all contrib module security updates done

2020-09-24 22:47:32 +02:00
parent 7d87153100
commit 0fbb9c4610
1612 changed files with 116663 additions and 32269 deletions
@@ -26,42 +26,43 @@ Installation
  Download, unpack the module the usual way.
  Enable this module and the Locale module (core).

-  You need at least one language other than English.
-  On Administration > Configuration > Regional and language:
-    Click "Add language"
-    Pull-down menu: Choose your new language
-    Then click "Add language"
+  You need at least one language (besides the default English).
+  On Administration > Configuration > Regional and language > Languages:
+    Click "Add language".
+    Select a language from the select list "Language name".
+    Then click the "Add language" button.

  Drupal is now importing interface translations. This can take a few minutes.
-  When it's finished, you'll get a confirmation with a summary of all
-  translation files that have been pulled in.
+  When it's finished, you'll get a confirmation with a summary of the
+  translations that have been imported.

  If required, enable the new language as default language.
-  Home > Administration > Configuration > Regional and language:
-    Select your new language as default
+  Administration > Configuration > Regional and language > Languages:
+    Select your new default language.

 Update interface translations
 -----------------------------
-  On Home > Administration > Configuration > Regional and language:
-    Choose the "Translation updates" tab
-    Change "Check for updates" to Daily or Weekly instead of the default "Never".
+  You want to import translations regularly using cron. You can enable this
+  on Administration > Configuration > Regional and language > Languages:
+    Choose the "Translation updates" tab.
+    Change "Check for updates" to "Daily" or "Weekly" instead of the default "Never".
+  From now on cron will check for updated translations, and import them is required.

-  Cron will from now on check for updated translations, and will report the
-  update status on the status page (Home > Administration > Reports).
+  The status of the translations is reported on the "Status report" page at 
+  Administration > Reports.

  To check the translation status and execute updates manually, go to
-     Administration > Configuration > Regional and language > Translate inteface
-  Here you see English and your new language.
-    Choose the "Update" tab
+    Administration > Configuration > Regional and language > Translate inteface
+    Choose the "Update" tab.
  You see a list of all modules and their translation status.
  On the bottom of the page, you can manually update using "Update translations".

 Use Drush
 ---------
  You can also use drush to update your translations:
-  drush l10n-update           # Update translations.
-  drush l10n-update-refresh   # Refresh available information.
-  drush l10n-update-status    # Show translation status of available project
+    drush l10n-update           # Update translations.
+    drush l10n-update-refresh   # Refresh available information.
+    drush l10n-update-status    # Show translation status of available project


 Summary of administrative pages
@@ -59,7 +59,7 @@ function l10n_update_admin_overview() {
    $build['admin_import_form'] = drupal_get_form('l10n_update_admin_import_form', $projects, $updates);
  }
  else {
-    $build['no_projects'] = array('#markup' => t('No projects or languages to update.'));
+    $build['no_languages'] = array('#markup' => t('No translatable language defined. <a href="/admin/config/regional/language">Add a language</a>.'));
  }
  return $build;
 }
@@ -96,30 +96,29 @@ function l10n_update_admin_import_form($form, $form_state, $projects, $updates)
      '#type' => 'value',
      '#value' => $updates,
    );
-    // @todo Only show this language fieldset if we have more than 1 language.
-    $form['lang'] = array(
-      '#type' => 'fieldset',
-      '#title' => t('Languages'),
-      '#collapsible' => TRUE,
-      '#collapsed' => TRUE,
-      '#description' => t('Select one or more languages to download and update. If you select none, all of them will be updated.'),
-    );
-    $form['lang']['languages'] = array(
-      '#type' => 'checkboxes',
-      '#options' => $languages,
-    );
-    $form['mode'] = array(
-      '#type' => 'radios',
-      '#title' => t('Update mode'),
-      '#default_value' => variable_get('l10n_update_import_mode', LOCALE_IMPORT_KEEP),
-      '#options' => _l10n_update_admin_import_options(),
-    );
-    $form['buttons']['download'] = array(
-      '#type' => 'submit',
-      '#value' => t('Update translations'),
-    );
+
+    if (count($languages) > 1) {
+      $form['lang'] = array(
+        '#type' => 'fieldset',
+        '#title' => t('Languages'),
+        '#collapsible' => TRUE,
+        '#collapsed' => FALSE ,
+        '#description' => t('Select one or more languages to download and update. If you select none, all of them will be updated.'),
+      );
+      $form['lang']['languages'] = array(
+        '#type' => 'checkboxes',
+        '#options' => $languages,
+      );
+    }
+
+    if ($updates) {
+      $form['actions']['download'] = array(
+        '#type' => 'submit',
+        '#value' => t('Update translations'),
+      );
+    }
  }
-  $form['buttons']['refresh'] = array(
+  $form['actions']['refresh'] = array(
    '#type' => 'submit',
    '#value' => t('Refresh information'),
  );
@@ -137,9 +136,10 @@ function l10n_update_admin_import_form_submit($form, $form_state) {
  $projects = l10n_update_get_projects();

