Commit 7cd65d56 authored by Pierre-Yves Gosset's avatar Pierre-Yves Gosset

Update 7.60 + modules Diff, Display, Features, Link, Metatag, Views, VotingAPI

parent 6b9b2704
......@@ -4,3 +4,12 @@ sites/*/settings*.php
# Ignore paths that contain user-generated content.
sites/*/files
sites/*/private
# Ignore non-drupal related stuff
stats/
error/
statistics.json
apple-touch-icon-precomposed.png
apple-touch-icon.png
favicon.ico
favicon.png
Drupal 7.60, 2018-10-18
------------------------
- Fixed security issues. See SA-CORE-2018-006.
Drupal 7.59, 2018-04-25
-----------------------
- Fixed security issues (remote code execution). See SA-CORE-2018-004.
Drupal 7.58, 2018-03-28
-----------------------
......
......@@ -8,7 +8,7 @@
/**
* The current system version.
*/
define('VERSION', '7.58');
define('VERSION', '7.60');
/**
* Core API compatibility.
......@@ -2778,6 +2778,11 @@ function _drupal_bootstrap_variables() {
unset($_GET['destination']);
unset($_REQUEST['destination']);
}
// Use the DrupalRequestSanitizer to ensure that the destination's query
// parameters are not dangerous.
if (isset($_GET['destination'])) {
DrupalRequestSanitizer::cleanDestination();
}
// If there's still something in $_REQUEST['destination'] that didn't come
// from $_GET, check it too.
if (isset($_REQUEST['destination']) && (!isset($_GET['destination']) || $_REQUEST['destination'] != $_GET['destination']) && url_is_external($_REQUEST['destination'])) {
......
......@@ -611,8 +611,9 @@ function drupal_parse_url($url) {
}
// The 'q' parameter contains the path of the current page if clean URLs are
// disabled. It overrides the 'path' of the URL when present, even if clean
// URLs are enabled, due to how Apache rewriting rules work.
if (isset($options['query']['q'])) {
// URLs are enabled, due to how Apache rewriting rules work. The path
// parameter must be a string.
if (isset($options['query']['q']) && is_string($options['query']['q'])) {
$options['path'] = $options['query']['q'];
unset($options['query']['q']);
}
......@@ -2310,7 +2311,10 @@ function url($path = NULL, array $options = array()) {
$language = isset($options['language']) && isset($options['language']->language) ? $options['language']->language : '';
$alias = drupal_get_path_alias($original_path, $language);
if ($alias != $original_path) {
$path = $alias;
// Strip leading slashes from internal path aliases to prevent them
// becoming external URLs without protocol. /example.com should not be
// turned into //example.com.
$path = ltrim($alias, '/');
}
}
......
......@@ -51,6 +51,38 @@ class DrupalRequestSanitizer {
}
}
/**
* Removes the destination if it is dangerous.
*
* Note this can only be called after common.inc has been included.
*
* @return bool
* TRUE if the destination has been removed from $_GET, FALSE if not.
*/
public static function cleanDestination() {
$dangerous_keys = array();
$log_sanitized_keys = variable_get('sanitize_input_logging', FALSE);
$parts = drupal_parse_url($_GET['destination']);
// If there is a query string, check its query parameters.
if (!empty($parts['query'])) {
$whitelist = variable_get('sanitize_input_whitelist', array());
self::stripDangerousValues($parts['query'], $whitelist, $dangerous_keys);
if (!empty($dangerous_keys)) {
// The destination is removed rather than sanitized to mirror the
// handling of external destinations.
unset($_GET['destination']);
unset($_REQUEST['destination']);
if ($log_sanitized_keys) {
trigger_error(format_string('Potentially unsafe destination removed from query string parameters (GET) because it contained the following keys: @keys', array('@keys' => implode(', ', $dangerous_keys))));
}
return TRUE;
}
}
return FALSE;
}
/**
* Strips dangerous keys from the provided input.
*
......
