Unverified Commit 3c216ebf authored by Maksim Baev's avatar Maksim Baev Committed by GitHub

issue #939: Вышло критическое обновление Drupal 7.57

parent fd579b41
......@@ -8,7 +8,7 @@
/**
* The current system version.
*/
define('VERSION', '7.56');
define('VERSION', '7.57');
/**
* Core API compatibility.
......
......@@ -2236,8 +2236,11 @@ function url($path = NULL, array $options = array()) {
'prefix' => ''
);
// Determine whether this is an external link, but ensure that the current
// path is always treated as internal by default (to prevent external link
// injection vulnerabilities).
if (!isset($options['external'])) {
$options['external'] = url_is_external($path);
$options['external'] = $path === $_GET['q'] ? FALSE : url_is_external($path);
}
// Preserve the original path before altering or aliasing.
......
......@@ -27,6 +27,42 @@ $.fn.init = function (selector, context, rootjQuery) {
};
$.fn.init.prototype = jquery_init.prototype;
/**
* Pre-filter Ajax requests to guard against XSS attacks.
*
* See https://github.com/jquery/jquery/issues/2432
*/
if ($.ajaxPrefilter) {
// For newer versions of jQuery, use an Ajax prefilter to prevent
// auto-executing script tags from untrusted domains. This is similar to the
// fix that is built in to jQuery 3.0 and higher.
$.ajaxPrefilter(function (s) {
if (s.crossDomain) {
s.contents.script = false;
}
});
}
else if ($.httpData) {
// For the version of jQuery that ships with Drupal core, override
// jQuery.httpData to prevent auto-detecting "script" data types from
// untrusted domains.
var jquery_httpData = $.httpData;
$.httpData = function (xhr, type, s) {
// @todo Consider backporting code from newer jQuery versions to check for
// a cross-domain request here, rather than using Drupal.urlIsLocal() to
// block scripts from all URLs that are not on the same site.
if (!type && !Drupal.urlIsLocal(s.url)) {
var content_type = xhr.getResponseHeader('content-type') || '';
if (content_type.indexOf('javascript') >= 0) {
// Default to a safe data type.
type = 'text';
}
}
return jquery_httpData.call(this, xhr, type, s);
};
$.httpData.prototype = jquery_httpData.prototype;
}
/**
* Attach all registered behaviors to a page element.
*
......@@ -137,7 +173,7 @@ Drupal.detachBehaviors = function (context, settings, trigger) {
*/
Drupal.checkPlain = function (str) {
var character, regex,
replace = { '&': '&amp;', '"': '&quot;', '<': '&lt;', '>': '&gt;' };
replace = { '&': '&amp;', "'": '&#39;', '"': '&quot;', '<': '&lt;', '>': '&gt;' };
str = String(str);
for (character in replace) {
if (replace.hasOwnProperty(character)) {
......
......@@ -7,8 +7,8 @@ files[] = aggregator.test
configure = admin/config/services/aggregator/settings
stylesheets[all][] = aggregator.css
; Information added by Drupal.org packaging script on 2017-06-21
version = "7.56"
; Information added by Drupal.org packaging script on 2018-02-21
version = "7.57"
project = "drupal"
datestamp = "1498069849"
datestamp = "1519235152"
......@@ -5,8 +5,8 @@ version = VERSION
core = 7.x
hidden = TRUE
; Information added by Drupal.org packaging script on 2017-06-21
version = "7.56"
; Information added by Drupal.org packaging script on 2018-02-21
version = "7.57"
project = "drupal"
datestamp = "1498069849"
datestamp = "1519235152"
......@@ -6,8 +6,8 @@ core = 7.x
files[] = block.test
configure = admin/structure/block
; Information added by Drupal.org packaging script on 2017-06-21
version = "7.56"
; Information added by Drupal.org packaging script on 2018-02-21
version = "7.57"
project = "drupal"
datestamp = "1498069849"
datestamp = "1519235152"
......@@ -5,8 +5,8 @@ version = VERSION
core = 7.x
hidden = TRUE
; Information added by Drupal.org packaging script on 2017-06-21
version = "7.56"
; Information added by Drupal.org packaging script on 2018-02-21
version = "7.57"
project = "drupal"
datestamp = "1498069849"
datestamp = "1519235152"
......@@ -13,8 +13,8 @@ regions[footer] = Footer