  if ($op == t('Update translations')) {
-    $languages = array_filter($form_state['values']['languages']);
+    $languages = isset($form_state['values']['languages']) ? array_filter($form_state['values']['languages']) : NULL;
    $updates = $form_state['values']['updates'];
-    $mode = $form_state['values']['mode'];
+    $mode = variable_get('l10n_update_import_mode', LOCALE_IMPORT_KEEP);
+
    if ($projects && $updates) {
      module_load_include('batch.inc', 'l10n_update');
      // Filter out updates in other languages. If no languages, all of them will be updated
@@ -147,9 +147,6 @@ function l10n_update_admin_import_form_submit($form, $form_state) {
      $batch = l10n_update_batch_multiple($updates, $mode);
      batch_set($batch);
    }
-    else {
-      drupal_set_message(t('Cannot find any translation updates.'), 'error');
-    }
  }
  elseif ($op == t('Refresh information')) {
    // Get current version of projects.
@@ -205,7 +202,11 @@ function l10n_update_admin_settings_form($form, &$form_state) {
    '#default_value' => variable_get('l10n_update_download_store', ''),
    '#description' => t('A path relative to the Drupal installation directory where translation files will be stored, e.g. sites/all/translations. Saved translation files can be reused by other installations. If left empty the downloaded translation will not be saved.'),
  );
-  return system_settings_form($form);
+
+  $form = system_settings_form($form);
+  $form['#submit'][] = 'l10n_update_admin_settings_form_submit';
+
+  return $form;
 }

 /**
@@ -223,6 +224,14 @@ function l10n_update_admin_settings_form_validate($form, &$form_state) {
  }
 }

+/**
+ * Additional submit handler for update settings.
+ */
+function l10n_update_admin_settings_form_submit($form, &$form_state) {
+  // Add .htaccess file to the translations directory.
+  l10n_update_ensure_htaccess();
+}
+
 /**
 * Get array of import options.
 *
@@ -344,6 +353,7 @@ function theme_l10n_update_project_status($variables) {
  // Plus add our own css and js.
  drupal_add_css(drupal_get_path('module', 'update') . '/update.css');
  drupal_add_css(drupal_get_path('module', 'l10n_update') . '/css/l10n_update.admin.css');
+  drupal_add_js('misc/collapse.js');
  drupal_add_js(drupal_get_path('module', 'l10n_update') . '/js/l10n_update.js');

  return $output;
@@ -172,6 +172,10 @@ function _l10n_update_batch_import($id, $file, $mode, &$context) {
    $file = $context['results'][$id]['file'];
  }
  if ($file) {
+    // Create a result if none exists yet.
+    if (!isset($context['results'][$id])) {
+      $context['results'][$id] = array();
+    }
    if ($import_result = l10n_update_source_import($file, $mode)) {
      $context['message'] = $t('Imported: %name.', array('%name' => $file->filename));
      $context['results'][$id] = array_merge((array)$context['results'][$id], $import_result, array('file' => $file));
@@ -249,6 +253,14 @@ function _l10n_update_batch_finished($success, $results) {
            array('!log_messages' => l(t('Recent log messages'), 'admin/reports/dblog'))),
        'warning');
      }
+
+      // Clear cache and force refresh of JavaScript translations and rebuild
+      // the menu as strings may have changed.
+      foreach (array_keys($totals) as $langcode) {
+        _locale_invalidate_js($langcode);
+      }
+      cache_clear_all('locale:', 'cache', TRUE);
+      menu_rebuild();
    }

    // Error for failed imports.
@@ -35,9 +35,7 @@ function l10n_update_available_releases($refresh = FALSE) {
  else {
    $projects = l10n_update_get_projects(TRUE);
    $languages = l10n_update_language_list();
-    $local = variable_get('l10n_update_check_mode', L10N_UPDATE_CHECK_ALL) & L10N_UPDATE_CHECK_LOCAL;
-    $remote = variable_get('l10n_update_check_mode', L10N_UPDATE_CHECK_ALL) & L10N_UPDATE_CHECK_REMOTE;
-    $available = l10n_update_check_projects($projects, array_keys($languages), $local, $remote);
+    $available = l10n_update_check_projects($projects, array_keys($languages));
    cache_set('l10n_update_available_releases', $available, 'cache_l10n_update', $frequency ? REQUEST_TIME + $frequency : CACHE_PERMANENT);
    return $available;
  }
@@ -58,7 +56,14 @@ function l10n_update_available_releases($refresh = FALSE) {
 * @return array
 *   Available sources indexed by project, language.
 */
-function l10n_update_check_projects($projects, $languages = NULL, $check_local = TRUE, $check_remote = TRUE) {
+function l10n_update_check_projects($projects, $languages = NULL, $check_local = NULL, $check_remote = NULL) {
+  if (!isset($check_local)) {
+    $check_local = (bool) (variable_get('l10n_update_check_mode', L10N_UPDATE_CHECK_ALL) & L10N_UPDATE_CHECK_LOCAL);
+  }
+  if (!isset($check_remote)) {
+    $check_remote = (bool) (variable_get('l10n_update_check_mode', L10N_UPDATE_CHECK_ALL) & L10N_UPDATE_CHECK_REMOTE);
+  }
+
  $languages = $languages ? $languages : array_keys(l10n_update_language_list());
  $result = array();
  foreach ($projects as $name => $project) {
@@ -132,8 +137,8 @@ function l10n_update_check_translations($count, $before, $limit = 1) {
  $result = $q->execute();

