commit 134c7813e7993a814e22e90c64878ddac51d9694
Author: Mathieu Schiano <mathieu.schianodischiabica@centrale-marseille.fr>
Date:   Thu Feb 25 15:28:24 2016 +0100

    Update to 7.43

diff --git a/drupal7/CHANGELOG.txt b/drupal7/CHANGELOG.txt
index aaa3f081..72d9d8fc 100644
--- a/drupal7/CHANGELOG.txt
+++ b/drupal7/CHANGELOG.txt
@@ -1,4 +1,8 @@
 
+Drupal 7.43, 2016-02-24
+-----------------------
+- Fixed security issues (multiple vulnerabilities). See SA-CORE-2016-001.
+
 Drupal 7.42, 2016-02-03
 -----------------------
 - Stopped invoking hook_flush_caches() on every cron run, since some modules
diff --git a/drupal7/includes/bootstrap.inc b/drupal7/includes/bootstrap.inc
index af88ffe4..0428bd36 100644
--- a/drupal7/includes/bootstrap.inc
+++ b/drupal7/includes/bootstrap.inc
@@ -8,7 +8,7 @@
 /**
  * The current system version.
  */
-define('VERSION', '7.42');
+define('VERSION', '7.43');
 
 /**
  * Core API compatibility.
diff --git a/drupal7/includes/common.inc b/drupal7/includes/common.inc
index 34fa9b96..c6303efa 100644
--- a/drupal7/includes/common.inc
+++ b/drupal7/includes/common.inc
@@ -688,6 +688,13 @@ function drupal_goto($path = '', array $options = array(), $http_response_code =
     $options['fragment'] = $destination['fragment'];
   }
 
+  // In some cases modules call drupal_goto(current_path()). We need to ensure
+  // that such a redirect is not to an external URL.
+  if ($path === current_path() && empty($options['external']) && url_is_external($path)) {
+    // Force url() to generate a non-external URL.
+    $options['external'] = FALSE;
+  }
+
   drupal_alter('drupal_goto', $path, $options, $http_response_code);
 
   // The 'Location' HTTP header must be absolute.
@@ -2220,20 +2227,8 @@ function url($path = NULL, array $options = array()) {
     'prefix' => ''
   );
 
-  // A duplicate of the code from url_is_external() to avoid needing another
-  // function call, since performance inside url() is critical.
   if (!isset($options['external'])) {
-    // Return an external link if $path contains an allowed absolute URL. Avoid
-    // calling drupal_strip_dangerous_protocols() if there is any slash (/),
-    // hash (#) or question_mark (?) before the colon (:) occurrence - if any -
-    // as this would clearly mean it is not a URL. If the path starts with 2
-    // slashes then it is always considered an external URL without an explicit
-    // protocol part.
-    $colonpos = strpos($path, ':');
-    $options['external'] = (strpos($path, '//') === 0)
-      || ($colonpos !== FALSE
-        && !preg_match('![/?#]!', substr($path, 0, $colonpos))
-        && drupal_strip_dangerous_protocols($path) == $path);
+    $options['external'] = url_is_external($path);
   }
 
   // Preserve the original path before altering or aliasing.
@@ -2353,12 +2348,18 @@ function url($path = NULL, array $options = array()) {
  */
 function url_is_external($path) {
   $colonpos = strpos($path, ':');
-  // Avoid calling drupal_strip_dangerous_protocols() if there is any slash (/),
-  // hash (#) or question_mark (?) before the colon (:) occurrence - if any - as
-  // this would clearly mean it is not a URL. If the path starts with 2 slashes
-  // then it is always considered an external URL without an explicit protocol
-  // part.
+  // Some browsers treat \ as / so normalize to forward slashes.
+  $path = str_replace('\\', '/', $path);
+  // If the path starts with 2 slashes then it is always considered an external
+  // URL without an explicit protocol part.
   return (strpos($path, '//') === 0)
+    // Leading control characters may be ignored or mishandled by browsers, so
+    // assume such a path may lead to an external location. The \p{C} character
+    // class matches all UTF-8 control, unassigned, and private characters.
+    || (preg_match('/^\p{C}/u', $path) !== 0)
+    // Avoid calling drupal_strip_dangerous_protocols() if there is any slash
+    // (/), hash (#) or question_mark (?) before the colon (:) occurrence - if
+    // any - as this would clearly mean it is not a URL.
     || ($colonpos !== FALSE
       && !preg_match('![/?#]!', substr($path, 0, $colonpos))
       && drupal_strip_dangerous_protocols($path) == $path);
diff --git a/drupal7/includes/path.inc b/drupal7/includes/path.inc
index 2e357111..6bd48d30 100644
--- a/drupal7/includes/path.inc
+++ b/drupal7/includes/path.inc
@@ -347,7 +347,8 @@ function drupal_match_path($path, $patterns) {
  * drupal_bootstrap(DRUPAL_BOOTSTRAP_FULL) makes this function available.
  *
  * @return
- *   The current Drupal URL path.
+ *   The current Drupal URL path. The path is untrusted user input and must be
+ *   treated as such.
  *
  * @see request_path()
  */
diff --git a/drupal7/includes/xmlrpcs.inc b/drupal7/includes/xmlrpcs.inc
index 8655c05b..c334de15 100644
--- a/drupal7/includes/xmlrpcs.inc
+++ b/drupal7/includes/xmlrpcs.inc
@@ -264,6 +264,10 @@ function xmlrpc_server_call($xmlrpc_server, $methodname, $args) {
  */
 function xmlrpc_server_multicall($methodcalls) {
   // See http://www.xmlrpc.com/discuss/msgReader$1208
+  // To avoid multicall expansion attacks, limit the number of duplicate method
+  // calls allowed with a default of 1. Set to -1 for unlimited.
+  $duplicate_method_limit = variable_get('xmlrpc_multicall_duplicate_method_limit', 1);
+  $method_count = array();
   $return = array();
   $xmlrpc_server = xmlrpc_server_get();
   foreach ($methodcalls as $call) {
@@ -273,10 +277,14 @@ function xmlrpc_server_multicall($methodcalls) {
       $ok = FALSE;
     }
     $method = $call['methodName'];
+    $method_count[$method] = isset($method_count[$method]) ? $method_count[$method] + 1 : 1;
     $params = $call['params'];
     if ($method == 'system.multicall') {
       $result = xmlrpc_error(-32600, t('Recursive calls to system.multicall are forbidden.'));
     }
+    elseif ($duplicate_method_limit > 0 && $method_count[$method] > $duplicate_method_limit) {
+      $result = xmlrpc_error(-156579, t('Too many duplicate method calls in system.multicall.'));
+    }
     elseif ($ok) {
       $result = xmlrpc_server_call($xmlrpc_server, $method, $params);
     }
diff --git a/drupal7/modules/aggregator/aggregator.info b/drupal7/modules/aggregator/aggregator.info
index 3321f8fe..c181417a 100644
--- a/drupal7/modules/aggregator/aggregator.info
+++ b/drupal7/modules/aggregator/aggregator.info
@@ -7,8 +7,8 @@ files[] = aggregator.test
 configure = admin/config/services/aggregator/settings
 stylesheets[all][] = aggregator.css
 
-; Information added by Drupal.org packaging script on 2016-02-03
-version = "7.42"
+; Information added by Drupal.org packaging script on 2016-02-24
+version = "7.43"
 project = "drupal"
-datestamp = "1454517955"
+datestamp = "1456343506"
 
diff --git a/drupal7/modules/aggregator/tests/aggregator_test.info b/drupal7/modules/aggregator/tests/aggregator_test.info
index 669a18e0..4579b77e 100644
--- a/drupal7/modules/aggregator/tests/aggregator_test.info
+++ b/drupal7/modules/aggregator/tests/aggregator_test.info
@@ -5,8 +5,8 @@ version = VERSION
 core = 7.x
 hidden = TRUE
 
-; Information added by Drupal.org packaging script on 2016-02-03
-version = "7.42"
+; Information added by Drupal.org packaging script on 2016-02-24
+version = "7.43"
 project = "drupal"
-datestamp = "1454517955"
+datestamp = "1456343506"
 
diff --git a/drupal7/modules/block/block.info b/drupal7/modules/block/block.info
index 711ee5f3..ad206a88 100644
--- a/drupal7/modules/block/block.info
+++ b/drupal7/modules/block/block.info
@@ -6,8 +6,8 @@ core = 7.x
 files[] = block.test
 configure = admin/structure/block
 
-; Information added by Drupal.org packaging script on 2016-02-03
-version = "7.42"
+; Information added by Drupal.org packaging script on 2016-02-24
+version = "7.43"
 project = "drupal"
-datestamp = "1454517955"
+datestamp = "1456343506"
 
diff --git a/drupal7/modules/block/tests/block_test.info b/drupal7/modules/block/tests/block_test.info
index 2b211043..1e7e4e92 100644
--- a/drupal7/modules/block/tests/block_test.info
+++ b/drupal7/modules/block/tests/block_test.info
@@ -5,8 +5,8 @@ version = VERSION
 core = 7.x
 hidden = TRUE
 
-; Information added by Drupal.org packaging script on 2016-02-03
-version = "7.42"
+; Information added by Drupal.org packaging script on 2016-02-24
+version = "7.43"
 project = "drupal"
-datestamp = "1454517955"
+datestamp = "1456343506"
 
diff --git a/drupal7/modules/block/tests/themes/block_test_theme/block_test_theme.info b/drupal7/modules/block/tests/themes/block_test_theme/block_test_theme.info
index 57e5cf75..e49025ab 100644
--- a/drupal7/modules/block/tests/themes/block_test_theme/block_test_theme.info
+++ b/drupal7/modules/block/tests/themes/block_test_theme/block_test_theme.info
@@ -13,8 +13,8 @@ regions[footer] = Footer
 regions[highlighted] = Highlighted
 regions[help] = Help
 
-; Information added by Drupal.org packaging script on 2016-02-03
-version = "7.42"
+; Information added by Drupal.org packaging script on 2016-02-24
+version = "7.43"
 project = "drupal"
-datestamp = "1454517955"
+datestamp = "1456343506"
 
diff --git a/drupal7/modules/blog/blog.info b/drupal7/modules/blog/blog.info
index 156edfd7..13294f93 100644
--- a/drupal7/modules/blog/blog.info
+++ b/drupal7/modules/blog/blog.info
@@ -5,8 +5,8 @@ version = VERSION
 core = 7.x
 files[] = blog.test
 
-; Information added by Drupal.org packaging script on 2016-02-03
-version = "7.42"
+; Information added by Drupal.org packaging script on 2016-02-24
+version = "7.43"
 project = "drupal"
-datestamp = "1454517955"
+datestamp = "1456343506"
 
diff --git a/drupal7/modules/book/book.info b/drupal7/modules/book/book.info
index f0a8fc1a..fa5b99ba 100644
--- a/drupal7/modules/book/book.info
+++ b/drupal7/modules/book/book.info
@@ -7,8 +7,8 @@ files[] = book.test
 configure = admin/content/book/settings
 stylesheets[all][] = book.css
 
-; Information added by Drupal.org packaging script on 2016-02-03
-version = "7.42"
+; Information added by Drupal.org packaging script on 2016-02-24
+version = "7.43"
 project = "drupal"
-datestamp = "1454517955"
+datestamp = "1456343506"
 
diff --git a/drupal7/modules/color/color.info b/drupal7/modules/color/color.info
index 77f21437..47ae442e 100644
--- a/drupal7/modules/color/color.info
+++ b/drupal7/modules/color/color.info
@@ -5,8 +5,8 @@ version = VERSION
 core = 7.x
 files[] = color.test
 
-; Information added by Drupal.org packaging script on 2016-02-03
-version = "7.42"
+; Information added by Drupal.org packaging script on 2016-02-24
+version = "7.43"
 project = "drupal"
-datestamp = "1454517955"
+datestamp = "1456343506"
 
diff --git a/drupal7/modules/comment/comment.info b/drupal7/modules/comment/comment.info
index 194e2035..fa206f98 100644
--- a/drupal7/modules/comment/comment.info
+++ b/drupal7/modules/comment/comment.info
@@ -9,8 +9,8 @@ files[] = comment.test
 configure = admin/content/comment
 stylesheets[all][] = comment.css
 
-; Information added by Drupal.org packaging script on 2016-02-03
-version = "7.42"
+; Information added by Drupal.org packaging script on 2016-02-24
+version = "7.43"
 project = "drupal"
-datestamp = "1454517955"
+datestamp = "1456343506"
 
diff --git a/drupal7/modules/contact/contact.info b/drupal7/modules/contact/contact.info
index 7d946e81..f8d1a97d 100644
--- a/drupal7/modules/contact/contact.info
+++ b/drupal7/modules/contact/contact.info
@@ -6,8 +6,8 @@ core = 7.x
 files[] = contact.test
 configure = admin/structure/contact
 
-; Information added by Drupal.org packaging script on 2016-02-03
-version = "7.42"
+; Information added by Drupal.org packaging script on 2016-02-24
+version = "7.43"
 project = "drupal"
-datestamp = "1454517955"
+datestamp = "1456343506"
 
diff --git a/drupal7/modules/contextual/contextual.info b/drupal7/modules/contextual/contextual.info
index 0b9010b6..8e82e2d3 100644
--- a/drupal7/modules/contextual/contextual.info
+++ b/drupal7/modules/contextual/contextual.info
@@ -5,8 +5,8 @@ version = VERSION
 core = 7.x
 files[] = contextual.test
 
-; Information added by Drupal.org packaging script on 2016-02-03
-version = "7.42"
+; Information added by Drupal.org packaging script on 2016-02-24
+version = "7.43"
 project = "drupal"
-datestamp = "1454517955"
+datestamp = "1456343506"
 
diff --git a/drupal7/modules/dashboard/dashboard.info b/drupal7/modules/dashboard/dashboard.info
index 46062944..55b454ef 100644
--- a/drupal7/modules/dashboard/dashboard.info
+++ b/drupal7/modules/dashboard/dashboard.info
@@ -7,8 +7,8 @@ files[] = dashboard.test
 dependencies[] = block
 configure = admin/dashboard/customize
 
