Update Core to 7.58

Drupal-FR · Apr 1, 2018 · 40aefe1 · 40aefe1
1 parent f69e15b
commit 40aefe1
Show file tree

Hide file tree

Showing 132 changed files with 477 additions and 391 deletions.
diff --git a/www/includes/bootstrap.inc b/www/includes/bootstrap.inc
@@ -8,7 +8,7 @@
 /**
  * The current system version.
  */
-define('VERSION', '7.57');
+define('VERSION', '7.58');
 
 /**
  * Core API compatibility.
@@ -2632,6 +2632,10 @@ function _drupal_bootstrap_configuration() {
   timer_start('page');
   // Initialize the configuration, including variables from settings.php.
   drupal_settings_initialize();
+
+  // Sanitize unsafe keys from the request.
+  require_once DRUPAL_ROOT . '/includes/request-sanitizer.inc';
+  DrupalRequestSanitizer::sanitize();
 }
 
 /**

diff --git a/www/includes/request-sanitizer.inc b/www/includes/request-sanitizer.inc
@@ -0,0 +1,82 @@
+<?php
+
+/**
+ * @file
+ * Contains code for sanitizing user input from the request.
+ */
+
+/**
+ * Sanitizes user input from the request.
+ */
+class DrupalRequestSanitizer {
+
+  /**
+   * Tracks whether the request was already sanitized.
+   */
+  protected static $sanitized = FALSE;
+
+  /**
+   * Modifies the request to strip dangerous keys from user input.
+   */
+  public static function sanitize() {
+    if (!self::$sanitized) {
+      $whitelist = variable_get('sanitize_input_whitelist', array());
+      $log_sanitized_keys = variable_get('sanitize_input_logging', FALSE);
+
+      // Process query string parameters.
+      $get_sanitized_keys = array();
+      $_GET = self::stripDangerousValues($_GET, $whitelist, $get_sanitized_keys);
+      if ($log_sanitized_keys && $get_sanitized_keys) {
+        _drupal_trigger_error_with_delayed_logging(format_string('Potentially unsafe keys removed from query string parameters (GET): @keys', array('@keys' => implode(', ', $get_sanitized_keys))), E_USER_NOTICE);
+      }
+
+      // Process request body parameters.
+      $post_sanitized_keys = array();
+      $_POST = self::stripDangerousValues($_POST, $whitelist, $post_sanitized_keys);
+      if ($log_sanitized_keys && $post_sanitized_keys) {
+        _drupal_trigger_error_with_delayed_logging(format_string('Potentially unsafe keys removed from request body parameters (POST): @keys', array('@keys' => implode(', ', $post_sanitized_keys))), E_USER_NOTICE);
+      }
+
+      // Process cookie parameters.
+      $cookie_sanitized_keys = array();
+      $_COOKIE = self::stripDangerousValues($_COOKIE, $whitelist, $cookie_sanitized_keys);
+      if ($log_sanitized_keys && $cookie_sanitized_keys) {
+        _drupal_trigger_error_with_delayed_logging(format_string('Potentially unsafe keys removed from cookie parameters (COOKIE): @keys', array('@keys' => implode(', ', $cookie_sanitized_keys))), E_USER_NOTICE);
+      }
+
+      $request_sanitized_keys = array();
+      $_REQUEST = self::stripDangerousValues($_REQUEST, $whitelist, $request_sanitized_keys);
+
+      self::$sanitized = TRUE;
+    }
+  }
+
+  /**
+   * Strips dangerous keys from the provided input.
+   *
+   * @param mixed $input
+   *   The input to sanitize.
+   * @param string[] $whitelist
+   *   An array of keys to whitelist as safe.
+   * @param string[] $sanitized_keys
+   *   An array of keys that have been removed.
+   *
+   * @return mixed
+   *   The sanitized input.
+   */
+  protected static function stripDangerousValues($input, array $whitelist, array &$sanitized_keys) {
+    if (is_array($input)) {
+      foreach ($input as $key => $value) {
+        if ($key !== '' && $key[0] === '#' && !in_array($key, $whitelist, TRUE)) {
+          unset($input[$key]);
+          $sanitized_keys[] = $key;
+        }
+        else {
+          $input[$key] = self::stripDangerousValues($input[$key], $whitelist, $sanitized_keys);
+        }
+      }
+    }
+    return $input;
+  }
+
+}
diff --git a/www/modules/aggregator/aggregator.info b/www/modules/aggregator/aggregator.info
@@ -7,8 +7,8 @@ files[] = aggregator.test
 configure = admin/config/services/aggregator/settings
 stylesheets[all][] = aggregator.css
 
