers to any such program or work, and a "work based on the Program"
+means either the Program or any derivative work under copyright law:
+that is to say, a work containing the Program or a portion of it,
+either verbatim or with modifications and/or translated into another
+language.  (Hereinafter, translation is included without limitation in
+the term "modification".)  Each licensee is addressed as "you".
+
+Activities other than copying, distribution and modification are not
+covered by this License; they are outside its scope.  The act of
+running the Program is not restricted, and the output from the Program
+is covered only if its contents constitute a work based on the
+Program (independent of having been made by running the Program).
+Whether that is true depends on what the Program does.
+
+  1. You may copy and distribute verbatim copies of the Program's
+source code as you receive it, in any medium, provided that you
+conspicuously and appropriately publish on each copy an appropriate
+copyright notice and disclaimer of warranty; keep intact all the
+notices that refer to this License and to the absence of any warranty;
+and give any other recipients of the Program a copy of this License
+along with the Program.
+
+You may charge a fee for the physical act of transferring a copy, and
+you may at your option offer warranty protection in exchange for a fee.
+
+  2. You may modify your copy or copies of the Program or any portion
+of it, thus forming a work based on the Program, and copy and
+distribute such modifications or work under the terms of Section 1
+above, provided that you also meet all of these conditions:
+
+    a) You must cause the modified files to carry prominent notices
+    stating that you changed the files and the date of any change.
+
+    b) You must cause any work that you distribute or publish, that in
+    whole or in part contains or is derived from the Program or any
+    part thereof, to be licensed as a whole at no charge to all third
+    parties under the terms of this License.
+
+    c) If the modified program normally reads commands interactively
+    when run, you must cause it, when started running for such
+    interactive use in the most ordinary way, to print or display an
+    announcement including an appropriate copyright notice and a
+    notice that there is no warranty (or else, saying that you provide
+    a warranty) and that users may redistribute the program under
+    these conditions, and telling the user how to view a copy of this
+    License.  (Exception: if the Program itself is interactive but
+    does not normally print such an announcement, your work based on
+    the Program is not required to print an announcement.)
+
+These requirements apply to the modified work as a whole.  If
+identifiable sections of that work are not derived from the Program,
+and can be reasonably considered independent and separate works in
+themselves, then this License, and its terms, do not apply to those
+sections when you distribute them as separate works.  But when you
+distribute the same sections as part of a whole which is a work based
+on the Program, the distribution of the whole must be on the terms of
+this License, whose permissions for other licensees extend to the
+entire whole, and thus to each and every part regardless of who wrote it.
+
+Thus, it is not the intent of this section to claim rights or contest
+your rights to work written entirely by you; rather, the intent is to
+exercise the right to control the distribution of derivative or
+collective works based on the Program.
+
+In addition, mere aggregation of another work not based on the Program
+with the Program (or with a work based on the Program) on a volume of
+a storage or distribution medium does not bring the other work under
+the scope of this License.
+
+  3. You may copy and distribute the Program (or a work based on it,
+under Section 2) in object code or executable form under the terms of
+Sections 1 and 2 above provided that you also do one of the following:
+
+    a) Accompany it with the complete corresponding machine-readable
+    source code, which must be distributed under the terms of Sections
+    1 and 2 above on a medium customarily used for software interchange; or,
+
+    b) Accompany it with a written offer, valid for at least three
+    years, to give any third party, for a charge no more than your
+    cost of physically performing source distribution, a complete
+    machine-readable copy of the corresponding source code, to be
+    distributed under the terms of Sections 1 and 2 above on a medium
+    customarily used for software interchange; or,
+
+    c) Accompany it with the information you received as to the offer
+    to distribute corresponding source code.  (This alternative is
+    allowed only for noncommercial distribution and only if you
+    received the program in object code or executable form with such
+    an offer, in accord with Subsection b above.)
+
+The source code for a work means the preferred form of the work for
+making modifications to it.  For an executable work, complete source
+code means all the source code for all modules it contains, plus any
+associated interface definition files, plus the scripts used to
+control compilation and installation of the executable.  However, as a
+special exception, the source code distributed need not include
+anything that is normally distributed (in either source or binary
+form) with the major components (compiler, kernel, and so on) of the
+operating system on which the executable runs, unless that component
+itself accompanies the executable.
+
+If distribution of executable or object code is made by offering
+access to copy from a designated place, then offering equivalent
+access to copy the source code from the same place counts as
+distribution of the source code, even though third parties are not
+compelled to copy the source along with the object code.
+
+  4. You may not copy, modify, sublicense, or distribute the Program
+except as expressly provided under this License.  Any attempt
+otherwise to copy, modify, sublicense or distribute the Program is
+void, and will automatically terminate your rights under this License.
+However, parties who have received copies, or rights, from you under
+this License will not have their licenses terminated so long as such
+parties remain in full compliance.
+
+  5. You are not required to accept this License, since you have not
+signed it.  However, nothing else grants you permission to modify or
+distribute the Program or its derivative works.  These actions are
+prohibited by law if you do not accept this License.  Therefore, by
+modifying or distributing the Program (or any work based on the
+Program), you indicate your acceptance of this License to do so, and
+all its terms and conditions for copying, distributing or modifying
+the Program or works based on it.
+
+  6. Each time you redistribute the Program (or any work based on the
+Program), the recipient automatically receives a license from the
+original licensor to copy, distribute or modify the Program subject to
+these terms and conditions.  You may not impose any further
+restrictions on the recipients' exercise of the rights granted herein.
+You are not responsible for enforcing compliance by third parties to
+this License.
+
+  7. If, as a consequence of a court judgment or allegation of patent
+infringement or for any other reason (not limited to patent issues),
+conditions are imposed on you (whether by court order, agreement or
+otherwise) that contradict the conditions of this License, they do not
+excuse you from the conditions of this License.  If you cannot
+distribute so as to satisfy simultaneously your obligations under this
+License and any other pertinent obligations, then as a consequence you
+may not distribute the Program at all.  For example, if a patent
+license would not permit royalty-free redistribution of the Program by
+all those who receive copies directly or indirectly through you, then
+the only way you could satisfy both it and this License would be to
+refrain entirely from distribution of the Program.
+
+If any portion of this section is held invalid or unenforceable under
+any particular circumstance, the balance of the section is intended to
+apply and the section as a whole is intended to apply in other
+circumstances.
+
+It is not the purpose of this section to induce you to infringe any
+patents or other property right claims or to contest validity of any
+such claims; this section has the sole purpose of protecting the
+integrity of the free software distribution system, which is
+implemented by public license practices.  Many people have made
+generous contributions to the wide range of software distributed
+through that system in reliance on consistent application of that
+system; it is up to the author/donor to decide if he or she is willing
+to distribute software through any other system and a licensee cannot
+impose that choice.
+
+This section is intended to make thoroughly clear what is believed to
+be a consequence of the rest of this License.
+
+  8. If the distribution and/or use of the Program is restricted in
+certain countries either by patents or by copyrighted interfaces, the
+original copyright holder who places the Program under this License
+may add an explicit geographical distribution limitation excluding
+those countries, so that distribution is permitted only in or among
+countries not thus excluded.  In such case, this License incorporates
+the limitation as if written in the body of this License.
+
+  9. The Free Software Foundation may publish revised and/or new versions
+of the General Public License from time to time.  Such new versions will
+be similar in spirit to the present version, but may differ in detail to
+address new problems or concerns.
+
+Each version is given a distinguishing version number.  If the Program
+specifies a version number of this License which applies to it and "any
+later version", you have the option of following the terms and conditions
+either of that version or of any later version published by the Free
+Software Foundation.  If the Program does not specify a version number of
+this License, you may choose any version ever published by the Free Software
+Foundation.
+
+  10. If you wish to incorporate parts of the Program into other free
+programs whose distribution conditions are different, write to the author
+to ask for permission.  For software which is copyrighted by the Free
+Software Foundation, write to the Free Software Foundation; we sometimes
+make exceptions for this.  Our decision will be guided by the two goals
+of preserving the free status of all derivatives of our free software and
+of promoting the sharing and reuse of software generally.
+
+                            NO WARRANTY
+
+  11. BECAUSE THE PROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY
+FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW.  EXCEPT WHEN
+OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES
+PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED
+OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
+MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.  THE ENTIRE RISK AS
+TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU.  SHOULD THE
+PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING,
+REPAIR OR CORRECTION.
+
+  12. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
+WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR
+REDISTRIBUTE THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES,
+INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING
+OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED
+TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY
+YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER
+PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE
+POSSIBILITY OF SUCH DAMAGES.
+
+                     END OF TERMS AND CONDITIONS
+
+            How to Apply These Terms to Your New Programs
+
+  If you develop a new program, and you want it to be of the greatest
+possible use to the public, the best way to achieve this is to make it
+free software which everyone can redistribute and change under these terms.
+
+  To do so, attach the following notices to the program.  It is safest
+to attach them to the start of each source file to most effectively
+convey the exclusion of warranty; and each file should have at least
+the "copyright" line and a pointer to where the full notice is found.
+
+    <one line to give the program's name and a brief idea of what it does.>
+    Copyright (C) <year>  <name of author>
+
+    This program is free software; you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation; either version 2 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    You should have received a copy of the GNU General Public License along
+    with this program; if not, write to the Free Software Foundation, Inc.,
+    51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+
+Also add information on how to contact you by electronic and paper mail.
+
+If the program is interactive, make it output a short notice like this
+when it starts in an interactive mode:
+
+    Gnomovision version 69, Copyright (C) year name of author
+    Gnomovision comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
+    This is free software, and you are welcome to redistribute it
+    under certain conditions; type `show c' for details.
+
+The hypothetical commands `show w' and `show c' should show the appropriate
+parts of the General Public License.  Of course, the commands you use may
+be called something other than `show w' and `show c'; they could even be
+mouse-clicks or menu items--whatever suits your program.
+
+You should also get your employer (if you work as a programmer) or your
+school, if any, to sign a "copyright disclaimer" for the program, if
+necessary.  Here is a sample; alter the names:
+
+  Yoyodyne, Inc., hereby disclaims all copyright interest in the program
+  `Gnomovision' (which makes passes at compilers) written by James Hacker.
+
+  <signature of Ty Coon>, 1 April 1989
+  Ty Coon, President of Vice
+
+This General Public License does not permit incorporating your program into
+proprietary programs.  If your program is a subroutine library, you may
+consider it more useful to permit linking proprietary applications with the
+library.  If this is what you want to do, use the GNU Lesser General
+Public License instead of this License.
@@ -17,10 +17,13 @@ feedback
 filter_path_alias
 flag_lists
 //nodeformcols
-search_api
+//search_api
 search_api_page
-search_api_solr
+//search_api_solr
 termreferencetree
 views
 wysiwyg
-
+views_rss_media
+node_export :
+  - https://www.drupal.org/node/1869918
+  - https://www.drupal.org/node/1911638
@@ -230,6 +230,10 @@
 *   functions.
 */
 function ajax_render($commands = array()) {
+  // Although ajax_deliver() does this, some contributed and custom modules
+  // render Ajax responses without using that delivery callback.
+  ajax_set_verification_header();
+
  // Ajax responses aren't rendered with html.tpl.php, so we have to call
  // drupal_get_css() and drupal_get_js() here, in order to have new files added
  // during this request to be loaded by the page. We only want to send back
@@ -487,6 +491,9 @@ function ajax_deliver($page_callback_result) {
    }
  }

