1632237549: Proposed release for 7.x-1.18.17 (#117)

* Update to Drupal 7.61. For more information, see https://www.drupal.org/project/drupal/releases/7.61 * Update to PHP 7.2. For details see https://pantheon.io/blog/php-72-everywhere/ * Update to Drupal 7.62. For more information, see https://www.drupal.org/project/drupal/releases/7.62 * Update to Drupal 7.63. For more information, see https://www.drupal.org/project/drupal/releases/7.63 * Update to Drupal 7.64. For more information, see https://www.drupal.org/project/drupal/releases/7.64 * Update to Drupal 7.65. For more information, see https://www.drupal.org/project/drupal/releases/7.65 * Update to Drupal 7.66. For more information, see https://www.drupal.org/project/drupal/releases/7.66 * Update to Drupal 7.67. For more information, see https://www.drupal.org/project/drupal/releases/7.67 * BUGS-2253: Remove 'Icon' from .gitignore. * Enforce HTTPS. For more info see https://pantheon.io/blog/pantheon-now-enforces-https-default-plus-really-simple-hsts * Update to Drupal 7.68. For more information, see https://www.drupal.org/project/drupal/releases/7.68 * Update to Drupal 7.69. For more information, see https://www.drupal.org/project/drupal/releases/7.69 * Update to Drupal 7.70. For more information, see https://www.drupal.org/project/drupal/releases/7.70 * Update to Drupal 7.71. For more information, see https://www.drupal.org/project/drupal/releases/7.71 * [OTTO-355] Default to Drush 8 in pantheon.upstream.yml * [OTTO-357] Add protected_web_paths to upstream * Update to Drupal 7.72. For more information, see https://www.drupal.org/project/drupal/releases/7.72 * Update to Drupal 7.73. For more information, see https://www.drupal.org/project/drupal/releases/7.73 * Update to Drupal 7.74. For more information, see https://www.drupal.org/project/drupal/releases/7.74 * Update to Drupal 7.75. For more information, see https://www.drupal.org/project/drupal/releases/7.75 * Update to Drupal 7.76. For more information, see https://www.drupal.org/project/drupal/releases/7.76 * Update to Drupal 7.77. For more information, see https://www.drupal.org/project/drupal/releases/7.77 * Update to Drupal 7.78. For more information, see https://www.drupal.org/project/drupal/releases/7.78 * Update to Drupal 7.79. For more information, see https://www.drupal.org/project/drupal/releases/7.79 * Re-release of Drupal 7.79. For more information, see https://www.drupal.org/project/drupal/releases/7.79 and pantheon-systems#168 * Update to Drupal 7.80. For more information, see https://www.drupal.org/project/drupal/releases/7.80 * Update to Drupal 7.81. For more information, see https://www.drupal.org/project/drupal/releases/7.81 * Update to Drupal 7.82. For more information, see https://www.drupal.org/project/drupal/releases/7.82 * 7.x-1.18.17 release Co-authored-by: Pantheon Automation <[email protected]> Co-authored-by: Greg Anderson <[email protected]> Co-authored-by: Greg Anderson <[email protected]> Co-authored-by: Greg Anderson <[email protected]> Co-authored-by: Jenkins <[email protected]>
GetDKAN · Sep 21, 2021 · 46bb89e · 46bb89e
1 parent c989758
commit 46bb89e
Show file tree

Hide file tree

Showing 129 changed files with 1,521 additions and 532 deletions.
diff --git a/.htaccess b/.htaccess
@@ -134,9 +134,9 @@ DirectoryIndex index.php index.html index.htm
     RewriteCond %{REQUEST_FILENAME}\.gz -s
     RewriteRule ^(.*)\.js $1\.js\.gz [QSA]
 
-    # Serve correct content types, and prevent mod_deflate double gzip.
-    RewriteRule \.css\.gz$ - [T=text/css,E=no-gzip:1]
-    RewriteRule \.js\.gz$ - [T=text/javascript,E=no-gzip:1]
+    # Serve correct content types, and prevent double compression.
+    RewriteRule \.css\.gz$ - [T=text/css,E=no-gzip:1,E=no-brotli:1]
+    RewriteRule \.js\.gz$ - [T=text/javascript,E=no-gzip:1,E=no-brotli:1]
 