-; Information added by Drupal.org packaging script on 2018-02-21
-version = "7.57"
+; Information added by Drupal.org packaging script on 2018-03-28
+version = "7.58"
 project = "drupal"
-datestamp = "1519235152"
+datestamp = "1522264019"
 
diff --git a/www/modules/aggregator/tests/aggregator_test.info b/www/modules/aggregator/tests/aggregator_test.info
@@ -5,8 +5,8 @@ version = VERSION
 core = 7.x
 hidden = TRUE
 
-; Information added by Drupal.org packaging script on 2018-02-21
-version = "7.57"
+; Information added by Drupal.org packaging script on 2018-03-28
+version = "7.58"
 project = "drupal"
-datestamp = "1519235152"
+datestamp = "1522264019"
 
diff --git a/www/modules/block/block.info b/www/modules/block/block.info
@@ -6,8 +6,8 @@ core = 7.x
 files[] = block.test
 configure = admin/structure/block
 
-; Information added by Drupal.org packaging script on 2018-02-21
-version = "7.57"
+; Information added by Drupal.org packaging script on 2018-03-28
+version = "7.58"
 project = "drupal"
-datestamp = "1519235152"
+datestamp = "1522264019"
 
diff --git a/www/modules/block/tests/block_test.info b/www/modules/block/tests/block_test.info
@@ -5,8 +5,8 @@ version = VERSION
 core = 7.x
 hidden = TRUE
 
-; Information added by Drupal.org packaging script on 2018-02-21
-version = "7.57"
+; Information added by Drupal.org packaging script on 2018-03-28
+version = "7.58"
 project = "drupal"
-datestamp = "1519235152"
+datestamp = "1522264019"
 
diff --git a/www/modules/block/tests/themes/block_test_theme/block_test_theme.info b/www/modules/block/tests/themes/block_test_theme/block_test_theme.info
@@ -13,8 +13,8 @@ regions[footer] = Footer
 regions[highlighted] = Highlighted
 regions[help] = Help
 
-; Information added by Drupal.org packaging script on 2018-02-21
-version = "7.57"
+; Information added by Drupal.org packaging script on 2018-03-28
+version = "7.58"
 project = "drupal"
-datestamp = "1519235152"
+datestamp = "1522264019"
 
diff --git a/www/modules/blog/blog.info b/www/modules/blog/blog.info
@@ -5,8 +5,8 @@ version = VERSION
 core = 7.x
 files[] = blog.test
 
-; Information added by Drupal.org packaging script on 2018-02-21
-version = "7.57"
+; Information added by Drupal.org packaging script on 2018-03-28
+version = "7.58"
 project = "drupal"
-datestamp = "1519235152"
+datestamp = "1522264019"
 
diff --git a/www/modules/book/book.info b/www/modules/book/book.info
@@ -7,8 +7,8 @@ files[] = book.test
 configure = admin/content/book/settings
 stylesheets[all][] = book.css
 
-; Information added by Drupal.org packaging script on 2018-02-21
-version = "7.57"
+; Information added by Drupal.org packaging script on 2018-03-28
+version = "7.58"
 project = "drupal"
-datestamp = "1519235152"
+datestamp = "1522264019"
 
diff --git a/www/modules/color/color.info b/www/modules/color/color.info
@@ -5,8 +5,8 @@ version = VERSION
 core = 7.x
 files[] = color.test
 
