56e257d5 · 2a4f67cd · 355446db · 2e235b51 · 766312e2 · 010a9a54
--- a/.editorconfig
+++ b/.editorconfig
+# Drupal editor configuration normalization
+# @see http://editorconfig.org/
+# This is the top-most .editorconfig file; do not search in parent directories.
+root = true
+# All files.
+[*]
+end_of_line = LF
+indent_style = space
+indent_size = 2
+charset = utf-8
+trim_trailing_whitespace = true
+insert_final_newline = true
--- a/.htaccess
+++ b/.htaccess
@@ -3,7 +3,7 @@
 #
 # Protect files and directories from prying eyes.
-<FilesMatch "\.(engine|inc|info|install|make|module|profile|test|po|sh|.*sql|theme|tpl(\.php)?|xtmpl)(~|\.sw[op]|\.bak|\.orig|\.save)?$|^(\..*|Entries.*|Repository|Root|Tag|Template)$|^#.*#$|\.php(~|\.sw[op]|\.bak|\.orig\.save)$">
+<FilesMatch "\.(engine|inc|info|install|make|module|profile|test|po|sh|.*sql|theme|tpl(\.php)?|xtmpl)(~|\.sw[op]|\.bak|\.orig|\.save)?$|^(\..*|Entries.*|Repository|Root|Tag|Template|composer\.(json|lock))$|^#.*#$|\.php(~|\.sw[op]|\.bak|\.orig\.save)$">
  Order allow,deny
 </FilesMatch>
@@ -141,3 +141,9 @@ DirectoryIndex index.php index.html index.htm
    </FilesMatch>
  </IfModule>
 </IfModule>
+# Add headers to all responses.
+<IfModule mod_headers.c>
+  # Disable content sniffing, since it's an attack vector.
+  Header always set X-Content-Type-Options nosniff
+</IfModule>
--- a/CHANGELOG.txt
+++ b/CHANGELOG.txt
--- a/INSTALL.txt
+++ b/INSTALL.txt
@@ -23,7 +23,7 @@ Drupal requires:
  - Percona Server 5.1.70 (or greater) (http://www.percona.com/). Percona
    Server is a backwards-compatible replacement for MySQL.
  - PostgreSQL 8.3 (or greater) (http://www.postgresql.org/).
-  - SQLite 3.4.2 (or greater) (http://www.sqlite.org/).
+  - SQLite 3.3.7 (or greater) (http://www.sqlite.org/).
 For more detailed information about Drupal requirements, including a list of
 PHP extensions and configurations that are required, see "System requirements"

--- a/MAINTAINERS.txt
+++ b/MAINTAINERS.txt
 Drupal core is built and maintained by the Drupal project community. Everyone is
 encouraged to submit issues and changes (patches) to improve Drupal, and to
-contribute in other ways -- see http://drupal.org/contribute to find out how.
+contribute in other ways -- see https://www.drupal.org/contribute to find out
+how.
 Branch maintainers
 ------------------
@@ -9,160 +10,154 @@ Branch maintainers
 The Drupal Core branch maintainers oversee the development of Drupal as a whole.
 The branch maintainers for Drupal 7 are:
- Dries Buytaert 'dries' http://drupal.org/user/1
+- Dries Buytaert 'dries' https://www.drupal.org/u/dries
- Angela Byron 'webchick' http://drupal.org/user/24967
+- Angela Byron 'webchick' https://www.drupal.org/u/webchick
- David Rothstein 'David_Rothstein' http://drupal.org/user/124982
+- Fabian Franz 'Fabianx' https://www.drupal.org/u/fabianx
+- David Rothstein 'David_Rothstein' https://www.drupal.org/u/david_rothstein
+- Stefan Ruijsenaars 'stefan.r' https://www.drupal.org/u/stefanr-0
 Component maintainers
 ---------------------
 The Drupal Core component maintainers oversee the development of Drupal
-subsystems. See http://drupal.org/contribute/core-maintainers for more
+subsystems. See https://www.drupal.org/contribute/core-maintainers for more
 information on their responsibilities, and to find out how to become a component
 maintainer. Current component maintainers for Drupal 7:
 Ajax system
- Alex Bronstein 'effulgentsia' http://drupal.org/user/78040
+- Alex Bronstein 'effulgentsia' https://www.drupal.org/u/effulgentsia
- Earl Miles 'merlinofchaos' http://drupal.org/user/26979
+- Earl Miles 'merlinofchaos' https://www.drupal.org/u/merlinofchaos
 Base system
- Károly Négyesi 'chx' http://drupal.org/user/9446
+- Damien Tournoud 'DamZ' https://www.drupal.org/u/damien-tournoud
- Damien Tournoud 'DamZ' http://drupal.org/user/22211
+- Moshe Weitzman 'moshe weitzman' https://www.drupal.org/u/moshe-weitzman
