updated drupal core to 7.43

2016-03-16 16:41:44 +01:00
parent 8fb9c70e42
commit b27aabe359
230 changed files with 4138 additions and 2075 deletions
--- a/includes/batch.inc
+++ b/includes/batch.inc
@@ -460,10 +460,10 @@ function _batch_finished() {
      if (isset($batch_set['file']) && is_file($batch_set['file'])) {
        include_once DRUPAL_ROOT . '/' . $batch_set['file'];
      }
-      if (function_exists($batch_set['finished'])) {
+      if (is_callable($batch_set['finished'])) {
        $queue = _batch_queue($batch_set);
        $operations = $queue->getAllItems();
-        $batch_set['finished']($batch_set['success'], $batch_set['results'], $operations, format_interval($batch_set['elapsed'] / 1000));
+        call_user_func($batch_set['finished'], $batch_set['success'], $batch_set['results'], $operations, format_interval($batch_set['elapsed'] / 1000));
      }
    }
  }
--- a/includes/bootstrap.inc
+++ b/includes/bootstrap.inc
@@ -8,7 +8,7 @@
 /**
 * The current system version.
 */
-define('VERSION', '7.39');
+define('VERSION', '7.43');

 /**
 * Core API compatibility.
@@ -1055,7 +1055,7 @@ function drupal_page_get_cache($check_only = FALSE) {
 * Determines the cacheability of the current page.
 *
 * @param $allow_caching
- *   Set to FALSE if you want to prevent this page to get cached.
+ *   Set to FALSE if you want to prevent this page from being cached.
 *
 * @return
 *   TRUE if the current page can be cached, FALSE otherwise.
@@ -1262,6 +1262,10 @@ function drupal_page_header() {
  $default_headers = array(
    'Expires' => 'Sun, 19 Nov 1978 05:00:00 GMT',
    'Cache-Control' => 'no-cache, must-revalidate, post-check=0, pre-check=0',
+    // Prevent browsers from sniffing a response and picking a MIME type
+    // different from the declared content-type, since that can lead to
+    // XSS and other vulnerabilities.
+    'X-Content-Type-Options' => 'nosniff',
  );
  drupal_send_headers($default_headers);
 }
@@ -1776,7 +1780,7 @@ function watchdog($type, $message, $variables = array(), $severity = WATCHDOG_NO
 * @see theme_status_messages()
 */
 function drupal_set_message($message = NULL, $type = 'status', $repeat = TRUE) {
-  if ($message) {
+  if ($message || $message === '0' || $message === 0) {
    if (!isset($_SESSION['messages'][$type])) {
      $_SESSION['messages'][$type] = array();
    }
@@ -2464,6 +2468,9 @@ function _drupal_bootstrap_database() {
  // the install or upgrade process.
  spl_autoload_register('drupal_autoload_class');
  spl_autoload_register('drupal_autoload_interface');
+  if (version_compare(PHP_VERSION, '5.4') >= 0) {
+    spl_autoload_register('drupal_autoload_trait');
+  }
 }

 /**
@@ -2779,10 +2786,14 @@ function language_list($field = 'language') {
 }

 /**
- * Returns the default language used on the site
+ * Returns the default language, as an object, or one of its properties.
 *
 * @param $property
- *   Optional property of the language object to return
+ *   (optional) The property of the language object to return.
+ *
+ * @return
+ *   Either the language object for the default language used on the site,
+ *   or the property of that object named in the $property parameter.
 */
 function language_default($property = NULL) {
  $language = variable_get('language_default', (object) array('language' => 'en', 'name' => 'English', 'native' => 'English', 'direction' => 0, 'enabled' => 1, 'plurals' => 0, 'formula' => '', 'domain' => '', 'prefix' => '', 'weight' => 0, 'javascript' => ''));
@@ -2952,7 +2963,9 @@ function ip_address() {
 * Gets the schema definition of a table, or the whole database schema.
 *
 * The returned schema will include any modifications made by any
- * module that implements hook_schema_alter().
+ * module that implements hook_schema_alter(). To get the schema without
+ * modifications, use drupal_get_schema_unprocessed().
+ *
 *
 * @param $table
 *   The name of the table. If not given, the schema of all tables is returned.
@@ -3107,6 +3120,22 @@ function drupal_autoload_class($class) {
  return _registry_check_code('class', $class);
 }

+/**
+ * Confirms that a trait is available.
+ *
+ * This function is rarely called directly. Instead, it is registered as an
+ * spl_autoload() handler, and PHP calls it for us when necessary.
+ *
+ * @param string $trait
+ *   The name of the trait to check or load.
+ *
+ * @return bool
+ *   TRUE if the trait is currently available, FALSE otherwise.
+ */
+function drupal_autoload_trait($trait) {
+  return _registry_check_code('trait', $trait);
+}
+
 /**
 * Checks for a resource in the registry.
 *
@@ -3125,7 +3154,7 @@ function drupal_autoload_class($class) {
 function _registry_check_code($type, $name = NULL) {
  static $lookup_cache, $cache_update_needed;

-  if ($type == 'class' && class_exists($name) || $type == 'interface' && interface_exists($name)) {
+  if ($type == 'class' && class_exists($name) || $type == 'interface' && interface_exists($name) || $type == 'trait' && trait_exists($name)) {
    return TRUE;
  }

