changed materio_serach_api, query configuration by query

updated search feature
updated search_api and search_api_solr
2016-03-16 12:35:55 +01:00 · 2016-03-02 10:15:50 +01:00 · 2016-03-01 16:23:45 +01:00 · 2016-01-21 12:02:55 +01:00 · 2016-01-20 18:15:38 +01:00 · 2016-01-19 19:23:16 +01:00
844 changed files with 59871 additions and 32685 deletions
@@ -1,4 +0,0 @@
-[Dolphin]
-Timestamp=2015,4,27,11,15,6
-Version=3
-ViewMode=2
@@ -6,6 +6,7 @@ sites/*/drushrc*
 #sites/*
 sites/*/files
 sites/*/private
+sites/all/translations/*

 _base_d7.tmproj
 /_materio.sublime-project
@@ -17,3 +18,7 @@ _base_d7.tmproj
 *.sublime-project*

 node_modules
+
+.sass-cache
+typescript
+.directory
@@ -3,7 +3,7 @@
 #

 # Protect files and directories from prying eyes.
-<FilesMatch "\.(engine|inc|info|install|make|module|profile|test|po|sh|.*sql|theme|tpl(\.php)?|xtmpl)$|^(\..*|Entries.*|Repository|Root|Tag|Template)$">
+<FilesMatch "\.(engine|inc|info|install|make|module|profile|test|po|sh|.*sql|theme|tpl(\.php)?|xtmpl)(~|\.sw[op]|\.bak|\.orig|\.save)?$|^(\..*|Entries.*|Repository|Root|Tag|Template)$|^#.*#$|\.php(~|\.sw[op]|\.bak|\.orig\.save)$">
  Order allow,deny
 </FilesMatch>

@@ -20,7 +20,7 @@ ErrorDocument 404 /index.php
 DirectoryIndex index.php index.html index.htm

 # Override PHP settings that cannot be changed at runtime. See
-# sites/default/default.settings.php and drupal_initialize_variables() in
+# sites/default/default.settings.php and drupal_environment_initialize() in
 # includes/bootstrap.inc for settings that can be changed at runtime.

 # PHP 5, Apache 1 and 2.
@@ -56,6 +56,17 @@ DirectoryIndex index.php index.html index.htm
 <IfModule mod_rewrite.c>
  RewriteEngine on

+  # Set "protossl" to "s" if we were accessed via https://.  This is used later
+  # if you enable "www." stripping or enforcement, in order to ensure that
+  # you don't bounce between http and https.
+  RewriteRule ^ - [E=protossl]
+  RewriteCond %{HTTPS} on
+  RewriteRule ^ - [E=protossl:s]
+
+  # Make sure Authorization HTTP header is available to PHP
+  # even when running as CGI or FastCGI.
+  RewriteRule ^ - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]
+
  # Block access to "hidden" directories whose names begin with a period. This
  # includes directories used by version control systems such as Subversion or
  # Git to store control files. Files whose names begin with a period, as well
@@ -71,18 +82,6 @@ DirectoryIndex index.php index.html index.htm
  # downloaded.
  RewriteRule "(^|/)\." - [F]

-# custom
-  RewriteCond %{HTTP_HOST} ^basebeta\.materio\.com [OR]
-  RewriteCond %{HTTP_HOST} ^materio\.com [OR]
-  RewriteCond %{HTTP_HOST} ^www\.materio\.fr [OR]
-  RewriteCond %{HTTP_HOST} ^materio\.fr [OR]
-  RewriteCond %{HTTP_HOST} ^www\.materio\.net [OR]
-  RewriteCond %{HTTP_HOST} ^materio\.net [OR]
-  RewriteCond %{HTTP_HOST} ^www\.materio\.eu [OR]
-  RewriteCond %{HTTP_HOST} ^materio\.eu [NC]
-  RewriteRule ^ http://www.materio.com%{REQUEST_URI} [L,R=301]
-
-
  # If your site can be accessed both with and without the 'www.' prefix, you
  # can use one of the following settings to redirect users to your preferred
  # URL, either WITH or WITHOUT the 'www.' prefix. Choose ONLY one option:
@@ -90,14 +89,32 @@ DirectoryIndex index.php index.html index.htm
  # To redirect all users to access the site WITH the 'www.' prefix,
  # (http://example.com/... will be redirected to http://www.example.com/...)
  # uncomment the following:
+  # RewriteCond %{HTTP_HOST} .
  # RewriteCond %{HTTP_HOST} !^www\. [NC]
-  # RewriteRule ^ http://www.%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
-  #
+  # RewriteRule ^ http%{ENV:protossl}://www.%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
+
  # To redirect all users to access the site WITHOUT the 'www.' prefix,
  # (http://www.example.com/... will be redirected to http://example.com/...)
  # uncomment the following:
  # RewriteCond %{HTTP_HOST} ^www\.(.+)$ [NC]
-  # RewriteRule ^ http://%1%{REQUEST_URI} [L,R=301]
+  # RewriteRule ^ http%{ENV:protossl}://%1%{REQUEST_URI} [L,R=301]
+
+  # redirect all materiau domains to materio.com
+  RewriteCond %{HTTP_HOST} ^basebeta\.materio\.com [OR]
+  RewriteCond %{HTTP_HOST} ^www\.materio\.fr [OR]
+  RewriteCond %{HTTP_HOST} ^materio\.fr [OR]
+  RewriteCond %{HTTP_HOST} ^www\.materio\.net [OR]
+  RewriteCond %{HTTP_HOST} ^materio\.net [OR]
+  RewriteCond %{HTTP_HOST} ^www\.materio\.eu [OR]
+  RewriteCond %{HTTP_HOST} ^materio\.eu [OR]
+  RewriteCond %{HTTP_HOST} ^www\.materio\.com
+  # RewriteRule ^ http%{ENV:protossl}://materio.com%{REQUEST_URI} [L,R=301]
+  RewriteRule ^ https://materio.com%{REQUEST_URI} [L,R=301]
+
+  # Redirect to HTTPS
+  # RewriteCond %{HTTPS} off
+  # RewriteCond %{HTTP:X-Forwarded-Proto} !https
+  # RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

  # Modify the RewriteBase if you are using Drupal in a subdirectory or in a
  # VirtualDocumentRoot and the rewrite rules are not working properly.
@@ -116,24 +133,6 @@ DirectoryIndex index.php index.html index.htm
  RewriteCond %{REQUEST_URI} !=/favicon.ico
  RewriteRule ^ index.php [L]

-  ## local
-  # RewriteCond %{REMOTE_ADDR} !^127\.0\.0\.1
-  ## maison quentin
-  # RewriteCond %{REMOTE_ADDR} !^86\.68\.188\.175
-  ## materio
-  # RewriteCond %{REMOTE_ADDR} !^212\.198\.136\.215
-  ## maison bach
-  # RewriteCond %{REMOTE_ADDR} !^82\.230\.62\.145
-  # RewriteRule !maintenance http://www.materio.com/maintenance [L,R=302,E=nocache:1]
-
-  ## http://mark.koli.ch/2010/12/set-cache-control-and-expires-headers-on-a-redirect-with-mod-rewrite.html
-  ## Set the response header if the "nocache" environment variable is set
-  ## in the RewriteRule above.
-  # Header always set Cache-Control "no-store, no-cache, must-revalidate" env=nocache
-  ## Set Expires too ...
-  # Header always set Expires "Thu, 01 Jan 1970 00:00:00 GMT" env=nocache
-
-
  # Rules to correctly serve gzip compressed CSS and JS files.
  # Requires both mod_rewrite and mod_headers to be enabled.
  <IfModule mod_headers.c>
@@ -160,94 +159,138 @@ DirectoryIndex index.php index.html index.htm
  </IfModule>
 </IfModule>

+# Add headers to all responses.
+<IfModule mod_headers.c>
+  # Disable content sniffing, since it's an attack vector.
+  Header always set X-Content-Type-Options nosniff
+</IfModule>

+# from boiler plate V5.02

-# FROM Html5 BoilerPlate 4.0
+# ######################################################################
+# # MEDIA TYPES AND CHARACTER ENCODINGS                                #
+# ######################################################################

 # ----------------------------------------------------------------------
-# Proper MIME type for all files
+# | Media types                                                        |
 # ----------------------------------------------------------------------

-# JavaScript
-#   Normalize to standard type (it's sniffed in IE anyways)
-#   tools.ietf.org/html/rfc4329#section-7.2
-AddType application/javascript         js jsonp
-AddType application/json               json
+# Serve resources with the proper media types (f.k.a. MIME types).
+#
+# https://www.iana.org/assignments/media-types/media-types.xhtml
+# https://httpd.apache.org/docs/current/mod/mod_mime.html#addtype

-# Audio
-AddType audio/ogg                      oga ogg
-AddType audio/mp4                      m4a f4a f4b
+<IfModule mod_mime.c>

-# Video
-AddType video/ogg                      ogv
-AddType video/mp4                      mp4 m4v f4v f4p
-AddType video/webm                     webm
-AddType video/x-flv                    flv
+  # Data interchange

-# SVG
-#   Required for svg webfonts on iPad
-#   twitter.com/FontSquirrel/status/14855840545
-AddType     image/svg+xml              svg svgz
-AddEncoding gzip                       svgz
-
-# Webfonts
-AddType application/vnd.ms-fontobject  eot
-AddType application/x-font-ttf         ttf ttc
-AddType font/opentype                  otf
-AddType application/x-font-woff        woff
-
-# Assorted types
-AddType image/x-icon                        ico
-AddType image/webp                          webp
-AddType text/cache-manifest                 appcache manifest
-AddType text/x-component                    htc
-AddType application/xml                     rss atom xml rdf
-AddType application/x-chrome-extension      crx
-AddType application/x-opera-extension       oex
-AddType application/x-xpinstall             xpi
-AddType application/octet-stream            safariextz
-AddType application/x-web-app-manifest+json webapp
-AddType text/x-vcard                        vcf
-AddType application/x-shockwave-flash       swf
-AddType text/vtt                            vtt
+  AddType application/atom+xml                        atom
+  AddType application/json                            json map topojson
+  AddType application/ld+json                         jsonld
+  AddType application/rss+xml                         rss
+  AddType application/vnd.geo+json                    geojson
+  AddType application/xml                             rdf xml


+  # JavaScript
+
+  # Normalize to standard type.
+  # https://tools.ietf.org/html/rfc4329#section-7.2
+
+  AddType application/javascript                      js
+
+
+  # Manifest files
+
+  AddType application/manifest+json                   webmanifest
+  AddType application/x-web-app-manifest+json         webapp
+  AddType text/cache-manifest                         appcache
+
+
+  # Media files
+
+  AddType audio/mp4                                   f4a f4b m4a
+  AddType audio/ogg                                   oga ogg opus
+  AddType image/bmp                                   bmp
+  AddType image/svg+xml                               svg svgz
+  AddType image/webp                                  webp
+  AddType video/mp4                                   f4v f4p m4v mp4
+  AddType video/ogg                                   ogv
+  AddType video/webm                                  webm
+  AddType video/x-flv                                 flv
+
+  # Serving `.ico` image files with a different media type
+  # prevents Internet Explorer from displaying then as images:
+  # https://github.com/h5bp/html5-boilerplate/commit/37b5fec090d00f38de64b591bcddcb205aadf8ee
+
+  AddType image/x-icon                                cur ico
+
+
+  # Web fonts
+
+  AddType application/font-woff                       woff
+  AddType application/font-woff2                      woff2
+  AddType application/vnd.ms-fontobject               eot
+
+  # Browsers usually ignore the font media types and simply sniff
+  # the bytes to figure out the font type.
+  # https://mimesniff.spec.whatwg.org/#matching-a-font-type-pattern
+  #
+  # However, Blink and WebKit based browsers will show a warning
+  # in the console if the following font types are served with any
+  # other media types.
+
+  AddType application/x-font-ttf                      ttc ttf
+  AddType font/opentype                               otf
+
+
+  # Other
+
+  AddType application/octet-stream                    safariextz
+  AddType application/x-bb-appworld                   bbaw
+  AddType application/x-chrome-extension              crx
+  AddType application/x-opera-extension               oex
+  AddType application/x-xpinstall                     xpi
+  AddType text/vcard                                  vcard vcf
+  AddType text/vnd.rim.location.xloc                  xloc
+  AddType text/vtt                                    vtt
+  AddType text/x-component                            htc
+
+</IfModule>

 # ----------------------------------------------------------------------
-# UTF-8 encoding
+# | Character encodings                                                |
 # ----------------------------------------------------------------------

-# Use UTF-8 encoding for anything served text/plain or text/html
+# Serve all resources labeled as `text/html` or `text/plain`
+# with the media type `charset` parameter set to `UTF-8`.
+#
+# https://httpd.apache.org/docs/current/mod/core.html#adddefaultcharset
+
 AddDefaultCharset utf-8

-# Force UTF-8 for a number of file formats
-AddCharset utf-8 .atom .css .js .json .rss .vtt .xml
+# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

+# Serve the following file types with the media type `charset`
+# parameter set to `UTF-8`.
+#
+# https://httpd.apache.org/docs/current/mod/mod_mime.html#addcharset

-# ----------------------------------------------------------------------
-# A little more security
-# ----------------------------------------------------------------------
-
-
-# Block access to "hidden" directories or files whose names begin with a
-# period. This includes directories used by version control systems such as
-# Subversion or Git.
-<IfModule mod_rewrite.c>
-  RewriteCond %{SCRIPT_FILENAME} -d [OR]
-  RewriteCond %{SCRIPT_FILENAME} -f
-  RewriteRule "(^|/)\." - [F]
-</IfModule>
-
-# Block access to backup and source files. These files may be left by some
-# text/html editors and pose a great security danger, when anyone can access
-# them.
-<FilesMatch "(\.(bak|config|sql|fla|psd|ini|log|sh|inc|swp|dist)|~)$">
-  Order allow,deny
-  Deny from all
-  Satisfy All
-</FilesMatch>
-
-# Increase cookie security
-<IfModule php5_module>
-  php_value session.cookie_httponly true
+<IfModule mod_mime.c>
+    AddCharset utf-8 .atom \
+                     .bbaw \
+                     .css \
+                     .geojson \
+                     .js \
+                     .json \
+                     .jsonld \
+                     .manifest \
+                     .rdf \
+                     .rss \
+                     .topojson \
+                     .vtt \
+                     .webapp \
+                     .webmanifest \
+                     .xloc \
+                     .xml
 </IfModule>
@@ -1,4 +1,32 @@

