applied security views modules updates

didn't repatched view module, keep it in mind, may be necessary
This commit is contained in:
Bachir Soussi Chiadmi 2017-05-24 19:35:05 +02:00
parent 5b82dfb691
commit d9f3677b98
49 changed files with 364 additions and 218 deletions

View File

@ -22,7 +22,7 @@
*/
.form-actions {
float: left;
float: right;
}
/* @end */

View File

@ -61,7 +61,6 @@ class views_handler_area_result extends views_handler_area {
// Calculate the page totals.
$current_page = (int) $this->view->get_current_page() + 1;
$per_page = (int) $this->view->get_items_per_page();
$count = count($this->view->result);
// @TODO: Maybe use a possible is views empty functionality.
// Not every view has total_rows set, use view->result instead.
$total = isset($this->view->total_rows) ? $this->view->total_rows : count($this->view->result);

View File

@ -372,8 +372,7 @@ class views_handler_field extends views_handler {
* Optional name of the field where the value is stored.
*/
function get_value($values, $field = NULL) {
// $alias = isset($field) ? $this->aliases[$field] : $this->field_alias;
$alias = isset($field) && isset($this->aliases[$field]) ? $this->aliases[$field] : $this->field_alias;
$alias = isset($field) ? $this->aliases[$field] : $this->field_alias;
if (isset($values->{$alias})) {
return $values->{$alias};
}

View File

@ -589,8 +589,11 @@ class views_handler_filter extends views_handler {
form_error($form['expose']['identifier'], t('The identifier is required if the filter is exposed.'));
}
if (!empty($form_state['values']['options']['expose']['identifier']) && $form_state['values']['options']['expose']['identifier'] == 'value') {
form_error($form['expose']['identifier'], t('This identifier is not allowed.'));
if (!empty($form_state['values']['options']['expose']['identifier'])) {
$illegal_identifiers = array('value', 'q');
if (in_array($form_state['values']['options']['expose']['identifier'], $illegal_identifiers)) {
form_error($form['expose']['identifier'], t('This identifier is not allowed.'));
}
}
if (!$this->view->display_handler->is_identifier_unique($form_state['id'], $form_state['values']['options']['expose']['identifier'])) {
@ -607,8 +610,11 @@ class views_handler_filter extends views_handler {
form_error($form['group_info']['identifier'], t('The identifier is required if the filter is exposed.'));
}
if (!empty($form_state['values']['options']['group_info']['identifier']) && $form_state['values']['options']['group_info']['identifier'] == 'value') {
form_error($form['group_info']['identifier'], t('This identifier is not allowed.'));
if (!empty($form_state['values']['options']['group_info']['identifier'])) {
$illegal_identifiers = array('value', 'q');
if (in_array($form_state['values']['options']['group_info']['identifier'], $illegal_identifiers)) {
form_error($form['group_info']['identifier'], t('This identifier is not allowed.'));
}
}
if (!$this->view->display_handler->is_identifier_unique($form_state['id'], $form_state['values']['options']['group_info']['identifier'])) {

View File

@ -18,6 +18,7 @@ function yourmodule_views_data() {
'handler' => 'yourmodule_handler_collapsible_area_text',
),
);
return $data;
}
</pre>

View File

@ -994,7 +994,7 @@ function views_ui_edit_form($form, &$form_state, $view, $display_id = NULL) {
// @todo When more functionality is added to this form, cloning here may be
// too soon. But some of what we do with $view later in this function
// results in making it unserializable due to PDO limitations.
$form_state['view'] = clone($view);
$form_state['view'] = clone $view;
$form['#attached']['library'][] = array('system', 'ui.tabs');
$form['#attached']['library'][] = array('system', 'ui.dialog');

View File

@ -46,9 +46,12 @@ function views_ajax() {
$_GET['q'] = $path;
}
// Add all $_POST data, because AJAX is always a post and many things,
// If page parameter is in the $_POST exclude it from $_GET,
// otherwise support views_ajax requests using $_GET.
$exclude = isset($_POST['page']) ? array('page') : array();
// Add all $_POST data to $_GET as many things,
// such as tablesorts, exposed filters and paging assume $_GET.
$_GET = $_POST + drupal_get_query_parameters($_GET, array('page'));
$_GET = $_POST + drupal_get_query_parameters($_GET, $exclude);
// Overwrite the destination.
// @see drupal_get_destination()
@ -343,7 +346,7 @@ function views_ajax_autocomplete_taxonomy($vid, $tags_typed = '') {
$query = db_select('taxonomy_term_data', 't');
$query->addTag('translatable');
$query->addTag('term_access');
$query->addTag('taxonomy_term_access');
// Do not select already entered terms.
if (!empty($tags_typed)) {