+  // Let ajax.js know that this response is safe to process.
+  ajax_set_verification_header();
+
  // Print the response.
  $commands = ajax_prepare_response($page_callback_result);
  $json = ajax_render($commands);
@@ -576,6 +583,29 @@ function ajax_prepare_response($page_callback_result) {
  return $commands;
 }

+/**
+ * Sets a response header for ajax.js to trust the response body.
+ *
+ * It is not safe to invoke Ajax commands within user-uploaded files, so this
+ * header protects against those being invoked.
+ *
+ * @see Drupal.ajax.options.success()
+ */
+function ajax_set_verification_header() {
+  $added = &drupal_static(__FUNCTION__);
+
+  // User-uploaded files cannot set any response headers, so a custom header is
+  // used to indicate to ajax.js that this response is safe. Note that most
+  // Ajax requests bound using the Form API will be protected by having the URL
+  // flagged as trusted in Drupal.settings, so this header is used only for
+  // things like custom markup that gets Ajax behaviors attached.
+  if (empty($added)) {
+    drupal_add_http_header('X-Drupal-Ajax-Token', '1');
+    // Avoid sending the header twice.
+    $added = TRUE;
+  }
+}
+
 /**
 * Performs end-of-Ajax-request tasks.
 *
@@ -764,7 +794,12 @@ function ajax_pre_render_element($element) {

    $element['#attached']['js'][] = array(
      'type' => 'setting',
-      'data' => array('ajax' => array($element['#id'] => $settings)),
+      'data' => array(
+        'ajax' => array($element['#id'] => $settings),
+        'urlIsAjaxTrusted' => array(
+          $settings['url'] => TRUE,
+        ),
+      ),
    );

    // Indicate that Ajax processing was successful.
@@ -8,7 +8,7 @@
 /**
 * The current system version.
 */
-define('VERSION', '7.37');
+define('VERSION', '7.39');

 /**
 * Core API compatibility.
@@ -6329,13 +6329,21 @@ function drupal_render_cid_parts($granularity = NULL) {
  }

  if (!empty($granularity)) {
+    $cache_per_role = $granularity & DRUPAL_CACHE_PER_ROLE;
+    $cache_per_user = $granularity & DRUPAL_CACHE_PER_USER;
+    // User 1 has special permissions outside of the role system, so when
+    // caching per role is requested, it should cache per user instead.
+    if ($user->uid == 1 && $cache_per_role) {
+      $cache_per_user = TRUE;
+      $cache_per_role = FALSE;
+    }
    // 'PER_ROLE' and 'PER_USER' are mutually exclusive. 'PER_USER' can be a
    // resource drag for sites with many users, so when a module is being
    // equivocal, we favor the less expensive 'PER_ROLE' pattern.
-    if ($granularity & DRUPAL_CACHE_PER_ROLE) {
+    if ($cache_per_role) {
      $cid_parts[] = 'r.' . implode(',', array_keys($user->roles));
    }
-    elseif ($granularity & DRUPAL_CACHE_PER_USER) {
+    elseif ($cache_per_user) {
      $cid_parts[] = "u.$user->uid";
    }

@@ -626,7 +626,7 @@ abstract class DatabaseConnection extends PDO {
   *   A sanitized version of the query comment string.
   */
  protected function filterComment($comment = '') {
-    return preg_replace('/(\/\*\s*)|(\s*\*\/)/', '', $comment);
+    return strtr($comment, array('*' => ' * '));
  }

  /**
@@ -1128,6 +1128,17 @@ function drupal_prepare_form($form_id, &$form, &$form_state) {
  drupal_alter($hooks, $form, $form_state, $form_id);
 }

+/**
+ * Helper function to call form_set_error() if there is a token error.
+ */
+function _drupal_invalid_token_set_form_error() {
+  $path = current_path();
+  $query = drupal_get_query_parameters();
+  $url = url($path, array('query' => $query));
+
+  // Setting this error will cause the form to fail validation.
+  form_set_error('form_token', t('The form has become outdated. Copy any unsaved work in the form below and then <a href="@link">reload this page</a>.', array('@link' => $url)));
+}

 /**
 * Validates user-submitted form data in the $form_state array.
@@ -1162,16 +1173,11 @@ function drupal_validate_form($form_id, &$form, &$form_state) {
  }

  // If the session token was set by drupal_prepare_form(), ensure that it
-  // matches the current user's session.
+  // matches the current user's session. This is duplicate to code in
+  // form_builder() but left to protect any custom form handling code.
  if (isset($form['#token'])) {
-    if (!drupal_valid_token($form_state['values']['form_token'], $form['#token'])) {
-      $path = current_path();
-      $query = drupal_get_query_parameters();
-      $url = url($path, array('query' => $query));
-
-      // Setting this error will cause the form to fail validation.
-      form_set_error('form_token', t('The form has become outdated. Copy any unsaved work in the form below and then <a href="@link">reload this page</a>.', array('@link' => $url)));
-
+    if (!drupal_valid_token($form_state['values']['form_token'], $form['#token']) || !empty($form_state['invalid_token'])) {
+      _drupal_invalid_token_set_form_error();
      // Stop here and don't run any further validation handlers, because they
      // could invoke non-safe operations which opens the door for CSRF
      // vulnerabilities.
@@ -1827,6 +1833,20 @@ function form_builder($form_id, &$element, &$form_state) {
    // from the POST data is set and matches the current form_id.
    if ($form_state['programmed'] || (!empty($form_state['input']) && (isset($form_state['input']['form_id']) && ($form_state['input']['form_id'] == $form_id)))) {
      $form_state['process_input'] = TRUE;
+      // If the session token was set by drupal_prepare_form(), ensure that it
+      // matches the current user's session.
+      $form_state['invalid_token'] = FALSE;
+      if (isset($element['#token'])) {
+        if (empty($form_state['input']['form_token']) || !drupal_valid_token($form_state['input']['form_token'], $element['#token'])) {
+          // Set an early form error to block certain input processing since that
+          // opens the door for CSRF vulnerabilities.
+          _drupal_invalid_token_set_form_error();
+          // This value is checked in _form_builder_handle_input_element().
+          $form_state['invalid_token'] = TRUE;
+          // Make sure file uploads do not get processed.
+          $_FILES = array();
+        }
+      }
    }
    else {
      $form_state['process_input'] = FALSE;
@@ -1930,6 +1950,18 @@ function form_builder($form_id, &$element, &$form_state) {
      $element['#attributes']['enctype'] = 'multipart/form-data';
    }

+    // Allow Ajax submissions to the form action to bypass verification. This is
+    // especially useful for multipart forms, which cannot be verified via a
+    // response header.
+    $element['#attached']['js'][] = array(
+      'type' => 'setting',
+      'data' => array(
+        'urlIsAjaxTrusted' => array(
+          $element['#action'] => TRUE,
+        ),
+      ),
+    );
+
    // If a form contains a single textfield, and the ENTER key is pressed
    // within it, Internet Explorer submits the form with no POST data
    // identifying any submit button. Other browsers submit POST data as though
@@ -1978,6 +2010,19 @@ function form_builder($form_id, &$element, &$form_state) {
 * Adds the #name and #value properties of an input element before rendering.
 */
 function _form_builder_handle_input_element($form_id, &$element, &$form_state) {
+  static $safe_core_value_callbacks = array(
+    'form_type_token_value',
+    'form_type_textarea_value',
+    'form_type_textfield_value',
+    'form_type_checkbox_value',
+    'form_type_checkboxes_value',
+    'form_type_radios_value',
+    'form_type_password_confirm_value',
+    'form_type_select_value',
+    'form_type_tableselect_value',
+    'list_boolean_allowed_values_callback',
+  );
+
  if (!isset($element['#name'])) {
    $name = array_shift($element['#parents']);
    $element['#name'] = $name;
@@ -2056,7 +2101,14 @@ function _form_builder_handle_input_element($form_id, &$element, &$form_state) {
      // property, optionally filtered through $value_callback.
      if ($input_exists) {
        if (function_exists($value_callback)) {
-          $element['#value'] = $value_callback($element, $input, $form_state);
+          // Skip all value callbacks except safe ones like text if the CSRF
+          // token was invalid.
+          if (empty($form_state['invalid_token']) || in_array($value_callback, $safe_core_value_callbacks)) {
+            $element['#value'] = $value_callback($element, $input, $form_state);
+          }
+          else {
+            $input = NULL;
+          }
        }
        if (!isset($element['#value']) && isset($input)) {
          $element['#value'] = $input;
@@ -3910,6 +3962,29 @@ function theme_hidden($variables) {
  return '<input' . drupal_attributes($element['#attributes']) . " />\n";
 }

+/**
+ * Process function to prepare autocomplete data.
+ *
+ * @param $element
+ *   A textfield or other element with a #autocomplete_path.
+ *
+ * @return array
+ *   The processed form element.
+ */
+function form_process_autocomplete($element) {
+  $element['#autocomplete_input'] = array();
+  if ($element['#autocomplete_path'] && drupal_valid_path($element['#autocomplete_path'])) {
+    $element['#autocomplete_input']['#id'] = $element['#id'] .'-autocomplete';
+    // Force autocomplete to use non-clean URLs since this protects against the
+    // browser interpreting the path plus search string as an actual file.
+    $current_clean_url = isset($GLOBALS['conf']['clean_url']) ? $GLOBALS['conf']['clean_url'] : NULL;
+    $GLOBALS['conf']['clean_url'] = 0;
+    $element['#autocomplete_input']['#url_value'] = url($element['#autocomplete_path'], array('absolute' => TRUE));
+    $GLOBALS['conf']['clean_url'] = $current_clean_url;
+  }
+  return $element;
+}
+
 /**
 * Returns HTML for a textfield form element.
 *
@@ -3928,14 +4003,14 @@ function theme_textfield($variables) {
  _form_set_class($element, array('form-text'));

  $extra = '';
-  if ($element['#autocomplete_path'] && drupal_valid_path($element['#autocomplete_path'])) {
+  if ($element['#autocomplete_path'] && !empty($element['#autocomplete_input'])) {
    drupal_add_library('system', 'drupal.autocomplete');
    $element['#attributes']['class'][] = 'form-autocomplete';