- Moshe Weitzman 'moshe weitzman' http://drupal.org/user/23
 Batch system
- Yves Chedemois 'yched' http://drupal.org/user/39567
+- Yves Chedemois 'yched' https://www.drupal.org/u/yched
 Cache system
- Damien Tournoud 'DamZ' http://drupal.org/user/22211
+- Damien Tournoud 'DamZ' https://www.drupal.org/u/damien-tournoud
- Nathaniel Catchpole 'catch' http://drupal.org/user/35733
+- Nathaniel Catchpole 'catch' https://www.drupal.org/u/catch
 Cron system
- Károly Négyesi 'chx' http://drupal.org/user/9446
+- Derek Wright 'dww' https://www.drupal.org/u/dww
- Derek Wright 'dww' http://drupal.org/user/46549
 Database system
- Larry Garfield 'Crell' http://drupal.org/user/26398
+- Larry Garfield 'Crell' https://www.drupal.org/u/crell
  - MySQL driver
-    - Larry Garfield 'Crell' http://drupal.org/user/26398
+    - Larry Garfield 'Crell' https://www.drupal.org/u/crell
-    - David Strauss 'David Strauss' http://drupal.org/user/93254
+    - David Strauss 'David Strauss' https://www.drupal.org/u/david-strauss
  - PostgreSQL driver
-    - Damien Tournoud 'DamZ' http://drupal.org/user/22211
+    - Damien Tournoud 'DamZ' https://www.drupal.org/u/damien-tournoud
-    - Josh Waihi 'fiasco' http://drupal.org/user/188162
+    - Josh Waihi 'fiasco' https://www.drupal.org/u/josh-waihi
  - Sqlite driver
-    - Damien Tournoud 'DamZ' http://drupal.org/user/22211
+    - Damien Tournoud 'DamZ' https://www.drupal.org/u/damien-tournoud
-    - Károly Négyesi 'chx' http://drupal.org/user/9446
 Database update system
- Károly Négyesi 'chx' http://drupal.org/user/9446
+- Ashok Modi 'BTMash' https://www.drupal.org/u/btmash
- Ashok Modi 'BTMash' http://drupal.org/user/60422
 Entity system
- Wolfgang Ziegler 'fago' http://drupal.org/user/16747
+- Wolfgang Ziegler 'fago' https://www.drupal.org/u/fago
- Nathaniel Catchpole 'catch' http://drupal.org/user/35733
+- Nathaniel Catchpole 'catch' https://www.drupal.org/u/catch
- Franz Heinzmann 'Frando' http://drupal.org/user/21850
+- Franz Heinzmann 'Frando' https://www.drupal.org/u/frando
 File system
- Andrew Morton 'drewish' http://drupal.org/user/34869
+- Andrew Morton 'drewish' https://www.drupal.org/u/drewish
- Aaron Winborn 'aaron' http://drupal.org/user/33420
+- Aaron Winborn 'aaron' https://www.drupal.org/u/aaron
 Form system
- Károly Négyesi 'chx' http://drupal.org/user/9446
+- Alex Bronstein 'effulgentsia' https://www.drupal.org/u/effulgentsia
- Alex Bronstein 'effulgentsia' http://drupal.org/user/78040
+- Wolfgang Ziegler 'fago' https://www.drupal.org/u/fago
- Wolfgang Ziegler 'fago' http://drupal.org/user/16747
+- Daniel F. Kudwien 'sun' https://www.drupal.org/u/sun
- Daniel F. Kudwien 'sun' http://drupal.org/user/54136
+- Franz Heinzmann 'Frando' https://www.drupal.org/u/frando
- Franz Heinzmann 'Frando' http://drupal.org/user/21850
 Image system
- Andrew Morton 'drewish' http://drupal.org/user/34869
+- Andrew Morton 'drewish' https://www.drupal.org/u/drewish
- Nathan Haug 'quicksketch' http://drupal.org/user/35821
+- Nathan Haug 'quicksketch' https://www.drupal.org/u/quicksketch
 Install system
- David Rothstein 'David_Rothstein' http://drupal.org/user/124982
+- David Rothstein 'David_Rothstein' https://www.drupal.org/u/david_rothstein
 JavaScript
- Théodore Biadala 'nod_' http://drupal.org/user/598310
+- Théodore Biadala 'nod_' https://www.drupal.org/u/nod_
- Steve De Jonghe 'seutje' http://drupal.org/user/264148
+- Steve De Jonghe 'seutje' https://www.drupal.org/u/seutje
- Jesse Renée Beach 'jessebeach' http://drupal.org/user/748566
 Language system
- Francesco Placella 'plach' http://drupal.org/user/183211
+- Francesco Placella 'plach' https://www.drupal.org/u/plach
- Daniel F. Kudwien 'sun' http://drupal.org/user/54136
+- Daniel F. Kudwien 'sun' https://www.drupal.org/u/sun
 Lock system
- Damien Tournoud 'DamZ' http://drupal.org/user/22211
+- Damien Tournoud 'DamZ' https://www.drupal.org/u/damien-tournoud
 Mail system
 - ?