  if ($result) {
-    $local = variable_get('l10n_update_check_mode', L10N_UPDATE_CHECK_ALL) & L10N_UPDATE_CHECK_LOCAL;
-    $remote = variable_get('l10n_update_check_mode', L10N_UPDATE_CHECK_ALL) & L10N_UPDATE_CHECK_REMOTE;
+    $local = (bool) (variable_get('l10n_update_check_mode', L10N_UPDATE_CHECK_ALL) & L10N_UPDATE_CHECK_LOCAL);
+    $remote = (bool) (variable_get('l10n_update_check_mode', L10N_UPDATE_CHECK_ALL) & L10N_UPDATE_CHECK_REMOTE);
    foreach ($result as $check) {
      if (count($updated) >= $limit) {
        break;
@@ -230,7 +235,6 @@ function l10n_update_source_check($source, $check_local = TRUE, $check_remote =
      $remote = $check;
    }
  }
-
  // Get remote if newer than local only, they both can be empty
  return _l10n_update_source_compare($local, $remote) < 0 ? $remote : $local;
 }
@@ -23,7 +23,7 @@ function l10n_update_drush_command() {
    'description' => 'Update translations.',
    'options' => array(
      'languages' => 'Comma separated list of languages. Defaults to all available languages.',
-      'mode' => 'Allowed values: overwrite, keep. Default value: keep.'
+      'mode' => 'Determine if existing translations are overwitten during import. Use "overwrite" to overwrite any existing translation, "replace" to replace previously imported translations but not overwrite edited strings, "keep" to keep any existing translation and only add new translations. Default value: keep'
    ),
  );
  return $commands;
@@ -102,8 +102,8 @@ function drush_l10n_update_validate() {

  // Check provided update mode is valid.
  $mode = drush_get_option('mode', 'keep');
-  if (!in_array($mode, array('keep', 'overwrite'))) {
-    return drush_set_error('L10N_UPDATE_INVALID_MODE', dt('Invalid update mode. Valid options are keep, overwrite.'));
+  if (!in_array($mode, array('keep', 'replace', 'overwrite'))) {
+    return drush_set_error('L10N_UPDATE_INVALID_MODE', dt('Invalid update mode. Valid options are keep, replace, overwrite.'));
  }
 }

@@ -118,6 +118,23 @@ function drush_l10n_update() {

      // Batch update all projects for selected languages.
      $mode = drush_get_option('mode', 'keep');
+
+      switch ($mode) {
+        case 'keep':
+          $mode = LOCALE_IMPORT_KEEP;
+          break;
+        case 'replace':
+          $mode = LOCALE_UPDATE_OVERRIDE_DEFAULT;
+          break;
+        case 'overwrite':
+          $mode = LOCALE_IMPORT_OVERWRITE;
+          break;
+
+        default:
+          return drush_set_error('L10N_UPDATE_INVALID_MODE', dt('Invalid update mode. Valid options are keep, overwrite.'));
+          break;
+      }
+
      $languages = drush_get_option('languages');
      module_load_include('batch.inc', 'l10n_update');
      $updates = _l10n_update_prepare_updates($updates, NULL, array_keys($languages));
@@ -258,8 +258,29 @@ function l10n_update_flag_history($available) {
 */
 function l10n_update_http_check($url, $headers = array()) {
  $result = l10n_update_http_request($url, array('headers' => $headers, 'method' => 'HEAD'));
-  if ($result && $result->code == '200') {
-    $result->updated = isset($result->headers['last-modified']) ? strtotime($result->headers['last-modified']) : 0;
+  if (!isset($result->error)) {
+    if ($result && $result->code == 200) {
+      $result->updated = isset($result->headers['last-modified']) ? strtotime($result->headers['last-modified']) : 0;
+    }
+    return $result;
+  }
+  else {
+    switch ($result->code) {
+      case 404:
+        // File not found occurs when a translation file is not yet available
+        // at the translation server. But also if a custom module or custom
+        // theme does not define the location of a translation file. By default
+        // the file is checked at the translation server, but it will not be
+        // found there.
+        watchdog('l10n_update', 'File not found: @uri.', array('@uri' => $url));
+        return TRUE;
+      case 0:
+        watchdog('l10n_update', 'Error occurred when trying to check @remote: @errormessage.', array('@errormessage' => $result->error, '@remote' => $url), WATCHDOG_ERROR);
+        break;
+      default:
+        watchdog('l10n_update', 'HTTP error @errorcode occurred when trying to check @remote.', array('@errorcode' => $result->code, '@remote' => $url), WATCHDOG_ERROR);
+        break;
+    }
  }
  return $result;
 }
@@ -297,7 +318,8 @@ function l10n_update_http_check($url, $headers = array()) {
 *     received.
 *   - redirect_code: If redirected, an integer containing the initial response
 *     status code.
- *   - redirect_url: If redirected, a string containing the redirection location.
+ *   - redirect_url: If redirected, a string containing the URL of the redirect
+ *     target.
 *   - error: If an error occurred, the error message. Otherwise not set.
 *   - headers: An array containing the response headers as name/value pairs.
 *     HTTP header names are case-insensitive (RFC 2616, section 4.2), so for
@@ -333,10 +355,51 @@ function l10n_update_http_request($url, array $options = array()) {
    'timeout' => 30.0,
    'context' => NULL,
  );
+
+  // Merge the default headers.
+  $options['headers'] += array(
+    'User-Agent' => 'Drupal (+http://drupal.org/)',
+  );
+
  // stream_socket_client() requires timeout to be a float.
  $options['timeout'] = (float) $options['timeout'];