    $attributes = array();
    $attributes['type'] = 'hidden';
-    $attributes['id'] = $element['#attributes']['id'] . '-autocomplete';
-    $attributes['value'] = url($element['#autocomplete_path'], array('absolute' => TRUE));
+    $attributes['id'] = $element['#autocomplete_input']['#id'];
+    $attributes['value'] = $element['#autocomplete_input']['#url_value'];
    $attributes['disabled'] = 'disabled';
    $attributes['class'][] = 'autocomplete';
    $extra = '<input' . drupal_attributes($attributes) . ' />';
@@ -1487,7 +1487,7 @@ function menu_tree_collect_node_links(&$tree, &$node_links) {
 *   menu_tree_collect_node_links().
 */
 function menu_tree_check_access(&$tree, $node_links = array()) {
-  if ($node_links) {
+  if ($node_links && (user_access('access content') || user_access('bypass node access'))) {
    $nids = array_keys($node_links);
    $select = db_select('node', 'n');
    $select->addField('n', 'nid');
@@ -14,6 +14,8 @@

 Drupal.ajax = Drupal.ajax || {};

+Drupal.settings.urlIsAjaxTrusted = Drupal.settings.urlIsAjaxTrusted || {};
+
 /**
 * Attaches the Ajax behavior to each Ajax form element.
 */
@@ -130,6 +132,11 @@ Drupal.ajax = function (base, element, element_settings) {
  // 5. /nojs# - Followed by a fragment.
  //      E.g.: path/nojs#myfragment
  this.url = element_settings.url.replace(/\/nojs(\/|$|\?|&|#)/g, '/ajax$1');
+  // If the 'nojs' version of the URL is trusted, also trust the 'ajax' version.
+  if (Drupal.settings.urlIsAjaxTrusted[element_settings.url]) {
+    Drupal.settings.urlIsAjaxTrusted[this.url] = true;
+  }
+
  this.wrapper = '#' + element_settings.wrapper;

  // If there isn't a form, jQuery.ajax() will be used instead, allowing us to
@@ -155,18 +162,36 @@ Drupal.ajax = function (base, element, element_settings) {
      ajax.ajaxing = true;
      return ajax.beforeSend(xmlhttprequest, options);
    },
-    success: function (response, status) {
+    success: function (response, status, xmlhttprequest) {
      // Sanity check for browser support (object expected).
      // When using iFrame uploads, responses must be returned as a string.
      if (typeof response == 'string') {
        response = $.parseJSON(response);
      }
+
+      // Prior to invoking the response's commands, verify that they can be
+      // trusted by checking for a response header. See
+      // ajax_set_verification_header() for details.
+      // - Empty responses are harmless so can bypass verification. This avoids
+      //   an alert message for server-generated no-op responses that skip Ajax
+      //   rendering.
+      // - Ajax objects with trusted URLs (e.g., ones defined server-side via
+      //   #ajax) can bypass header verification. This is especially useful for
+      //   Ajax with multipart forms. Because IFRAME transport is used, the
+      //   response headers cannot be accessed for verification.
+      if (response !== null && !Drupal.settings.urlIsAjaxTrusted[ajax.url]) {
+        if (xmlhttprequest.getResponseHeader('X-Drupal-Ajax-Token') !== '1') {
+          var customMessage = Drupal.t("The response failed verification so will not be processed.");
+          return ajax.error(xmlhttprequest, ajax.url, customMessage);
+        }
+      }
+
      return ajax.success(response, status);
    },
-    complete: function (response, status) {
+    complete: function (xmlhttprequest, status) {
      ajax.ajaxing = false;
      if (status == 'error' || status == 'parsererror') {
-        return ajax.error(response, ajax.url);
+        return ajax.error(xmlhttprequest, ajax.url);
      }
    },
    dataType: 'json',
@@ -175,6 +200,9 @@ Drupal.ajax = function (base, element, element_settings) {

  // Bind the ajaxSubmit function to the element event.
  $(ajax.element).bind(element_settings.event, function (event) {
+    if (!Drupal.settings.urlIsAjaxTrusted[ajax.url] && !Drupal.urlIsLocal(ajax.url)) {
+      throw new Error(Drupal.t('The callback URL is not local and not trusted: !url', {'!url': ajax.url}));
+    }
    return ajax.eventResponse(this, event);
  });

@@ -447,8 +475,8 @@ Drupal.ajax.prototype.getEffect = function (response) {
 /**
 * Handler for the form redirection error.
 */
-Drupal.ajax.prototype.error = function (response, uri) {
-  alert(Drupal.ajaxError(response, uri));
+Drupal.ajax.prototype.error = function (xmlhttprequest, uri, customMessage) {
+  alert(Drupal.ajaxError(xmlhttprequest, uri, customMessage));
  // Remove the progress element.
  if (this.progress.element) {
    $(this.progress.element).remove();
@@ -462,7 +490,7 @@ Drupal.ajax.prototype.error = function (response, uri) {
  $(this.element).removeClass('progress-disabled').removeAttr('disabled');
  // Reattach behaviors, if they were detached in beforeSerialize().
  if (this.form) {
-    var settings = response.settings || this.settings || Drupal.settings;
+    var settings = this.settings || Drupal.settings;
    Drupal.attachBehaviors(this.form, settings);
  }
 };
@@ -271,8 +271,11 @@ Drupal.ACDB.prototype.search = function (searchString) {
  var db = this;
  this.searchString = searchString;

-  // See if this string needs to be searched for anyway.
-  searchString = searchString.replace(/^\s+|\s+$/, '');
+  // See if this string needs to be searched for anyway. The pattern ../ is
+  // stripped since it may be misinterpreted by the browser.
+  searchString = searchString.replace(/^\s+|\.{2,}\/|\s+$/g, '');
+  // Skip empty search strings, or search strings ending with a comma, since
+  // that is the separator between search terms.
  if (searchString.length <= 0 ||
    searchString.charAt(searchString.length - 1) == ',') {
    return;
@@ -269,6 +269,72 @@ Drupal.formatPlural = function (count, singular, plural, args, options) {
  }
 };

+/**
+ * Returns the passed in URL as an absolute URL.
+ *
+ * @param url
+ *   The URL string to be normalized to an absolute URL.
+ *
+ * @return
+ *   The normalized, absolute URL.
+ *
+ * @see https://github.com/angular/angular.js/blob/v1.4.4/src/ng/urlUtils.js
+ * @see https://grack.com/blog/2009/11/17/absolutizing-url-in-javascript
+ * @see https://github.com/jquery/jquery-ui/blob/1.11.4/ui/tabs.js#L53
+ */
+Drupal.absoluteUrl = function (url) {
+  var urlParsingNode = document.createElement('a');
+
+  // Decode the URL first; this is required by IE <= 6. Decoding non-UTF-8
+  // strings may throw an exception.
+  try {
+    url = decodeURIComponent(url);
+  } catch (e) {}
+
+  urlParsingNode.setAttribute('href', url);
+
+  // IE <= 7 normalizes the URL when assigned to the anchor node similar to
+  // the other browsers.
+  return urlParsingNode.cloneNode(false).href;
+};
+
+/**
+ * Returns true if the URL is within Drupal's base path.
+ *
+ * @param url
+ *   The URL string to be tested.
+ *
+ * @return
+ *   Boolean true if local.
+ *
+ * @see https://github.com/jquery/jquery-ui/blob/1.11.4/ui/tabs.js#L58
+ */
+Drupal.urlIsLocal = function (url) {
+  // Always use browser-derived absolute URLs in the comparison, to avoid
+  // attempts to break out of the base path using directory traversal.
+  var absoluteUrl = Drupal.absoluteUrl(url);
+  var protocol = location.protocol;
+
+  // Consider URLs that match this site's base URL but use HTTPS instead of HTTP
+  // as local as well.
+  if (protocol === 'http:' && absoluteUrl.indexOf('https:') === 0) {
+    protocol = 'https:';
+  }
+  var baseUrl = protocol + '//' + location.host + Drupal.settings.basePath.slice(0, -1);
+
+  // Decoding non-UTF-8 strings may throw an exception.
+  try {
+    absoluteUrl = decodeURIComponent(absoluteUrl);
+  } catch (e) {}
+  try {
+    baseUrl = decodeURIComponent(baseUrl);
+  } catch (e) {}
+
+  // The given URL matches the site's base URL, or has a path under the site's
+  // base URL.
+  return absoluteUrl === baseUrl || absoluteUrl.indexOf(baseUrl + '/') === 0;
+};
+
 /**
 * Generate the themed representation of a Drupal object.
 *
@@ -350,7 +416,7 @@ Drupal.getSelection = function (element) {
 /**
 * Build an error message from an Ajax response.
 */
-Drupal.ajaxError = function (xmlhttp, uri) {
+Drupal.ajaxError = function (xmlhttp, uri, customMessage) {
  var statusCode, statusText, pathText, responseText, readyStateText, message;
  if (xmlhttp.status) {
    statusCode = "\n" + Drupal.t("An AJAX HTTP error occurred.") +  "\n" + Drupal.t("HTTP Result Code: !status", {'!status': xmlhttp.status});
@@ -383,7 +449,10 @@ Drupal.ajaxError = function (xmlhttp, uri) {
  // We don't need readyState except for status == 0.
  readyStateText = xmlhttp.status == 0 ? ("\n" + Drupal.t("ReadyState: !readyState", {'!readyState': xmlhttp.readyState})) : "";

-  message = statusCode + pathText + statusText + responseText + readyStateText;
+  // Additional message beyond what the xmlhttp object provides.
+  customMessage = customMessage ? ("\n" + Drupal.t("CustomMessage: !customMessage", {'!customMessage': customMessage})) : "";
+
+  message = statusCode + pathText + statusText + customMessage + responseText + readyStateText;
  return message;
 };

@@ -7,8 +7,8 @@ files[] = aggregator.test
 configure = admin/config/services/aggregator/settings
 stylesheets[all][] = aggregator.css

-; Information added by Drupal.org packaging script on 2015-05-07
-version = "7.37"
+; Information added by Drupal.org packaging script on 2015-08-19
+version = "7.39"
 project = "drupal"
-datestamp = "1430973154"
+datestamp = "1440020197"

@@ -5,8 +5,8 @@ version = VERSION
 core = 7.x
 hidden = TRUE

-; Information added by Drupal.org packaging script on 2015-05-07
-version = "7.37"
+; Information added by Drupal.org packaging script on 2015-08-19
+version = "7.39"
 project = "drupal"
-datestamp = "1430973154"
+datestamp = "1440020197"

@@ -6,8 +6,8 @@ core = 7.x
 files[] = block.test
 configure = admin/structure/block

-; Information added by Drupal.org packaging script on 2015-05-07
-version = "7.37"
+; Information added by Drupal.org packaging script on 2015-08-19
+version = "7.39"
 project = "drupal"
-datestamp = "1430973154"
+datestamp = "1440020197"

@@ -5,8 +5,8 @@ version = VERSION
 core = 7.x
 hidden = TRUE

-; Information added by Drupal.org packaging script on 2015-05-07
-version = "7.37"
+; Information added by Drupal.org packaging script on 2015-08-19
+version = "7.39"
 project = "drupal"
-datestamp = "1430973154"
+datestamp = "1440020197"