+Drupal 7.39, 2015-08-19
+-----------------------
+- Fixed security issues (multiple vulnerabilities). See SA-CORE-2015-003.
+
+Drupal 7.38, 2015-06-17
+-----------------------
+- Fixed security issues (multiple vulnerabilities). See SA-CORE-2015-002.
+
+Drupal 7.37, 2015-05-07
+-----------------------
+- Fixed a regression in Drupal 7.36 which caused certain kinds of content types
+  to become disabled if they were defined by a no-longer-enabled module.
+- Removed a confusing description regarding automatic time zone detection from
+  the user account form (minor UI and data structure change).
+- Allowed custom HTML tags with a dash in the name to pass through filter_xss()
+  when specified in the list of allowed tags.
+- Allowed hook_field_schema() implementations to specify indexes for fields
+  based on a fixed-length column prefix (rather than the entire column), as was
+  already allowed in hook_schema() implementations.
+- Fixed PDO exceptions on PostgreSQL when accessing invalid entity URLs.
+- Added a sites/all/libraries folder to the codebase, with instructions for
+  using it.
+- Added a description to the "Administer text formats and filters" permission
+  on the Permissions page (string change).
+- Numerous small bug fixes.
+- Numerous API documentation improvements.
+- Additional automated test coverage.
+
 Drupal 7.36, 2015-04-01
 -----------------------
 - Added a 'file_public_schema' variable which allows modules that define
@@ -1,16 +0,0 @@
-cer
-contentadminrelink
-entity_translation_search_api
-entityreference
-feedback
-//field_group
-filter_path_alias
-flag_lists
-//nodeformcols
-search_api
-search_api_page
-search_api_solr
-termreferencetree
-views
-wysiwyg
-
@@ -0,0 +1,29 @@
+# Core Patches :
+- Implement language aware tokens for one time login link and cancel link
+https://www.drupal.org/node/1754162
+
+- est-ce que je dois faire ce patch ???
+includes/entity.inc
+see https://www.drupal.org/node/1003788
+
+# Modules :
+
+cer
+contentadminrelink
+entity_translation_search_api
+entityreference
+feedback
+//field_group
+filter_path_alias
+flag_lists
+//nodeformcols
+//search_api
+search_api_page
+//search_api_solr
+termreferencetree
+views
+wysiwyg
+views_rss_media
+node_export :
+  - https://www.drupal.org/node/1869918
+  - https://www.drupal.org/node/1911638
@@ -230,6 +230,10 @@
 *   functions.
 */
 function ajax_render($commands = array()) {
+  // Although ajax_deliver() does this, some contributed and custom modules
+  // render Ajax responses without using that delivery callback.
+  ajax_set_verification_header();
+
  // Ajax responses aren't rendered with html.tpl.php, so we have to call
  // drupal_get_css() and drupal_get_js() here, in order to have new files added
  // during this request to be loaded by the page. We only want to send back
@@ -487,6 +491,9 @@ function ajax_deliver($page_callback_result) {
    }
  }

+  // Let ajax.js know that this response is safe to process.
+  ajax_set_verification_header();
+
  // Print the response.
  $commands = ajax_prepare_response($page_callback_result);
  $json = ajax_render($commands);
@@ -576,6 +583,29 @@ function ajax_prepare_response($page_callback_result) {
  return $commands;
 }

+/**
+ * Sets a response header for ajax.js to trust the response body.
+ *
+ * It is not safe to invoke Ajax commands within user-uploaded files, so this
+ * header protects against those being invoked.
+ *
+ * @see Drupal.ajax.options.success()
+ */
+function ajax_set_verification_header() {
+  $added = &drupal_static(__FUNCTION__);
+
+  // User-uploaded files cannot set any response headers, so a custom header is
+  // used to indicate to ajax.js that this response is safe. Note that most
+  // Ajax requests bound using the Form API will be protected by having the URL
+  // flagged as trusted in Drupal.settings, so this header is used only for
+  // things like custom markup that gets Ajax behaviors attached.
+  if (empty($added)) {
+    drupal_add_http_header('X-Drupal-Ajax-Token', '1');
+    // Avoid sending the header twice.
+    $added = TRUE;
+  }
+}
+
 /**
 * Performs end-of-Ajax-request tasks.
 *
@@ -764,7 +794,12 @@ function ajax_pre_render_element($element) {

    $element['#attached']['js'][] = array(
      'type' => 'setting',
-      'data' => array('ajax' => array($element['#id'] => $settings)),
+      'data' => array(
+        'ajax' => array($element['#id'] => $settings),
+        'urlIsAjaxTrusted' => array(
+          $settings['url'] => TRUE,
+        ),
+      ),
    );

    // Indicate that Ajax processing was successful.
@@ -8,7 +8,7 @@
 /**
 * The current system version.
 */
-define('VERSION', '7.36');
+define('VERSION', '7.39');

 /**
 * Core API compatibility.
@@ -1522,7 +1522,7 @@ function _filter_xss_split($m, $store = FALSE) {
    return '&lt;';
  }

-  if (!preg_match('%^<\s*(/\s*)?([a-zA-Z0-9]+)([^>]*)>?|(<!--.*?-->)$%', $string, $matches)) {
+  if (!preg_match('%^<\s*(/\s*)?([a-zA-Z0-9\-]+)([^>]*)>?|(<!--.*?-->)$%', $string, $matches)) {
    // Seriously malformed.
    return '';
  }
@@ -3802,7 +3802,7 @@ function drupal_load_stylesheet_content($contents, $optimize = FALSE) {

  // Replaces @import commands with the actual stylesheet content.
  // This happens recursively but omits external files.
-  $contents = preg_replace_callback('/@import\s*(?:url\(\s*)?[\'"]?(?![a-z]+:)([^\'"\()]+)[\'"]?\s*\)?\s*;/', '_drupal_load_stylesheet', $contents);
+  $contents = preg_replace_callback('/@import\s*(?:url\(\s*)?[\'"]?(?![a-z]+:)(?!\/\/)([^\'"\()]+)[\'"]?\s*\)?\s*;/', '_drupal_load_stylesheet', $contents);
  return $contents;
 }

@@ -6329,13 +6329,21 @@ function drupal_render_cid_parts($granularity = NULL) {
  }

  if (!empty($granularity)) {
+    $cache_per_role = $granularity & DRUPAL_CACHE_PER_ROLE;
+    $cache_per_user = $granularity & DRUPAL_CACHE_PER_USER;
+    // User 1 has special permissions outside of the role system, so when
+    // caching per role is requested, it should cache per user instead.
+    if ($user->uid == 1 && $cache_per_role) {
+      $cache_per_user = TRUE;
+      $cache_per_role = FALSE;
+    }
    // 'PER_ROLE' and 'PER_USER' are mutually exclusive. 'PER_USER' can be a
    // resource drag for sites with many users, so when a module is being
    // equivocal, we favor the less expensive 'PER_ROLE' pattern.
-    if ($granularity & DRUPAL_CACHE_PER_ROLE) {
+    if ($cache_per_role) {
      $cid_parts[] = 'r.' . implode(',', array_keys($user->roles));
    }
-    elseif ($granularity & DRUPAL_CACHE_PER_USER) {
+    elseif ($cache_per_user) {
      $cid_parts[] = "u.$user->uid";
    }

@@ -7137,6 +7145,23 @@ function _drupal_schema_initialize(&$schema, $module, $remove_descriptions = TRU
  }
 }

+/**
+ * Retrieves the type for every field in a table schema.
+ *
+ * @param $table
+ *   The name of the table from which to retrieve type information.
+ *
+ * @return
+ *   An array of types, keyed by field name.
+ */
+function drupal_schema_field_types($table) {
+  $table_schema = drupal_get_schema($table);
+  foreach ($table_schema['fields'] as $field_name => $field_info) {
+    $field_types[$field_name] = isset($field_info['type']) ? $field_info['type'] : NULL;
+  }
+  return $field_types;
+}
+
 /**
 * Retrieves a list of fields from a table schema.
 *
@@ -7761,6 +7786,7 @@ function entity_get_info($entity_type = NULL) {
        // Prepare entity schema fields SQL info for
        // DrupalEntityControllerInterface::buildQuery().
        if (isset($entity_info[$name]['base table'])) {
+          $entity_info[$name]['base table field types'] = drupal_schema_field_types($entity_info[$name]['base table']);
          $entity_info[$name]['schema_fields_sql']['base table'] = drupal_schema_fields_sql($entity_info[$name]['base table']);
          if (isset($entity_info[$name]['revision table'])) {
            $entity_info[$name]['schema_fields_sql']['revision table'] = drupal_schema_fields_sql($entity_info[$name]['revision table']);
@@ -626,7 +626,7 @@ abstract class DatabaseConnection extends PDO {
   *   A sanitized version of the query comment string.
   */
  protected function filterComment($comment = '') {
-    return preg_replace('/(\/\*\s*)|(\s*\*\/)/', '', $comment);
+    return strtr($comment, array('*' => ' * '));
  }

  /**
@@ -157,18 +157,6 @@ class DrupalDefaultEntityController implements DrupalEntityControllerInterface {
  public function load($ids = array(), $conditions = array()) {
    $entities = array();

-    # PATCH http://drupal.org/node/1003788#comment-5195682
-    // Clean the $ids array to remove non-integer values that can be passed
-    // in from various sources, including menu callbacks.
-    if (is_array($ids)) {
-      foreach ($ids as $key => $id) {
-        if (empty($id) || ((string) $id !== (string) (int) $id)) {
-          unset($ids[$key]);
-        }
-      }
-    }
-    # endpatch
-
    // Revisions are not statically cached, and require a different query to
    // other conditions, so separate the revision id into its own variable.
    if ($this->revisionKey && isset($conditions[$this->revisionKey])) {
@@ -195,6 +183,11 @@ class DrupalDefaultEntityController implements DrupalEntityControllerInterface {
      }
    }

+    // Ensure integer entity IDs are valid.
+    if (!empty($ids)) {
+      $this->cleanIds($ids);
+    }
+
    // Load any remaining entities from the database. This is the case if $ids
    // is set to FALSE (so we load all entities), if there are any ids left to
    // load, if loading a revision, or if $conditions was passed without $ids.
@@ -235,6 +228,35 @@ class DrupalDefaultEntityController implements DrupalEntityControllerInterface {
    return $entities;
  }

+  /**
+   * Ensures integer entity IDs are valid.
+   *
+   * The identifier sanitization provided by this method has been introduced
+   * as Drupal used to rely on the database to facilitate this, which worked
+   * correctly with MySQL but led to errors with other DBMS such as PostgreSQL.
+   *
+   * @param array $ids
+   *   The entity IDs to verify. Non-integer IDs are removed from this array if
+   *   the entity type requires IDs to be integers.
+   */
+  protected function cleanIds(&$ids) {
+    $entity_info = entity_get_info($this->entityType);
+    if (isset($entity_info['base table field types'])) {
+      $id_type = $entity_info['base table field types'][$this->idKey];
+      if ($id_type == 'serial' || $id_type == 'int') {
+        $ids = array_filter($ids, array($this, 'filterId'));
+        $ids = array_map('intval', $ids);
+      }
+    }
+  }
+
+  /**
+   * Callback for array_filter that removes non-integer IDs.
+   */
+  protected function filterId($id) {
+    return is_numeric($id) && $id == (int) $id;
+  }
+
  /**
   * Builds the query to load the entity.
   *
@@ -1128,6 +1128,17 @@ function drupal_prepare_form($form_id, &$form, &$form_state) {
  drupal_alter($hooks, $form, $form_state, $form_id);
 }

+/**
+ * Helper function to call form_set_error() if there is a token error.
+ */
+function _drupal_invalid_token_set_form_error() {
+  $path = current_path();
+  $query = drupal_get_query_parameters();
+  $url = url($path, array('query' => $query));
+
+  // Setting this error will cause the form to fail validation.
+  form_set_error('form_token', t('The form has become outdated. Copy any unsaved work in the form below and then <a href="@link">reload this page</a>.', array('@link' => $url)));
+}

 /**
 * Validates user-submitted form data in the $form_state array.
@@ -1162,16 +1173,11 @@ function drupal_validate_form($form_id, &$form, &$form_state) {
  }

  // If the session token was set by drupal_prepare_form(), ensure that it
-  // matches the current user's session.
+  // matches the current user's session. This is duplicate to code in
+  // form_builder() but left to protect any custom form handling code.
  if (isset($form['#token'])) {
-    if (!drupal_valid_token($form_state['values']['form_token'], $form['#token'])) {
-      $path = current_path();
-      $query = drupal_get_query_parameters();
-      $url = url($path, array('query' => $query));
-
-      // Setting this error will cause the form to fail validation.
-      form_set_error('form_token', t('The form has become outdated. Copy any unsaved work in the form below and then <a href="@link">reload this page</a>.', array('@link' => $url)));
-
+    if (!drupal_valid_token($form_state['values']['form_token'], $form['#token']) || !empty($form_state['invalid_token'])) {
+      _drupal_invalid_token_set_form_error();
      // Stop here and don't run any further validation handlers, because they
      // could invoke non-safe operations which opens the door for CSRF
      // vulnerabilities.
@@ -1827,6 +1833,20 @@ function form_builder($form_id, &$element, &$form_state) {
    // from the POST data is set and matches the current form_id.
    if ($form_state['programmed'] || (!empty($form_state['input']) && (isset($form_state['input']['form_id']) && ($form_state['input']['form_id'] == $form_id)))) {
      $form_state['process_input'] = TRUE;
+      // If the session token was set by drupal_prepare_form(), ensure that it
+      // matches the current user's session.
+      $form_state['invalid_token'] = FALSE;
+      if (isset($element['#token'])) {
+        if (empty($form_state['input']['form_token']) || !drupal_valid_token($form_state['input']['form_token'], $element['#token'])) {
+          // Set an early form error to block certain input processing since that
+          // opens the door for CSRF vulnerabilities.
+          _drupal_invalid_token_set_form_error();
+          // This value is checked in _form_builder_handle_input_element().
+          $form_state['invalid_token'] = TRUE;
+          // Make sure file uploads do not get processed.
+          $_FILES = array();
+        }
+      }
    }
    else {
      $form_state['process_input'] = FALSE;
@@ -1930,6 +1950,18 @@ function form_builder($form_id, &$element, &$form_state) {
      $element['#attributes']['enctype'] = 'multipart/form-data';
    }

