Skip to content
This repository was archived by the owner on Aug 14, 2023. It is now read-only.

Commit 9d1ac80

Browse files
cablemancableman
committed
SERV-214: Updated core and modules
1 parent e9623e6 commit 9d1ac80

File tree

177 files changed

+3204
-1014
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

177 files changed

+3204
-1014
lines changed

‎CHANGELOG.txt

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,14 @@
1+
Drupal 7.60, 2018-10-18
2+
------------------------
3+
- Fixed security issues. See SA-CORE-2018-006.
4+
5+
Drupal 7.59, 2018-04-25
6+
-----------------------
7+
- Fixed security issues (remote code execution). See SA-CORE-2018-004.
8+
9+
Drupal 7.58, 2018-03-28
10+
-----------------------
11+
- Fixed security issues (multiple vulnerabilities). See SA-CORE-2018-002.
112

213
Drupal 7.57, 2018-02-21
314
-----------------------

‎includes/bootstrap.inc

Lines changed: 10 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@
88
/**
99
* The current system version.
1010
*/
11-
define('VERSION', '7.57');
11+
define('VERSION', '7.60');
1212

1313
/**
1414
* Core API compatibility.
@@ -2632,6 +2632,10 @@ function _drupal_bootstrap_configuration() {
26322632
timer_start('page');
26332633
// Initialize the configuration, including variables from settings.php.
26342634
drupal_settings_initialize();
2635+
2636+
// Sanitize unsafe keys from the request.
2637+
require_once DRUPAL_ROOT . '/includes/request-sanitizer.inc';
2638+
DrupalRequestSanitizer::sanitize();
26352639
}
26362640

26372641
/**
@@ -2774,6 +2778,11 @@ function _drupal_bootstrap_variables() {
27742778
unset($_GET['destination']);
27752779
unset($_REQUEST['destination']);
27762780
}
2781+
// Use the DrupalRequestSanitizer to ensure that the destination's query
2782+
// parameters are not dangerous.
2783+
if (isset($_GET['destination'])) {
2784+
DrupalRequestSanitizer::cleanDestination();
2785+
}
27772786
// If there's still something in $_REQUEST['destination'] that didn't come
27782787
// from $_GET, check it too.
27792788
if (isset($_REQUEST['destination']) && (!isset($_GET['destination']) || $_REQUEST['destination'] != $_GET['destination']) && url_is_external($_REQUEST['destination'])) {

‎includes/common.inc

Lines changed: 7 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -611,8 +611,9 @@ function drupal_parse_url($url) {
611611
}
612612
// The 'q' parameter contains the path of the current page if clean URLs are
613613
// disabled. It overrides the 'path' of the URL when present, even if clean
614-
// URLs are enabled, due to how Apache rewriting rules work.
615-
if (isset($options['query']['q'])) {
614+
// URLs are enabled, due to how Apache rewriting rules work. The path
615+
// parameter must be a string.
616+
if (isset($options['query']['q']) && is_string($options['query']['q'])) {
616617
$options['path'] = $options['query']['q'];
617618
unset($options['query']['q']);
618619
}
@@ -2310,7 +2311,10 @@ function url($path = NULL, array $options = array()) {
23102311
$language = isset($options['language']) && isset($options['language']->language) ? $options['language']->language : '';
23112312
$alias = drupal_get_path_alias($original_path, $language);
23122313
if ($alias != $original_path) {
2313-
$path = $alias;
2314+
// Strip leading slashes from internal path aliases to prevent them
2315+
// becoming external URLs without protocol. /example.com should not be
2316+
// turned into //example.com.
2317+
$path = ltrim($alias, '/');
23142318
}
23152319
}
23162320