-; Information added by Drupal.org packaging script on 2016-02-03
-version = "7.42"
+; Information added by Drupal.org packaging script on 2016-02-24
+version = "7.43"
 project = "drupal"
-datestamp = "1454517955"
+datestamp = "1456343506"
 
diff --git a/drupal7/modules/dblog/dblog.info b/drupal7/modules/dblog/dblog.info
index d813e26b..89de733f 100644
--- a/drupal7/modules/dblog/dblog.info
+++ b/drupal7/modules/dblog/dblog.info
@@ -5,8 +5,8 @@ version = VERSION
 core = 7.x
 files[] = dblog.test
 
-; Information added by Drupal.org packaging script on 2016-02-03
-version = "7.42"
+; Information added by Drupal.org packaging script on 2016-02-24
+version = "7.43"
 project = "drupal"
-datestamp = "1454517955"
+datestamp = "1456343506"
 
diff --git a/drupal7/modules/field/field.info b/drupal7/modules/field/field.info
index 06a388ef..11015a75 100644
--- a/drupal7/modules/field/field.info
+++ b/drupal7/modules/field/field.info
@@ -11,8 +11,8 @@ dependencies[] = field_sql_storage
 required = TRUE
 stylesheets[all][] = theme/field.css
 
-; Information added by Drupal.org packaging script on 2016-02-03
-version = "7.42"
+; Information added by Drupal.org packaging script on 2016-02-24
+version = "7.43"
 project = "drupal"
-datestamp = "1454517955"
+datestamp = "1456343506"
 
diff --git a/drupal7/modules/field/modules/field_sql_storage/field_sql_storage.info b/drupal7/modules/field/modules/field_sql_storage/field_sql_storage.info
index a49c06d5..0828c20a 100644
--- a/drupal7/modules/field/modules/field_sql_storage/field_sql_storage.info
+++ b/drupal7/modules/field/modules/field_sql_storage/field_sql_storage.info
@@ -7,8 +7,8 @@ dependencies[] = field
 files[] = field_sql_storage.test
 required = TRUE
 
-; Information added by Drupal.org packaging script on 2016-02-03
-version = "7.42"
+; Information added by Drupal.org packaging script on 2016-02-24
+version = "7.43"
 project = "drupal"
-datestamp = "1454517955"
+datestamp = "1456343506"
 
diff --git a/drupal7/modules/field/modules/list/list.info b/drupal7/modules/field/modules/list/list.info
index 42060241..7b0c9c23 100644
--- a/drupal7/modules/field/modules/list/list.info
+++ b/drupal7/modules/field/modules/list/list.info
@@ -7,8 +7,8 @@ dependencies[] = field
 dependencies[] = options
 files[] = tests/list.test
 
-; Information added by Drupal.org packaging script on 2016-02-03
-version = "7.42"
+; Information added by Drupal.org packaging script on 2016-02-24
+version = "7.43"
 project = "drupal"
-datestamp = "1454517955"
+datestamp = "1456343506"
 
diff --git a/drupal7/modules/field/modules/list/tests/list_test.info b/drupal7/modules/field/modules/list/tests/list_test.info
index 41c460d6..9b3e4d6b 100644
--- a/drupal7/modules/field/modules/list/tests/list_test.info
+++ b/drupal7/modules/field/modules/list/tests/list_test.info
@@ -5,8 +5,8 @@ package = Testing
 version = VERSION
 hidden = TRUE
 
-; Information added by Drupal.org packaging script on 2016-02-03
-version = "7.42"
+; Information added by Drupal.org packaging script on 2016-02-24
+version = "7.43"
 project = "drupal"
-datestamp = "1454517955"
+datestamp = "1456343506"
 
diff --git a/drupal7/modules/field/modules/number/number.info b/drupal7/modules/field/modules/number/number.info
index 320a638e..52553fd7 100644
--- a/drupal7/modules/field/modules/number/number.info
+++ b/drupal7/modules/field/modules/number/number.info
@@ -6,8 +6,8 @@ core = 7.x
 dependencies[] = field
 files[] = number.test
 
-; Information added by Drupal.org packaging script on 2016-02-03
-version = "7.42"
+; Information added by Drupal.org packaging script on 2016-02-24
+version = "7.43"
 project = "drupal"
-datestamp = "1454517955"
+datestamp = "1456343506"
 
diff --git a/drupal7/modules/field/modules/options/options.info b/drupal7/modules/field/modules/options/options.info
index 81c55adf..f07ea90b 100644
--- a/drupal7/modules/field/modules/options/options.info
+++ b/drupal7/modules/field/modules/options/options.info
@@ -6,8 +6,8 @@ core = 7.x
 dependencies[] = field
 files[] = options.test
 
-; Information added by Drupal.org packaging script on 2016-02-03
-version = "7.42"
+; Information added by Drupal.org packaging script on 2016-02-24
+version = "7.43"
 project = "drupal"
-datestamp = "1454517955"
+datestamp = "1456343506"
 
diff --git a/drupal7/modules/field/modules/text/text.info b/drupal7/modules/field/modules/text/text.info
index a8b6aac7..b3cf7cf0 100644
--- a/drupal7/modules/field/modules/text/text.info
+++ b/drupal7/modules/field/modules/text/text.info
@@ -7,8 +7,8 @@ dependencies[] = field
 files[] = text.test
 required = TRUE
 
-; Information added by Drupal.org packaging script on 2016-02-03
-version = "7.42"
+; Information added by Drupal.org packaging script on 2016-02-24
+version = "7.43"
 project = "drupal"
-datestamp = "1454517955"
+datestamp = "1456343506"
 
diff --git a/drupal7/modules/field/tests/field_test.info b/drupal7/modules/field/tests/field_test.info
index 78957a8f..8bfe1719 100644
--- a/drupal7/modules/field/tests/field_test.info
+++ b/drupal7/modules/field/tests/field_test.info
@@ -6,8 +6,8 @@ files[] = field_test.entity.inc
 version = VERSION
 hidden = TRUE
 
-; Information added by Drupal.org packaging script on 2016-02-03
-version = "7.42"
+; Information added by Drupal.org packaging script on 2016-02-24
+version = "7.43"
 project = "drupal"
-datestamp = "1454517955"
+datestamp = "1456343506"
 
diff --git a/drupal7/modules/field_ui/field_ui.info b/drupal7/modules/field_ui/field_ui.info
index 77d4f106..ef904d2e 100644
--- a/drupal7/modules/field_ui/field_ui.info
+++ b/drupal7/modules/field_ui/field_ui.info
@@ -6,8 +6,8 @@ core = 7.x
 dependencies[] = field
 files[] = field_ui.test
 
-; Information added by Drupal.org packaging script on 2016-02-03
-version = "7.42"
+; Information added by Drupal.org packaging script on 2016-02-24
+version = "7.43"
 project = "drupal"
-datestamp = "1454517955"
+datestamp = "1456343506"
 
diff --git a/drupal7/modules/file/file.info b/drupal7/modules/file/file.info
index bf8450cd..aebd7f92 100644
--- a/drupal7/modules/file/file.info
+++ b/drupal7/modules/file/file.info
@@ -6,8 +6,8 @@ core = 7.x
 dependencies[] = field
 files[] = tests/file.test
 
-; Information added by Drupal.org packaging script on 2016-02-03
-version = "7.42"
+; Information added by Drupal.org packaging script on 2016-02-24
+version = "7.43"
 project = "drupal"
-datestamp = "1454517955"
+datestamp = "1456343506"
 
diff --git a/drupal7/modules/file/file.module b/drupal7/modules/file/file.module
index fbf8b81e..9e091af0 100644
--- a/drupal7/modules/file/file.module
+++ b/drupal7/modules/file/file.module
@@ -529,14 +529,19 @@ function file_managed_file_value(&$element, $input = FALSE, $form_state = NULL)
         // publicly accessible, with no download restrictions; for security
         // reasons all other schemes must go through the file_download_access()
         // check.
-        if (in_array(file_uri_scheme($file->uri), variable_get('file_public_schema', array('public'))) || file_download_access($file->uri)) {
-          $fid = $file->fid;
+        if (!in_array(file_uri_scheme($file->uri), variable_get('file_public_schema', array('public'))) && !file_download_access($file->uri)) {
+          $force_default = TRUE;
         }
-        // If the current user doesn't have access, don't let the file be
-        // changed.
-        else {
+        // Temporary files that belong to other users should never be allowed.
+        // Since file ownership can't be determined for anonymous users, they
+        // are not allowed to reuse temporary files at all.
+        elseif ($file->status != FILE_STATUS_PERMANENT && (!$GLOBALS['user']->uid || $file->uid != $GLOBALS['user']->uid)) {
           $force_default = TRUE;
         }
+        // If all checks pass, allow the file to be changed.
+        else {
+          $fid = $file->fid;
+        }
       }
     }
   }
diff --git a/drupal7/modules/file/tests/file.test b/drupal7/modules/file/tests/file.test
index 80433954..6d7cb4bc 100644
--- a/drupal7/modules/file/tests/file.test
+++ b/drupal7/modules/file/tests/file.test
@@ -218,6 +218,30 @@ class FileFieldTestCase extends DrupalWebTestCase {
     $message = isset($message) ? $message : format_string('File %file is permanent.', array('%file' => $file->uri));
     $this->assertTrue($file->status == FILE_STATUS_PERMANENT, $message);
   }
+
+  /**
+   * Creates a temporary file, for a specific user.
+   *
+   * @param string $data
+   *   A string containing the contents of the file.
+   * @param int $uid
+   *   The user ID of the file owner.
+   *
+   * @return object
+   *   A file object, or FALSE on error.
+   */
+  function createTemporaryFile($data, $uid = NULL) {
+    $file = file_save_data($data, NULL, NULL);
+
+    if ($file) {
+      $file->uid = isset($uid) ? $uid : $this->admin_user->uid;
+      // Change the file status to be temporary.
+      $file->status = NULL;
+      return file_save($file);
+    }
+
+    return $file;
+  }
 }
 
 /**
@@ -526,6 +550,120 @@ class FileFieldWidgetTestCase extends FileFieldTestCase {
     }
   }
 
+  /**
+   * Tests exploiting the temporary file removal of another user using fid.
+   */
+  function testTemporaryFileRemovalExploit() {
+    // Create a victim user.
+    $victim_user = $this->drupalCreateUser();
+
+    // Create an attacker user.
+    $attacker_user = $this->drupalCreateUser(array(
+      'access content',
+      'create page content',
+      'edit any page content',
+    ));
+
+    // Log in as the attacker user.
+    $this->drupalLogin($attacker_user);
+
+    // Perform tests using the newly created users.
+    $this->doTestTemporaryFileRemovalExploit($victim_user->uid, $attacker_user->uid);
+  }
+
+  /**
+   * Tests exploiting the temporary file removal for anonymous users using fid.
+   */
+  public function testTemporaryFileRemovalExploitAnonymous() {
+    // Set up an anonymous victim user.
+    $victim_uid = 0;
+
+    // Set up an anonymous attacker user.
+    $attacker_uid = 0;
+
+    // Set up permissions for anonymous attacker user.
+    user_role_change_permissions(DRUPAL_ANONYMOUS_RID, array(
+      'access content' => TRUE,
+      'create page content' => TRUE,
+      'edit any page content' => TRUE,
+    ));
+
+    // In order to simulate being the anonymous attacker user, we need to log
+    // out here since setUp() has logged in the admin.
+    $this->drupalLogout();
+
+    // Perform tests using the newly set up users.
+    $this->doTestTemporaryFileRemovalExploit($victim_uid, $attacker_uid);
+  }
+
+  /**
+   * Helper for testing exploiting the temporary file removal using fid.
+   *
+   * @param int $victim_uid
+   *   The victim user ID.
+   * @param int $attacker_uid
+   *   The attacker user ID.
+   */
+  protected function doTestTemporaryFileRemovalExploit($victim_uid, $attacker_uid) {
+    // Use 'page' instead of 'article', so that the 'article' image field does
+    // not conflict with this test. If in the future the 'page' type gets its
+    // own default file or image field, this test can be made more robust by
+    // using a custom node type.
+    $type_name = 'page';
+    $field_name = 'test_file_field';
+    $this->createFileField($field_name, $type_name);
+
+    $test_file = $this->getTestFile('text');
+    foreach (array('nojs', 'js') as $type) {
+      // Create a temporary file owned by the anonymous victim user. This will be
+      // as if they had uploaded the file, but not saved the node they were
+      // editing or creating.
+      $victim_tmp_file = $this->createTemporaryFile('some text', $victim_uid);
+      $victim_tmp_file = file_load($victim_tmp_file->fid);
+      $this->assertTrue($victim_tmp_file->status != FILE_STATUS_PERMANENT, 'New file saved to disk is temporary.');
+      $this->assertFalse(empty($victim_tmp_file->fid), 'New file has a fid');
+      $this->assertEqual($victim_uid, $victim_tmp_file->uid, 'New file belongs to the victim user');
+
+      // Have attacker create a new node with a different uploaded file and
+      // ensure it got uploaded successfully.
+      // @todo Can we test AJAX? See https://www.drupal.org/node/2538260
+      $edit = array(
+        'title' => $type . '-title',
+      );
+
+      // Attach a file to a node.
+      $langcode = LANGUAGE_NONE;
+      $edit['files[' . $field_name . '_' . $langcode . '_0]'] = drupal_realpath($test_file->uri);
+      $this->drupalPost("node/add/$type_name", $edit, 'Save');
+      $node = $this->drupalGetNodeByTitle($edit['title']);
+      $node_file = file_load($node->{$field_name}[$langcode][0]['fid']);
+      $this->assertFileExists($node_file, 'New file saved to disk on node creation.');
+      $this->assertEqual($attacker_uid, $node_file->uid, 'New file belongs to the attacker.');
+
+      // Ensure the file can be downloaded.
+      $this->drupalGet(file_create_url($node_file->uri));
+      $this->assertResponse(200, 'Confirmed that the generated URL is correct by downloading the shipped file.');
+
+      // "Click" the remove button (emulating either a nojs or js submission).
+      // In this POST request, the attacker "guesses" the fid of the victim's
+      // temporary file and uses that to remove this file.
+      $this->drupalGet('node/' . $node->nid . '/edit');
+      switch ($type) {
+        case 'nojs':
+          $this->drupalPost(NULL, array("{$field_name}[$langcode][0][fid]" => (string) $victim_tmp_file->fid), 'Remove');
+          break;
+        case 'js':
+          $button = $this->xpath('//input[@type="submit" and @value="Remove"]');
+          $this->drupalPostAJAX(NULL, array("{$field_name}[$langcode][0][fid]" => (string) $victim_tmp_file->fid), array((string) $button[0]['name'] => (string) $button[0]['value']));
+          break;
+      }
+
+      // The victim's temporary file should not be removed by the attacker's
+      // POST request.
+      $this->assertFileExists($victim_tmp_file);
+    }
+  }
+
   /**
    * Tests upload and remove buttons for multiple multi-valued File fields.
    */
diff --git a/drupal7/modules/file/tests/file_module_test.info b/drupal7/modules/file/tests/file_module_test.info
index 2d24e263..a9675621 100644
--- a/drupal7/modules/file/tests/file_module_test.info
+++ b/drupal7/modules/file/tests/file_module_test.info
@@ -5,8 +5,8 @@ version = VERSION
 core = 7.x
 hidden = TRUE
 