View File

@ -1544,9 +1544,10 @@ class views_join {
// Tack on the extra.
if (isset($this->extra)) {
if (is_array($this->extra)) {
$extras = array();
foreach ($this->extra as $info) {
$extras = array();
foreach ($this->extra as $info) {
if (is_array($info)) {
$extra = '';
// Figure out the table name. Remember, only use aliases provided
// if at all possible.
$join_table = '';
@ -1564,76 +1565,49 @@ class views_join {
}
}
// If left_field is set use it for a field-to-field condition.
if (!empty($info['left_field'])) {
$operator = !empty($info['operator']) ? $info['operator'] : '=';
$left_table = (isset($info['left_table'])) ? $info['left_table'] : $left['alias'];
$extras[] = "$join_table$info[field] $operator $left_table.$info[left_field]";
}
// Else if formula is set, us it for a flexible on clause.
elseif (!empty($info['formula'])) {
// If a field is given, we build a "$field $op $formula".
// Without it would only be "$formula".
$extra = '';
if (isset($info['field'])) {
// With a single value, the '=' operator is implicit.
$operator = !empty($info['operator']) ? $info['operator'] : '=';
$extra .= "$join_table$info[field] $operator ";
}
$extra .= $info['formula'];
// Add placeholder arguments.
if (isset($info['formula_arguments']) && is_array($info['formula_arguments'])) {
$arguments = array_merge($arguments, $info['formula_arguments']);
}
$extras[] = $extra;
}
// Otherwise - and if we have a value - use it for a field-to-value condition.
elseif (!empty($info['value'])) {
// Convert a single-valued array of values to the single-value case,
// and transform from IN() notation to = notation
if (is_array($info['value']) && count($info['value']) == 1) {
if (empty($info['operator'])) {
$operator = '=';
}
else {
$operator = $info['operator'] == 'NOT IN' ? '!=' : '=';
}
$info['value'] = array_shift($info['value']);
}
if (is_array($info['value'])) {
// With an array of values, we need multiple placeholders and the
// 'IN' operator is implicit.
foreach ($info['value'] as $value) {
$placeholder_i = ':views_join_condition_' . $select_query->nextPlaceholder();
$arguments[$placeholder_i] = $value;
}
$operator = !empty($info['operator']) ? $info['operator'] : 'IN';
$placeholder = '( ' . implode(', ', array_keys($arguments)) . ' )';
// Convert a single-valued array of values to the single-value case,
// and transform from IN() notation to = notation
if (is_array($info['value']) && count($info['value']) == 1) {
if (empty($info['operator'])) {
$operator = '=';
}
else {
// With a single value, the '=' operator is implicit.
$operator = !empty($info['operator']) ? $info['operator'] : '=';
$placeholder = ':views_join_condition_' . $select_query->nextPlaceholder();
$arguments[$placeholder] = $info['value'];
$operator = $info['operator'] == 'NOT IN' ? '!=' : '=';
}
$info['value'] = array_shift($info['value']);
}
if (is_array($info['value'])) {
// With an array of values, we need multiple placeholders and the
// 'IN' operator is implicit.
foreach ($info['value'] as $value) {
$placeholder_i = $view_query->placeholder('views_join_condition_');
$arguments[$placeholder_i] = $value;
}
$extras[] = "$join_table$info[field] $operator $placeholder";
}
}
if ($extras) {
if (count($extras) == 1) {
$condition .= ' AND ' . array_shift($extras);
$operator = !empty($info['operator']) ? $info['operator'] : 'IN';
$placeholder = '( ' . implode(', ', array_keys($arguments)) . ' )';
}
else {
$condition .= ' AND (' . implode(' ' . $this->extra_type . ' ', $extras) . ')';
// With a single value, the '=' operator is implicit.
$operator = !empty($info['operator']) ? $info['operator'] : '=';
$placeholder = $view_query->placeholder('views_join_condition_');
$arguments[$placeholder] = $info['value'];
}
$extras[] = "$join_table$info[field] $operator $placeholder";
}
elseif (is_string($info)) {
$extras[] = $info;
}
}
elseif ($this->extra && is_string($this->extra)) {
$condition .= " AND ($this->extra)";
if ($extras) {
if (count($extras) == 1) {
$condition .= ' AND ' . array_shift($extras);
}
else {
$condition .= ' AND (' . implode(' ' . $this->extra_type . ' ', $extras) . ')';
}
}
}
@ -1681,11 +1655,13 @@ class views_join_subquery extends views_join {
$arguments = array();
// Tack on the extra.
// This is just copied verbatim from the parent class, which itself has a bug: http://drupal.org/node/1118100
// This is just copied verbatim from the parent class, which itself has a
// bug: http://drupal.org/node/1118100
if (isset($this->extra)) {
if (is_array($this->extra)) {
$extras = array();
foreach ($this->extra as $info) {
$extras = array();
foreach ($this->extra as $info) {
if (is_array($info)) {
$extra = '';
// Figure out the table name. Remember, only use aliases provided
// if at all possible.
$join_table = '';
@ -1713,18 +1689,18 @@ class views_join_subquery extends views_join {
$extras[] = "$join_table$info[field] $operator $placeholder";
$arguments[$placeholder] = $info['value'];
}
if ($extras) {
if (count($extras) == 1) {
$condition .= ' AND ' . array_shift($extras);
}
else {
$condition .= ' AND (' . implode(' ' . $this->extra_type . ' ', $extras) . ')';
}
elseif (is_string($info)) {
$extras[] = $info;
}
}
elseif ($this->extra && is_string($this->extra)) {
$condition .= " AND ($this->extra)";
if ($extras) {
if (count($extras) == 1) {
$condition .= ' AND ' . array_shift($extras);
}
else {
$condition .= ' AND (' . implode(' ' . $this->extra_type . ' ', $extras) . ')';
}
}
}