--- a/includes/cache.inc
+++ b/includes/cache.inc
@@ -14,6 +14,7 @@
 *
 * @param $bin
 *   The cache bin for which the cache object should be returned.
+ *
 * @return DrupalCacheInterface
 *   The cache object associated with the specified bin.
 *
--- a/includes/common.inc
+++ b/includes/common.inc
@@ -688,6 +688,13 @@ function drupal_goto($path = '', array $options = array(), $http_response_code =
    $options['fragment'] = $destination['fragment'];
  }

+  // In some cases modules call drupal_goto(current_path()). We need to ensure
+  // that such a redirect is not to an external URL.
+  if ($path === current_path() && empty($options['external']) && url_is_external($path)) {
+    // Force url() to generate a non-external URL.
+    $options['external'] = FALSE;
+  }
+
  drupal_alter('drupal_goto', $path, $options, $http_response_code);

  // The 'Location' HTTP header must be absolute.
@@ -1057,6 +1064,12 @@ function drupal_http_request($url, array $options = array()) {

  switch ($code) {
    case 200: // OK
+    case 201: // Created
+    case 202: // Accepted
+    case 203: // Non-Authoritative Information
+    case 204: // No Content
+    case 205: // Reset Content
+    case 206: // Partial Content
    case 304: // Not modified
      break;
    case 301: // Moved permanently
@@ -2214,20 +2227,8 @@ function url($path = NULL, array $options = array()) {
    'prefix' => ''
  );

-  // A duplicate of the code from url_is_external() to avoid needing another
-  // function call, since performance inside url() is critical.
  if (!isset($options['external'])) {
-    // Return an external link if $path contains an allowed absolute URL. Avoid
-    // calling drupal_strip_dangerous_protocols() if there is any slash (/),
-    // hash (#) or question_mark (?) before the colon (:) occurrence - if any -
-    // as this would clearly mean it is not a URL. If the path starts with 2
-    // slashes then it is always considered an external URL without an explicit
-    // protocol part.
-    $colonpos = strpos($path, ':');
-    $options['external'] = (strpos($path, '//') === 0)
-      || ($colonpos !== FALSE
-        && !preg_match('![/?#]!', substr($path, 0, $colonpos))
-        && drupal_strip_dangerous_protocols($path) == $path);
+    $options['external'] = url_is_external($path);
  }

  // Preserve the original path before altering or aliasing.
@@ -2347,12 +2348,18 @@ function url($path = NULL, array $options = array()) {
 */
 function url_is_external($path) {
  $colonpos = strpos($path, ':');
-  // Avoid calling drupal_strip_dangerous_protocols() if there is any slash (/),
-  // hash (#) or question_mark (?) before the colon (:) occurrence - if any - as
-  // this would clearly mean it is not a URL. If the path starts with 2 slashes
-  // then it is always considered an external URL without an explicit protocol
-  // part.
+  // Some browsers treat \ as / so normalize to forward slashes.
+  $path = str_replace('\\', '/', $path);
+  // If the path starts with 2 slashes then it is always considered an external
+  // URL without an explicit protocol part.
  return (strpos($path, '//') === 0)
+    // Leading control characters may be ignored or mishandled by browsers, so
+    // assume such a path may lead to an external location. The \p{C} character
+    // class matches all UTF-8 control, unassigned, and private characters.
+    || (preg_match('/^\p{C}/u', $path) !== 0)
+    // Avoid calling drupal_strip_dangerous_protocols() if there is any slash
+    // (/), hash (#) or question_mark (?) before the colon (:) occurrence - if
+    // any - as this would clearly mean it is not a URL.
    || ($colonpos !== FALSE
      && !preg_match('![/?#]!', substr($path, 0, $colonpos))
      && drupal_strip_dangerous_protocols($path) == $path);
@@ -2812,11 +2819,11 @@ function drupal_map_assoc($array, $function = NULL) {
 * into script execution a call such as set_time_limit(20) is made, the
 * script will run for a total of 45 seconds before timing out.
 *
- * It also means that it is possible to decrease the total time limit if
- * the sum of the new time limit and the current time spent running the
- * script is inferior to the original time limit. It is inherent to the way
- * set_time_limit() works, it should rather be called with an appropriate
- * value every time you need to allocate a certain amount of time
+ * If the current time limit is not unlimited it is possible to decrease the
+ * total time limit if the sum of the new time limit and the current time spent
+ * running the script is inferior to the original time limit. It is inherent to
+ * the way set_time_limit() works, it should rather be called with an
+ * appropriate value every time you need to allocate a certain amount of time
 * to execute a task than only once at the beginning of the script.
 *
 * Before calling set_time_limit(), we check if this function is available
@@ -2833,7 +2840,11 @@ function drupal_map_assoc($array, $function = NULL) {
 */
 function drupal_set_time_limit($time_limit) {
  if (function_exists('set_time_limit')) {
-    @set_time_limit($time_limit);
+    $current = ini_get('max_execution_time');
+    // Do not set time limit if it is currently unlimited.
+    if ($current != 0) {
+      @set_time_limit($time_limit);
+    }
  }
 }

