security updates of unpatched modules

sites/all/modules/contrib/panels/panels/panels.install

@@ -47,7 +47,69 @@ function panels_requirements_install() {
 function panels_schema() {
   // This should always point to our 'current' schema. This makes it relatively
   // easy to keep a record of schema as we make changes to it.
-  return panels_schema_6();
+  return panels_schema_9();
+}
+
+function panels_schema_9() {
+  $schema = panels_schema_8();
+  $schema['panels_allowed_types'] = array(
+    'fields' => array(
+      'module' => array(
+        'description' => 'The name of the module requiring allowed type settings.',
+        'type' => 'varchar',
+        'length' => 255,
+        'not null' => TRUE,
+        'default' => '',
+      ),
+      'type' => array(
+        'description' => 'Ctools content type to allow.',
+        'type' => 'varchar',
+        'length' => 255,
+        'not null' => TRUE,
+        'default' => '',
+      ),
+      'allowed' => array(
+        'description' => 'A boolean for if the type is allowed or not.',
+        'type' => 'int',
+        'size' => 'tiny',
+        'default' => 1,
+      ),
+    ),
+    'indexes' => array(
+      'type_idx' => array('type'),
+    ),
+  );
+
+  return $schema;
+ }
+
+function panels_schema_8() {
+  $schema = panels_schema_7();
+
+  // Add the storage type and id columns.
+  $schema['panels_display']['fields']['storage_type'] = array(
+    'type' => 'varchar',
+    'length' => 255,
+    'default' => '',
+  );
+  $schema['panels_display']['fields']['storage_id'] = array(
+    'type' => 'varchar',
+    'length' => 255,
+    'default' => '',
+  );
+
+  return $schema;
+}
+
+function panels_schema_7() {
+  $schema = panels_schema_6();
+
+  // Update field lengths to 255 chars.
+  $schema['panels_pane']['fields']['subtype']['length'] = '255';
+  $schema['panels_pane']['fields']['panel']['length'] = '255';
+  $schema['panels_pane']['fields']['type']['length'] = '255';
+
+  return $schema;
 }
 
 function panels_schema_6() {
@@ -406,11 +468,23 @@ function panels_update_7301() {
 
 /**
  * Adding universally unique identifiers to panels.
+ *
+ * Note: This update hook is not written well. It calls apis which uses the
+ * most updated drupal database, causing missing columns or tables errors. To
+ * mitigate the issue, we've added updates from 7303 and 7305. Future updates
+ * should go below the 7305 update.
+ *
+ * See https://www.drupal.org/node/2787123 for more info.
  */
 function panels_update_7302() {
   if (!module_load_include('inc', 'ctools', 'includes/uuid')) {
     throw new DrupalUpdateException(t('Ctools UUID support not detected. You must update to a more recent version of the ctools module.'));
   }
+  // Run the 7303 update first to avoid caching issues.
+  // This *probably* should be placed right above update 7305, however it was
+  // tested here and re-testing this update is difficult, so it stays here.
+  panels_update_7303();
+
   // Load the schema.
   $schema = panels_schema_5();
   $msg = array();
@@ -462,6 +536,10 @@ function panels_update_7302() {
 
   $dids = array_unique(array_merge($display_dids, $pane_dids));
 
+  // Before using panels_save_display(), we have to make sure any new fields
+  // are added from future updates.
+  panels_update_7305();
+
   // If the Panels module is disabled we don't have access to
   // panels_load_displays().
   if (!function_exists('panels_load_displays')) {
@@ -492,3 +570,122 @@ function panels_update_7303() {
     db_create_table($table_name, $schema[$table_name]);
   }
 }
+
+/**
+ * Update "panels_pane" table field lengths to 255 chars.
+ */
+function panels_update_7304() {
+  $schema = panels_schema_7();
+
+  $update_fields = array(
+    'panels_pane' => array('subtype', 'panel', 'type'),
+  );
+
+  foreach ($update_fields as $table => $fields) {
+    foreach ($fields as $field_name) {
+      db_change_field($table, $field_name, $field_name, $schema[$table]['fields'][$field_name]);
+    }
+  }
+}
+
+/**
+ * Add the "storage_type" and "storage_id" columns to "panels_display".
+ */
+function panels_update_7305() {
+  $schema = panels_schema_8();
+
+  $new_fields = array(
+    'panels_display' => array('storage_type', 'storage_id'),
+  );
+
+  foreach ($new_fields as $table => $fields) {
+    foreach ($fields as $field_name) {
+      // Due to a previous failure, the column may already exist:
+      if (!db_field_exists($table, $field_name)) {
+        db_add_field($table, $field_name, $schema[$table]['fields'][$field_name]);
+      }
+    }
+  }
+}
+
+/**
+ * Set the storage type and id on existing page manager panels displays.
+ */
+function panels_update_7306() {
+  if (!db_table_exists('page_manager_handlers')) {
+    return t('Skipping update - page_manager is not installed.');
+  }
+
+  // Get all page_manager_handlers that have a panels context.
+  $result = db_query("SELECT pm.name, pm.conf FROM {page_manager_handlers} pm WHERE pm.handler = 'panel_context'");
+  $page_manager_panels = array();
+  foreach ($result as $row) {
+    $conf = unserialize($row->conf);
+    if (isset($conf['did'])) {
+      $page_manager_panels[$conf['did']] = $row->name;
+    }
+  }
+
+  if (!empty($page_manager_panels)) {
+    // Check panels displays that only have empty storage types
+    $result = db_query("SELECT pd.did FROM {panels_display} pd WHERE pd.did IN (:dids) AND storage_type = ''", array(':dids' => array_keys($page_manager_panels)));
+    foreach ($result as $row) {
+      db_update('panels_display')
+        ->fields(array(
+          'storage_type' => 'page_manager',
+          'storage_id' => $page_manager_panels[$row->did],
+        ))
+        ->condition('did', $row->did)
+        ->execute();
+    }
+  }
+}
+
+/**
+ * Add a custom table for allowed types.
+ */
+function panels_update_7307() {
+  $schema = panels_schema_9();
+
+  $table_name = 'panels_allowed_types';
+  if (!db_table_exists($table_name)) {
+    db_create_table($table_name, $schema[$table_name]);
+  }
+
+  // Read existing allowed settings and store them in a new table.
+  $variables = db_select('variable', 'v')
+    ->fields('v', array('name'))
+    ->condition('name', '%' . db_like('_allowed_types'), 'LIKE')
+    ->execute()
+    ->fetchCol();
+  foreach ($variables as $name) {
+    $module = str_replace('_allowed_types', '', $name);
+    $variable = variable_get($name);
+    foreach ($variable as $type => $allowed) {
+      $allowed = empty($allowed) ? 0 : 1;
+      db_merge('panels_allowed_types')
+        ->key(array('module' => $module, 'type' => $type))
+        ->fields(array(
+          'module' => $module,
+          'type' => $type,
+          'allowed' => $allowed,
+        ))
+        ->execute();
+    }
+    variable_del($name);
+  }
+}
+
+/**
+ * Rename style permissions.
+ */
+function panels_update_7308() {
+  $permissions = array(
+    'administer panels display styles',
+    'administer panels pane styles',
+    'administer panels region styles',
+  );
+  foreach (array_keys(user_roles(TRUE, 'administer panels styles')) as $rid) {
+    user_role_grant_permissions($rid, $permissions);
+  }
+}