View File

@ -411,18 +411,8 @@ class view extends views_db_object {
* Figure out what the exposed input for this view is.
*/
function get_exposed_input() {
// Fill our input either from $_GET or from something previously set on the
// view.
if (empty($this->exposed_input)) {
$this->exposed_input = $_GET;
// unset items that are definitely not our input:
foreach (array('page', 'q') as $key) {
if (isset($this->exposed_input[$key])) {
unset($this->exposed_input[$key]);
}
}
// If we have no input at all, check for remembered input via session.
$this->exposed_input = array();
// If filters are not overridden, store the 'remember' settings on the
// default display. If they are, store them on this display. This way,
@ -430,9 +420,17 @@ class view extends views_db_object {
// remember settings.
$display_id = ($this->display_handler->is_defaulted('filters')) ? 'default' : $this->current_display;
if (empty($this->exposed_input) && !empty($_SESSION['views'][$this->name][$display_id])) {
// Start with remembered input via session.
if (!empty($_SESSION['views'][$this->name][$display_id])) {
$this->exposed_input = $_SESSION['views'][$this->name][$display_id];
}
// Fetch exposed input values from $_GET. Overwrite if clashing.
foreach ($_GET as $key => $value) {
if (!in_array($key, array('page', 'q'))) {
$this->exposed_input[$key] = $value;
}
}
}
return $this->exposed_input;
@ -685,6 +683,10 @@ class view extends views_db_object {
*/
function init_pager() {
if (empty($this->query->pager)) {
// If the query doesn't exist, initialize it.
if (empty($this->query)) {
$this->init_query();
}
$this->query->pager = $this->display_handler->get_plugin('pager');
if ($this->query->pager->use_pager()) {
@ -1282,7 +1284,7 @@ class view extends views_db_object {
foreach ($GLOBALS['base_theme_info'] as $base) {
$function = $base->name . '_views_post_render';
if (function_exists($function)) {
$function($this);
$function($this, $this->display_handler->output, $cache);
}
}
$function = $GLOBALS['theme'] . '_views_post_render';
@ -1478,7 +1480,7 @@ class view extends views_db_object {
* this sets the display handler if it hasn't been.
*/
function access($displays = NULL, $account = NULL) {
// Noone should have access to disabled views.
// No one should have access to disabled views.
if (!empty($this->disabled)) {
return FALSE;
}
@ -1960,12 +1962,12 @@ class view extends views_db_object {
* The cloned view.
*/
function clone_view() {
$clone = version_compare(phpversion(), '5.0') < 0 ? $this : clone($this);
$clone = clone $this;
$keys = array('current_display', 'display_handler', 'build_info', 'built', 'executed', 'attachment_before', 'attachment_after', 'field', 'argument', 'filter', 'sort', 'relationship', 'header', 'footer', 'empty', 'query', 'inited', 'style_plugin', 'plugin_name', 'exposed_data', 'exposed_input', 'exposed_widgets', 'many_to_one_tables', 'feed_icon');
foreach ($keys as $key) {
if (isset($clone->$key)) {
unset($clone->$key);
if (isset($clone->{$key})) {
unset($clone->{$key});
}
}
$clone->built = $clone->executed = FALSE;
@ -1994,7 +1996,7 @@ class view extends views_db_object {
*/
function destroy() {
foreach (array_keys($this->display) as $display_id) {
if (isset($this->display[$display_id]->handler)) {
if (isset($this->display[$display_id]->handler) && is_object($this->display[$display_id]->handler)) {
$this->display[$display_id]->handler->destroy();
unset($this->display[$display_id]->handler);
}

View File

@ -60,6 +60,9 @@ Drupal.views.ajaxView = function(settings) {
this.$exposed_form = $('#views-exposed-form-'+ settings.view_name.replace(/_/g, '-') + '-' + settings.view_display_id.replace(/_/g, '-'));
this.$exposed_form.once(jQuery.proxy(this.attachExposedFormAjax, this));
// Store Drupal.ajax objects here for all pager links.
this.links = [];
// Add the ajax to pagers.
this.$view
// Don't attach to nested views. Doing so would attach multiple behaviors
@ -123,6 +126,7 @@ Drupal.views.ajaxView.prototype.attachPagerLinkAjax = function(id, link) {
this.element_settings.submit = viewData;
this.pagerAjax = new Drupal.ajax(false, $link, this.element_settings);
this.links.push(this.pagerAjax);
};
Drupal.ajax.prototype.commands.viewsScrollTop = function (ajax, response, status) {

View File

@ -64,6 +64,11 @@ Drupal.Views.parseQueryString = function (query) {
* Helper function to return a view's arguments based on a path.
*/
Drupal.Views.parseViewArgs = function (href, viewPath) {
// Provide language prefix.
if (Drupal.settings.pathPrefix) {
var viewPath = Drupal.settings.pathPrefix + viewPath;
}
var returnObj = {};
var path = Drupal.Views.getPath(href);
// Ensure we have a correct path.
@ -99,7 +104,7 @@ Drupal.Views.getPath = function (href) {
href = href.substring(3, href.length);
}
var chars = ['#', '?', '&'];
for (i in chars) {
for (var i in chars) {
if (href.indexOf(chars[i]) > -1) {
href = href.substr(0, href.indexOf(chars[i]));
}

View File

@ -168,6 +168,59 @@ function comment_views_data() {
),
);
$data['comment']['created_fulldata'] = array(
'title' => t('Created date'),
'help' => t('Date in the form of CCYYMMDD.'),
'argument' => array(
'field' => 'created',
'handler' => 'views_handler_argument_node_created_fulldate',
),
);
$data['comment']['created_year_month'] = array(
'title' => t('Created year + month'),
'help' => t('Date in the form of YYYYMM.'),
'argument' => array(
'field' => 'created',
'handler' => 'views_handler_argument_node_created_year_month',
),
);
$data['comment']['created_year'] = array(
'title' => t('Created year'),
'help' => t('Date in the form of YYYY.'),
'argument' => array(
'field' => 'created',
'handler' => 'views_handler_argument_node_created_year',
),
);
$data['comment']['created_month'] = array(
'title' => t('Created month'),
'help' => t('Date in the form of MM (01 - 12).'),
'argument' => array(
'field' => 'created',
'handler' => 'views_handler_argument_node_created_month',
),
);
$data['comment']['created_day'] = array(
'title' => t('Created day'),
'help' => t('Date in the form of DD (01 - 31).'),
'argument' => array(
'field' => 'created',
'handler' => 'views_handler_argument_node_created_day',
),
);
$data['comment']['created_week'] = array(
'title' => t('Created week'),
'help' => t('Date in the form of WW (01 - 53).'),
'argument' => array(
'field' => 'created',
'handler' => 'views_handler_argument_node_created_week',
),
);
// Language field
if (module_exists('locale')) {
@ -209,7 +262,7 @@ function comment_views_data() {
$data['comments']['timestamp_fulldate']['moved to'] = array('comment', 'changed_fulldata');
$data['comment']['changed_fulldata'] = array(
'title' => t('Created date'),
'title' => t('Changed date'),
'help' => t('Date in the form of CCYYMMDD.'),
'argument' => array(
'field' => 'changed',
@ -219,7 +272,7 @@ function comment_views_data() {
$data['comments']['timestamp_year_month']['moved to'] = array('comment', 'changed_year_month');
$data['comment']['changed_year_month'] = array(
'title' => t('Created year + month'),
'title' => t('Changed year + month'),
'help' => t('Date in the form of YYYYMM.'),
'argument' => array(
'field' => 'changed',
@ -229,7 +282,7 @@ function comment_views_data() {
$data['comments']['timestamp_year']['moved to'] = array('comment', 'changed_year');
$data['comment']['changed_year'] = array(
'title' => t('Created year'),
'title' => t('Changed year'),
'help' => t('Date in the form of YYYY.'),
'argument' => array(
'field' => 'changed',
@ -239,7 +292,7 @@ function comment_views_data() {
$data['comments']['timestamp_month']['moved to'] = array('comment', 'changed_month');
$data['comment']['changed_month'] = array(
'title' => t('Created month'),
'title' => t('Changed month'),
'help' => t('Date in the form of MM (01 - 12).'),
'argument' => array(
'field' => 'changed',
@ -249,7 +302,7 @@ function comment_views_data() {
$data['comments']['timestamp_day']['moved to'] = array('comment', 'changed_day');
$data['comment']['changed_day'] = array(
'title' => t('Created day'),
'title' => t('Changed day'),
'help' => t('Date in the form of DD (01 - 31).'),
'argument' => array(
'field' => 'changed',
@ -259,7 +312,7 @@ function comment_views_data() {
$data['comments']['timestamp_week']['moved to'] = array('comment', 'changed_week');
$data['comment']['changed_week'] = array(
'title' => t('Created week'),
'title' => t('Changed week'),
'help' => t('Date in the form of WW (01 - 53).'),
'argument' => array(
'field' => 'changed',