@@ -5212,6 +5223,11 @@ function _drupal_bootstrap_full() {
  fix_gpc_magic();
  // Load all enabled modules
  module_load_all();
+  // Reset drupal_alter() and module_implements() static caches as these
+  // include implementations for vital modules only when called early on
+  // in the bootstrap.
+  drupal_static_reset('drupal_alter');
+  drupal_static_reset('module_implements');
  // Make sure all stream wrappers are registered.
  file_get_stream_wrappers();
  // Ensure mt_rand is reseeded, to prevent random values from one page load
@@ -5308,8 +5324,8 @@ function drupal_page_set_cache() {
 *
 * Do not call this function from a test. Use $this->cronRun() instead.
 *
- * @return
- *   TRUE if cron ran successfully.
+ * @return bool
+ *   TRUE if cron ran successfully and FALSE if cron is already running.
 */
 function drupal_cron_run() {
  // Allow execution to continue even if the request gets canceled.
@@ -5371,12 +5387,12 @@ function drupal_cron_run() {
      // Do not run if queue wants to skip.
      continue;
    }
-    $function = $info['worker callback'];
+    $callback = $info['worker callback'];
    $end = time() + (isset($info['time']) ? $info['time'] : 15);
    $queue = DrupalQueue::get($queue_name);
    while (time() < $end && ($item = $queue->claimItem())) {
      try {
-        $function($item->data);
+        call_user_func($callback, $item->data);
        $queue->deleteItem($item);
      }
      catch (Exception $e) {
@@ -7083,7 +7099,8 @@ function drupal_uninstall_schema($module) {
 * specification of a schema, as it was defined in a module's
 * hook_schema(). No additional default values will be set,
 * hook_schema_alter() is not invoked and these unprocessed
- * definitions won't be cached.
+ * definitions won't be cached. To retrieve the schema after
+ * hook_schema_alter() has been invoked use drupal_get_schema().
 *
 * This function can be used to retrieve a schema specification in
 * hook_schema(), so it allows you to derive your tables from existing
@@ -7156,6 +7173,7 @@ function _drupal_schema_initialize(&$schema, $module, $remove_descriptions = TRU
 */
 function drupal_schema_field_types($table) {
  $table_schema = drupal_get_schema($table);
+  $field_types = array();
  foreach ($table_schema['fields'] as $field_name => $field_info) {
    $field_types[$field_name] = isset($field_info['type']) ? $field_info['type'] : NULL;
  }
@@ -7363,7 +7381,16 @@ function drupal_write_record($table, &$record, $primary_keys = array()) {
 * Information stored in a module .info file:
 * - name: The real name of the module for display purposes.
 * - description: A brief description of the module.
- * - dependencies: An array of shortnames of other modules this module requires.
+ * - dependencies: An array of dependency strings. Each is in the form
+ *   'project:module (versions)'; with the following meanings:
+ *   - project: (optional) Project shortname, recommended to ensure uniqueness,
+ *     if the module is part of a project hosted on drupal.org. If omitted,
+ *     also omit the : that follows. The project name is currently ignored by
+ *     Drupal core but is used for automated testing.
+ *   - module: (required) Module shortname within the project.
+ *   - (versions): Optional version information, consisting of one or more
+ *     comma-separated operator/value pairs or simply version numbers, which
+ *     can contain "x" as a wildcard. Examples: (>=7.22, <7.28), (7.x-3.x).
 * - package: The name of the package of modules this module belongs to.
 *
 * See forum.info for an example of a module .info file.
@@ -7443,7 +7470,6 @@ function drupal_parse_info_file($filename) {
 */
 function drupal_parse_info_format($data) {
  $info = array();
-  $constants = get_defined_constants();

  if (preg_match_all('
    @^\s*                           # Start at the beginning of a line, ignoring leading whitespace
@@ -7483,8 +7509,8 @@ function drupal_parse_info_format($data) {
      }

      // Handle PHP constants.
-      if (isset($constants[$value])) {
-        $value = $constants[$value];
+      if (preg_match('/^\w+$/i', $value) && defined($value)) {
+        $value = constant($value);
      }

