Club Drupal

Drupal 7.27, 2014-04-16

----------------------

- Fixed security issues (information disclosure). See SA-CORE-2014-002.

 *   An array containing the $form, $form_state, $form_id, $form_build_id and an

 *   initial list of Ajax $commands. Use the list() function to break these

 *   apart:

 *     list($form, $form_state, $form_id, $form_build_id, $commands) = ajax_get_form();

  // When a page level cache is enabled, the form-build id might have been

  // replaced from within form_get_cache. If this is the case, it is also

  // necessary to update it in the browser by issuing an appropriate Ajax

  // command.

  $commands = array();

  if (isset($form['#build_id_old']) && $form['#build_id_old'] != $form['#build_id']) {

    // If the form build ID has changed, issue an Ajax command to update it.

    $commands[] = ajax_command_update_build_id($form);

    $form_build_id = $form['#build_id'];

  }

  return array($form, $form_state, $form_id, $form_build_id, $commands);

  list($form, $form_state, $form_id, $form_build_id, $commands) = ajax_get_form();

    $result = $callback($form, $form_state);

    if (!(is_array($result) && isset($result['#type']) && $result['#type'] == 'ajax')) {

      // Turn the response into a #type=ajax array if it isn't one already.

      $result = array(

        '#type' => 'ajax',

        '#commands' => ajax_prepare_response($result),

      );

    }

    $result['#commands'] = array_merge($commands, $result['#commands']);

    return $result;

/**

 * Creates a Drupal Ajax 'update_build_id' command.

 *

 * This command updates the value of a hidden form_build_id input element on a

 * form. It requires the form passed in to have keys for both the old build ID

 * in #build_id_old and the new build ID in #build_id.

 *

 * The primary use case for this Ajax command is to serve a new build ID to a

 * form served from the cache to an anonymous user, preventing one anonymous

 * user from accessing the form state of another anonymous users on Ajax enabled

 * forms.

 *

 * @param $form

 *   The form array representing the form whose build ID should be updated.

 */

function ajax_command_update_build_id($form) {

  return array(

    'command' => 'updateBuildId',

    'old' => $form['#build_id_old'],

    'new' => $form['#build_id'],

  );

}

define('VERSION', '7.27');

 *     - immutable: If this flag is set to TRUE, a new form build id is

 *       generated when the form is loaded from the cache. If it is subsequently

 *       saved to the cache again, it will have another cache id and therefore

 *       the original form and form-state will remain unaltered. This is

 *       important when page caching is enabled in order to prevent form state

 *       from leaking between anonymous users.

  // RIA clients), or if the form already had a new build ID regenerated when it

  // was retrieved from the form cache, reuse the existing #build_id.

  $enforce_old_build_id = isset($old_form['#build_id']) && !empty($form_state['rebuild_info']['copy']['#build_id']);

  $old_form_is_mutable_copy = isset($old_form['#build_id_old']);

  if ($enforce_old_build_id || $old_form_is_mutable_copy) {

    if ($old_form_is_mutable_copy) {

      $form['#build_id_old'] = $old_form['#build_id_old'];

    }

    if (isset($old_form['#build_id'])) {

      $form['#build_id_old'] = $old_form['#build_id'];

    }

      // Generate a new #build_id if the cached form was rendered on a cacheable

      // page.

      if (!empty($form_state['build_info']['immutable'])) {

        $form['#build_id_old'] = $form['#build_id'];

        $form['#build_id'] = 'form-' . drupal_random_key();

        $form['form_build_id']['#value'] = $form['#build_id'];

        $form['form_build_id']['#id'] = $form['#build_id'];

        unset($form_state['build_info']['immutable']);

      }

  // Ensure that the form build_id embedded in the form structure is the same as

  // the one passed in as a parameter. This is an additional safety measure to

  // prevent legacy code operating directly with form_get_cache and

  // form_set_cache from accidentally overwriting immutable form state.

  if ($form['#build_id'] != $form_build_id) {

    watchdog('form', 'Form build-id mismatch detected while attempting to store a form in the cache.', array(), WATCHDOG_ERROR);

    return;

  }

    unset($form['#build_id_old']);

  if (variable_get('cache', 0) && drupal_page_is_cacheable()) {

    $form_state['build_info']['immutable'] = TRUE;

  }

  },

  /**

   * Command to update a form's build ID.

