security updates

have to check views and entityreference for custom patches

sites/all/modules/contrib/mail/simplenews/includes/simplenews.admin.inc

@@ -862,7 +862,7 @@ function simplenews_subscription_list_export($form, &$form_state) {
     '#options' => array(
       'subscribed' => t('Subscribed to the newsletter'),
       'unconfirmed' => t('Unconfirmed to the newsletter'),
-      'unsubscribed' => t('UnSubscribed from the newsletter'),
+      'unsubscribed' => t('Unsubscribed from the newsletter'),
     ),
     '#default_value' => $default['subscribed'],
     '#description' => t('Subscriptions matching the selected subscription states will be exported.'),
@@ -1112,7 +1112,7 @@ function simplenews_subscription_list_form() {
 
   foreach ($result as $subscriber) {
     $options[$subscriber->snid] = array(
-      'mail' => $subscriber->mail,
+      'mail' => check_plain($subscriber->mail),
       'username' => isset($subscriber->uid) ? l($subscriber->name, 'user/' . $subscriber->uid) : check_plain($subscriber->name),
       'status' => theme('simplenews_status', array('source' => 'activated', 'status' => $subscriber->activated)),
       'language' => check_plain($subscriber->language),

sites/all/modules/contrib/mail/simplenews/includes/simplenews.subscription.inc

@@ -229,7 +229,7 @@ function simplenews_subscriptions_page_form($form, &$form_state, $code = NULL) {
   // Get newsletters for subscription form checkboxes.
   // Newsletters with opt-in/out method 'hidden' will not be listed.
   foreach (simplenews_category_get_visible() as $newsletter) {
-    $options[$newsletter->tid] = check_plain($newsletter->name);
+    $options[$newsletter->tid] = check_plain(_simplenews_newsletter_name($newsletter));
     $default_value[$newsletter->tid] = FALSE;
   }
 
@@ -395,7 +395,7 @@ function simplenews_subscriptions_multi_block_form($form, &$form_state) {
   // Get newsletters for subscription form checkboxes.
   // Newsletters with opt-in/out method 'hidden' will not be listed.
   foreach (simplenews_category_get_visible() as $newsletter) {
-    $options[$newsletter->tid] = check_plain($newsletter->name);
+    $options[$newsletter->tid] = check_plain(_simplenews_newsletter_name($newsletter));
     $default_value[$newsletter->tid] = FALSE;
   }
 
@@ -726,7 +726,7 @@ function simplenews_subscriptions_admin_form($form, &$form_state, $snid) {
   // Get newsletters for subscription form checkboxes.
   // Newsletters with opt-in/out method 'hidden' will not be listed.
   foreach (simplenews_category_get_visible() as $newsletter) {
-    $options[$newsletter->tid] = check_plain($newsletter->name);
+    $options[$newsletter->tid] = check_plain(_simplenews_newsletter_name($newsletter));
     $default_value[$newsletter->tid] = FALSE;
   }
 
@@ -760,7 +760,7 @@ function simplenews_subscriptions_admin_form($form, &$form_state, $snid) {
     }
     $form['language'] = array(
       '#type' => 'fieldset',
-      '#title' => 'Preferred language',
+      '#title' => t('Preferred language'),
       '#description' => t('The e-mails will be localized in language chosen. Real users have their preference in account settings.'),
       '#disabled' => FALSE,
     );

sites/all/modules/contrib/mail/simplenews/includes/views/simplenews.views.inc

@@ -350,8 +350,10 @@ function simplenews_views_data() {
       'click sortable' => TRUE,
     ),
     'filter' => array(
-      'handler' => 'views_handler_filter_boolean',
-      'allow empty' => TRUE,
+      'handler' => 'views_handler_filter_boolean_operator',
+      'label' => t('Activated'),
+      'type' => 'yes-no',
+      'accept null' => TRUE,
     ),
     'argument' => array(
       'handler' => 'views_handler_argument_numeric',

sites/all/modules/contrib/mail/simplenews/simplenews.info

@@ -21,9 +21,9 @@ files[] = includes/views/handlers/simplenews_handler_filter_category_hyperlinks.
 files[] = includes/views/handlers/simplenews_handler_filter_category_new_account.inc
 files[] = includes/views/handlers/simplenews_handler_filter_category_opt_inout.inc
 