+  // Use a proxy if one is defined and the host is not on the excluded list.
+  $proxy_server = variable_get('proxy_server', '');
+  if ($proxy_server && _drupal_http_use_proxy($uri['host'])) {
+    // Set the scheme so we open a socket to the proxy server.
+    $uri['scheme'] = 'proxy';
+    // Set the path to be the full URL.
+    $uri['path'] = $url;
+    // Since the URL is passed as the path, we won't use the parsed query.
+    unset($uri['query']);
+
+    // Add in username and password to Proxy-Authorization header if needed.
+    if ($proxy_username = variable_get('proxy_username', '')) {
+      $proxy_password = variable_get('proxy_password', '');
+      $options['headers']['Proxy-Authorization'] = 'Basic ' . base64_encode($proxy_username . (!empty($proxy_password) ? ":" . $proxy_password : ''));
+    }
+    // Some proxies reject requests with any User-Agent headers, while others
+    // require a specific one.
+    $proxy_user_agent = variable_get('proxy_user_agent', '');
+    // The default value matches neither condition.
+    if ($proxy_user_agent === NULL) {
+      unset($options['headers']['User-Agent']);
+    }
+    elseif ($proxy_user_agent) {
+      $options['headers']['User-Agent'] = $proxy_user_agent;
+    }
+  }
+
  switch ($uri['scheme']) {
+    case 'proxy':
+      // Make the socket connection to a proxy server.
+      $socket = 'tcp://' . $proxy_server . ':' . variable_get('proxy_port', 8080);
+      // The Host header still needs to match the real request.
+      $options['headers']['Host'] = $uri['host'];
+      $options['headers']['Host'] .= isset($uri['port']) && $uri['port'] != 80 ? ':' . $uri['port'] : '';
+      break;
+
    case 'http':
    case 'feed':
      $port = isset($uri['port']) ? $uri['port'] : 80;
@@ -346,12 +409,14 @@ function l10n_update_http_request($url, array $options = array()) {
      // checking the host that do not take into account the port number.
      $options['headers']['Host'] = $uri['host'] . ($port != 80 ? ':' . $port : '');
      break;
+
    case 'https':
      // Note: Only works when PHP is compiled with OpenSSL support.
      $port = isset($uri['port']) ? $uri['port'] : 443;
      $socket = 'ssl://' . $uri['host'] . ':' . $port;
      $options['headers']['Host'] = $uri['host'] . ($port != 443 ? ':' . $port : '');
      break;
+
    default:
      $result->error = 'invalid schema ' . $uri['scheme'];
      $result->code = -1003;
@@ -376,7 +441,7 @@ function l10n_update_http_request($url, array $options = array()) {
    // Mark that this request failed. This will trigger a check of the web
    // server's ability to make outgoing HTTP requests the next time that
    // requirements checking is performed.
-    // See system_requirements()
+    // See system_requirements().
    // variable_set('drupal_http_request_fails', TRUE);

    return $result;
@@ -388,11 +453,6 @@ function l10n_update_http_request($url, array $options = array()) {
    $path .= '?' . $uri['query'];
  }

-  // Merge the default headers.
-  $options['headers'] += array(
-    'User-Agent' => 'Drupal (+http://drupal.org/)',
-  );
-
  // Only add Content-Length if we actually have any content or if it is a POST
  // or PUT request. Some non-standard servers get confused by Content-Length in
  // at least HEAD/GET requests, and Squid always requires Content-Length in
@@ -404,7 +464,7 @@ function l10n_update_http_request($url, array $options = array()) {