‎includes/request-sanitizer.inc

Lines changed: 114 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,114 @@
1+
<?php
2+
3+
/**
4+
* @file
5+
* Contains code for sanitizing user input from the request.
6+
*/
7+
8+
/**
9+
* Sanitizes user input from the request.
10+
*/
11+
class DrupalRequestSanitizer {
12+
13+
/**
14+
* Tracks whether the request was already sanitized.
15+
*/
16+
protected static $sanitized = FALSE;
17+
18+
/**
19+
* Modifies the request to strip dangerous keys from user input.
20+
*/
21+
public static function sanitize() {
22+
if (!self::$sanitized) {
23+
$whitelist = variable_get('sanitize_input_whitelist', array());
24+
$log_sanitized_keys = variable_get('sanitize_input_logging', FALSE);
25+
26+
// Process query string parameters.
27+
$get_sanitized_keys = array();
28+
$_GET = self::stripDangerousValues($_GET, $whitelist, $get_sanitized_keys);
29+
if ($log_sanitized_keys && $get_sanitized_keys) {
30+
_drupal_trigger_error_with_delayed_logging(format_string('Potentially unsafe keys removed from query string parameters (GET): @keys', array('@keys' => implode(', ', $get_sanitized_keys))), E_USER_NOTICE);
31+
}
32+
33+
// Process request body parameters.
34+
$post_sanitized_keys = array();
35+
$_POST = self::stripDangerousValues($_POST, $whitelist, $post_sanitized_keys);
36+
if ($log_sanitized_keys && $post_sanitized_keys) {
37+
_drupal_trigger_error_with_delayed_logging(format_string('Potentially unsafe keys removed from request body parameters (POST): @keys', array('@keys' => implode(', ', $post_sanitized_keys))), E_USER_NOTICE);
38+
}
39+
40+
// Process cookie parameters.
41+
$cookie_sanitized_keys = array();
42+
$_COOKIE = self::stripDangerousValues($_COOKIE, $whitelist, $cookie_sanitized_keys);
43+
if ($log_sanitized_keys && $cookie_sanitized_keys) {
44+
_drupal_trigger_error_with_delayed_logging(format_string('Potentially unsafe keys removed from cookie parameters (COOKIE): @keys', array('@keys' => implode(', ', $cookie_sanitized_keys))), E_USER_NOTICE);
45+
}
46+
47+
$request_sanitized_keys = array();
48+
$_REQUEST = self::stripDangerousValues($_REQUEST, $whitelist, $request_sanitized_keys);
49+
50+
self::$sanitized = TRUE;
51+
}
52+
}
53+
54+
/**
55+
* Removes the destination if it is dangerous.
56+
*
57+
* Note this can only be called after common.inc has been included.
58+
*
59+
* @return bool
60+
* TRUE if the destination has been removed from $_GET, FALSE if not.
61+
*/
62+
public static function cleanDestination() {
63+
$dangerous_keys = array();
64+
$log_sanitized_keys = variable_get('sanitize_input_logging', FALSE);
65+
66+
$parts = drupal_parse_url($_GET['destination']);
67+
// If there is a query string, check its query parameters.
68+
if (!empty($parts['query'])) {
69+
$whitelist = variable_get('sanitize_input_whitelist', array());
70+
71+
self::stripDangerousValues($parts['query'], $whitelist, $dangerous_keys);
72+
if (!empty($dangerous_keys)) {
73+
// The destination is removed rather than sanitized to mirror the
74+
// handling of external destinations.
75+
unset($_GET['destination']);
76+
unset($_REQUEST['destination']);
77+
if ($log_sanitized_keys) {
78+
trigger_error(format_string('Potentially unsafe destination removed from query string parameters (GET) because it contained the following keys: @keys', array('@keys' => implode(', ', $dangerous_keys))));
79+
}
80+
return TRUE;
81+
}
82+
}
83+
return FALSE;
84+
}
85+
86+
/**
87+
* Strips dangerous keys from the provided input.
88+
*
89+
* @param mixed $input
90+
* The input to sanitize.
91+
* @param string[] $whitelist
92+
* An array of keys to whitelist as safe.
93+
* @param string[] $sanitized_keys
94+
* An array of keys that have been removed.
95+
*
96+
* @return mixed
97+
* The sanitized input.
98+
*/
99+
protected static function stripDangerousValues($input, array $whitelist, array &$sanitized_keys) {
100+
if (is_array($input)) {
101+
foreach ($input as $key => $value) {
102+
if ($key !== '' && $key[0] === '#' && !in_array($key, $whitelist, TRUE)) {
103+
unset($input[$key]);
104+
$sanitized_keys[] = $key;
105+
}
106+
else {
107+
$input[$key] = self::stripDangerousValues($input[$key], $whitelist, $sanitized_keys);
108+
}
109+
}
110+
}
111+
return $input;
112+
}
113+
114+
}