     <FilesMatch "(\.js\.gz|\.css\.gz)$">
       # Serve correct encoding type.
@@ -147,8 +147,10 @@ DirectoryIndex index.php index.html index.htm
   </IfModule>
 </IfModule>
 
-# Add headers to all responses.
+# Various header fixes.
 <IfModule mod_headers.c>
   # Disable content sniffing, since it's an attack vector.
   Header always set X-Content-Type-Options nosniff
+  # Disable Proxy header, since it's an attack vector.
+  RequestHeader unset Proxy
 </IfModule>
diff --git a/CHANGELOG.txt b/CHANGELOG.txt
@@ -1,3 +1,14 @@
+Drupal 7.82, 2021-07-21
+-----------------------
+- Fixed security issues:
+   - SA-CORE-2021-004
+
+Drupal 7.81, 2021-06-02
+-----------------------
+- Block Google FLoC by default
+- Testing and accessibility enhancements
+- Various bug fixes, optimizations and improvements
+
 Drupal 7.80, 2021-04-20
 -----------------------
 - Fixed security issues:

diff --git a/includes/bootstrap.inc b/includes/bootstrap.inc
@@ -8,7 +8,7 @@
 /**
  * The current system version.
  */
-define('VERSION', '7.80');
+define('VERSION', '7.82');
 
 /**
  * Core API compatibility.

diff --git a/includes/common.inc b/includes/common.inc
@@ -2696,6 +2696,19 @@ function drupal_deliver_html_page($page_callback_result) {
     drupal_add_http_header('X-Frame-Options', $frame_options);
   }
 
+  if (variable_get('block_interest_cohort', TRUE)) {
+    $permissions_policy = drupal_get_http_header('Permissions-Policy');
+    if (is_null($permissions_policy)) {
+      drupal_add_http_header('Permissions-Policy', 'interest-cohort=()');
+    }
+    else {
+      // Only add interest-cohort if the header does not contain it already.
+      if (strpos($permissions_policy, 'interest-cohort') === FALSE) {
+        drupal_add_http_header('Permissions-Policy', 'interest-cohort=()', TRUE);
+      }
+    }
+  }
+
   // Menu status constants are integers; page content is a string or array.
   if (is_int($page_callback_result)) {
     // @todo: Break these up into separate functions?
@@ -3392,7 +3405,7 @@ function drupal_group_css($css) {
  * @see system_element_info()
  */
 function drupal_aggregate_css(&$css_groups) {
-  $preprocess_css = (variable_get('preprocess_css', FALSE) && (!defined('MAINTENANCE_MODE') || MAINTENANCE_MODE != 'update'));
+  $preprocess_css = (variable_get('preprocess_css', FALSE) && !defined('MAINTENANCE_MODE'));
 
   // For each group that needs aggregation, aggregate its items.
   foreach ($css_groups as $key => $group) {
@@ -3851,20 +3864,22 @@ function drupal_load_stylesheet_content($contents, $optimize = FALSE) {
     // whitespace.
     // @see http://php.net/manual/regexp.reference.subpatterns.php
     $contents = preg_replace('<
+      # Do not strip any space from within single or double quotes
+        (' . $double_quot . '|' . $single_quot . ')
       # Strip leading and trailing whitespace.
-        \s*([@{};,])\s*
+      | \s*([@{};,])\s*
       # Strip only leading whitespace from:
       # - Closing parenthesis: Retain "@media (bar) and foo".
       | \s+([\)])
       # Strip only trailing whitespace from:
       # - Opening parenthesis: Retain "@media (bar) and foo".
       # - Colon: Retain :pseudo-selectors.
       | ([\(:])\s+
-    >xS',
-      // Only one of the three capturing groups will match, so its reference
+    >xSs',
+      // Only one of the four capturing groups will match, so its reference
       // will contain the wanted value and the references for the
       // two non-matching groups will be replaced with empty strings.
-      '$1$2$3',
+      '$1$2$3$4',
       $contents
     );
     // End the file with a new line.
@@ -4505,7 +4520,7 @@ function drupal_get_js($scope = 'header', $javascript = NULL, $skip_alter = FALS
  * @see drupal_add_js()
  */
 function drupal_pre_render_scripts(array $elements) {
-  $preprocess_js = (variable_get('preprocess_js', FALSE) && (!defined('MAINTENANCE_MODE') || MAINTENANCE_MODE != 'update'));
+  $preprocess_js = (variable_get('preprocess_js', FALSE) && !defined('MAINTENANCE_MODE'));
 