+    // Allow Ajax submissions to the form action to bypass verification. This is
+    // especially useful for multipart forms, which cannot be verified via a
+    // response header.
+    $element['#attached']['js'][] = array(
+      'type' => 'setting',
+      'data' => array(
+        'urlIsAjaxTrusted' => array(
+          $element['#action'] => TRUE,
+        ),
+      ),
+    );
+
    // If a form contains a single textfield, and the ENTER key is pressed
    // within it, Internet Explorer submits the form with no POST data
    // identifying any submit button. Other browsers submit POST data as though
@@ -1978,6 +2010,19 @@ function form_builder($form_id, &$element, &$form_state) {
 * Adds the #name and #value properties of an input element before rendering.
 */
 function _form_builder_handle_input_element($form_id, &$element, &$form_state) {
+  static $safe_core_value_callbacks = array(
+    'form_type_token_value',
+    'form_type_textarea_value',
+    'form_type_textfield_value',
+    'form_type_checkbox_value',
+    'form_type_checkboxes_value',
+    'form_type_radios_value',
+    'form_type_password_confirm_value',
+    'form_type_select_value',
+    'form_type_tableselect_value',
+    'list_boolean_allowed_values_callback',
+  );
+
  if (!isset($element['#name'])) {
    $name = array_shift($element['#parents']);
    $element['#name'] = $name;
@@ -2056,7 +2101,14 @@ function _form_builder_handle_input_element($form_id, &$element, &$form_state) {
      // property, optionally filtered through $value_callback.
      if ($input_exists) {
        if (function_exists($value_callback)) {
-          $element['#value'] = $value_callback($element, $input, $form_state);
+          // Skip all value callbacks except safe ones like text if the CSRF
+          // token was invalid.
+          if (empty($form_state['invalid_token']) || in_array($value_callback, $safe_core_value_callbacks)) {
+            $element['#value'] = $value_callback($element, $input, $form_state);
+          }
+          else {
+            $input = NULL;
+          }
        }
        if (!isset($element['#value']) && isset($input)) {
          $element['#value'] = $input;
@@ -2662,8 +2714,8 @@ function _form_options_flatten($array) {
 *   - #required: (optional) Whether the user needs to select an option (TRUE)
 *     or not (FALSE). Defaults to FALSE.
 *   - #empty_option: (optional) The label to show for the first default option.
- *     By default, the label is automatically set to "- Please select -" for a
- *     required field and "- None -" for an optional field.
+ *     By default, the label is automatically set to "- Select -" for a required
+ *     field and "- None -" for an optional field.
 *   - #empty_value: (optional) The value for the first default option, which is
 *     used to determine whether the user submitted a value or not.
 *     - If #required is TRUE, this defaults to '' (an empty string).
@@ -3910,6 +3962,29 @@ function theme_hidden($variables) {
  return '<input' . drupal_attributes($element['#attributes']) . " />\n";
 }

+/**
+ * Process function to prepare autocomplete data.
+ *
+ * @param $element
+ *   A textfield or other element with a #autocomplete_path.
+ *
+ * @return array
+ *   The processed form element.
+ */
+function form_process_autocomplete($element) {
+  $element['#autocomplete_input'] = array();
+  if ($element['#autocomplete_path'] && drupal_valid_path($element['#autocomplete_path'])) {
+    $element['#autocomplete_input']['#id'] = $element['#id'] .'-autocomplete';
+    // Force autocomplete to use non-clean URLs since this protects against the
+    // browser interpreting the path plus search string as an actual file.
+    $current_clean_url = isset($GLOBALS['conf']['clean_url']) ? $GLOBALS['conf']['clean_url'] : NULL;
+    $GLOBALS['conf']['clean_url'] = 0;
+    $element['#autocomplete_input']['#url_value'] = url($element['#autocomplete_path'], array('absolute' => TRUE));
+    $GLOBALS['conf']['clean_url'] = $current_clean_url;
+  }
+  return $element;
+}
+
 /**
 * Returns HTML for a textfield form element.
 *
@@ -3928,14 +4003,14 @@ function theme_textfield($variables) {
  _form_set_class($element, array('form-text'));

  $extra = '';
-  if ($element['#autocomplete_path'] && drupal_valid_path($element['#autocomplete_path'])) {
+  if ($element['#autocomplete_path'] && !empty($element['#autocomplete_input'])) {
    drupal_add_library('system', 'drupal.autocomplete');
    $element['#attributes']['class'][] = 'form-autocomplete';

    $attributes = array();
    $attributes['type'] = 'hidden';
-    $attributes['id'] = $element['#attributes']['id'] . '-autocomplete';
-    $attributes['value'] = url($element['#autocomplete_path'], array('absolute' => TRUE));
+    $attributes['id'] = $element['#autocomplete_input']['#id'];
+    $attributes['value'] = $element['#autocomplete_input']['#url_value'];
    $attributes['disabled'] = 'disabled';
    $attributes['class'][] = 'autocomplete';
    $extra = '<input' . drupal_attributes($attributes) . ' />';
@@ -362,7 +362,8 @@ function install_run_tasks(&$install_state) {
 * Runs an individual installation task.
 *
 * @param $task
- *   An array of information about the task to be run.
+ *   An array of information about the task to be run as returned by
+ *   hook_install_tasks().
 * @param $install_state
 *   An array of information about the current installation state. This is
 *   passed in by reference so that it can be modified by the task.
@@ -478,11 +479,15 @@ function install_run_task($task, &$install_state) {
 * the page request evolves (for example, if an installation profile hasn't
 * been selected yet, we don't yet know which profile tasks need to be run).
 *
+ * You can override this using hook_install_tasks() or
+ * hook_install_tasks_alter().
+ *
 * @param $install_state
 *   An array of information about the current installation state.
 *
 * @return
- *   A list of tasks to be performed, with associated metadata.
+ *   A list of tasks to be performed, with associated metadata as returned by
+ *   hook_install_tasks().
 */
 function install_tasks_to_perform($install_state) {
  // Start with a list of all currently available tasks.
@@ -1487,7 +1487,7 @@ function menu_tree_collect_node_links(&$tree, &$node_links) {
 *   menu_tree_collect_node_links().
 */
 function menu_tree_check_access(&$tree, $node_links = array()) {
-  if ($node_links) {
+  if ($node_links && (user_access('access content') || user_access('bypass node access'))) {
    $nids = array_keys($node_links);
    $select = db_select('node', 'n');
    $select->addField('n', 'nid');
@@ -14,6 +14,8 @@

 Drupal.ajax = Drupal.ajax || {};

+Drupal.settings.urlIsAjaxTrusted = Drupal.settings.urlIsAjaxTrusted || {};
+
 /**
 * Attaches the Ajax behavior to each Ajax form element.
 */
@@ -130,6 +132,11 @@ Drupal.ajax = function (base, element, element_settings) {
  // 5. /nojs# - Followed by a fragment.
  //      E.g.: path/nojs#myfragment
  this.url = element_settings.url.replace(/\/nojs(\/|$|\?|&|#)/g, '/ajax$1');
+  // If the 'nojs' version of the URL is trusted, also trust the 'ajax' version.
+  if (Drupal.settings.urlIsAjaxTrusted[element_settings.url]) {
+    Drupal.settings.urlIsAjaxTrusted[this.url] = true;
+  }
+
  this.wrapper = '#' + element_settings.wrapper;

  // If there isn't a form, jQuery.ajax() will be used instead, allowing us to
@@ -155,18 +162,36 @@ Drupal.ajax = function (base, element, element_settings) {
      ajax.ajaxing = true;
      return ajax.beforeSend(xmlhttprequest, options);
    },
-    success: function (response, status) {
+    success: function (response, status, xmlhttprequest) {
      // Sanity check for browser support (object expected).
      // When using iFrame uploads, responses must be returned as a string.
      if (typeof response == 'string') {
        response = $.parseJSON(response);
      }
+
+      // Prior to invoking the response's commands, verify that they can be
+      // trusted by checking for a response header. See
+      // ajax_set_verification_header() for details.
+      // - Empty responses are harmless so can bypass verification. This avoids
+      //   an alert message for server-generated no-op responses that skip Ajax
+      //   rendering.
+      // - Ajax objects with trusted URLs (e.g., ones defined server-side via
+      //   #ajax) can bypass header verification. This is especially useful for
+      //   Ajax with multipart forms. Because IFRAME transport is used, the
+      //   response headers cannot be accessed for verification.
+      if (response !== null && !Drupal.settings.urlIsAjaxTrusted[ajax.url]) {
+        if (xmlhttprequest.getResponseHeader('X-Drupal-Ajax-Token') !== '1') {
+          var customMessage = Drupal.t("The response failed verification so will not be processed.");
+          return ajax.error(xmlhttprequest, ajax.url, customMessage);
+        }
+      }
+
      return ajax.success(response, status);
    },
-    complete: function (response, status) {
+    complete: function (xmlhttprequest, status) {
      ajax.ajaxing = false;
      if (status == 'error' || status == 'parsererror') {
-        return ajax.error(response, ajax.url);
+        return ajax.error(xmlhttprequest, ajax.url);
      }
    },
    dataType: 'json',
@@ -175,6 +200,9 @@ Drupal.ajax = function (base, element, element_settings) {

  // Bind the ajaxSubmit function to the element event.
  $(ajax.element).bind(element_settings.event, function (event) {
+    if (!Drupal.settings.urlIsAjaxTrusted[ajax.url] && !Drupal.urlIsLocal(ajax.url)) {
+      throw new Error(Drupal.t('The callback URL is not local and not trusted: !url', {'!url': ajax.url}));
+    }
    return ajax.eventResponse(this, event);
  });

@@ -447,8 +475,8 @@ Drupal.ajax.prototype.getEffect = function (response) {
 /**
 * Handler for the form redirection error.
 */
-Drupal.ajax.prototype.error = function (response, uri) {
-  alert(Drupal.ajaxError(response, uri));
+Drupal.ajax.prototype.error = function (xmlhttprequest, uri, customMessage) {
+  alert(Drupal.ajaxError(xmlhttprequest, uri, customMessage));
  // Remove the progress element.
  if (this.progress.element) {
    $(this.progress.element).remove();
@@ -462,7 +490,7 @@ Drupal.ajax.prototype.error = function (response, uri) {
  $(this.element).removeClass('progress-disabled').removeAttr('disabled');
  // Reattach behaviors, if they were detached in beforeSerialize().
  if (this.form) {
-    var settings = response.settings || this.settings || Drupal.settings;
+    var settings = this.settings || Drupal.settings;
    Drupal.attachBehaviors(this.form, settings);
  }
 };
@@ -271,8 +271,11 @@ Drupal.ACDB.prototype.search = function (searchString) {
  var db = this;
  this.searchString = searchString;

-  // See if this string needs to be searched for anyway.
-  searchString = searchString.replace(/^\s+|\s+$/, '');
+  // See if this string needs to be searched for anyway. The pattern ../ is
+  // stripped since it may be misinterpreted by the browser.
+  searchString = searchString.replace(/^\s+|\.{2,}\/|\s+$/g, '');
+  // Skip empty search strings, or search strings ending with a comma, since
+  // that is the separator between search terms.
  if (searchString.length <= 0 ||
    searchString.charAt(searchString.length - 1) == ',') {
    return;
@@ -269,6 +269,72 @@ Drupal.formatPlural = function (count, singular, plural, args, options) {
  }
 };

+/**
+ * Returns the passed in URL as an absolute URL.
+ *
+ * @param url
+ *   The URL string to be normalized to an absolute URL.
+ *
+ * @return
+ *   The normalized, absolute URL.
+ *
+ * @see https://github.com/angular/angular.js/blob/v1.4.4/src/ng/urlUtils.js
+ * @see https://grack.com/blog/2009/11/17/absolutizing-url-in-javascript
+ * @see https://github.com/jquery/jquery-ui/blob/1.11.4/ui/tabs.js#L53
+ */
+Drupal.absoluteUrl = function (url) {
+  var urlParsingNode = document.createElement('a');
+
+  // Decode the URL first; this is required by IE <= 6. Decoding non-UTF-8
+  // strings may throw an exception.
+  try {
+    url = decodeURIComponent(url);
+  } catch (e) {}
+
+  urlParsingNode.setAttribute('href', url);
+
+  // IE <= 7 normalizes the URL when assigned to the anchor node similar to
+  // the other browsers.
+  return urlParsingNode.cloneNode(false).href;
+};
+
+/**
+ * Returns true if the URL is within Drupal's base path.
+ *
+ * @param url
+ *   The URL string to be tested.
+ *
+ * @return
+ *   Boolean true if local.
+ *
+ * @see https://github.com/jquery/jquery-ui/blob/1.11.4/ui/tabs.js#L58
+ */
+Drupal.urlIsLocal = function (url) {
+  // Always use browser-derived absolute URLs in the comparison, to avoid
+  // attempts to break out of the base path using directory traversal.
+  var absoluteUrl = Drupal.absoluteUrl(url);
+  var protocol = location.protocol;
+
+  // Consider URLs that match this site's base URL but use HTTPS instead of HTTP
+  // as local as well.
+  if (protocol === 'http:' && absoluteUrl.indexOf('https:') === 0) {
+    protocol = 'https:';
+  }
+  var baseUrl = protocol + '//' + location.host + Drupal.settings.basePath.slice(0, -1);
+
+  // Decoding non-UTF-8 strings may throw an exception.
+  try {
+    absoluteUrl = decodeURIComponent(absoluteUrl);
+  } catch (e) {}
+  try {
+    baseUrl = decodeURIComponent(baseUrl);
+  } catch (e) {}
+
+  // The given URL matches the site's base URL, or has a path under the site's
+  // base URL.
+  return absoluteUrl === baseUrl || absoluteUrl.indexOf(baseUrl + '/') === 0;
+};
+
 /**
 * Generate the themed representation of a Drupal object.
 *
@@ -350,7 +416,7 @@ Drupal.getSelection = function (element) {
 /**
 * Build an error message from an Ajax response.
 */
-Drupal.ajaxError = function (xmlhttp, uri) {
+Drupal.ajaxError = function (xmlhttp, uri, customMessage) {
  var statusCode, statusText, pathText, responseText, readyStateText, message;
  if (xmlhttp.status) {
    statusCode = "\n" + Drupal.t("An AJAX HTTP error occurred.") +  "\n" + Drupal.t("HTTP Result Code: !status", {'!status': xmlhttp.status});
@@ -383,7 +449,10 @@ Drupal.ajaxError = function (xmlhttp, uri) {
  // We don't need readyState except for status == 0.
  readyStateText = xmlhttp.status == 0 ? ("\n" + Drupal.t("ReadyState: !readyState", {'!readyState': xmlhttp.readyState})) : "";