-; Information added by Drupal.org packaging script on 2018-02-21
-version = "7.57"
+; Information added by Drupal.org packaging script on 2018-03-28
+version = "7.58"
 project = "drupal"
-datestamp = "1519235152"
+datestamp = "1522264019"
 
diff --git a/www/modules/comment/comment.info b/www/modules/comment/comment.info
@@ -9,8 +9,8 @@ files[] = comment.test
 configure = admin/content/comment
 stylesheets[all][] = comment.css
 
-; Information added by Drupal.org packaging script on 2018-02-21
-version = "7.57"
+; Information added by Drupal.org packaging script on 2018-03-28
+version = "7.58"
 project = "drupal"
-datestamp = "1519235152"
+datestamp = "1522264019"
 
diff --git a/www/modules/contact/contact.info b/www/modules/contact/contact.info
@@ -6,8 +6,8 @@ core = 7.x
 files[] = contact.test
 configure = admin/structure/contact
 
-; Information added by Drupal.org packaging script on 2018-02-21
-version = "7.57"
+; Information added by Drupal.org packaging script on 2018-03-28
+version = "7.58"
 project = "drupal"
-datestamp = "1519235152"
+datestamp = "1522264019"
 
diff --git a/www/modules/contextual/contextual.info b/www/modules/contextual/contextual.info
@@ -5,8 +5,8 @@ version = VERSION
 core = 7.x
 files[] = contextual.test
 
-; Information added by Drupal.org packaging script on 2018-02-21
-version = "7.57"
+; Information added by Drupal.org packaging script on 2018-03-28
+version = "7.58"
 project = "drupal"
-datestamp = "1519235152"
+datestamp = "1522264019"
 
diff --git a/www/modules/dashboard/dashboard.info b/www/modules/dashboard/dashboard.info
@@ -7,8 +7,8 @@ files[] = dashboard.test
 dependencies[] = block
 configure = admin/dashboard/customize
 
-; Information added by Drupal.org packaging script on 2018-02-21
-version = "7.57"
+; Information added by Drupal.org packaging script on 2018-03-28
+version = "7.58"
 project = "drupal"
-datestamp = "1519235152"
+datestamp = "1522264019"
 
diff --git a/www/modules/dblog/dblog.info b/www/modules/dblog/dblog.info
@@ -5,8 +5,8 @@ version = VERSION
 core = 7.x
 files[] = dblog.test
 
-; Information added by Drupal.org packaging script on 2018-02-21
-version = "7.57"
+; Information added by Drupal.org packaging script on 2018-03-28
+version = "7.58"
 project = "drupal"
-datestamp = "1519235152"
+datestamp = "1522264019"
 
diff --git a/www/modules/field/field.info b/www/modules/field/field.info
@@ -11,8 +11,8 @@ dependencies[] = field_sql_storage
 required = TRUE
 stylesheets[all][] = theme/field.css
 
-; Information added by Drupal.org packaging script on 2018-02-21
-version = "7.57"
+; Information added by Drupal.org packaging script on 2018-03-28
+version = "7.58"
 project = "drupal"
-datestamp = "1519235152"
+datestamp = "1522264019"
 
diff --git a/www/modules/field/modules/field_sql_storage/field_sql_storage.info b/www/modules/field/modules/field_sql_storage/field_sql_storage.info
@@ -7,8 +7,8 @@ dependencies[] = field
 files[] = field_sql_storage.test
 required = TRUE
 
-; Information added by Drupal.org packaging script on 2018-02-21
-version = "7.57"
+; Information added by Drupal.org packaging script on 2018-03-28
+version = "7.58"
 project = "drupal"
-datestamp = "1519235152"
+datestamp = "1522264019"
 
diff --git a/www/modules/field/modules/list/list.info b/www/modules/field/modules/list/list.info
@@ -7,8 +7,8 @@ dependencies[] = field
 dependencies[] = options
 files[] = tests/list.test
 