   */

  updateBuildId: function(ajax, response, status) {

    $('input[name="form_build_id"][value="' + response.old + '"]').val(response.new);

; Information added by Drupal.org packaging script on 2014-04-16

version = "7.27"

datestamp = "1397687057"

; Information added by Drupal.org packaging script on 2014-04-16

version = "7.27"

datestamp = "1397687057"

; Information added by Drupal.org packaging script on 2014-04-16

version = "7.27"

datestamp = "1397687057"

; Information added by Drupal.org packaging script on 2014-04-16

version = "7.27"

datestamp = "1397687057"

; Information added by Drupal.org packaging script on 2014-04-16

version = "7.27"

datestamp = "1397687057"

; Information added by Drupal.org packaging script on 2014-04-16

version = "7.27"

datestamp = "1397687057"

; Information added by Drupal.org packaging script on 2014-04-16

version = "7.27"

datestamp = "1397687057"

; Information added by Drupal.org packaging script on 2014-04-16

version = "7.27"

datestamp = "1397687057"

; Information added by Drupal.org packaging script on 2014-04-16

version = "7.27"

datestamp = "1397687057"

; Information added by Drupal.org packaging script on 2014-04-16

version = "7.27"

datestamp = "1397687057"

; Information added by Drupal.org packaging script on 2014-04-16

version = "7.27"

datestamp = "1397687057"

; Information added by Drupal.org packaging script on 2014-04-16

version = "7.27"

datestamp = "1397687057"

; Information added by Drupal.org packaging script on 2014-04-16

version = "7.27"

datestamp = "1397687057"

; Information added by Drupal.org packaging script on 2014-04-16

version = "7.27"

datestamp = "1397687057"

; Information added by Drupal.org packaging script on 2014-04-16

version = "7.27"

datestamp = "1397687057"

; Information added by Drupal.org packaging script on 2014-04-16

version = "7.27"

datestamp = "1397687057"

; Information added by Drupal.org packaging script on 2014-04-16

version = "7.27"

datestamp = "1397687057"

; Information added by Drupal.org packaging script on 2014-04-16

version = "7.27"

datestamp = "1397687057"

; Information added by Drupal.org packaging script on 2014-04-16

version = "7.27"

datestamp = "1397687057"

; Information added by Drupal.org packaging script on 2014-04-16

version = "7.27"

datestamp = "1397687057"

; Information added by Drupal.org packaging script on 2014-04-16

version = "7.27"

datestamp = "1397687057"

; Information added by Drupal.org packaging script on 2014-04-16

version = "7.27"

datestamp = "1397687057"

; Information added by Drupal.org packaging script on 2014-04-16

version = "7.27"

datestamp = "1397687057"

  list($form, $form_state, $form_id, $form_build_id, $commands) = ajax_get_form();

; Information added by Drupal.org packaging script on 2014-04-16

version = "7.27"

datestamp = "1397687057"

; Information added by Drupal.org packaging script on 2014-04-16

version = "7.27"

datestamp = "1397687057"

; Information added by Drupal.org packaging script on 2014-04-16

version = "7.27"

datestamp = "1397687057"

; Information added by Drupal.org packaging script on 2014-04-16

version = "7.27"

datestamp = "1397687057"

; Information added by Drupal.org packaging script on 2014-04-16

version = "7.27"

datestamp = "1397687057"

; Information added by Drupal.org packaging script on 2014-04-16

version = "7.27"

datestamp = "1397687057"

; Information added by Drupal.org packaging script on 2014-04-16

version = "7.27"

datestamp = "1397687057"

; Information added by Drupal.org packaging script on 2014-04-16

version = "7.27"

datestamp = "1397687057"

; Information added by Drupal.org packaging script on 2014-04-16

version = "7.27"

datestamp = "1397687057"

; Information added by Drupal.org packaging script on 2014-04-16

version = "7.27"

datestamp = "1397687057"

; Information added by Drupal.org packaging script on 2014-04-16

version = "7.27"

datestamp = "1397687057"

; Information added by Drupal.org packaging script on 2014-04-16

version = "7.27"

datestamp = "1397687057"

; Information added by Drupal.org packaging script on 2014-04-16

version = "7.27"

datestamp = "1397687057"

; Information added by Drupal.org packaging script on 2014-04-16

version = "7.27"

datestamp = "1397687057"

; Information added by Drupal.org packaging script on 2014-04-16

version = "7.27"

datestamp = "1397687057"

; Information added by Drupal.org packaging script on 2014-04-16

version = "7.27"

datestamp = "1397687057"

; Information added by Drupal.org packaging script on 2014-04-16

version = "7.27"

datestamp = "1397687057"

; Information added by Drupal.org packaging script on 2014-04-16

version = "7.27"

datestamp = "1397687057"

; Information added by Drupal.org packaging script on 2014-04-16

version = "7.27"

datestamp = "1397687057"

; Information added by Drupal.org packaging script on 2014-04-16

version = "7.27"

datestamp = "1397687057"

