Updating core to version 7.20

.gitignore

@@ -1,49 +1,11 @@
-# Ignore paths that contain user-generated content.
-/sites/*/files
-/sites/*/private
-/files/*
-/cache
-
-# ** Only works in OSs that support newer versions of fnmatch (Bash 4+)
-/sites/default/**/files
-/sites/default/**/private
-
-# Packages #
-############
-*.7z
-*.dmg
-*.gz
-*.bz2
-*.iso
-*.jar
-*.rar
-*.tar
-*.zip
-*.tgz
-
-# Logs and databases #
-######################
-*.log
-*.sql
-
-# OS generated files #
-######################
-.DS_Store*
-ehthumbs.db
-Icon?
-Thumbs.db
-._*
+# Ignore configuration files that may contain sensitive information.
+sites/*/settings*.php
 
-# Vim generated files #
-######################
-*.un~
-
-# SASS #
-##########
-.sass-cache
+# Ignore paths that contain user-generated content.
+sites/*/files
+sites/*/private
 
-# PHPEclipse config files #
-##########################
-.buildpath
-.settings/
+#Ignore eclipse project files
 .project
+.buildpath
+.settings

CHANGELOG.txt

@@ -1,3 +1,8 @@
+
+Drupal 7.20, 2013-02-20
+-----------------------
+- Fixed security issues (denial of service). See SA-CORE-2013-002.
+
 Drupal 7.19, 2013-01-16
 -----------------------
 - Fixed security issues (multiple vulnerabilities). See SA-CORE-2013-001.

LICENSE.txt

@@ -1,12 +1,12 @@
-        GNU GENERAL PUBLIC LICENSE
-           Version 2, June 1991
+                    GNU GENERAL PUBLIC LICENSE
+                       Version 2, June 1991
 
  Copyright (C) 1989, 1991 Free Software Foundation, Inc.,
  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
  Everyone is permitted to copy and distribute verbatim copies
  of this license document, but changing it is not allowed.
 
-          Preamble
+                            Preamble
 
   The licenses for most software are designed to take away your
 freedom to share and change it.  By contrast, the GNU General Public
@@ -56,7 +56,7 @@ patent must be licensed for everyone's free use or not licensed at all.
   The precise terms and conditions for copying, distribution and
 modification follow.
 
-        GNU GENERAL PUBLIC LICENSE
+                    GNU GENERAL PUBLIC LICENSE
    TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION
 
   0. This License applies to any program or other work which contains
@@ -255,7 +255,7 @@ make exceptions for this.  Our decision will be guided by the two goals
 of preserving the free status of all derivatives of our free software and
 of promoting the sharing and reuse of software generally.
 
-          NO WARRANTY
+                            NO WARRANTY
 
   11. BECAUSE THE PROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY
 FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW.  EXCEPT WHEN
@@ -277,9 +277,9 @@ YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER
 PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE
 POSSIBILITY OF SUCH DAMAGES.
 
-         END OF TERMS AND CONDITIONS
+                     END OF TERMS AND CONDITIONS
 
-      How to Apply These Terms to Your New Programs
+            How to Apply These Terms to Your New Programs
 
   If you develop a new program, and you want it to be of the greatest
 possible use to the public, the best way to achieve this is to make it

includes/bootstrap.inc

@@ -8,7 +8,7 @@
 /**
  * The current system version.
  */
-define('VERSION', '7.19');
+define('VERSION', '7.20');
 
 /**
  * Core API compatibility.
@@ -713,31 +713,6 @@ function drupal_settings_initialize() {
   }
   $is_https = isset($_SERVER['HTTPS']) && strtolower($_SERVER['HTTPS']) == 'on';
 
-  // Load environmental config, if present.
-  if (isset($_SERVER['PRESSFLOW_SETTINGS'])) {
-    $pressflow_settings = json_decode($_SERVER['PRESSFLOW_SETTINGS'], TRUE);
-    foreach ($pressflow_settings as $key => $value) {
-      // One level of depth should be enough for $conf and $database.
-      if ($key == 'conf') {
-        foreach($value as $conf_key => $conf_value) {
-          $conf[$conf_key] = $conf_value;
-        }
-      }
-      elseif ($key == 'databases') {
-        // Protect default configuration but allow the specification of
-        // additional databases. Also, allows fun things with 'prefix' if they
-        // want to try multisite.
-        if (!isset($databases) || !is_array($databases)) {
-          $databases = array();
-        }
-        $databases = array_replace_recursive($databases, $value);
-      }
-      else {
-        $$key = $value;
-      }
-    }
-  }
-
   if (isset($base_url)) {
     // Parse fixed base URL from settings.php.
     $parts = parse_url($base_url);
@@ -2420,22 +2395,6 @@ function _drupal_bootstrap_database() {
 function _drupal_bootstrap_variables() {
   global $conf;
 
