security update core+modules

2015-04-26 18:38:56 +02:00
parent 2f45ea820a
commit 7c96373038
1022 changed files with 30319 additions and 11259 deletions
--- a/modules/taxonomy/taxonomy-term.tpl.php
+++ b/modules/taxonomy/taxonomy-term.tpl.php
@ -5,7 +5,8 @@
 * Default theme implementation to display a term.
 *
 * Available variables:
- * - $name: the (sanitized) name of the term.
+ * - $name: (deprecated) The unsanitized name of the term. Use $term_name
+ *   instead.
 * - $content: An array of items for the content of the term (fields and
 *   description). Use render($content) to print them all, or print a subset
 *   such as render($content['field_example']). Use
--- a/modules/taxonomy/taxonomy.api.php
+++ b/modules/taxonomy/taxonomy.api.php
@ -20,12 +20,15 @@
 *   An array of taxonomy vocabulary objects.
 */
 function hook_taxonomy_vocabulary_load($vocabularies) {
-  foreach ($vocabularies as $vocabulary) {
-    $vocabulary->synonyms = variable_get('taxonomy_' . $vocabulary->vid . '_synonyms', FALSE);
+  $result = db_select('mytable', 'm')
+    ->fields('m', array('vid', 'foo'))
+    ->condition('m.vid', array_keys($vocabularies), 'IN')
+    ->execute();
+  foreach ($result as $record) {
+    $vocabularies[$record->vid]->foo = $record->foo;
  }
 }

-
 /**
 * Act on taxonomy vocabularies before they are saved.
 *
@ -49,8 +52,8 @@ function hook_taxonomy_vocabulary_presave($vocabulary) {
 *   A taxonomy vocabulary object.
 */
 function hook_taxonomy_vocabulary_insert($vocabulary) {
-  if ($vocabulary->synonyms) {
-    variable_set('taxonomy_' . $vocabulary->vid . '_synonyms', TRUE);
+  if ($vocabulary->machine_name == 'my_vocabulary') {
+    $vocabulary->weight = 100;
  }
 }

@ -63,10 +66,10 @@ function hook_taxonomy_vocabulary_insert($vocabulary) {
 *   A taxonomy vocabulary object.
 */
 function hook_taxonomy_vocabulary_update($vocabulary) {
-  $status = $vocabulary->synonyms ? TRUE : FALSE;
-  if ($vocabulary->synonyms) {
-    variable_set('taxonomy_' . $vocabulary->vid . '_synonyms', $status);
-  }
+  db_update('mytable')
+    ->fields(array('foo' => $vocabulary->foo))
+    ->condition('vid', $vocabulary->vid)
+    ->execute();
 }

 /**
@ -79,9 +82,9 @@ function hook_taxonomy_vocabulary_update($vocabulary) {
 *   A taxonomy vocabulary object.
 */
 function hook_taxonomy_vocabulary_delete($vocabulary) {
-  if (variable_get('taxonomy_' . $vocabulary->vid . '_synonyms', FALSE)) {
-    variable_del('taxonomy_' . $vocabulary->vid . '_synonyms');
-  }
+  db_delete('mytable')
+    ->condition('vid', $vocabulary->vid)
+    ->execute();
 }

 /**
@ -101,7 +104,10 @@ function hook_taxonomy_vocabulary_delete($vocabulary) {
 *   An array of term objects, indexed by tid.
 */
 function hook_taxonomy_term_load($terms) {
-  $result = db_query('SELECT tid, foo FROM {mytable} WHERE tid IN (:tids)', array(':tids' => array_keys($terms)));
+  $result = db_select('mytable', 'm')
+    ->fields('m', array('tid', 'foo'))
+    ->condition('m.tid', array_keys($terms), 'IN')
+    ->execute();
  foreach ($result as $record) {
    $terms[$record->tid]->foo = $record->foo;
  }
@ -130,18 +136,12 @@ function hook_taxonomy_term_presave($term) {
 *   A taxonomy term object.
 */
 function hook_taxonomy_term_insert($term) {
-  if (!empty($term->synonyms)) {
-    foreach (explode ("\n", str_replace("\r", '', $term->synonyms)) as $synonym) {
-      if ($synonym) {
-        db_insert('taxonomy_term_synonym')
-        ->fields(array(
-          'tid' => $term->tid,
-          'name' => rtrim($synonym),
-        ))
-        ->execute();
-      }
-    }
-  }
+  db_insert('mytable')
+    ->fields(array(
+      'tid' => $term->tid,
+      'foo' => $term->foo,
+    ))
+    ->execute();
 }