View File

@ -733,7 +733,7 @@ function node_row_node_view_preprocess_node(&$vars) {
unset($vars['content']['links']);
}
if (!empty($options['comments']) && user_access('access comments') && $node->comment) {
if (module_exists('comments') && !empty($options['comments']) && user_access('access comments') && $node->comment) {
$vars['content']['comments'] = comment_node_page_additions($node);
}
}

View File

@ -33,7 +33,10 @@ class views_handler_argument_node_created_fulldate extends views_handler_argumen
* Provide a link to the next level of the view
*/
function title() {
return format_date(strtotime($this->argument . " 00:00:00 UTC"), 'custom', $this->format, 'UTC');
$timestamp = strtotime($this->argument . " 00:00:00 UTC");
if ($timestamp !== FALSE) {
return format_date($timestamp, 'custom', $this->format, 'UTC');
}
}
}
@ -77,7 +80,10 @@ class views_handler_argument_node_created_year_month extends views_handler_argum
* Provide a link to the next level of the view
*/
function title() {
return format_date(strtotime($this->argument . "15" . " 00:00:00 UTC"), 'custom', $this->format, 'UTC');
$timestamp = strtotime($this->argument . "15" . " 00:00:00 UTC");
if ($timestamp !== FALSE) {
return format_date($timestamp, 'custom', $this->format, 'UTC');
}
}
}
@ -108,7 +114,10 @@ class views_handler_argument_node_created_month extends views_handler_argument_d
*/
function title() {
$month = str_pad($this->argument, 2, '0', STR_PAD_LEFT);
return format_date(strtotime("2005" . $month . "15" . " 00:00:00 UTC"), 'custom', $this->format, 'UTC');
$timestamp = strtotime("2005" . $month . "15" . " 00:00:00 UTC");
if ($timestamp !== FALSE) {
return format_date($timestamp, 'custom', $this->format, 'UTC');
}
}
function summary_argument($data) {
@ -145,7 +154,10 @@ class views_handler_argument_node_created_day extends views_handler_argument_dat
*/
function title() {
$day = str_pad($this->argument, 2, '0', STR_PAD_LEFT);
return format_date(strtotime("2005" . "05" . $day . " 00:00:00 UTC"), 'custom', $this->format, 'UTC');
$timestamp = strtotime("2005" . "05" . $day . " 00:00:00 UTC");
if ($timestamp !== FALSE) {
return format_date($timestamp, 'custom', $this->format, 'UTC');
}
}
function summary_argument($data) {

View File

@ -61,6 +61,7 @@ class views_plugin_row_node_view extends views_plugin_row {
'#type' => 'checkbox',
'#title' => t('Display comments'),
'#default_value' => $this->options['comments'],
'#access' => module_exists('comments'),
);
}
@ -107,4 +108,4 @@ class views_plugin_row_node_view extends views_plugin_row {
return drupal_render($build);
}
}
}
}

View File

@ -42,7 +42,7 @@ class views_handler_argument_search extends views_handler_argument {
}
}
if ($required) {
if ($this->operator == 'required') {
if (isset($this->operator) && ($this->operator == 'required')) {
$this->query->add_where(0, 'FALSE');
}
}

View File

@ -45,7 +45,7 @@ class views_handler_filter_search extends views_handler_filter {
$form['remove_score'] = array(
'#type' => 'checkbox',
'#title' => t('Remove search score'),
'#description' => t('Check this box to remove the search score from the query. This can help reduce help reduce duplicate search results when using this filter.'),
'#description' => t('Check this box to remove the search score from the query. This can help reduce duplicate search results when using this filter.'),
'#default_value' => $this->options['remove_score'],
);
}

View File

@ -114,7 +114,7 @@ function taxonomy_views_data() {
'field' => 'tid',
'title' => t('Term'),
'help' => t('Taxonomy terms are attached to nodes.'),
'access query tag' => 'term_access',
'access query tag' => 'taxonomy_term_access',
);
$data['taxonomy_term_data']['table']['entity type'] = 'taxonomy_term';

View File

@ -38,6 +38,7 @@ class views_handler_argument_term_node_tid extends views_handler_argument_many_t
function title_query() {
$titles = array();
$result = db_select('taxonomy_term_data', 'td')
->addTag('taxonomy_term_access')
->fields('td', array('name'))
->condition('td.tid', $this->value)
->execute();