-; Information added by Drupal.org packaging script on 2016-02-03
-version = "7.42"
+; Information added by Drupal.org packaging script on 2016-02-24
+version = "7.43"
 project = "drupal"
-datestamp = "1454517955"
+datestamp = "1456343506"
 
diff --git a/drupal7/modules/filter/filter.info b/drupal7/modules/filter/filter.info
index 3e18bda4..7584d6ed 100644
--- a/drupal7/modules/filter/filter.info
+++ b/drupal7/modules/filter/filter.info
@@ -7,8 +7,8 @@ files[] = filter.test
 required = TRUE
 configure = admin/config/content/formats
 
-; Information added by Drupal.org packaging script on 2016-02-03
-version = "7.42"
+; Information added by Drupal.org packaging script on 2016-02-24
+version = "7.43"
 project = "drupal"
-datestamp = "1454517955"
+datestamp = "1456343506"
 
diff --git a/drupal7/modules/forum/forum.info b/drupal7/modules/forum/forum.info
index 2ac20790..2f10e395 100644
--- a/drupal7/modules/forum/forum.info
+++ b/drupal7/modules/forum/forum.info
@@ -9,8 +9,8 @@ files[] = forum.test
 configure = admin/structure/forum
 stylesheets[all][] = forum.css
 
-; Information added by Drupal.org packaging script on 2016-02-03
-version = "7.42"
+; Information added by Drupal.org packaging script on 2016-02-24
+version = "7.43"
 project = "drupal"
-datestamp = "1454517955"
+datestamp = "1456343506"
 
diff --git a/drupal7/modules/help/help.info b/drupal7/modules/help/help.info
index 84dd5ef0..accbca80 100644
--- a/drupal7/modules/help/help.info
+++ b/drupal7/modules/help/help.info
@@ -5,8 +5,8 @@ version = VERSION
 core = 7.x
 files[] = help.test
 
-; Information added by Drupal.org packaging script on 2016-02-03
-version = "7.42"
+; Information added by Drupal.org packaging script on 2016-02-24
+version = "7.43"
 project = "drupal"
-datestamp = "1454517955"
+datestamp = "1456343506"
 
diff --git a/drupal7/modules/image/image.info b/drupal7/modules/image/image.info
index 53d1146a..b6bd514d 100644
--- a/drupal7/modules/image/image.info
+++ b/drupal7/modules/image/image.info
@@ -7,8 +7,8 @@ dependencies[] = file
 files[] = image.test
 configure = admin/config/media/image-styles
 
-; Information added by Drupal.org packaging script on 2016-02-03
-version = "7.42"
+; Information added by Drupal.org packaging script on 2016-02-24
+version = "7.43"
 project = "drupal"
-datestamp = "1454517955"
+datestamp = "1456343506"
 
diff --git a/drupal7/modules/image/tests/image_module_test.info b/drupal7/modules/image/tests/image_module_test.info
index 84ad7f56..85a47e21 100644
--- a/drupal7/modules/image/tests/image_module_test.info
+++ b/drupal7/modules/image/tests/image_module_test.info
@@ -6,8 +6,8 @@ core = 7.x
 files[] = image_module_test.module
 hidden = TRUE
 
-; Information added by Drupal.org packaging script on 2016-02-03
-version = "7.42"
+; Information added by Drupal.org packaging script on 2016-02-24
+version = "7.43"
 project = "drupal"
-datestamp = "1454517955"
+datestamp = "1456343506"
 
diff --git a/drupal7/modules/locale/locale.info b/drupal7/modules/locale/locale.info
index dde39f34..b2208f7a 100644
--- a/drupal7/modules/locale/locale.info
+++ b/drupal7/modules/locale/locale.info
@@ -6,8 +6,8 @@ core = 7.x
 files[] = locale.test
 configure = admin/config/regional/language
 
-; Information added by Drupal.org packaging script on 2016-02-03
-version = "7.42"
+; Information added by Drupal.org packaging script on 2016-02-24
+version = "7.43"
 project = "drupal"
-datestamp = "1454517955"
+datestamp = "1456343506"
 
diff --git a/drupal7/modules/locale/tests/locale_test.info b/drupal7/modules/locale/tests/locale_test.info
index bc4018ef..23493fe3 100644
--- a/drupal7/modules/locale/tests/locale_test.info
+++ b/drupal7/modules/locale/tests/locale_test.info
@@ -5,8 +5,8 @@ package = Testing
 version = VERSION
 hidden = TRUE
 
-; Information added by Drupal.org packaging script on 2016-02-03
-version = "7.42"
+; Information added by Drupal.org packaging script on 2016-02-24
+version = "7.43"
 project = "drupal"
-datestamp = "1454517955"
+datestamp = "1456343506"
 
diff --git a/drupal7/modules/menu/menu.info b/drupal7/modules/menu/menu.info
index bcdecf32..b135e395 100644
--- a/drupal7/modules/menu/menu.info
+++ b/drupal7/modules/menu/menu.info
@@ -6,8 +6,8 @@ core = 7.x
 files[] = menu.test
 configure = admin/structure/menu
 
-; Information added by Drupal.org packaging script on 2016-02-03
-version = "7.42"
+; Information added by Drupal.org packaging script on 2016-02-24
+version = "7.43"
 project = "drupal"
-datestamp = "1454517955"
+datestamp = "1456343506"
 
diff --git a/drupal7/modules/node/node.info b/drupal7/modules/node/node.info
index 2bd6d48f..58f56696 100644
--- a/drupal7/modules/node/node.info
+++ b/drupal7/modules/node/node.info
@@ -9,8 +9,8 @@ required = TRUE
 configure = admin/structure/types
 stylesheets[all][] = node.css
 
-; Information added by Drupal.org packaging script on 2016-02-03
-version = "7.42"
+; Information added by Drupal.org packaging script on 2016-02-24
+version = "7.43"
 project = "drupal"
-datestamp = "1454517955"
+datestamp = "1456343506"
 
diff --git a/drupal7/modules/node/tests/node_access_test.info b/drupal7/modules/node/tests/node_access_test.info
index 6cc8a0d6..faa0c5b3 100644
--- a/drupal7/modules/node/tests/node_access_test.info
+++ b/drupal7/modules/node/tests/node_access_test.info
@@ -5,8 +5,8 @@ version = VERSION
 core = 7.x
 hidden = TRUE
 
-; Information added by Drupal.org packaging script on 2016-02-03
-version = "7.42"
+; Information added by Drupal.org packaging script on 2016-02-24
+version = "7.43"
 project = "drupal"
-datestamp = "1454517955"
+datestamp = "1456343506"
 
diff --git a/drupal7/modules/node/tests/node_test.info b/drupal7/modules/node/tests/node_test.info
index 281afb84..fe528f7a 100644
--- a/drupal7/modules/node/tests/node_test.info
+++ b/drupal7/modules/node/tests/node_test.info
@@ -5,8 +5,8 @@ version = VERSION
 core = 7.x
 hidden = TRUE
 
-; Information added by Drupal.org packaging script on 2016-02-03
-version = "7.42"
+; Information added by Drupal.org packaging script on 2016-02-24
+version = "7.43"
 project = "drupal"
-datestamp = "1454517955"
+datestamp = "1456343506"
 
diff --git a/drupal7/modules/node/tests/node_test_exception.info b/drupal7/modules/node/tests/node_test_exception.info
index 0cf4a67b..59941f03 100644
--- a/drupal7/modules/node/tests/node_test_exception.info
+++ b/drupal7/modules/node/tests/node_test_exception.info
@@ -5,8 +5,8 @@ version = VERSION
 core = 7.x
 hidden = TRUE
 
-; Information added by Drupal.org packaging script on 2016-02-03
-version = "7.42"
+; Information added by Drupal.org packaging script on 2016-02-24
+version = "7.43"
 project = "drupal"
-datestamp = "1454517955"
+datestamp = "1456343506"
 
diff --git a/drupal7/modules/openid/openid.info b/drupal7/modules/openid/openid.info
index d1d72e73..8f265925 100644
--- a/drupal7/modules/openid/openid.info
+++ b/drupal7/modules/openid/openid.info
@@ -5,8 +5,8 @@ package = Core
 core = 7.x
 files[] = openid.test
 
-; Information added by Drupal.org packaging script on 2016-02-03
-version = "7.42"
+; Information added by Drupal.org packaging script on 2016-02-24
+version = "7.43"
 project = "drupal"
-datestamp = "1454517955"
+datestamp = "1456343506"
 
diff --git a/drupal7/modules/openid/tests/openid_test.info b/drupal7/modules/openid/tests/openid_test.info
index d6de7b3f..c123b952 100644
--- a/drupal7/modules/openid/tests/openid_test.info
+++ b/drupal7/modules/openid/tests/openid_test.info
@@ -6,8 +6,8 @@ core = 7.x
 dependencies[] = openid
 hidden = TRUE
 
-; Information added by Drupal.org packaging script on 2016-02-03
-version = "7.42"
+; Information added by Drupal.org packaging script on 2016-02-24
+version = "7.43"
 project = "drupal"
-datestamp = "1454517955"
+datestamp = "1456343506"
 
diff --git a/drupal7/modules/overlay/overlay.info b/drupal7/modules/overlay/overlay.info
index 395fdb18..d415a0d5 100644
--- a/drupal7/modules/overlay/overlay.info
+++ b/drupal7/modules/overlay/overlay.info
@@ -4,8 +4,8 @@ package = Core
 version = VERSION
 core = 7.x
 
-; Information added by Drupal.org packaging script on 2016-02-03
-version = "7.42"
+; Information added by Drupal.org packaging script on 2016-02-24
+version = "7.43"
 project = "drupal"
-datestamp = "1454517955"
+datestamp = "1456343506"
 
diff --git a/drupal7/modules/path/path.info b/drupal7/modules/path/path.info
index b51d3028..7ef6ad34 100644
--- a/drupal7/modules/path/path.info
+++ b/drupal7/modules/path/path.info
@@ -6,8 +6,8 @@ core = 7.x
 files[] = path.test
 configure = admin/config/search/path
 
-; Information added by Drupal.org packaging script on 2016-02-03
-version = "7.42"
+; Information added by Drupal.org packaging script on 2016-02-24
+version = "7.43"
 project = "drupal"
-datestamp = "1454517955"
+datestamp = "1456343506"
 
diff --git a/drupal7/modules/php/php.info b/drupal7/modules/php/php.info
index 78ec54a1..fb788c62 100644
--- a/drupal7/modules/php/php.info
+++ b/drupal7/modules/php/php.info
@@ -5,8 +5,8 @@ version = VERSION
 core = 7.x
 files[] = php.test
 
-; Information added by Drupal.org packaging script on 2016-02-03
-version = "7.42"
+; Information added by Drupal.org packaging script on 2016-02-24
+version = "7.43"
 project = "drupal"
-datestamp = "1454517955"
+datestamp = "1456343506"
 
diff --git a/drupal7/modules/poll/poll.info b/drupal7/modules/poll/poll.info
index 8502b2a9..8d9d91af 100644
--- a/drupal7/modules/poll/poll.info
+++ b/drupal7/modules/poll/poll.info
@@ -6,8 +6,8 @@ core = 7.x
 files[] = poll.test
 stylesheets[all][] = poll.css
 
-; Information added by Drupal.org packaging script on 2016-02-03
-version = "7.42"
+; Information added by Drupal.org packaging script on 2016-02-24
+version = "7.43"
 project = "drupal"
-datestamp = "1454517955"
+datestamp = "1456343506"
 
diff --git a/drupal7/modules/profile/profile.info b/drupal7/modules/profile/profile.info
index c1d27ab6..db6e7b1b 100644
--- a/drupal7/modules/profile/profile.info
+++ b/drupal7/modules/profile/profile.info
@@ -11,8 +11,8 @@ configure = admin/config/people/profile
 ; See user_system_info_alter().
 hidden = TRUE
 
-; Information added by Drupal.org packaging script on 2016-02-03
-version = "7.42"
+; Information added by Drupal.org packaging script on 2016-02-24
+version = "7.43"
 project = "drupal"
-datestamp = "1454517955"
+datestamp = "1456343506"
 
diff --git a/drupal7/modules/rdf/rdf.info b/drupal7/modules/rdf/rdf.info
index 1c39cdb2..a58be463 100644
--- a/drupal7/modules/rdf/rdf.info
+++ b/drupal7/modules/rdf/rdf.info
@@ -5,8 +5,8 @@ version = VERSION
 core = 7.x
 files[] = rdf.test
 
-; Information added by Drupal.org packaging script on 2016-02-03
-version = "7.42"
+; Information added by Drupal.org packaging script on 2016-02-24
+version = "7.43"
 project = "drupal"
-datestamp = "1454517955"
+datestamp = "1456343506"
 
diff --git a/drupal7/modules/rdf/tests/rdf_test.info b/drupal7/modules/rdf/tests/rdf_test.info
index e2136860..836ddf63 100644
--- a/drupal7/modules/rdf/tests/rdf_test.info
+++ b/drupal7/modules/rdf/tests/rdf_test.info
@@ -5,8 +5,8 @@ version = VERSION
 core = 7.x
 hidden = TRUE
 
-; Information added by Drupal.org packaging script on 2016-02-03
-version = "7.42"
+; Information added by Drupal.org packaging script on 2016-02-24
+version = "7.43"
 project = "drupal"
-datestamp = "1454517955"
+datestamp = "1456343506"
 
diff --git a/drupal7/modules/search/search.info b/drupal7/modules/search/search.info
index 787389b3..33fed95d 100644
--- a/drupal7/modules/search/search.info
+++ b/drupal7/modules/search/search.info
@@ -8,8 +8,8 @@ files[] = search.test
 configure = admin/config/search/settings
 stylesheets[all][] = search.css
 
