updated drupal core to 7.43

modules/system/system.admin.inc

@@ -2202,6 +2202,11 @@ function system_add_date_format_type_form_submit($form, &$form_state) {
  * Return the date for a given format string via Ajax.
  */
 function system_date_time_lookup() {
+  // This callback is protected with a CSRF token because user input from the
+  // query string is reflected in the output.
+  if (!isset($_GET['token']) || !drupal_valid_token($_GET['token'], 'admin/config/regional/date-time/formats/lookup')) {
+    return MENU_ACCESS_DENIED;
+  }
   $result = format_date(REQUEST_TIME, 'custom', $_GET['format']);
   drupal_json_output($result);
 }
@@ -2875,13 +2880,14 @@ function system_date_time_formats() {
  * Allow users to add additional date formats.
  */
 function system_configure_date_formats_form($form, &$form_state, $dfid = 0) {
+  $ajax_path = 'admin/config/regional/date-time/formats/lookup';
   $js_settings = array(
     'type' => 'setting',
     'data' => array(
       'dateTime' => array(
         'date-format' => array(
           'text' => t('Displayed as'),
-          'lookup' => url('admin/config/regional/date-time/formats/lookup'),
+          'lookup' => url($ajax_path, array('query' => array('token' => drupal_get_token($ajax_path)))),
         ),
       ),
     ),

modules/system/system.api.php

@@ -113,21 +113,21 @@ function hook_hook_info_alter(&$hooks) {
  *     translation handlers. Array keys are the module names, array values
  *     can be any data structure the module uses to provide field translation.
  *     Any empty value disallows the module to appear as a translation handler.
- *   - entity keys: An array describing how the Field API can extract the
- *     information it needs from the objects of the type. Elements:
+ *   - entity keys: (optional) An array describing how the Field API can extract
+ *     the information it needs from the objects of the type. Elements:
  *     - id: The name of the property that contains the primary id of the
  *       entity. Every entity object passed to the Field API must have this
  *       property and its value must be numeric.
  *     - revision: The name of the property that contains the revision id of
  *       the entity. The Field API assumes that all revision ids are unique
  *       across all entities of a type. This entry can be omitted if the
- *       entities of this type are not versionable.
+ *       entities of this type are not versionable. Defaults to an empty string.
  *     - bundle: The name of the property that contains the bundle name for the
  *       entity. The bundle name defines which set of fields are attached to
  *       the entity (e.g. what nodes call "content type"). This entry can be
  *       omitted if this entity type exposes a single bundle (all entities have
  *       the same collection of fields). The name of this single bundle will be
- *       the same as the entity type.
+ *       the same as the entity type. Defaults to an empty string.
  *     - label: The name of the property that contains the entity label. For
  *       example, if the entity's label is located in $entity->subject, then
  *       'subject' should be specified here. If complex logic is required to
@@ -2632,6 +2632,8 @@ function hook_flush_caches() {
  * module_enable() for a detailed description of the order in which install and
  * enable hooks are invoked.
  *
+ * This hook should be implemented in a .module file, not in an .install file.
+ *
  * @param $modules
  *   An array of the modules that were installed.
  *
@@ -3173,7 +3175,9 @@ function hook_requirements($phase) {
  * creation and alteration of the supported database engines.
  *
  * See the Schema API Handbook at http://drupal.org/node/146843 for details on
- * schema definition structures.
+ * schema definition structures. Note that foreign key definitions are for
+ * documentation purposes only; foreign keys are not created in the database,
+ * nor are they enforced by Drupal.
  *
  * @return array
  *   A schema definition structure array. For each element of the
@@ -3225,6 +3229,8 @@ function hook_schema() {
       'nid_vid' => array('nid', 'vid'),
       'vid'     => array('vid'),
     ),
+    // For documentation purposes only; foreign keys are not created in the
+    // database.
     'foreign keys' => array(
       'node_revision' => array(
         'table' => 'node_revision',

modules/system/system.info

@@ -12,8 +12,8 @@ files[] = system.test
 required = TRUE
 configure = admin/config/system
 