@@ -13,8 +13,8 @@ regions[footer] = Footer
 regions[highlighted] = Highlighted
 regions[help] = Help

-; Information added by Drupal.org packaging script on 2015-05-07
-version = "7.37"
+; Information added by Drupal.org packaging script on 2015-08-19
+version = "7.39"
 project = "drupal"
-datestamp = "1430973154"
+datestamp = "1440020197"

@@ -5,8 +5,8 @@ version = VERSION
 core = 7.x
 files[] = blog.test

-; Information added by Drupal.org packaging script on 2015-05-07
-version = "7.37"
+; Information added by Drupal.org packaging script on 2015-08-19
+version = "7.39"
 project = "drupal"
-datestamp = "1430973154"
+datestamp = "1440020197"

@@ -7,8 +7,8 @@ files[] = book.test
 configure = admin/content/book/settings
 stylesheets[all][] = book.css

-; Information added by Drupal.org packaging script on 2015-05-07
-version = "7.37"
+; Information added by Drupal.org packaging script on 2015-08-19
+version = "7.39"
 project = "drupal"
-datestamp = "1430973154"
+datestamp = "1440020197"

@@ -5,8 +5,8 @@ version = VERSION
 core = 7.x
 files[] = color.test

-; Information added by Drupal.org packaging script on 2015-05-07
-version = "7.37"
+; Information added by Drupal.org packaging script on 2015-08-19
+version = "7.39"
 project = "drupal"
-datestamp = "1430973154"
+datestamp = "1440020197"

@@ -9,8 +9,8 @@ files[] = comment.test
 configure = admin/content/comment
 stylesheets[all][] = comment.css

-; Information added by Drupal.org packaging script on 2015-05-07
-version = "7.37"
+; Information added by Drupal.org packaging script on 2015-08-19
+version = "7.39"
 project = "drupal"
-datestamp = "1430973154"
+datestamp = "1440020197"

@@ -6,8 +6,8 @@ core = 7.x
 files[] = contact.test
 configure = admin/structure/contact

-; Information added by Drupal.org packaging script on 2015-05-07
-version = "7.37"
+; Information added by Drupal.org packaging script on 2015-08-19
+version = "7.39"
 project = "drupal"
-datestamp = "1430973154"
+datestamp = "1440020197"

@@ -5,8 +5,8 @@ version = VERSION
 core = 7.x
 files[] = contextual.test

-; Information added by Drupal.org packaging script on 2015-05-07
-version = "7.37"
+; Information added by Drupal.org packaging script on 2015-08-19
+version = "7.39"
 project = "drupal"
-datestamp = "1430973154"
+datestamp = "1440020197"

@@ -7,8 +7,8 @@ files[] = dashboard.test
 dependencies[] = block
 configure = admin/dashboard/customize

-; Information added by Drupal.org packaging script on 2015-05-07
-version = "7.37"
+; Information added by Drupal.org packaging script on 2015-08-19
+version = "7.39"
 project = "drupal"
-datestamp = "1430973154"
+datestamp = "1440020197"

@@ -5,8 +5,8 @@ version = VERSION
 core = 7.x
 files[] = dblog.test

-; Information added by Drupal.org packaging script on 2015-05-07
-version = "7.37"
+; Information added by Drupal.org packaging script on 2015-08-19
+version = "7.39"
 project = "drupal"
-datestamp = "1430973154"
+datestamp = "1440020197"

@@ -11,8 +11,8 @@ dependencies[] = field_sql_storage
 required = TRUE
 stylesheets[all][] = theme/field.css

-; Information added by Drupal.org packaging script on 2015-05-07
-version = "7.37"
+; Information added by Drupal.org packaging script on 2015-08-19
+version = "7.39"
 project = "drupal"
-datestamp = "1430973154"
+datestamp = "1440020197"

@@ -7,8 +7,8 @@ dependencies[] = field
 files[] = field_sql_storage.test
 required = TRUE

-; Information added by Drupal.org packaging script on 2015-05-07
-version = "7.37"
+; Information added by Drupal.org packaging script on 2015-08-19
+version = "7.39"
 project = "drupal"
-datestamp = "1430973154"
+datestamp = "1440020197"

@@ -7,8 +7,8 @@ dependencies[] = field
 dependencies[] = options
 files[] = tests/list.test

-; Information added by Drupal.org packaging script on 2015-05-07
-version = "7.37"
+; Information added by Drupal.org packaging script on 2015-08-19
+version = "7.39"
 project = "drupal"
-datestamp = "1430973154"
+datestamp = "1440020197"

@@ -5,8 +5,8 @@ package = Testing
 version = VERSION
 hidden = TRUE

-; Information added by Drupal.org packaging script on 2015-05-07
-version = "7.37"
+; Information added by Drupal.org packaging script on 2015-08-19
+version = "7.39"
 project = "drupal"
-datestamp = "1430973154"
+datestamp = "1440020197"

@@ -6,8 +6,8 @@ core = 7.x
 dependencies[] = field
 files[] = number.test

-; Information added by Drupal.org packaging script on 2015-05-07
-version = "7.37"
+; Information added by Drupal.org packaging script on 2015-08-19
+version = "7.39"
 project = "drupal"
-datestamp = "1430973154"
+datestamp = "1440020197"

@@ -6,8 +6,8 @@ core = 7.x
 dependencies[] = field
 files[] = options.test

-; Information added by Drupal.org packaging script on 2015-05-07
-version = "7.37"
+; Information added by Drupal.org packaging script on 2015-08-19
+version = "7.39"
 project = "drupal"
-datestamp = "1430973154"
+datestamp = "1440020197"

@@ -7,8 +7,8 @@ dependencies[] = field
 files[] = text.test
 required = TRUE

-; Information added by Drupal.org packaging script on 2015-05-07
-version = "7.37"
+; Information added by Drupal.org packaging script on 2015-08-19
+version = "7.39"
 project = "drupal"
-datestamp = "1430973154"
+datestamp = "1440020197"

@@ -6,8 +6,8 @@ files[] = field_test.entity.inc
 version = VERSION
 hidden = TRUE

-; Information added by Drupal.org packaging script on 2015-05-07
-version = "7.37"
+; Information added by Drupal.org packaging script on 2015-08-19
+version = "7.39"
 project = "drupal"
-datestamp = "1430973154"
+datestamp = "1440020197"

@@ -2105,6 +2105,10 @@ function field_ui_next_destination($entity_type, $bundle) {
  $destinations = !empty($_REQUEST['destinations']) ? $_REQUEST['destinations'] : array();
  if (!empty($destinations)) {
    unset($_REQUEST['destinations']);
+  }
+  // Remove any external URLs.
+  $destinations = array_diff($destinations, array_filter($destinations, 'url_is_external'));
+  if ($destinations) {
    return field_ui_get_destinations($destinations);
  }
  $admin_path = _field_ui_bundle_admin_path($entity_type, $bundle);
@@ -6,8 +6,8 @@ core = 7.x
 dependencies[] = field
 files[] = field_ui.test

-; Information added by Drupal.org packaging script on 2015-05-07
-version = "7.37"
+; Information added by Drupal.org packaging script on 2015-08-19
+version = "7.39"
 project = "drupal"
-datestamp = "1430973154"
+datestamp = "1440020197"

@@ -445,6 +445,19 @@ class FieldUIManageFieldsTestCase extends FieldUITestCase {
    $this->assertText(t('The machine-readable name is already in use. It must be unique.'));
    $this->assertUrl($url, array(), 'Stayed on the same page.');
  }
+
+  /**
+   * Tests that external URLs in the 'destinations' query parameter are blocked.
+   */
+  function testExternalDestinations() {
+    $path = 'admin/structure/types/manage/article/fields/field_tags/field-settings';
+    $options = array(
+      'query' => array('destinations' => array('http://example.com')),
+    );
+    $this->drupalPost($path, NULL, t('Save field settings'), $options);
+
+    $this->assertUrl('admin/structure/types/manage/article/fields', array(), 'Stayed on the same site.');
+  }
 }

 /**
@@ -6,8 +6,8 @@ core = 7.x
 dependencies[] = field
 files[] = tests/file.test

-; Information added by Drupal.org packaging script on 2015-05-07
-version = "7.37"
+; Information added by Drupal.org packaging script on 2015-08-19
+version = "7.39"
 project = "drupal"
-datestamp = "1430973154"
+datestamp = "1440020197"

@@ -377,6 +377,18 @@ class FileManagedFileElementTestCase extends FileFieldTestCase {
        $this->drupalPost($path, array(), t('Save'));
        $this->assertRaw(t('The file id is %fid.', array('%fid' => 0)), 'Submitted without a file.');

+        // Submit with a file, but with an invalid form token. Ensure the file
+        // was not saved.
+        $last_fid_prior = $this->getLastFileId();
+        $edit = array(
+          'files[' . $input_base_name . ']' => drupal_realpath($test_file->uri),
+          'form_token' => 'invalid token',
+        );
+        $this->drupalPost($path, $edit, t('Save'));
+        $this->assertText('The form has become outdated. Copy any unsaved work in the form below');
+        $last_fid = $this->getLastFileId();
+        $this->assertEqual($last_fid_prior, $last_fid, 'File was not saved when uploaded with an invalid form token.');
+
        // Submit a new file, without using the Upload button.
        $last_fid_prior = $this->getLastFileId();
        $edit = array('files[' . $input_base_name . ']' => drupal_realpath($test_file->uri));
@@ -5,8 +5,8 @@ version = VERSION
 core = 7.x
 hidden = TRUE

-; Information added by Drupal.org packaging script on 2015-05-07
-version = "7.37"
+; Information added by Drupal.org packaging script on 2015-08-19
+version = "7.39"
 project = "drupal"
-datestamp = "1430973154"
+datestamp = "1440020197"

@@ -7,8 +7,8 @@ files[] = filter.test
 required = TRUE
 configure = admin/config/content/formats

-; Information added by Drupal.org packaging script on 2015-05-07
-version = "7.37"
+; Information added by Drupal.org packaging script on 2015-08-19
+version = "7.39"
 project = "drupal"
-datestamp = "1430973154"
+datestamp = "1440020197"

@@ -9,8 +9,8 @@ files[] = forum.test
 configure = admin/structure/forum
 stylesheets[all][] = forum.css

-; Information added by Drupal.org packaging script on 2015-05-07
-version = "7.37"
+; Information added by Drupal.org packaging script on 2015-08-19
+version = "7.39"
 project = "drupal"
-datestamp = "1430973154"
+datestamp = "1440020197"

@@ -5,8 +5,8 @@ version = VERSION
 core = 7.x
 files[] = help.test

-; Information added by Drupal.org packaging script on 2015-05-07
-version = "7.37"
+; Information added by Drupal.org packaging script on 2015-08-19
+version = "7.39"
 project = "drupal"
-datestamp = "1430973154"
+datestamp = "1440020197"