 Markup
- Jacine Luisi 'Jacine' http://drupal.org/user/88931
+- Jacine Luisi 'Jacine' https://www.drupal.org/u/jacine
- Daniel F. Kudwien 'sun' http://drupal.org/user/54136
+- Daniel F. Kudwien 'sun' https://www.drupal.org/u/sun
 Menu system
- Peter Wolanin 'pwolanin' http://drupal.org/user/49851
+- Peter Wolanin 'pwolanin' https://www.drupal.org/u/pwolanin
- Károly Négyesi 'chx' http://drupal.org/user/9446
 Path system
- Dave Reid 'davereid' http://drupal.org/user/53892
+- Dave Reid 'davereid' https://www.drupal.org/u/dave-reid
- Nathaniel Catchpole 'catch' http://drupal.org/user/35733
+- Nathaniel Catchpole 'catch' https://www.drupal.org/u/catch
 Render system
- Moshe Weitzman 'moshe weitzman' http://drupal.org/user/23
+- Moshe Weitzman 'moshe weitzman' https://www.drupal.org/u/moshe-weitzman
- Alex Bronstein 'effulgentsia' http://drupal.org/user/78040
+- Alex Bronstein 'effulgentsia' https://www.drupal.org/u/effulgentsia
- Franz Heinzmann 'Frando' http://drupal.org/user/21850
+- Franz Heinzmann 'Frando' https://www.drupal.org/u/frando
 Theme system
- Earl Miles 'merlinofchaos' http://drupal.org/user/26979
+- Earl Miles 'merlinofchaos' https://www.drupal.org/u/merlinofchaos
- Alex Bronstein 'effulgentsia' http://drupal.org/user/78040
+- Alex Bronstein 'effulgentsia' https://www.drupal.org/u/effulgentsia
- Joon Park 'dvessel' http://drupal.org/user/56782
+- Joon Park 'dvessel' https://www.drupal.org/u/dvessel
- John Albin Wilkins 'JohnAlbin' http://drupal.org/user/32095
+- John Albin Wilkins 'JohnAlbin' https://www.drupal.org/u/johnalbin
 Token system
- Dave Reid 'davereid' http://drupal.org/user/53892
+- Dave Reid 'davereid' https://www.drupal.org/u/dave-reid
 XML-RPC system
- Frederic G. Marand 'fgm' http://drupal.org/user/27985
+- Frederic G. Marand 'fgm' https://www.drupal.org/u/fgm
 Topic coordinators
 ------------------
 Accessibility
- Everett Zufelt 'Everett Zufelt' http://drupal.org/user/406552
+- Everett Zufelt 'Everett Zufelt' https://www.drupal.org/u/everett-zufelt
- Brandon Bowersox-Johnson 'bowersox' http://drupal.org/user/186415
+- Brandon Bowersox-Johnson 'bowersox' https://www.drupal.org/u/bowersox
 Documentation
- Jennifer Hodgdon 'jhodgdon' http://drupal.org/user/155601
+- Jennifer Hodgdon 'jhodgdon' https://www.drupal.org/u/jhodgdon
 Translations
- Gerhard Killesreiter 'killes' http://drupal.org/user/83
+- Gerhard Killesreiter 'killes' https://www.drupal.org/u/gerhard-killesreiter
 User experience and usability
- Roy Scholten 'yoroy' http://drupal.org/user/41502
+- Roy Scholten 'yoroy' https://www.drupal.org/u/yoroy
- Bojhan Somers 'Bojhan' http://drupal.org/user/87969
+- Bojhan Somers 'Bojhan' https://www.drupal.org/u/bojhan
 Node Access
- Moshe Weitzman 'moshe weitzman' http://drupal.org/user/23
+- Moshe Weitzman 'moshe weitzman' https://www.drupal.org/u/moshe-weitzman
- Ken Rickard 'agentrickard' http://drupal.org/user/20975
+- Ken Rickard 'agentrickard' https://www.drupal.org/u/agentrickard
- Jess Myrbo 'xjm' http://drupal.org/user/65776
 Security team
 -----------------
-To report a security issue, see: https://drupal.org/security-team/report-issue
+To report a security issue, see: https://www.drupal.org/security-team/report-issue
 The Drupal security team provides Security Advisories for vulnerabilities,
 assists developers in resolving security issues, and provides security
-documentation. See http://drupal.org/security-team for more information. The
+documentation. See https://www.drupal.org/security-team for more information.
-security team lead is:
+The security team lead is:
- Michael Hess 'mlhess' https://drupal.org/user/102818
+- Michael Hess 'mlhess' https://www.drupal.org/u/mlhess
 Module maintainers
@@ -172,143 +167,141 @@ Aggregator module
 - ?
 Block module
- John Albin Wilkins 'JohnAlbin' http://drupal.org/user/32095
+- John Albin Wilkins 'JohnAlbin' https://www.drupal.org/u/johnalbin
 Blog module
 - ?
 Book module
- Peter Wolanin 'pwolanin' http://drupal.org/user/49851
+- Peter Wolanin 'pwolanin' https://www.drupal.org/u/pwolanin
 Color module
 - ?
 Comment module
- Nathaniel Catchpole 'catch' http://drupal.org/user/35733
+- Nathaniel Catchpole 'catch' https://www.drupal.org/u/catch
 Contact module
- Dave Reid 'davereid' http://drupal.org/user/53892
+- Dave Reid 'davereid' https://www.drupal.org/u/dave-reid
 Contextual module
- Daniel F. Kudwien 'sun' http://drupal.org/user/54136
+- Daniel F. Kudwien 'sun' https://www.drupal.org/u/sun
 Dashboard module
 - ?