‎modules/aggregator/aggregator.info

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -7,8 +7,7 @@ files[] = aggregator.test
77
configure = admin/config/services/aggregator/settings
88
stylesheets[all][] = aggregator.css
99

10-
; Information added by Drupal.org packaging script on 2018-02-21
11-
version = "7.57"
10+
; Information added by Drupal.org packaging script on 2018-10-17
11+
version = "7.60"
1212
project = "drupal"
13-
datestamp = "1519235152"
14-
13+
datestamp = "1539816636"

‎modules/aggregator/tests/aggregator_test.info

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -5,8 +5,7 @@ version = VERSION
55
core = 7.x
66
hidden = TRUE
77

8-
; Information added by Drupal.org packaging script on 2018-02-21
9-
version = "7.57"
8+
; Information added by Drupal.org packaging script on 2018-10-17
9+
version = "7.60"
1010
project = "drupal"
11-
datestamp = "1519235152"
12-
11+
datestamp = "1539816636"

‎modules/block/block.info

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -6,8 +6,7 @@ core = 7.x
66
files[] = block.test
77
configure = admin/structure/block
88

9-
; Information added by Drupal.org packaging script on 2018-02-21
10-
version = "7.57"
9+
; Information added by Drupal.org packaging script on 2018-10-17
10+
version = "7.60"
1111
project = "drupal"
12-
datestamp = "1519235152"
13-
12+
datestamp = "1539816636"

‎modules/block/tests/block_test.info

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -5,8 +5,7 @@ version = VERSION
55
core = 7.x
66
hidden = TRUE
77

8-
; Information added by Drupal.org packaging script on 2018-02-21
9-
version = "7.57"
8+
; Information added by Drupal.org packaging script on 2018-10-17
9+
version = "7.60"
1010
project = "drupal"
11-
datestamp = "1519235152"
12-
11+
datestamp = "1539816636"

‎modules/block/tests/themes/block_test_theme/block_test_theme.info

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -13,8 +13,7 @@ regions[footer] = Footer
1313
regions[highlighted] = Highlighted
1414
regions[help] = Help
1515

16-
; Information added by Drupal.org packaging script on 2018-02-21
17-
version = "7.57"
16+
; Information added by Drupal.org packaging script on 2018-10-17
17+
version = "7.60"
1818
project = "drupal"
19-
datestamp = "1519235152"
20-
19+
datestamp = "1539816636"

‎modules/blog/blog.info

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -5,8 +5,7 @@ version = VERSION
55
core = 7.x
66
files[] = blog.test
77

8-
; Information added by Drupal.org packaging script on 2018-02-21
9-
version = "7.57"
8+
; Information added by Drupal.org packaging script on 2018-10-17
9+
version = "7.60"
1010
project = "drupal"
11-
datestamp = "1519235152"
12-
11+
datestamp = "1539816636"

‎modules/book/book.info

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -7,8 +7,7 @@ files[] = book.test
77
configure = admin/content/book/settings
88
stylesheets[all][] = book.css
99

10-
; Information added by Drupal.org packaging script on 2018-02-21
11-
version = "7.57"
10+
; Information added by Drupal.org packaging script on 2018-10-17
11+
version = "7.60"
1212
project = "drupal"
13-
datestamp = "1519235152"
14-
13+
datestamp = "1539816636"

‎modules/color/color.info

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -5,8 +5,7 @@ version = VERSION
55
core = 7.x
66
files[] = color.test
77

8-
; Information added by Drupal.org packaging script on 2018-02-21
9-
version = "7.57"
8+
; Information added by Drupal.org packaging script on 2018-10-17
9+
version = "7.60"
1010
project = "drupal"
11-
datestamp = "1519235152"
12-
11+
datestamp = "1539816636"

‎modules/comment/comment.info

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -9,8 +9,7 @@ files[] = comment.test
99
configure = admin/content/comment
1010
stylesheets[all][] = comment.css
1111