@@ -7,8 +7,8 @@ dependencies[] = file
 files[] = image.test
 configure = admin/config/media/image-styles

-; Information added by Drupal.org packaging script on 2015-05-07
-version = "7.37"
+; Information added by Drupal.org packaging script on 2015-08-19
+version = "7.39"
 project = "drupal"
-datestamp = "1430973154"
+datestamp = "1440020197"

@@ -6,8 +6,8 @@ core = 7.x
 files[] = image_module_test.module
 hidden = TRUE

-; Information added by Drupal.org packaging script on 2015-05-07
-version = "7.37"
+; Information added by Drupal.org packaging script on 2015-08-19
+version = "7.39"
 project = "drupal"
-datestamp = "1430973154"
+datestamp = "1440020197"

@@ -6,8 +6,8 @@ core = 7.x
 files[] = locale.test
 configure = admin/config/regional/language

-; Information added by Drupal.org packaging script on 2015-05-07
-version = "7.37"
+; Information added by Drupal.org packaging script on 2015-08-19
+version = "7.39"
 project = "drupal"
-datestamp = "1430973154"
+datestamp = "1440020197"

@@ -5,8 +5,8 @@ package = Testing
 version = VERSION
 hidden = TRUE

-; Information added by Drupal.org packaging script on 2015-05-07
-version = "7.37"
+; Information added by Drupal.org packaging script on 2015-08-19
+version = "7.39"
 project = "drupal"
-datestamp = "1430973154"
+datestamp = "1440020197"

@@ -6,8 +6,8 @@ core = 7.x
 files[] = menu.test
 configure = admin/structure/menu

-; Information added by Drupal.org packaging script on 2015-05-07
-version = "7.37"
+; Information added by Drupal.org packaging script on 2015-08-19
+version = "7.39"
 project = "drupal"
-datestamp = "1430973154"
+datestamp = "1440020197"

@@ -9,8 +9,8 @@ required = TRUE
 configure = admin/structure/types
 stylesheets[all][] = node.css

-; Information added by Drupal.org packaging script on 2015-05-07
-version = "7.37"
+; Information added by Drupal.org packaging script on 2015-08-19
+version = "7.39"
 project = "drupal"
-datestamp = "1430973154"
+datestamp = "1440020197"

@@ -5,8 +5,8 @@ version = VERSION
 core = 7.x
 hidden = TRUE

-; Information added by Drupal.org packaging script on 2015-05-07
-version = "7.37"
+; Information added by Drupal.org packaging script on 2015-08-19
+version = "7.39"
 project = "drupal"
-datestamp = "1430973154"
+datestamp = "1440020197"

@@ -5,8 +5,8 @@ version = VERSION
 core = 7.x
 hidden = TRUE

-; Information added by Drupal.org packaging script on 2015-05-07
-version = "7.37"
+; Information added by Drupal.org packaging script on 2015-08-19
+version = "7.39"
 project = "drupal"
-datestamp = "1430973154"
+datestamp = "1440020197"

@@ -5,8 +5,8 @@ version = VERSION
 core = 7.x
 hidden = TRUE

-; Information added by Drupal.org packaging script on 2015-05-07
-version = "7.37"
+; Information added by Drupal.org packaging script on 2015-08-19
+version = "7.39"
 project = "drupal"
-datestamp = "1430973154"
+datestamp = "1440020197"

@@ -5,8 +5,8 @@ package = Core
 core = 7.x
 files[] = openid.test

-; Information added by Drupal.org packaging script on 2015-05-07
-version = "7.37"
+; Information added by Drupal.org packaging script on 2015-08-19
+version = "7.39"
 project = "drupal"
-datestamp = "1430973154"
+datestamp = "1440020197"

@@ -365,14 +365,20 @@ function openid_complete($response = array()) {
            // to the OpenID Provider, we need to do discovery on the returned
            // identififer to make sure that the provider is authorized to
            // respond on behalf of this.
-            if ($response_claimed_id != $claimed_id) {
+            if ($response_claimed_id != $claimed_id || $response_claimed_id != $response['openid.identity']) {
              $discovery = openid_discovery($response['openid.claimed_id']);
+              $uris = array();
              if ($discovery && !empty($discovery['services'])) {
-                $uris = array();
                foreach ($discovery['services'] as $discovered_service) {
-                  if (in_array('http://specs.openid.net/auth/2.0/server', $discovered_service['types']) || in_array('http://specs.openid.net/auth/2.0/signon', $discovered_service['types'])) {
-                    $uris[] = $discovered_service['uri'];
+                  if (!in_array('http://specs.openid.net/auth/2.0/server', $discovered_service['types']) && !in_array('http://specs.openid.net/auth/2.0/signon', $discovered_service['types'])) {
+                    continue;
                  }
+                  // The OP-Local Identifier (if different than the Claimed
+                  // Identifier) must be present in the XRDS document.
+                  if ($response_claimed_id != $response['openid.identity'] && (!isset($discovered_service['identity']) || $discovered_service['identity'] != $response['openid.identity'])) {
+                    continue;
+                  }
+                  $uris[] = $discovered_service['uri'];
                }
              }
              if (!in_array($service['uri'], $uris)) {
@@ -94,7 +94,7 @@ class OpenIDFunctionalTestCase extends OpenIDWebTestCase {
    $identity = url('openid-test/yadis/xrds/dummy-user', array('absolute' => TRUE, 'fragment' => $this->randomName()));
    // Tell openid_test.module to respond with this identifier. If the fragment
    // part is present in the identifier, it should be retained.
-    variable_set('openid_test_response', array('openid.claimed_id' => $identity));
+    variable_set('openid_test_response', array('openid.claimed_id' => $identity, 'openid.identity' => openid_normalize($identity)));
    $this->addIdentity(url('openid-test/yadis/xrds/server', array('absolute' => TRUE)), 2, 'http://specs.openid.net/auth/2.0/identifier_select', $identity);
    variable_set('openid_test_response', array());

@@ -6,8 +6,8 @@ core = 7.x
 dependencies[] = openid
 hidden = TRUE

-; Information added by Drupal.org packaging script on 2015-05-07
-version = "7.37"
+; Information added by Drupal.org packaging script on 2015-08-19
+version = "7.39"
 project = "drupal"
-datestamp = "1430973154"
+datestamp = "1440020197"

@@ -150,6 +150,7 @@ function openid_test_yadis_xrds() {
          <Service priority="20">
            <Type>http://specs.openid.net/auth/2.0/server</Type>
            <URI>' . url('openid-test/endpoint', array('absolute' => TRUE)) . '</URI>
+            <LocalID>' . url('openid-test/yadis/xrds/server', array('absolute' => TRUE)) . '</LocalID>
          </Service>';
    }
    elseif (arg(3) == 'delegate') {
@@ -389,6 +389,27 @@ Drupal.overlay.isExternalLink = function (url) {
  return re.test(url);
 };

+/**
+ * Constructs an internal URL (relative to this site) from the provided path.
+ *
+ * For example, if the provided path is 'admin' and the site is installed at
+ * http://example.com/drupal, this function will return '/drupal/admin'.
+ *
+ * @param path
+ *   The internal path, without any leading slash.
+ *
+ * @return
+ *   The internal URL derived from the provided path, or null if a valid
+ *   internal path cannot be constructed (for example, if an attempt to create
+ *   an external link is detected).
+ */
+Drupal.overlay.getInternalUrl = function (path) {
+  var url = Drupal.settings.basePath + path;
+  if (!this.isExternalLink(url)) {
+    return url;
+  }
+};
+
 /**
 * Event handler: resizes overlay according to the size of the parent window.
 *
@@ -577,7 +598,7 @@ Drupal.overlay.eventhandlerOverrideLink = function (event) {
      // If the link contains the overlay-restore class and the overlay-context
      // state is set, also update the parent window's location.
      var parentLocation = ($target.hasClass('overlay-restore') && typeof $.bbq.getState('overlay-context') == 'string')
-        ? Drupal.settings.basePath + $.bbq.getState('overlay-context')
+        ? this.getInternalUrl($.bbq.getState('overlay-context'))
        : null;
      href = this.fragmentizeLink($target.get(0), parentLocation);
      // Only override default behavior when left-clicking and user is not
@@ -657,11 +678,15 @@ Drupal.overlay.eventhandlerOperateByURLFragment = function (event) {
  }

  // Get the overlay URL from the current URL fragment.
+  var internalUrl = null;
  var state = $.bbq.getState('overlay');
  if (state) {
+    internalUrl = this.getInternalUrl(state);
+  }
+  if (internalUrl) {
    // Append render variable, so the server side can choose the right
    // rendering and add child frame code to the page if needed.
-    var url = $.param.querystring(Drupal.settings.basePath + state, { render: 'overlay' });
+    var url = $.param.querystring(internalUrl, { render: 'overlay' });

    this.open(url);
    this.resetActiveClass(this.getPath(Drupal.settings.basePath + state));
@@ -4,8 +4,8 @@ package = Core
 version = VERSION
 core = 7.x

-; Information added by Drupal.org packaging script on 2015-05-07
-version = "7.37"
+; Information added by Drupal.org packaging script on 2015-08-19
+version = "7.39"
 project = "drupal"
-datestamp = "1430973154"
+datestamp = "1440020197"

@@ -6,8 +6,8 @@ core = 7.x
 files[] = path.test
 configure = admin/config/search/path

-; Information added by Drupal.org packaging script on 2015-05-07
-version = "7.37"
+; Information added by Drupal.org packaging script on 2015-08-19
+version = "7.39"
 project = "drupal"
-datestamp = "1430973154"
+datestamp = "1440020197"

@@ -5,8 +5,8 @@ version = VERSION
 core = 7.x
 files[] = php.test

-; Information added by Drupal.org packaging script on 2015-05-07
-version = "7.37"
+; Information added by Drupal.org packaging script on 2015-08-19
+version = "7.39"
 project = "drupal"
-datestamp = "1430973154"
+datestamp = "1440020197"

@@ -6,8 +6,8 @@ core = 7.x
 files[] = poll.test
 stylesheets[all][] = poll.css

-; Information added by Drupal.org packaging script on 2015-05-07
-version = "7.37"
+; Information added by Drupal.org packaging script on 2015-08-19
+version = "7.39"
 project = "drupal"
-datestamp = "1430973154"
+datestamp = "1440020197"

@@ -11,8 +11,8 @@ configure = admin/config/people/profile
 ; See user_system_info_alter().
 hidden = TRUE

-; Information added by Drupal.org packaging script on 2015-05-07
-version = "7.37"
+; Information added by Drupal.org packaging script on 2015-08-19
+version = "7.39"
 project = "drupal"
-datestamp = "1430973154"
+datestamp = "1440020197"

@@ -339,12 +339,22 @@ class ProfileTestAutocomplete extends ProfileTestCase {
    $this->setProfileField($field, $field['value']);

