From ab5d43a39797b54694cdb82b99d101ec35d1f680 Mon Sep 17 00:00:00 2001 From: Bachir Soussi Chiadmi Date: Fri, 27 Mar 2020 14:22:44 +0100 Subject: [PATCH] upadted core to 7.69 --- CHANGELOG.txt | 24 +++ MAINTAINERS.txt | 5 +- includes/ajax.inc | 1 + includes/bootstrap.inc | 14 +- includes/common.inc | 130 ++++++++++----- includes/file.inc | 3 + includes/pager.inc | 2 +- includes/session.inc | 25 ++- includes/theme.inc | 67 ++++++-- modules/aggregator/aggregator.info | 6 +- modules/aggregator/tests/aggregator_test.info | 6 +- modules/block/block.info | 6 +- modules/block/tests/block_test.info | 6 +- .../block_test_theme/block_test_theme.info | 6 +- modules/blog/blog.info | 6 +- modules/book/book.info | 6 +- modules/color/color.info | 6 +- modules/comment/comment.info | 6 +- modules/contact/contact.info | 6 +- modules/contextual/contextual.info | 6 +- modules/dashboard/dashboard.info | 6 +- modules/dblog/dblog.info | 6 +- modules/field/field.info | 6 +- .../field_sql_storage/field_sql_storage.info | 6 +- modules/field/modules/list/list.info | 6 +- .../field/modules/list/tests/list_test.info | 6 +- modules/field/modules/number/number.info | 6 +- modules/field/modules/options/options.info | 6 +- modules/field/modules/text/text.info | 6 +- modules/field/tests/field_test.info | 6 +- modules/field_ui/field_ui.info | 6 +- modules/file/file.info | 6 +- modules/file/tests/file_module_test.info | 6 +- modules/filter/filter.info | 6 +- modules/forum/forum.info | 6 +- modules/help/help.info | 6 +- modules/image/image.info | 6 +- modules/image/tests/image_module_test.info | 6 +- modules/locale/locale.info | 6 +- modules/locale/tests/locale_test.info | 6 +- modules/menu/menu.info | 6 +- modules/node/node.info | 6 +- modules/node/node.module | 2 +- modules/node/tests/node_access_test.info | 6 +- modules/node/tests/node_test.info | 6 +- modules/node/tests/node_test_exception.info | 6 +- modules/openid/openid.info | 6 +- modules/openid/tests/openid_test.info | 6 +- modules/overlay/overlay.info | 6 +- modules/path/path.info | 6 +- modules/php/php.info | 6 +- modules/poll/poll.info | 6 +- modules/profile/profile.info | 6 +- modules/rdf/rdf.info | 6 +- modules/rdf/tests/rdf_test.info | 6 +- modules/search/search.info | 6 +- .../search/tests/search_embedded_form.info | 6 +- modules/search/tests/search_extra_type.info | 6 +- modules/search/tests/search_node_tags.info | 6 +- modules/shortcut/shortcut.info | 6 +- modules/simpletest/simpletest.info | 6 +- .../simpletest/tests/actions_loop_test.info | 6 +- modules/simpletest/tests/ajax_forms_test.info | 6 +- modules/simpletest/tests/ajax_test.info | 6 +- modules/simpletest/tests/batch_test.info | 6 +- modules/simpletest/tests/boot_test_1.info | 6 +- modules/simpletest/tests/boot_test_2.info | 6 +- modules/simpletest/tests/common.test | 10 +- modules/simpletest/tests/common_test.info | 6 +- .../tests/common_test_cron_helper.info | 6 +- modules/simpletest/tests/database_test.info | 6 +- .../drupal_autoload_test.info | 6 +- ...drupal_system_listing_compatible_test.info | 6 +- ...upal_system_listing_incompatible_test.info | 6 +- .../simpletest/tests/entity_cache_test.info | 6 +- .../tests/entity_cache_test_dependency.info | 6 +- .../tests/entity_crud_hook_test.info | 6 +- .../tests/entity_query_access_test.info | 6 +- modules/simpletest/tests/error_test.info | 6 +- modules/simpletest/tests/file.test | 4 +- modules/simpletest/tests/file_test.info | 6 +- modules/simpletest/tests/filter_test.info | 6 +- modules/simpletest/tests/form_test.info | 6 +- modules/simpletest/tests/image_test.info | 6 +- modules/simpletest/tests/menu_test.info | 6 +- modules/simpletest/tests/module_test.info | 6 +- modules/simpletest/tests/pager.test | 17 +- modules/simpletest/tests/path_test.info | 6 +- .../tests/psr_0_test/psr_0_test.info | 6 +- .../tests/psr_4_test/psr_4_test.info | 6 +- .../simpletest/tests/requirements1_test.info | 6 +- .../simpletest/tests/requirements2_test.info | 6 +- modules/simpletest/tests/session_test.info | 6 +- .../tests/system_dependencies_test.info | 6 +- ...atible_core_version_dependencies_test.info | 6 +- ...system_incompatible_core_version_test.info | 6 +- ...ible_module_version_dependencies_test.info | 6 +- ...stem_incompatible_module_version_test.info | 6 +- .../tests/system_project_namespace_test.info | 6 +- modules/simpletest/tests/system_test.info | 6 +- modules/simpletest/tests/taxonomy_test.info | 6 +- modules/simpletest/tests/theme.test | 21 +++ modules/simpletest/tests/theme_test.info | 6 +- .../themes/test_basetheme/test_basetheme.info | 6 +- .../themes/test_subtheme/test_subtheme.info | 6 +- .../tests/themes/test_theme/test_theme.info | 6 +- .../test_theme_nyan_cat.info | 6 +- .../simpletest/tests/update_script_test.info | 6 +- modules/simpletest/tests/update_test_1.info | 6 +- modules/simpletest/tests/update_test_2.info | 6 +- modules/simpletest/tests/update_test_3.info | 6 +- modules/simpletest/tests/url_alter_test.info | 6 +- modules/simpletest/tests/xmlrpc_test.info | 6 +- modules/statistics/statistics.info | 6 +- modules/statistics/statistics.module | 2 - modules/syslog/syslog.info | 6 +- modules/system/system.archiver.inc | 4 +- modules/system/system.info | 6 +- modules/system/system.module | 4 + modules/system/system.tar.inc | 153 +++++++++++------- modules/system/tests/cron_queue_test.info | 6 +- modules/system/tests/system_cron_test.info | 6 +- modules/taxonomy/taxonomy.info | 6 +- modules/toolbar/toolbar-print.css | 6 + modules/toolbar/toolbar.info | 6 +- modules/toolbar/toolbar.module | 3 + modules/tracker/tracker.info | 6 +- .../translation/tests/translation_test.info | 6 +- modules/translation/translation.info | 6 +- modules/trigger/tests/trigger_test.info | 6 +- modules/trigger/trigger.info | 6 +- modules/update/tests/aaa_update_test.info | 6 +- modules/update/tests/bbb_update_test.info | 6 +- modules/update/tests/ccc_update_test.info | 6 +- .../update_test_admintheme.info | 6 +- .../update_test_basetheme.info | 6 +- .../update_test_subtheme.info | 6 +- modules/update/tests/update_test.info | 6 +- modules/update/update.info | 6 +- modules/user/tests/user_form_test.info | 6 +- modules/user/tests/user_session_test.info | 11 ++ modules/user/tests/user_session_test.module | 29 ++++ modules/user/user.info | 6 +- modules/user/user.module | 38 +---- modules/user/user.test | 68 ++------ profiles/minimal/minimal.info | 6 +- profiles/standard/standard.info | 6 +- ...drupal_system_listing_compatible_test.info | 6 +- ...upal_system_listing_incompatible_test.info | 6 +- profiles/testing/testing.info | 6 +- themes/bartik/bartik.info | 6 +- themes/garland/garland.info | 6 +- themes/seven/seven.info | 6 +- themes/stark/stark.info | 6 +- web.config | 2 +- 155 files changed, 819 insertions(+), 606 deletions(-) create mode 100644 modules/toolbar/toolbar-print.css create mode 100644 modules/user/tests/user_session_test.info create mode 100644 modules/user/tests/user_session_test.module diff --git a/CHANGELOG.txt b/CHANGELOG.txt index 5a00d11c..39c48f1b 100644 --- a/CHANGELOG.txt +++ b/CHANGELOG.txt @@ -1,6 +1,30 @@ Drupal 7.xx, xxxx-xx-xx (development version) ----------------------- +Drupal 7.69, 2019-12-18 +----------------------- +- Fixed security issues: + - SA-CORE-2019-012 + +Drupal 7.68, 2019-12-04 +----------------------- +- Fixed: Hide toolbar when printing +- Fixed: Settings returned via ajax are not run through hook_js_alter() +- Fixed: Use drupal_http_build_query() in drupal_http_request() +- Fixed: DrupalRequestSanitizer not found fatal error when bootstrap phase order is changed +- Fixed: Block web.config in .htaccess (and vice-versa) +- Fixed: Create "scripts" element to align rendering workflow to how "styles" are handled +- PHP 7.3: Fixed 'Cannot change session id when