-  message = statusCode + pathText + statusText + responseText + readyStateText;
+  // Additional message beyond what the xmlhttp object provides.
+  customMessage = customMessage ? ("\n" + Drupal.t("CustomMessage: !customMessage", {'!customMessage': customMessage})) : "";
+
+  message = statusCode + pathText + statusText + customMessage + responseText + readyStateText;
  return message;
 };

@@ -7,8 +7,8 @@ files[] = aggregator.test
 configure = admin/config/services/aggregator/settings
 stylesheets[all][] = aggregator.css

-; Information added by Drupal.org packaging script on 2015-04-02
-version = "7.36"
+; Information added by Drupal.org packaging script on 2015-08-19
+version = "7.39"
 project = "drupal"
-datestamp = "1427943826"
+datestamp = "1440020197"

@@ -5,8 +5,8 @@ version = VERSION
 core = 7.x
 hidden = TRUE

-; Information added by Drupal.org packaging script on 2015-04-02
-version = "7.36"
+; Information added by Drupal.org packaging script on 2015-08-19
+version = "7.39"
 project = "drupal"
-datestamp = "1427943826"
+datestamp = "1440020197"

@@ -6,8 +6,8 @@ core = 7.x
 files[] = block.test
 configure = admin/structure/block

-; Information added by Drupal.org packaging script on 2015-04-02
-version = "7.36"
+; Information added by Drupal.org packaging script on 2015-08-19
+version = "7.39"
 project = "drupal"
-datestamp = "1427943826"
+datestamp = "1440020197"

@@ -5,8 +5,8 @@ version = VERSION
 core = 7.x
 hidden = TRUE

-; Information added by Drupal.org packaging script on 2015-04-02
-version = "7.36"
+; Information added by Drupal.org packaging script on 2015-08-19
+version = "7.39"
 project = "drupal"
-datestamp = "1427943826"
+datestamp = "1440020197"

@@ -13,8 +13,8 @@ regions[footer] = Footer
 regions[highlighted] = Highlighted
 regions[help] = Help

-; Information added by Drupal.org packaging script on 2015-04-02
-version = "7.36"
+; Information added by Drupal.org packaging script on 2015-08-19
+version = "7.39"
 project = "drupal"
-datestamp = "1427943826"
+datestamp = "1440020197"

@@ -5,8 +5,8 @@ version = VERSION
 core = 7.x
 files[] = blog.test

-; Information added by Drupal.org packaging script on 2015-04-02
-version = "7.36"
+; Information added by Drupal.org packaging script on 2015-08-19
+version = "7.39"
 project = "drupal"
-datestamp = "1427943826"
+datestamp = "1440020197"

@@ -7,8 +7,8 @@ files[] = book.test
 configure = admin/content/book/settings
 stylesheets[all][] = book.css

-; Information added by Drupal.org packaging script on 2015-04-02
-version = "7.36"
+; Information added by Drupal.org packaging script on 2015-08-19
+version = "7.39"
 project = "drupal"
-datestamp = "1427943826"
+datestamp = "1440020197"

@@ -5,8 +5,8 @@ version = VERSION
 core = 7.x
 files[] = color.test

-; Information added by Drupal.org packaging script on 2015-04-02
-version = "7.36"
+; Information added by Drupal.org packaging script on 2015-08-19
+version = "7.39"
 project = "drupal"
-datestamp = "1427943826"
+datestamp = "1440020197"

@@ -9,8 +9,8 @@ files[] = comment.test
 configure = admin/content/comment
 stylesheets[all][] = comment.css

-; Information added by Drupal.org packaging script on 2015-04-02
-version = "7.36"
+; Information added by Drupal.org packaging script on 2015-08-19
+version = "7.39"
 project = "drupal"
-datestamp = "1427943826"
+datestamp = "1440020197"

@@ -6,8 +6,8 @@ core = 7.x
 files[] = contact.test
 configure = admin/structure/contact

-; Information added by Drupal.org packaging script on 2015-04-02
-version = "7.36"
+; Information added by Drupal.org packaging script on 2015-08-19
+version = "7.39"
 project = "drupal"
-datestamp = "1427943826"
+datestamp = "1440020197"

@@ -5,8 +5,8 @@ version = VERSION
 core = 7.x
 files[] = contextual.test

-; Information added by Drupal.org packaging script on 2015-04-02
-version = "7.36"
+; Information added by Drupal.org packaging script on 2015-08-19
+version = "7.39"
 project = "drupal"
-datestamp = "1427943826"
+datestamp = "1440020197"

@@ -7,8 +7,8 @@ files[] = dashboard.test
 dependencies[] = block
 configure = admin/dashboard/customize

-; Information added by Drupal.org packaging script on 2015-04-02
-version = "7.36"
+; Information added by Drupal.org packaging script on 2015-08-19
+version = "7.39"
 project = "drupal"
-datestamp = "1427943826"
+datestamp = "1440020197"

@@ -5,8 +5,8 @@ version = VERSION
 core = 7.x
 files[] = dblog.test

-; Information added by Drupal.org packaging script on 2015-04-02
-version = "7.36"
+; Information added by Drupal.org packaging script on 2015-08-19
+version = "7.39"
 project = "drupal"
-datestamp = "1427943826"
+datestamp = "1440020197"

@@ -11,8 +11,8 @@ dependencies[] = field_sql_storage
 required = TRUE
 stylesheets[all][] = theme/field.css

-; Information added by Drupal.org packaging script on 2015-04-02
-version = "7.36"
+; Information added by Drupal.org packaging script on 2015-08-19
+version = "7.39"
 project = "drupal"
-datestamp = "1427943826"
+datestamp = "1440020197"

@@ -7,8 +7,8 @@ dependencies[] = field
 files[] = field_sql_storage.test
 required = TRUE

-; Information added by Drupal.org packaging script on 2015-04-02
-version = "7.36"
+; Information added by Drupal.org packaging script on 2015-08-19
+version = "7.39"
 project = "drupal"
-datestamp = "1427943826"
+datestamp = "1440020197"

@@ -223,7 +223,17 @@ function _field_sql_storage_schema($field) {
  foreach ($field['indexes'] as $index_name => $columns) {
    $real_name = _field_sql_storage_indexname($field['field_name'], $index_name);
    foreach ($columns as $column_name) {
-      $current['indexes'][$real_name][] = _field_sql_storage_columnname($field['field_name'], $column_name);
+      // Indexes can be specified as either a column name or an array with
+      // column name and length. Allow for either case.
+      if (is_array($column_name)) {
+        $current['indexes'][$real_name][] = array(
+          _field_sql_storage_columnname($field['field_name'], $column_name[0]),
+          $column_name[1],
+        );
+      }
+      else {
+        $current['indexes'][$real_name][] = _field_sql_storage_columnname($field['field_name'], $column_name);
+      }
    }
  }

@@ -332,7 +342,17 @@ function field_sql_storage_field_storage_update_field($field, $prior_field, $has
        $real_name = _field_sql_storage_indexname($field['field_name'], $name);
        $real_columns = array();
        foreach ($columns as $column_name) {
-          $real_columns[] = _field_sql_storage_columnname($field['field_name'], $column_name);
+          // Indexes can be specified as either a column name or an array with
+          // column name and length. Allow for either case.
+          if (is_array($column_name)) {
+            $real_columns[] = array(
+              _field_sql_storage_columnname($field['field_name'], $column_name[0]),
+              $column_name[1],
+            );
+          }
+          else {
+            $real_columns[] = _field_sql_storage_columnname($field['field_name'], $column_name);
+          }
        }
        db_add_index($table, $real_name, $real_columns);
        db_add_index($revision_table, $real_name, $real_columns);
@@ -355,14 +355,14 @@ class FieldSqlStorageTestCase extends DrupalWebTestCase {
    field_attach_insert('test_entity', $entity);

    // Add an index
-    $field = array('field_name' => $field_name, 'indexes' => array('value' => array('value')));
+    $field = array('field_name' => $field_name, 'indexes' => array('value' => array(array('value', 255))));
    field_update_field($field);
    foreach ($tables as $table) {
      $this->assertTrue(Database::getConnection()->schema()->indexExists($table, "{$field_name}_value"), format_string("Index on value created in %table", array('%table' => $table)));
    }

    // Add a different index, removing the existing custom one.
-    $field = array('field_name' => $field_name, 'indexes' => array('value_format' => array('value', 'format')));
+    $field = array('field_name' => $field_name, 'indexes' => array('value_format' => array(array('value', 127), array('format', 127))));
    field_update_field($field);
    foreach ($tables as $table) {
      $this->assertTrue(Database::getConnection()->schema()->indexExists($table, "{$field_name}_value_format"), format_string("Index on value_format created in %table", array('%table' => $table)));
@@ -7,8 +7,8 @@ dependencies[] = field
 dependencies[] = options
 files[] = tests/list.test

-; Information added by Drupal.org packaging script on 2015-04-02
-version = "7.36"
+; Information added by Drupal.org packaging script on 2015-08-19
+version = "7.39"
 project = "drupal"
-datestamp = "1427943826"
+datestamp = "1440020197"

@@ -5,8 +5,8 @@ package = Testing
 version = VERSION
 hidden = TRUE

-; Information added by Drupal.org packaging script on 2015-04-02
-version = "7.36"
+; Information added by Drupal.org packaging script on 2015-08-19
+version = "7.39"
 project = "drupal"
-datestamp = "1427943826"
+datestamp = "1440020197"

@@ -6,8 +6,8 @@ core = 7.x
 dependencies[] = field
 files[] = number.test

-; Information added by Drupal.org packaging script on 2015-04-02
-version = "7.36"
+; Information added by Drupal.org packaging script on 2015-08-19
+version = "7.39"
 project = "drupal"
-datestamp = "1427943826"
+datestamp = "1440020197"

@@ -6,8 +6,8 @@ core = 7.x
 dependencies[] = field
 files[] = options.test

-; Information added by Drupal.org packaging script on 2015-04-02
-version = "7.36"
+; Information added by Drupal.org packaging script on 2015-08-19
+version = "7.39"
 project = "drupal"
-datestamp = "1427943826"
+datestamp = "1440020197"

@@ -7,8 +7,8 @@ dependencies[] = field
 files[] = text.test
 required = TRUE

-; Information added by Drupal.org packaging script on 2015-04-02
-version = "7.36"
+; Information added by Drupal.org packaging script on 2015-08-19
+version = "7.39"
 project = "drupal"
-datestamp = "1427943826"
+datestamp = "1440020197"

@@ -6,8 +6,8 @@ files[] = field_test.entity.inc
 version = VERSION
 hidden = TRUE

-; Information added by Drupal.org packaging script on 2015-04-02
-version = "7.36"
+; Information added by Drupal.org packaging script on 2015-08-19
+version = "7.39"
 project = "drupal"
-datestamp = "1427943826"
+datestamp = "1440020197"

@@ -2105,6 +2105,10 @@ function field_ui_next_destination($entity_type, $bundle) {
  $destinations = !empty($_REQUEST['destinations']) ? $_REQUEST['destinations'] : array();
  if (!empty($destinations)) {
    unset($_REQUEST['destinations']);
+  }
+  // Remove any external URLs.
+  $destinations = array_diff($destinations, array_filter($destinations, 'url_is_external'));
+  if ($destinations) {
    return field_ui_get_destinations($destinations);
  }
  $admin_path = _field_ui_bundle_admin_path($entity_type, $bundle);
@@ -6,8 +6,8 @@ core = 7.x
 dependencies[] = field
 files[] = field_ui.test

-; Information added by Drupal.org packaging script on 2015-04-02
-version = "7.36"
+; Information added by Drupal.org packaging script on 2015-08-19
+version = "7.39"
 project = "drupal"
-datestamp = "1427943826"
+datestamp = "1440020197"

@@ -445,6 +445,19 @@ class FieldUIManageFieldsTestCase extends FieldUITestCase {
    $this->assertText(t('The machine-readable name is already in use. It must be unique.'));
    $this->assertUrl($url, array(), 'Stayed on the same page.');
  }
+
+  /**
+   * Tests that external URLs in the 'destinations' query parameter are blocked.
+   */
+  function testExternalDestinations() {
+    $path = 'admin/structure/types/manage/article/fields/field_tags/field-settings';
+    $options = array(
+      'query' => array('destinations' => array('http://example.com')),
+    );
+    $this->drupalPost($path, NULL, t('Save field settings'), $options);
+
+    $this->assertUrl('admin/structure/types/manage/article/fields', array(), 'Stayed on the same site.');
+  }
 }

 /**
@@ -6,8 +6,8 @@ core = 7.x
 dependencies[] = field
 files[] = tests/file.test

-; Information added by Drupal.org packaging script on 2015-04-02
-version = "7.36"
+; Information added by Drupal.org packaging script on 2015-08-19
+version = "7.39"
 project = "drupal"
-datestamp = "1427943826"
+datestamp = "1440020197"

@@ -377,6 +377,18 @@ class FileManagedFileElementTestCase extends FileFieldTestCase {
        $this->drupalPost($path, array(), t('Save'));
        $this->assertRaw(t('The file id is %fid.', array('%fid' => 0)), 'Submitted without a file.');

+        // Submit with a file, but with an invalid form token. Ensure the file
+        // was not saved.
+        $last_fid_prior = $this->getLastFileId();
+        $edit = array(
+          'files[' . $input_base_name . ']' => drupal_realpath($test_file->uri),
+          'form_token' => 'invalid token',
+        );
+        $this->drupalPost($path, $edit, t('Save'));
+        $this->assertText('The form has become outdated. Copy any unsaved work in the form below');
+        $last_fid = $this->getLastFileId();
+        $this->assertEqual($last_fid_prior, $last_fid, 'File was not saved when uploaded with an invalid form token.');
+
        // Submit a new file, without using the Upload button.
        $last_fid_prior = $this->getLastFileId();
        $edit = array('files[' . $input_base_name . ']' => drupal_realpath($test_file->uri));
@@ -5,8 +5,8 @@ version = VERSION
 core = 7.x
 hidden = TRUE

-; Information added by Drupal.org packaging script on 2015-04-02
-version = "7.36"
+; Information added by Drupal.org packaging script on 2015-08-19
+version = "7.39"
 project = "drupal"
-datestamp = "1427943826"
+datestamp = "1440020197"

@@ -7,8 +7,8 @@ files[] = filter.test
 required = TRUE
 configure = admin/config/content/formats

-; Information added by Drupal.org packaging script on 2015-04-02
-version = "7.36"
+; Information added by Drupal.org packaging script on 2015-08-19
+version = "7.39"
 project = "drupal"
-datestamp = "1427943826"
+datestamp = "1440020197"

