[Unallocated#247] Update drupal while we're in here.

nhepner1 · Dec 19, 2014 · abc2cf5 · abc2cf5
1 parent 7ee4c97
commit abc2cf5
Show file tree

Hide file tree

Showing 155 changed files with 540 additions and 443 deletions.
diff --git a/docroot/.htaccess b/docroot/.htaccess
@@ -109,13 +109,6 @@ DirectoryIndex index.php index.html index.htm
   # uncomment the following line:
   # RewriteBase /
 
-# AIS: Adaptive Image Style
-  RewriteBase /
-  RewriteCond %{REQUEST_URI} ^(.+)/files/styles/adaptive/(.+)$
-  RewriteCond %{REQUEST_URI} !/modules/image/sample.png
-  RewriteCond %{HTTP_COOKIE} ais=([a-z0-9_-]+)
-  RewriteRule ^(.+)/files/styles/adaptive/(.+)$ $1/files/styles/%1/$2 [R=302,L]
-
   # Pass all requests not referring directly to files in the filesystem to
   # index.php. Clean URLs are handled in drupal_environment_initialize().
   RewriteCond %{REQUEST_FILENAME} !-f

diff --git a/docroot/CHANGELOG.txt b/docroot/CHANGELOG.txt
@@ -1,4 +1,8 @@
 
+Drupal 7.34, 2014-11-19
+----------------------
+- Fixed security issues (multiple vulnerabilities). See SA-CORE-2014-006.
+
 Drupal 7.33, 2014-11-07
 -----------------------
 - Began storing the file modification time of each module and theme in the

diff --git a/docroot/includes/bootstrap.inc b/docroot/includes/bootstrap.inc
@@ -8,7 +8,7 @@
 /**
  * The current system version.
  */
-define('VERSION', '7.33');
+define('VERSION', '7.34');
 
 /**
  * Core API compatibility.

diff --git a/docroot/includes/password.inc b/docroot/includes/password.inc
@@ -140,7 +140,7 @@ function _password_enforce_log2_boundaries($count_log2) {
  * @param $algo
  *   The string name of a hashing algorithm usable by hash(), like 'sha256'.
  * @param $password
- *   The plain-text password to hash.
+ *   Plain-text password up to 512 bytes (128 to 512 UTF-8 characters) to hash.
  * @param $setting
  *   An existing hash or the output of _password_generate_salt().  Must be
  *   at least 12 characters (the settings and salt).
@@ -150,6 +150,10 @@ function _password_enforce_log2_boundaries($count_log2) {
  *   The return string will be truncated at DRUPAL_HASH_LENGTH characters max.
  */
 function _password_crypt($algo, $password, $setting) {
+  // Prevent DoS attacks by refusing to hash large passwords.
+  if (strlen($password) > 512) {
+    return FALSE;
+  }
   // The first 12 characters of an existing hash are its setting string.
   $setting = substr($setting, 0, 12);
 

diff --git a/docroot/includes/session.inc b/docroot/includes/session.inc
@@ -79,7 +79,7 @@ function _drupal_session_read($sid) {
   // Handle the case of first time visitors and clients that don't store
   // cookies (eg. web crawlers).
   $insecure_session_name = substr(session_name(), 1);
-  if (!isset($_COOKIE[session_name()]) && !isset($_COOKIE[$insecure_session_name])) {
+  if (empty($sid) || (!isset($_COOKIE[session_name()]) && !isset($_COOKIE[$insecure_session_name]))) {
     $user = drupal_anonymous_user();
     return '';
   }

diff --git a/docroot/modules/aggregator/aggregator.info b/docroot/modules/aggregator/aggregator.info
@@ -7,8 +7,8 @@ files[] = aggregator.test
 configure = admin/config/services/aggregator/settings
 stylesheets[all][] = aggregator.css
 
-; Information added by Drupal.org packaging script on 2014-11-07
-version = "7.33"
+; Information added by Drupal.org packaging script on 2014-11-19
+version = "7.34"
 project = "drupal"
-datestamp = "1415375131"
+datestamp = "1416429488"
 
diff --git a/docroot/modules/aggregator/tests/aggregator_test.info b/docroot/modules/aggregator/tests/aggregator_test.info
@@ -5,8 +5,8 @@ version = VERSION
 core = 7.x
 hidden = TRUE
 