regions[highlighted] = Highlighted
regions[help] = Help
; Information added by Drupal.org packaging script on 2017-06-21
version = "7.56"
; Information added by Drupal.org packaging script on 2018-02-21
version = "7.57"
project = "drupal"
datestamp = "1498069849"
datestamp = "1519235152"
......@@ -5,8 +5,8 @@ version = VERSION
core = 7.x
files[] = blog.test
; Information added by Drupal.org packaging script on 2017-06-21
version = "7.56"
; Information added by Drupal.org packaging script on 2018-02-21
version = "7.57"
project = "drupal"
datestamp = "1498069849"
datestamp = "1519235152"
......@@ -7,8 +7,8 @@ files[] = book.test
configure = admin/content/book/settings
stylesheets[all][] = book.css
; Information added by Drupal.org packaging script on 2017-06-21
version = "7.56"
; Information added by Drupal.org packaging script on 2018-02-21
version = "7.57"
project = "drupal"
datestamp = "1498069849"
datestamp = "1519235152"
......@@ -5,8 +5,8 @@ version = VERSION
core = 7.x
files[] = color.test
; Information added by Drupal.org packaging script on 2017-06-21
version = "7.56"
; Information added by Drupal.org packaging script on 2018-02-21
version = "7.57"
project = "drupal"
datestamp = "1498069849"
datestamp = "1519235152"
......@@ -9,8 +9,8 @@ files[] = comment.test
configure = admin/content/comment
stylesheets[all][] = comment.css
; Information added by Drupal.org packaging script on 2017-06-21
version = "7.56"
; Information added by Drupal.org packaging script on 2018-02-21
version = "7.57"
project = "drupal"
datestamp = "1498069849"
datestamp = "1519235152"
......@@ -6,8 +6,8 @@ core = 7.x
files[] = contact.test
configure = admin/structure/contact
; Information added by Drupal.org packaging script on 2017-06-21
version = "7.56"
; Information added by Drupal.org packaging script on 2018-02-21
version = "7.57"
project = "drupal"
datestamp = "1498069849"
datestamp = "1519235152"
......@@ -5,8 +5,8 @@ version = VERSION
core = 7.x
files[] = contextual.test
; Information added by Drupal.org packaging script on 2017-06-21
version = "7.56"
; Information added by Drupal.org packaging script on 2018-02-21
version = "7.57"
project = "drupal"
datestamp = "1498069849"
datestamp = "1519235152"
......@@ -7,8 +7,8 @@ files[] = dashboard.test
dependencies[] = block
configure = admin/dashboard/customize
; Information added by Drupal.org packaging script on 2017-06-21
version = "7.56"
; Information added by Drupal.org packaging script on 2018-02-21
version = "7.57"
project = "drupal"
datestamp = "1498069849"
datestamp = "1519235152"
......@@ -5,8 +5,8 @@ version = VERSION
core = 7.x
files[] = dblog.test
; Information added by Drupal.org packaging script on 2017-06-21
version = "7.56"
; Information added by Drupal.org packaging script on 2018-02-21
version = "7.57"
project = "drupal"
datestamp = "1498069849"
datestamp = "1519235152"
......@@ -11,8 +11,8 @@ dependencies[] = field_sql_storage
required = TRUE
stylesheets[all][] = theme/field.css
; Information added by Drupal.org packaging script on 2017-06-21
version = "7.56"
; Information added by Drupal.org packaging script on 2018-02-21
version = "7.57"
project = "drupal"
datestamp = "1498069849"
datestamp = "1519235152"
......@@ -7,8 +7,8 @@ dependencies[] = field
files[] = field_sql_storage.test
required = TRUE
; Information added by Drupal.org packaging script on 2017-06-21
version = "7.56"
; Information added by Drupal.org packaging script on 2018-02-21
version = "7.57"
project = "drupal"
datestamp = "1498069849"
datestamp = "1519235152"
......@@ -7,8 +7,8 @@ dependencies[] = field
dependencies[] = options
files[] = tests/list.test
; Information added by Drupal.org packaging script on 2017-06-21
version = "7.56"
; Information added by Drupal.org packaging script on 2018-02-21
version = "7.57"
project = "drupal"
datestamp = "1498069849"
datestamp = "1519235152"
......@@ -5,8 +5,8 @@ package = Testing