-; Information added by Drupal.org packaging script on 2015-08-19
-version = "7.39"
+; Information added by Drupal.org packaging script on 2016-02-24
+version = "7.43"
 project = "drupal"
-datestamp = "1440020197"
+datestamp = "1456343506"
 

modules/system/system.install

@@ -800,6 +800,7 @@ function system_schema() {
         'type' => 'varchar',
         'length' => 100,
         'not null' => TRUE,
+        'binary' => TRUE,
       ),
       'type' => array(
         'description' => 'The date format type, e.g. medium.',
@@ -2803,6 +2804,16 @@ function system_update_7061(&$sandbox) {
       ->from($query)
       ->execute();
 
+    // Retrieve a list of duplicate files with the same filepath. Only the
+    // most-recently uploaded of these will be moved to the new {file_managed}
+    // table (and all references will be updated to point to it), since
+    // duplicate file URIs are not allowed in Drupal 7.
+    // Since the Drupal 6 to 7 upgrade path leaves the {files} table behind
+    // after it's done, custom or contributed modules which need to migrate
+    // file references of their own can use a similar query to determine the
+    // file IDs that duplicate filepaths were mapped to.
+    $sandbox['duplicate_filepath_fids_to_use'] = db_query("SELECT filepath, MAX(fid) FROM {files} GROUP BY filepath HAVING COUNT(*) > 1")->fetchAllKeyed();
+
     // Initialize batch update information.
     $sandbox['progress'] = 0;
     $sandbox['last_vid_processed'] = -1;
@@ -2832,6 +2843,16 @@ function system_update_7061(&$sandbox) {
         continue;
       }
 
+      // If this file has a duplicate filepath, replace it with the
+      // most-recently uploaded file that has the same filepath.
+      if (isset($sandbox['duplicate_filepath_fids_to_use'][$file['filepath']]) && $record->fid != $sandbox['duplicate_filepath_fids_to_use'][$file['filepath']]) {
+        $file = db_select('files', 'f')
+          ->fields('f', array('fid', 'uid', 'filename', 'filepath', 'filemime', 'filesize', 'status', 'timestamp'))
+          ->condition('f.fid', $sandbox['duplicate_filepath_fids_to_use'][$file['filepath']])
+          ->execute()
+          ->fetchAssoc();
+      }
+
       // Add in the file information from the upload table.
       $file['description'] = $record->description;
       $file['display'] = $record->list;
@@ -3157,6 +3178,20 @@ function system_update_7079() {
   db_change_field('file_managed', 'filesize', 'filesize', $spec);
 }
 
+/**
+ * Convert the 'format' column in {date_format_locale} to case sensitive varchar.
+ */
+function system_update_7080() {
+  $spec = array(
+    'description' => 'The date format string.',
+    'type' => 'varchar',
+    'length' => 100,
+    'not null' => TRUE,
+    'binary' => TRUE,
+  );
+  db_change_field('date_format_locale', 'format', 'format', $spec);
+}
+
 /**
  * @} End of "defgroup updates-7.x-extra".
  * The next series of updates should start at 8000.

modules/system/system.js

@@ -105,7 +105,7 @@ Drupal.behaviors.dateTime = {
           // Attach keyup handler to custom format inputs.
           $('input' + source, context).once('date-time').keyup(function () {
             var input = $(this);
-            var url = fieldSettings.lookup + (/\?q=/.test(fieldSettings.lookup) ? '&format=' : '?format=') + encodeURIComponent(input.val());
+            var url = fieldSettings.lookup + (/\?/.test(fieldSettings.lookup) ? '&format=' : '?format=') + encodeURIComponent(input.val());
             $.getJSON(url, function (data) {
               $(suffix).empty().append(' ' + fieldSettings.text + ': <em>' + data + '</em>');
             });

modules/system/system.module

@@ -2411,6 +2411,10 @@ function _system_rebuild_module_data() {
     // Merge in defaults and save.
     $modules[$key]->info = $module->info + $defaults;
 
+    // The "name" key is required, but to avoid a fatal error in the menu system
+    // we set a reasonable default if it is not provided.
+    $modules[$key]->info += array('name' => $key);
+
     // Prefix stylesheets and scripts with module path.
     $path = dirname($module->uri);
     if (isset($module->info['stylesheets'])) {
@@ -2546,6 +2550,10 @@ function _system_rebuild_theme_data() {
     $themes[$key]->filename = $theme->uri;
     $themes[$key]->info = drupal_parse_info_file($theme->uri) + $defaults;
 