-; Information added by Drupal.org packaging script on 2014-11-07
-version = "7.33"
+; Information added by Drupal.org packaging script on 2014-11-19
+version = "7.34"
 project = "drupal"
-datestamp = "1415375131"
+datestamp = "1416429488"
 
diff --git a/docroot/modules/block/block.info b/docroot/modules/block/block.info
@@ -6,8 +6,8 @@ core = 7.x
 files[] = block.test
 configure = admin/structure/block
 
-; Information added by Drupal.org packaging script on 2014-11-07
-version = "7.33"
+; Information added by Drupal.org packaging script on 2014-11-19
+version = "7.34"
 project = "drupal"
-datestamp = "1415375131"
+datestamp = "1416429488"
 
diff --git a/docroot/modules/block/tests/block_test.info b/docroot/modules/block/tests/block_test.info
@@ -5,8 +5,8 @@ version = VERSION
 core = 7.x
 hidden = TRUE
 
-; Information added by Drupal.org packaging script on 2014-11-07
-version = "7.33"
+; Information added by Drupal.org packaging script on 2014-11-19
+version = "7.34"
 project = "drupal"
-datestamp = "1415375131"
+datestamp = "1416429488"
 
diff --git a/docroot/modules/block/tests/themes/block_test_theme/block_test_theme.info b/docroot/modules/block/tests/themes/block_test_theme/block_test_theme.info
@@ -13,8 +13,8 @@ regions[footer] = Footer
 regions[highlighted] = Highlighted
 regions[help] = Help
 
-; Information added by Drupal.org packaging script on 2014-11-07
-version = "7.33"
+; Information added by Drupal.org packaging script on 2014-11-19
+version = "7.34"
 project = "drupal"
-datestamp = "1415375131"
+datestamp = "1416429488"
 
diff --git a/docroot/modules/blog/blog.info b/docroot/modules/blog/blog.info
@@ -5,8 +5,8 @@ version = VERSION
 core = 7.x
 files[] = blog.test
 
-; Information added by Drupal.org packaging script on 2014-11-07
-version = "7.33"
+; Information added by Drupal.org packaging script on 2014-11-19
+version = "7.34"
 project = "drupal"
-datestamp = "1415375131"
+datestamp = "1416429488"
 
diff --git a/docroot/modules/book/book.info b/docroot/modules/book/book.info
@@ -7,8 +7,8 @@ files[] = book.test
 configure = admin/content/book/settings
 stylesheets[all][] = book.css
 
-; Information added by Drupal.org packaging script on 2014-11-07
-version = "7.33"
+; Information added by Drupal.org packaging script on 2014-11-19
+version = "7.34"
 project = "drupal"
-datestamp = "1415375131"
+datestamp = "1416429488"
 
diff --git a/docroot/modules/color/color.info b/docroot/modules/color/color.info
@@ -5,8 +5,8 @@ version = VERSION
 core = 7.x
 files[] = color.test
 
-; Information added by Drupal.org packaging script on 2014-11-07
-version = "7.33"
+; Information added by Drupal.org packaging script on 2014-11-19
+version = "7.34"
 project = "drupal"
-datestamp = "1415375131"
+datestamp = "1416429488"
 
diff --git a/docroot/modules/comment/comment.info b/docroot/modules/comment/comment.info
@@ -9,8 +9,8 @@ files[] = comment.test
 configure = admin/content/comment
 stylesheets[all][] = comment.css
 
-; Information added by Drupal.org packaging script on 2014-11-07
-version = "7.33"
+; Information added by Drupal.org packaging script on 2014-11-19
+version = "7.34"
 project = "drupal"
-datestamp = "1415375131"
+datestamp = "1416429488"
 
diff --git a/docroot/modules/contact/contact.info b/docroot/modules/contact/contact.info
@@ -6,8 +6,8 @@ core = 7.x
 files[] = contact.test
 configure = admin/structure/contact
 
-; Information added by Drupal.org packaging script on 2014-11-07
-version = "7.33"
+; Information added by Drupal.org packaging script on 2014-11-19
+version = "7.34"
 project = "drupal"
-datestamp = "1415375131"
+datestamp = "1416429488"
 
diff --git a/docroot/modules/contextual/contextual.info b/docroot/modules/contextual/contextual.info
@@ -5,8 +5,8 @@ version = VERSION
 core = 7.x
 files[] = contextual.test
 