View File

@ -22,6 +22,7 @@ class views_handler_field_taxonomy extends views_handler_field {
parent::construct();
$this->additional_fields['vid'] = 'vid';
$this->additional_fields['tid'] = 'tid';
$this->additional_fields['name'] = 'name';
$this->additional_fields['vocabulary_machine_name'] = array(
'table' => 'taxonomy_vocabulary',
'field' => 'machine_name',
@ -65,10 +66,18 @@ class views_handler_field_taxonomy extends views_handler_field {
$term = new stdClass();
$term->tid = $tid;
$term->vid = $this->get_value($values, 'vid');
$term->name = $this->get_value($values, 'name');
$term->vocabulary_machine_name = $values->{$this->aliases['vocabulary_machine_name']};
$this->options['alter']['make_link'] = TRUE;
$uri = entity_uri('taxonomy_term', $term);
if (isset($uri['options'])) {
$this->options['alter'] = array_merge($this->options['alter'], $uri['options']);
}
$this->options['alter']['path'] = $uri['path'];
// If entity_uri() returned an options array, use it.
if (isset($uri['options'])) {
$this->options['alter'] = $uri['options'] + $this->options['alter'];
}
}
if (!empty($this->options['convert_spaces'])) {

View File

@ -104,7 +104,7 @@ class views_handler_field_term_node_tid extends views_handler_field_prerender_li
$query->orderby('td.weight');
$query->orderby('td.name');
$query->condition('tn.nid', $nids);
$query->addTag('term_access');
$query->addTag('taxonomy_term_access');
$vocabs = array_filter($this->options['vocabularies']);
if (!empty($this->options['limit']) && !empty($vocabs)) {
$query->condition('tv.machine_name', $vocabs);

View File

@ -140,7 +140,7 @@ class views_handler_filter_term_node_tid extends views_handler_filter_many_to_on
$query->orderby('tv.name');
$query->orderby('td.weight');
$query->orderby('td.name');
$query->addTag('term_access');
$query->addTag('taxonomy_term_access');
if ($this->options['limit']) {
$query->condition('tv.machine_name', $vocabulary->machine_name);
}
@ -328,7 +328,7 @@ class views_handler_filter_term_node_tid extends views_handler_filter_many_to_on
$query->fields('td');
$query->condition('td.name', $names);
$query->condition('tv.machine_name', $this->options['vocabulary']);
$query->addTag('term_access');
$query->addTag('taxonomy_term_access');
$result = $query->execute();
foreach ($result as $term) {
unset($missing[strtolower($term->name)]);

View File

@ -76,7 +76,7 @@ class views_handler_relationship_node_term_data extends views_handler_relationsh
$query->addJoin($def['type'], 'taxonomy_index', 'tn', 'tn.tid = td.tid');
$query->condition('tv.machine_name', array_filter($this->options['vocabularies']));
if (empty($this->query->options['disable_sql_rewrite'])) {
$query->addTag('term_access');
$query->addTag('taxonomy_term_access');
}
$query->fields('td');
$query->fields('tn', array('nid'));

View File

@ -97,7 +97,7 @@ class views_plugin_argument_validate_taxonomy_term extends views_plugin_argument
$query->leftJoin('taxonomy_vocabulary', 'tv', 'td.vid = tv.vid');
$query->fields('td');
$query->condition('td.tid', $argument);
$query->addTag('term_access');
$query->addTag('taxonomy_term_access');
$term = $query->execute()->fetchObject();
if (!$term) {
return FALSE;
@ -139,6 +139,7 @@ class views_plugin_argument_validate_taxonomy_term extends views_plugin_argument
// if unverified tids left - verify them and cache results
if (count($test)) {
$query = db_select('taxonomy_term_data', 'td');
$query->addTag('taxonomy_term_access');
$query->leftJoin('taxonomy_vocabulary', 'tv', 'td.vid = tv.vid');
$query->fields('td');
$query->fields('tv', array('machine_name'));
@ -167,6 +168,7 @@ class views_plugin_argument_validate_taxonomy_term extends views_plugin_argument
case 'name':
case 'convert':
$query = db_select('taxonomy_term_data', 'td');
$query->addTag('taxonomy_term_access');
$query->leftJoin('taxonomy_vocabulary', 'tv', 'td.vid = tv.vid');
$query->fields('td');
$query->fields('tv', array('machine_name'));
@ -202,6 +204,7 @@ class views_plugin_argument_validate_taxonomy_term extends views_plugin_argument
$arg_keys = array_flip($args);
$query = db_select('taxonomy_term_data', 'td');
$query->addTag('taxonomy_term_access');
$query->condition('tid', $args);
$query->addField('td', 'tid', 'tid');
if (!empty($vocabularies)) {

View File

@ -74,7 +74,7 @@ class views_handler_field_user_name extends views_handler_field_user {
}
}
// If we want a formatted username, do that.
if (!empty($this->options['format_username'])) {
if (!empty($this->options['format_username']) && !is_null($account->uid)) {
return format_username($account);
}
// Otherwise, there's no special handling, so return the data directly.

View File

@ -34,7 +34,7 @@ class views_plugin_row_user_view extends views_plugin_row {
'#title' => t('View mode'),
'#default_value' => $this->options['view_mode'],
);
$form['help']['#markup'] = t("Display the user with standard user view. It might be necessary to add a user-profile.tpl.php in your themes template folder, because the default <a href=\"@user-profile-api-link\">user-profile</a>e template don't show the username per default.", array('@user-profile-api-link' => url('http://api.drupal.org/api/drupal/modules--user--user-profile.tpl.php/7')));
$form['help']['#markup'] = t("Display the user with standard user view. It might be necessary to add a user-profile.tpl.php in your theme's template folder, because the default <a href=\"@user-profile-api-link\">user-profile</a> template doesn't show the username by default.", array('@user-profile-api-link' => url('http://api.drupal.org/api/drupal/modules--user--user-profile.tpl.php/7')));
}

View File

@ -109,7 +109,7 @@ function views_views_data() {
$data['views']['combine'] = array(
'title' => t('Combine fields filter'),
'help' => t('Combine two fields together and search by them.'),
'help' => t('Combine multiple fields together and search by them.'),
'filter' => array(
'handler' => 'views_handler_filter_combine',
),