@@ -340,6 +340,7 @@ function filter_admin_format_title($format) {
 function filter_permission() {
  $perms['administer filters'] = array(
    'title' => t('Administer text formats and filters'),
+    'description' => t('Define how text is handled by combining filters into <a href="@url">text formats</a>.', array('@url' => url('admin/config/content/formats'))),
    'restrict access' => TRUE,
  );

@@ -1148,7 +1148,7 @@ class FilterUnitTestCase extends DrupalUnitTestCase {
    // Setup dummy filter object.
    $filter = new stdClass();
    $filter->settings = array(
-      'allowed_html' => '<a> <em> <strong> <cite> <blockquote> <code> <ul> <ol> <li> <dl> <dt> <dd>',
+      'allowed_html' => '<a> <em> <strong> <cite> <blockquote> <code> <ul> <ol> <li> <dl> <dt> <dd> <test-element>',
      'filter_html_help' => 1,
      'filter_html_nofollow' => 0,
    );
@@ -1184,6 +1184,10 @@ class FilterUnitTestCase extends DrupalUnitTestCase {

    $f = _filter_html('<code onerror>&nbsp;</code>', $filter);
    $this->assertNoNormalized($f, 'onerror', 'HTML filter should remove empty on* attributes on default.');
+
+    // Custom tags are supported and should be allowed through.
+    $f = _filter_html('<test-element></test-element>', $filter);
+    $this->assertNormalized($f, 'test-element', 'HTML filter should allow custom elements.');
  }

  /**
@@ -9,8 +9,8 @@ files[] = forum.test
 configure = admin/structure/forum
 stylesheets[all][] = forum.css

-; Information added by Drupal.org packaging script on 2015-04-02
-version = "7.36"
+; Information added by Drupal.org packaging script on 2015-08-19
+version = "7.39"
 project = "drupal"
-datestamp = "1427943826"
+datestamp = "1440020197"

@@ -5,8 +5,8 @@ version = VERSION
 core = 7.x
 files[] = help.test

-; Information added by Drupal.org packaging script on 2015-04-02
-version = "7.36"
+; Information added by Drupal.org packaging script on 2015-08-19
+version = "7.39"
 project = "drupal"
-datestamp = "1427943826"
+datestamp = "1440020197"

@@ -7,8 +7,8 @@ dependencies[] = file
 files[] = image.test
 configure = admin/config/media/image-styles

-; Information added by Drupal.org packaging script on 2015-04-02
-version = "7.36"
+; Information added by Drupal.org packaging script on 2015-08-19
+version = "7.39"
 project = "drupal"
-datestamp = "1427943826"
+datestamp = "1440020197"

@@ -6,8 +6,8 @@ core = 7.x
 files[] = image_module_test.module
 hidden = TRUE

-; Information added by Drupal.org packaging script on 2015-04-02
-version = "7.36"
+; Information added by Drupal.org packaging script on 2015-08-19
+version = "7.39"
 project = "drupal"
-datestamp = "1427943826"
+datestamp = "1440020197"

@@ -6,8 +6,8 @@ core = 7.x
 files[] = locale.test
 configure = admin/config/regional/language

-; Information added by Drupal.org packaging script on 2015-04-02
-version = "7.36"
+; Information added by Drupal.org packaging script on 2015-08-19
+version = "7.39"
 project = "drupal"
-datestamp = "1427943826"
+datestamp = "1440020197"

@@ -5,8 +5,8 @@ package = Testing
 version = VERSION
 hidden = TRUE

-; Information added by Drupal.org packaging script on 2015-04-02
-version = "7.36"
+; Information added by Drupal.org packaging script on 2015-08-19
+version = "7.39"
 project = "drupal"
-datestamp = "1427943826"
+datestamp = "1440020197"

@@ -6,8 +6,8 @@ core = 7.x
 files[] = menu.test
 configure = admin/structure/menu

-; Information added by Drupal.org packaging script on 2015-04-02
-version = "7.36"
+; Information added by Drupal.org packaging script on 2015-08-19
+version = "7.39"
 project = "drupal"
-datestamp = "1427943826"
+datestamp = "1440020197"

@@ -9,8 +9,8 @@ required = TRUE
 configure = admin/structure/types
 stylesheets[all][] = node.css

-; Information added by Drupal.org packaging script on 2015-04-02
-version = "7.36"
+; Information added by Drupal.org packaging script on 2015-08-19
+version = "7.39"
 project = "drupal"
-datestamp = "1427943826"
+datestamp = "1440020197"

@@ -933,6 +933,16 @@ function node_update_7014() {
  db_add_index('node', 'language', array('language'));
 }

+/**
+ * Enable node types that may have been erroneously disabled in Drupal 7.36.
+ */
+function node_update_7015() {
+  db_update('node_type')
+    ->fields(array('disabled' => 0))
+    ->condition('base', 'node_content')
+    ->execute();
+}
+
 /**
 * @} End of "addtogroup updates-7.x-extra".
 */
@@ -740,9 +740,11 @@ function _node_types_build($rebuild = FALSE) {
    $type_db = $type_object->type;
    // Original disabled value.
    $disabled = $type_object->disabled;
-    // Check for node types either from disabled modules or otherwise not defined
-    // and mark as disabled.
-    if (empty($type_object->custom) && empty($_node_types->types[$type_db])) {
+    // Check for node types from disabled modules and mark their types for removal.
+    // Types defined by the node module in the database (rather than by a separate
+    // module using hook_node_info) have a base value of 'node_content'. The isset()
+    // check prevents errors on old (pre-Drupal 7) databases.
+    if (isset($type_object->base) && $type_object->base != 'node_content' && empty($_node_types->types[$type_db])) {
      $type_object->disabled = TRUE;
    }
    if (isset($_node_types->types[$type_db])) {
@@ -5,8 +5,8 @@ version = VERSION
 core = 7.x
 hidden = TRUE

-; Information added by Drupal.org packaging script on 2015-04-02
-version = "7.36"
+; Information added by Drupal.org packaging script on 2015-08-19
+version = "7.39"
 project = "drupal"
-datestamp = "1427943826"
+datestamp = "1440020197"

@@ -5,8 +5,8 @@ version = VERSION
 core = 7.x
 hidden = TRUE

-; Information added by Drupal.org packaging script on 2015-04-02
-version = "7.36"
+; Information added by Drupal.org packaging script on 2015-08-19
+version = "7.39"
 project = "drupal"
-datestamp = "1427943826"
+datestamp = "1440020197"

@@ -5,8 +5,8 @@ version = VERSION
 core = 7.x
 hidden = TRUE

-; Information added by Drupal.org packaging script on 2015-04-02
-version = "7.36"
+; Information added by Drupal.org packaging script on 2015-08-19
+version = "7.39"
 project = "drupal"
-datestamp = "1427943826"
+datestamp = "1440020197"

@@ -5,8 +5,8 @@ package = Core
 core = 7.x
 files[] = openid.test

-; Information added by Drupal.org packaging script on 2015-04-02
-version = "7.36"
+; Information added by Drupal.org packaging script on 2015-08-19
+version = "7.39"
 project = "drupal"
-datestamp = "1427943826"
+datestamp = "1440020197"

@@ -365,14 +365,20 @@ function openid_complete($response = array()) {
            // to the OpenID Provider, we need to do discovery on the returned
            // identififer to make sure that the provider is authorized to
            // respond on behalf of this.
-            if ($response_claimed_id != $claimed_id) {
+            if ($response_claimed_id != $claimed_id || $response_claimed_id != $response['openid.identity']) {
              $discovery = openid_discovery($response['openid.claimed_id']);
+              $uris = array();
              if ($discovery && !empty($discovery['services'])) {
-                $uris = array();
                foreach ($discovery['services'] as $discovered_service) {
-                  if (in_array('http://specs.openid.net/auth/2.0/server', $discovered_service['types']) || in_array('http://specs.openid.net/auth/2.0/signon', $discovered_service['types'])) {
-                    $uris[] = $discovered_service['uri'];
+                  if (!in_array('http://specs.openid.net/auth/2.0/server', $discovered_service['types']) && !in_array('http://specs.openid.net/auth/2.0/signon', $discovered_service['types'])) {
+                    continue;
                  }
+                  // The OP-Local Identifier (if different than the Claimed
+                  // Identifier) must be present in the XRDS document.
+                  if ($response_claimed_id != $response['openid.identity'] && (!isset($discovered_service['identity']) || $discovered_service['identity'] != $response['openid.identity'])) {
+                    continue;
+                  }
+                  $uris[] = $discovered_service['uri'];
                }
              }
              if (!in_array($service['uri'], $uris)) {
@@ -94,7 +94,7 @@ class OpenIDFunctionalTestCase extends OpenIDWebTestCase {
    $identity = url('openid-test/yadis/xrds/dummy-user', array('absolute' => TRUE, 'fragment' => $this->randomName()));
    // Tell openid_test.module to respond with this identifier. If the fragment
    // part is present in the identifier, it should be retained.
-    variable_set('openid_test_response', array('openid.claimed_id' => $identity));
+    variable_set('openid_test_response', array('openid.claimed_id' => $identity, 'openid.identity' => openid_normalize($identity)));
    $this->addIdentity(url('openid-test/yadis/xrds/server', array('absolute' => TRUE)), 2, 'http://specs.openid.net/auth/2.0/identifier_select', $identity);
    variable_set('openid_test_response', array());

@@ -6,8 +6,8 @@ core = 7.x
 dependencies[] = openid
 hidden = TRUE

-; Information added by Drupal.org packaging script on 2015-04-02
-version = "7.36"
+; Information added by Drupal.org packaging script on 2015-08-19
+version = "7.39"
 project = "drupal"
-datestamp = "1427943826"
+datestamp = "1440020197"

@@ -150,6 +150,7 @@ function openid_test_yadis_xrds() {
          <Service priority="20">
            <Type>http://specs.openid.net/auth/2.0/server</Type>
            <URI>' . url('openid-test/endpoint', array('absolute' => TRUE)) . '</URI>
+            <LocalID>' . url('openid-test/yadis/xrds/server', array('absolute' => TRUE)) . '</LocalID>
          </Service>';
    }
    elseif (arg(3) == 'delegate') {
@@ -389,6 +389,27 @@ Drupal.overlay.isExternalLink = function (url) {
  return re.test(url);
 };

+/**
+ * Constructs an internal URL (relative to this site) from the provided path.
+ *
+ * For example, if the provided path is 'admin' and the site is installed at
+ * http://example.com/drupal, this function will return '/drupal/admin'.
+ *
+ * @param path
+ *   The internal path, without any leading slash.
+ *
+ * @return
+ *   The internal URL derived from the provided path, or null if a valid
+ *   internal path cannot be constructed (for example, if an attempt to create
+ *   an external link is detected).
+ */
+Drupal.overlay.getInternalUrl = function (path) {
+  var url = Drupal.settings.basePath + path;
+  if (!this.isExternalLink(url)) {
+    return url;
+  }
+};
+
 /**
 * Event handler: resizes overlay according to the size of the parent window.
 *
@@ -577,7 +598,7 @@ Drupal.overlay.eventhandlerOverrideLink = function (event) {
      // If the link contains the overlay-restore class and the overlay-context
      // state is set, also update the parent window's location.
      var parentLocation = ($target.hasClass('overlay-restore') && typeof $.bbq.getState('overlay-context') == 'string')
-        ? Drupal.settings.basePath + $.bbq.getState('overlay-context')
+        ? this.getInternalUrl($.bbq.getState('overlay-context'))
        : null;
      href = this.fragmentizeLink($target.get(0), parentLocation);
      // Only override default behavior when left-clicking and user is not
@@ -657,11 +678,15 @@ Drupal.overlay.eventhandlerOperateByURLFragment = function (event) {
  }

  // Get the overlay URL from the current URL fragment.
+  var internalUrl = null;
  var state = $.bbq.getState('overlay');
  if (state) {
+    internalUrl = this.getInternalUrl(state);
+  }
+  if (internalUrl) {
    // Append render variable, so the server side can choose the right
    // rendering and add child frame code to the page if needed.
-    var url = $.param.querystring(Drupal.settings.basePath + state, { render: 'overlay' });
+    var url = $.param.querystring(internalUrl, { render: 'overlay' });

    this.open(url);
    this.resetActiveClass(this.getPath(Drupal.settings.basePath + state));
@@ -4,8 +4,8 @@ package = Core
 version = VERSION
 core = 7.x

-; Information added by Drupal.org packaging script on 2015-04-02
-version = "7.36"
+; Information added by Drupal.org packaging script on 2015-08-19
+version = "7.39"
 project = "drupal"
-datestamp = "1427943826"
+datestamp = "1440020197"

@@ -6,8 +6,8 @@ core = 7.x
 files[] = path.test
 configure = admin/config/search/path

-; Information added by Drupal.org packaging script on 2015-04-02
-version = "7.36"
+; Information added by Drupal.org packaging script on 2015-08-19
+version = "7.39"
 project = "drupal"
-datestamp = "1427943826"
+datestamp = "1440020197"

@@ -5,8 +5,8 @@ version = VERSION
 core = 7.x
 files[] = php.test

-; Information added by Drupal.org packaging script on 2015-04-02
-version = "7.36"
+; Information added by Drupal.org packaging script on 2015-08-19
+version = "7.39"
 project = "drupal"
-datestamp = "1427943826"
+datestamp = "1440020197"

@@ -6,8 +6,8 @@ core = 7.x
 files[] = poll.test
 stylesheets[all][] = poll.css

-; Information added by Drupal.org packaging script on 2015-04-02
-version = "7.36"
+; Information added by Drupal.org packaging script on 2015-08-19
+version = "7.39"
 project = "drupal"
-datestamp = "1427943826"
+datestamp = "1440020197"

@@ -191,7 +191,6 @@ function poll_node_info() {
      'base' => 'poll',
      'description' => t('A <em>poll</em> is a question with a set of possible responses. A <em>poll</em>, once created, automatically provides a simple running count of the number of votes received for each response.'),
      'title_label' => t('Question'),
-      'has_body' => FALSE,
    )
  );
 }
@@ -11,8 +11,8 @@ configure = admin/config/people/profile
 ; See user_system_info_alter().
 hidden = TRUE

-; Information added by Drupal.org packaging script on 2015-04-02
-version = "7.36"
+; Information added by Drupal.org packaging script on 2015-08-19
+version = "7.39"
 project = "drupal"
-datestamp = "1427943826"
+datestamp = "1440020197"

@@ -339,12 +339,22 @@ class ProfileTestAutocomplete extends ProfileTestCase {
    $this->setProfileField($field, $field['value']);