-; Information added by Drupal.org packaging script on 2014-11-07
-version = "7.33"
+; Information added by Drupal.org packaging script on 2014-11-19
+version = "7.34"
 project = "drupal"
-datestamp = "1415375131"
+datestamp = "1416429488"
 
diff --git a/docroot/modules/dashboard/dashboard.info b/docroot/modules/dashboard/dashboard.info
@@ -7,8 +7,8 @@ files[] = dashboard.test
 dependencies[] = block
 configure = admin/dashboard/customize
 
-; Information added by Drupal.org packaging script on 2014-11-07
-version = "7.33"
+; Information added by Drupal.org packaging script on 2014-11-19
+version = "7.34"
 project = "drupal"
-datestamp = "1415375131"
+datestamp = "1416429488"
 
diff --git a/docroot/modules/dblog/dblog.info b/docroot/modules/dblog/dblog.info
@@ -5,8 +5,8 @@ version = VERSION
 core = 7.x
 files[] = dblog.test
 
-; Information added by Drupal.org packaging script on 2014-11-07
-version = "7.33"
+; Information added by Drupal.org packaging script on 2014-11-19
+version = "7.34"
 project = "drupal"
-datestamp = "1415375131"
+datestamp = "1416429488"
 
diff --git a/docroot/modules/field/field.info b/docroot/modules/field/field.info
@@ -11,8 +11,8 @@ dependencies[] = field_sql_storage
 required = TRUE
 stylesheets[all][] = theme/field.css
 
-; Information added by Drupal.org packaging script on 2014-11-07
-version = "7.33"
+; Information added by Drupal.org packaging script on 2014-11-19
+version = "7.34"
 project = "drupal"
-datestamp = "1415375131"
+datestamp = "1416429488"
 
diff --git a/docroot/modules/field/modules/field_sql_storage/field_sql_storage.info b/docroot/modules/field/modules/field_sql_storage/field_sql_storage.info
@@ -7,8 +7,8 @@ dependencies[] = field
 files[] = field_sql_storage.test
 required = TRUE
 
-; Information added by Drupal.org packaging script on 2014-11-07
-version = "7.33"
+; Information added by Drupal.org packaging script on 2014-11-19
+version = "7.34"
 project = "drupal"
-datestamp = "1415375131"
+datestamp = "1416429488"
 
diff --git a/docroot/modules/field/modules/list/list.info b/docroot/modules/field/modules/list/list.info
@@ -7,8 +7,8 @@ dependencies[] = field
 dependencies[] = options
 files[] = tests/list.test
 
-; Information added by Drupal.org packaging script on 2014-11-07
-version = "7.33"
+; Information added by Drupal.org packaging script on 2014-11-19
+version = "7.34"
 project = "drupal"
-datestamp = "1415375131"
+datestamp = "1416429488"
 
diff --git a/docroot/modules/field/modules/list/tests/list_test.info b/docroot/modules/field/modules/list/tests/list_test.info
@@ -5,8 +5,8 @@ package = Testing
 version = VERSION
 hidden = TRUE
 
-; Information added by Drupal.org packaging script on 2014-11-07
-version = "7.33"
+; Information added by Drupal.org packaging script on 2014-11-19
+version = "7.34"
 project = "drupal"
-datestamp = "1415375131"
+datestamp = "1416429488"
 
diff --git a/docroot/modules/field/modules/number/number.info b/docroot/modules/field/modules/number/number.info
@@ -6,8 +6,8 @@ core = 7.x
 dependencies[] = field
 files[] = number.test
 
-; Information added by Drupal.org packaging script on 2014-11-07
-version = "7.33"
+; Information added by Drupal.org packaging script on 2014-11-19
+version = "7.34"
 project = "drupal"
-datestamp = "1415375131"
+datestamp = "1416429488"
 
diff --git a/docroot/modules/field/modules/options/options.info b/docroot/modules/field/modules/options/options.info
@@ -6,8 +6,8 @@ core = 7.x
 dependencies[] = field
 files[] = options.test
 
-; Information added by Drupal.org packaging script on 2014-11-07
-version = "7.33"
+; Information added by Drupal.org packaging script on 2014-11-19
+version = "7.34"
 project = "drupal"
-datestamp = "1415375131"
+datestamp = "1416429488"
 
diff --git a/docroot/modules/field/modules/text/text.info b/docroot/modules/field/modules/text/text.info
@@ -7,8 +7,8 @@ dependencies[] = field
 files[] = text.test
 required = TRUE
 