; Information added by Drupal.org packaging script on 2014-04-16

version = "7.27"

datestamp = "1397687057"

; Information added by Drupal.org packaging script on 2014-04-16

version = "7.27"

datestamp = "1397687057"

; Information added by Drupal.org packaging script on 2014-04-16

version = "7.27"

datestamp = "1397687057"

; Information added by Drupal.org packaging script on 2014-04-16

version = "7.27"

datestamp = "1397687057"

; Information added by Drupal.org packaging script on 2014-04-16

version = "7.27"

datestamp = "1397687057"

; Information added by Drupal.org packaging script on 2014-04-16

version = "7.27"

datestamp = "1397687057"

          case 'updateBuildId':

            $buildId = $xpath->query('//input[@name="form_build_id" and @value="' . $command['old'] . '"]')->item(0);

            if ($buildId) {

              $buildId->setAttribute('value', $command['new']);

            }

            break;

; Information added by Drupal.org packaging script on 2014-04-16

version = "7.27"

datestamp = "1397687057"

; Information added by Drupal.org packaging script on 2014-04-16

version = "7.27"

datestamp = "1397687057"

/**

 * Test Ajax forms when page caching for anonymous users is turned on.

 */

class AJAXFormPageCacheTestCase extends AJAXTestCase {

  protected $profile = 'testing';

  public static function getInfo() {

    return array(

      'name' => 'AJAX forms on cached pages',

      'description' => 'Tests that AJAX forms work properly for anonymous users on cached pages.',

      'group' => 'AJAX',

    );

  }

  public function setUp() {

    parent::setUp();

    variable_set('cache', TRUE);

  }

  /**

   * Return the build id of the current form.

   */

  protected function getFormBuildId() {

    $build_id_fields = $this->xpath('//input[@name="form_build_id"]');

    $this->assertEqual(count($build_id_fields), 1, 'One form build id field on the page');

    return (string) $build_id_fields[0]['value'];

  }

  /**

   * Create a simple form, then POST to system/ajax to change to it.

   */

  public function testSimpleAJAXFormValue() {

    $this->drupalGet('ajax_forms_test_get_form');

    $this->assertEqual($this->drupalGetHeader('X-Drupal-Cache'), 'MISS', 'Page was not cached.');

    $build_id_initial = $this->getFormBuildId();

    $edit = array('select' => 'green');

    $commands = $this->drupalPostAJAX(NULL, $edit, 'select');

    $build_id_first_ajax = $this->getFormBuildId();

    $this->assertNotEqual($build_id_initial, $build_id_first_ajax, 'Build id is changed in the simpletest-DOM on first AJAX submission');

    $expected = array(

      'command' => 'updateBuildId',

      'old' => $build_id_initial,

      'new' => $build_id_first_ajax,

    );

    $this->assertCommand($commands, $expected, 'Build id change command issued on first AJAX submission');

    $edit = array('select' => 'red');

    $commands = $this->drupalPostAJAX(NULL, $edit, 'select');

    $build_id_second_ajax = $this->getFormBuildId();

    $this->assertEqual($build_id_first_ajax, $build_id_second_ajax, 'Build id remains the same on subsequent AJAX submissions');

    // Repeat the test sequence but this time with a page loaded from the cache.

    $this->drupalGet('ajax_forms_test_get_form');

    $this->assertEqual($this->drupalGetHeader('X-Drupal-Cache'), 'HIT', 'Page was cached.');

    $build_id_from_cache_initial = $this->getFormBuildId();

    $this->assertEqual($build_id_initial, $build_id_from_cache_initial, 'Build id is the same as on the first request');

    $edit = array('select' => 'green');

    $commands = $this->drupalPostAJAX(NULL, $edit, 'select');

    $build_id_from_cache_first_ajax = $this->getFormBuildId();

    $this->assertNotEqual($build_id_from_cache_initial, $build_id_from_cache_first_ajax, 'Build id is changed in the simpletest-DOM on first AJAX submission');

    $this->assertNotEqual($build_id_first_ajax, $build_id_from_cache_first_ajax, 'Build id from first user is not reused');

    $expected = array(

      'command' => 'updateBuildId',

      'old' => $build_id_from_cache_initial,

      'new' => $build_id_from_cache_first_ajax,

    );

    $this->assertCommand($commands, $expected, 'Build id change command issued on first AJAX submission');

    $edit = array('select' => 'red');

    $commands = $this->drupalPostAJAX(NULL, $edit, 'select');

    $build_id_from_cache_second_ajax = $this->getFormBuildId();

    $this->assertEqual($build_id_from_cache_first_ajax, $build_id_from_cache_second_ajax, 'Build id remains the same on subsequent AJAX submissions');