 /**
@ -153,19 +153,10 @@ function hook_taxonomy_term_insert($term) {
 *   A taxonomy term object.
 */
 function hook_taxonomy_term_update($term) {
-  hook_taxonomy_term_delete($term);
-  if (!empty($term->synonyms)) {
-    foreach (explode ("\n", str_replace("\r", '', $term->synonyms)) as $synonym) {
-      if ($synonym) {
-        db_insert('taxonomy_term_synonym')
-        ->fields(array(
-          'tid' => $term->tid,
-          'name' => rtrim($synonym),
-        ))
-        ->execute();
-      }
-    }
-  }
+  db_update('mytable')
+    ->fields(array('foo' => $term->foo))
+    ->condition('tid', $term->tid)
+    ->execute();
 }

 /**
@ -178,7 +169,9 @@ function hook_taxonomy_term_update($term) {
 *   A taxonomy term object.
 */
 function hook_taxonomy_term_delete($term) {
-  db_delete('term_synoynm')->condition('tid', $term->tid)->execute();
+  db_delete('mytable')
+    ->condition('tid', $term->tid)
+    ->execute();
 }

 /**
@ -219,7 +212,7 @@ function hook_taxonomy_term_view($term, $view_mode, $langcode) {
 * documentation respectively for details.
 *
 * @param $build
- *   A renderable array representing the node content.
+ *   A renderable array representing the term.
 *
 * @see hook_entity_view_alter()
 */
--- a/modules/taxonomy/taxonomy.info
+++ b/modules/taxonomy/taxonomy.info
@ -7,3 +7,9 @@ dependencies[] = options
 files[] = taxonomy.module
 files[] = taxonomy.test
 configure = admin/structure/taxonomy
+
+; Information added by Drupal.org packaging script on 2015-04-02
+version = "7.36"
+project = "drupal"
+datestamp = "1427943826"
+
--- a/modules/taxonomy/taxonomy.install
+++ b/modules/taxonomy/taxonomy.install
@ -638,6 +638,10 @@ function taxonomy_update_7005(&$sandbox) {
          'type' => 'int',
          'not null' => FALSE,
        ),
+        'status' => array(
+          'type' => 'int',
+          'not null' => FALSE,
+        ),
        'is_current' => array(
          'type' => 'int',
          'unsigned' => TRUE,
@ -670,6 +674,7 @@ function taxonomy_update_7005(&$sandbox) {
    $query->addField('n', 'type');
    $query->addField('n2', 'created');
    $query->addField('n2', 'sticky');
+    $query->addField('n2', 'status');
    $query->addField('n2', 'nid', 'is_current');
    // This query must return a consistent ordering across multiple calls.
    // We need them ordered by node vid (since we use that to decide when
@ -682,6 +687,14 @@ function taxonomy_update_7005(&$sandbox) {
    $query->orderBy('tn.vid');
    $query->orderBy('td.weight');
    $query->orderBy('tn.tid');
+
+    // Work around a bug in the PostgreSQL driver that would result in fatal
+    // errors when this subquery is used in the insert query below. See
+    // https://drupal.org/node/2057693.
+    $fields = &$query->getFields();
+    unset($fields['td.weight']);
+    unset($fields['tn.tid']);
+
    db_insert('taxonomy_update_7005')
      ->from($query)
      ->execute();
@ -690,7 +703,7 @@ function taxonomy_update_7005(&$sandbox) {
    // We do each pass in batches of 1000.
    $batch = 1000;

-    $result = db_query_range('SELECT vocab_id, tid, nid, vid, type, created, sticky, is_current FROM {taxonomy_update_7005} ORDER BY n', $sandbox['last'], $batch);
+    $result = db_query_range('SELECT vocab_id, tid, nid, vid, type, created, sticky, status, is_current FROM {taxonomy_update_7005} ORDER BY n', $sandbox['last'], $batch);
    if (isset($sandbox['cursor'])) {
      $values = $sandbox['cursor']['values'];
      $deltas = $sandbox['cursor']['deltas'];
@ -757,12 +770,14 @@ function taxonomy_update_7005(&$sandbox) {
      // is_current column is a node ID if this revision is also current.
      if ($record->is_current) {
        db_insert($table_name)->fields($columns)->values($values)->execute();
-
-        // Update the {taxonomy_index} table.
-        db_insert('taxonomy_index')
-          ->fields(array('nid', 'tid', 'sticky', 'created',))
-          ->values(array($record->nid, $record->tid, $record->sticky, $record->created))
-          ->execute();
+        // Only insert a record in the taxonomy index if the node is published.
+        if ($record->status) {
+          // Update the {taxonomy_index} table.
+          db_insert('taxonomy_index')
+            ->fields(array('nid', 'tid', 'sticky', 'created',))
+            ->values(array($record->nid, $record->tid, $record->sticky, $record->created))
+            ->execute();
+        }
      }
    }