    // Set some html for what we want to see in the page output later.
-    $autocomplete_html = '<input type="hidden" id="' . drupal_html_id('edit-' . $field['form_name'] . '-autocomplete') . '" value="' . url('profile/autocomplete/' . $field['fid'], array('absolute' => TRUE)) . '" disabled="disabled" class="autocomplete" />';
-    $field_html = '<input type="text" maxlength="255" name="' . $field['form_name'] . '" id="' . drupal_html_id('edit-' . $field['form_name']) . '" size="60" value="' . $field['value'] . '" class="form-text form-autocomplete required" />';
+    // Autocomplete always uses non-clean URLs.
+    $current_clean_url = isset($GLOBALS['conf']['clean_url']) ? $GLOBALS['conf']['clean_url'] : NULL;
+    $GLOBALS['conf']['clean_url'] = 0;
+    $autocomplete_url = url('profile/autocomplete/' . $field['fid'], array('absolute' => TRUE));
+    $GLOBALS['conf']['clean_url'] = $current_clean_url;
+    $autocomplete_id = drupal_html_id('edit-' . $field['form_name'] . '-autocomplete');
+    $autocomplete_html = '<input type="hidden" id="' . $autocomplete_id . '" value="' . $autocomplete_url . '" disabled="disabled" class="autocomplete" />';

    // Check that autocompletion html is found on the user's profile edit page.
    $this->drupalGet('user/' . $this->admin_user->uid . '/edit/' . $category);
    $this->assertRaw($autocomplete_html, 'Autocomplete found.');
+    $this->assertFieldByXPath(
+      '//input[@type="text" and @name="' . $field['form_name'] . '" and contains(@class, "form-autocomplete")]',
+      '',
+      'Text input field found'
+    );
    $this->assertRaw('misc/autocomplete.js', 'Autocomplete JavaScript found.');
    $this->assertRaw('class="form-text form-autocomplete"', 'Autocomplete form element class found.');

@@ -5,8 +5,8 @@ version = VERSION
 core = 7.x
 files[] = rdf.test

-; Information added by Drupal.org packaging script on 2015-05-07
-version = "7.37"
+; Information added by Drupal.org packaging script on 2015-08-19
+version = "7.39"
 project = "drupal"
-datestamp = "1430973154"
+datestamp = "1440020197"

@@ -5,8 +5,8 @@ version = VERSION
 core = 7.x
 hidden = TRUE

-; Information added by Drupal.org packaging script on 2015-05-07
-version = "7.37"
+; Information added by Drupal.org packaging script on 2015-08-19
+version = "7.39"
 project = "drupal"
-datestamp = "1430973154"
+datestamp = "1440020197"

@@ -8,8 +8,8 @@ files[] = search.test
 configure = admin/config/search/settings
 stylesheets[all][] = search.css

-; Information added by Drupal.org packaging script on 2015-05-07
-version = "7.37"
+; Information added by Drupal.org packaging script on 2015-08-19
+version = "7.39"
 project = "drupal"
-datestamp = "1430973154"
+datestamp = "1440020197"

@@ -5,8 +5,8 @@ version = VERSION
 core = 7.x
 hidden = TRUE

-; Information added by Drupal.org packaging script on 2015-05-07
-version = "7.37"
+; Information added by Drupal.org packaging script on 2015-08-19
+version = "7.39"
 project = "drupal"
-datestamp = "1430973154"
+datestamp = "1440020197"

@@ -5,8 +5,8 @@ version = VERSION
 core = 7.x
 hidden = TRUE

-; Information added by Drupal.org packaging script on 2015-05-07
-version = "7.37"
+; Information added by Drupal.org packaging script on 2015-08-19
+version = "7.39"
 project = "drupal"
-datestamp = "1430973154"
+datestamp = "1440020197"

@@ -5,8 +5,8 @@ version = VERSION
 core = 7.x
 hidden = TRUE

-; Information added by Drupal.org packaging script on 2015-05-07
-version = "7.37"
+; Information added by Drupal.org packaging script on 2015-08-19
+version = "7.39"
 project = "drupal"
-datestamp = "1430973154"
+datestamp = "1440020197"

@@ -6,8 +6,8 @@ core = 7.x
 files[] = shortcut.test
 configure = admin/config/user-interface/shortcut

-; Information added by Drupal.org packaging script on 2015-05-07
-version = "7.37"
+; Information added by Drupal.org packaging script on 2015-08-19
+version = "7.39"
 project = "drupal"
-datestamp = "1430973154"
+datestamp = "1440020197"

@@ -2221,6 +2221,7 @@ class DrupalWebTestCase extends DrupalTestCase {

    // Submit the POST request.
    $return = drupal_json_decode($this->drupalPost(NULL, $edit, array('path' => $ajax_path, 'triggering_element' => $triggering_element), $options, $headers, $form_html_id, $extra_post));
+    $this->assertIdentical($this->drupalGetHeader('X-Drupal-Ajax-Token'), '1', 'Ajax response header found.');

    // Change the page content by applying the returned commands.
    if (!empty($ajax_settings) && !empty($return)) {
@@ -56,8 +56,8 @@ files[] = tests/upgrade/update.trigger.test
 files[] = tests/upgrade/update.field.test
 files[] = tests/upgrade/update.user.test

-; Information added by Drupal.org packaging script on 2015-05-07
-version = "7.37"
+; Information added by Drupal.org packaging script on 2015-08-19
+version = "7.39"
 project = "drupal"
-datestamp = "1430973154"
+datestamp = "1440020197"

@@ -5,8 +5,8 @@ version = VERSION
 core = 7.x
 hidden = TRUE

-; Information added by Drupal.org packaging script on 2015-05-07
-version = "7.37"
+; Information added by Drupal.org packaging script on 2015-08-19
+version = "7.39"
 project = "drupal"
-datestamp = "1430973154"
+datestamp = "1440020197"

@@ -5,8 +5,8 @@ package = Testing
 version = VERSION
 hidden = TRUE

-; Information added by Drupal.org packaging script on 2015-05-07
-version = "7.37"
+; Information added by Drupal.org packaging script on 2015-08-19
+version = "7.39"
 project = "drupal"
-datestamp = "1430973154"
+datestamp = "1440020197"

@@ -5,8 +5,8 @@ version = VERSION
 core = 7.x
 hidden = TRUE

-; Information added by Drupal.org packaging script on 2015-05-07
-version = "7.37"
+; Information added by Drupal.org packaging script on 2015-08-19
+version = "7.39"
 project = "drupal"
-datestamp = "1430973154"
+datestamp = "1440020197"

@@ -5,8 +5,8 @@ version = VERSION
 core = 7.x
 hidden = TRUE

-; Information added by Drupal.org packaging script on 2015-05-07
-version = "7.37"
+; Information added by Drupal.org packaging script on 2015-08-19
+version = "7.39"
 project = "drupal"
-datestamp = "1430973154"
+datestamp = "1440020197"

@@ -2117,7 +2117,7 @@ class DrupalRenderTestCase extends DrupalWebTestCase {
  }

  /**
-   * Tests caching of an empty render item.
+   * Tests caching of render items.
   */
  function testDrupalRenderCache() {
    // Force a request via GET.
@@ -2143,6 +2143,59 @@ class DrupalRenderTestCase extends DrupalWebTestCase {
    drupal_render($element);
    $this->assertFalse(isset($element['#printed']), 'Cache hit');

+    // Test that user 1 does not share the cache with other users who have the
+    // same roles, even when DRUPAL_CACHE_PER_ROLE is used.
+    $user1 = user_load(1);
+    $first_authenticated_user = $this->drupalCreateUser();
+    $second_authenticated_user = $this->drupalCreateUser();
+    $user1->roles = array_intersect_key($user1->roles, array(DRUPAL_AUTHENTICATED_RID => TRUE));
+    user_save($user1);
+    // Load all the accounts again, to make sure we have complete account
+    // objects.
+    $user1 = user_load(1);
+    $first_authenticated_user = user_load($first_authenticated_user->uid);
+    $second_authenticated_user = user_load($second_authenticated_user->uid);
+    $this->assertEqual($user1->roles, $first_authenticated_user->roles, 'User 1 has the same roles as an authenticated user.');
+    // Impersonate user 1 and render content that only user 1 should have
+    // permission to see.
+    $original_user = $GLOBALS['user'];
+    $original_session_state = drupal_save_session();
+    drupal_save_session(FALSE);
+    $GLOBALS['user'] = $user1;
+    $test_element = array(
+      '#cache' => array(
+        'keys' => array('test'),
+        'granularity' => DRUPAL_CACHE_PER_ROLE,
+      ),
+    );
+    $element = $test_element;
+    $element['#markup'] = 'content for user 1';
+    $output = drupal_render($element);
+    $this->assertEqual($output, 'content for user 1');
+    // Verify the cache is working by rendering the same element but with
+    // different markup passed in; the result should be the same.
+    $element = $test_element;
+    $element['#markup'] = 'should not be used';
+    $output = drupal_render($element);
+    $this->assertEqual($output, 'content for user 1');
+    // Verify that the first authenticated user does not see the same content
+    // as user 1.
+    $GLOBALS['user'] = $first_authenticated_user;
+    $element = $test_element;
+    $element['#markup'] = 'content for authenticated users';
+    $output = drupal_render($element);
+    $this->assertEqual($output, 'content for authenticated users');
+    // Verify that the second authenticated user shares the cache with the
+    // first authenticated user.
+    $GLOBALS['user'] = $second_authenticated_user;
+    $element = $test_element;
+    $element['#markup'] = 'should not be used';
+    $output = drupal_render($element);
+    $this->assertEqual($output, 'content for authenticated users');
+    // Restore the original logged-in user.
+    $GLOBALS['user'] = $original_user;
+    drupal_save_session($original_session_state);
+
    // Restore the previous request method.
    $_SERVER['REQUEST_METHOD'] = $request_method;
  }
@@ -7,8 +7,8 @@ stylesheets[all][] = common_test.css
 stylesheets[print][] = common_test.print.css
 hidden = TRUE

-; Information added by Drupal.org packaging script on 2015-05-07
-version = "7.37"
+; Information added by Drupal.org packaging script on 2015-08-19
+version = "7.39"
 project = "drupal"
-datestamp = "1430973154"
+datestamp = "1440020197"

@@ -5,8 +5,8 @@ version = VERSION
 core = 7.x
 hidden = TRUE

-; Information added by Drupal.org packaging script on 2015-05-07
-version = "7.37"
+; Information added by Drupal.org packaging script on 2015-08-19
+version = "7.39"
 project = "drupal"
-datestamp = "1430973154"
+datestamp = "1440020197"

@@ -5,8 +5,8 @@ package = Testing
 version = VERSION
 hidden = TRUE

-; Information added by Drupal.org packaging script on 2015-05-07
-version = "7.37"
+; Information added by Drupal.org packaging script on 2015-08-19
+version = "7.39"
 project = "drupal"
-datestamp = "1430973154"
+datestamp = "1440020197"