-; Information added by Drupal.org packaging script on 2016-02-03
-version = "7.42"
+; Information added by Drupal.org packaging script on 2016-02-24
+version = "7.43"
 project = "drupal"
-datestamp = "1454517955"
+datestamp = "1456343506"
 
diff --git a/drupal7/modules/search/tests/search_embedded_form.info b/drupal7/modules/search/tests/search_embedded_form.info
index e4960dc9..d8b237ff 100644
--- a/drupal7/modules/search/tests/search_embedded_form.info
+++ b/drupal7/modules/search/tests/search_embedded_form.info
@@ -5,8 +5,8 @@ version = VERSION
 core = 7.x
 hidden = TRUE
 
-; Information added by Drupal.org packaging script on 2016-02-03
-version = "7.42"
+; Information added by Drupal.org packaging script on 2016-02-24
+version = "7.43"
 project = "drupal"
-datestamp = "1454517955"
+datestamp = "1456343506"
 
diff --git a/drupal7/modules/search/tests/search_extra_type.info b/drupal7/modules/search/tests/search_extra_type.info
index 34a547d4..306cc8cb 100644
--- a/drupal7/modules/search/tests/search_extra_type.info
+++ b/drupal7/modules/search/tests/search_extra_type.info
@@ -5,8 +5,8 @@ version = VERSION
 core = 7.x
 hidden = TRUE
 
-; Information added by Drupal.org packaging script on 2016-02-03
-version = "7.42"
+; Information added by Drupal.org packaging script on 2016-02-24
+version = "7.43"
 project = "drupal"
-datestamp = "1454517955"
+datestamp = "1456343506"
 
diff --git a/drupal7/modules/search/tests/search_node_tags.info b/drupal7/modules/search/tests/search_node_tags.info
index 1668e872..78b1f397 100644
--- a/drupal7/modules/search/tests/search_node_tags.info
+++ b/drupal7/modules/search/tests/search_node_tags.info
@@ -5,8 +5,8 @@ version = VERSION
 core = 7.x
 hidden = TRUE
 
-; Information added by Drupal.org packaging script on 2016-02-03
-version = "7.42"
+; Information added by Drupal.org packaging script on 2016-02-24
+version = "7.43"
 project = "drupal"
-datestamp = "1454517955"
+datestamp = "1456343506"
 
diff --git a/drupal7/modules/shortcut/shortcut.info b/drupal7/modules/shortcut/shortcut.info
index b42db9cb..d6aa11c0 100644
--- a/drupal7/modules/shortcut/shortcut.info
+++ b/drupal7/modules/shortcut/shortcut.info
@@ -6,8 +6,8 @@ core = 7.x
 files[] = shortcut.test
 configure = admin/config/user-interface/shortcut
 
-; Information added by Drupal.org packaging script on 2016-02-03
-version = "7.42"
+; Information added by Drupal.org packaging script on 2016-02-24
+version = "7.43"
 project = "drupal"
-datestamp = "1454517955"
+datestamp = "1456343506"
 
diff --git a/drupal7/modules/simpletest/simpletest.info b/drupal7/modules/simpletest/simpletest.info
index d037b8ee..1063ed66 100644
--- a/drupal7/modules/simpletest/simpletest.info
+++ b/drupal7/modules/simpletest/simpletest.info
@@ -57,8 +57,8 @@ files[] = tests/upgrade/update.trigger.test
 files[] = tests/upgrade/update.field.test
 files[] = tests/upgrade/update.user.test
 
-; Information added by Drupal.org packaging script on 2016-02-03
-version = "7.42"
+; Information added by Drupal.org packaging script on 2016-02-24
+version = "7.43"
 project = "drupal"
-datestamp = "1454517955"
+datestamp = "1456343506"
 
diff --git a/drupal7/modules/simpletest/tests/actions_loop_test.info b/drupal7/modules/simpletest/tests/actions_loop_test.info
index a29d18a9..8054ae3e 100644
--- a/drupal7/modules/simpletest/tests/actions_loop_test.info
+++ b/drupal7/modules/simpletest/tests/actions_loop_test.info
@@ -5,8 +5,8 @@ version = VERSION
 core = 7.x
 hidden = TRUE
 
-; Information added by Drupal.org packaging script on 2016-02-03
-version = "7.42"
+; Information added by Drupal.org packaging script on 2016-02-24
+version = "7.43"
 project = "drupal"
-datestamp = "1454517955"
+datestamp = "1456343506"
 
diff --git a/drupal7/modules/simpletest/tests/ajax_forms_test.info b/drupal7/modules/simpletest/tests/ajax_forms_test.info
index 124fa133..9a036b55 100644
--- a/drupal7/modules/simpletest/tests/ajax_forms_test.info
+++ b/drupal7/modules/simpletest/tests/ajax_forms_test.info
@@ -5,8 +5,8 @@ package = Testing
 version = VERSION
 hidden = TRUE
 
-; Information added by Drupal.org packaging script on 2016-02-03
-version = "7.42"
+; Information added by Drupal.org packaging script on 2016-02-24
+version = "7.43"
 project = "drupal"
-datestamp = "1454517955"
+datestamp = "1456343506"
 
diff --git a/drupal7/modules/simpletest/tests/ajax_test.info b/drupal7/modules/simpletest/tests/ajax_test.info
index c94233f6..a987a3fa 100644
--- a/drupal7/modules/simpletest/tests/ajax_test.info
+++ b/drupal7/modules/simpletest/tests/ajax_test.info
@@ -5,8 +5,8 @@ version = VERSION
 core = 7.x
 hidden = TRUE
 
-; Information added by Drupal.org packaging script on 2016-02-03
-version = "7.42"
+; Information added by Drupal.org packaging script on 2016-02-24
+version = "7.43"
 project = "drupal"
-datestamp = "1454517955"
+datestamp = "1456343506"
 
diff --git a/drupal7/modules/simpletest/tests/batch_test.info b/drupal7/modules/simpletest/tests/batch_test.info
index ca6096e5..04db1c8c 100644
--- a/drupal7/modules/simpletest/tests/batch_test.info
+++ b/drupal7/modules/simpletest/tests/batch_test.info
@@ -5,8 +5,8 @@ version = VERSION
 core = 7.x
 hidden = TRUE
 
-; Information added by Drupal.org packaging script on 2016-02-03
-version = "7.42"
+; Information added by Drupal.org packaging script on 2016-02-24
+version = "7.43"
 project = "drupal"
-datestamp = "1454517955"
+datestamp = "1456343506"
 
diff --git a/drupal7/modules/simpletest/tests/boot_test_1.info b/drupal7/modules/simpletest/tests/boot_test_1.info
index e549d125..16c7bc48 100644
--- a/drupal7/modules/simpletest/tests/boot_test_1.info
+++ b/drupal7/modules/simpletest/tests/boot_test_1.info
@@ -5,8 +5,8 @@ package = Testing
 version = VERSION
 hidden = TRUE
 
-; Information added by Drupal.org packaging script on 2016-02-03
-version = "7.42"
+; Information added by Drupal.org packaging script on 2016-02-24
+version = "7.43"
 project = "drupal"
-datestamp = "1454517955"
+datestamp = "1456343506"
 
diff --git a/drupal7/modules/simpletest/tests/boot_test_2.info b/drupal7/modules/simpletest/tests/boot_test_2.info
index 8004acc7..64fb360a 100644
--- a/drupal7/modules/simpletest/tests/boot_test_2.info
+++ b/drupal7/modules/simpletest/tests/boot_test_2.info
@@ -5,8 +5,8 @@ package = Testing
 version = VERSION
 hidden = TRUE
 
-; Information added by Drupal.org packaging script on 2016-02-03
-version = "7.42"
+; Information added by Drupal.org packaging script on 2016-02-24
+version = "7.43"
 project = "drupal"
-datestamp = "1454517955"
+datestamp = "1456343506"
 
diff --git a/drupal7/modules/simpletest/tests/common.test b/drupal7/modules/simpletest/tests/common.test
index bf855761..92aefe48 100644
--- a/drupal7/modules/simpletest/tests/common.test
+++ b/drupal7/modules/simpletest/tests/common.test
@@ -372,6 +372,65 @@ class CommonURLUnitTest extends DrupalWebTestCase {
   }
 }
 
+/**
+ * Tests url_is_external().
+ */
+class UrlIsExternalUnitTest extends DrupalUnitTestCase {
+
+  public static function getInfo() {
+    return array(
+      'name' => 'External URL checking',
+      'description' => 'Performs tests on url_is_external().',
+      'group' => 'System',
+    );
+  }
+
+  /**
+   * Tests if each URL is external or not.
+   */
+  function testUrlIsExternal() {
+    foreach ($this->examples() as $path => $expected) {
+      $this->assertIdentical(url_is_external($path), $expected, $path);
+    }
+  }
+
+  /**
+   * Provides data for testUrlIsExternal().
+   *
+   * @return array
+   *   An array of test data, keyed by a path, with the expected value where
+   *   TRUE is external, and FALSE is not external.
+   */
+  protected function examples() {
+    return array(
+      // Simple external URLs.
+      'http://example.com' => TRUE,
+      'https://example.com' => TRUE,
+      'http://drupal.org/foo/bar?foo=bar&bar=baz&baz#foo' => TRUE,
+      '//drupal.org' => TRUE,
+      // Some browsers ignore or strip leading control characters.
+      "\x00//www.example.com" => TRUE,
+      "\x08//www.example.com" => TRUE,
+      "\x1F//www.example.com" => TRUE,
+      "\n//www.example.com" => TRUE,
+      // JSON supports decoding directly from UTF-8 code points.
+      json_decode('"\u00AD"') . "//www.example.com" => TRUE,
+      json_decode('"\u200E"') . "//www.example.com" => TRUE,
+      json_decode('"\uE0020"') . "//www.example.com" => TRUE,
+      json_decode('"\uE000"')  . "//www.example.com" => TRUE,
+      // Backslashes should be normalized to forward.
+      '\\\\example.com' => TRUE,
+      // Local URLs.
+      'node' => FALSE,
+      '/system/ajax' => FALSE,
+      '?q=foo:bar' => FALSE,
+      'node/edit:me' => FALSE,
+      '/drupal.org' => FALSE,
+      '<front>' => FALSE,
+    );
+  }
+}
+
 /**
  * Tests for check_plain(), filter_xss(), format_string(), and check_url().
  */
@@ -1256,6 +1315,15 @@ class DrupalGotoTest extends DrupalWebTestCase {
     $this->assertText('drupal_goto', 'Drupal goto redirect succeeded.');
     $this->assertEqual($this->getUrl(), url('common-test/drupal_goto', array('query' => array('foo' => '123'), 'absolute' => TRUE)), 'Drupal goto redirected to expected URL.');
 
+    // Test that calling drupal_goto() on the current path is not dangerous.
+    variable_set('common_test_redirect_current_path', TRUE);
+    $this->drupalGet('', array('query' => array('q' => 'http://www.example.com/')));
+    $headers = $this->drupalGetHeaders(TRUE);
+    list(, $status) = explode(' ', $headers[0][':status'], 3);
+    $this->assertEqual($status, 302, 'Expected response code was sent.');
+    $this->assertNotEqual($this->getUrl(), 'http://www.example.com/', 'Drupal goto did not redirect to external URL.');
+    $this->assertTrue(strpos($this->getUrl(), url('<front>', array('absolute' => TRUE))) === 0, 'Drupal redirected to itself.');
+    variable_del('common_test_redirect_current_path');
     // Test that drupal_goto() respects ?destination=xxx. Use an complicated URL
     // to test that the path is encoded and decoded properly.
     $destination = 'common-test/drupal_goto/destination?foo=%2525&bar=123';
diff --git a/drupal7/modules/simpletest/tests/common_test.info b/drupal7/modules/simpletest/tests/common_test.info
index 989a9589..e484a8c2 100644
--- a/drupal7/modules/simpletest/tests/common_test.info
+++ b/drupal7/modules/simpletest/tests/common_test.info
@@ -7,8 +7,8 @@ stylesheets[all][] = common_test.css
 stylesheets[print][] = common_test.print.css
 hidden = TRUE
 
-; Information added by Drupal.org packaging script on 2016-02-03
-version = "7.42"
+; Information added by Drupal.org packaging script on 2016-02-24
+version = "7.43"
 project = "drupal"
-datestamp = "1454517955"
+datestamp = "1456343506"
 
diff --git a/drupal7/modules/simpletest/tests/common_test.module b/drupal7/modules/simpletest/tests/common_test.module
index 674a4944..2eb8cd5d 100644
--- a/drupal7/modules/simpletest/tests/common_test.module
+++ b/drupal7/modules/simpletest/tests/common_test.module
@@ -92,6 +92,15 @@ function common_test_drupal_goto_alter(&$path, &$options, &$http_response_code)
   }
 }
 
+/**
+ * Implements hook_init().
+ */
+function common_test_init() {
+  if (variable_get('common_test_redirect_current_path', FALSE)) {
+    drupal_goto(current_path());
+  }
+}
+
 /**
  * Print destination query parameter.
  */
diff --git a/drupal7/modules/simpletest/tests/common_test_cron_helper.info b/drupal7/modules/simpletest/tests/common_test_cron_helper.info
index 3f641479..a11c2fc5 100644
--- a/drupal7/modules/simpletest/tests/common_test_cron_helper.info
+++ b/drupal7/modules/simpletest/tests/common_test_cron_helper.info
@@ -5,8 +5,8 @@ version = VERSION
 core = 7.x
 hidden = TRUE
 
-; Information added by Drupal.org packaging script on 2016-02-03
-version = "7.42"
+; Information added by Drupal.org packaging script on 2016-02-24
+version = "7.43"
 project = "drupal"
-datestamp = "1454517955"
+datestamp = "1456343506"
 
diff --git a/drupal7/modules/simpletest/tests/database_test.info b/drupal7/modules/simpletest/tests/database_test.info
index a049a7d4..c8c2aa80 100644
--- a/drupal7/modules/simpletest/tests/database_test.info
+++ b/drupal7/modules/simpletest/tests/database_test.info
@@ -5,8 +5,8 @@ package = Testing
 version = VERSION
 hidden = TRUE
 
