updated core to 7.58 (right after the site was hacked)

This commit is contained in:
2018-04-20 23:48:40 +02:00
parent 18f4aba146
commit 9344a61b61
711 changed files with 99690 additions and 480 deletions

View File

@@ -140,7 +140,7 @@ function file_file_download($uri, $field_type = 'file') {
}
// Find out which (if any) fields of this type contain the file.
$references = file_get_file_references($file, NULL, FIELD_LOAD_CURRENT, $field_type);
$references = file_get_file_references($file, NULL, FIELD_LOAD_CURRENT, $field_type, FALSE);
// Stop processing if there are no references in order to avoid returning
// headers for files controlled by other modules. Make an exception for
@@ -1067,11 +1067,18 @@ function file_icon_map($file) {
* @param $field_type
* (optional) The name of a field type. If given, limits the reference check
* to fields of the given type.
* @param $check_access
* (optional) A boolean that specifies whether the permissions of the current
* user should be checked when retrieving references. If FALSE, all
* references to the file are returned. If TRUE, only references from
* entities that the current user has access to are returned. Defaults to
* TRUE for backwards compatibility reasons, but FALSE is recommended for
* most situations.
*
* @return
* An integer value.
*/
function file_get_file_references($file, $field = NULL, $age = FIELD_LOAD_REVISION, $field_type = 'file') {
function file_get_file_references($file, $field = NULL, $age = FIELD_LOAD_REVISION, $field_type = 'file', $check_access = TRUE) {
$references = drupal_static(__FUNCTION__, array());
$fields = isset($field) ? array($field['field_name'] => $field) : field_info_fields();
@@ -1082,6 +1089,11 @@ function file_get_file_references($file, $field = NULL, $age = FIELD_LOAD_REVISI
$query
->fieldCondition($file_field, 'fid', $file->fid)
->age($age);
if (!$check_access) {
// Neutralize the 'entity_field_access' query tag added by
// field_sql_storage_field_storage_query().
$query->addTag('DANGEROUS_ACCESS_CHECK_OPT_OUT');
}
$references[$field_name] = $query->execute();
}
}