@ -880,3 +895,44 @@ function taxonomy_update_7010() {
  ));
 }

+/**
+ * @addtogroup updates-7.x-extra
+ * @{
+ */
+
+/**
+ * Drop unpublished nodes from the index.
+ */
+function taxonomy_update_7011(&$sandbox) {
+  // Initialize information needed by the batch update system.
+  if (!isset($sandbox['progress'])) {
+    $sandbox['progress'] = 0;
+    $sandbox['max'] = db_query('SELECT COUNT(DISTINCT n.nid) FROM {node} n INNER JOIN {taxonomy_index} t ON n.nid = t.nid WHERE n.status = :status', array(':status' => NODE_NOT_PUBLISHED))->fetchField();
+    // If there's no data, don't bother with the extra work.
+    if (empty($sandbox['max'])) {
+      return;
+    }
+  }
+
+  // Process records in groups of 5000.
+  $limit = 5000;
+  $nids = db_query_range('SELECT DISTINCT n.nid FROM {node} n INNER JOIN {taxonomy_index} t ON n.nid = t.nid WHERE n.status = :status', 0, $limit, array(':status' => NODE_NOT_PUBLISHED))->fetchCol();
+  if (!empty($nids)) {
+    db_delete('taxonomy_index')
+      ->condition('nid', $nids)
+      ->execute();
+  }
+
+  // Update our progress information for the batch update.
+  $sandbox['progress'] += $limit;
+
+  // Indicate our current progress to the batch update system, if the update is
+  // not yet complete.
+  if ($sandbox['progress'] < $sandbox['max']) {
+    $sandbox['#finished'] = $sandbox['progress'] / $sandbox['max'];
+  }
+}
+
+/**
+ * @} End of "addtogroup updates-7.x-extra".
+ */
--- a/modules/taxonomy/taxonomy.module
+++ b/modules/taxonomy/taxonomy.module
@ -140,7 +140,7 @@ function taxonomy_entity_info() {
 }

 /**
- * Entity URI callback.
+ * Implements callback_entity_info_uri().
 */
 function taxonomy_term_uri($term) {
  return array(
@ -457,7 +457,12 @@ function taxonomy_vocabulary_save($vocabulary) {
 }

 /**
- * Delete a vocabulary.
+ * Deletes a vocabulary.
+ *
+ * This will update all Taxonomy fields so that they don't reference the
+ * deleted vocabulary. It also will delete fields that have no remaining
+ * vocabulary references. All taxonomy terms of the deleted vocabulary
+ * will be deleted as well.
 *
 * @param $vid
 *   A vocabulary ID.
@ -748,7 +753,7 @@ function taxonomy_term_delete($tid) {
 * @param term
 *   A taxonomy term object.
 * @return
- *   A $page element suitable for use by drupal_page_render().
+ *   A $page element suitable for use by drupal_render().
 */
 function taxonomy_term_show($term) {
  return taxonomy_term_view_multiple(array($term->tid => $term), 'full');
@ -771,15 +776,26 @@ function taxonomy_term_show($term) {
 *   An array in the format expected by drupal_render().
 */
 function taxonomy_term_view_multiple($terms, $view_mode = 'teaser', $weight = 0, $langcode = NULL) {
-  field_attach_prepare_view('taxonomy_term', $terms, $view_mode, $langcode);
-  entity_prepare_view('taxonomy_term', $terms, $langcode);
  $build = array();
+  $entities_by_view_mode = entity_view_mode_prepare('taxonomy_term', $terms, $view_mode, $langcode);
+  foreach ($entities_by_view_mode as $entity_view_mode => $entities) {
+    field_attach_prepare_view('taxonomy_term', $entities, $entity_view_mode, $langcode);
+    entity_prepare_view('taxonomy_term', $entities, $langcode);
+
+    foreach ($entities as $entity) {
+      $build['taxonomy_terms'][$entity->tid] = taxonomy_term_view($entity, $entity_view_mode, $langcode);
+    }
+  }
+
  foreach ($terms as $term) {
-    $build['taxonomy_terms'][$term->tid] = taxonomy_term_view($term, $view_mode, $langcode);
    $build['taxonomy_terms'][$term->tid]['#weight'] = $weight;
    $weight++;
  }
+  // Sort here, to preserve the input order of the entities that were passed to
+  // this function.
+  uasort($build['taxonomy_terms'], 'element_sort');
  $build['taxonomy_terms']['#sorted'] = TRUE;
+
  return $build;
 }

@ -812,12 +828,7 @@ function taxonomy_term_build_content($term, $view_mode = 'full', $langcode = NUL
  $term->content = array();