   // A dummy query-string is added to filenames, to gain control over
   // browser-caching. The string changes on every update or full cache
@@ -6941,7 +6956,7 @@ function drupal_array_set_nested_value(array &$array, array $parents, $value, $f
 function &drupal_array_get_nested_value(array &$array, array $parents, &$key_exists = NULL) {
   $ref = &$array;
   foreach ($parents as $parent) {
-    if (is_array($ref) && array_key_exists($parent, $ref)) {
+    if (is_array($ref) && (isset($ref[$parent]) || array_key_exists($parent, $ref))) {
       $ref = &$ref[$parent];
     }
     else {

diff --git a/includes/form.inc b/includes/form.inc
@@ -3924,6 +3924,11 @@ function theme_button($variables) {
   $element['#attributes']['type'] = 'submit';
   element_set_attributes($element, array('id', 'name', 'value'));
 
+  // Remove name attribute, if empty, for W3C compliance.
+  if (isset($element['#attributes']['name']) && $element['#attributes']['name'] === '') {
+    unset($element['#attributes']['name']);
+  }
+
   $element['#attributes']['class'][] = 'form-' . $element['#button_type'];
   if (!empty($element['#attributes']['disabled'])) {
     $element['#attributes']['class'][] = 'form-button-disabled';

diff --git a/includes/menu.inc b/includes/menu.inc
@@ -1500,13 +1500,25 @@ function menu_tree_check_access(&$tree, $node_links = array()) {
     $nids = array_keys($node_links);
     $select = db_select('node', 'n');
     $select->addField('n', 'nid');
-    $select->condition('n.status', 1);
+    // When a menu administrator who we know has permission to see unpublished
+    // nodes is administering the menu, included the unpublished nodes in the
+    // tree, with a special flag so that the Menu module can label them.
+    // Otherwise, exclude these nodes from the tree.
+    if (!empty($GLOBALS['menu_admin']) && user_access('bypass node access')) {
+      $select->addField('n', 'status');
+    }
+    else {
+      $select->condition('n.status', 1);
+    }
     $select->condition('n.nid', $nids, 'IN');
     $select->addTag('node_access');
-    $nids = $select->execute()->fetchCol();
-    foreach ($nids as $nid) {
-      foreach ($node_links[$nid] as $mlid => $link) {
-        $node_links[$nid][$mlid]['access'] = TRUE;
+    $node_objects = $select->execute()->fetchAll();
+    foreach ($node_objects as $node_object) {
+      foreach ($node_links[$node_object->nid] as $mlid => $link) {
+        $node_links[$node_object->nid][$mlid]['access'] = TRUE;
+        if (isset($node_object->status)) {
+          $node_links[$node_object->nid][$mlid]['node_unpublished'] = !$node_object->status;
+        }
       }
     }
   }
@@ -1868,7 +1880,7 @@ function menu_navigation_links($menu_name, $level = 0) {
   $router_item = menu_get_item();
   $links = array();
   foreach ($tree as $item) {
-    if (!$item['link']['hidden']) {
+    if ($item['link']['access'] && !$item['link']['hidden']) {
       $class = '';
       $l = $item['link']['localized_options'];
       $l['href'] = $item['link']['href'];