      // Insert actual value.
@@ -7648,7 +7674,12 @@ function debug($data, $label = NULL, $print_r = FALSE) {
 * Parses a dependency for comparison by drupal_check_incompatibility().
 *
 * @param $dependency
- *   A dependency string, for example 'foo (>=7.x-4.5-beta5, 3.x)'.
+ *   A dependency string, which specifies a module dependency, and optionally
+ *   the project it comes from and versions that are supported. Supported
+ *   formats include:
+ *   - 'module'
+ *   - 'project:module'
+ *   - 'project:module (>=version, version)'
 *
 * @return
 *   An associative array with three keys:
@@ -7663,6 +7694,12 @@ function debug($data, $label = NULL, $print_r = FALSE) {
 * @see drupal_check_incompatibility()
 */
 function drupal_parse_dependency($dependency) {
+  $value = array();
+  // Split out the optional project name.
+  if (strpos($dependency, ':')) {
+    list($project_name, $dependency) = explode(':', $dependency);
+    $value['project'] = $project_name;
+  }
  // We use named subpatterns and support every op that version_compare
  // supports. Also, op is optional and defaults to equals.
  $p_op = '(?P<operation>!=|==|=|<|<=|>|>=|<>)?';
@@ -7671,7 +7708,6 @@ function drupal_parse_dependency($dependency) {
  $p_major = '(?P<major>\d+)';
  // By setting the minor version to x, branches can be matched.
  $p_minor = '(?P<minor>(?:\d+|x)(?:-[A-Za-z]+\d+)?)';
-  $value = array();
  $parts = explode('(', $dependency, 2);
  $value['name'] = trim($parts[0]);
  if (isset($parts[1])) {
--- a/includes/database/database.inc
+++ b/includes/database/database.inc
@@ -656,7 +656,7 @@ abstract class DatabaseConnection extends PDO {
   * @return DatabaseStatementInterface
   *   This method will return one of: the executed statement, the number of
   *   rows affected by the query (not the number matched), or the generated
-   *   insert IT of the last query, depending on the value of
+   *   insert ID of the last query, depending on the value of
   *   $options['return']. Typically that value will be set by default or a
   *   query builder and should not be set by a user. If there is an error,
   *   this method will return NULL and may throw an exception if
--- a/includes/database/mysql/database.inc
+++ b/includes/database/mysql/database.inc
@@ -51,6 +51,11 @@ class DatabaseConnection_mysql extends DatabaseConnection {
      // Because MySQL's prepared statements skip the query cache, because it's dumb.
      PDO::ATTR_EMULATE_PREPARES => TRUE,
    );
+    if (defined('PDO::MYSQL_ATTR_MULTI_STATEMENTS')) {
+      // An added connection option in PHP 5.5.21+ to optionally limit SQL to a
+      // single statement like mysqli.
+      $connection_options['pdo'] += array(PDO::MYSQL_ATTR_MULTI_STATEMENTS => FALSE);
+    }

    parent::__construct($dsn, $connection_options['username'], $connection_options['password'], $connection_options['pdo']);

@@ -76,10 +81,12 @@ class DatabaseConnection_mysql extends DatabaseConnection {
      'init_commands' => array(),
    );
    $connection_options['init_commands'] += array(
-      'sql_mode' => "SET sql_mode = 'ANSI,STRICT_TRANS_TABLES,STRICT_ALL_TABLES,NO_ZERO_IN_DATE,NO_ZERO_DATE,ERROR_FOR_DIVISION_BY_ZERO,NO_AUTO_CREATE_USER'",
+      'sql_mode' => "SET sql_mode = 'REAL_AS_FLOAT,PIPES_AS_CONCAT,ANSI_QUOTES,IGNORE_SPACE,STRICT_TRANS_TABLES,STRICT_ALL_TABLES,NO_ZERO_IN_DATE,NO_ZERO_DATE,ERROR_FOR_DIVISION_BY_ZERO,NO_AUTO_CREATE_USER'",
    );
-    // Set connection options.
-    $this->exec(implode('; ', $connection_options['init_commands']));
+    // Execute initial commands.
+    foreach ($connection_options['init_commands'] as $sql) {
+      $this->exec($sql);
+    }
  }

  public function __destruct() {
--- a/includes/database/schema.inc
+++ b/includes/database/schema.inc
@@ -92,7 +92,8 @@ require_once dirname(__FILE__) . '/query.inc';
 *    specification). Each specification is an array containing the name of
 *    the referenced table ('table'), and an array of column mappings
 *    ('columns'). Column mappings are defined by key pairs ('source_column' =>
- *    'referenced_column').
+ *    'referenced_column'). This key is for documentation purposes only; foreign
+ *    keys are not created in the database, nor are they enforced by Drupal.
 *  - 'indexes':  An associative array of indexes ('indexname' =>
 *    specification). Each specification is an array of one or more
 *    key column specifiers (see below) that form an index on the
@@ -144,6 +145,8 @@ require_once dirname(__FILE__) . '/query.inc';
 *   'unique keys' => array(
 *     'vid' => array('vid'),
 *   ),
+ *   // For documentation purposes only; foreign keys are not created in the
+ *   // database.
 *   'foreign keys' => array(
 *     'node_revision' => array(
 *       'table' => 'node_revision',
--- a/includes/database/sqlite/install.inc
+++ b/includes/database/sqlite/install.inc
@@ -14,8 +14,6 @@ class DatabaseTasks_sqlite extends DatabaseTasks {