session is active' +- PHP 7.1: Fixed 'A non-numeric value encountered in theme_pager()' +- PHP 7.x: Fixed file.inc generated .htaccess does not cover PHP 7 +- PHP 5.3: Fixed check_plain() 'Invalid multibyte sequence in argument' test failures +- Fixed: Allow passing data as array to drupal_http_request() +- Fixed: Skip module_invoke/module_hook in calling hook_watchdog (excessive function_exist) +- Fixed: HTTP status 200 returned for 'Additional uncaught exception thrown while handling exception' +- Fixed: theme_table() should take an optional footer variable and produce +- Fixed: 'uasort() expects parameter 1 to be array, null given in node_view_multiple()' +- [regression] Fix default.settings.php permission + Drupal 7.67, 2019-05-08 ----------------------- - Fixed security issues: diff --git a/MAINTAINERS.txt b/MAINTAINERS.txt index 460658c1..4ea5572a 100644 --- a/MAINTAINERS.txt +++ b/MAINTAINERS.txt @@ -11,11 +11,8 @@ The Drupal Core branch maintainers oversee the development of Drupal as a whole. The branch maintainers for Drupal 7 are: - Dries Buytaert 'dries' https://www.drupal.org/u/dries -- Angela Byron 'webchick' https://www.drupal.org/u/webchick - Fabian Franz 'Fabianx' https://www.drupal.org/u/fabianx -- David Rothstein 'David_Rothstein' https://www.drupal.org/u/david_rothstein -- Stefan Ruijsenaars 'stefan.r' https://www.drupal.org/u/stefanr-0 -- (provisional) Pol Dellaiera 'Pol' https://www.drupal.org/u/pol +- (provisional) Drew Webber 'mcdruid' https://www.drupal.org/u/mcdruid Component maintainers diff --git a/includes/ajax.inc b/includes/ajax.inc index f059209b..db53e31b 100644 --- a/includes/ajax.inc +++ b/includes/ajax.inc @@ -294,6 +294,7 @@ function ajax_render($commands = array()) { // Now add a command to merge changes and additions to Drupal.settings. $scripts = drupal_add_js(); + drupal_alter('js', $scripts); if (!empty($scripts['settings'])) { $settings = $scripts['settings']; array_unshift($commands, ajax_command_settings(drupal_array_merge_deep_array($settings['data']), TRUE)); diff --git a/includes/bootstrap.inc b/includes/bootstrap.inc index 8b05bc5c..10e2a420 100644 --- a/includes/bootstrap.inc +++ b/includes/bootstrap.inc @@ -8,7 +8,7 @@ /** * The current system version. */ -define('VERSION', '7.67'); +define('VERSION', '7.69'); /** * Core API compatibility. @@ -1998,7 +1998,7 @@ function watchdog($type, $message, $variables = array(), $severity = WATCHDOG_NO // It is possible that the error handling will itself trigger an error. In that case, we could // end up in an infinite loop. To avoid that, we implement a simple static semaphore. - if (!$in_error_state && function_exists('module_implements')) { + if (!$in_error_state && function_exists('module_invoke_all')) { $in_error_state = TRUE; // The user object may not exist in all conditions, so 0 is substituted if needed. @@ -2021,9 +2021,7 @@ function watchdog($type, $message, $variables = array(), $severity = WATCHDOG_NO ); // Call the logging hooks to log/process the message - foreach (module_implements('watchdog') as $module) { - module_invoke($module, 'watchdog', $log_entry); - } + module_invoke_all('watchdog', $log_entry); // It is critical that the semaphore is only cleared here, in the parent // watchdog() call (not outside the loop), to prevent recursive execution. @@ -2518,6 +2516,7 @@ function drupal_bootstrap($phase = NULL, $new_phase = TRUE) { switch ($current_phase) { case DRUPAL_BOOTSTRAP_CONFIGURATION: + require_once DRUPAL_ROOT . '/includes/request-sanitizer.inc'; _drupal_bootstrap_configuration(); break; @@ -2622,6 +2621,10 @@ function _drupal_exception_handler($exception) { _drupal_log_error(_drupal_decode_exception($exception), TRUE); } catch (Exception $exception2) { + // Add a 500 status code in case an exception was thrown before the 500 + // status could be set (e.g. while loading a maintenance theme from