    // Set some html for what we want to see in the page output later.
-    $autocomplete_html = '<input type="hidden" id="' . drupal_html_id('edit-' . $field['form_name'] . '-autocomplete') . '" value="' . url('profile/autocomplete/' . $field['fid'], array('absolute' => TRUE)) . '" disabled="disabled" class="autocomplete" />';
-    $field_html = '<input type="text" maxlength="255" name="' . $field['form_name'] . '" id="' . drupal_html_id('edit-' . $field['form_name']) . '" size="60" value="' . $field['value'] . '" class="form-text form-autocomplete required" />';
+    // Autocomplete always uses non-clean URLs.
+    $current_clean_url = isset($GLOBALS['conf']['clean_url']) ? $GLOBALS['conf']['clean_url'] : NULL;
+    $GLOBALS['conf']['clean_url'] = 0;
+    $autocomplete_url = url('profile/autocomplete/' . $field['fid'], array('absolute' => TRUE));
+    $GLOBALS['conf']['clean_url'] = $current_clean_url;
+    $autocomplete_id = drupal_html_id('edit-' . $field['form_name'] . '-autocomplete');
+    $autocomplete_html = '<input type="hidden" id="' . $autocomplete_id . '" value="' . $autocomplete_url . '" disabled="disabled" class="autocomplete" />';

    // Check that autocompletion html is found on the user's profile edit page.
    $this->drupalGet('user/' . $this->admin_user->uid . '/edit/' . $category);
    $this->assertRaw($autocomplete_html, 'Autocomplete found.');
+    $this->assertFieldByXPath(
+      '//input[@type="text" and @name="' . $field['form_name'] . '" and contains(@class, "form-autocomplete")]',
+      '',
+      'Text input field found'
+    );
    $this->assertRaw('misc/autocomplete.js', 'Autocomplete JavaScript found.');
    $this->assertRaw('class="form-text form-autocomplete"', 'Autocomplete form element class found.');

@@ -5,8 +5,8 @@ version = VERSION
 core = 7.x
 files[] = rdf.test

-; Information added by Drupal.org packaging script on 2015-04-02
-version = "7.36"
+; Information added by Drupal.org packaging script on 2015-08-19
+version = "7.39"
 project = "drupal"
-datestamp = "1427943826"
+datestamp = "1440020197"

@@ -5,8 +5,8 @@ version = VERSION
 core = 7.x
 hidden = TRUE

-; Information added by Drupal.org packaging script on 2015-04-02
-version = "7.36"
+; Information added by Drupal.org packaging script on 2015-08-19
+version = "7.39"
 project = "drupal"
-datestamp = "1427943826"
+datestamp = "1440020197"

@@ -8,8 +8,8 @@ files[] = search.test
 configure = admin/config/search/settings
 stylesheets[all][] = search.css

-; Information added by Drupal.org packaging script on 2015-04-02
-version = "7.36"
+; Information added by Drupal.org packaging script on 2015-08-19
+version = "7.39"
 project = "drupal"
-datestamp = "1427943826"
+datestamp = "1440020197"

@@ -5,8 +5,8 @@ version = VERSION
 core = 7.x
 hidden = TRUE

-; Information added by Drupal.org packaging script on 2015-04-02
-version = "7.36"
+; Information added by Drupal.org packaging script on 2015-08-19
+version = "7.39"
 project = "drupal"
-datestamp = "1427943826"
+datestamp = "1440020197"

@@ -5,8 +5,8 @@ version = VERSION
 core = 7.x
 hidden = TRUE

-; Information added by Drupal.org packaging script on 2015-04-02
-version = "7.36"
+; Information added by Drupal.org packaging script on 2015-08-19
+version = "7.39"
 project = "drupal"
-datestamp = "1427943826"
+datestamp = "1440020197"

@@ -5,8 +5,8 @@ version = VERSION
 core = 7.x
 hidden = TRUE

-; Information added by Drupal.org packaging script on 2015-04-02
-version = "7.36"
+; Information added by Drupal.org packaging script on 2015-08-19
+version = "7.39"
 project = "drupal"
-datestamp = "1427943826"
+datestamp = "1440020197"

@@ -6,8 +6,8 @@ core = 7.x
 files[] = shortcut.test
 configure = admin/config/user-interface/shortcut

-; Information added by Drupal.org packaging script on 2015-04-02
-version = "7.36"
+; Information added by Drupal.org packaging script on 2015-08-19
+version = "7.39"
 project = "drupal"
-datestamp = "1427943826"
+datestamp = "1440020197"

@@ -2221,6 +2221,7 @@ class DrupalWebTestCase extends DrupalTestCase {

    // Submit the POST request.
    $return = drupal_json_decode($this->drupalPost(NULL, $edit, array('path' => $ajax_path, 'triggering_element' => $triggering_element), $options, $headers, $form_html_id, $extra_post));
+    $this->assertIdentical($this->drupalGetHeader('X-Drupal-Ajax-Token'), '1', 'Ajax response header found.');

    // Change the page content by applying the returned commands.
    if (!empty($ajax_settings) && !empty($return)) {
@@ -2257,8 +2258,13 @@ class DrupalWebTestCase extends DrupalTestCase {
            if ($wrapperNode) {
              // ajax.js adds an enclosing DIV to work around a Safari bug.
              $newDom = new DOMDocument();
+              // DOM can load HTML soup. But, HTML soup can throw warnings,
+              // suppress them.
              $newDom->loadHTML('<div>' . $command['data'] . '</div>');
-              $newNode = $dom->importNode($newDom->documentElement->firstChild->firstChild, TRUE);
+              // Suppress warnings thrown when duplicate HTML IDs are
+              // encountered. This probably means we are replacing an element
+              // with the same ID.
+              $newNode = @$dom->importNode($newDom->documentElement->firstChild->firstChild, TRUE);
              $method = isset($command['method']) ? $command['method'] : $ajax_settings['method'];
              // The "method" is a jQuery DOM manipulation function. Emulate
              // each one using PHP's DOMNode API.
@@ -1,5 +1,7 @@


+@import url("http://example.com/style.css");
+@import url("//example.com/style.css");
@import "import1.css";
@import "import2.css";

@@ -1,4 +1,4 @@
-ul,select{font:1em/160% Verdana,sans-serif;color:#494949;}.ui-icon{background-image:url(images/icon.png);}.data .double-quote{background-image:url("data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7");}.data .single-quote{background-image:url('data:image/jpeg;base64,/9j/4AAQSkZJRgABAQAAAQABAAD/2wBDACAWGBwYFCAcGhwkIiAmMFA0MCwsMGJGSjpQdGZ6eHJmcG6AkLicgIiuim5woNqirr7EztDOfJri8uDI8LjKzsb/2wBDASIkJDAqMF40NF7GhHCExsbGxsbGxsbGxsbGxsbGxsbGxsbGxsbGxsbGxsbGxsbGxsbGxsbGxsbGxsbGxsbGxsb/wAARCAABAAEDASIAAhEBAxEB/8QAFQABAQAAAAAAAAAAAAAAAAAAAAb/xAAUEAEAAAAAAAAAAAAAAAAAAAAA/8QAFAEBAAAAAAAAAAAAAAAAAAAAAP/EABQRAQAAAAAAAAAAAAAAAAAAAAD/2gAMAwEAAhEDEQA/AKAAH//Z');}.data .no-quote{background-image:url(data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAACEAAAAEAQAAAAAo/mtHAAAAIElEQVQIHWMRnWHwcRNLN8NZ7QYWwT8PlBlYsgqVBRsAankIMw5MtnoAAAAASUVORK5CYII=);}
+@import url("http://example.com/style.css");@import url("//example.com/style.css");ul,select{font:1em/160% Verdana,sans-serif;color:#494949;}.ui-icon{background-image:url(images/icon.png);}.data .double-quote{background-image:url("data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7");}.data .single-quote{background-image:url('data:image/jpeg;base64,/9j/4AAQSkZJRgABAQAAAQABAAD/2wBDACAWGBwYFCAcGhwkIiAmMFA0MCwsMGJGSjpQdGZ6eHJmcG6AkLicgIiuim5woNqirr7EztDOfJri8uDI8LjKzsb/2wBDASIkJDAqMF40NF7GhHCExsbGxsbGxsbGxsbGxsbGxsbGxsbGxsbGxsbGxsbGxsbGxsbGxsbGxsbGxsbGxsbGxsb/wAARCAABAAEDASIAAhEBAxEB/8QAFQABAQAAAAAAAAAAAAAAAAAAAAb/xAAUEAEAAAAAAAAAAAAAAAAAAAAA/8QAFAEBAAAAAAAAAAAAAAAAAAAAAP/EABQRAQAAAAAAAAAAAAAAAAAAAAD/2gAMAwEAAhEDEQA/AKAAH//Z');}.data .no-quote{background-image:url(data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAACEAAAAEAQAAAAAo/mtHAAAAIElEQVQIHWMRnWHwcRNLN8NZ7QYWwT8PlBlYsgqVBRsAankIMw5MtnoAAAAASUVORK5CYII=);}
 p,select{font:1em/160% Verdana,sans-serif;color:#494949;}
 body{margin:0;padding:0;background:#edf5fa;font:76%/170% Verdana,sans-serif;color:#494949;}.this .is .a .test{font:1em/100% Verdana,sans-serif;color:#494949;}.this
 .is
@@ -1,5 +1,7 @@


+@import url("http://example.com/style.css");
+@import url("//example.com/style.css");

 ul, select {
  font: 1em/160% Verdana, sans-serif;
@@ -56,8 +56,8 @@ files[] = tests/upgrade/update.trigger.test
 files[] = tests/upgrade/update.field.test
 files[] = tests/upgrade/update.user.test

-; Information added by Drupal.org packaging script on 2015-04-02
-version = "7.36"
+; Information added by Drupal.org packaging script on 2015-08-19
+version = "7.39"
 project = "drupal"
-datestamp = "1427943826"
+datestamp = "1440020197"

@@ -5,8 +5,8 @@ version = VERSION
 core = 7.x
 hidden = TRUE

-; Information added by Drupal.org packaging script on 2015-04-02
-version = "7.36"
+; Information added by Drupal.org packaging script on 2015-08-19
+version = "7.39"
 project = "drupal"
-datestamp = "1427943826"
+datestamp = "1440020197"

@@ -5,8 +5,8 @@ package = Testing
 version = VERSION
 hidden = TRUE

-; Information added by Drupal.org packaging script on 2015-04-02
-version = "7.36"
+; Information added by Drupal.org packaging script on 2015-08-19
+version = "7.39"
 project = "drupal"
-datestamp = "1427943826"
+datestamp = "1440020197"

@@ -5,8 +5,8 @@ version = VERSION
 core = 7.x
 hidden = TRUE

-; Information added by Drupal.org packaging script on 2015-04-02
-version = "7.36"
+; Information added by Drupal.org packaging script on 2015-08-19
+version = "7.39"
 project = "drupal"
-datestamp = "1427943826"
+datestamp = "1440020197"

@@ -5,8 +5,8 @@ version = VERSION
 core = 7.x
 hidden = TRUE

-; Information added by Drupal.org packaging script on 2015-04-02
-version = "7.36"
+; Information added by Drupal.org packaging script on 2015-08-19
+version = "7.39"
 project = "drupal"
-datestamp = "1427943826"
+datestamp = "1440020197"

@@ -942,6 +942,7 @@ class CascadingStylesheetsUnitTest extends DrupalUnitTestCase {
   * - Proper URLs in imported files. (https://drupal.org/node/265719)
   * - Retain pseudo-selectors. (https://drupal.org/node/460448)
   * - Don't adjust data URIs. (https://drupal.org/node/2142441)
+   * - Files imported from external URLs. (https://drupal.org/node/2014851)
   */
  function testLoadCssBasic() {
    // Array of files to test living in 'simpletest/files/css_test_files/'.
@@ -2116,7 +2117,7 @@ class DrupalRenderTestCase extends DrupalWebTestCase {
  }

  /**
-   * Tests caching of an empty render item.
+   * Tests caching of render items.
   */
  function testDrupalRenderCache() {
    // Force a request via GET.
@@ -2142,6 +2143,59 @@ class DrupalRenderTestCase extends DrupalWebTestCase {
    drupal_render($element);
    $this->assertFalse(isset($element['#printed']), 'Cache hit');

+    // Test that user 1 does not share the cache with other users who have the
+    // same roles, even when DRUPAL_CACHE_PER_ROLE is used.
+    $user1 = user_load(1);
+    $first_authenticated_user = $this->drupalCreateUser();
+    $second_authenticated_user = $this->drupalCreateUser();
+    $user1->roles = array_intersect_key($user1->roles, array(DRUPAL_AUTHENTICATED_RID => TRUE));
+    user_save($user1);
+    // Load all the accounts again, to make sure we have complete account
+    // objects.
+    $user1 = user_load(1);
+    $first_authenticated_user = user_load($first_authenticated_user->uid);
+    $second_authenticated_user = user_load($second_authenticated_user->uid);
+    $this->assertEqual($user1->roles, $first_authenticated_user->roles, 'User 1 has the same roles as an authenticated user.');
+    // Impersonate user 1 and render content that only user 1 should have
+    // permission to see.
+    $original_user = $GLOBALS['user'];
+    $original_session_state = drupal_save_session();
+    drupal_save_session(FALSE);
+    $GLOBALS['user'] = $user1;
+    $test_element = array(
+      '#cache' => array(
+        'keys' => array('test'),
+        'granularity' => DRUPAL_CACHE_PER_ROLE,
+      ),
+    );
+    $element = $test_element;
+    $element['#markup'] = 'content for user 1';
+    $output = drupal_render($element);
+    $this->assertEqual($output, 'content for user 1');
+    // Verify the cache is working by rendering the same element but with
+    // different markup passed in; the result should be the same.
+    $element = $test_element;
+    $element['#markup'] = 'should not be used';
+    $output = drupal_render($element);
+    $this->assertEqual($output, 'content for user 1');
+    // Verify that the first authenticated user does not see the same content
+    // as user 1.
+    $GLOBALS['user'] = $first_authenticated_user;
+    $element = $test_element;
+    $element['#markup'] = 'content for authenticated users';
+    $output = drupal_render($element);
+    $this->assertEqual($output, 'content for authenticated users');
+    // Verify that the second authenticated user shares the cache with the
+    // first authenticated user.
+    $GLOBALS['user'] = $second_authenticated_user;
+    $element = $test_element;
+    $element['#markup'] = 'should not be used';
+    $output = drupal_render($element);
+    $this->assertEqual($output, 'content for authenticated users');
+    // Restore the original logged-in user.
+    $GLOBALS['user'] = $original_user;
+    drupal_save_session($original_session_state);
+
    // Restore the previous request method.
    $_SERVER['REQUEST_METHOD'] = $request_method;
  }
@@ -7,8 +7,8 @@ stylesheets[all][] = common_test.css
 stylesheets[print][] = common_test.print.css
 hidden = TRUE