-; Information added by Drupal.org packaging script on 2016-02-03
-version = "7.42"
+; Information added by Drupal.org packaging script on 2016-02-24
+version = "7.43"
 project = "drupal"
-datestamp = "1454517955"
+datestamp = "1456343506"
 
diff --git a/drupal7/modules/simpletest/tests/drupal_autoload_test/drupal_autoload_test.info b/drupal7/modules/simpletest/tests/drupal_autoload_test/drupal_autoload_test.info
index e398d8c7..520e8d59 100644
--- a/drupal7/modules/simpletest/tests/drupal_autoload_test/drupal_autoload_test.info
+++ b/drupal7/modules/simpletest/tests/drupal_autoload_test/drupal_autoload_test.info
@@ -7,8 +7,8 @@ version = VERSION
 core = 7.x
 hidden = TRUE
 
-; Information added by Drupal.org packaging script on 2016-02-03
-version = "7.42"
+; Information added by Drupal.org packaging script on 2016-02-24
+version = "7.43"
 project = "drupal"
-datestamp = "1454517955"
+datestamp = "1456343506"
 
diff --git a/drupal7/modules/simpletest/tests/drupal_system_listing_compatible_test/drupal_system_listing_compatible_test.info b/drupal7/modules/simpletest/tests/drupal_system_listing_compatible_test/drupal_system_listing_compatible_test.info
index a61cfb1b..613d911a 100644
--- a/drupal7/modules/simpletest/tests/drupal_system_listing_compatible_test/drupal_system_listing_compatible_test.info
+++ b/drupal7/modules/simpletest/tests/drupal_system_listing_compatible_test/drupal_system_listing_compatible_test.info
@@ -5,8 +5,8 @@ version = VERSION
 core = 7.x
 hidden = TRUE
 
-; Information added by Drupal.org packaging script on 2016-02-03
-version = "7.42"
+; Information added by Drupal.org packaging script on 2016-02-24
+version = "7.43"
 project = "drupal"
-datestamp = "1454517955"
+datestamp = "1456343506"
 
diff --git a/drupal7/modules/simpletest/tests/drupal_system_listing_incompatible_test/drupal_system_listing_incompatible_test.info b/drupal7/modules/simpletest/tests/drupal_system_listing_incompatible_test/drupal_system_listing_incompatible_test.info
index da073175..e417f4bf 100644
--- a/drupal7/modules/simpletest/tests/drupal_system_listing_incompatible_test/drupal_system_listing_incompatible_test.info
+++ b/drupal7/modules/simpletest/tests/drupal_system_listing_incompatible_test/drupal_system_listing_incompatible_test.info
@@ -5,8 +5,8 @@ version = VERSION
 core = 7.x
 hidden = TRUE
 
-; Information added by Drupal.org packaging script on 2016-02-03
-version = "7.42"
+; Information added by Drupal.org packaging script on 2016-02-24
+version = "7.43"
 project = "drupal"
-datestamp = "1454517955"
+datestamp = "1456343506"
 
diff --git a/drupal7/modules/simpletest/tests/entity_cache_test.info b/drupal7/modules/simpletest/tests/entity_cache_test.info
index 96eeba3a..ebb4b089 100644
--- a/drupal7/modules/simpletest/tests/entity_cache_test.info
+++ b/drupal7/modules/simpletest/tests/entity_cache_test.info
@@ -6,8 +6,8 @@ core = 7.x
 dependencies[] = entity_cache_test_dependency
 hidden = TRUE
 
-; Information added by Drupal.org packaging script on 2016-02-03
-version = "7.42"
+; Information added by Drupal.org packaging script on 2016-02-24
+version = "7.43"
 project = "drupal"
-datestamp = "1454517955"
+datestamp = "1456343506"
 
diff --git a/drupal7/modules/simpletest/tests/entity_cache_test_dependency.info b/drupal7/modules/simpletest/tests/entity_cache_test_dependency.info
index e42de23d..835e4ca6 100644
--- a/drupal7/modules/simpletest/tests/entity_cache_test_dependency.info
+++ b/drupal7/modules/simpletest/tests/entity_cache_test_dependency.info
@@ -5,8 +5,8 @@ version = VERSION
 core = 7.x
 hidden = TRUE
 
-; Information added by Drupal.org packaging script on 2016-02-03
-version = "7.42"
+; Information added by Drupal.org packaging script on 2016-02-24
+version = "7.43"
 project = "drupal"
-datestamp = "1454517955"
+datestamp = "1456343506"
 
diff --git a/drupal7/modules/simpletest/tests/entity_crud_hook_test.info b/drupal7/modules/simpletest/tests/entity_crud_hook_test.info
index c9766a1a..d7969f18 100644
--- a/drupal7/modules/simpletest/tests/entity_crud_hook_test.info
+++ b/drupal7/modules/simpletest/tests/entity_crud_hook_test.info
@@ -5,8 +5,8 @@ package = Testing
 version = VERSION
 hidden = TRUE
 
-; Information added by Drupal.org packaging script on 2016-02-03
-version = "7.42"
+; Information added by Drupal.org packaging script on 2016-02-24
+version = "7.43"
 project = "drupal"
-datestamp = "1454517955"
+datestamp = "1456343506"
 
diff --git a/drupal7/modules/simpletest/tests/entity_query_access_test.info b/drupal7/modules/simpletest/tests/entity_query_access_test.info
index 6c770caf..03c2dcf1 100644
--- a/drupal7/modules/simpletest/tests/entity_query_access_test.info
+++ b/drupal7/modules/simpletest/tests/entity_query_access_test.info
@@ -5,8 +5,8 @@ version = VERSION
 core = 7.x
 hidden = TRUE
 
-; Information added by Drupal.org packaging script on 2016-02-03
-version = "7.42"
+; Information added by Drupal.org packaging script on 2016-02-24
+version = "7.43"
 project = "drupal"
-datestamp = "1454517955"
+datestamp = "1456343506"
 
diff --git a/drupal7/modules/simpletest/tests/error_test.info b/drupal7/modules/simpletest/tests/error_test.info
index 6622fcef..08ff6765 100644
--- a/drupal7/modules/simpletest/tests/error_test.info
+++ b/drupal7/modules/simpletest/tests/error_test.info
@@ -5,8 +5,8 @@ version = VERSION
 core = 7.x
 hidden = TRUE
 
-; Information added by Drupal.org packaging script on 2016-02-03
-version = "7.42"
+; Information added by Drupal.org packaging script on 2016-02-24
+version = "7.43"
 project = "drupal"
-datestamp = "1454517955"
+datestamp = "1456343506"
 
diff --git a/drupal7/modules/simpletest/tests/file_test.info b/drupal7/modules/simpletest/tests/file_test.info
index 53f5591c..4f6598ab 100644
--- a/drupal7/modules/simpletest/tests/file_test.info
+++ b/drupal7/modules/simpletest/tests/file_test.info
@@ -6,8 +6,8 @@ core = 7.x
 files[] = file_test.module
 hidden = TRUE
 
-; Information added by Drupal.org packaging script on 2016-02-03
-version = "7.42"
+; Information added by Drupal.org packaging script on 2016-02-24
+version = "7.43"
 project = "drupal"
-datestamp = "1454517955"
+datestamp = "1456343506"
 
diff --git a/drupal7/modules/simpletest/tests/filter_test.info b/drupal7/modules/simpletest/tests/filter_test.info
index ee5164e0..b57f9795 100644
--- a/drupal7/modules/simpletest/tests/filter_test.info
+++ b/drupal7/modules/simpletest/tests/filter_test.info
@@ -5,8 +5,8 @@ version = VERSION
 core = 7.x
 hidden = TRUE
 
-; Information added by Drupal.org packaging script on 2016-02-03
-version = "7.42"
+; Information added by Drupal.org packaging script on 2016-02-24
+version = "7.43"
 project = "drupal"
-datestamp = "1454517955"
+datestamp = "1456343506"
 
diff --git a/drupal7/modules/simpletest/tests/form_test.info b/drupal7/modules/simpletest/tests/form_test.info
index 34337e52..21f621b4 100644
--- a/drupal7/modules/simpletest/tests/form_test.info
+++ b/drupal7/modules/simpletest/tests/form_test.info
@@ -5,8 +5,8 @@ version = VERSION
 core = 7.x
 hidden = TRUE
 
-; Information added by Drupal.org packaging script on 2016-02-03
-version = "7.42"
+; Information added by Drupal.org packaging script on 2016-02-24
+version = "7.43"
 project = "drupal"
-datestamp = "1454517955"
+datestamp = "1456343506"
 
diff --git a/drupal7/modules/simpletest/tests/image_test.info b/drupal7/modules/simpletest/tests/image_test.info
index f06e90a2..6ad1785f 100644
--- a/drupal7/modules/simpletest/tests/image_test.info
+++ b/drupal7/modules/simpletest/tests/image_test.info
@@ -5,8 +5,8 @@ version = VERSION
 core = 7.x
 hidden = TRUE
 
-; Information added by Drupal.org packaging script on 2016-02-03
-version = "7.42"
+; Information added by Drupal.org packaging script on 2016-02-24
+version = "7.43"
 project = "drupal"
-datestamp = "1454517955"
+datestamp = "1456343506"
 
diff --git a/drupal7/modules/simpletest/tests/menu_test.info b/drupal7/modules/simpletest/tests/menu_test.info
index b630707f..88007a1e 100644
--- a/drupal7/modules/simpletest/tests/menu_test.info
+++ b/drupal7/modules/simpletest/tests/menu_test.info
@@ -5,8 +5,8 @@ version = VERSION
 core = 7.x
 hidden = TRUE
 
-; Information added by Drupal.org packaging script on 2016-02-03
-version = "7.42"
+; Information added by Drupal.org packaging script on 2016-02-24
+version = "7.43"
 project = "drupal"
-datestamp = "1454517955"
+datestamp = "1456343506"
 
diff --git a/drupal7/modules/simpletest/tests/module_test.info b/drupal7/modules/simpletest/tests/module_test.info
index d821d938..08c2c7f1 100644
--- a/drupal7/modules/simpletest/tests/module_test.info
+++ b/drupal7/modules/simpletest/tests/module_test.info
@@ -5,8 +5,8 @@ version = VERSION
 core = 7.x
 hidden = TRUE
 
-; Information added by Drupal.org packaging script on 2016-02-03
-version = "7.42"
+; Information added by Drupal.org packaging script on 2016-02-24
+version = "7.43"
 project = "drupal"
-datestamp = "1454517955"
+datestamp = "1456343506"
 
diff --git a/drupal7/modules/simpletest/tests/path_test.info b/drupal7/modules/simpletest/tests/path_test.info
index d660a473..7c3d6c93 100644
--- a/drupal7/modules/simpletest/tests/path_test.info
+++ b/drupal7/modules/simpletest/tests/path_test.info
@@ -5,8 +5,8 @@ version = VERSION
 core = 7.x
 hidden = TRUE
 
-; Information added by Drupal.org packaging script on 2016-02-03
-version = "7.42"
+; Information added by Drupal.org packaging script on 2016-02-24
+version = "7.43"
 project = "drupal"
-datestamp = "1454517955"
+datestamp = "1456343506"
 
diff --git a/drupal7/modules/simpletest/tests/psr_0_test/psr_0_test.info b/drupal7/modules/simpletest/tests/psr_0_test/psr_0_test.info
index b9553696..e17791ac 100644
--- a/drupal7/modules/simpletest/tests/psr_0_test/psr_0_test.info
+++ b/drupal7/modules/simpletest/tests/psr_0_test/psr_0_test.info
@@ -5,8 +5,8 @@ core = 7.x
 hidden = TRUE
 package = Testing
 
-; Information added by Drupal.org packaging script on 2016-02-03
-version = "7.42"
+; Information added by Drupal.org packaging script on 2016-02-24
+version = "7.43"
 project = "drupal"
-datestamp = "1454517955"
+datestamp = "1456343506"
 
diff --git a/drupal7/modules/simpletest/tests/psr_4_test/psr_4_test.info b/drupal7/modules/simpletest/tests/psr_4_test/psr_4_test.info
index f6124684..52004961 100644
--- a/drupal7/modules/simpletest/tests/psr_4_test/psr_4_test.info
+++ b/drupal7/modules/simpletest/tests/psr_4_test/psr_4_test.info
@@ -5,8 +5,8 @@ core = 7.x
 hidden = TRUE
 package = Testing
 
-; Information added by Drupal.org packaging script on 2016-02-03
-version = "7.42"
+; Information added by Drupal.org packaging script on 2016-02-24
+version = "7.43"
 project = "drupal"
-datestamp = "1454517955"
+datestamp = "1456343506"
 
diff --git a/drupal7/modules/simpletest/tests/requirements1_test.info b/drupal7/modules/simpletest/tests/requirements1_test.info
index d7d6284a..95ac379b 100644
--- a/drupal7/modules/simpletest/tests/requirements1_test.info
+++ b/drupal7/modules/simpletest/tests/requirements1_test.info
@@ -5,8 +5,8 @@ version = VERSION
 core = 7.x
 hidden = TRUE
 
-; Information added by Drupal.org packaging script on 2016-02-03
-version = "7.42"
+; Information added by Drupal.org packaging script on 2016-02-24
+version = "7.43"
 project = "drupal"
-datestamp = "1454517955"
+datestamp = "1456343506"
 
diff --git a/drupal7/modules/simpletest/tests/requirements2_test.info b/drupal7/modules/simpletest/tests/requirements2_test.info
index 19b86f56..ab6015ab 100644
--- a/drupal7/modules/simpletest/tests/requirements2_test.info
+++ b/drupal7/modules/simpletest/tests/requirements2_test.info
@@ -7,8 +7,8 @@ version = VERSION
 core = 7.x
 hidden = TRUE
 
-; Information added by Drupal.org packaging script on 2016-02-03
-version = "7.42"
+; Information added by Drupal.org packaging script on 2016-02-24
+version = "7.43"
 project = "drupal"
-datestamp = "1454517955"
+datestamp = "1456343506"
 
diff --git a/drupal7/modules/simpletest/tests/session_test.info b/drupal7/modules/simpletest/tests/session_test.info
index e06f6903..fe8594ac 100644
--- a/drupal7/modules/simpletest/tests/session_test.info
+++ b/drupal7/modules/simpletest/tests/session_test.info
@@ -5,8 +5,8 @@ version = VERSION
 core = 7.x
 hidden = TRUE
 