  // Allow modules to change the view mode.
-  $context = array(
-    'entity_type' => 'taxonomy_term',
-    'entity' => $term,
-    'langcode' => $langcode,
-  );
-  drupal_alter('entity_view_mode', $view_mode, $context);
+  $view_mode = key(entity_view_mode_prepare('taxonomy_term', array($term->tid => $term), $view_mode, $langcode));

  // Add the term description if the term has one and it is visible.
  $type = 'taxonomy_term';
--- a/modules/taxonomy/taxonomy.pages.inc
+++ b/modules/taxonomy/taxonomy.pages.inc
@ -118,7 +118,7 @@ function taxonomy_term_feed($term) {
 * @see taxonomy_menu()
 * @see taxonomy_field_widget_info()
 */
-function taxonomy_autocomplete($field_name, $tags_typed = '') {
+function taxonomy_autocomplete($field_name = '', $tags_typed = '') {
  // If the request has a '/' in the search text, then the menu system will have
  // split it into multiple arguments, recover the intended $tags_typed.
  $args = func_get_args();
@ -138,7 +138,7 @@ function taxonomy_autocomplete($field_name, $tags_typed = '') {
  $tags_typed = drupal_explode_tags($tags_typed);
  $tag_last = drupal_strtolower(array_pop($tags_typed));

-  $matches = array();
+  $term_matches = array();
  if ($tag_last != '') {

    // Part of the criteria for the query come from the field's own settings.
@ -167,7 +167,6 @@ function taxonomy_autocomplete($field_name, $tags_typed = '') {

    $prefix = count($tags_typed) ? drupal_implode_tags($tags_typed) . ', ' : '';

-    $term_matches = array();
    foreach ($tags_return as $tid => $name) {
      $n = $name;
      // Term names containing commas or quotes must be wrapped in quotes.
--- a/modules/taxonomy/taxonomy.test
+++ b/modules/taxonomy/taxonomy.test
@ -170,7 +170,8 @@ class TaxonomyVocabularyFunctionalTest extends TaxonomyWebTestCase {

    // Check the created vocabulary.
    $vocabularies = taxonomy_get_vocabularies();
-    $vid = $vocabularies[count($vocabularies) - 1]->vid;
+    $vocabularies_keys = array_keys($vocabularies);
+    $vid = $vocabularies[end($vocabularies_keys)]->vid;
    entity_get_controller('taxonomy_vocabulary')->resetCache();
    $vocabulary = taxonomy_vocabulary_load($vid);
    $this->assertTrue($vocabulary, 'Vocabulary found in database.');
@ -689,15 +690,20 @@ class TaxonomyTermTestCase extends TaxonomyWebTestCase {
      $term_objects[$key] = reset($term_objects[$key]);
    }

+    // Test editing the node.
+    $node = $this->drupalGetNodeByTitle($edit["title"]);
+    $this->drupalPost('node/' . $node->nid . '/edit', $edit, t('Save'));
+    foreach ($terms as $term) {
+      $this->assertText($term, 'The term was retained after edit and still appears on the node page.');
+    }
+
    // Delete term 1.
    $this->drupalPost('taxonomy/term/' . $term_objects['term1']->tid . '/edit', array(), t('Delete'));
    $this->drupalPost(NULL, NULL, t('Delete'));
    $term_names = array($term_objects['term2']->name, $term_objects['term3']->name);

-    // Get the node.
-    $node = $this->drupalGetNodeByTitle($edit["title"]);
+    // Get the node and verify that the terms that should be there still are.
    $this->drupalGet('node/' . $node->nid);
-
    foreach ($term_names as $term_name) {
      $this->assertText($term_name, format_string('The term %name appears on the node page after one term %deleted was deleted', array('%name' => $term_name, '%deleted' => $term_objects['term1']->name)));
    }
@ -722,6 +728,13 @@ class TaxonomyTermTestCase extends TaxonomyWebTestCase {
    $this->assertFalse(field_info_field($field_name), format_string('Field %field_name does not exist.', array('%field_name' => $field_name)));
    $this->drupalGet('taxonomy/autocomplete/' . $field_name . '/' . $tag);
    $this->assertRaw($message, 'Autocomplete returns correct error message when the taxonomy field does not exist.');
+
+    // Test the autocomplete path without passing a field_name and terms.
+    // This should not trigger a PHP notice.
+    $field_name = '';
+    $message = t("Taxonomy field @field_name not found.", array('@field_name' => $field_name));
+    $this->drupalGet('taxonomy/autocomplete');
+    $this->assertRaw($message, 'Autocomplete returns correct error message when no taxonomy field is given.');
  }

  /**