+    // The "name" key is required, but to avoid a fatal error in the menu system
+    // we set a reasonable default if it is not provided.
+    $themes[$key]->info += array('name' => $key);
+
     // Add the info file modification time, so it becomes available for
     // contributed modules to use for ordering theme lists.
     $themes[$key]->info['mtime'] = filemtime($theme->uri);
@@ -2807,7 +2815,7 @@ function system_settings_form_submit($form, &$form_state) {
 function _system_sort_requirements($a, $b) {
   if (!isset($a['weight'])) {
     if (!isset($b['weight'])) {
-      return strcmp($a['title'], $b['title']);
+      return strcasecmp($a['title'], $b['title']);
     }
     return -$b['weight'];
   }
@@ -3048,8 +3056,20 @@ function system_cron() {
     }
   }
 
-  $core = array('cache', 'cache_path', 'cache_filter', 'cache_page', 'cache_form', 'cache_menu');
-  $cache_tables = array_merge(module_invoke_all('flush_caches'), $core);
+  // Delete expired cache entries.
+  // Avoid invoking hook_flush_cashes() on every cron run because some modules
+  // use this hook to perform expensive rebuilding operations (which are only
+  // designed to happen on full cache clears), rather than just returning a
+  // list of cache tables to be cleared.
+  $cache_object = cache_get('system_cache_tables');
+  if (empty($cache_object)) {
+    $core = array('cache', 'cache_path', 'cache_filter', 'cache_page', 'cache_form', 'cache_menu');
+    $cache_tables = array_merge(module_invoke_all('flush_caches'), $core);
+    cache_set('system_cache_tables', $cache_tables);
+  }
+  else {
+    $cache_tables = $cache_object->data;
+  }
   foreach ($cache_tables as $table) {
     cache_clear_all(NULL, $table);
   }

modules/system/system.test

@@ -389,6 +389,18 @@ class ModuleDependencyTestCase extends ModuleTestCase {
     );
   }
 
+  /**
+   * Checks functionality of project namespaces for dependencies.
+   */
+  function testProjectNamespaceForDependencies() {
+    // Enable module with project namespace to ensure nothing breaks.
+    $edit = array(
+      'modules[Testing][system_project_namespace_test][enable]' => TRUE,
+    );
+    $this->drupalPost('admin/modules', $edit, t('Save configuration'));
+    $this->assertModules(array('system_project_namespace_test'), TRUE);
+  }
+
   /**
    * Attempt to enable translation module without locale enabled.
    */
@@ -893,6 +905,29 @@ class CronRunTestCase extends DrupalWebTestCase {
     $result = variable_get('common_test_cron');
     $this->assertEqual($result, 'success', 'Cron correctly handles exceptions thrown during hook_cron() invocations.');
   }
+
+  /**
+   * Tests that hook_flush_caches() is not invoked on every single cron run.
+   *
+   * @see system_cron()
+   */
+  public function testCronCacheExpiration() {
+    module_enable(array('system_cron_test'));
+    variable_del('system_cron_test_flush_caches');
+
+    // Invoke cron the first time: hook_flush_caches() should be called and then
+    // get cached.
+    drupal_cron_run();
+    $this->assertEqual(variable_get('system_cron_test_flush_caches'), 1, 'hook_flush_caches() was invoked the first time.');
+    $cache = cache_get('system_cache_tables');
+    $this->assertEqual(empty($cache), FALSE, 'Cache is filled with cache table data.');
+
+    // Run cron again and ensure that hook_flush_caches() is not called.
+    variable_del('system_cron_test_flush_caches');
+    drupal_cron_run();
+    $this->assertNull(variable_get('system_cron_test_flush_caches'), 'hook_flush_caches() was not invoked the second time.');
+  }
+
 }
 
 /**
@@ -911,7 +946,7 @@ class CronQueueTestCase extends DrupalWebTestCase {
   }
 
   function setUp() {
-    parent::setUp(array('common_test', 'common_test_cron_helper'));
+    parent::setUp(array('common_test', 'common_test_cron_helper', 'cron_queue_test'));
   }
 
   /**
@@ -931,6 +966,23 @@ class CronQueueTestCase extends DrupalWebTestCase {
     $this->assertEqual($queue->numberOfItems(), 1, 'Failing item still in the queue after throwing an exception.');
   }
 