-; Information added by Drupal.org packaging script on 2016-02-03
-version = "7.42"
+; Information added by Drupal.org packaging script on 2016-02-24
+version = "7.43"
 project = "drupal"
-datestamp = "1454517955"
+datestamp = "1456343506"
 
diff --git a/drupal7/modules/simpletest/tests/system_dependencies_test.info b/drupal7/modules/simpletest/tests/system_dependencies_test.info
index 12087764..6bc9979f 100644
--- a/drupal7/modules/simpletest/tests/system_dependencies_test.info
+++ b/drupal7/modules/simpletest/tests/system_dependencies_test.info
@@ -6,8 +6,8 @@ core = 7.x
 hidden = TRUE
 dependencies[] = _missing_dependency
 
-; Information added by Drupal.org packaging script on 2016-02-03
-version = "7.42"
+; Information added by Drupal.org packaging script on 2016-02-24
+version = "7.43"
 project = "drupal"
-datestamp = "1454517955"
+datestamp = "1456343506"
 
diff --git a/drupal7/modules/simpletest/tests/system_incompatible_core_version_dependencies_test.info b/drupal7/modules/simpletest/tests/system_incompatible_core_version_dependencies_test.info
index c1f6d527..0cdbda70 100644
--- a/drupal7/modules/simpletest/tests/system_incompatible_core_version_dependencies_test.info
+++ b/drupal7/modules/simpletest/tests/system_incompatible_core_version_dependencies_test.info
@@ -6,8 +6,8 @@ core = 7.x
 hidden = TRUE
 dependencies[] = system_incompatible_core_version_test
 
-; Information added by Drupal.org packaging script on 2016-02-03
-version = "7.42"
+; Information added by Drupal.org packaging script on 2016-02-24
+version = "7.43"
 project = "drupal"
-datestamp = "1454517955"
+datestamp = "1456343506"
 
diff --git a/drupal7/modules/simpletest/tests/system_incompatible_core_version_test.info b/drupal7/modules/simpletest/tests/system_incompatible_core_version_test.info
index ee3c9724..7c36e496 100644
--- a/drupal7/modules/simpletest/tests/system_incompatible_core_version_test.info
+++ b/drupal7/modules/simpletest/tests/system_incompatible_core_version_test.info
@@ -5,8 +5,8 @@ version = VERSION
 core = 5.x
 hidden = TRUE
 
-; Information added by Drupal.org packaging script on 2016-02-03
-version = "7.42"
+; Information added by Drupal.org packaging script on 2016-02-24
+version = "7.43"
 project = "drupal"
-datestamp = "1454517955"
+datestamp = "1456343506"
 
diff --git a/drupal7/modules/simpletest/tests/system_incompatible_module_version_dependencies_test.info b/drupal7/modules/simpletest/tests/system_incompatible_module_version_dependencies_test.info
index bd9bd820..5c7c43ab 100644
--- a/drupal7/modules/simpletest/tests/system_incompatible_module_version_dependencies_test.info
+++ b/drupal7/modules/simpletest/tests/system_incompatible_module_version_dependencies_test.info
@@ -7,8 +7,8 @@ hidden = TRUE
 ; system_incompatible_module_version_test declares version 1.0
 dependencies[] = system_incompatible_module_version_test (>2.0)
 
-; Information added by Drupal.org packaging script on 2016-02-03
-version = "7.42"
+; Information added by Drupal.org packaging script on 2016-02-24
+version = "7.43"
 project = "drupal"
-datestamp = "1454517955"
+datestamp = "1456343506"
 
diff --git a/drupal7/modules/simpletest/tests/system_incompatible_module_version_test.info b/drupal7/modules/simpletest/tests/system_incompatible_module_version_test.info
index ec3d0c47..0bdef7cd 100644
--- a/drupal7/modules/simpletest/tests/system_incompatible_module_version_test.info
+++ b/drupal7/modules/simpletest/tests/system_incompatible_module_version_test.info
@@ -5,8 +5,8 @@ version = 1.0
 core = 7.x
 hidden = TRUE
 
-; Information added by Drupal.org packaging script on 2016-02-03
-version = "7.42"
+; Information added by Drupal.org packaging script on 2016-02-24
+version = "7.43"
 project = "drupal"
-datestamp = "1454517955"
+datestamp = "1456343506"
 
diff --git a/drupal7/modules/simpletest/tests/system_project_namespace_test.info b/drupal7/modules/simpletest/tests/system_project_namespace_test.info
index 663a1b17..2bfeb881 100644
--- a/drupal7/modules/simpletest/tests/system_project_namespace_test.info
+++ b/drupal7/modules/simpletest/tests/system_project_namespace_test.info
@@ -6,8 +6,8 @@ core = 7.x
 hidden = TRUE
 dependencies[] = drupal:filter
 
-; Information added by Drupal.org packaging script on 2016-02-03
-version = "7.42"
+; Information added by Drupal.org packaging script on 2016-02-24
+version = "7.43"
 project = "drupal"
-datestamp = "1454517955"
+datestamp = "1456343506"
 
diff --git a/drupal7/modules/simpletest/tests/system_test.info b/drupal7/modules/simpletest/tests/system_test.info
index a89e1fcb..3c7da63b 100644
--- a/drupal7/modules/simpletest/tests/system_test.info
+++ b/drupal7/modules/simpletest/tests/system_test.info
@@ -6,8 +6,8 @@ core = 7.x
 files[] = system_test.module
 hidden = TRUE
 
-; Information added by Drupal.org packaging script on 2016-02-03
-version = "7.42"
+; Information added by Drupal.org packaging script on 2016-02-24
+version = "7.43"
 project = "drupal"
-datestamp = "1454517955"
+datestamp = "1456343506"
 
diff --git a/drupal7/modules/simpletest/tests/taxonomy_test.info b/drupal7/modules/simpletest/tests/taxonomy_test.info
index fa48c188..1e2d7221 100644
--- a/drupal7/modules/simpletest/tests/taxonomy_test.info
+++ b/drupal7/modules/simpletest/tests/taxonomy_test.info
@@ -6,8 +6,8 @@ core = 7.x
 hidden = TRUE
 dependencies[] = taxonomy
 
-; Information added by Drupal.org packaging script on 2016-02-03
-version = "7.42"
+; Information added by Drupal.org packaging script on 2016-02-24
+version = "7.43"
 project = "drupal"
-datestamp = "1454517955"
+datestamp = "1456343506"
 
diff --git a/drupal7/modules/simpletest/tests/theme_test.info b/drupal7/modules/simpletest/tests/theme_test.info
index e94630ef..adb04d76 100644
--- a/drupal7/modules/simpletest/tests/theme_test.info
+++ b/drupal7/modules/simpletest/tests/theme_test.info
@@ -5,8 +5,8 @@ version = VERSION
 core = 7.x
 hidden = TRUE
 
-; Information added by Drupal.org packaging script on 2016-02-03
-version = "7.42"
+; Information added by Drupal.org packaging script on 2016-02-24
+version = "7.43"
 project = "drupal"
-datestamp = "1454517955"
+datestamp = "1456343506"
 
diff --git a/drupal7/modules/simpletest/tests/themes/test_basetheme/test_basetheme.info b/drupal7/modules/simpletest/tests/themes/test_basetheme/test_basetheme.info
index 178eb02b..b82f86a4 100644
--- a/drupal7/modules/simpletest/tests/themes/test_basetheme/test_basetheme.info
+++ b/drupal7/modules/simpletest/tests/themes/test_basetheme/test_basetheme.info
@@ -6,8 +6,8 @@ hidden = TRUE
 settings[basetheme_only] = base theme value
 settings[subtheme_override] = base theme value
 
-; Information added by Drupal.org packaging script on 2016-02-03
-version = "7.42"
+; Information added by Drupal.org packaging script on 2016-02-24
+version = "7.43"
 project = "drupal"
-datestamp = "1454517955"
+datestamp = "1456343506"
 
diff --git a/drupal7/modules/simpletest/tests/themes/test_subtheme/test_subtheme.info b/drupal7/modules/simpletest/tests/themes/test_subtheme/test_subtheme.info
index 414ec5e2..5059593b 100644
--- a/drupal7/modules/simpletest/tests/themes/test_subtheme/test_subtheme.info
+++ b/drupal7/modules/simpletest/tests/themes/test_subtheme/test_subtheme.info
@@ -6,8 +6,8 @@ hidden = TRUE
 
 settings[subtheme_override] = subtheme value
 
-; Information added by Drupal.org packaging script on 2016-02-03
-version = "7.42"
+; Information added by Drupal.org packaging script on 2016-02-24
+version = "7.43"
 project = "drupal"
-datestamp = "1454517955"
+datestamp = "1456343506"
 
diff --git a/drupal7/modules/simpletest/tests/themes/test_theme/test_theme.info b/drupal7/modules/simpletest/tests/themes/test_theme/test_theme.info
index c1aee297..98050c40 100644
--- a/drupal7/modules/simpletest/tests/themes/test_theme/test_theme.info
+++ b/drupal7/modules/simpletest/tests/themes/test_theme/test_theme.info
@@ -17,8 +17,8 @@ stylesheets[all][] = system.base.css
 
 settings[theme_test_setting] = default value
 
-; Information added by Drupal.org packaging script on 2016-02-03
-version = "7.42"
+; Information added by Drupal.org packaging script on 2016-02-24
+version = "7.43"
 project = "drupal"
-datestamp = "1454517955"
+datestamp = "1456343506"
 
diff --git a/drupal7/modules/simpletest/tests/update_script_test.info b/drupal7/modules/simpletest/tests/update_script_test.info
index 15de6d50..fb5d12bb 100644
--- a/drupal7/modules/simpletest/tests/update_script_test.info
+++ b/drupal7/modules/simpletest/tests/update_script_test.info
@@ -5,8 +5,8 @@ version = VERSION
 core = 7.x
 hidden = TRUE
 
-; Information added by Drupal.org packaging script on 2016-02-03
-version = "7.42"
+; Information added by Drupal.org packaging script on 2016-02-24
+version = "7.43"
 project = "drupal"
-datestamp = "1454517955"
+datestamp = "1456343506"
 
diff --git a/drupal7/modules/simpletest/tests/update_test_1.info b/drupal7/modules/simpletest/tests/update_test_1.info
index ebe765c2..4dddc493 100644
--- a/drupal7/modules/simpletest/tests/update_test_1.info
+++ b/drupal7/modules/simpletest/tests/update_test_1.info
@@ -5,8 +5,8 @@ version = VERSION
 core = 7.x
 hidden = TRUE
 
-; Information added by Drupal.org packaging script on 2016-02-03
-version = "7.42"
+; Information added by Drupal.org packaging script on 2016-02-24
+version = "7.43"
 project = "drupal"
-datestamp = "1454517955"
+datestamp = "1456343506"
 
diff --git a/drupal7/modules/simpletest/tests/update_test_2.info b/drupal7/modules/simpletest/tests/update_test_2.info
index ebe765c2..4dddc493 100644
--- a/drupal7/modules/simpletest/tests/update_test_2.info
+++ b/drupal7/modules/simpletest/tests/update_test_2.info
@@ -5,8 +5,8 @@ version = VERSION
 core = 7.x
 hidden = TRUE
 
-; Information added by Drupal.org packaging script on 2016-02-03
-version = "7.42"
+; Information added by Drupal.org packaging script on 2016-02-24
+version = "7.43"
 project = "drupal"
-datestamp = "1454517955"
+datestamp = "1456343506"
 
diff --git a/drupal7/modules/simpletest/tests/update_test_3.info b/drupal7/modules/simpletest/tests/update_test_3.info
index ebe765c2..4dddc493 100644
--- a/drupal7/modules/simpletest/tests/update_test_3.info
+++ b/drupal7/modules/simpletest/tests/update_test_3.info
@@ -5,8 +5,8 @@ version = VERSION
 core = 7.x
 hidden = TRUE
 
-; Information added by Drupal.org packaging script on 2016-02-03
-version = "7.42"
+; Information added by Drupal.org packaging script on 2016-02-24
+version = "7.43"
 project = "drupal"
-datestamp = "1454517955"
+datestamp = "1456343506"
 
diff --git a/drupal7/modules/simpletest/tests/url_alter_test.info b/drupal7/modules/simpletest/tests/url_alter_test.info
index b5e7f28f..641b673f 100644
--- a/drupal7/modules/simpletest/tests/url_alter_test.info
+++ b/drupal7/modules/simpletest/tests/url_alter_test.info
@@ -5,8 +5,8 @@ package = Testing
 version = VERSION
 hidden = TRUE
 
-; Information added by Drupal.org packaging script on 2016-02-03
-version = "7.42"
+; Information added by Drupal.org packaging script on 2016-02-24
+version = "7.43"
 project = "drupal"
-datestamp = "1454517955"
+datestamp = "1456343506"
 
diff --git a/drupal7/modules/simpletest/tests/xmlrpc.test b/drupal7/modules/simpletest/tests/xmlrpc.test
index 1a9ef234..bb74f059 100644
--- a/drupal7/modules/simpletest/tests/xmlrpc.test
+++ b/drupal7/modules/simpletest/tests/xmlrpc.test
@@ -246,4 +246,38 @@ class XMLRPCMessagesTestCase extends DrupalWebTestCase {
     $this->assertEqual($removed, 'system.methodSignature', 'Hiding builting system.methodSignature with hook_xmlrpc_alter works');
   }
 