-  // Pressflow Smart Start
-  if (!empty($GLOBALS['databases']) && variable_get('pressflow_smart_start', FALSE)) {
-    try {
-      $result = db_query('SELECT s.name FROM {system} s WHERE s.name = :name', array(':name' => 'system'));
-    } catch (PDOException $e) {
-      if ($e->getCode() == '2003') {
-        header('Status: 550 Database Offline');
-        exit();
-      }
-      elseif ($e->getCode() == '42S02') {
-        include_once DRUPAL_ROOT . '/includes/install.inc';
-        install_goto('install.php');
-      }
-    }
-  }
-
   // Initialize the lock system.
   require_once DRUPAL_ROOT . '/' . variable_get('lock_inc', 'includes/lock.inc');
   lock_initialize();

includes/common.inc

@@ -3539,7 +3539,7 @@ function drupal_build_css_cache($css) {
     $uri = $map[$key];
   }
 
-  if (empty($uri) || !drupal_aggregated_file_exists($uri)) {
+  if (empty($uri) || !file_exists($uri)) {
     // Build aggregate CSS file.
     foreach ($css as $stylesheet) {
       // Only 'file' stylesheets can be aggregated.
@@ -4868,19 +4868,6 @@ function drupal_add_tabledrag($table_id, $action, $relationship, $group, $subgro
   drupal_add_js($settings, 'setting');
 }
 
-function drupal_aggregated_file_exists($uri) {
-  if (function_exists('apc_exists')) {
-    $exists = apc_exists('file_exists_' . $uri);
-    if (!$exists && file_exists($uri)) {
-      $exists = TRUE;
-      apc_store('file_exists_' . $uri, TRUE, 86400);
-    }
-    return $exists;
-  }
-  // If no APC available, fall back to default.
-  return file_exists($uri);
-}
-
 /**
  * Aggregates JavaScript files into a cache file in the files directory.
  *
@@ -4920,7 +4907,7 @@ function drupal_build_js_cache($files) {
     $uri = $map[$key];
   }
 
-  if (empty($uri) || !drupal_aggregated_file_exists($uri)) {
+  if (empty($uri) || !file_exists($uri)) {
     // Build aggregate JS file.
     foreach ($files as $path => $info) {
       if ($info['preprocess']) {

includes/file.inc

@@ -476,11 +476,6 @@ function file_ensure_htaccess() {
  *   The default is TRUE which indicates a private and protected directory.
  */
 function file_create_htaccess($directory, $private = TRUE) {
-  if (isset($_SERVER['PANTHEON_ENVIRONMENT'])) {
-    // Skip on Pantheon since we use nginx and this can hang.
-    return;
-  }
-
   if (file_uri_scheme($directory)) {
     $directory = file_stream_wrapper_uri_normalize($directory);
   }

includes/image.inc

@@ -122,21 +122,6 @@ function image_toolkit_invoke($method, stdClass $image, array $params = array())
  *   - "file_size": File size in bytes.
  */
 function image_get_info($filepath, $toolkit = FALSE) {
-  // Cache image_info if possible. This provides a significant speedup on style
-  // rendering and generation, as well as with IMCE and other image-heavy
-  // contributed modules.
-  $cid = "image_get_info:$toolkit:$filepath";
-  if (strpos($filepath, 'public://') === 0 && function_exists('pantheon_cache_get') && $cache = pantheon_cache_get($cid)) {
-    $parsed = parse_url($filepath);
-    $statpath = $parsed['host'];
-    if (isset($parsed['path'])) {
-      $statpath .= $parsed['path'];
-    }
-    $stat = pantheon_stat($statpath);
-    if ($stat['size']	== $cache['file_size']) {
-      return $cache;
-    }
-  }
   $details = FALSE;
   if (!is_file($filepath) && !is_uploaded_file($filepath)) {
     return $details;
@@ -154,9 +139,7 @@ function image_get_info($filepath, $toolkit = FALSE) {
       $details['file_size'] = filesize($filepath);
     }
   }
-  if (function_exists('pantheon_cache_get')) {
-    pantheon_cache_set($cid, $details);
-  }
+
   return $details;
 }
 