+  /**
+   * Tests worker defined as a class method callable.
+   */
+  function testCallable() {
+    $queue = DrupalQueue::get('cron_queue_test_callback');
+
+    // Enqueue an item for processing.
+    $queue->createItem(array($this->randomName() => $this->randomName()));
+
+    // Run cron; the worker should perform the task and delete the item from the
+    // queue.
+    $this->cronRun();
+
+    // The queue should be empty.
+    $this->assertEqual($queue->numberOfItems(), 0);
+  }
+
 }
 
 class AdminMetaTagTestCase extends DrupalWebTestCase {
@@ -1298,7 +1350,23 @@ class DateTimeFunctionalTest extends DrupalWebTestCase {
     $this->assertEqual($this->getUrl(), url('admin/config/regional/date-time/formats', array('absolute' => TRUE)), 'Correct page redirection.');
     $this->assertText(t('Custom date format updated.'), 'Custom date format successfully updated.');
 
+    // Check that ajax callback is protected by CSRF token.
+    $this->drupalGet('admin/config/regional/date-time/formats/lookup', array('query' => array('format' => 'Y m d')));
+    $this->assertResponse(403, 'Access denied with no token');
+    $this->drupalGet('admin/config/regional/date-time/formats/lookup', array('query' => array('token' => 'invalid', 'format' => 'Y m d')));
+    $this->assertResponse(403, 'Access denied with invalid token');
+    $this->drupalGet('admin/config/regional/date-time/formats');
+    $this->clickLink(t('edit'));
+    $settings = $this->drupalGetSettings();
+    $lookup_url = $settings['dateTime']['date-format']['lookup'];
+    preg_match('/token=([^&]+)/', $lookup_url, $matches);
+    $this->assertFalse(empty($matches[1]), 'Found token value');
+    $this->drupalGet('admin/config/regional/date-time/formats/lookup', array('query' => array('token' => $matches[1], 'format' => 'Y m d')));
+    $this->assertResponse(200, 'Access allowed with valid token');
+    $this->assertText(format_date(time(), 'custom', 'Y m d'));
+
     // Delete custom date format.
+    $this->drupalGet('admin/config/regional/date-time/formats');
     $this->clickLink(t('delete'));
     $this->drupalPost($this->getUrl(), array(), t('Remove'));
     $this->assertEqual($this->getUrl(), url('admin/config/regional/date-time/formats', array('absolute' => TRUE)), 'Correct page redirection.');

modules/system/tests/cron_queue_test.info

@@ -5,8 +5,8 @@ version = VERSION
 core = 7.x
 hidden = TRUE
 
-; Information added by Drupal.org packaging script on 2015-08-19
-version = "7.39"
+; Information added by Drupal.org packaging script on 2016-02-24
+version = "7.43"
 project = "drupal"
-datestamp = "1440020197"
+datestamp = "1456343506"
 

modules/system/tests/cron_queue_test.module

@@ -7,9 +7,21 @@ function cron_queue_test_cron_queue_info() {
   $queues['cron_queue_test_exception'] = array(
     'worker callback' => 'cron_queue_test_exception',
   );
+  $queues['cron_queue_test_callback'] = array(
+    'worker callback' => array('CronQueueTestCallbackClass', 'foo'),
+  );
+
   return $queues;
 }
 
 function cron_queue_test_exception($item) {
   throw new Exception('That is not supposed to happen.');
 }
+
+class CronQueueTestCallbackClass {
+
+  static public function foo() {
+    // Do nothing.
+  }
+
+}

modules/system/tests/system_cron_test.info

@@ -0,0 +1,12 @@
+name = System Cron Test
+description = 'Support module for testing the system_cron().'
+package = Testing
+version = VERSION
+core = 7.x
+hidden = TRUE
+
+; Information added by Drupal.org packaging script on 2016-02-24
+version = "7.43"
+project = "drupal"
+datestamp = "1456343506"
+

modules/system/tests/system_cron_test.module

@@ -0,0 +1,15 @@
+<?php
+
+/**
+ * @file
+ * Helper module for CronRunTestCase::testCronCacheExpiration().
+ */
+
+/**
+ * Implements hook_flush_caches().
+ */
+function system_cron_test_flush_caches() {
+  // Set a variable to indicate that this hook was invoked.
+  variable_set('system_cron_test_flush_caches', 1);
+  return array();
+}