diff --git a/includes/theme.inc b/includes/theme.inc
@@ -418,7 +418,7 @@ class ThemeRegistry Extends DrupalCacheArray {
     // are not registered, just check the existence of the key in the registry.
     // Use array_key_exists() here since a NULL value indicates that the theme
     // hook exists but has not yet been requested.
-    return array_key_exists($offset, $this->storage);
+    return isset($this->storage[$offset]) || array_key_exists($offset, $this->storage);
   }
 
   public function offsetGet($offset) {

diff --git a/misc/autocomplete.js b/misc/autocomplete.js
@@ -17,7 +17,7 @@ Drupal.behaviors.autocomplete = {
       $($input[0].form).submit(Drupal.autocompleteSubmit);
       $input.parent()
         .attr('role', 'application')
-        .append($('<span class="element-invisible" aria-live="assertive"></span>')
+        .append($('<span class="element-invisible" aria-live="assertive" aria-atomic="true"></span>')
           .attr('id', $input.attr('id') + '-autocomplete-aria-live')
         );
       new Drupal.jsAC($input, acdb[uri]);

diff --git a/modules/field/field.form.inc b/modules/field/field.form.inc
@@ -213,14 +213,25 @@ function field_multiple_value_form($field, $instance, $langcode, $items, &$form,
         '#language' => $langcode,
         '#field_parents' => $parents,
         '#columns' => array_keys($field['columns']),
-        // For multiple fields, title and description are handled by the wrapping table.
-        '#title' => $multiple ? '' : $title,
-        '#description' => $multiple ? '' : $description,
+        '#title' => $title,
+        '#description' => $description,
         // Only the first widget should be required.
         '#required' => $delta == 0 && $instance['required'],
         '#delta' => $delta,
         '#weight' => $delta,
       );
+      // For multiple fields, title and description are handled by the wrapping
+      // table.
+      if ($multiple) {
+        if ($delta == 0) {
+          $element['#title'] = $title;
+        }
+        else {
+          $element['#title'] = t('!title (value @number)', array('@number' => $delta + 1, '!title' => $title));
+        }
+        $element['#title_display'] = 'invisible';
+        $element['#description'] = '';
+      }
       if ($element = $function($form, $form_state, $field, $instance, $langcode, $items, $delta, $element)) {
         // Input field for the delta (drag-n-drop reordering).
         if ($multiple) {

diff --git a/modules/field/tests/field.test b/modules/field/tests/field.test
@@ -1810,6 +1810,27 @@ class FieldFormTestCase extends FieldTestCase {
     // Test with several multiple fields in a form
   }
 
+  /**
+   * Tests the position of the required label.
+   */
+  public function testFieldFormUnlimitedRequired() {
+    $this->field = $this->field_unlimited;
+    $this->field_name = $this->field['field_name'];
+    $this->instance['field_name'] = $this->field_name;
+    $this->instance['required'] = TRUE;
+    field_create_field($this->field);
+    field_create_instance($this->instance);
+
+    // Display creation form -> 1 widget.
+    $this->drupalGet('test-entity/add/test-bundle');
+    $result = $this->xpath("//label[not(contains(@class, 'element-invisible')) and contains(text(), :label)]/span/text()", array(':label' => $this->instance['label']));
+    $this->assertEqual($result[0], '*', 'Required symbol added to field label.');
+    // Check that the label of the field input is visually hidden and contains
+    // the field title and an indication of the delta for a11y.
+    $result = $this->xpath("//label[contains(@class, 'element-invisible') and contains(text(), :label)]/span/text()", array(':label' => $this->instance['label']));
+    $this->assertEqual($result[0], '*', 'Required symbol and field label are visually hidden.');
+  }
+
   /**
    * Tests widget handling of multiple required radios.
    */

diff --git a/modules/menu/menu.admin.inc b/modules/menu/menu.admin.inc
@@ -59,6 +59,9 @@ function menu_overview_form($form, &$form_state, $menu) {
   foreach ($result as $item) {
     $links[] = $item;
   }
+  $link_count = db_query("SELECT COUNT(*) AS counter FROM {menu_links} WHERE menu_name = :menu AND link_path NOT LIKE :link_path", array(':menu' => $menu['menu_name'], ':link_path' => '%\%%'))->fetchObject();
+  $counter = intval($link_count->counter / 2 ) + 1;
+
   $tree = menu_tree_data($links);
   $node_links = array();
   menu_tree_collect_node_links($tree, $node_links);
@@ -67,7 +70,8 @@ function menu_overview_form($form, &$form_state, $menu) {
   menu_tree_check_access($tree, $node_links);
   $menu_admin = FALSE;
 