 Database logging module
- Khalid Baheyeldin 'kbahey' http://drupal.org/user/4063
+- Khalid Baheyeldin 'kbahey' https://www.drupal.org/u/kbahey
 Field module
- Yves Chedemois 'yched' http://drupal.org/user/39567
+- Yves Chedemois 'yched' https://www.drupal.org/u/yched
- Barry Jaspan 'bjaspan' http://drupal.org/user/46413
+- Barry Jaspan 'bjaspan' https://www.drupal.org/u/bjaspan
 Field UI module
- Yves Chedemois 'yched' http://drupal.org/user/39567
+- Yves Chedemois 'yched' https://www.drupal.org/u/yched
 File module
- Aaron Winborn 'aaron' http://drupal.org/user/33420
+- Aaron Winborn 'aaron' https://www.drupal.org/u/aaron
 Filter module
- Daniel F. Kudwien 'sun' http://drupal.org/user/54136
+- Daniel F. Kudwien 'sun' https://www.drupal.org/u/sun
 Forum module
- Lee Rowlands 'larowlan' http://drupal.org/user/395439
+- Lee Rowlands 'larowlan' https://www.drupal.org/u/larowlan
 Help module
 - ?
 Image module
- Nathan Haug 'quicksketch' http://drupal.org/user/35821
+- Nathan Haug 'quicksketch' https://www.drupal.org/u/quicksketch
 Locale module
- Gábor Hojtsy 'Gábor Hojtsy' http://drupal.org/user/4166
+- Gábor Hojtsy 'Gábor Hojtsy' https://www.drupal.org/u/gábor-hojtsy
 Menu module
 - ?
 Node module
- Moshe Weitzman 'moshe weitzman' http://drupal.org/user/23
+- Moshe Weitzman 'moshe weitzman' https://www.drupal.org/u/moshe-weitzman
- David Strauss 'David Strauss' http://drupal.org/user/93254
+- David Strauss 'David Strauss' https://www.drupal.org/u/david-strauss
 OpenID module
- Vojtech Kusy 'wojtha' http://drupal.org/user/56154
+- Vojtech Kusy 'wojtha' https://www.drupal.org/u/wojtha
- Christian Schmidt 'c960657' http://drupal.org/user/216078
+- Christian Schmidt 'c960657' https://www.drupal.org/u/c960657
- Damien Tournoud 'DamZ' http://drupal.org/user/22211
+- Damien Tournoud 'DamZ' https://www.drupal.org/u/damien-tournoud
 Overlay module
- Katherine Senzee 'ksenzee' http://drupal.org/user/139855
+- Katherine Senzee 'ksenzee' https://www.drupal.org/u/ksenzee
 Path module
- Dave Reid 'davereid' http://drupal.org/user/53892
+- Dave Reid 'davereid' https://www.drupal.org/u/dave-reid
 PHP module
 - ?
 Poll module
- Andrei Mateescu 'amateescu' http://drupal.org/user/729614
+- Andrei Mateescu 'amateescu' https://www.drupal.org/u/amateescu
 Profile module
 - ?
 RDF module
- Stéphane Corlosquet 'scor' http://drupal.org/user/52142
+- Stéphane Corlosquet 'scor' https://www.drupal.org/u/scor
 Search module
- Doug Green 'douggreen' http://drupal.org/user/29191
+- Doug Green 'douggreen' https://www.drupal.org/u/douggreen
 Shortcut module
- David Rothstein 'David_Rothstein' http://drupal.org/user/124982
+- David Rothstein 'David_Rothstein' https://www.drupal.org/u/david_rothstein
 Simpletest module
- Jimmy Berry 'boombatower' http://drupal.org/user/214218
+- Jimmy Berry 'boombatower' https://www.drupal.org/u/boombatower
- Károly Négyesi 'chx' http://drupal.org/user/9446
 Statistics module
- Tim Millwood 'timmillwood' http://drupal.org/user/227849
+- Tim Millwood 'timmillwood' https://www.drupal.org/u/timmillwood
 Syslog module
- Khalid Baheyeldin 'kbahey' http://drupal.org/user/4063
+- Khalid Baheyeldin 'kbahey' https://www.drupal.org/u/kbahey
 System module
 - ?
 Taxonomy module
- Jess Myrbo 'xjm' http://drupal.org/user/65776
+- Nathaniel Catchpole 'catch' https://www.drupal.org/u/catch
- Nathaniel Catchpole 'catch' http://drupal.org/user/35733
+- Benjamin Doherty 'bangpound' https://www.drupal.org/u/bangpound
- Benjamin Doherty 'bangpound' http://drupal.org/user/100456
 Toolbar module
 - ?
 Tracker module
- David Strauss 'David Strauss' http://drupal.org/user/93254
+- David Strauss 'David Strauss' https://www.drupal.org/u/david-strauss
 Translation module
- Francesco Placella 'plach' http://drupal.org/user/183211
+- Francesco Placella 'plach' https://www.drupal.org/u/plach
 Trigger module
 - ?