  /**
   * Minimum engine version.
-   *
-   * @todo: consider upping to 3.6.8 in Drupal 8 to get SAVEPOINT support.
   */
  public function minimumVersion() {
    return '3.3.7';
--- a/includes/file.inc
+++ b/includes/file.inc
@@ -1785,7 +1785,7 @@ function file_validate_is_image(stdClass $file) {
 /**
 * Verifies that image dimensions are within the specified maximum and minimum.
 *
- * Non-image files will be ignored. If a image toolkit is available the image
+ * Non-image files will be ignored. If an image toolkit is available the image
 * will be scaled to fit within the desired maximum dimensions.
 *
 * @param $file
--- a/includes/form.inc
+++ b/includes/form.inc
@@ -3385,9 +3385,12 @@ function form_process_container($element, &$form_state) {
 /**
 * Returns HTML to wrap child elements in a container.
 *
- * Used for grouped form items. Can also be used as a #theme_wrapper for any
+ * Used for grouped form items. Can also be used as a theme wrapper for any
 * renderable element, to surround it with a <div> and add attributes such as
- * classes or an HTML id.
+ * classes or an HTML ID.
+ *
+ * See the @link forms_api_reference.html Form API reference @endlink for more
+ * information on the #theme_wrappers render array property.
 *
 * @param $variables
 *   An associative array containing:
@@ -3979,7 +3982,12 @@ function form_process_autocomplete($element) {
    // browser interpreting the path plus search string as an actual file.
    $current_clean_url = isset($GLOBALS['conf']['clean_url']) ? $GLOBALS['conf']['clean_url'] : NULL;
    $GLOBALS['conf']['clean_url'] = 0;
-    $element['#autocomplete_input']['#url_value'] = url($element['#autocomplete_path'], array('absolute' => TRUE));
+    // Force the script path to 'index.php', in case the server is not
+    // configured to find it automatically. Normally it is the responsibility
+    // of the site to do this themselves using hook_url_outbound_alter() (see
+    // url()) but since this code is forcing non-clean URLs on sites that don't
+    // normally use them, it is done here instead.
+    $element['#autocomplete_input']['#url_value'] = url($element['#autocomplete_path'], array('absolute' => TRUE, 'script' => 'index.php'));
    $GLOBALS['conf']['clean_url'] = $current_clean_url;
  }
  return $element;
@@ -4484,7 +4492,7 @@ function element_validate_number($element, &$form_state) {
 *
 * Sample callback_batch_finished():
 * @code
- * function batch_test_finished($success, $results, $operations) {
+ * function my_finished_callback($success, $results, $operations) {
 *   // The 'success' parameter means no fatal PHP errors were detected. All
 *   // other error management should be handled using 'results'.
 *   if ($success) {
--- a/includes/install.core.inc
+++ b/includes/install.core.inc
@@ -1590,7 +1590,9 @@ function install_finished(&$install_state) {
 }

 /**
- * Batch callback for batch installation of modules.
+ * Implements callback_batch_operation().
+ *
+ * Performs batch installation of modules.
 */
 function _install_module_batch($module, $module_name, &$context) {
  // Install and enable the module right away, so that the module will be
@@ -1603,6 +1605,8 @@ function _install_module_batch($module, $module_name, &$context) {
 }

 /**
+ * Implements callback_batch_finished().
+ *
 * 'Finished' callback for module installation batch.
 */
 function _install_profile_modules_finished($success, $results, $operations) {
--- a/includes/install.inc
+++ b/includes/install.inc
@@ -750,7 +750,7 @@ function drupal_install_system() {
 /**
 * Uninstalls a given list of disabled modules.
 *
- * @param array $module_list
+ * @param string[] $module_list
 *   The modules to uninstall. It is the caller's responsibility to ensure that
 *   all modules in this list have already been disabled before this function
 *   is called.
@@ -769,6 +769,7 @@ function drupal_install_system() {
 *   included in $module_list).
 *
 * @see module_disable()
+ * @see module_enable()
 */
 function drupal_uninstall_modules($module_list = array(), $uninstall_dependents = TRUE) {
  if ($uninstall_dependents) {
--- a/includes/locale.inc
+++ b/includes/locale.inc
@@ -2306,6 +2306,8 @@ function _locale_batch_build($files, $finished = NULL, $components = array()) {
 }

 /**
+ * Implements callback_batch_operation().
+ *
 * Perform interface translation import as a batch step.
 *
 * @param $filepath
@@ -2324,6 +2326,8 @@ function _locale_batch_import($filepath, &$context) {
 }

 /**
+ * Implements callback_batch_finished().
+ *
 * Finished callback of system page locale import batch.
 * Inform the user of translation files imported.
 */
@@ -2334,6 +2338,8 @@ function _locale_batch_system_finished($success, $results) {
 }

 /**
+ * Implements callback_batch_finished().
+ *
 * Finished callback of language addition locale import batch.
 * Inform the user of translation files imported.
 */
--- a/includes/mail.inc
+++ b/includes/mail.inc
@@ -566,7 +566,7 @@ function _drupal_wrap_mail_line(&$line, $key, $values) {
  // Use soft-breaks only for purely quoted or unindented text.
  $line = wordwrap($line, 77 - $values['length'], $values['soft'] ? " \n" : "\n");
  // Break really long words at the maximum width allowed.
-  $line = wordwrap($line, 996 - $values['length'], $values['soft'] ? " \n" : "\n");
+  $line = wordwrap($line, 996 - $values['length'], $values['soft'] ? " \n" : "\n", TRUE);
 }

 /**
--- a/includes/menu.inc
+++ b/includes/menu.inc
@@ -229,12 +229,20 @@ define('MENU_CONTEXT_INLINE', 0x0002);
 define('MENU_FOUND', 1);

 /**
- * Internal menu status code -- Menu item was not found.
+ * Menu status code -- Not found.
+ *
+ * This can be used as the return value from a page callback, although it is
+ * preferable to use a load function to accomplish this; see the hook_menu()
+ * documentation for details.
 */
 define('MENU_NOT_FOUND', 2);