+  /**
+   * Test limits on system.multicall that can prevent brute-force attacks.
+   */
+  function testMulticallLimit() {
+    $url = url(NULL, array('absolute' => TRUE)) . 'xmlrpc.php';
+    $multicall_args = array();
+    $num_method_calls = 10;
+    for ($i = 0; $i < $num_method_calls; $i++) {
+      $struct = array('i' => $i);
+      $multicall_args[] = array('methodName' => 'validator1.echoStructTest', 'params' => array($struct));
+    }
+    // Test limits of 1, 5, 9, 13.
+    for ($limit = 1; $limit < $num_method_calls + 4; $limit += 4) {
+      variable_set('xmlrpc_multicall_duplicate_method_limit', $limit);
+      $results = xmlrpc($url, array('system.multicall' => array($multicall_args)));
+      $this->assertEqual($num_method_calls, count($results));
+      for ($i = 0; $i < min($limit, $num_method_calls); $i++) {
+        $x = array_shift($results);
+        $this->assertTrue(empty($x->is_error), "Result $i is not an error");
+        $this->assertEqual($multicall_args[$i]['params'][0], $x);
+      }
+      for (; $i < $num_method_calls; $i++) {
+        $x = array_shift($results);
+        $this->assertFalse(empty($x->is_error), "Result $i is an error");
+        $this->assertEqual(-156579, $x->code);
+      }
+    }
+    variable_set('xmlrpc_multicall_duplicate_method_limit', -1);
+    $results = xmlrpc($url, array('system.multicall' => array($multicall_args)));
+    $this->assertEqual($num_method_calls, count($results));
+    foreach ($results as $i => $x) {
+      $this->assertTrue(empty($x->is_error), "Result $i is not an error");
+    }
+  }
 }
diff --git a/drupal7/modules/simpletest/tests/xmlrpc_test.info b/drupal7/modules/simpletest/tests/xmlrpc_test.info
index f6cd6fa8..857b1a51 100644
--- a/drupal7/modules/simpletest/tests/xmlrpc_test.info
+++ b/drupal7/modules/simpletest/tests/xmlrpc_test.info
@@ -5,8 +5,8 @@ version = VERSION
 core = 7.x
 hidden = TRUE
 
-; Information added by Drupal.org packaging script on 2016-02-03
-version = "7.42"
+; Information added by Drupal.org packaging script on 2016-02-24
+version = "7.43"
 project = "drupal"
-datestamp = "1454517955"
+datestamp = "1456343506"
 
diff --git a/drupal7/modules/statistics/statistics.info b/drupal7/modules/statistics/statistics.info
index abb4d2d8..25a6ecc2 100644
--- a/drupal7/modules/statistics/statistics.info
+++ b/drupal7/modules/statistics/statistics.info
@@ -6,8 +6,8 @@ core = 7.x
 files[] = statistics.test
 configure = admin/config/system/statistics
 
-; Information added by Drupal.org packaging script on 2016-02-03
-version = "7.42"
+; Information added by Drupal.org packaging script on 2016-02-24
+version = "7.43"
 project = "drupal"
-datestamp = "1454517955"
+datestamp = "1456343506"
 
diff --git a/drupal7/modules/syslog/syslog.info b/drupal7/modules/syslog/syslog.info
index 1c0ccc73..39afcb72 100644
--- a/drupal7/modules/syslog/syslog.info
+++ b/drupal7/modules/syslog/syslog.info
@@ -6,8 +6,8 @@ core = 7.x
 files[] = syslog.test
 configure = admin/config/development/logging
 
-; Information added by Drupal.org packaging script on 2016-02-03
-version = "7.42"
+; Information added by Drupal.org packaging script on 2016-02-24
+version = "7.43"
 project = "drupal"
-datestamp = "1454517955"
+datestamp = "1456343506"
 
diff --git a/drupal7/modules/system/system.admin.inc b/drupal7/modules/system/system.admin.inc
index 0f525c6c..16c40d4d 100644
--- a/drupal7/modules/system/system.admin.inc
+++ b/drupal7/modules/system/system.admin.inc
@@ -2202,6 +2202,11 @@ function system_add_date_format_type_form_submit($form, &$form_state) {
  * Return the date for a given format string via Ajax.
  */
 function system_date_time_lookup() {
+  // This callback is protected with a CSRF token because user input from the
+  // query string is reflected in the output.
+  if (!isset($_GET['token']) || !drupal_valid_token($_GET['token'], 'admin/config/regional/date-time/formats/lookup')) {
+    return MENU_ACCESS_DENIED;
+  }
   $result = format_date(REQUEST_TIME, 'custom', $_GET['format']);
   drupal_json_output($result);
 }
@@ -2875,13 +2880,14 @@ function system_date_time_formats() {
  * Allow users to add additional date formats.
  */
 function system_configure_date_formats_form($form, &$form_state, $dfid = 0) {
+  $ajax_path = 'admin/config/regional/date-time/formats/lookup';
   $js_settings = array(
     'type' => 'setting',
     'data' => array(
       'dateTime' => array(
         'date-format' => array(
           'text' => t('Displayed as'),
-          'lookup' => url('admin/config/regional/date-time/formats/lookup'),
+          'lookup' => url($ajax_path, array('query' => array('token' => drupal_get_token($ajax_path)))),
         ),
       ),
     ),
diff --git a/drupal7/modules/system/system.info b/drupal7/modules/system/system.info
index 6db2732e..850f7cee 100644
--- a/drupal7/modules/system/system.info
+++ b/drupal7/modules/system/system.info
@@ -12,8 +12,8 @@ files[] = system.test
 required = TRUE
 configure = admin/config/system
 
-; Information added by Drupal.org packaging script on 2016-02-03
-version = "7.42"
+; Information added by Drupal.org packaging script on 2016-02-24
+version = "7.43"
 project = "drupal"
-datestamp = "1454517955"
+datestamp = "1456343506"
 
diff --git a/drupal7/modules/system/system.js b/drupal7/modules/system/system.js
index 910fb5d3..c0e76d38 100644
--- a/drupal7/modules/system/system.js
+++ b/drupal7/modules/system/system.js
@@ -105,7 +105,7 @@ Drupal.behaviors.dateTime = {
           // Attach keyup handler to custom format inputs.
           $('input' + source, context).once('date-time').keyup(function () {
             var input = $(this);
-            var url = fieldSettings.lookup + (/\?q=/.test(fieldSettings.lookup) ? '&format=' : '?format=') + encodeURIComponent(input.val());
+            var url = fieldSettings.lookup + (/\?/.test(fieldSettings.lookup) ? '&format=' : '?format=') + encodeURIComponent(input.val());
             $.getJSON(url, function (data) {
               $(suffix).empty().append(' ' + fieldSettings.text + ': <em>' + data + '</em>');
             });
diff --git a/drupal7/modules/system/system.test b/drupal7/modules/system/system.test
index bc764dde..95b43538 100644
--- a/drupal7/modules/system/system.test
+++ b/drupal7/modules/system/system.test
@@ -1350,7 +1350,23 @@ class DateTimeFunctionalTest extends DrupalWebTestCase {
     $this->assertEqual($this->getUrl(), url('admin/config/regional/date-time/formats', array('absolute' => TRUE)), 'Correct page redirection.');
     $this->assertText(t('Custom date format updated.'), 'Custom date format successfully updated.');
 
+    // Check that ajax callback is protected by CSRF token.
+    $this->drupalGet('admin/config/regional/date-time/formats/lookup', array('query' => array('format' => 'Y m d')));
+    $this->assertResponse(403, 'Access denied with no token');
+    $this->drupalGet('admin/config/regional/date-time/formats/lookup', array('query' => array('token' => 'invalid', 'format' => 'Y m d')));
+    $this->assertResponse(403, 'Access denied with invalid token');
+    $this->drupalGet('admin/config/regional/date-time/formats');
+    $this->clickLink(t('edit'));
+    $settings = $this->drupalGetSettings();
+    $lookup_url = $settings['dateTime']['date-format']['lookup'];
+    preg_match('/token=([^&]+)/', $lookup_url, $matches);
+    $this->assertFalse(empty($matches[1]), 'Found token value');
+    $this->drupalGet('admin/config/regional/date-time/formats/lookup', array('query' => array('token' => $matches[1], 'format' => 'Y m d')));
+    $this->assertResponse(200, 'Access allowed with valid token');
+    $this->assertText(format_date(time(), 'custom', 'Y m d'));
+
     // Delete custom date format.
+    $this->drupalGet('admin/config/regional/date-time/formats');
     $this->clickLink(t('delete'));
     $this->drupalPost($this->getUrl(), array(), t('Remove'));
     $this->assertEqual($this->getUrl(), url('admin/config/regional/date-time/formats', array('absolute' => TRUE)), 'Correct page redirection.');
diff --git a/drupal7/modules/system/tests/cron_queue_test.info b/drupal7/modules/system/tests/cron_queue_test.info
index 7d2d32e6..0042f854 100644
--- a/drupal7/modules/system/tests/cron_queue_test.info
+++ b/drupal7/modules/system/tests/cron_queue_test.info
@@ -5,8 +5,8 @@ version = VERSION
 core = 7.x
 hidden = TRUE
 
-; Information added by Drupal.org packaging script on 2016-02-03
-version = "7.42"
+; Information added by Drupal.org packaging script on 2016-02-24
+version = "7.43"
 project = "drupal"
-datestamp = "1454517955"
+datestamp = "1456343506"
 
diff --git a/drupal7/modules/system/tests/system_cron_test.info b/drupal7/modules/system/tests/system_cron_test.info
index fdfe81d2..8a82231a 100644
--- a/drupal7/modules/system/tests/system_cron_test.info
+++ b/drupal7/modules/system/tests/system_cron_test.info
@@ -5,8 +5,8 @@ version = VERSION
 core = 7.x
 hidden = TRUE
 
-; Information added by Drupal.org packaging script on 2016-02-03
-version = "7.42"
+; Information added by Drupal.org packaging script on 2016-02-24
+version = "7.43"
 project = "drupal"
-datestamp = "1454517955"
+datestamp = "1456343506"
 
diff --git a/drupal7/modules/taxonomy/taxonomy.info b/drupal7/modules/taxonomy/taxonomy.info
index 3bc80c0f..725335a1 100644
--- a/drupal7/modules/taxonomy/taxonomy.info
+++ b/drupal7/modules/taxonomy/taxonomy.info
@@ -8,8 +8,8 @@ files[] = taxonomy.module
 files[] = taxonomy.test
 configure = admin/structure/taxonomy
 
-; Information added by Drupal.org packaging script on 2016-02-03
-version = "7.42"
+; Information added by Drupal.org packaging script on 2016-02-24
+version = "7.43"
 project = "drupal"
-datestamp = "1454517955"
+datestamp = "1456343506"
 
diff --git a/drupal7/modules/toolbar/toolbar.info b/drupal7/modules/toolbar/toolbar.info
index 5260d55f..7edd8eda 100644
--- a/drupal7/modules/toolbar/toolbar.info
+++ b/drupal7/modules/toolbar/toolbar.info
@@ -4,8 +4,8 @@ core = 7.x
 package = Core
 version = VERSION
 
-; Information added by Drupal.org packaging script on 2016-02-03
-version = "7.42"
+; Information added by Drupal.org packaging script on 2016-02-24
+version = "7.43"
 project = "drupal"
-datestamp = "1454517955"
+datestamp = "1456343506"
 
diff --git a/drupal7/modules/tracker/tracker.info b/drupal7/modules/tracker/tracker.info
index 077de412..2917302b 100644
--- a/drupal7/modules/tracker/tracker.info
+++ b/drupal7/modules/tracker/tracker.info
@@ -6,8 +6,8 @@ version = VERSION
 core = 7.x
 files[] = tracker.test
 
-; Information added by Drupal.org packaging script on 2016-02-03
-version = "7.42"
+; Information added by Drupal.org packaging script on 2016-02-24
+version = "7.43"
 project = "drupal"
-datestamp = "1454517955"
+datestamp = "1456343506"
 
diff --git a/drupal7/modules/translation/tests/translation_test.info b/drupal7/modules/translation/tests/translation_test.info
index 89382cc7..692b4ad8 100644
--- a/drupal7/modules/translation/tests/translation_test.info
+++ b/drupal7/modules/translation/tests/translation_test.info
@@ -5,8 +5,8 @@ package = Testing
 version = VERSION
 hidden = TRUE
 
-; Information added by Drupal.org packaging script on 2016-02-03
-version = "7.42"
+; Information added by Drupal.org packaging script on 2016-02-24
+version = "7.43"
 project = "drupal"
-datestamp = "1454517955"
+datestamp = "1456343506"
 
diff --git a/drupal7/modules/translation/translation.info b/drupal7/modules/translation/translation.info
index e37aa2e1..2f38d2ba 100644
--- a/drupal7/modules/translation/translation.info
+++ b/drupal7/modules/translation/translation.info
@@ -6,8 +6,8 @@ version = VERSION
 core = 7.x
 files[] = translation.test
 
-; Information added by Drupal.org packaging script on 2016-02-03
-version = "7.42"
+; Information added by Drupal.org packaging script on 2016-02-24
+version = "7.43"
 project = "drupal"
-datestamp = "1454517955"
+datestamp = "1456343506"
 
diff --git a/drupal7/modules/trigger/tests/trigger_test.info b/drupal7/modules/trigger/tests/trigger_test.info
index 514532b7..0fe583a3 100644
--- a/drupal7/modules/trigger/tests/trigger_test.info
+++ b/drupal7/modules/trigger/tests/trigger_test.info
@@ -4,8 +4,8 @@ package = Testing
 core = 7.x
 hidden = TRUE
 
-; Information added by Drupal.org packaging script on 2016-02-03
-version = "7.42"
+; Information added by Drupal.org packaging script on 2016-02-24
+version = "7.43"
 project = "drupal"
-datestamp = "1454517955"
+datestamp = "1456343506"
 
diff --git a/drupal7/modules/trigger/trigger.info b/drupal7/modules/trigger/trigger.info
index 1240601c..85175379 100644
--- a/drupal7/modules/trigger/trigger.info
+++ b/drupal7/modules/trigger/trigger.info
@@ -6,8 +6,8 @@ core = 7.x
 files[] = trigger.test
 configure = admin/structure/trigger
 
-; Information added by Drupal.org packaging script on 2016-02-03
-version = "7.42"
+; Information added by Drupal.org packaging script on 2016-02-24
+version = "7.43"
 project = "drupal"
-datestamp = "1454517955"
+datestamp = "1456343506"
 
diff --git a/drupal7/modules/update/tests/aaa_update_test.info b/drupal7/modules/update/tests/aaa_update_test.info
index 79ead47d..23756e02 100644
--- a/drupal7/modules/update/tests/aaa_update_test.info
+++ b/drupal7/modules/update/tests/aaa_update_test.info
@@ -4,8 +4,8 @@ package = Testing
 core = 7.x
 hidden = TRUE
 