 Update module
- Derek Wright 'dww' http://drupal.org/user/46549
+- Derek Wright 'dww' https://www.drupal.org/u/dww
 User module
- Moshe Weitzman 'moshe weitzman' http://drupal.org/user/23
+- Moshe Weitzman 'moshe weitzman' https://www.drupal.org/u/moshe-weitzman
- David Strauss 'David Strauss' http://drupal.org/user/93254
+- David Strauss 'David Strauss' https://www.drupal.org/u/david-strauss
 Theme maintainers
 -----------------
 Bartik theme
- Jen Simmons 'jensimmons' http://drupal.org/user/140882
+- Jen Simmons 'jensimmons' https://www.drupal.org/u/jensimmons
- Jeff Burns 'Jeff Burnz' http://drupal.org/user/61393
+- Jeff Burns 'Jeff Burnz' https://www.drupal.org/u/jeff-burnz
 Garland theme
- John Albin Wilkins 'JohnAlbin' http://drupal.org/user/32095
+- John Albin Wilkins 'JohnAlbin' https://www.drupal.org/u/johnalbin
 Seven theme
- Jeff Burns 'Jeff Burnz' http://drupal.org/user/61393
+- Jeff Burns 'Jeff Burnz' https://www.drupal.org/u/jeff-burnz
 Stark theme
- John Albin Wilkins 'JohnAlbin' http://drupal.org/user/32095
+- John Albin Wilkins 'JohnAlbin' https://www.drupal.org/u/johnalbin
--- a/UPGRADE.txt
+++ b/UPGRADE.txt
@@ -64,6 +64,9 @@ following the instructions in the INTRODUCTION section at the top of this file:
   Sometimes an update includes changes to default.settings.php (this will be
   noted in the release notes). If that's the case, follow these steps:
+   - Locate your settings.php file in the /sites/* directory. (Typically
+     sites/default.)
   - Make a backup copy of your settings.php file, with a different file name.
   - Make a copy of the new default.settings.php file, and name the copy
@@ -74,6 +77,13 @@ following the instructions in the INTRODUCTION section at the top of this file:
     database information, and you will also want to copy in any other
     customizations you have added.
+   You can find the release notes for your version at
+   https://www.drupal.org/project/drupal. At bottom of the project page under
+   "Downloads" use the link for your version of Drupal to view the release
+   notes. If your version is not listed, use the 'View all releases' link. From
+   this page you can scroll down or use the filter to find your version and its
+   release notes.
 4. Download the latest Drupal 7.x release from http://drupal.org to a
   directory outside of your web root. Extract the archive and copy the files
   into your Drupal directory.

--- a/includes/ajax.inc
+++ b/includes/ajax.inc
@@ -211,7 +211,7 @@
 *
 * When returning an Ajax command array, it is often useful to have
 * status messages rendered along with other tasks in the command array.
- * In that case the the Ajax commands array may be constructed like this:
+ * In that case the Ajax commands array may be constructed like this:
 * @code
 *   $commands = array();
 *   $commands[] = ajax_command_replace(NULL, $output);
@@ -230,6 +230,10 @@
 *   functions.
 */
 function ajax_render($commands = array()) {
+  // Although ajax_deliver() does this, some contributed and custom modules
+  // render Ajax responses without using that delivery callback.
+  ajax_set_verification_header();
  // Ajax responses aren't rendered with html.tpl.php, so we have to call
  // drupal_get_css() and drupal_get_js() here, in order to have new files added
  // during this request to be loaded by the page. We only want to send back
@@ -276,7 +280,7 @@ function ajax_render($commands = array()) {
  $extra_commands = array();
  if (!empty($styles)) {
-    $extra_commands[] = ajax_command_prepend('head', $styles);
+    $extra_commands[] = ajax_command_add_css($styles);
  }
  if (!empty($scripts_header)) {
    $extra_commands[] = ajax_command_prepend('head', $scripts_header);
@@ -390,7 +394,7 @@ function ajax_form_callback() {
  if (!empty($form_state['triggering_element'])) {
    $callback = $form_state['triggering_element']['#ajax']['callback'];
  }
-  if (!empty($callback) && function_exists($callback)) {
+  if (!empty($callback) && is_callable($callback)) {
    $result = $callback($form, $form_state);
    if (!(is_array($result) && isset($result['#type']) && $result['#type'] == 'ajax')) {
@@ -487,6 +491,9 @@ function ajax_deliver($page_callback_result) {
    }
  }
+  // Let ajax.js know that this response is safe to process.
+  ajax_set_verification_header();
  // Print the response.
  $commands = ajax_prepare_response($page_callback_result);
  $json = ajax_render($commands);
@@ -576,6 +583,29 @@ function ajax_prepare_response($page_callback_result) {
  return $commands;
 }
+/**
+ * Sets a response header for ajax.js to trust the response body.
+ *
+ * It is not safe to invoke Ajax commands within user-uploaded files, so this
+ * header protects against those being invoked.