  // If the server URL has a user then attempt to use basic authentication.
  if (isset($uri['user'])) {
-    $options['headers']['Authorization'] = 'Basic ' . base64_encode($uri['user'] . (!empty($uri['pass']) ? ":" . $uri['pass'] : ''));
+    $options['headers']['Authorization'] = 'Basic ' . base64_encode($uri['user'] . (isset($uri['pass']) ? ':' . $uri['pass'] : ''));
  }

  // If the database prefix is being used by SimpleTest to run the tests in a copied
@@ -459,7 +519,9 @@ function l10n_update_http_request($url, array $options = array()) {
    return $result;
  }
  // Parse response headers from the response body.
-  list($response, $result->data) = explode("\r\n\r\n", $response, 2);
+  // Be tolerant of malformed HTTP responses that separate header and body with
+  // \n\n or \r\r instead of \r\n\r\n.
+  list($response, $result->data) = preg_split("/\r\n\r\n|\n\n|\r\r/", $response, 2);
  $response = preg_split("/\r\n|\n|\r/", $response);

  // Parse the response status line.
@@ -551,7 +613,9 @@ function l10n_update_http_request($url, array $options = array()) {
        $result = l10n_update_http_request($location, $options);
        $result->redirect_code = $code;
      }
-      $result->redirect_url = $location;
+      if (!isset($result->redirect_url)) {
+        $result->redirect_url = $location;
+      }
      break;
    default:
      $result->error = $status_message;
@@ -4,21 +4,10 @@ dependencies[] = locale
 core = 7.x
 package = Multilingual

-files[] = l10n_update.admin.inc
-files[] = l10n_update.api.php
-files[] = l10n_update.batch.inc
-files[] = l10n_update.check.inc
-files[] = l10n_update.drush.inc
-files[] = l10n_update.inc
-files[] = l10n_update.install
-files[] = l10n_update.locale.inc
-files[] = l10n_update.module
 files[] = l10n_update.parser.inc
-files[] = l10n_update.project.inc