12-
; Information added by Drupal.org packaging script on 2018-02-21
13-
version = "7.57"
12+
; Information added by Drupal.org packaging script on 2018-10-17
13+
version = "7.60"
1414
project = "drupal"
15-
datestamp = "1519235152"
16-
15+
datestamp = "1539816636"

‎modules/contact/contact.info

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -6,8 +6,7 @@ core = 7.x
66
files[] = contact.test
77
configure = admin/structure/contact
88

9-
; Information added by Drupal.org packaging script on 2018-02-21
10-
version = "7.57"
9+
; Information added by Drupal.org packaging script on 2018-10-17
10+
version = "7.60"
1111
project = "drupal"
12-
datestamp = "1519235152"
13-
12+
datestamp = "1539816636"

‎modules/contextual/contextual.info

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -5,8 +5,7 @@ version = VERSION
55
core = 7.x
66
files[] = contextual.test
77

8-
; Information added by Drupal.org packaging script on 2018-02-21
9-
version = "7.57"
8+
; Information added by Drupal.org packaging script on 2018-10-17
9+
version = "7.60"
1010
project = "drupal"
11-
datestamp = "1519235152"
12-
11+
datestamp = "1539816636"

‎modules/dashboard/dashboard.info

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -7,8 +7,7 @@ files[] = dashboard.test
77
dependencies[] = block
88
configure = admin/dashboard/customize
99

10-
; Information added by Drupal.org packaging script on 2018-02-21
11-
version = "7.57"
10+
; Information added by Drupal.org packaging script on 2018-10-17
11+
version = "7.60"
1212
project = "drupal"
13-
datestamp = "1519235152"
14-
13+
datestamp = "1539816636"

‎modules/dblog/dblog.info

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -5,8 +5,7 @@ version = VERSION
55
core = 7.x
66
files[] = dblog.test
77

8-
; Information added by Drupal.org packaging script on 2018-02-21
9-
version = "7.57"
8+
; Information added by Drupal.org packaging script on 2018-10-17
9+
version = "7.60"
1010
project = "drupal"
11-
datestamp = "1519235152"
12-
11+
datestamp = "1539816636"

‎modules/field/field.info

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -11,8 +11,7 @@ dependencies[] = field_sql_storage
1111
required = TRUE
1212
stylesheets[all][] = theme/field.css
1313

14-
; Information added by Drupal.org packaging script on 2018-02-21
15-
version = "7.57"
14+
; Information added by Drupal.org packaging script on 2018-10-17
15+
version = "7.60"
1616
project = "drupal"
17-
datestamp = "1519235152"
18-
17+
datestamp = "1539816636"

‎modules/field/modules/field_sql_storage/field_sql_storage.info

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -7,8 +7,7 @@ dependencies[] = field
77
files[] = field_sql_storage.test
88
required = TRUE
99

10-
; Information added by Drupal.org packaging script on 2018-02-21
11-
version = "7.57"
10+
; Information added by Drupal.org packaging script on 2018-10-17
11+
version = "7.60"
1212
project = "drupal"
13-
datestamp = "1519235152"
14-
13+
datestamp = "1539816636"

‎modules/field/modules/list/list.info

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -7,8 +7,7 @@ dependencies[] = field
77
dependencies[] = options
88
files[] = tests/list.test
99

10-
; Information added by Drupal.org packaging script on 2018-02-21
11-
version = "7.57"
10+
; Information added by Drupal.org packaging script on 2018-10-17
11+
version = "7.60"
1212
project = "drupal"
13-
datestamp = "1519235152"
14-
13+
datestamp = "1539816636"

‎modules/field/modules/list/tests/list_test.info

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -5,8 +5,7 @@ package = Testing
55
version = VERSION
66
hidden = TRUE
77

8-
; Information added by Drupal.org packaging script on 2018-02-21
9-
version = "7.57"
8+
; Information added by Drupal.org packaging script on 2018-10-17
9+
version = "7.60"
1010
project = "drupal"
11-
datestamp = "1519235152"
12-
11+
datestamp = "1539816636"

0 commit comments

Comments
 (0)