-; Information added by Drupal.org packaging script on 2014-11-07
-version = "7.33"
+; Information added by Drupal.org packaging script on 2014-11-19
+version = "7.34"
 project = "drupal"
-datestamp = "1415375131"
+datestamp = "1416429488"
 
diff --git a/docroot/modules/field/tests/field_test.info b/docroot/modules/field/tests/field_test.info
@@ -6,8 +6,8 @@ files[] = field_test.entity.inc
 version = VERSION
 hidden = TRUE
 
-; Information added by Drupal.org packaging script on 2014-11-07
-version = "7.33"
+; Information added by Drupal.org packaging script on 2014-11-19
+version = "7.34"
 project = "drupal"
-datestamp = "1415375131"
+datestamp = "1416429488"
 
diff --git a/docroot/modules/field_ui/field_ui.info b/docroot/modules/field_ui/field_ui.info
@@ -6,8 +6,8 @@ core = 7.x
 dependencies[] = field
 files[] = field_ui.test
 
-; Information added by Drupal.org packaging script on 2014-11-07
-version = "7.33"
+; Information added by Drupal.org packaging script on 2014-11-19
+version = "7.34"
 project = "drupal"
-datestamp = "1415375131"
+datestamp = "1416429488"
 
diff --git a/docroot/modules/file/file.info b/docroot/modules/file/file.info
@@ -6,8 +6,8 @@ core = 7.x
 dependencies[] = field
 files[] = tests/file.test
 
-; Information added by Drupal.org packaging script on 2014-11-07
-version = "7.33"
+; Information added by Drupal.org packaging script on 2014-11-19
+version = "7.34"
 project = "drupal"
-datestamp = "1415375131"
+datestamp = "1416429488"
 
diff --git a/docroot/modules/file/tests/file_module_test.info b/docroot/modules/file/tests/file_module_test.info
@@ -5,8 +5,8 @@ version = VERSION
 core = 7.x
 hidden = TRUE
 
-; Information added by Drupal.org packaging script on 2014-11-07
-version = "7.33"
+; Information added by Drupal.org packaging script on 2014-11-19
+version = "7.34"
 project = "drupal"
-datestamp = "1415375131"
+datestamp = "1416429488"
 
diff --git a/docroot/modules/filter/filter.info b/docroot/modules/filter/filter.info
@@ -7,8 +7,8 @@ files[] = filter.test
 required = TRUE
 configure = admin/config/content/formats
 
-; Information added by Drupal.org packaging script on 2014-11-07
-version = "7.33"
+; Information added by Drupal.org packaging script on 2014-11-19
+version = "7.34"
 project = "drupal"
-datestamp = "1415375131"
+datestamp = "1416429488"
 
diff --git a/docroot/modules/forum/forum.info b/docroot/modules/forum/forum.info
@@ -9,8 +9,8 @@ files[] = forum.test
 configure = admin/structure/forum
 stylesheets[all][] = forum.css
 
-; Information added by Drupal.org packaging script on 2014-11-07
-version = "7.33"
+; Information added by Drupal.org packaging script on 2014-11-19
+version = "7.34"
 project = "drupal"
-datestamp = "1415375131"
+datestamp = "1416429488"
 
diff --git a/docroot/modules/help/help.info b/docroot/modules/help/help.info
@@ -5,8 +5,8 @@ version = VERSION
 core = 7.x
 files[] = help.test
 
-; Information added by Drupal.org packaging script on 2014-11-07
-version = "7.33"
+; Information added by Drupal.org packaging script on 2014-11-19
+version = "7.34"
 project = "drupal"
-datestamp = "1415375131"
+datestamp = "1416429488"
 
diff --git a/docroot/modules/image/image.info b/docroot/modules/image/image.info
@@ -7,8 +7,8 @@ dependencies[] = file
 files[] = image.test
 configure = admin/config/media/image-styles
 
-; Information added by Drupal.org packaging script on 2014-11-07
-version = "7.33"
+; Information added by Drupal.org packaging script on 2014-11-19
+version = "7.34"
 project = "drupal"
-datestamp = "1415375131"
+datestamp = "1416429488"