-; Information added by drupal.org packaging script on 2012-02-06
-version = "7.x-1.0-beta3"
+; Information added by Drupal.org packaging script on 2019-12-16
+version = "7.x-1.4"
 core = "7.x"
 project = "l10n_update"
-datestamp = "1328563848"
-
+datestamp = "1576494267"
@@ -15,7 +15,7 @@ function l10n_update_schema() {
      'name' => array(
        'description' => 'A unique short name to identify the project.',
        'type' => 'varchar',
-        'length' => '50',
+        'length' => '255',
        'not null' => TRUE,
      ),
      'project_type' => array(
@@ -68,7 +68,7 @@ function l10n_update_schema() {
      'project' => array(
        'description' => 'A unique short name to identify the project.',
        'type' => 'varchar',
-        'length' => '50',
+        'length' => '255',
        'not null' => TRUE,
      ),
      'language' => array(
@@ -182,30 +182,52 @@ function l10n_update_uninstall() {
 */
 function l10n_update_requirements($phase) {
  if ($phase == 'runtime') {
-    if (l10n_update_get_projects() && l10n_update_language_list()) {
-      $requirements['l10n_update']['title'] = t('Translation update status');
-      if (l10n_update_available_updates()) {
-        $requirements['l10n_update']['severity'] = REQUIREMENT_WARNING;
-        $requirements['l10n_update']['value'] = t('There are available updates');
-        $requirements['l10n_update']['description'] = t(
-          'There are new or updated translations available for currently installed modules and themes. To check for updates, you can visit the <a href="@check_manually">translation update page</a>.',
-          array(
-            '@check_manually' => url('admin/config/regional/translate/update')
-          )
-        );
+    $requirements['l10n_update']['title'] = t('Translation update status');
+    if (variable_get('l10n_update_check_frequency', 0)) {
+      if (l10n_update_get_projects() && l10n_update_language_list()) {
+        if (l10n_update_available_updates()) {
+          $requirements['l10n_update']['severity'] = REQUIREMENT_WARNING;
+          $requirements['l10n_update']['value'] = t('There are available updates');
+          $requirements['l10n_update']['description'] = t('There are new or updated translations available for currently installed modules and themes. To check for updates, you can visit the <a href="@check_manually">translation update page</a>.', array(
+              '@check_manually' => url('admin/config/regional/translate/update')
+            ));
+        }
+        else {
+          $requirements['l10n_update']['severity'] = REQUIREMENT_OK;
+          $requirements['l10n_update']['value'] = t('All your translations are up to date');
+        }
      }
      else {
-        $requirements['l10n_update']['severity'] = REQUIREMENT_OK;
-        $requirements['l10n_update']['value'] = t('All your translations are up to date');
+        $requirements['l10n_update']['value'] = t('No update data available');
+        $requirements['l10n_update']['severity'] = REQUIREMENT_WARNING;
+        $requirements['l10n_update']['description'] = _l10n_update_no_data();
      }
    }
    else {
-      $requirements['l10n_update']['title'] = t('Translation update status');
-      $requirements['l10n_update']['value'] = t('No update data available');
-      $requirements['l10n_update']['severity'] = REQUIREMENT_WARNING;
-      //$requirements['update_core']['reason'] = UPDATE_UNKNOWN;
-      $requirements['l10n_update']['description'] = _l10n_update_no_data();
+      $requirements['l10n_update']['value'] = t('Not enabled');
+      $requirements['l10n_update']['severity'] = REQUIREMENT_INFO;
    }
+
+    // Test the contents of the .htaccess file in the translations directory.
+    $directory = variable_get('l10n_update_download_store', '');
+    if ($directory) {
+      l10n_update_ensure_htaccess();
+      $htaccess_file = $directory . '/.htaccess';
+      // Check for the string which was added to the recommended .htaccess file
+      // in the latest security update.
+      if (!file_exists($htaccess_file) || !($contents = @file_get_contents($htaccess_file)) || strpos($contents, 'Drupal_Security_Do_Not_Remove_See_SA_2013_003') === FALSE) {
+        $requirements['l10n_update_htaccess'] = array(
+          'title' => t('Translations directory'),
+          'value' => t('Not fully protected'),
+          'severity' => REQUIREMENT_ERROR,
+          'description' => t('See <a href="@url">@url</a> for information about the recommended .htaccess file which should be added to the %directory directory to help protect against arbitrary code execution.', array(
+            '@url' => 'http://drupal.org/SA-CORE-2013-003',
+            '%directory' => $directory
+          )),
+        );
+      }
+    }
+
    return $requirements;
  }
  // We must always return array, the installer doesn't use module_invoke_all()
@@ -282,3 +304,50 @@ function l10n_update_update_7004() {
    db_create_table('cache_l10n_update', $schema);
  }
 }
+
+/**
+ * Rebuild registry for 'translations' stream wrapper.
+ */
+function l10n_update_update_7005() {
+  registry_rebuild();
+}
+
+/**
+ * Rebuild registry after removing the stream wrapper.
+ */
+function l10n_update_update_7006() {
+  registry_rebuild();
+}
+
+/**
+ * Increase the length of the {l10n_update_project}.name column.
+ */
+function l10n_update_update_7007() {
+  $schema = l10n_update_schema();
+  db_change_field('l10n_update_project', 'name', 'name', $schema['l10n_update_project']['fields']['name']);
+}
+
+/**
+ * Increase the length of the {l10n_update_file}.project column.
+ */
+function l10n_update_update_7008() {
+  $schema = l10n_update_schema();
+  db_change_field('l10n_update_file', 'project', 'project', $schema['l10n_update_file']['fields']['project']);
+}
+
+/**
+ * Remove 'headers' field from cache table.
+ */
+function l10n_update_update_7009() {
+  if (db_field_exists('cache_l10n_update', 'headers')) {
+    db_drop_field('cache_l10n_update', 'headers');
+  }
+}
+
+/**
+ * Add a .htaccess file to the translations directory.
+ */
+function l10n_update_update_7010() {
+  module_load_include('module', 'l10n_update');
+  l10n_update_ensure_htaccess();
+}
@@ -46,13 +46,6 @@ function _l10n_update_locale_import_po($file, $langcode, $mode, $group = NULL) {
    drupal_set_message(t('The translation file %filename appears to have a missing or malformed header.', array('%filename' => $file->filename)), 'error');
  }

-  // Clear cache and force refresh of JavaScript translations.
-  _locale_invalidate_js($langcode);
-  cache_clear_all('locale:', 'cache', TRUE);
-
-  // Rebuild the menu, strings may have changed.
-  menu_rebuild();
-
  watchdog('locale', 'Imported %file into %locale: %number new strings added, %update updated and %delete removed.', array('%file' => $file->filename, '%locale' => $langcode, '%number' => $additions, '%update' => $updates, '%delete' => $deletes));
  if ($skips) {
    watchdog('locale', '@count disallowed HTML string(s) in %file', array('@count' => $skips, '%file' => $file->uri), WATCHDOG_WARNING);
@@ -38,7 +38,6 @@ define('L10N_UPDATE_CRON_PROJECTS', 10);
 */
 define('L10N_UPDATE_CRON_UPDATES', 2);

-
 /**
 * Implements hook_help().
 */
@@ -87,7 +86,9 @@ function l10n_update_menu() {
 */
 function l10n_update_menu_alter(&$menu) {
  // Redirect l10n_client AJAX callback path for strings.
-  $menu['l10n_client/save']['page callback'] = 'l10n_update_client_save_string';
+  if (module_exists('l10n_client')) {
+    $menu['l10n_client/save']['page callback'] = 'l10n_update_client_save_string';
+  }
 }