version = VERSION
hidden = TRUE
; Information added by Drupal.org packaging script on 2017-06-21
version = "7.56"
; Information added by Drupal.org packaging script on 2018-02-21
version = "7.57"
project = "drupal"
datestamp = "1498069849"
datestamp = "1519235152"
......@@ -6,8 +6,8 @@ core = 7.x
dependencies[] = field
files[] = number.test
; Information added by Drupal.org packaging script on 2017-06-21
version = "7.56"
; Information added by Drupal.org packaging script on 2018-02-21
version = "7.57"
project = "drupal"
datestamp = "1498069849"
datestamp = "1519235152"
......@@ -6,8 +6,8 @@ core = 7.x
dependencies[] = field
files[] = options.test
; Information added by Drupal.org packaging script on 2017-06-21
version = "7.56"
; Information added by Drupal.org packaging script on 2018-02-21
version = "7.57"
project = "drupal"
datestamp = "1498069849"
datestamp = "1519235152"
......@@ -7,8 +7,8 @@ dependencies[] = field
files[] = text.test
required = TRUE
; Information added by Drupal.org packaging script on 2017-06-21
version = "7.56"
; Information added by Drupal.org packaging script on 2018-02-21
version = "7.57"
project = "drupal"
datestamp = "1498069849"
datestamp = "1519235152"
......@@ -6,8 +6,8 @@ files[] = field_test.entity.inc
version = VERSION
hidden = TRUE
; Information added by Drupal.org packaging script on 2017-06-21
version = "7.56"
; Information added by Drupal.org packaging script on 2018-02-21
version = "7.57"
project = "drupal"
datestamp = "1498069849"
datestamp = "1519235152"
......@@ -6,8 +6,8 @@ core = 7.x
dependencies[] = field
files[] = field_ui.test
; Information added by Drupal.org packaging script on 2017-06-21
version = "7.56"
; Information added by Drupal.org packaging script on 2018-02-21
version = "7.57"
project = "drupal"
datestamp = "1498069849"
datestamp = "1519235152"
......@@ -6,8 +6,8 @@ core = 7.x
dependencies[] = field
files[] = tests/file.test
; Information added by Drupal.org packaging script on 2017-06-21
version = "7.56"
; Information added by Drupal.org packaging script on 2018-02-21
version = "7.57"
project = "drupal"
datestamp = "1498069849"
datestamp = "1519235152"
......@@ -140,7 +140,7 @@ function file_file_download($uri, $field_type = 'file') {
}
// Find out which (if any) fields of this type contain the file.
$references = file_get_file_references($file, NULL, FIELD_LOAD_CURRENT, $field_type);
$references = file_get_file_references($file, NULL, FIELD_LOAD_CURRENT, $field_type, FALSE);
// Stop processing if there are no references in order to avoid returning
// headers for files controlled by other modules. Make an exception for
......@@ -1067,11 +1067,18 @@ function file_icon_map($file) {
* @param $field_type
* (optional) The name of a field type. If given, limits the reference check
* to fields of the given type.
* @param $check_access
* (optional) A boolean that specifies whether the permissions of the current
* user should be checked when retrieving references. If FALSE, all
* references to the file are returned. If TRUE, only references from
* entities that the current user has access to are returned. Defaults to
* TRUE for backwards compatibility reasons, but FALSE is recommended for
* most situations.
*
* @return
* An integer value.
*/
function file_get_file_references($file, $field = NULL, $age = FIELD_LOAD_REVISION, $field_type = 'file') {
function file_get_file_references($file, $field = NULL, $age = FIELD_LOAD_REVISION, $field_type = 'file', $check_access = TRUE) {
$references = drupal_static(__FUNCTION__, array());
$fields = isset($field) ? array($field['field_name'] => $field) : field_info_fields();
......@@ -1082,6 +1089,11 @@ function file_get_file_references($file, $field = NULL, $age = FIELD_LOAD_REVISI
$query
->fieldCondition($file_field, 'fid', $file->fid)
->age($age);
if (!$check_access) {
// Neutralize the 'entity_field_access' query tag added by
// field_sql_storage_field_storage_query().