 /**
- * Internal menu status code -- Menu item access is denied.
+ * Menu status code -- Access denied.
+ *
+ * This can be used as the return value from a page callback, although it is
+ * preferable to use an access callback to accomplish this; see the hook_menu()
+ * documentation for details.
 */
 define('MENU_ACCESS_DENIED', 3);

@@ -431,7 +439,7 @@ function menu_set_item($path, $router_item) {
 *
 * @param $path
 *   The path; for example, 'node/5'. The function will find the corresponding
- *   node/% item and return that.
+ *   node/% item and return that. Defaults to the current path.
 * @param $router_item
 *   Internal use only.
 *
@@ -2613,10 +2621,30 @@ function menu_get_active_breadcrumb() {
 */
 function menu_get_active_title() {
  $active_trail = menu_get_active_trail();
+  $local_task_title = NULL;

  foreach (array_reverse($active_trail) as $item) {
-    if (!(bool) ($item['type'] & MENU_IS_LOCAL_TASK)) {
-      return $item['title'];
+    // Local task titles are displayed as tabs and therefore should not be
+    // repeated as the page title. However, if the local task appears in a
+    // top-level menu, it is no longer a "local task" anymore (the front page
+    // of the site does not have tabs) so it is better to use the local task
+    // title in that case than to fall back on the front page link in the
+    // active trail (which is usually "Home" and would not make sense in this
+    // context).
+    if ((bool) ($item['type'] & MENU_IS_LOCAL_TASK)) {
+      // A local task title is being skipped; track it in case it needs to be
+      // used later.
+      $local_task_title = $item['title'];
+    }
+    else {
+      // This is not a local task, so use it for the page title (unless the
+      // conditions described above are met).
+      if (isset($local_task_title) && isset($item['href']) && $item['href'] == '<front>') {
+        return $local_task_title;
+      }
+      else {
+        return $item['title'];
+      }
    }
  }
 }
--- a/includes/module.inc
+++ b/includes/module.inc
@@ -320,16 +320,27 @@ function module_load_install($module) {
 *   The name of the included file, if successful; FALSE otherwise.
 */
 function module_load_include($type, $module, $name = NULL) {
+  static $files = array();
+
  if (!isset($name)) {
    $name = $module;
  }

+  $key = $type . ':' . $module . ':' . $name;
+  if (isset($files[$key])) {
+    return $files[$key];
+  }
+
  if (function_exists('drupal_get_path')) {
    $file = DRUPAL_ROOT . '/' . drupal_get_path('module', $module) . "/$name.$type";
    if (is_file($file)) {
      require_once $file;
+      $files[$key] = $file;
      return $file;
    }
+    else {
+      $files[$key] = FALSE;
+    }
  }
  return FALSE;
 }
@@ -365,20 +376,22 @@ function module_load_all_includes($type, $name = NULL) {
 * - Invoke hook_modules_installed().
 * - Invoke hook_modules_enabled().
 *
- * @param $module_list
+ * @param string[] $module_list
 *   An array of module names.
- * @param $enable_dependencies
+ * @param bool $enable_dependencies
 *   If TRUE, dependencies will automatically be added and enabled in the
 *   correct order. This incurs a significant performance cost, so use FALSE
 *   if you know $module_list is already complete and in the correct order.
 *
- * @return
+ * @return bool
 *   FALSE if one or more dependencies are missing, TRUE otherwise.
 *
 * @see hook_install()
 * @see hook_enable()
 * @see hook_modules_installed()
 * @see hook_modules_enabled()
+ * @see module_disable()
+ * @see drupal_uninstall_modules()
 */
 function module_enable($module_list, $enable_dependencies = TRUE) {
  if ($enable_dependencies) {
@@ -505,12 +518,15 @@ function module_enable($module_list, $enable_dependencies = TRUE) {
 /**
 * Disables a given set of modules.
 *
- * @param $module_list
+ * @param string[] $module_list
 *   An array of module names.
- * @param $disable_dependents
+ * @param bool $disable_dependents
 *   If TRUE, dependent modules will automatically be added and disabled in the
 *   correct order. This incurs a significant performance cost, so use FALSE
 *   if you know $module_list is already complete and in the correct order.
+ *
+ * @see drupal_uninstall_modules()
+ * @see module_enable()
 */
 function module_disable($module_list, $disable_dependents = TRUE) {
  if ($disable_dependents) {
@@ -676,12 +692,16 @@ function module_hook($module, $hook) {
 /**
 * Determines which modules are implementing a hook.
 *
- * @param $hook
+ * Lazy-loaded include files specified with "group" via hook_hook_info() or
+ * hook_module_implements_alter() will be automatically included by this
+ * function when necessary.
+ *
+ * @param string $hook
 *   The name of the hook (e.g. "help" or "menu").
- * @param $sort
+ * @param bool $sort
 *   By default, modules are ordered by weight and filename, settings this option
 *   to TRUE, module list will be ordered by module name.
- * @param $reset
+ * @param bool $reset
 *   For internal use only: Whether to force the stored list of hook
 *   implementations to be regenerated (such as after enabling a new module,
 *   before processing hook_enable).
@@ -696,8 +716,10 @@ function module_implements($hook, $sort = FALSE, $reset = FALSE) {
  static $drupal_static_fast;
  if (!isset($drupal_static_fast)) {
    $drupal_static_fast['implementations'] = &drupal_static(__FUNCTION__);
+    $drupal_static_fast['verified'] = &drupal_static(__FUNCTION__ . ':verified');
  }
  $implementations = &$drupal_static_fast['implementations'];
+  $verified = &$drupal_static_fast['verified'];

