bachir/popsu-d7
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

security upadtes

Browse Source
This commit is contained in:
Bachir Soussi Chiadmi
2017-09-25 15:16:35 +02:00
parent 650c6448e4
commit 8d8a60b615
240 changed files with 3022 additions and 1300 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
modules/user/tests/user_form_test.info
View File

@@ -5,8 +5,8 @@ version = VERSION
core = 7.x
hidden = TRUE
; Information added by Drupal.org packaging script on 2017-02-01
version = "7.54"
; Information added by Drupal.org packaging script on 2017-06-21
version = "7.56"
project = "drupal"
datestamp = "1485986921"
datestamp = "1498069849"

6
modules/user/user.info
View File

@@ -9,8 +9,8 @@ required = TRUE
configure = admin/config/people
stylesheets[all][] = user.css
; Information added by Drupal.org packaging script on 2017-02-01
version = "7.54"
; Information added by Drupal.org packaging script on 2017-06-21
version = "7.56"
project = "drupal"
datestamp = "1485986921"
datestamp = "1498069849"

9
modules/user/user.module
View File

@@ -1088,13 +1088,16 @@ function user_account_form(&$form, &$form_state) {
'#description' => t('To change the current user password, enter the new password in both fields.'),
);
// To skip the current password field, the user must have logged in via a
// one-time link and have the token in the URL.
$pass_reset = isset($_SESSION['pass_reset_' . $account->uid]) && isset($_GET['pass-reset-token']) && ($_GET['pass-reset-token'] == $_SESSION['pass_reset_' . $account->uid]);
// one-time link and have the token in the URL. Store this in $form_state
// so it persists even on subsequent Ajax requests.
if (!isset($form_state['user_pass_reset'])) {
$form_state['user_pass_reset'] = isset($_SESSION['pass_reset_' . $account->uid]) && isset($_GET['pass-reset-token']) && ($_GET['pass-reset-token'] == $_SESSION['pass_reset_' . $account->uid]);
}
$protected_values = array();
$current_pass_description = '';
// The user may only change their own password without their current
// password if they logged in via a one-time login link.
if (!$pass_reset) {
if (!$form_state['user_pass_reset']) {
$protected_values['mail'] = $form['account']['mail']['#title'];
$protected_values['pass'] = t('Password');
$request_new = l(t('Request new password'), 'user/password', array('attributes' => array('title' => t('Request new password via e-mail.'))));

76
modules/user/user.test
View File

@@ -465,6 +465,19 @@ class UserPasswordResetTestCase extends DrupalWebTestCase {
);
}
/**
* Retrieves password reset email and extracts the login link.
*/
public function getResetURL() {
// Assume the most recent email.
$_emails = $this->drupalGetMails();
$email = end($_emails);
$urls = array();
preg_match('#.+user/reset/.+#', $email['body'], $urls);
return $urls[0];
}
/**
* Tests password reset functionality.
*/
@@ -478,6 +491,49 @@ class UserPasswordResetTestCase extends DrupalWebTestCase {
$this->drupalPost('user/password', $edit, t('E-mail new password'));
// Confirm the password reset.
$this->assertText(t('Further instructions have been sent to your e-mail address.'), 'Password reset instructions mailed message displayed.');
// Create an image field to enable an Ajax request on the user profile page.
$field = array(
'field_name' => 'field_avatar',
'type' => 'image',
'settings' => array(),
'cardinality' => 1,
);
field_create_field($field);
$instance = array(
'field_name' => $field['field_name'],
'entity_type' => 'user',
'label' => 'Avatar',
'bundle' => 'user',
'required' => FALSE,
'settings' => array(),
'widget' => array(
'type' => 'image_image',
'settings' => array(),
),
);
field_create_instance($instance);
$resetURL = $this->getResetURL();
$this->drupalGet($resetURL);
// Check successful login.
$this->drupalPost(NULL, NULL, t('Log in'));
// Make sure the Ajax request from uploading a file does not invalidate the
// reset token.
$image = current($this->drupalGetTestFiles('image'));
$edit = array(
'files[field_avatar_und_0]' => drupal_realpath($image->uri),
);
$this->drupalPostAJAX(NULL, $edit, 'field_avatar_und_0_upload_button');
// Change the forgotten password.
$password = user_password();
$edit = array('pass[pass1]' => $password, 'pass[pass2]' => $password);
$this->drupalPost(NULL, $edit, t('Save'));
$this->assertText(t('The changes have been saved.'), 'Forgotten password changed.');
}
/**
@@ -1529,7 +1585,13 @@ class UserTimeZoneFunctionalTest extends DrupalWebTestCase {
// Setup date/time settings for Los Angeles time.
variable_set('date_default_timezone', 'America/Los_Angeles');
variable_set('configurable_timezones', 1);
variable_set('date_format_medium', 'Y-m-d H:i T');
// Override the 'medium' date format, which is the default for node
// creation time. Since we are testing time zones with Daylight Saving
// Time, and need to future proof against changes to the zoneinfo database,
// we choose the 'I' format placeholder instead of a human-readable zone
// name. With 'I', a 1 means the date is in DST, and 0 if not.
variable_set('date_format_medium', 'Y-m-d H:i I');
// Create a user account and login.
$web_user = $this->drupalCreateUser();
@@ -1547,11 +1609,11 @@ class UserTimeZoneFunctionalTest extends DrupalWebTestCase {
// Confirm date format and time zone.
$this->drupalGet("node/$node1->nid");
$this->assertText('2007-03-09 21:00 PST', 'Date should be PST.');
$this->assertText('2007-03-09 21:00 0', 'Date should be PST.');
$this->drupalGet("node/$node2->nid");
$this->assertText('2007-03-11 01:00 PST', 'Date should be PST.');
$this->assertText('2007-03-11 01:00 0', 'Date should be PST.');
$this->drupalGet("node/$node3->nid");
$this->assertText('2007-03-20 21:00 PDT', 'Date should be PDT.');
$this->assertText('2007-03-20 21:00 1', 'Date should be PDT.');
// Change user time zone to Santiago time.
$edit = array();
@@ -1562,11 +1624,11 @@ class UserTimeZoneFunctionalTest extends DrupalWebTestCase {
// Confirm date format and time zone.
$this->drupalGet("node/$node1->nid");
$this->assertText('2007-03-10 02:00 CLST', 'Date should be Chile summer time; five hours ahead of PST.');
$this->assertText('2007-03-10 02:00 1', 'Date should be Chile summer time; five hours ahead of PST.');
$this->drupalGet("node/$node2->nid");
$this->assertText('2007-03-11 05:00 CLT', 'Date should be Chile time; four hours ahead of PST');
$this->assertText('2007-03-11 05:00 0', 'Date should be Chile time; four hours ahead of PST');
$this->drupalGet("node/$node3->nid");
$this->assertText('2007-03-21 00:00 CLT', 'Date should be Chile time; three hours ahead of PDT.');
$this->assertText('2007-03-21 00:00 0', 'Date should be Chile time; three hours ahead of PDT.');
}
}