View File

@ -289,7 +289,14 @@ class views_plugin_cache extends views_plugin {
function get_results_key() {
if (!isset($this->_results_key)) {
$this->_results_key = $this->view->name . ':' . $this->display->id . ':results:' . $this->get_cache_key();
$key_data = array();
foreach (array('exposed_info', 'page', 'sort', 'order', 'items_per_page', 'offset') as $key) {
if (isset($_GET[$key])) {
$key_data[$key] = $_GET[$key];
}
}
$this->_results_key = $this->view->name . ':' . $this->display->id . ':results:' . $this->get_cache_key($key_data);
}
return $this->_results_key;
@ -298,6 +305,7 @@ class views_plugin_cache extends views_plugin {
function get_output_key() {
if (!isset($this->_output_key)) {
$key_data = array(
'result' => $this->view->result,
'theme' => $GLOBALS['theme'],
);
$this->_output_key = $this->view->name . ':' . $this->display->id . ':output:' . $this->get_cache_key($key_data);

View File

@ -41,7 +41,7 @@ class views_plugin_cache_time extends views_plugin_cache {
'#maxlength' => '30',
'#description' => t('Length of time in seconds raw query results should be cached.'),
'#default_value' => $this->options['results_lifespan_custom'],
'#process' => array('form_process_select','ctools_dependent_process'),
'#process' => array('ctools_dependent_process'),
'#dependency' => array(
'edit-cache-options-results-lifespan' => array('custom'),
),
@ -60,7 +60,7 @@ class views_plugin_cache_time extends views_plugin_cache {
'#maxlength' => '30',
'#description' => t('Length of time in seconds rendered HTML output should be cached.'),
'#default_value' => $this->options['output_lifespan_custom'],
'#process' => array('form_process_select','ctools_dependent_process'),
'#process' => array('ctools_dependent_process'),
'#dependency' => array(
'edit-cache-options-output-lifespan' => array('custom'),
),

View File

@ -1061,6 +1061,11 @@ class views_plugin_display extends views_plugin {
$title = $text;
}
// Truncate the path as it is displayed as a link.
if ($section == 'path') {
$text = views_ui_truncate($text, 24);
}
return l($text, 'admin/structure/views/nojs/display/' . $this->view->name . '/' . $this->display->id . '/' . $section, array('attributes' => array('class' => 'views-ajax-link ' . $class, 'title' => $title, 'id' => drupal_html_id('views-' . $this->display->id . '-' . $section)), 'html' => TRUE));
}
@ -1468,7 +1473,7 @@ class views_plugin_display extends views_plugin {
$form['#title'] .= t('The title of this view');
$form['title'] = array(
'#type' => 'textfield',
'#description' => t('This title will be displayed with the view, wherever titles are normally displayed; i.e, as the page title, block title, etc.'),
'#description' => t('This title will be displayed with the view, wherever titles are normally displayed; i.e, as the page title, block title, etc. Use &lt;none&gt; to not assign a title; this can allow other modules to control the page title.'),
'#default_value' => $this->get_option('title'),
);
break;
@ -2798,7 +2803,7 @@ class views_plugin_display extends views_plugin {
}
}
else {
if ($id != $key && $identifier == $handler->options['expose']['identifier']) {
if ($id != $key && isset($handler->options['expose']['identifier']) && $identifier == $handler->options['expose']['identifier']) {
return FALSE;
}
}

View File

@ -52,7 +52,8 @@ class views_plugin_display_block extends views_plugin_display {
// Prior to this being called, the $view should already be set to this
// display, and arguments should be set on the view.
$info['content'] = $this->view->render();
$info['subject'] = filter_xss_admin($this->view->get_title());
$title = $this->view->get_title();
$info['subject'] = ($title == '<none>') ? '' : filter_xss_admin($title);
if (!empty($this->view->result) || $this->get_option('empty') || !empty($this->view->style_plugin->definition['even empty'])) {
return $info;
}

View File

@ -118,6 +118,8 @@ class views_plugin_display_page extends views_plugin_display {
'access arguments' => $access_arguments,
// Identify URL embedded arguments and correlate them to a handler
'load arguments' => array($this->view->name, $this->display->id, '%index'),
// Make sure the menu router knows where views_page is.
'module' => 'views',
);
$menu = $this->get_option('menu');
if (empty($menu)) {
@ -182,6 +184,8 @@ class views_plugin_display_page extends views_plugin_display {
'title' => $tab_options['title'],
'description' => $tab_options['description'],
'menu_name' => $tab_options['name'],
// Make sure the menu router knows where views_page is.
'module' => 'views',
);
switch ($tab_options['type']) {
default:
@ -231,7 +235,13 @@ class views_plugin_display_page extends views_plugin_display {
// First execute the view so it's possible to get tokens for the title.
// And the title, which is much easier.
drupal_set_title(filter_xss_admin($this->view->get_title()), PASS_THROUGH);
$title = $this->view->get_title();
// Support the core method of using '<none>' to indicate nothing should be
// assigned to the title, so only process the title value if it is not that
// value.
if ($title != '<none>') {
drupal_set_title(filter_xss_admin($title), PASS_THROUGH);
}
return $render;
}
@ -263,7 +273,7 @@ class views_plugin_display_page extends views_plugin_display {
$options['path'] = array(
'category' => 'page',
'title' => t('Path'),
'value' => views_ui_truncate($path, 24),
'value' => $path,
);
$menu = $this->get_option('menu');

View File

@ -39,6 +39,9 @@ class views_plugin_query extends views_plugin {
*
* @param $get_count
* Provide a countquery if this is true, otherwise provide a normal query.
*
* @return SelectQuery
* A SelectQuery object.
*/
function query($get_count = FALSE) { }

View File

@ -1244,6 +1244,9 @@ class views_plugin_query_default extends views_plugin_query {
*
* @param $get_count
* Provide a countquery if this is true, otherwise provide a normal query.
*
* @return SelectQuery
* A SelectQuery object.
*/
function query($get_count = FALSE) {
// Check query distinct value.
@ -1367,7 +1370,7 @@ class views_plugin_query_default extends views_plugin_query {
}
// Add all query substitutions as metadata.
$query->addMetaData('views_substitutions', module_invoke_all('views_query_substitutions', $this));
$query->addMetaData('views_substitutions', module_invoke_all('views_query_substitutions', $this->view));
if (!$get_count) {
if (!empty($this->limit) || !empty($this->offset)) {