$query->addTag('DANGEROUS_ACCESS_CHECK_OPT_OUT');
}
$references[$field_name] = $query->execute();
}
}
......
......@@ -1626,6 +1626,79 @@ class FilePrivateTestCase extends FileFieldTestCase {
$this->drupalGet($file_url);
$this->assertResponse(403, 'Confirmed that another anonymous user cannot access the permanent file when it is referenced by an unpublished node.');
}
/**
* Tests file access for private nodes when file download access is granted.
*/
function testPrivateFileDownloadAccessGranted() {
// Tell file_module_test to attempt to grant access to all private files,
// and ensure that it is doing so correctly.
$test_file = $this->getTestFile('text');
$uri = file_unmanaged_move($test_file->uri, 'private://');
$file_url = file_create_url($uri);
$this->drupalGet($file_url);
$this->assertResponse(403, 'Access is not granted to an arbitrary private file by default.');
variable_set('file_module_test_grant_download_access', TRUE);
$this->drupalGet($file_url);
$this->assertResponse(200, 'Access is granted to an arbitrary private file after a module grants access to all private files in hook_file_download().');
// Create a public node with a file attached.
$type_name = 'page';
$field_name = strtolower($this->randomName());
$this->createFileField($field_name, $type_name, array('uri_scheme' => 'private'));
$test_file = $this->getTestFile('text');
$nid = $this->uploadNodeFile($test_file, $field_name, $type_name, TRUE, array('private' => FALSE));
$node = node_load($nid, NULL, TRUE);
$file_url = file_create_url($node->{$field_name}[LANGUAGE_NONE][0]['uri']);
// Unpublish the node and ensure that only administrators (not anonymous
// users) can access the node and download the file; the expectation is
// that the File module's hook_file_download() implementation will deny
// access and thereby override the file_module_test module's access grant.
$node->status = NODE_NOT_PUBLISHED;
node_save($node);
$this->drupalLogin($this->admin_user);
$this->drupalGet("node/$nid");
$this->assertResponse(200, 'Administrator can access the unpublished node.');
$this->drupalGet($file_url);
$this->assertResponse(200, 'Administrator can download the file attached to the unpublished node.');
$this->drupalLogOut();
$this->drupalGet("node/$nid");
$this->assertResponse(403, 'Anonymous user cannot access the unpublished node.');
$this->drupalGet($file_url);
$this->assertResponse(403, 'Anonymous user cannot download the file attached to the unpublished node.');
// Re-publish the node and ensure that the node and file can be accessed by
// everyone.
$node->status = NODE_PUBLISHED;
node_save($node);
$this->drupalLogin($this->admin_user);
$this->drupalGet("node/$nid");
$this->assertResponse(200, 'Administrator can access the published node.');
$this->drupalGet($file_url);
$this->assertResponse(200, 'Administrator can download the file attached to the published node.');
$this->drupalLogOut();
$this->drupalGet("node/$nid");
$this->assertResponse(200, 'Anonymous user can access the published node.');
$this->drupalGet($file_url);
$this->assertResponse(200, 'Anonymous user can download the file attached to the published node.');
// Make the node private via the node access system and test that only
// administrators (not anonymous users) can access the node and download
// the file.
$node->private = TRUE;
node_save($node);
$this->drupalLogin($this->admin_user);
$this->drupalGet("node/$nid");
$this->assertResponse(200, 'Administrator can access the private node.');
$this->drupalGet($file_url);
$this->assertResponse(200, 'Administrator can download the file attached to the private node.');
$this->drupalLogOut();
$this->drupalGet("node/$nid");
$this->assertResponse(403, 'Anonymous user cannot access the private node.');
$this->drupalGet($file_url);
$this->assertResponse(403, 'Anonymous user cannot download the file attached to the private node.');
}
}
/**
......