  }

}

; Information added by Drupal.org packaging script on 2014-04-16

version = "7.27"

datestamp = "1397687057"

; Information added by Drupal.org packaging script on 2014-04-16

version = "7.27"

datestamp = "1397687057"

; Information added by Drupal.org packaging script on 2014-04-16

version = "7.27"

datestamp = "1397687057"

; Information added by Drupal.org packaging script on 2014-04-16

version = "7.27"

datestamp = "1397687057"

; Information added by Drupal.org packaging script on 2014-04-16

version = "7.27"

datestamp = "1397687057"

; Information added by Drupal.org packaging script on 2014-04-16

version = "7.27"

datestamp = "1397687057"

; Information added by Drupal.org packaging script on 2014-04-16

version = "7.27"

datestamp = "1397687057"

; Information added by Drupal.org packaging script on 2014-04-16

version = "7.27"

datestamp = "1397687057"

; Information added by Drupal.org packaging script on 2014-04-16

version = "7.27"

datestamp = "1397687057"

; Information added by Drupal.org packaging script on 2014-04-16

version = "7.27"

datestamp = "1397687057"

; Information added by Drupal.org packaging script on 2014-04-16

version = "7.27"

datestamp = "1397687057"

; Information added by Drupal.org packaging script on 2014-04-16

version = "7.27"

datestamp = "1397687057"

; Information added by Drupal.org packaging script on 2014-04-16

version = "7.27"

datestamp = "1397687057"

; Information added by Drupal.org packaging script on 2014-04-16

version = "7.27"

datestamp = "1397687057"

; Information added by Drupal.org packaging script on 2014-04-16

version = "7.27"

datestamp = "1397687057"

  /**

   * Verify that the form build-id remains the same when validation errors

   * occur on a mutable form.

   */

  function testMutableForm() {

    // Request the form with 'cache' query parameter to enable form caching.

    $this->drupalGet('form_test/form-storage', array('query' => array('cache' => 1)));

    $buildIdFields = $this->xpath('//input[@name="form_build_id"]');

    $this->assertEqual(count($buildIdFields), 1, 'One form build id field on the page');

    $buildId = (string) $buildIdFields[0]['value'];

    // Trigger validation error by submitting an empty title.

    $edit = array('title' => '');

    $this->drupalPost(NULL, $edit, 'Continue submit');

    // Verify that the build-id did not change.

    $this->assertFieldByName('form_build_id', $buildId, 'Build id remains the same when form validation fails');

  }

  /**

   * Verifies that form build-id is regenerated when loading an immutable form

   * from the cache.

   */

  function testImmutableForm() {

    // Request the form with 'cache' query parameter to enable form caching.

    $this->drupalGet('form_test/form-storage', array('query' => array('cache' => 1, 'immutable' => 1)));

    $buildIdFields = $this->xpath('//input[@name="form_build_id"]');

    $this->assertEqual(count($buildIdFields), 1, 'One form build id field on the page');

    $buildId = (string) $buildIdFields[0]['value'];

    // Trigger validation error by submitting an empty title.

    $edit = array('title' => '');

    $this->drupalPost(NULL, $edit, 'Continue submit');

    // Verify that the build-id did change.

    $this->assertNoFieldByName('form_build_id', $buildId, 'Build id changes when form validation fails');

    // Retrieve the new build-id.

    $buildIdFields = $this->xpath('//input[@name="form_build_id"]');

    $this->assertEqual(count($buildIdFields), 1, 'One form build id field on the page');

    $buildId = (string) $buildIdFields[0]['value'];

    // Trigger validation error by again submitting an empty title.

    $edit = array('title' => '');

    $this->drupalPost(NULL, $edit, 'Continue submit');

    // Verify that the build-id does not change the second time.

    $this->assertFieldByName('form_build_id', $buildId, 'Build id remains the same when form validation fails subsequently');

  }

  /**

   * Verify that existing contrib code cannot overwrite immutable form state.

   */

  public function testImmutableFormLegacyProtection() {

    $this->drupalGet('form_test/form-storage', array('query' => array('cache' => 1, 'immutable' => 1)));

    $build_id_fields = $this->xpath('//input[@name="form_build_id"]');

    $this->assertEqual(count($build_id_fields), 1, 'One form build id field on the page');

    $build_id = (string) $build_id_fields[0]['value'];

    // Try to poison the form cache.

    $original = $this->drupalGetAJAX('form_test/form-storage-legacy/' . $build_id);

    $this->assertEqual($original['form']['#build_id_old'], $build_id, 'Original build_id was recorded');

    $this->assertNotEqual($original['form']['#build_id'], $build_id, 'New build_id was generated');