@@ -1414,10 +1414,47 @@ class DatabaseSelectTestCase extends DatabaseTestCase {
    }

    $query = (string)$query;
-    $expected = "/* Testing query comments SELECT nid FROM {node}; -- */ SELECT test.name AS name, test.age AS age\nFROM \n{test} test";
+    $expected = "/* Testing query comments  * / SELECT nid FROM {node}; -- */ SELECT test.name AS name, test.age AS age\nFROM \n{test} test";

    $this->assertEqual($num_records, 4, 'Returned the correct number of rows.');
    $this->assertEqual($query, $expected, 'The flattened query contains the sanitised comment string.');
+
+    $connection = Database::getConnection();
+    foreach ($this->makeCommentsProvider() as $test_set) {
+      list($expected, $comments) = $test_set;
+      $this->assertEqual($expected, $connection->makeComment($comments));
+    }
+  }
+
+  /**
+   * Provides expected and input values for testVulnerableComment().
+   */
+  function makeCommentsProvider() {
+    return array(
+      array(
+        '/*  */ ',
+        array(''),
+      ),
+      // Try and close the comment early.
+      array(
+        '/* Exploit  * / DROP TABLE node; -- */ ',
+        array('Exploit */ DROP TABLE node; --'),
+      ),
+      // Variations on comment closing.
+      array(
+        '/* Exploit  * / * / DROP TABLE node; -- */ ',
+        array('Exploit */*/ DROP TABLE node; --'),
+      ),
+      array(
+        '/* Exploit  *  * // DROP TABLE node; -- */ ',
+        array('Exploit **// DROP TABLE node; --'),
+      ),
+      // Try closing the comment in the second string which is appended.
+      array(
+        '/* Exploit  * / DROP TABLE node; --; Another try  * / DROP TABLE node; -- */ ',
+        array('Exploit */ DROP TABLE node; --', 'Another try */ DROP TABLE node; --'),
+      ),
+    );
  }

  /**
@@ -7,8 +7,8 @@ version = VERSION
 core = 7.x
 hidden = TRUE

-; Information added by Drupal.org packaging script on 2015-05-07
-version = "7.37"
+; Information added by Drupal.org packaging script on 2015-08-19
+version = "7.39"
 project = "drupal"
-datestamp = "1430973154"
+datestamp = "1440020197"

@@ -5,8 +5,8 @@ version = VERSION
 core = 7.x
 hidden = TRUE

-; Information added by Drupal.org packaging script on 2015-05-07
-version = "7.37"
+; Information added by Drupal.org packaging script on 2015-08-19
+version = "7.39"
 project = "drupal"
-datestamp = "1430973154"
+datestamp = "1440020197"

@@ -5,8 +5,8 @@ version = VERSION
 core = 7.x
 hidden = TRUE

-; Information added by Drupal.org packaging script on 2015-05-07
-version = "7.37"
+; Information added by Drupal.org packaging script on 2015-08-19
+version = "7.39"
 project = "drupal"
-datestamp = "1430973154"
+datestamp = "1440020197"

@@ -6,8 +6,8 @@ core = 7.x
 dependencies[] = entity_cache_test_dependency
 hidden = TRUE

-; Information added by Drupal.org packaging script on 2015-05-07
-version = "7.37"
+; Information added by Drupal.org packaging script on 2015-08-19
+version = "7.39"
 project = "drupal"
-datestamp = "1430973154"
+datestamp = "1440020197"

@@ -5,8 +5,8 @@ version = VERSION
 core = 7.x
 hidden = TRUE

-; Information added by Drupal.org packaging script on 2015-05-07
-version = "7.37"
+; Information added by Drupal.org packaging script on 2015-08-19
+version = "7.39"
 project = "drupal"
-datestamp = "1430973154"
+datestamp = "1440020197"

@@ -5,8 +5,8 @@ package = Testing
 version = VERSION
 hidden = TRUE

-; Information added by Drupal.org packaging script on 2015-05-07
-version = "7.37"
+; Information added by Drupal.org packaging script on 2015-08-19
+version = "7.39"
 project = "drupal"
-datestamp = "1430973154"
+datestamp = "1440020197"

@@ -5,8 +5,8 @@ version = VERSION
 core = 7.x
 hidden = TRUE

-; Information added by Drupal.org packaging script on 2015-05-07
-version = "7.37"
+; Information added by Drupal.org packaging script on 2015-08-19
+version = "7.39"
 project = "drupal"
-datestamp = "1430973154"
+datestamp = "1440020197"

@@ -5,8 +5,8 @@ version = VERSION
 core = 7.x
 hidden = TRUE

-; Information added by Drupal.org packaging script on 2015-05-07
-version = "7.37"
+; Information added by Drupal.org packaging script on 2015-08-19
+version = "7.39"
 project = "drupal"
-datestamp = "1430973154"
+datestamp = "1440020197"

@@ -6,8 +6,8 @@ core = 7.x
 files[] = file_test.module
 hidden = TRUE

-; Information added by Drupal.org packaging script on 2015-05-07
-version = "7.37"
+; Information added by Drupal.org packaging script on 2015-08-19
+version = "7.39"
 project = "drupal"
-datestamp = "1430973154"
+datestamp = "1440020197"

@@ -5,8 +5,8 @@ version = VERSION
 core = 7.x
 hidden = TRUE

-; Information added by Drupal.org packaging script on 2015-05-07
-version = "7.37"
+; Information added by Drupal.org packaging script on 2015-08-19
+version = "7.39"
 project = "drupal"
-datestamp = "1430973154"
+datestamp = "1440020197"

@@ -5,8 +5,8 @@ version = VERSION
 core = 7.x
 hidden = TRUE

-; Information added by Drupal.org packaging script on 2015-05-07
-version = "7.37"
+; Information added by Drupal.org packaging script on 2015-08-19
+version = "7.39"
 project = "drupal"
-datestamp = "1430973154"
+datestamp = "1440020197"

@@ -5,8 +5,8 @@ version = VERSION
 core = 7.x
 hidden = TRUE

-; Information added by Drupal.org packaging script on 2015-05-07
-version = "7.37"
+; Information added by Drupal.org packaging script on 2015-08-19
+version = "7.39"
 project = "drupal"
-datestamp = "1430973154"
+datestamp = "1440020197"

@@ -5,8 +5,8 @@ version = VERSION
 core = 7.x
 hidden = TRUE

-; Information added by Drupal.org packaging script on 2015-05-07
-version = "7.37"
+; Information added by Drupal.org packaging script on 2015-08-19
+version = "7.39"
 project = "drupal"
-datestamp = "1430973154"
+datestamp = "1440020197"

@@ -5,8 +5,8 @@ version = VERSION
 core = 7.x
 hidden = TRUE

-; Information added by Drupal.org packaging script on 2015-05-07
-version = "7.37"
+; Information added by Drupal.org packaging script on 2015-08-19
+version = "7.39"
 project = "drupal"
-datestamp = "1430973154"
+datestamp = "1440020197"

@@ -5,8 +5,8 @@ version = VERSION
 core = 7.x
 hidden = TRUE

-; Information added by Drupal.org packaging script on 2015-05-07
-version = "7.37"
+; Information added by Drupal.org packaging script on 2015-08-19
+version = "7.39"
 project = "drupal"
-datestamp = "1430973154"
+datestamp = "1440020197"

@@ -5,8 +5,8 @@ core = 7.x
 hidden = TRUE
 package = Testing

-; Information added by Drupal.org packaging script on 2015-05-07
-version = "7.37"
+; Information added by Drupal.org packaging script on 2015-08-19
+version = "7.39"
 project = "drupal"
-datestamp = "1430973154"
+datestamp = "1440020197"

@@ -5,8 +5,8 @@ core = 7.x
 hidden = TRUE
 package = Testing

-; Information added by Drupal.org packaging script on 2015-05-07
-version = "7.37"
+; Information added by Drupal.org packaging script on 2015-08-19
+version = "7.39"
 project = "drupal"
-datestamp = "1430973154"
+datestamp = "1440020197"