cache). + drupal_add_http_header('Status', '500 Internal Server Error'); + // Another uncaught exception was thrown while handling the first one. // If we are displaying errors, then do so with no possibility of a further uncaught exception being thrown. if (error_displayable()) { @@ -2647,7 +2650,6 @@ function _drupal_bootstrap_configuration() { drupal_settings_initialize(); // Sanitize unsafe keys from the request. - require_once DRUPAL_ROOT . '/includes/request-sanitizer.inc'; DrupalRequestSanitizer::sanitize(); } diff --git a/includes/common.inc b/includes/common.inc index 44ff4607..d370bb8f 100644 --- a/includes/common.inc +++ b/includes/common.inc @@ -760,9 +760,10 @@ function drupal_access_denied() { * (optional) An array that can have one or more of the following elements: * - headers: An array containing request headers to send as name/value pairs. * - method: A string containing the request method. Defaults to 'GET'. - * - data: A string containing the request body, formatted as - * 'param=value¶m=value&...'; to generate this, use http_build_query(). - * Defaults to NULL. + * - data: An array containing the values for the request body or a string + * containing the request body, formatted as + * 'param=value¶m=value&...'; to generate this, use + * drupal_http_build_query(). Defaults to NULL. * - max_redirects: An integer representing how many times a redirect * may be followed. Defaults to 3. * - timeout: A float representing the maximum number of seconds the function @@ -788,7 +789,7 @@ function drupal_access_denied() { * easy access the array keys are returned in lower case. * - data: A string containing the response body that was received. * - * @see http_build_query() + * @see drupal_http_build_query() */ function drupal_http_request($url, array $options = array()) { // Allow an alternate HTTP client library to replace Drupal's default @@ -930,6 +931,11 @@ function drupal_http_request($url, array $options = array()) { $path .= '?' . $uri['query']; } + // Convert array $options['data'] to query string. + if (is_array($options['data'])) { + $options['data'] = drupal_http_build_query($options['data']); + } + // Only add Content-Length if we actually have any content or if it is a POST // or PUT request. Some non-standard servers get confused by Content-Length in // at least HEAD/GET requests, and Squid always requires Content-Length in @@ -4441,12 +4447,54 @@ function drupal_get_js($scope = 'header', $javascript = NULL, $skip_alter = FALS } } - $output = ''; - // The index counter is used to keep aggregated and non-aggregated files in - // order by weight. - $index = 1; - $processed = array(); - $files = array(); + // Sort the JavaScript so that it appears in the correct order. + uasort($items, 'drupal_sort_css_js'); + + // Provide the page with information about the individual JavaScript files + // used, information not otherwise available when aggregation is enabled. + $setting['ajaxPageState']['js'] = array_fill_keys(array_keys($items), 1); + unset($setting['ajaxPageState']['js']['settings']); + drupal_add_js($setting, 'setting'); + + // If we're outputting the header scope, then this might be the final time + // that drupal_get_js() is running, so add the setting to this output as well + // as to the drupal_add_js() cache. If $items['settings'] doesn't exist, it's + // because drupal_get_js() was intentionally passed a $javascript argument + // stripped off settings, potentially in order to override how settings get + // output, so in this case, do not add the setting to this output. + if ($scope == 'header' && isset($items['settings'])) { + $items['settings']['data'][] = $setting; + } + + $elements = array( + '#type' => 'scripts', + '#items' => $items, + ); + + return drupal_render($elements); +} + +/** + * The #pre_render callback for the "scripts" element. + * + * This callback adds elements needed for