includes/stream_wrappers.inc

@@ -681,39 +681,16 @@ abstract class DrupalLocalStreamWrapper implements DrupalStreamWrapperInterface
    * @see http://php.net/manual/en/streamwrapper.url-stat.php
    */
   public function url_stat($uri, $flags) {
-    // Cache existence checks for ctools_css_retrieve.
-    $store_to_cache = FALSE;
-    if (strpos($uri, 'public://ctools/css/') === 0 && function_exists('pantheon_cache_get')) {
-      $stat = pantheon_cache_get('file_stat_' . $uri);
-      if ($stat !== FALSE) {
-        return $stat;
-      }
-      $store_to_cache = TRUE;
-    }
-
     $this->uri = $uri;
-
-    if (strpos($uri, 'public://') === 0 && function_exists('pantheon_stat')) {
-      $path = $this->getTarget($uri);
-      $stat = pantheon_stat($path);
+    $path = $this->getLocalPath();
+    // Suppress warnings if requested or if the file or directory does not
+    // exist. This is consistent with PHP's plain filesystem stream wrapper.
+    if ($flags & STREAM_URL_STAT_QUIET || !file_exists($path)) {
+      return @stat($path);
     }
     else {
-      $path = $this->getLocalPath();
-      // Suppress warnings if requested or if the file or directory does not
-      // exist. This is consistent with PHP's plain filesystem stream wrapper.
-      if ($flags & STREAM_URL_STAT_QUIET || !file_exists($path)) {
-        $stat = @stat($path);
-      }
-      else {
-        $stat = stat($path);
-      }
+      return stat($path);
     }
-
-    if ($store_to_cache && $stat !== FALSE) {
-      pantheon_cache_set('file_stat_' . $uri, $stat, 86400);
-    }
-
-    return $stat;
   }
 
   /**

modules/aggregator/aggregator.info

@@ -6,3 +6,9 @@ core = 7.x
 files[] = aggregator.test
 configure = admin/config/services/aggregator/settings
 stylesheets[all][] = aggregator.css
+
+; Information added by drupal.org packaging script on 2013-02-20
+version = "7.20"
+project = "drupal"
+datestamp = "1361393684"
+

modules/aggregator/tests/aggregator_test.info

@@ -4,3 +4,9 @@ package = Testing
 version = VERSION
 core = 7.x
 hidden = TRUE
+
+; Information added by drupal.org packaging script on 2013-02-20
+version = "7.20"
+project = "drupal"
+datestamp = "1361393684"
+

modules/block/block.info

@@ -5,3 +5,9 @@ version = VERSION
 core = 7.x
 files[] = block.test
 configure = admin/structure/block
+
+; Information added by drupal.org packaging script on 2013-02-20
+version = "7.20"
+project = "drupal"
+datestamp = "1361393684"
+

modules/block/tests/block_test.info

@@ -4,3 +4,9 @@ package = Testing
 version = VERSION
 core = 7.x
 hidden = TRUE
+
+; Information added by drupal.org packaging script on 2013-02-20
+version = "7.20"
+project = "drupal"
+datestamp = "1361393684"
+

modules/block/tests/themes/block_test_theme/block_test_theme.info

@@ -12,3 +12,9 @@ regions[header] = Header
 regions[footer] = Footer
 regions[highlighted] = Highlighted
 regions[help] = Help
+
+; Information added by drupal.org packaging script on 2013-02-20
+version = "7.20"
+project = "drupal"
+datestamp = "1361393684"
+

modules/blog/blog.info

@@ -4,3 +4,9 @@ package = Core
 version = VERSION
 core = 7.x
 files[] = blog.test
+
+; Information added by drupal.org packaging script on 2013-02-20
+version = "7.20"
+project = "drupal"
+datestamp = "1361393684"
+

modules/book/book.info

@@ -6,3 +6,9 @@ core = 7.x
 files[] = book.test
 configure = admin/content/book/settings
 stylesheets[all][] = book.css
+
+; Information added by drupal.org packaging script on 2013-02-20
+version = "7.20"
+project = "drupal"
+datestamp = "1361393684"
+

modules/color/color.info

@@ -4,3 +4,9 @@ package = Core
 version = VERSION
 core = 7.x
 files[] = color.test
+
+; Information added by drupal.org packaging script on 2013-02-20
+version = "7.20"
+project = "drupal"
+datestamp = "1361393684"
+

modules/comment/comment.info

@@ -8,3 +8,9 @@ files[] = comment.module
 files[] = comment.test
 configure = admin/content/comment
 stylesheets[all][] = comment.css
+
+; Information added by drupal.org packaging script on 2013-02-20
+version = "7.20"
+project = "drupal"
+datestamp = "1361393684"
+