+ *
+ * @see Drupal.ajax.options.success()
+ */
+function ajax_set_verification_header() {
+  $added = &drupal_static(__FUNCTION__);
+  // User-uploaded files cannot set any response headers, so a custom header is
+  // used to indicate to ajax.js that this response is safe. Note that most
+  // Ajax requests bound using the Form API will be protected by having the URL
+  // flagged as trusted in Drupal.settings, so this header is used only for
+  // things like custom markup that gets Ajax behaviors attached.
+  if (empty($added)) {
+    drupal_add_http_header('X-Drupal-Ajax-Token', '1');
+    // Avoid sending the header twice.
+    $added = TRUE;
+  }
+}
 /**
 * Performs end-of-Ajax-request tasks.
 *
@@ -764,7 +794,12 @@ function ajax_pre_render_element($element) {
    $element['#attached']['js'][] = array(
      'type' => 'setting',
-      'data' => array('ajax' => array($element['#id'] => $settings)),
+      'data' => array(
+        'ajax' => array($element['#id'] => $settings),
+        'urlIsAjaxTrusted' => array(
+          $settings['url'] => TRUE,
+        ),
+      ),
    );
    // Indicate that Ajax processing was successful.
@@ -1257,3 +1292,26 @@ function ajax_command_update_build_id($form) {
    'new' => $form['#build_id'],
  );
 }
+/**
+ * Creates a Drupal Ajax 'add_css' command.
+ *
+ * This method will add css via ajax in a cross-browser compatible way.
+ *
+ * This command is implemented by Drupal.ajax.prototype.commands.add_css()
+ * defined in misc/ajax.js.
+ *
+ * @param $styles
+ *   A string that contains the styles to be added.
+ *
+ * @return
+ *   An array suitable for use with the ajax_render() function.
+ *
+ * @see misc/ajax.js
+ */
+function ajax_command_add_css($styles) {
+  return array(
+    'command' => 'add_css',
+    'data' => $styles,
+  );
+}
--- a/includes/batch.inc
+++ b/includes/batch.inc
@@ -460,10 +460,10 @@ function _batch_finished() {
      if (isset($batch_set['file']) && is_file($batch_set['file'])) {
        include_once DRUPAL_ROOT . '/' . $batch_set['file'];
      }
-      if (function_exists($batch_set['finished'])) {
+      if (is_callable($batch_set['finished'])) {
        $queue = _batch_queue($batch_set);
        $operations = $queue->getAllItems();
-        $batch_set['finished']($batch_set['success'], $batch_set['results'], $operations, format_interval($batch_set['elapsed'] / 1000));
+        call_user_func($batch_set['finished'], $batch_set['success'], $batch_set['results'], $operations, format_interval($batch_set['elapsed'] / 1000));
      }
    }
  }

--- a/includes/bootstrap.inc
+++ b/includes/bootstrap.inc
--- a/includes/cache.inc
+++ b/includes/cache.inc
@@ -14,6 +14,7 @@
 *
 * @param $bin
 *   The cache bin for which the cache object should be returned.
+ *
 * @return DrupalCacheInterface
 *   The cache object associated with the specified bin.
 *

--- a/includes/common.inc
+++ b/includes/common.inc
--- a/includes/database/database.inc
+++ b/includes/database/database.inc
@@ -296,6 +296,20 @@ abstract class DatabaseConnection extends PDO {
   */
  protected $prefixReplace = array();
+  /**
+   * List of escaped database, table, and field names, keyed by unescaped names.
+   *
+   * @var array
+   */
+  protected $escapedNames = array();
+  /**
+   * List of escaped aliases names, keyed by unescaped aliases.
+   *
+   * @var array
+   */
+  protected $escapedAliases = array();
  function __construct($dsn, $username, $password, $driver_options = array()) {
    // Initialize and prepare the connection prefix.
    $this->setPrefix(isset($this->connectionOptions['prefix']) ? $this->connectionOptions['prefix'] : '');
@@ -626,7 +640,7 @@ public function makeComment($comments) {
   *   A sanitized version of the query comment string.
   */
  protected function filterComment($comment = '') {
-    return preg_replace('/(\/\*\s*)|(\s*\*\/)/', '', $comment);
+    return strtr($comment, array('*' => ' * '));
  }
  /**
@@ -656,7 +670,7 @@ protected function filterComment($comment = '') {
   * @return DatabaseStatementInterface
   *   This method will return one of: the executed statement, the number of
   *   rows affected by the query (not the number matched), or the generated
-   *   insert IT of the last query, depending on the value of
+   *   insert ID of the last query, depending on the value of
   *   $options['return']. Typically that value will be set by default or a
   *   query builder and should not be set by a user. If there is an error,
   *   this method will return NULL and may throw an exception if
@@ -919,11 +933,14 @@ public function schema() {
   * For some database drivers, it may also wrap the table name in
   * database-specific escape characters.
   *
-   * @return
+   * @return string
   *   The sanitized table name string.
   */
  public function escapeTable($table) {
-    return preg_replace('/[^A-Za-z0-9_.]+/', '', $table);
+    if (!isset($this->escapedNames[$table])) {
+      $this->escapedNames[$table] = preg_replace('/[^A-Za-z0-9_.]+/', '', $table);
+    }
+    return $this->escapedNames[$table];
  }
  /**
@@ -933,11 +950,14 @@ public function escapeTable($table) {
   * For some database drivers, it may also wrap the field name in
   * database-specific escape characters.