View File

@ -130,7 +130,7 @@ class views_plugin_style extends views_plugin {
// Explode the value by whitespace, this allows the function to handle
// a single class name and multiple class names that are then tokenized.
foreach(explode(' ', $class) as $token_class) {
$classes[] = strip_tags($this->tokenize_value($token_class, $row_index));
$classes = array_merge($classes, explode(' ', strip_tags($this->tokenize_value($token_class, $row_index))));
}
}
else {
@ -139,7 +139,7 @@ class views_plugin_style extends views_plugin {
// Convert whatever the result is to a nice clean class name
foreach ($classes as &$class) {
$class = drupal_html_class($class);
$class = drupal_clean_css_identifier($class);
}
return implode(' ', $classes);
}
@ -237,6 +237,7 @@ class views_plugin_style extends views_plugin {
'#type' => 'checkbox',
'#title' => t('Remove tags from rendered output'),
'#default_value' => $grouping['rendered_strip'],
'#description' => t('Some modules add HTML to the rendered output and prevent the rows from grouping correctly. Stripping the HTML tags should correct this.'),
'#dependency' => array(
'edit-style-options-grouping-' . $i . '-field' => array_keys($field_labels),
)

View File

@ -146,7 +146,7 @@ class views_plugin_style_jump_menu extends views_plugin_style {
$lookup_options = array();
// We need to check if the path is absolute
// or else language is not taken in account.
if ($this->view->display[$this->view->current_display]->display_options['fields'][$this->options['path']]['absolute']) {
if (!empty($this->view->display[$this->view->current_display]->display_options['fields'][$this->options['path']]['absolute'])) {
$lookup_options['absolute'] = TRUE;
}
$lookup_url = url($_GET['q'], $lookup_options);

View File

@ -84,7 +84,8 @@ abstract class views_plugin_style_mapping extends views_plugin_style {
// Optionally filter the available fields.
if (isset($mapping[$key]['#filter'])) {
$this->view->init_handlers();
$this::$mapping[$key]['#filter']($field_options);
$filter = $mapping[$key]['#filter'];
$this::$filter($field_options);
unset($mapping[$key]['#filter']);
}

View File

@ -252,11 +252,11 @@ class ViewsPluginStyleTestCase extends ViewsPluginStyleTestBase {
foreach ($rows as $row) {
$attributes = $row->attributes();
$class = (string) $attributes['class'][0];
$this->assertTrue(strpos($class, $random_name) !== FALSE, 'Take sure that a custom css class is added to the output.');
$this->assertTrue(strpos($class, $random_name) !== FALSE, 'Make sure that a custom css class is added to the output.');
// Check token replacement.
$name = drupal_html_class($view->field['name']->get_value($view->result[$count]));
$this->assertTrue(strpos($class, "test-token-$name") !== FALSE, 'Take sure that a token in custom css class is replaced.');
$name = drupal_clean_css_identifier($view->field['name']->get_value($view->result[$count]));
$this->assertTrue(strpos($class, "test-token-$name") !== FALSE, 'Make sure that a token in custom css class is replaced.');
$count++;
}

View File

@ -56,6 +56,38 @@ class ViewsExposedFormTest extends ViewsSqlTest {
$this->helperButtonHasLabel('edit-reset', $expected_label);
}
/**
* Tests that exposed values are correctly stored.
*/
public function testRemember() {
$account = $this->drupalCreateUser();
$this->drupalLogin($account);
// Create some random nodes.
for ($i = 0; $i < 5; $i++) {
$this->drupalCreateNode();
}
// Set the exposed filter.
$this->drupalGet('test_exposed_remember', array('query' => array('type' => 'page')));
$this->assertFieldByName('type', 'page');
// Request the page again, should still be set.
$this->drupalGet('test_exposed_remember');
$this->assertFieldByName('type', 'page');
// Request the page with an unrelated GET argument, filter should still be set.
$this->drupalGet('test_exposed_remember', array('query' => array('argument' => 'value')));
$this->assertFieldByName('type', 'page');
// Change the remembered exposed value.
$this->drupalGet('test_exposed_remember', array('query' => array('type' => 'article')));
$this->assertFieldByName('type', 'article');
// Request the page again, should have remembered the new value.
$this->drupalGet('test_exposed_remember');
$this->assertFieldByName('type', 'article');
}
/**
* Tests the admin interface of exposed filter and sort items.
*/

View File

@ -5,9 +5,9 @@ core = 7.x
dependencies[] = views
hidden = TRUE
; Information added by Drupal.org packaging script on 2016-06-15
version = "7.x-3.14"
; Information added by Drupal.org packaging script on 2017-04-02
version = "7.x-3.16"
core = "7.x"
project = "views"
datestamp = "1466019588"
datestamp = "1491158591"

View File

@ -218,5 +218,61 @@ function views_test_views_default_views() {
$views[$view->name] = $view;
$view = new view();
$view->name = 'test_exposed_remember';
$view->description = '';
$view->tag = '';
$view->base_table = 'node';
$view->human_name = 'test_exposed_remember';
$view->core = 0;
$view->api_version = '3.0';
$view->disabled = FALSE; /* Edit this to true to make a default view disabled initially */
/* Display: Master */
$handler = $view->new_display('default', 'Master', 'default');
$handler->display->display_options['use_more_always'] = FALSE;
$handler->display->display_options['access']['type'] = 'none';
$handler->display->display_options['cache']['type'] = 'none';
$handler->display->display_options['query']['type'] = 'views_query';
$handler->display->display_options['exposed_form']['type'] = 'basic';
$handler->display->display_options['exposed_form']['options']['reset_button'] = TRUE;
$handler->display->display_options['pager']['type'] = 'none';
$handler->display->display_options['style_plugin'] = 'default';
$handler->display->display_options['row_plugin'] = 'node';
/* Sort criterion: Content: Post date */
$handler->display->display_options['sorts']['created']['id'] = 'created';
$handler->display->display_options['sorts']['created']['table'] = 'node';
$handler->display->display_options['sorts']['created']['field'] = 'created';
/* Filter criterion: Content: Type */
$handler->display->display_options['filters']['type']['id'] = 'type';
$handler->display->display_options['filters']['type']['table'] = 'node';
$handler->display->display_options['filters']['type']['field'] = 'type';
$handler->display->display_options['filters']['type']['exposed'] = TRUE;
$handler->display->display_options['filters']['type']['expose']['operator_id'] = 'type_op';
$handler->display->display_options['filters']['type']['expose']['label'] = 'Type';
$handler->display->display_options['filters']['type']['expose']['operator'] = 'type_op';
$handler->display->display_options['filters']['type']['expose']['identifier'] = 'type';
$handler->display->display_options['filters']['type']['expose']['remember'] = TRUE;
$handler->display->display_options['filters']['type']['expose']['remember_roles'] = array(
2 => '2',
);
/* Display: Page */
$handler = $view->new_display('page', 'Page', 'page_1');
$handler->display->display_options['path'] = 'test_exposed_remember';
$translatables['test_exposed_remember'] = array(
t('Master'),
t('more'),
t('Apply'),
t('Reset'),
t('Sort by'),
t('Asc'),
t('Desc'),
t('Type'),
t('Page'),
);
$views[$view->name] = $view;
return $views;
}