-  $form = array_merge($form, _menu_overview_tree_form($tree));
+  $delta = _menu_get_menu_weight_delta($menu['menu_name'], $counter);
+  $form = array_merge($form, _menu_overview_tree_form($tree, $delta));
   $form['#menu'] =  $menu;
 
   if (element_children($form)) {
@@ -88,8 +92,10 @@ function menu_overview_form($form, &$form_state, $menu) {
  *
  * @param $tree
  *   The menu_tree retrieved by menu_tree_data.
+ * @param $delta
+ *   The number of items to use in the menu weight selector. Defaults to 50.
  */
-function _menu_overview_tree_form($tree) {
+function _menu_overview_tree_form($tree, $delta = 50) {
   $form = &drupal_static(__FUNCTION__, array('#tree' => TRUE));
   foreach ($tree as $data) {
     $title = '';
@@ -100,12 +106,7 @@ function _menu_overview_tree_form($tree) {
       $form[$mlid]['#item'] = $item;
       $form[$mlid]['#attributes'] = $item['hidden'] ? array('class' => array('menu-disabled')) : array('class' => array('menu-enabled'));
       $form[$mlid]['title']['#markup'] = l($item['title'], $item['href'], $item['localized_options']);
-      if ($item['hidden']) {
-        $form[$mlid]['title']['#markup'] .= ' (' . t('disabled') . ')';
-      }
-      elseif ($item['link_path'] == 'user' && $item['module'] == 'system') {
-        $form[$mlid]['title']['#markup'] .= ' (' . t('logged in users only') . ')';
-      }
+      menu_add_link_labels($form[$mlid]['title']['#markup'], $item);
 
       $form[$mlid]['hidden'] = array(
         '#type' => 'checkbox',
@@ -115,7 +116,7 @@ function _menu_overview_tree_form($tree) {
       );
       $form[$mlid]['weight'] = array(
         '#type' => 'weight',
-        '#delta' => 50,
+        '#delta' => $delta,
         '#default_value' => $item['weight'],
         '#title_display' => 'invisible',
         '#title' => t('Weight for @title', array('@title' => $item['title'])),
@@ -143,7 +144,7 @@ function _menu_overview_tree_form($tree) {
     }
 
     if ($data['below']) {
-      _menu_overview_tree_form($data['below']);
+      _menu_overview_tree_form($data['below'], $delta);
     }
   }
   return $form;
@@ -358,10 +359,22 @@ function menu_edit_item($form, &$form_state, $type, $item, $menu) {
     '#description' => t('The maximum depth for a link and all its children is fixed at !maxdepth. Some menu links may not be available as parents if selecting them would exceed this limit.', array('!maxdepth' => MENU_MAX_DEPTH)),
     '#attributes' => array('class' => array('menu-title-select')),
   );
+  // Get number of items in all possible parent menus so the weight selector is
+  // sized appropriately.
+  $menu_names = array_keys(menu_get_menus());
+  $menu_options = array();
+  foreach ($menu_names as $menu_name) {
+    if (isset($options[$menu_name . ':0'])) {
+      $menu_options[] = $menu_name;
+    }
+  }
+  // Make sure that we always have values in menu_options.
+  $menu_options = !empty($menu_options) ? $menu_options : $menu_names;
+
   $form['weight'] = array(
     '#type' => 'weight',
     '#title' => t('Weight'),
-    '#delta' => 50,
+    '#delta' => _menu_get_menu_weight_delta($menu_options),
     '#default_value' => $item['weight'],
     '#description' => t('Optional. In the menu, the heavier links will sink and the lighter links will be positioned nearer the top.'),
   );