   *
-   * @return
+   * @return string
   *   The sanitized field name string.
   */
  public function escapeField($field) {
-    return preg_replace('/[^A-Za-z0-9_.]+/', '', $field);
+    if (!isset($this->escapedNames[$field])) {
+      $this->escapedNames[$field] = preg_replace('/[^A-Za-z0-9_.]+/', '', $field);
+    }
+    return $this->escapedNames[$field];
  }
  /**
@@ -948,11 +968,14 @@ public function escapeField($field) {
   * DatabaseConnection::escapeTable(), this doesn't allow the period (".")
   * because that is not allowed in aliases.
   *
-   * @return
+   * @return string
   *   The sanitized field name string.
   */
  public function escapeAlias($field) {
-    return preg_replace('/[^A-Za-z0-9_]+/', '', $field);
+    if (!isset($this->escapedAliases[$field])) {
+      $this->escapedAliases[$field] = preg_replace('/[^A-Za-z0-9_]+/', '', $field);
+    }
+    return $this->escapedAliases[$field];
  }
  /**
@@ -1313,6 +1336,39 @@ public function commit() {
   *   also larger than the $existing_id if one was passed in.
   */
  abstract public function nextId($existing_id = 0);
+  /**
+   * Checks whether utf8mb4 support is configurable in settings.php.
+   *
+   * @return bool
+   */
+  public function utf8mb4IsConfigurable() {
+    // Since 4 byte UTF-8 is not supported by default, there is nothing to
+    // configure.
+    return FALSE;
+  }
+  /**
+   * Checks whether utf8mb4 support is currently active.
+   *
+   * @return bool
+   */
+  public function utf8mb4IsActive() {
+    // Since 4 byte UTF-8 is not supported by default, there is nothing to
+    // activate.
+    return FALSE;
+  }
+  /**
+   * Checks whether utf8mb4 support is available on the current database system.
+   *
+   * @return bool
+   */
+  public function utf8mb4IsSupported() {
+    // By default we assume that the database backend may not support 4 byte
+    // UTF-8.
+    return FALSE;
+  }
 }
 /**

--- a/includes/database/mysql/database.inc
+++ b/includes/database/mysql/database.inc
@@ -28,6 +28,12 @@ public function __construct(array $connection_options = array()) {
    $this->connectionOptions = $connection_options;
+    $charset = 'utf8';
+    // Check if the charset is overridden to utf8mb4 in settings.php.
+    if ($this->utf8mb4IsActive()) {
+      $charset = 'utf8mb4';
+    }
    // The DSN should use either a socket or a host/port.
    if (isset($connection_options['unix_socket'])) {
      $dsn = 'mysql:unix_socket=' . $connection_options['unix_socket'];
@@ -36,6 +42,10 @@ public function __construct(array $connection_options = array()) {
      // Default to TCP connection on port 3306.
      $dsn = 'mysql:host=' . $connection_options['host'] . ';port=' . (empty($connection_options['port']) ? 3306 : $connection_options['port']);
    }
+    // Character set is added to dsn to ensure PDO uses the proper character
+    // set when escaping. This has security implications. See
+    // https://www.drupal.org/node/1201452 for further discussion.
+    $dsn .= ';charset=' . $charset;
    $dsn .= ';dbname=' . $connection_options['database'];
    // Allow PDO options to be overridden.
    $connection_options += array(
@@ -47,6 +57,11 @@ public function __construct(array $connection_options = array()) {
      // Because MySQL's prepared statements skip the query cache, because it's dumb.
      PDO::ATTR_EMULATE_PREPARES => TRUE,
    );
+    if (defined('PDO::MYSQL_ATTR_MULTI_STATEMENTS')) {
+      // An added connection option in PHP 5.5.21+ to optionally limit SQL to a
+      // single statement like mysqli.
+      $connection_options['pdo'] += array(PDO::MYSQL_ATTR_MULTI_STATEMENTS => FALSE);
+    }
    parent::__construct($dsn, $connection_options['username'], $connection_options['password'], $connection_options['pdo']);
@@ -54,10 +69,10 @@ public function __construct(array $connection_options = array()) {
    // certain one has been set; otherwise, MySQL defaults to 'utf8_general_ci'
    // for UTF-8.
    if (!empty($connection_options['collation'])) {
-      $this->exec('SET NAMES utf8 COLLATE ' . $connection_options['collation']);
+      $this->exec('SET NAMES ' . $charset . ' COLLATE ' . $connection_options['collation']);
    }
    else {
-      $this->exec('SET NAMES utf8');
+      $this->exec('SET NAMES ' . $charset);
    }
    // Set MySQL init_commands if not already defined.  Default Drupal's MySQL
@@ -72,10 +87,12 @@ public function __construct(array $connection_options = array()) {
      'init_commands' => array(),
    );
    $connection_options['init_commands'] += array(
-      'sql_mode' => "SET sql_mode = 'ANSI,STRICT_TRANS_TABLES,STRICT_ALL_TABLES,NO_ZERO_IN_DATE,NO_ZERO_DATE,ERROR_FOR_DIVISION_BY_ZERO,NO_AUTO_CREATE_USER'",
+      'sql_mode' => "SET sql_mode = 'REAL_AS_FLOAT,PIPES_AS_CONCAT,ANSI_QUOTES,IGNORE_SPACE,STRICT_TRANS_TABLES,STRICT_ALL_TABLES,NO_ZERO_IN_DATE,NO_ZERO_DATE,ERROR_FOR_DIVISION_BY_ZERO,NO_AUTO_CREATE_USER'",
    );
-    // Set connection options.