-; Information added by Drupal.org packaging script on 2016-02-03
-version = "7.42"
+; Information added by Drupal.org packaging script on 2016-02-24
+version = "7.43"
 project = "drupal"
-datestamp = "1454517955"
+datestamp = "1456343506"
 
diff --git a/drupal7/modules/update/tests/bbb_update_test.info b/drupal7/modules/update/tests/bbb_update_test.info
index 049374b0..3fa1422d 100644
--- a/drupal7/modules/update/tests/bbb_update_test.info
+++ b/drupal7/modules/update/tests/bbb_update_test.info
@@ -4,8 +4,8 @@ package = Testing
 core = 7.x
 hidden = TRUE
 
-; Information added by Drupal.org packaging script on 2016-02-03
-version = "7.42"
+; Information added by Drupal.org packaging script on 2016-02-24
+version = "7.43"
 project = "drupal"
-datestamp = "1454517955"
+datestamp = "1456343506"
 
diff --git a/drupal7/modules/update/tests/ccc_update_test.info b/drupal7/modules/update/tests/ccc_update_test.info
index ed756bf4..50327549 100644
--- a/drupal7/modules/update/tests/ccc_update_test.info
+++ b/drupal7/modules/update/tests/ccc_update_test.info
@@ -4,8 +4,8 @@ package = Testing
 core = 7.x
 hidden = TRUE
 
-; Information added by Drupal.org packaging script on 2016-02-03
-version = "7.42"
+; Information added by Drupal.org packaging script on 2016-02-24
+version = "7.43"
 project = "drupal"
-datestamp = "1454517955"
+datestamp = "1456343506"
 
diff --git a/drupal7/modules/update/tests/themes/update_test_basetheme/update_test_basetheme.info b/drupal7/modules/update/tests/themes/update_test_basetheme/update_test_basetheme.info
index 50297e44..427e9e33 100644
--- a/drupal7/modules/update/tests/themes/update_test_basetheme/update_test_basetheme.info
+++ b/drupal7/modules/update/tests/themes/update_test_basetheme/update_test_basetheme.info
@@ -3,8 +3,8 @@ description = Test theme which acts as a base theme for other test subthemes.
 core = 7.x
 hidden = TRUE
 
-; Information added by Drupal.org packaging script on 2016-02-03
-version = "7.42"
+; Information added by Drupal.org packaging script on 2016-02-24
+version = "7.43"
 project = "drupal"
-datestamp = "1454517955"
+datestamp = "1456343506"
 
diff --git a/drupal7/modules/update/tests/themes/update_test_subtheme/update_test_subtheme.info b/drupal7/modules/update/tests/themes/update_test_subtheme/update_test_subtheme.info
index 2a5dcc26..3e6b0ba3 100644
--- a/drupal7/modules/update/tests/themes/update_test_subtheme/update_test_subtheme.info
+++ b/drupal7/modules/update/tests/themes/update_test_subtheme/update_test_subtheme.info
@@ -4,8 +4,8 @@ core = 7.x
 base theme = update_test_basetheme
 hidden = TRUE
 
-; Information added by Drupal.org packaging script on 2016-02-03
-version = "7.42"
+; Information added by Drupal.org packaging script on 2016-02-24
+version = "7.43"
 project = "drupal"
-datestamp = "1454517955"
+datestamp = "1456343506"
 
diff --git a/drupal7/modules/update/tests/update_test.info b/drupal7/modules/update/tests/update_test.info
index 4c45d3ee..1c868d13 100644
--- a/drupal7/modules/update/tests/update_test.info
+++ b/drupal7/modules/update/tests/update_test.info
@@ -5,8 +5,8 @@ version = VERSION
 core = 7.x
 hidden = TRUE
 
-; Information added by Drupal.org packaging script on 2016-02-03
-version = "7.42"
+; Information added by Drupal.org packaging script on 2016-02-24
+version = "7.43"
 project = "drupal"
-datestamp = "1454517955"
+datestamp = "1456343506"
 
diff --git a/drupal7/modules/update/update.info b/drupal7/modules/update/update.info
index 19184787..f55538f7 100644
--- a/drupal7/modules/update/update.info
+++ b/drupal7/modules/update/update.info
@@ -6,8 +6,8 @@ core = 7.x
 files[] = update.test
 configure = admin/reports/updates/settings
 
-; Information added by Drupal.org packaging script on 2016-02-03
-version = "7.42"
+; Information added by Drupal.org packaging script on 2016-02-24
+version = "7.43"
 project = "drupal"
-datestamp = "1454517955"
+datestamp = "1456343506"
 
diff --git a/drupal7/modules/user/tests/user_form_test.info b/drupal7/modules/user/tests/user_form_test.info
index 63857d83..3f4862d8 100644
--- a/drupal7/modules/user/tests/user_form_test.info
+++ b/drupal7/modules/user/tests/user_form_test.info
@@ -5,8 +5,8 @@ version = VERSION
 core = 7.x
 hidden = TRUE
 
-; Information added by Drupal.org packaging script on 2016-02-03
-version = "7.42"
+; Information added by Drupal.org packaging script on 2016-02-24
+version = "7.43"
 project = "drupal"
-datestamp = "1454517955"
+datestamp = "1456343506"
 
diff --git a/drupal7/modules/user/user.info b/drupal7/modules/user/user.info
index fff7f0e1..03be9cd5 100644
--- a/drupal7/modules/user/user.info
+++ b/drupal7/modules/user/user.info
@@ -9,8 +9,8 @@ required = TRUE
 configure = admin/config/people
 stylesheets[all][] = user.css
 
-; Information added by Drupal.org packaging script on 2016-02-03
-version = "7.42"
+; Information added by Drupal.org packaging script on 2016-02-24
+version = "7.43"
 project = "drupal"
-datestamp = "1454517955"
+datestamp = "1456343506"
 
diff --git a/drupal7/modules/user/user.module b/drupal7/modules/user/user.module
index c33aa098..d38de69b 100644
--- a/drupal7/modules/user/user.module
+++ b/drupal7/modules/user/user.module
@@ -1308,10 +1308,12 @@ function user_user_presave(&$edit, $account, $category) {
     elseif (!empty($edit['picture_delete'])) {
       $edit['picture'] = NULL;
     }
-    // Prepare user roles.
-    if (isset($edit['roles'])) {
-      $edit['roles'] = array_filter($edit['roles']);
-    }
+  }
+
+  // Filter out roles with empty values to avoid granting extra roles when
+  // processing custom form submissions.
+  if (isset($edit['roles'])) {
+    $edit['roles'] = array_filter($edit['roles']);
   }
 
   // Move account cancellation information into $user->data.
@@ -2227,7 +2229,11 @@ function user_login_final_validate($form, &$form_state) {
       }
     }
     else {
-      form_set_error('name', t('Sorry, unrecognized username or password. <a href="@password">Have you forgotten your password?</a>', array('@password' => url('user/password', array('query' => array('name' => $form_state['values']['name']))))));
+      // Use $form_state['input']['name'] here to guarantee that we send
+      // exactly what the user typed in. $form_state['values']['name'] may have
+      // been modified by validation handlers that ran earlier than this one.
+      $query = isset($form_state['input']['name']) ? array('name' => $form_state['input']['name']) : array();
+      form_set_error('name', t('Sorry, unrecognized username or password. <a href="@password">Have you forgotten your password?</a>', array('@password' => url('user/password', array('query' => $query)))));
       watchdog('user', 'Login attempt failed for %user.', array('%user' => $form_state['values']['name']));
     }
   }
diff --git a/drupal7/profiles/minimal/minimal.info b/drupal7/profiles/minimal/minimal.info
index a23c1369..f52b0f96 100644
--- a/drupal7/profiles/minimal/minimal.info
+++ b/drupal7/profiles/minimal/minimal.info
@@ -5,8 +5,8 @@ core = 7.x
 dependencies[] = block
 dependencies[] = dblog
 
-; Information added by Drupal.org packaging script on 2016-02-03
-version = "7.42"
+; Information added by Drupal.org packaging script on 2016-02-24
+version = "7.43"
 project = "drupal"
-datestamp = "1454517955"
+datestamp = "1456343506"
 
diff --git a/drupal7/profiles/standard/standard.info b/drupal7/profiles/standard/standard.info
index ddf24169..9840da32 100644
--- a/drupal7/profiles/standard/standard.info
+++ b/drupal7/profiles/standard/standard.info
@@ -24,8 +24,8 @@ dependencies[] = field_ui
 dependencies[] = file
 dependencies[] = rdf
 
-; Information added by Drupal.org packaging script on 2016-02-03
-version = "7.42"
+; Information added by Drupal.org packaging script on 2016-02-24
+version = "7.43"
 project = "drupal"
-datestamp = "1454517955"
+datestamp = "1456343506"
 
diff --git a/drupal7/profiles/standard/translations/fr.po b/drupal7/profiles/standard/translations/fr.po
index c480eaac..639a0a30 100644
--- a/drupal7/profiles/standard/translations/fr.po
+++ b/drupal7/profiles/standard/translations/fr.po
@@ -1,10 +1,10 @@
-# French translation of Drupal core (7.42)
+# French translation of Drupal core (7.43)
 # Copyright (c) 2016 by the French translation team
 #
 msgid ""
 msgstr ""
-"Project-Id-Version: Drupal core (7.42)\n"
-"POT-Creation-Date: 2016-02-03 17:45+0000\n"
+"Project-Id-Version: Drupal core (7.43)\n"
+"POT-Creation-Date: 2016-02-24 21:00+0000\n"
 "PO-Revision-Date: YYYY-mm-DD HH:MM+ZZZZ\n"
 "Language-Team: French\n"
 "MIME-Version: 1.0\n"
diff --git a/drupal7/profiles/testing/modules/drupal_system_listing_compatible_test/drupal_system_listing_compatible_test.info b/drupal7/profiles/testing/modules/drupal_system_listing_compatible_test/drupal_system_listing_compatible_test.info
index d77cf003..1a6c0083 100644
--- a/drupal7/profiles/testing/modules/drupal_system_listing_compatible_test/drupal_system_listing_compatible_test.info
+++ b/drupal7/profiles/testing/modules/drupal_system_listing_compatible_test/drupal_system_listing_compatible_test.info
@@ -6,8 +6,8 @@ core = 7.x
 hidden = TRUE
 files[] = drupal_system_listing_compatible_test.test
 
-; Information added by Drupal.org packaging script on 2016-02-03
-version = "7.42"
+; Information added by Drupal.org packaging script on 2016-02-24
+version = "7.43"
 project = "drupal"
-datestamp = "1454517955"
+datestamp = "1456343506"
 
diff --git a/drupal7/profiles/testing/modules/drupal_system_listing_incompatible_test/drupal_system_listing_incompatible_test.info b/drupal7/profiles/testing/modules/drupal_system_listing_incompatible_test/drupal_system_listing_incompatible_test.info
index 939bad94..d6353f5d 100644
--- a/drupal7/profiles/testing/modules/drupal_system_listing_incompatible_test/drupal_system_listing_incompatible_test.info
+++ b/drupal7/profiles/testing/modules/drupal_system_listing_incompatible_test/drupal_system_listing_incompatible_test.info
@@ -8,8 +8,8 @@ version = VERSION
 core = 6.x
 hidden = TRUE
 
-; Information added by Drupal.org packaging script on 2016-02-03
-version = "7.42"
+; Information added by Drupal.org packaging script on 2016-02-24
+version = "7.43"
 project = "drupal"
-datestamp = "1454517955"
+datestamp = "1456343506"
 
diff --git a/drupal7/profiles/testing/testing.info b/drupal7/profiles/testing/testing.info
index 622cbcd3..4342ddab 100644
--- a/drupal7/profiles/testing/testing.info
+++ b/drupal7/profiles/testing/testing.info
@@ -4,8 +4,8 @@ version = VERSION
 core = 7.x
 hidden = TRUE
 
-; Information added by Drupal.org packaging script on 2016-02-03
-version = "7.42"
+; Information added by Drupal.org packaging script on 2016-02-24
+version = "7.43"
 project = "drupal"
-datestamp = "1454517955"
+datestamp = "1456343506"
 
diff --git a/drupal7/themes/bartik/bartik.info b/drupal7/themes/bartik/bartik.info
index c677e10c..01533c0d 100644
--- a/drupal7/themes/bartik/bartik.info
+++ b/drupal7/themes/bartik/bartik.info
@@ -34,8 +34,8 @@ regions[footer] = Footer
 settings[shortcut_module_link] = 0
 
 
-; Information added by Drupal.org packaging script on 2016-02-03
-version = "7.42"
+; Information added by Drupal.org packaging script on 2016-02-24
+version = "7.43"
 project = "drupal"
-datestamp = "1454517955"
+datestamp = "1456343506"
 
diff --git a/drupal7/themes/garland/garland.info b/drupal7/themes/garland/garland.info
index 6eb61b47..a4b410a9 100644
--- a/drupal7/themes/garland/garland.info
+++ b/drupal7/themes/garland/garland.info
@@ -7,8 +7,8 @@ stylesheets[all][] = style.css
 stylesheets[print][] = print.css
 settings[garland_width] = fluid
 
-; Information added by Drupal.org packaging script on 2016-02-03
-version = "7.42"
+; Information added by Drupal.org packaging script on 2016-02-24
+version = "7.43"
 project = "drupal"
-datestamp = "1454517955"
+datestamp = "1456343506"
 
diff --git a/drupal7/themes/seven/seven.info b/drupal7/themes/seven/seven.info
index 22bfa80a..3866ed2e 100644
--- a/drupal7/themes/seven/seven.info
+++ b/drupal7/themes/seven/seven.info
@@ -13,8 +13,8 @@ regions[page_bottom] = Page bottom
 regions[sidebar_first] = First sidebar
 regions_hidden[] = sidebar_first
 
-; Information added by Drupal.org packaging script on 2016-02-03
-version = "7.42"
+; Information added by Drupal.org packaging script on 2016-02-24
+version = "7.43"
 project = "drupal"
-datestamp = "1454517955"
+datestamp = "1456343506"
 
diff --git a/drupal7/themes/stark/stark.info b/drupal7/themes/stark/stark.info
index 3a4e44f3..4b2f7db5 100644
--- a/drupal7/themes/stark/stark.info
+++ b/drupal7/themes/stark/stark.info
@@ -5,8 +5,8 @@ version = VERSION
 core = 7.x
 stylesheets[all][] = layout.css
 
-; Information added by Drupal.org packaging script on 2016-02-03
-version = "7.42"
+; Information added by Drupal.org packaging script on 2016-02-24
+version = "7.43"
 project = "drupal"
-datestamp = "1454517955"
+datestamp = "1456343506"
 