View File

@ -86,7 +86,7 @@ function template_preprocess_views_view(&$vars) {
$vars['title'] = !empty($view->views_ui_context) ? filter_xss_admin($view->get_title()) : '';
if ($view->display_handler->render_pager()) {
$exposed_input = isset($view->exposed_raw_input) ? $view->exposed_raw_input : NULL;
$exposed_input = $view->get_exposed_input();
$vars['pager'] = $view->query->render_pager($exposed_input);
}
@ -138,6 +138,10 @@ function template_preprocess_views_view(&$vars) {
),
),
),
// Support for AJAX path validation in core 7.39.
'urlIsAjaxTrusted' => array(
url('views/ajax') => TRUE,
),
);
drupal_add_js($settings, 'setting');

View File

@ -1,45 +0,0 @@
<?php
/**
* @file
* This template handles the printing of fields/filters/sort criteria/arguments or relationships.
*/
?>
<?php print $rearrange; ?>
<?php print $add; ?>
<div class="views-category-title<?php
if ($overridden) {
print ' overridden';
}
if ($defaulted) {
print ' defaulted';
}
?>">
<?php print $item_help_icon; ?>
<?php print $title; ?>
</div>
<div class="views-category-content<?php
if ($overridden) {
print ' overridden';
}
if ($defaulted) {
print ' defaulted';
}
?>">
<?php if (!empty($no_fields)): ?>
<div><?php print t('The style selected does not utilize fields.'); ?></div>
<?php elseif (empty($fields)): ?>
<div><?php print t('None defined'); ?></div>
<?php else: ?>
<?php foreach ($fields as $pid => $field): ?>
<?php if (!empty($field['links'])): ?>
<?php print $field['links']; ?>
<?php endif; ?>
<div class="<?php print $field['class']; if (!empty($field['changed'])) { print ' changed'; } ?>">
<?php print $field['title']; ?>
<?php print $field['info']; ?>
</div>
<?php endforeach; ?>
<?php endif; ?>
</div>

View File

@ -87,7 +87,7 @@
* $this->value_title = t('Node type');
* $types = node_get_types();
* foreach ($types as $type => $info) {
* $options[$type] = $info-&gt;name;
* $options[$type] = $info->name;
* }
* $this->value_options = $options;
* }

View File

@ -2,7 +2,6 @@ name = Views
description = Create customized lists and queries from your database.
package = Views
core = 7.x
php = 5.2
; Always available CSS
stylesheets[all][] = css/views.css
@ -328,9 +327,9 @@ files[] = tests/views_cache.test
files[] = tests/views_view.test
files[] = tests/views_ui.test
; Information added by Drupal.org packaging script on 2016-06-15
version = "7.x-3.14"
; Information added by Drupal.org packaging script on 2017-04-02
version = "7.x-3.16"
core = "7.x"
project = "views"
datestamp = "1466019588"
datestamp = "1491158591"

View File

@ -44,13 +44,12 @@ function views_schema($caller_function = FALSE) {
// Generate a sorted list of available schema update functions.
if ($get_current || empty($schemas)) {
$get_current = FALSE;
$functions = get_defined_functions();
foreach ($functions['user'] as $function) {
if (strpos($function, 'views_schema_') === 0) {
$version = substr($function, strlen('views_schema_'));
if (is_numeric($version)) {
$schemas[] = $version;
}
// Provide a worst-case scenario range.
$start_schema = 6000;
$end_schema = 7999;
for ($i = $start_schema; $i <= $end_schema; $i++) {
if (function_exists('views_schema_' . $i)) {
$schemas[] = $i;
}
}
if ($schemas) {

View File

@ -377,7 +377,7 @@ function views_menu() {
'file' => 'includes/ajax.inc',
);
// Define another taxonomy autocomplete because the default one of drupal
// does not support a vid a argument anymore
// does not support a vid a argument anymore.
$items['admin/views/ajax/autocomplete/taxonomy'] = array(
'page callback' => 'views_ajax_autocomplete_taxonomy',
'theme callback' => 'ajax_base_page_theme',

View File

@ -7,9 +7,9 @@ dependencies[] = views
files[] = views_ui.module
files[] = plugins/views_wizard/views_ui_base_views_wizard.class.php
; Information added by Drupal.org packaging script on 2016-06-15
version = "7.x-3.14"
; Information added by Drupal.org packaging script on 2017-04-02
version = "7.x-3.16"
core = "7.x"
project = "views"
datestamp = "1466019588"
datestamp = "1491158591"

View File

@ -186,11 +186,6 @@ function views_ui_theme() {
'template' => 'views-ui-display-tab-bucket',
'path' => "$path/theme",
),
'views_ui_edit_item' => array(
'variables' => array('type' => NULL, 'view' => NULL, 'display' => NULL, 'no_fields' => FALSE),
'template' => 'views-ui-edit-item',
'path' => "$path/theme",
),
'views_ui_rearrange_form' => array(
'render element' => 'form',
),