-; Information added by drupal.org packaging script on 2012-09-09
-version = "7.x-1.0"
+; Information added by drupal.org packaging script on 2013-10-16
+version = "7.x-1.1"
 core = "7.x"
 project = "simplenews"
-datestamp = "1347191876"
+datestamp = "1381947969"
 

sites/all/modules/contrib/mail/simplenews/simplenews_rules/simplenews_rules.info

@@ -5,9 +5,9 @@ dependencies[] = rules
 package = Mail
 core = 7.x
 
-; Information added by drupal.org packaging script on 2012-09-09
-version = "7.x-1.0"
+; Information added by drupal.org packaging script on 2013-10-16
+version = "7.x-1.1"
 core = "7.x"
 project = "simplenews"
-datestamp = "1347191876"
+datestamp = "1381947969"
 

sites/all/modules/contrib/mail/simplenews/tests/simplenews.test

@@ -13,8 +13,11 @@ class SimplenewsTestCase extends DrupalWebTestCase {
   // Store generated email addresses used to prevent duplications.
   protected $mailadress_cache;
 
-  public function setUp($modules = array()) {
-
+  public function setUp() {
+    $modules = func_get_args();
+    if (isset($modules[0]) && is_array($modules[0])) {
+      $modules = $modules[0];
+    }
     $modules = array_merge(array('taxonomy', 'simplenews'), $modules);
     parent::setUp($modules);
 
@@ -171,7 +174,7 @@ class SimplenewsSubscribeTestCase extends SimplenewsTestCase {
   /**
    * Implement getInfo().
    */
-  function getInfo() {
+  static function getInfo() {
     return array(
       'name' => t('Subscribe and unsubscribe users'),
       'description' => t('(un)subscription of anonymous and authenticated users. Subscription via block, subscription page and account page'),
@@ -985,7 +988,7 @@ class SimpleNewsAdministrationTestCase extends SimplenewsTestCase {
   /**
    * Implement getInfo().
    */
-  function getInfo() {
+  static function getInfo() {
     return array(
       'name' => t('Simplenews administration'),
       'description' => t('Managing of newsletter categories and content types.'),
@@ -1544,6 +1547,19 @@ class SimpleNewsAdministrationTestCase extends SimplenewsTestCase {
     $this->assertFalse(simplenews_user_is_subscribed($subscriber->mail, reset($subscriber->tids), t('Subscriber not subscribed anymore.')));
 
     // @todo Test Admin subscriber edit preferred language $subscription->language
+
+    // Register a subscriber with an insecure e-mail address through the API
+    // and make sure the address is correctly encoded.
+    $xss_mail = "<script>alert('XSS');</script>";
+    simplenews_subscribe_user($xss_mail, $this->getRandomNewsletter(), FALSE);
+    $this->drupalGet('admin/people/simplenews');
+    $this->assertNoRaw($xss_mail);
+    $this->assertRaw(check_plain($xss_mail));
+
+    $xss_subscriber = simplenews_subscriber_load_by_mail($xss_mail);
+    $this->drupalGet('admin/people/simplenews/users/edit/' . $xss_subscriber->snid);
+    $this->assertNoRaw($xss_mail);
+    $this->assertRaw(check_plain($xss_mail));
   }
 
   /**
@@ -1611,7 +1627,7 @@ class SimpleNewsI18nTestCase extends SimplenewsTestCase {
   /**
    * Implementation of getInfo().
    */
-  function getInfo() {
+  static function getInfo() {
     return array(
       'name' => t('Simplenews I18n'),
       'description' => t('Translation of newsletter categories'),
@@ -2019,7 +2035,7 @@ class SimplenewsSendTestCase extends SimplenewsTestCase {
   /**
    * Implementation of getInfo().
    */
-  function getInfo() {
+  static function getInfo() {
     return array(
       'name' => t('Sending newsletters'),
       'description' => t('Creating and sending of newsletters, different send processes (with/without cron, send on publish)'),
@@ -2546,7 +2562,7 @@ class SimplenewsSourceTestCase extends SimplenewsTestCase {
   /**
    * Implementation of getInfo().
    */
-  function getInfo() {
+  static function getInfo() {
     return array(
       'name' => t('Source tests'),
       'description' => t('Tests for the new source interfaces and concepts.'),
@@ -2929,7 +2945,7 @@ class SimplenewsSourceTestCase extends SimplenewsTestCase {
  */
 class SimplenewsUnitTest extends DrupalUnitTestCase {
 
-  function getInfo() {
+  static function getInfo() {
     return array(
       'name' => 'Unit tests',
       'description' => 'Unit tests for certain functions.',