--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Bachir Soussi Chiadmi	e36279d8b1	changed materio_serach_api, query configuration by query	2016-03-16 12:35:55 +01:00
Bachir Soussi Chiadmi	0b6e0c10cb	updated search feature	2016-03-02 10:15:50 +01:00
Bachir Soussi Chiadmi	ba1ec7113e	updated search_api and search_api_solr	2016-03-01 16:23:45 +01:00
Bachir Soussi Chiadmi	deb2bff572	print fine tuning	2016-01-21 12:02:55 +01:00
Bachir Soussi Chiadmi	538c791bae	fine tunning print fiche	2016-01-20 18:15:38 +01:00
Bachir Soussi Chiadmi	df107a0443	fixed printed material WARNING : we are nox using gulp instead of grunt, watch for bugs	2016-01-19 19:23:16 +01:00
Bachir Soussi Chiadmi	c9b16289ef	added remove duplicates modules	2016-01-19 15:10:33 +01:00
Bachir Soussi Chiadmi	b4acd7d8bb	updated video filter module to handle https on embeded videos	2015-12-20 10:56:50 +01:00
Bachir Soussi Chiadmi	3af02617b4	added html5 boiler plate mime headers to htaccess	2015-12-19 21:36:40 +01:00
Bachir Soussi Chiadmi	0fdb4abd71	ajax autocomplete fixe	2015-12-03 12:23:53 +01:00
Bachir Soussi Chiadmi	90be34eef1	updated htaccess	2015-12-02 17:17:06 +01:00
Bachir Soussi Chiadmi	3e984dc6c5	updated htaccess	2015-12-02 17:13:13 +01:00
Bachir Soussi Chiadmi	a0cb0b2171	updated htaccess	2015-12-02 16:57:17 +01:00
Bachir Soussi Chiadmi	f6346b0195	updated htaccess	2015-12-02 16:52:56 +01:00
Bachir Soussi Chiadmi	300f698989	updated htaccess	2015-12-02 16:46:36 +01:00
Bachir Soussi Chiadmi	8cbb5f8c4c	updated htaccess	2015-12-02 16:45:51 +01:00
Bachir Soussi Chiadmi	a106b98209	updated htaccess	2015-12-02 16:30:59 +01:00
Bachir Soussi Chiadmi	8fe92dbcc7	updated htaccess	2015-12-02 16:29:02 +01:00
Bachir Soussi Chiadmi	60f2c5c7fa	updated htaccess	2015-12-02 15:20:02 +01:00
Bachir Soussi Chiadmi	d96c17454b	updated htaccess	2015-12-02 11:40:34 +01:00
Bachir Soussi Chiadmi	ed6ae84181	added ubercart ssl module	2015-12-02 11:36:55 +01:00
Bachir Soussi Chiadmi	35e914df58	created admon taxo view	2015-11-25 11:34:49 +01:00
Bachir Soussi Chiadmi	6b46869a16	htaccess : all redirects are handle by claranet	2015-11-25 09:47:27 +01:00
Bachir Soussi Chiadmi	892dba801f	added entity_translation_export_import module	2015-11-25 00:53:33 +01:00
Bachir Soussi Chiadmi	50dfd2d89b	removed i18n_taxonomy module from features dependencies fixed some bugs	2015-11-24 23:50:19 +01:00
Bachir Soussi Chiadmi	9a18821b7e	fixed search api materio settings	2015-11-24 18:17:34 +01:00
Bachir Soussi Chiadmi	82bf36a5eb	recreated features	2015-11-24 18:05:48 +01:00
Bachir Soussi Chiadmi	3eb20676ca	search api autocomplet t() for transmlate term name	2015-11-24 16:51:48 +01:00
Bachir Soussi Chiadmi	2155a66eb1	added special menu items module	2015-11-24 15:29:54 +01:00
Bachir Soussi Chiadmi	62fef652fc	removed redirects from htaccess, claranet will handle this on vhosts	2015-11-24 15:15:10 +01:00
Bachir Soussi Chiadmi	951c9114a2	added code for remove all http on file address	2015-11-24 13:42:37 +01:00
Bachir Soussi Chiadmi	edba04f103	htaccess fixe	2015-11-24 13:23:18 +01:00
Bachir Soussi Chiadmi	26ab9aa56b	htaccess fixe	2015-11-24 13:22:11 +01:00
Bachir Soussi Chiadmi	5716acf5bb	htaccess fixe	2015-11-24 13:20:51 +01:00
Bachir Soussi Chiadmi	12fe570fbd	htaccess fixe	2015-11-24 13:20:11 +01:00
Bachir Soussi Chiadmi	66ee9c6657	htaccess fixe	2015-11-24 13:19:01 +01:00
Bachir Soussi Chiadmi	ca5231f1fe	htaccess fixe	2015-11-24 13:09:04 +01:00
Bachir Soussi Chiadmi	b9a8db8140	htaccess fixe	2015-11-24 13:08:22 +01:00
Bachir Soussi Chiadmi	d25e7428bc	htaccess fixe	2015-11-24 12:55:37 +01:00
Bachir Soussi Chiadmi	3027b3985b	htaccess fixe	2015-11-24 12:55:09 +01:00
Bachir Soussi Chiadmi	d214a44291	htaccess fixe	2015-11-24 12:49:06 +01:00
Bachir Soussi Chiadmi	fc7753f7a0	htaccess fixe	2015-11-24 12:48:26 +01:00
Bachir Soussi Chiadmi	7c51b255fb	htaccess fixe	2015-11-24 12:47:26 +01:00
Bachir Soussi Chiadmi	5e099d48de	htaccess fixe	2015-11-24 12:35:16 +01:00
Bachir Soussi Chiadmi	bf84ac06cd	htaccess fixe	2015-11-24 12:34:56 +01:00
Bachir Soussi Chiadmi	87beabee92	htaccess fixe	2015-11-24 12:29:51 +01:00
Bachir Soussi Chiadmi	f6ee366a71	htaccess fixe	2015-11-24 12:29:32 +01:00
Bachir Soussi Chiadmi	b216e30f28	htaccess fixe	2015-11-24 12:28:04 +01:00
Bachir Soussi Chiadmi	0a863fc1bb	htaccess ssl	2015-11-24 12:26:56 +01:00
Bachir Soussi Chiadmi	a5edc41323	htaccess fixe	2015-11-24 12:12:57 +01:00
Bachir Soussi Chiadmi	1cc2c9af75	updated term csv files	2015-11-24 11:17:12 +01:00
Bachir Soussi Chiadmi	cc653b73be	bug fixe	2015-11-24 11:02:29 +01:00
Bachir Soussi Chiadmi	73993a539b	added fr2en batch function	2015-11-24 10:59:13 +01:00
Bachir Soussi Chiadmi	d7e7410950	added term_merge module	2015-11-24 10:56:30 +01:00
Bachir Soussi Chiadmi	7298235d4f	added taxonomy wrangler module	2015-11-23 14:47:44 +01:00
Bachir Soussi Chiadmi	fc0a779214	fixed bookmarks for students	2015-10-21 20:22:58 +02:00
Bachir Soussi Chiadmi	248c5ed3e1	added search form back bouton	2015-10-21 19:43:37 +02:00
Bachir Soussi Chiadmi	ace9de07e2	started base home back btn	2015-10-21 17:44:29 +02:00
Bachir Soussi Chiadmi	7ad1f5dc67	patched i18n modules for node don't record chosen language on create see https://www.drupal.org/node/1852102#comment-9612303	2015-10-14 17:15:19 +02:00
Bachir Soussi Chiadmi	d5628cc78e	updated entity_translation to last dev version	2015-10-14 17:09:13 +02:00
Bachir Soussi Chiadmi	81371521c7	updated gitignore to ignore .directory files	2015-10-14 17:03:08 +02:00
Bachir Soussi Chiadmi	eb699f528d	updated date pathauto addressfield honeypot features modules	2015-10-12 12:03:12 +02:00
Bachir Soussi Chiadmi	0ba0c21bb9	upadated colorbox andd prod_check	2015-10-12 11:52:36 +02:00
Bachir Soussi Chiadmi	50c3e1c7d7	added list of deleted entities from flag list content	2015-09-27 19:50:44 +02:00
Bachir Soussi Chiadmi	f0cb6175c1	patched flag list to trigger remove entity from lists when this entity is deleted	2015-09-27 18:55:26 +02:00
Bachir Soussi Chiadmi	e004b7a238	patched node-export module https://www.drupal.org/node/1869918 https://www.drupal.org/node/1911638	2015-09-18 14:54:38 +02:00
Bachir Soussi Chiadmi	f7cd9c0858	ran security updates on contrib modules ctools, video_embed_field, migrate, views_bulk_operations	2015-09-17 14:44:25 +02:00
Bachir Soussi Chiadmi	5d30d9bcee	repatched user module Implement language aware tokens for one time login link and cancel link https://www.drupal.org/node/1754162	2015-09-17 13:59:26 +02:00
Bachir Soussi Chiadmi	c4f2e62697	core update from 7.37 to 7.38	2015-09-17 13:08:35 +02:00
Bachir Soussi Chiadmi	a99f2d7aa6	fixed rss media notification https://www.drupal.org/node/2472409	2015-09-16 16:34:31 +02:00
Bachir Soussi Chiadmi	4e8346e5e3	fixed weight field rights for admin	2015-07-21 18:04:54 +02:00
Bachir Soussi Chiadmi	5b281024a5	added database link on home for members	2015-07-21 15:58:56 +02:00
Bachir Soussi Chiadmi	96903cab02	fixed some header display	2015-07-17 18:18:01 +02:00
Bachir Soussi Chiadmi	ce20bb3f0f	fixed some header display	2015-07-17 18:05:02 +02:00
Bachir Soussi Chiadmi	19d3d90743	fixed publication node display	2015-07-17 17:56:35 +02:00
Bachir Soussi Chiadmi	62fec82217	fixed printed cards	2015-07-16 17:08:15 +02:00
Bachir Soussi Chiadmi	f0295847f9	fixed icon alignement on header's blocks	2015-07-16 16:21:27 +02:00
Bachir Soussi Chiadmi	cc657eaec4	added publications links and display of pubications pages	2015-07-16 15:46:48 +02:00
Bachir Soussi Chiadmi	54f496acad	added contact footer on home V2	2015-07-16 15:02:15 +02:00
Bachir Soussi Chiadmi	feef7951cd	removed img max width on simplenews nodes	2015-07-07 22:32:49 +02:00
Bachir Soussi Chiadmi	8def2961ac	updated user export materio module	2015-07-07 22:11:34 +02:00
Bachir Soussi Chiadmi	1c38e1b72a	added fixed width for simplenews node type	2015-07-07 18:49:42 +02:00
Bachir Soussi Chiadmi	0446c17ad1	added home visibility field to simplenews content type and one more filtre on homeV2 view for news letter	2015-07-03 10:56:26 +02:00
Bachir Soussi Chiadmi	459335fee1	removed front-page module	2015-07-03 10:31:06 +02:00
Bachir Soussi Chiadmi	408251fd28	admin features remoced front-page dependencie	2015-07-03 10:28:35 +02:00
Bachir Soussi Chiadmi	98d1b5cb03	fixed front for member display	2015-07-02 20:14:15 +02:00
Bachir Soussi Chiadmi	141d1f4b5c	added front by role	2015-07-02 20:08:33 +02:00
Bachir Soussi Chiadmi	100dce022a	some display	2015-07-02 19:38:33 +02:00
Bachir Soussi Chiadmi	3220ed8e4b	fixed login redirection from login block and improved design of this block	2015-07-02 19:24:43 +02:00
Bachir Soussi Chiadmi	22146c2778	fixed viewmode change bug	2015-07-02 18:34:27 +02:00
Bachir Soussi Chiadmi	f4b8bfa249	removed newsletters which user doesn't have access to	2015-06-26 19:24:47 +02:00
Bachir Soussi Chiadmi	4c32c73321	added user export page for simplenews unsubscription	2015-06-26 18:42:45 +02:00
Bachir Soussi Chiadmi	09d1f06552	fixed some display bug	2015-06-24 17:20:14 +02:00
Bachir Soussi Chiadmi	ade4a41f76	fixed user profile form display	2015-06-24 16:29:54 +02:00
Bachir Soussi Chiadmi	19b1d49a22	applied fixe width to all page exept /actuality and /explore	2015-06-24 16:00:38 +02:00
Bachir Soussi Chiadmi	4264a271b4	added simple_pass_reset module	2015-06-24 15:48:23 +02:00
Bachir Soussi Chiadmi	de040b46ea	re-add linked materials on actuality page for visitors, in big card viewmode	2015-06-23 16:33:05 +02:00
Bachir Soussi Chiadmi	aa323869c3	display none links on home regarding logged-in or not	2015-06-18 18:34:20 +02:00
Bachir Soussi Chiadmi	22e93d650e	added class field to page links field	2015-06-18 18:26:30 +02:00
Bachir Soussi Chiadmi	2664d2fcfd	fixed localisation link display	2015-06-18 18:01:03 +02:00
Bachir Soussi Chiadmi	feb93503b6	fixed hash encoding bug with chrome between tarifs page and register form	2015-06-18 17:43:16 +02:00
Bachir Soussi Chiadmi	2d5be00cf1	improved mobile display	2015-06-17 19:25:33 +02:00
Bachir Soussi Chiadmi	a84cd67456	improved mobile display	2015-06-17 19:23:41 +02:00
Bachir Soussi Chiadmi	8a1f5cd116	improved mobile display	2015-06-17 19:21:32 +02:00
Bachir Soussi Chiadmi	65c7ab92b6	fixed skrollr for mobile, added skrollrbody option in init	2015-06-17 18:49:11 +02:00