-; Information added by Drupal.org packaging script on 2015-04-02
-version = "7.36"
+; Information added by Drupal.org packaging script on 2015-08-19
+version = "7.39"
 project = "drupal"
-datestamp = "1427943826"
+datestamp = "1440020197"

@@ -5,8 +5,8 @@ version = VERSION
 core = 7.x
 hidden = TRUE

-; Information added by Drupal.org packaging script on 2015-04-02
-version = "7.36"
+; Information added by Drupal.org packaging script on 2015-08-19
+version = "7.39"
 project = "drupal"
-datestamp = "1427943826"
+datestamp = "1440020197"

@@ -5,8 +5,8 @@ package = Testing
 version = VERSION
 hidden = TRUE

-; Information added by Drupal.org packaging script on 2015-04-02
-version = "7.36"
+; Information added by Drupal.org packaging script on 2015-08-19
+version = "7.39"
 project = "drupal"
-datestamp = "1427943826"
+datestamp = "1440020197"

@@ -1414,10 +1414,47 @@ class DatabaseSelectTestCase extends DatabaseTestCase {
    }

    $query = (string)$query;
-    $expected = "/* Testing query comments SELECT nid FROM {node}; -- */ SELECT test.name AS name, test.age AS age\nFROM \n{test} test";
+    $expected = "/* Testing query comments  * / SELECT nid FROM {node}; -- */ SELECT test.name AS name, test.age AS age\nFROM \n{test} test";

    $this->assertEqual($num_records, 4, 'Returned the correct number of rows.');
    $this->assertEqual($query, $expected, 'The flattened query contains the sanitised comment string.');
+
+    $connection = Database::getConnection();
+    foreach ($this->makeCommentsProvider() as $test_set) {
+      list($expected, $comments) = $test_set;
+      $this->assertEqual($expected, $connection->makeComment($comments));
+    }
+  }
+
+  /**
+   * Provides expected and input values for testVulnerableComment().
+   */
+  function makeCommentsProvider() {
+    return array(
+      array(
+        '/*  */ ',
+        array(''),
+      ),
+      // Try and close the comment early.
+      array(
+        '/* Exploit  * / DROP TABLE node; -- */ ',
+        array('Exploit */ DROP TABLE node; --'),
+      ),
+      // Variations on comment closing.
+      array(
+        '/* Exploit  * / * / DROP TABLE node; -- */ ',
+        array('Exploit */*/ DROP TABLE node; --'),
+      ),
+      array(
+        '/* Exploit  *  * // DROP TABLE node; -- */ ',
+        array('Exploit **// DROP TABLE node; --'),
+      ),
+      // Try closing the comment in the second string which is appended.
+      array(
+        '/* Exploit  * / DROP TABLE node; --; Another try  * / DROP TABLE node; -- */ ',
+        array('Exploit */ DROP TABLE node; --', 'Another try */ DROP TABLE node; --'),
+      ),
+    );
  }

  /**
@@ -7,8 +7,8 @@ version = VERSION
 core = 7.x
 hidden = TRUE

-; Information added by Drupal.org packaging script on 2015-04-02
-version = "7.36"
+; Information added by Drupal.org packaging script on 2015-08-19
+version = "7.39"
 project = "drupal"
-datestamp = "1427943826"
+datestamp = "1440020197"

@@ -5,8 +5,8 @@ version = VERSION
 core = 7.x
 hidden = TRUE

-; Information added by Drupal.org packaging script on 2015-04-02
-version = "7.36"
+; Information added by Drupal.org packaging script on 2015-08-19
+version = "7.39"
 project = "drupal"
-datestamp = "1427943826"
+datestamp = "1440020197"