  // We maintain a persistent cache of hook implementations in addition to the
  // static cache to avoid looping through every module and every hook on each
@@ -711,14 +733,19 @@ function module_implements($hook, $sort = FALSE, $reset = FALSE) {
  // per request.
  if ($reset) {
    $implementations = array();
+    $verified = array();
    cache_set('module_implements', array(), 'cache_bootstrap');
    drupal_static_reset('module_hook_info');
    drupal_static_reset('drupal_alter');
    cache_clear_all('hook_info', 'cache_bootstrap');
+    cache_clear_all('system_cache_tables', 'cache');
    return;
  }

  // Fetch implementations from cache.
+  // This happens on the first call to module_implements(*, *, FALSE) during a
+  // request, but also when $implementations have been reset, e.g. after
+  // module_enable().
  if (empty($implementations)) {
    $implementations = cache_get('module_implements', 'cache_bootstrap');
    if ($implementations === FALSE) {
@@ -727,12 +754,17 @@ function module_implements($hook, $sort = FALSE, $reset = FALSE) {
    else {
      $implementations = $implementations->data;
    }
+    // Forget all previously "verified" hooks, in case that $implementations
+    // were cleared via drupal_static_reset('module_implements') instead of
+    // module_implements(*, *, TRUE).
+    $verified = array();
  }

  if (!isset($implementations[$hook])) {
    // The hook is not cached, so ensure that whether or not it has
    // implementations, that the cache is updated at the end of the request.
    $implementations['#write_cache'] = TRUE;
+    // Discover implementations for this hook.
    $hook_info = module_hook_info();
    $implementations[$hook] = array();
    $list = module_list(FALSE, FALSE, $sort);
@@ -744,13 +776,31 @@ function module_implements($hook, $sort = FALSE, $reset = FALSE) {
        $implementations[$hook][$module] = $include_file ? $hook_info[$hook]['group'] : FALSE;
      }
    }
-    // Allow modules to change the weight of specific implementations but avoid
+    // Allow modules to change the weight of specific implementations, but avoid
    // an infinite loop.
    if ($hook != 'module_implements_alter') {
+      // Remember the implementations before hook_module_implements_alter().
+      $implementations_before = $implementations[$hook];
      drupal_alter('module_implements', $implementations[$hook], $hook);
+      // Verify implementations that were added or modified.
+      foreach (array_diff_assoc($implementations[$hook], $implementations_before) as $module => $group) {
+        // If drupal_alter('module_implements') changed or added a $group, the
+        // respective file needs to be included.
+        if ($group) {
+          module_load_include('inc', $module, "$module.$group");
+        }
+        // If a new implementation was added, verify that the function exists.
+        if (!function_exists($module . '_' . $hook)) {
+          unset($implementations[$hook][$module]);
+        }
+      }
    }
+    // Implementations for this hook are now "verified".
+    $verified[$hook] = TRUE;
  }
-  else {
+  elseif (!isset($verified[$hook])) {
+    // Implementations for this hook were in the cache, but they are not
+    // "verified" yet.
    foreach ($implementations[$hook] as $module => $group) {
      // If this hook implementation is stored in a lazy-loaded file, so include
      // that file first.
@@ -769,6 +819,7 @@ function module_implements($hook, $sort = FALSE, $reset = FALSE) {
        $implementations['#write_cache'] = TRUE;
      }
    }
+    $verified[$hook] = TRUE;
  }