 /**
@@ -96,10 +97,15 @@ function l10n_update_menu_alter(&$menu) {
 * Check one project/language at a time, download and import if update available
 */
 function l10n_update_cron() {
-  if ($frequency = variable_get('l10n_update_check_frequency', 0)) {
+  $last = variable_get('l10n_update_last_check', 0);
+  $frequency = variable_get('l10n_update_check_frequency', 0) * 24 *3600;
+  if ($frequency && $last < REQUEST_TIME - $frequency) {
    module_load_include('check.inc', 'l10n_update');
-    list($checked, $updated) = l10n_update_check_translations(L10N_UPDATE_CRON_PROJECTS, REQUEST_TIME - $frequency * 24 * 3600, L10N_UPDATE_CRON_UPDATES);
-    watchdog('l10n_update', 'Automatically checked @checked translations, updated @updated.', array('@checked' => count($checked), '@updated' => count($updated)));
+    list($checked, $updated) = l10n_update_check_translations(L10N_UPDATE_CRON_PROJECTS, REQUEST_TIME - $frequency, L10N_UPDATE_CRON_UPDATES);
+    if (count($checked) || count($updated)) {
+      watchdog('l10n_update', 'Automatically checked @checked translations, updated @updated.', array('@checked' => count($checked), '@updated' => count($updated)));
+    }
+    variable_set('l10n_update_last_check', REQUEST_TIME);
  }
 }

@@ -109,8 +115,8 @@ function l10n_update_cron() {
 function l10n_update_form_alter(&$form, $form_state, $form_id) {
  switch ($form_id) {
    case 'locale_translate_edit_form':
-      // Replace the submit callback by our own customized version
-      $form['#submit'] = array('l10n_update_locale_translate_edit_form_submit');
+    case 'i18n_string_locale_translate_edit_form':
+      $form['#submit'][] = 'l10n_update_locale_translate_edit_form_submit';
      break;
    case 'locale_languages_predefined_form':
    case 'locale_languages_custom_form':
@@ -177,62 +183,25 @@ function l10n_update_languages_delete_submit($form, $form_state) {
 }

 /**
- * Replacement submit handler for translation edit form.
+ * Additional submit handler for locale and i18n_string translation edit form.
 *
- * Process string editing form submissions marking translations as customized.
- * Saves all translations of one string submitted from a form.
+ * Mark locally edited translations as customized.
 *
 * @see l10n_update_form_alter()
- * @todo Just mark as customized when string changed.
 */
 function l10n_update_locale_translate_edit_form_submit($form, &$form_state) {
  module_load_include('inc', 'l10n_update');
  $lid = $form_state['values']['lid'];
-  foreach ($form_state['values']['translations'] as $key => $value) {
-    $translation = db_query("SELECT translation FROM {locales_target} WHERE lid = :lid AND language = :language", array(':lid' => $lid, ':language' => $key))->fetchField();
-    if (!empty($value)) {
-      // Only update or insert if we have a value to use.
-      if (!empty($translation)) {
-        db_update('locales_target')
-          ->fields(array(
-            'translation' => $value,
-            'l10n_status' => L10N_UPDATE_STRING_CUSTOM,
-          ))
-          ->condition('lid', $lid)
-          ->condition('language', $key)
-          ->execute();
-      }
-      else {
-        db_insert('locales_target')
-          ->fields(array(
-            'lid' => $lid,
-            'translation' => $value,
-            'language' => $key,
-            'l10n_status' => L10N_UPDATE_STRING_CUSTOM,
-          ))
-          ->execute();
-      }
-    }
-    elseif (!empty($translation)) {
-      // Empty translation entered: remove existing entry from database.
-      db_delete('locales_target')
+  foreach ($form_state['values']['translations'] as $langcode => $value) {
+    if (!empty($value) && $value != $form_state['complete form']['translations'][$langcode]['#default_value']) {
+      // An update has been made, mark the string as customized.
+      db_update('locales_target')
+        ->fields(array('l10n_status' => L10N_UPDATE_STRING_CUSTOM))
        ->condition('lid', $lid)
-        ->condition('language', $key)
+        ->condition('language', $langcode)
        ->execute();
    }
-
-    // Force JavaScript translation file recreation for this language.
-    _locale_invalidate_js($key);
  }
-
-  drupal_set_message(t('The string has been saved.'));
-
-  // Clear locale cache.
-  _locale_invalidate_js();
-  cache_clear_all('locale:', 'cache', TRUE);
-
-  $form_state['redirect'] = 'admin/config/regional/translate/translate';
-  return;
 }