--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Bachir Soussi Chiadmi	e36279d8b1	changed materio_serach_api, query configuration by query	2016-03-16 12:35:55 +01:00
Bachir Soussi Chiadmi	0b6e0c10cb	updated search feature	2016-03-02 10:15:50 +01:00
Bachir Soussi Chiadmi	ba1ec7113e	updated search_api and search_api_solr	2016-03-01 16:23:45 +01:00
Bachir Soussi Chiadmi	deb2bff572	print fine tuning	2016-01-21 12:02:55 +01:00
Bachir Soussi Chiadmi	538c791bae	fine tunning print fiche	2016-01-20 18:15:38 +01:00
Bachir Soussi Chiadmi	df107a0443	fixed printed material WARNING : we are nox using gulp instead of grunt, watch for bugs	2016-01-19 19:23:16 +01:00
Bachir Soussi Chiadmi	c9b16289ef	added remove duplicates modules	2016-01-19 15:10:33 +01:00
Bachir Soussi Chiadmi	b4acd7d8bb	updated video filter module to handle https on embeded videos	2015-12-20 10:56:50 +01:00
Bachir Soussi Chiadmi	3af02617b4	added html5 boiler plate mime headers to htaccess	2015-12-19 21:36:40 +01:00
Bachir Soussi Chiadmi	0fdb4abd71	ajax autocomplete fixe	2015-12-03 12:23:53 +01:00
Bachir Soussi Chiadmi	90be34eef1	updated htaccess	2015-12-02 17:17:06 +01:00
Bachir Soussi Chiadmi	3e984dc6c5	updated htaccess	2015-12-02 17:13:13 +01:00
Bachir Soussi Chiadmi	a0cb0b2171	updated htaccess	2015-12-02 16:57:17 +01:00
Bachir Soussi Chiadmi	f6346b0195	updated htaccess	2015-12-02 16:52:56 +01:00
Bachir Soussi Chiadmi	300f698989	updated htaccess	2015-12-02 16:46:36 +01:00
Bachir Soussi Chiadmi	8cbb5f8c4c	updated htaccess	2015-12-02 16:45:51 +01:00
Bachir Soussi Chiadmi	a106b98209	updated htaccess	2015-12-02 16:30:59 +01:00
Bachir Soussi Chiadmi	8fe92dbcc7	updated htaccess	2015-12-02 16:29:02 +01:00
Bachir Soussi Chiadmi	60f2c5c7fa	updated htaccess	2015-12-02 15:20:02 +01:00
Bachir Soussi Chiadmi	d96c17454b	updated htaccess	2015-12-02 11:40:34 +01:00
Bachir Soussi Chiadmi	ed6ae84181	added ubercart ssl module	2015-12-02 11:36:55 +01:00
Bachir Soussi Chiadmi	35e914df58	created admon taxo view	2015-11-25 11:34:49 +01:00
Bachir Soussi Chiadmi	6b46869a16	htaccess : all redirects are handle by claranet	2015-11-25 09:47:27 +01:00
Bachir Soussi Chiadmi	892dba801f	added entity_translation_export_import module	2015-11-25 00:53:33 +01:00
Bachir Soussi Chiadmi	50dfd2d89b	removed i18n_taxonomy module from features dependencies fixed some bugs	2015-11-24 23:50:19 +01:00
Bachir Soussi Chiadmi	9a18821b7e	fixed search api materio settings	2015-11-24 18:17:34 +01:00
Bachir Soussi Chiadmi	82bf36a5eb	recreated features	2015-11-24 18:05:48 +01:00
Bachir Soussi Chiadmi	3eb20676ca	search api autocomplet t() for transmlate term name	2015-11-24 16:51:48 +01:00
Bachir Soussi Chiadmi	2155a66eb1	added special menu items module	2015-11-24 15:29:54 +01:00
Bachir Soussi Chiadmi	62fef652fc	removed redirects from htaccess, claranet will handle this on vhosts	2015-11-24 15:15:10 +01:00
Bachir Soussi Chiadmi	951c9114a2	added code for remove all http on file address	2015-11-24 13:42:37 +01:00
Bachir Soussi Chiadmi	edba04f103	htaccess fixe	2015-11-24 13:23:18 +01:00
Bachir Soussi Chiadmi	26ab9aa56b	htaccess fixe	2015-11-24 13:22:11 +01:00
Bachir Soussi Chiadmi	5716acf5bb	htaccess fixe	2015-11-24 13:20:51 +01:00
Bachir Soussi Chiadmi	12fe570fbd	htaccess fixe	2015-11-24 13:20:11 +01:00
Bachir Soussi Chiadmi	66ee9c6657	htaccess fixe	2015-11-24 13:19:01 +01:00
Bachir Soussi Chiadmi	ca5231f1fe	htaccess fixe	2015-11-24 13:09:04 +01:00
Bachir Soussi Chiadmi	b9a8db8140	htaccess fixe	2015-11-24 13:08:22 +01:00
Bachir Soussi Chiadmi	d25e7428bc	htaccess fixe	2015-11-24 12:55:37 +01:00
Bachir Soussi Chiadmi	3027b3985b	htaccess fixe	2015-11-24 12:55:09 +01:00
Bachir Soussi Chiadmi	d214a44291	htaccess fixe	2015-11-24 12:49:06 +01:00
Bachir Soussi Chiadmi	fc7753f7a0	htaccess fixe	2015-11-24 12:48:26 +01:00
Bachir Soussi Chiadmi	7c51b255fb	htaccess fixe	2015-11-24 12:47:26 +01:00
Bachir Soussi Chiadmi	5e099d48de	htaccess fixe	2015-11-24 12:35:16 +01:00
Bachir Soussi Chiadmi	bf84ac06cd	htaccess fixe	2015-11-24 12:34:56 +01:00
Bachir Soussi Chiadmi	87beabee92	htaccess fixe	2015-11-24 12:29:51 +01:00
Bachir Soussi Chiadmi	f6ee366a71	htaccess fixe	2015-11-24 12:29:32 +01:00
Bachir Soussi Chiadmi	b216e30f28	htaccess fixe	2015-11-24 12:28:04 +01:00
Bachir Soussi Chiadmi	0a863fc1bb	htaccess ssl	2015-11-24 12:26:56 +01:00
Bachir Soussi Chiadmi	a5edc41323	htaccess fixe	2015-11-24 12:12:57 +01:00
Bachir Soussi Chiadmi	1cc2c9af75	updated term csv files	2015-11-24 11:17:12 +01:00
Bachir Soussi Chiadmi	cc653b73be	bug fixe	2015-11-24 11:02:29 +01:00
Bachir Soussi Chiadmi	73993a539b	added fr2en batch function	2015-11-24 10:59:13 +01:00
Bachir Soussi Chiadmi	d7e7410950	added term_merge module	2015-11-24 10:56:30 +01:00
Bachir Soussi Chiadmi	7298235d4f	added taxonomy wrangler module	2015-11-23 14:47:44 +01:00
Bachir Soussi Chiadmi	fc0a779214	fixed bookmarks for students	2015-10-21 20:22:58 +02:00
Bachir Soussi Chiadmi	248c5ed3e1	added search form back bouton	2015-10-21 19:43:37 +02:00
Bachir Soussi Chiadmi	ace9de07e2	started base home back btn	2015-10-21 17:44:29 +02:00
Bachir Soussi Chiadmi	7ad1f5dc67	patched i18n modules for node don't record chosen language on create see https://www.drupal.org/node/1852102#comment-9612303	2015-10-14 17:15:19 +02:00
Bachir Soussi Chiadmi	d5628cc78e	updated entity_translation to last dev version	2015-10-14 17:09:13 +02:00
Bachir Soussi Chiadmi	81371521c7	updated gitignore to ignore .directory files	2015-10-14 17:03:08 +02:00
Bachir Soussi Chiadmi	eb699f528d	updated date pathauto addressfield honeypot features modules	2015-10-12 12:03:12 +02:00
Bachir Soussi Chiadmi	0ba0c21bb9	upadated colorbox andd prod_check	2015-10-12 11:52:36 +02:00
Bachir Soussi Chiadmi	50c3e1c7d7	added list of deleted entities from flag list content	2015-09-27 19:50:44 +02:00
Bachir Soussi Chiadmi	f0cb6175c1	patched flag list to trigger remove entity from lists when this entity is deleted	2015-09-27 18:55:26 +02:00
Bachir Soussi Chiadmi	e004b7a238	patched node-export module https://www.drupal.org/node/1869918 https://www.drupal.org/node/1911638	2015-09-18 14:54:38 +02:00
Bachir Soussi Chiadmi	f7cd9c0858	ran security updates on contrib modules ctools, video_embed_field, migrate, views_bulk_operations	2015-09-17 14:44:25 +02:00
Bachir Soussi Chiadmi	5d30d9bcee	repatched user module Implement language aware tokens for one time login link and cancel link https://www.drupal.org/node/1754162	2015-09-17 13:59:26 +02:00
Bachir Soussi Chiadmi	c4f2e62697	core update from 7.37 to 7.38	2015-09-17 13:08:35 +02:00
Bachir Soussi Chiadmi	a99f2d7aa6	fixed rss media notification https://www.drupal.org/node/2472409	2015-09-16 16:34:31 +02:00
Bachir Soussi Chiadmi	4e8346e5e3	fixed weight field rights for admin	2015-07-21 18:04:54 +02:00
Bachir Soussi Chiadmi	5b281024a5	added database link on home for members	2015-07-21 15:58:56 +02:00
Bachir Soussi Chiadmi	96903cab02	fixed some header display	2015-07-17 18:18:01 +02:00
Bachir Soussi Chiadmi	ce20bb3f0f	fixed some header display	2015-07-17 18:05:02 +02:00
Bachir Soussi Chiadmi	19d3d90743	fixed publication node display	2015-07-17 17:56:35 +02:00
Bachir Soussi Chiadmi	62fec82217	fixed printed cards	2015-07-16 17:08:15 +02:00
Bachir Soussi Chiadmi	f0295847f9	fixed icon alignement on header's blocks	2015-07-16 16:21:27 +02:00
Bachir Soussi Chiadmi	cc657eaec4	added publications links and display of pubications pages	2015-07-16 15:46:48 +02:00
Bachir Soussi Chiadmi	54f496acad	added contact footer on home V2	2015-07-16 15:02:15 +02:00
Bachir Soussi Chiadmi	feef7951cd	removed img max width on simplenews nodes	2015-07-07 22:32:49 +02:00
Bachir Soussi Chiadmi	8def2961ac	updated user export materio module	2015-07-07 22:11:34 +02:00
Bachir Soussi Chiadmi	1c38e1b72a	added fixed width for simplenews node type	2015-07-07 18:49:42 +02:00
Bachir Soussi Chiadmi	0446c17ad1	added home visibility field to simplenews content type and one more filtre on homeV2 view for news letter	2015-07-03 10:56:26 +02:00
Bachir Soussi Chiadmi	459335fee1	removed front-page module	2015-07-03 10:31:06 +02:00
Bachir Soussi Chiadmi	408251fd28	admin features remoced front-page dependencie	2015-07-03 10:28:35 +02:00
Bachir Soussi Chiadmi	98d1b5cb03	fixed front for member display	2015-07-02 20:14:15 +02:00
Bachir Soussi Chiadmi	141d1f4b5c	added front by role	2015-07-02 20:08:33 +02:00
Bachir Soussi Chiadmi	100dce022a	some display	2015-07-02 19:38:33 +02:00
Bachir Soussi Chiadmi	3220ed8e4b	fixed login redirection from login block and improved design of this block	2015-07-02 19:24:43 +02:00
Bachir Soussi Chiadmi	22146c2778	fixed viewmode change bug	2015-07-02 18:34:27 +02:00
Bachir Soussi Chiadmi	f4b8bfa249	removed newsletters which user doesn't have access to	2015-06-26 19:24:47 +02:00
Bachir Soussi Chiadmi	4c32c73321	added user export page for simplenews unsubscription	2015-06-26 18:42:45 +02:00
Bachir Soussi Chiadmi	09d1f06552	fixed some display bug	2015-06-24 17:20:14 +02:00
Bachir Soussi Chiadmi	ade4a41f76	fixed user profile form display	2015-06-24 16:29:54 +02:00
Bachir Soussi Chiadmi	19b1d49a22	applied fixe width to all page exept /actuality and /explore	2015-06-24 16:00:38 +02:00
Bachir Soussi Chiadmi	4264a271b4	added simple_pass_reset module	2015-06-24 15:48:23 +02:00
Bachir Soussi Chiadmi	de040b46ea	re-add linked materials on actuality page for visitors, in big card viewmode	2015-06-23 16:33:05 +02:00
Bachir Soussi Chiadmi	aa323869c3	display none links on home regarding logged-in or not	2015-06-18 18:34:20 +02:00
Bachir Soussi Chiadmi	22e93d650e	added class field to page links field	2015-06-18 18:26:30 +02:00
Bachir Soussi Chiadmi	2664d2fcfd	fixed localisation link display	2015-06-18 18:01:03 +02:00
Bachir Soussi Chiadmi	feb93503b6	fixed hash encoding bug with chrome between tarifs page and register form	2015-06-18 17:43:16 +02:00
Bachir Soussi Chiadmi	2d5be00cf1	improved mobile display	2015-06-17 19:25:33 +02:00
Bachir Soussi Chiadmi	a84cd67456	improved mobile display	2015-06-17 19:23:41 +02:00
Bachir Soussi Chiadmi	8a1f5cd116	improved mobile display	2015-06-17 19:21:32 +02:00
Bachir Soussi Chiadmi	65c7ab92b6	fixed skrollr for mobile, added skrollrbody option in init	2015-06-17 18:49:11 +02:00
Bachir Soussi Chiadmi	1c1de98039	bug fixe	2015-06-15 20:53:06 +02:00
Bachir Soussi Chiadmi	2e4a069036	fixed some display	2015-06-15 18:15:53 +02:00
Bachir Soussi Chiadmi	cc8306bc14	fixed forms display	2015-06-15 17:47:06 +02:00
Bachir Soussi Chiadmi	d107702f86	updated pricing page	2015-06-15 17:34:54 +02:00
Bachir Soussi Chiadmi	f9144db774	removed linked materials from actuality page	2015-06-15 15:32:05 +02:00
Bachir Soussi Chiadmi	1ca1912fe2	added card behaviour to news on homeV2	2015-06-15 15:13:04 +02:00
Bachir Soussi Chiadmi	1657634e1a	fixed the right color background for video home	2015-06-15 14:06:34 +02:00
Bachir Soussi Chiadmi	a908bb02ca	removed beta	2015-06-15 14:00:44 +02:00
Bachir Soussi Chiadmi	4eadc1b771	removed translation link from publications	2015-06-15 12:21:31 +02:00
Bachir Soussi Chiadmi	ce2f811278	added new window option for page link field	2015-06-15 12:08:23 +02:00
Bachir Soussi Chiadmi	1c42c93c54	removed some dsm	2015-06-15 11:51:12 +02:00
Bachir Soussi Chiadmi	71744db508	added rights for simplenews subscriptions by roles	2015-06-15 11:48:45 +02:00
Bachir Soussi Chiadmi	3add8f6b96	added weight field to publications	2015-06-14 19:35:34 +02:00
Bachir Soussi Chiadmi	678343b0e9	home v2	2015-06-10 19:27:56 +02:00
Bachir Soussi Chiadmi	5485f80dae	home v2	2015-06-10 19:26:56 +02:00
Bachir Soussi Chiadmi	6df0ebfa53	home v2	2015-06-10 19:25:08 +02:00
Bachir Soussi Chiadmi	9521fc1ce5	home v2	2015-06-10 19:22:26 +02:00
Bachir Soussi Chiadmi	1f1247a226	home v2	2015-06-10 19:21:34 +02:00
Bachir Soussi Chiadmi	b05c9a53c5	home v2: upadted features	2015-06-10 19:18:11 +02:00
Bachir Soussi Chiadmi	b2d9b7dbf7	home v2: fixed simple news sub display	2015-06-10 19:05:00 +02:00
Bachir Soussi Chiadmi	98bc1dfef8	home v2: fixed simple news sub display	2015-06-10 19:01:12 +02:00
Bachir Soussi Chiadmi	d35191a96e	home v2: hide simple news from register block	2015-06-10 18:59:23 +02:00
Bachir Soussi Chiadmi	2fd09f23e9	home v2: added register block and newsletter subscription	2015-06-10 18:50:27 +02:00
Bachir Soussi Chiadmi	181a28cd85	fixed link display home v2	2015-06-10 17:47:49 +02:00
Bachir Soussi Chiadmi	d5155b3b31	added links to home v2	2015-06-10 17:01:47 +02:00
Bachir Soussi Chiadmi	32f26b4bf5	added links to home v2	2015-06-10 16:57:35 +02:00
Bachir Soussi Chiadmi	1b9752f495	updated admin for publication	2015-06-10 16:17:54 +02:00
Bachir Soussi Chiadmi	afd3a90538	upadted home V2	2015-06-10 15:53:49 +02:00
Bachir Soussi Chiadmi	96aef8c128	home v2 fixed menu links display	2015-06-09 18:08:38 +02:00
Bachir Soussi Chiadmi	73741839ca	home v2 update	2015-06-09 18:03:11 +02:00
Bachir Soussi Chiadmi	8a8ed4f929	updated publication feature	2015-06-03 20:09:11 +02:00
Bachir Soussi Chiadmi	e12a664fa5	added publications and some skrollr animations to home v2	2015-06-03 20:06:35 +02:00
Bachir Soussi Chiadmi	6ceb7d6534	added workflow strongarm variable to admin feature	2015-06-03 17:12:25 +02:00
Bachir Soussi Chiadmi	3ffbc09c10	big update for home v2	2015-06-03 17:02:24 +02:00
Bachir Soussi Chiadmi	49004d7fee	repatched views module	2015-05-26 20:01:49 +02:00
Bachir Soussi Chiadmi	706c96d663	updated modules views friendly_register serial address_field i18n	2015-05-26 19:56:22 +02:00
Bachir Soussi Chiadmi	c9f8dc21ed	updated loggintobogan	2015-05-26 19:48:46 +02:00
Bachir Soussi Chiadmi	59cec97bcf	updated patch lists	2015-05-26 19:45:37 +02:00
Bachir Soussi Chiadmi	c2a05d8ab3	repatched user module Implement language aware tokens for one time login link and cancel link https://www.drupal.org/node/1754162	2015-05-26 19:34:57 +02:00
Bachir Soussi Chiadmi	f75cb5562c	updated core to 7.37	2015-05-26 19:28:47 +02:00
Bachir Soussi Chiadmi	342655bf2b	updated publication feature	2015-05-26 18:45:25 +02:00
Bachir Soussi Chiadmi	f9f0ce54ec	Merge branch 'homeV2' of https://bitbucket.org/bachysoucy/materio-base-d7 into homeV2	2015-05-26 18:30:49 +02:00
Bachir Soussi Chiadmi	0c29476b3f	updated features for home v2	2015-05-26 18:24:48 +02:00
sarah garcin	c183a0b0dd	add scrollto function	2015-05-26 18:14:30 +02:00
sarah garcin	ea423f2146	add images funky	2015-05-26 16:15:22 +02:00
Bachir Soussi Chiadmi	580c97dc49	fixed frontend search field bad display	2015-05-26 12:39:32 +02:00
sarah garcin	95cbb13821	theming new materio Home css	2015-05-20 17:08:18 +02:00
Bachir Soussi Chiadmi	ddae683ff3	removed pays filtre from admin view company	2015-05-19 19:52:31 +02:00
Bachir Soussi Chiadmi	c90787212b	materiau print page css	2015-05-19 19:14:40 +02:00
Bachir Soussi Chiadmi	81ea02bb3e	Merge branch 'homeV2' into prod	2015-05-19 15:03:05 +02:00
Bachir Soussi Chiadmi	d9f6370962	admin feature added admin the right to add premium role	2015-05-19 14:11:04 +02:00
sarah garcin	40e4643644	start theming home v2	2015-05-19 14:01:51 +02:00
sarah garcin	76c59dc2a9	change home v2 feature, add class	2015-05-19 14:01:06 +02:00
Bachir Soussi Chiadmi	ae3b3d3895	scss added ascii art fixed some media querys for mobile	2015-05-18 19:03:00 +02:00
Bachir Soussi Chiadmi	d858f00e17	removed obsolete mixins like pb() pl() mb() bgc() bgca()	2015-05-18 17:42:53 +02:00
Bachir Soussi Chiadmi	f28719a994	fixed gruntfile, fixed modal buttons, fixed .gitignore .sass-cache folder	2015-05-18 16:32:24 +02:00
Bachir Soussi Chiadmi	922a2da1e5	Merge branch 'prod' into homeV2	2015-05-18 14:43:16 +02:00
Bachir Soussi Chiadmi	26bb2de5b8	updated feature admin added materiau localisation exposed filtre	2015-05-18 14:33:58 +02:00
Bachir Soussi Chiadmi	e4b76f4756	fixed libraries mis-path bug from theme refactoring	2015-05-16 15:29:08 +02:00
Bachir Soussi Chiadmi	2686166df2	Merge branch 'theme-refactoring' of https://bitbucket.org/bachysoucy/materio-base-d7 into homeV2	2015-05-16 14:51:57 +02:00
Bachir Soussi Chiadmi	1f211d5348	Merge branch 'prod' into homeV2	2015-05-16 14:51:35 +02:00
Bachir Soussi Chiadmi	b3c85e79c6	improved mandrill callback	2015-05-16 14:50:28 +02:00
Bachir Soussi Chiadmi	2ffa37fefa	updated home V2 feature	2015-05-16 14:24:02 +02:00
Bachir Soussi Chiadmi	70151f23e1	added home v2 feature	2015-05-15 09:44:14 +02:00
Bachir Soussi Chiadmi	79bd95aeec	Merge branch 'theme-refactoring' into homeV2	2015-05-15 09:42:23 +02:00
Bachir Soussi Chiadmi	3a53525bf9	fixed title localisation display on admin views	2015-05-14 19:23:45 +02:00
Bachir Soussi Chiadmi	54787232fb	upadted users admin view after uc_roles patch	2015-05-13 14:29:05 +02:00
Bachir Soussi Chiadmi	69c5b7ee5c	patche ubercart to add expiration date field on views https://www.drupal.org/node/419700	2015-05-13 13:18:06 +02:00
Bachir Soussi Chiadmi	8d141a61e0	updated navigation menu	2015-05-11 16:05:53 +02:00
Bachir Soussi Chiadmi	19a68f970e	removed credit card from ubercart	2015-05-11 15:21:34 +02:00
Bachir Soussi Chiadmi	de8f5e4ccc	created materio rss feature	2015-05-11 15:13:37 +02:00
Bachir Soussi Chiadmi	442d89c948	updated and patched views_php to fixe the pager bug https://www.drupal.org/node/2484407	2015-05-11 14:33:53 +02:00
Bachir Soussi Chiadmi	3adb83ccf7	added site/all/translations to .gitignore	2015-05-07 12:08:44 +02:00
Bachir Soussi Chiadmi	68b11d7a9b	fix elysia_cron icons bug see patch https://www.drupal.org/node/2096571	2015-05-07 12:05:46 +02:00
Bachir Soussi Chiadmi	f8a18606ba	added watchdog mandrill result hook	2015-05-06 11:09:06 +02:00
Bachir Soussi Chiadmi	23b96ab26f	grrrrr	2015-05-05 19:12:51 +02:00
Bachir Soussi Chiadmi	8c920e81df	grrrrr	2015-05-05 19:10:25 +02:00
Bachir Soussi Chiadmi	202993e68e	grrrrr	2015-05-05 19:08:05 +02:00
Bachir Soussi Chiadmi	8589ce7c28	grrrrr	2015-05-05 19:06:47 +02:00
Bachir Soussi Chiadmi	17580e8eba	grrrrr	2015-05-05 19:06:01 +02:00
Bachir Soussi Chiadmi	ca9530466a	grrrrr	2015-05-05 18:42:39 +02:00
Bachir Soussi Chiadmi	31ede7287a	grrrrr	2015-05-05 18:41:34 +02:00
Bachir Soussi Chiadmi	be2054c163	grrrrr	2015-05-05 18:36:26 +02:00
Bachir Soussi Chiadmi	a20d86efbf	bug fixed	2015-05-05 18:32:32 +02:00
Bachir Soussi Chiadmi	0795a2a514	grrrrr	2015-05-05 18:27:34 +02:00
Bachir Soussi Chiadmi	c92d7ed737	added simplenews_spool management to try to fix mandrill rejected bug	2015-05-05 18:26:12 +02:00
Bachir Soussi Chiadmi	923b407498	fixed mandatory address field on company nodes. + added node_modules to .gitignore	2015-05-05 12:08:23 +02:00
Bachir Soussi Chiadmi	ceeefdd109	updated features (removed ubercart card payement dependencie)	2015-05-04 12:29:16 +02:00