  return array_keys($implementations[$hook]);
@@ -833,6 +884,11 @@ function module_hook_info() {
 * @see module_implements()
 */
 function module_implements_write_cache() {
+  // The list of implementations includes vital modules only before full
+  // bootstrap, so do not write cache if we are not fully bootstrapped yet.
+  if (drupal_get_bootstrap_phase() != DRUPAL_BOOTSTRAP_FULL) {
+    return;
+  }
  $implementations = &drupal_static('module_implements');
  if (isset($implementations['#write_cache'])) {
    unset($implementations['#write_cache']);
--- a/includes/path.inc
+++ b/includes/path.inc
@@ -347,7 +347,8 @@ function drupal_match_path($path, $patterns) {
 * drupal_bootstrap(DRUPAL_BOOTSTRAP_FULL) makes this function available.
 *
 * @return
- *   The current Drupal URL path.
+ *   The current Drupal URL path. The path is untrusted user input and must be
+ *   treated as such.
 *
 * @see request_path()
 */
--- a/includes/registry.inc
+++ b/includes/registry.inc
@@ -164,7 +164,7 @@ function _registry_parse_files($files) {
 *   (optional) Weight of the module.
 */
 function _registry_parse_file($filename, $contents, $module = '', $weight = 0) {
-  if (preg_match_all('/^\s*(?:abstract|final)?\s*(class|interface)\s+([a-zA-Z0-9_]+)/m', $contents, $matches)) {
+  if (preg_match_all('/^\s*(?:abstract|final)?\s*(class|interface|trait)\s+([a-zA-Z0-9_]+)/m', $contents, $matches)) {
    foreach ($matches[2] as $key => $name) {
      db_merge('registry')
        ->key(array(
--- a/includes/theme.inc
+++ b/includes/theme.inc
@@ -1710,11 +1710,29 @@ function theme_status_messages($variables) {
 * copy if none of the enabled modules or the active theme implement any
 * preprocess or process functions or override this theme implementation.
 *
- * @param $variables
- *   An associative array containing the keys 'text', 'path', and 'options'.
- *   See the l() function for information about these variables.
+ * @param array $variables
+ *   An associative array containing the keys:
+ *   - text: The text of the link.
+ *   - path: The internal path or external URL being linked to. It is used as
+ *     the $path parameter of the url() function.
+ *   - options: (optional) An array that defaults to empty, but can contain:
+ *     - attributes: Can contain optional attributes:
+ *       - class: must be declared in an array. Example: 'class' =>
+ *         array('class_name1','class_name2').
+ *       - title: must be a string. Example: 'title' => 'Example title'
+ *       - Others are more flexible as long as they work with
+ *         drupal_attributes($variables['options']['attributes]).
+ *     - html: Boolean flag that tells whether text contains HTML or plain
+ *       text. If set to TRUE, the text value will not be sanitized so the
+         calling function must ensure that it already contains safe HTML.
+ *   The elements $variables['options']['attributes'] and
+ *   $variables['options']['html'] are used in this function similarly to the
+ *   way that $options['attributes'] and $options['html'] are used in l().
+ *   The link itself is built by the url() function, which takes
+ *   $variables['path'] and $variables['options'] as arguments.
 *
 * @see l()
+ * @see url()
 */
 function theme_link($variables) {
  return '<a href="' . check_plain(url($variables['path'], $variables['options'])) . '"' . drupal_attributes($variables['options']['attributes']) . '>' . ($variables['options']['html'] ? $variables['text'] : check_plain($variables['text'])) . '</a>';
@@ -1791,7 +1809,8 @@ function theme_links($variables) {
    foreach ($links as $key => $link) {
      $class = array($key);

-      // Add first, last and active classes to the list of links to help out themers.
+      // Add first, last and active classes to the list of links to help out
+      // themers.
      if ($i == 1) {
        $class[] = 'first';
      }
@@ -1809,7 +1828,8 @@ function theme_links($variables) {
        $output .= l($link['title'], $link['href'], $link);
      }
      elseif (!empty($link['title'])) {
-        // Some links are actually not links, but we wrap these in <span> for adding title and class attributes.
+        // Some links are actually not links, but we wrap these in <span> for
+        // adding title and class attributes.
        if (empty($link['html'])) {
          $link['title'] = check_plain($link['title']);
        }
--- a/includes/update.inc
+++ b/includes/update.inc
@@ -908,6 +908,8 @@ function update_get_d6_session_name() {
 }

 /**
+ * Implements callback_batch_operation().
+ *
 * Performs one update and stores the results for display on the results page.
 *
 * If an update function completes successfully, it should return a message
@@ -1078,6 +1080,8 @@ function update_batch($start, $redirect = NULL, $url = NULL, $batch = array(), $
 }

 /**
+ * Implements callback_batch_finished().
+ *
 * Finishes the update process and stores the results for eventual display.
 *
 * After the updates run, all caches are flushed. The update results are
--- a/includes/xmlrpcs.inc
+++ b/includes/xmlrpcs.inc
@@ -264,6 +264,10 @@ function xmlrpc_server_call($xmlrpc_server, $methodname, $args) {
 */
 function xmlrpc_server_multicall($methodcalls) {
  // See http://www.xmlrpc.com/discuss/msgReader$1208
+  // To avoid multicall expansion attacks, limit the number of duplicate method
+  // calls allowed with a default of 1. Set to -1 for unlimited.
+  $duplicate_method_limit = variable_get('xmlrpc_multicall_duplicate_method_limit', 1);
+  $method_count = array();
  $return = array();
  $xmlrpc_server = xmlrpc_server_get();
  foreach ($methodcalls as $call) {
@@ -273,10 +277,14 @@ function xmlrpc_server_multicall($methodcalls) {
      $ok = FALSE;
    }
    $method = $call['methodName'];
+    $method_count[$method] = isset($method_count[$method]) ? $method_count[$method] + 1 : 1;
    $params = $call['params'];
    if ($method == 'system.multicall') {
      $result = xmlrpc_error(-32600, t('Recursive calls to system.multicall are forbidden.'));
    }
+    elseif ($duplicate_method_limit > 0 && $method_count[$method] > $duplicate_method_limit) {
+      $result = xmlrpc_error(-156579, t('Too many duplicate method calls in system.multicall.'));
+    }
    elseif ($ok) {
      $result = xmlrpc_server_call($xmlrpc_server, $method, $params);
    }