 /**
@@ -246,7 +215,7 @@ function l10n_update_client_save_string() {
      // Ensure we have this source string before we attempt to save it.
      // @todo: add actual context support.
      $lid = db_query("SELECT lid FROM {locales_source} WHERE source = :source AND context = :context AND textgroup = :textgroup", array(':source' => $_POST['source'], ':context' => '', ':textgroup' => $_POST['textgroup']))->fetchField();
-      
+
      if (!empty($lid)) {
        module_load_include('inc', 'l10n_update');
        $report = array('skips' => 0, 'additions' => 0, 'updates' => 0, 'deletes' => 0);
@@ -525,3 +494,13 @@ function l10n_update_flush_caches() {
  }
  return array();
 }
+
+/**
+ * Creates a .htaccess file in the translations directory if it is missing.
+ */
+function l10n_update_ensure_htaccess() {
+  $directory = variable_get('l10n_update_download_store', '');
+  if ($directory) {
+    file_create_htaccess($directory, FALSE);
+  }
+}
@@ -115,7 +115,9 @@ class l10n_update_xml_parser {
        $this->current_server['languages'] = $this->current_languages;
        break;
      default:
-        $this->current_object[strtolower($this->current_tag)] = trim($this->current_object[strtolower($this->current_tag)]);
+        if (isset($this->current_object[strtolower($this->current_tag)])) {
+          $this->current_object[strtolower($this->current_tag)] = trim($this->current_object[strtolower($this->current_tag)]);
+        }
        $this->current_tag = '';
    }
  }
@@ -25,12 +25,16 @@
 /**
 * Rebuild project list
 *
+ * @param $refresh
+ *   TRUE: Refresh project list.
+ *
 * @return array
+ *   Array of project objects to be considered for translation update.
 */
-function l10n_update_build_projects() {
+function l10n_update_build_projects($refresh = FALSE) {
  module_load_include('inc', 'l10n_update');
  // Get all stored projects, including disabled ones
-  $current = l10n_update_get_projects(NULL, TRUE);
+  $current = l10n_update_get_projects($refresh, TRUE);
  // Now get the new project list, just enabled ones
  $projects = l10n_update_project_list();

@@ -43,34 +47,18 @@ function l10n_update_build_projects() {

  $default_server = l10n_update_default_server();

-  if (module_exists('update')) {
-    $projects_info = update_get_available(TRUE);
-  }
  foreach ($projects as $name => $data) {
-    if (isset($projects_info[$name]['releases']) && $projects_info[$name]['project_status'] != 'not-fetched') {
-      // Find out if a dev version is installed.
-      if (preg_match("/^[0-9]+\.x-([0-9]+)\..*-dev$/", $data['info']['version'], $matches)) {
-        // Find a suitable release to use as alternative translation.
-        foreach ($projects_info[$name]['releases'] as $project_release) {
-          // The first release with the same major release number which is not 
-          // a dev release is the one. Releases are sorted the most recent first.
-          if ($project_release['version_major'] == $matches[1] &&
-              (!isset($project_release['version_extra']) || $project_release['version_extra'] != 'dev')) {
-            $release = $project_release;
-            break;
-          }
-        }
+    // For dev releases, remove the '-dev' part and trust the translation server
+    // to fall back to the latest stable release for that branch.
+    if (isset($data['info']['version']) && strpos($data['info']['version'], '-dev')) {
+      if (preg_match("/^(\d+\.x-\d+\.).*$/", $data['info']['version'], $matches)) {
+        // Example matches: 7.x-1.x-dev, 7.x-1.0-alpha1+5-dev => 7.x-1.x
+        $data['info']['version'] = $matches[1] . 'x';
      }
-      elseif ($name == "drupal" || preg_match("/HEAD/", $data['info']['version'], $matches)) {
-        // Pick latest available release.
-        $release = array_shift($projects_info[$name]['releases']);
+      elseif (preg_match("/^(\d+\.).*$/", $data['info']['version'], $matches)) {
+        // Example match: 7.33-dev => 7.x (Drupal core)
+        $data['info']['version'] = $matches[1] . 'x';
      }
-
-      if (!empty($release['version'])) {
-        $data['info']['version'] = $release['version'];
-      }
-
-      unset($release);
    }

    $data += array(
@@ -101,7 +89,13 @@ function l10n_update_build_projects() {
    }
    // Create / update project record
    $update = empty($current[$name]) ? array() : array('name');
-    drupal_write_record('l10n_update_project', $project, $update);
+    // @todo Use db_merge() to avoid problems with saving existing projects.
+    try {
+      drupal_write_record('l10n_update_project', $project, $update);
+    }
+    catch (Exception $e) {
+      watchdog('l10n_update', 'Could not insert a project into the l10n_update_project table, possibly because it already exists.', NULL, WATCHDOG_INFO);
+    }
    $projects[$name] = $project;
  }
  return $projects;
@@ -136,7 +130,7 @@ function l10n_update_project_refresh($modules) {
  $projects = array();

  // Get all current projects, including the recently installed.
-  $current_projects = l10n_update_build_projects();
+  $current_projects = l10n_update_build_projects(TRUE);
  // Collect project data of newly installed projects.
  foreach ($modules as $name) {
    if (isset($current_projects[$name])) {
@@ -210,7 +204,7 @@ function _l10n_update_project_info_list(&$projects, $list, $project_type, $disab
        'name' => $project_name,
        'info' => $file->info,
        'datestamp' => isset($file->info['datestamp']) ? $file->info['datestamp'] : 0,
-        'includes' => array($file->name => $file->info['name']),
+        'includes' => array($file->name => isset($file->info['name']) ? $file->info['name'] : $file->name),
        'project_type' => $project_name == 'drupal' ? 'core' : $project_type,
      );
    }