Issue #2180877 by poker10, ClassicCut, juankvillegas: file_validate_image_resolution() doesn't recalculate the image dimensions after checking $maximum_dimensions

Issue #2345695 by poker10, formatC'vt, frodri, quietone, mgifford, mondrake, thirdender, james.williams: Users are able to upload 0-byte images

Issue #3214047 by poker10, mcdruid: [D7] Add phtml files to the list of potentially malicious extensions

SA-CORE-2023-005 by benjifisher, Heine, cmlara, mlhess, larowlan, David_Rothstein, xjm, Wim Leers, DamienMcKenna, effulgentsia, pwolanin, mcdruid, poker10, jenlampton, longwave, kim.pepper, alexpott, drumm

Issue #2789723 by mcdruid, pcambra: drupal_mkdir does not set permissions on directories it created recursively

SA-CORE-2020-012 by ufku, mrf, fgm, samuel.mortenson, dww, Heine, mlhess, David_Rothstein, pwolanin, xjm, fgm, stefan.r, dsnopek, rickmanelius, David Strauss, tedbow, alexpott, dww, larowlan, kim.pepper, Wim Leers, quicksketch, mcdruid, Fabianx, effulgentsia, drumm, pandaski, Mixologic

Issue #3055805 by mcdruid, greggles, Ayesh, Darren Oh, David_Rothstein, sidharrell, pwolanin, mkalkbrenner, Sweetchuck, YesCT: file.inc generated .htaccess does not cover PHP 7

SA-CORE-2019-002 by greggles, cashwilliams, EclipseGc, larowlan, samuel.mortenson, alexpott, tedbow, effulgentsia, Fabianx, xjm, mlhess

Issue #2482549 by Pol, marcelovani, ndf, drupal@guusvandewal.nl, jenlampton, ufku, kaidjohnson, MiSc, David_Rothstein, RobLoach, SebCorbin, geerlingguy, pablo.guerino, JohnAlbin, joelpittet, afoster: Ignore node_module folder in core to use Drupal with npm/grunt/nodejs

Issue #1815504 by pwolanin, Kevin Hankens, roderik, scor: file_save_upload() should not alter the file URI string before validation

Drupal 7.56 (SA-CORE-2017-003) by alexpott, catch, cilefen, David_Rothstein, dokumori, greggles, iancawthorne, larowlan, mlhess, pwolanin, quicksketch, smaz, stefan.r, xjm

Issue #2853160 by hgoto, smaaz: Variable $name is defined but not used in file_get_content_headers()

Revert "Issue #2853160 by hgoto, RenatoG: Variable $name is defined but not used in file_get_content_headers()"

This reverts commit f72778cf.

Issue #2853160 by hgoto, RenatoG: Variable $name is defined but not used in file_get_content_headers()

Issue #1599774 by longwave, ben.bunk, Rob C, stefan.r, David_Rothstein, BTMash, kristofferwiklund, marcingy, mpdonadio, DuneBL, serundeputy, Letharion, quicksketch, alexpott, J-Lee, Morbus Iff: Drupal fails to boot with 503 error and .htaccess protections do not work on Apache 2.4 without mod_access_compat

Issue #1443342 by joseph.olstad, mikeytown2, LauraRocks, xjm, stefan.r, joelpittet, brianV, effulgentsia, Fabianx, Mac_Weber: Inline file_uri_scheme() in file_stream_wrapper_uri_normalize() and other file.inc functions

Issue #2112247 by sihv, mitsuroseba, dgroene, aalamaki, Dennis Walgaard, mErilainen: Fixed Valid file extensions in file names are not properly enforced when uploading files with non-lowercase names.

Issue #1468210 by marthinal, quicksketch, tstoeckler, Devin Carlson, David_Rothstein, Eric_A: Fixed Remove special $user->uid == 1 check in file_validate_size().

Issue #1984378 by Jaypan, JacobSanford, aroq | Dave Hirschman: $source argument is name of form field used to upload file, not "filepath or URI of the uploaded file."

Issue #692366 by  mariacha1, hosef, Albert Volkman, xjm, underq, kid_icarus, willmoy, bradweikel: Replace US-centric php.net URLs with language-neutral URLs

Issue #1201024 by pillarsdotnet, jbrown, tim.plunkett | Damien Tournoud: drupal_realpath() should describe when it should be used.

Issue #1049050 by mfb, TwoD, David_Rothstein, jpsoto: Removed dead code in file_stream_wrapper_uri_normalize().

Issue #1229014 by bfroehle, jackbravo, illmasterc: Fixed Content-Disposition header makes private files show open/save prompts, but public files show inline.

Issue #1815930 by slashrsm, gbrands, amontero: Fixed Update watchdog message in file_unmanaged_copy() with correct string/variable replacement values.

Issue #1874342 by erikwebb: Fixed Undefined constant STEAM_WRAPPERS_LOCAL used in file_get_stream_wrappers() documentation.

Issue #1773032 by Jorrit: Fixed Non-standard and pointless name attribute added to Content-Type header.