-; Information added by Drupal.org packaging script on 2018-02-21
-version = "7.57"
+; Information added by Drupal.org packaging script on 2018-03-28
+version = "7.58"
 project = "drupal"
-datestamp = "1519235152"
+datestamp = "1522264019"
 
diff --git a/www/modules/field/modules/list/tests/list_test.info b/www/modules/field/modules/list/tests/list_test.info
@@ -5,8 +5,8 @@ package = Testing
 version = VERSION
 hidden = TRUE
 
-; Information added by Drupal.org packaging script on 2018-02-21
-version = "7.57"
+; Information added by Drupal.org packaging script on 2018-03-28
+version = "7.58"
 project = "drupal"
-datestamp = "1519235152"
+datestamp = "1522264019"
 
diff --git a/www/modules/field/modules/number/number.info b/www/modules/field/modules/number/number.info
@@ -6,8 +6,8 @@ core = 7.x
 dependencies[] = field
 files[] = number.test
 
-; Information added by Drupal.org packaging script on 2018-02-21
-version = "7.57"
+; Information added by Drupal.org packaging script on 2018-03-28
+version = "7.58"
 project = "drupal"
-datestamp = "1519235152"
+datestamp = "1522264019"
 
diff --git a/www/modules/field/modules/options/options.info b/www/modules/field/modules/options/options.info
@@ -6,8 +6,8 @@ core = 7.x
 dependencies[] = field
 files[] = options.test
 
-; Information added by Drupal.org packaging script on 2018-02-21
-version = "7.57"
+; Information added by Drupal.org packaging script on 2018-03-28
+version = "7.58"
 project = "drupal"
-datestamp = "1519235152"
+datestamp = "1522264019"
 
diff --git a/www/modules/field/modules/text/text.info b/www/modules/field/modules/text/text.info
@@ -7,8 +7,8 @@ dependencies[] = field
 files[] = text.test
 required = TRUE
 
-; Information added by Drupal.org packaging script on 2018-02-21
-version = "7.57"
+; Information added by Drupal.org packaging script on 2018-03-28
+version = "7.58"
 project = "drupal"
-datestamp = "1519235152"
+datestamp = "1522264019"
 
diff --git a/www/modules/field/tests/field_test.info b/www/modules/field/tests/field_test.info
@@ -6,8 +6,8 @@ files[] = field_test.entity.inc
 version = VERSION
 hidden = TRUE
 
-; Information added by Drupal.org packaging script on 2018-02-21
-version = "7.57"
+; Information added by Drupal.org packaging script on 2018-03-28
+version = "7.58"
 project = "drupal"
-datestamp = "1519235152"
+datestamp = "1522264019"
 
diff --git a/www/modules/field_ui/field_ui.info b/www/modules/field_ui/field_ui.info
@@ -6,8 +6,8 @@ core = 7.x
 dependencies[] = field
 files[] = field_ui.test
 
-; Information added by Drupal.org packaging script on 2018-02-21
-version = "7.57"
+; Information added by Drupal.org packaging script on 2018-03-28
+version = "7.58"
 project = "drupal"
-datestamp = "1519235152"
+datestamp = "1522264019"
 
diff --git a/www/modules/file/file.info b/www/modules/file/file.info
@@ -6,8 +6,8 @@ core = 7.x
 dependencies[] = field
 files[] = tests/file.test
 
-; Information added by Drupal.org packaging script on 2018-02-21
-version = "7.57"
+; Information added by Drupal.org packaging script on 2018-03-28
+version = "7.58"
 project = "drupal"
-datestamp = "1519235152"
+datestamp = "1522264019"
 
diff --git a/www/modules/file/tests/file_module_test.info b/www/modules/file/tests/file_module_test.info
@@ -5,8 +5,8 @@ version = VERSION
 core = 7.x
 hidden = TRUE
 
-; Information added by Drupal.org packaging script on 2018-02-21
-version = "7.57"
+; Information added by Drupal.org packaging script on 2018-03-28
+version = "7.58"
 project = "drupal"
-datestamp = "1519235152"
+datestamp = "1522264019"