......@@ -7,8 +7,7 @@ files[] = aggregator.test
configure = admin/config/services/aggregator/settings
stylesheets[all][] = aggregator.css
; Information added by Drupal.org packaging script on 2018-03-28
version = "7.58"
; Information added by Drupal.org packaging script on 2018-10-17
version = "7.60"
project = "drupal"
datestamp = "1522264019"
datestamp = "1539816636"
......@@ -5,8 +5,7 @@ version = VERSION
core = 7.x
hidden = TRUE
; Information added by Drupal.org packaging script on 2018-03-28
version = "7.58"
; Information added by Drupal.org packaging script on 2018-10-17
version = "7.60"
project = "drupal"
datestamp = "1522264019"
datestamp = "1539816636"
......@@ -6,8 +6,7 @@ core = 7.x
files[] = block.test
configure = admin/structure/block
; Information added by Drupal.org packaging script on 2018-03-28
version = "7.58"
; Information added by Drupal.org packaging script on 2018-10-17
version = "7.60"
project = "drupal"
datestamp = "1522264019"
datestamp = "1539816636"
......@@ -5,8 +5,7 @@ version = VERSION
core = 7.x
hidden = TRUE
; Information added by Drupal.org packaging script on 2018-03-28
version = "7.58"
; Information added by Drupal.org packaging script on 2018-10-17
version = "7.60"
project = "drupal"
datestamp = "1522264019"
datestamp = "1539816636"
......@@ -13,8 +13,7 @@ regions[footer] = Footer
regions[highlighted] = Highlighted
regions[help] = Help
; Information added by Drupal.org packaging script on 2018-03-28
version = "7.58"
; Information added by Drupal.org packaging script on 2018-10-17
version = "7.60"
project = "drupal"
datestamp = "1522264019"
datestamp = "1539816636"
......@@ -5,8 +5,7 @@ version = VERSION
core = 7.x
files[] = blog.test
; Information added by Drupal.org packaging script on 2018-03-28
version = "7.58"
; Information added by Drupal.org packaging script on 2018-10-17
version = "7.60"
project = "drupal"
datestamp = "1522264019"
datestamp = "1539816636"
......@@ -7,8 +7,7 @@ files[] = book.test
configure = admin/content/book/settings
stylesheets[all][] = book.css
; Information added by Drupal.org packaging script on 2018-03-28
version = "7.58"
; Information added by Drupal.org packaging script on 2018-10-17
version = "7.60"
project = "drupal"
datestamp = "1522264019"
datestamp = "1539816636"
......@@ -5,8 +5,7 @@ version = VERSION
core = 7.x
files[] = color.test
; Information added by Drupal.org packaging script on 2018-03-28
version = "7.58"
; Information added by Drupal.org packaging script on 2018-10-17
version = "7.60"
project = "drupal"
datestamp = "1522264019"
datestamp = "1539816636"
......@@ -9,8 +9,7 @@ files[] = comment.test
configure = admin/content/comment
stylesheets[all][] = comment.css
; Information added by Drupal.org packaging script on 2018-03-28
version = "7.58"
; Information added by Drupal.org packaging script on 2018-10-17
version = "7.60"
project = "drupal"
datestamp = "1522264019"
datestamp = "1539816636"
......@@ -6,8 +6,7 @@ core = 7.x
files[] = contact.test
configure = admin/structure/contact
; Information added by Drupal.org packaging script on 2018-03-28
version = "7.58"
; Information added by Drupal.org packaging script on 2018-10-17
version = "7.60"
project = "drupal"
datestamp = "1522264019"
datestamp = "1539816636"
......@@ -5,8 +5,7 @@ version = VERSION
core = 7.x
files[] = contextual.test
; Information added by Drupal.org packaging script on 2018-03-28
version = "7.58"
; Information added by Drupal.org packaging script on 2018-10-17
version = "7.60"
project = "drupal"
datestamp = "1522264019"
datestamp = "1539816636"
......@@ -7,8 +7,7 @@ files[] = dashboard.test
dependencies[] = block
configure = admin/dashboard/customize
; Information added by Drupal.org packaging script on 2018-03-28
version = "7.58"
; Information added by Drupal.org packaging script on 2018-10-17
version = "7.60"
project = "drupal"
datestamp = "1522264019"
datestamp = "1539816636"
......@@ -5,8 +5,7 @@ version = VERSION
core = 7.x
files[] = dblog.test
; Information added by Drupal.org packaging script on 2018-03-28
version = "7.58"
; Information added by Drupal.org packaging script on 2018-10-17
version = "7.60"
project = "drupal"
datestamp = "1522264019"
datestamp = "1539816636"
......@@ -11,8 +11,7 @@ dependencies[] = field_sql_storage
required = TRUE
stylesheets[all][] = theme/field.css
; Information added by Drupal.org packaging script on 2018-03-28
version = "7.58"
; Information added by Drupal.org packaging script on 2018-10-17
version = "7.60"
project = "drupal"
datestamp = "1522264019"
datestamp = "1539816636"
......@@ -7,8 +7,7 @@ dependencies[] = field
files[] = field_sql_storage.test
required = TRUE
; Information added by Drupal.org packaging script on 2018-03-28
version = "7.58"
; Information added by Drupal.org packaging script on 2018-10-17
version = "7.60"
project = "drupal"
datestamp = "1522264019"
datestamp = "1539816636"
......@@ -7,8 +7,7 @@ dependencies[] = field
dependencies[] = options
files[] = tests/list.test
; Information added by Drupal.org packaging script on 2018-03-28
version = "7.58"
; Information added by Drupal.org packaging script on 2018-10-17
version = "7.60"
project = "drupal"
datestamp = "1522264019"
datestamp = "1539816636"
......@@ -5,8 +5,7 @@ package = Testing
version = VERSION
hidden = TRUE
; Information added by Drupal.org packaging script on 2018-03-28
version = "7.58"
; Information added by Drupal.org packaging script on 2018-10-17