......@@ -5,8 +5,8 @@ version = VERSION
core = 7.x
hidden = TRUE
; Information added by Drupal.org packaging script on 2017-06-21
version = "7.56"
; Information added by Drupal.org packaging script on 2018-02-21
version = "7.57"
project = "drupal"
datestamp = "1498069849"
datestamp = "1519235152"
......@@ -67,3 +67,18 @@ function file_module_test_form_submit($form, &$form_state) {
}
drupal_set_message(t('The file id is %fid.', array('%fid' => $fid)));
}
/**
* Implements hook_file_download().
*/
function file_module_test_file_download($uri) {
if (variable_get('file_module_test_grant_download_access')) {
// Mimic what file_get_content_headers() would do if we had a full $file
// object to pass to it.
return array(
'Content-Type' => mime_header_encode(file_get_mimetype($uri)),
'Content-Length' => filesize($uri),
'Cache-Control' => 'private',
);
}
}
......@@ -7,8 +7,8 @@ files[] = filter.test
required = TRUE
configure = admin/config/content/formats
; Information added by Drupal.org packaging script on 2017-06-21
version = "7.56"
; Information added by Drupal.org packaging script on 2018-02-21
version = "7.57"
project = "drupal"
datestamp = "1498069849"
datestamp = "1519235152"
......@@ -9,8 +9,8 @@ files[] = forum.test
configure = admin/structure/forum
stylesheets[all][] = forum.css
; Information added by Drupal.org packaging script on 2017-06-21
version = "7.56"
; Information added by Drupal.org packaging script on 2018-02-21
version = "7.57"
project = "drupal"
datestamp = "1498069849"
datestamp = "1519235152"
......@@ -5,8 +5,8 @@ version = VERSION
core = 7.x
files[] = help.test
; Information added by Drupal.org packaging script on 2017-06-21
version = "7.56"
; Information added by Drupal.org packaging script on 2018-02-21
version = "7.57"
project = "drupal"
datestamp = "1498069849"
datestamp = "1519235152"
......@@ -7,8 +7,8 @@ dependencies[] = file
files[] = image.test
configure = admin/config/media/image-styles
; Information added by Drupal.org packaging script on 2017-06-21
version = "7.56"
; Information added by Drupal.org packaging script on 2018-02-21
version = "7.57"
project = "drupal"
datestamp = "1498069849"
datestamp = "1519235152"
......@@ -6,8 +6,8 @@ core = 7.x
files[] = image_module_test.module
hidden = TRUE
; Information added by Drupal.org packaging script on 2017-06-21
version = "7.56"
; Information added by Drupal.org packaging script on 2018-02-21
version = "7.57"
project = "drupal"
datestamp = "1498069849"
datestamp = "1519235152"
......@@ -6,8 +6,8 @@ core = 7.x
files[] = locale.test
configure = admin/config/regional/language
; Information added by Drupal.org packaging script on 2017-06-21
version = "7.56"
; Information added by Drupal.org packaging script on 2018-02-21
version = "7.57"
project = "drupal"
datestamp = "1498069849"
datestamp = "1519235152"
......@@ -5,8 +5,8 @@ package = Testing
version = VERSION
hidden = TRUE
; Information added by Drupal.org packaging script on 2017-06-21
version = "7.56"
; Information added by Drupal.org packaging script on 2018-02-21
version = "7.57"
project = "drupal"
datestamp = "1498069849"
datestamp = "1519235152"
......@@ -6,8 +6,8 @@ core = 7.x
files[] = menu.test
configure = admin/structure/menu
; Information added by Drupal.org packaging script on 2017-06-21
version = "7.56"
; Information added by Drupal.org packaging script on 2018-02-21
version = "7.57"
project = "drupal"
datestamp = "1498069849"
datestamp = "1519235152"
......@@ -9,8 +9,8 @@ required = TRUE
configure = admin/structure/types
stylesheets[all][] = node.css
; Information added by Drupal.org packaging script on 2017-06-21
version = "7.56"
; Information added by Drupal.org packaging script on 2018-02-21
version = "7.57"
project = "drupal"
datestamp = "1498069849"
datestamp = "1519235152"
......@@ -5,8 +5,8 @@ version = VERSION
core = 7.x
hidden = TRUE
; Information added by Drupal.org packaging script on 2017-06-21
version = "7.56"
; Information added by Drupal.org packaging script on 2018-02-21
version = "7.57"
project = "drupal"
datestamp = "1498069849"
datestamp = "1519235152"