+    // Execute initial commands.
-    $this->exec(implode('; ', $connection_options['init_commands']));
+    foreach ($connection_options['init_commands'] as $sql) {
+      $this->exec($sql);
+    }
  }
  public function __destruct() {
@@ -195,6 +212,42 @@ protected function popCommittableTransactions() {
      }
    }
  }
+  public function utf8mb4IsConfigurable() {
+    return TRUE;
+  }
+  public function utf8mb4IsActive() {
+    return isset($this->connectionOptions['charset']) && $this->connectionOptions['charset'] === 'utf8mb4';
+  }
+  public function utf8mb4IsSupported() {
+    // Ensure that the MySQL driver supports utf8mb4 encoding.
+    $version = $this->getAttribute(PDO::ATTR_CLIENT_VERSION);
+    if (strpos($version, 'mysqlnd') !== FALSE) {
+      // The mysqlnd driver supports utf8mb4 starting at version 5.0.9.
+      $version = preg_replace('/^\D+([\d.]+).*/', '$1', $version);
+      if (version_compare($version, '5.0.9', '<')) {
+        return FALSE;
+      }
+    }
+    else {
+      // The libmysqlclient driver supports utf8mb4 starting at version 5.5.3.
+      if (version_compare($version, '5.5.3', '<')) {
+        return FALSE;
+      }
+    }
+    // Ensure that the MySQL server supports large prefixes and utf8mb4.
+    try {
+      $this->query("CREATE TABLE {drupal_utf8mb4_test} (id VARCHAR(255), PRIMARY KEY(id(255))) CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci ROW_FORMAT=DYNAMIC ENGINE=INNODB");
+    }
+    catch (Exception $e) {
+      return FALSE;
+    }
+    $this->query("DROP TABLE {drupal_utf8mb4_test}");
+    return TRUE;
+  }
 }

--- a/includes/database/mysql/schema.inc
+++ b/includes/database/mysql/schema.inc
@@ -39,8 +39,8 @@ protected function getPrefixInfo($table = 'default', $add_prefix = TRUE) {
      $info['table'] = substr($table, ++$pos);
    }
    else {
-      $db_info = Database::getConnectionInfo();
+      $db_info = $this->connection->getConnectionOptions();
-      $info['database'] = $db_info[$this->connection->getTarget()]['database'];
+      $info['database'] = $db_info['database'];
      $info['table'] = $table;
    }
    return $info;
@@ -81,7 +81,8 @@ protected function createTableSql($name, $table) {
    // Provide defaults if needed.
    $table += array(
      'mysql_engine' => 'InnoDB',
-      'mysql_character_set' => 'utf8',
+      // Allow the default charset to be overridden in settings.php.
+      'mysql_character_set' => $this->connection->utf8mb4IsActive() ? 'utf8mb4' : 'utf8',
    );
    $sql = "CREATE TABLE {" . $name . "} (\n";
@@ -109,6 +110,13 @@ protected function createTableSql($name, $table) {
      $sql .= ' COLLATE ' . $info['collation'];
    }
+    // The row format needs to be either DYNAMIC or COMPRESSED in order to allow
+    // for the innodb_large_prefix setting to take effect, see
+    // https://dev.mysql.com/doc/refman/5.6/en/create-table.html
+    if ($this->connection->utf8mb4IsActive()) {
+      $sql .= ' ROW_FORMAT=DYNAMIC';
+    }
    // Add table comment.
    if (!empty($table['description'])) {
      $sql .= ' COMMENT ' . $this->prepareComment($table['description'], self::COMMENT_MAX_TABLE);

--- a/includes/database/pgsql/database.inc
+++ b/includes/database/pgsql/database.inc
@@ -216,6 +216,14 @@ public function nextId($existing = 0) {
    return $id;
  }
+  public function utf8mb4IsActive() {
+    return TRUE;
+  }
+  public function utf8mb4IsSupported() {
+    return TRUE;
+  }
 }
 /**

--- a/includes/database/query.inc
+++ b/includes/database/query.inc
@@ -1694,7 +1694,7 @@ public function __construct($conjunction) {
   * Implements Countable::count().
   *
   * Returns the size of this conditional. The size of the conditional is the
-   * size of its conditional array minus one, because one element is the the
+   * size of its conditional array minus one, because one element is the
   * conjunction.
   */
  public function count() {

--- a/includes/database/schema.inc
+++ b/includes/database/schema.inc
@@ -92,7 +92,8 @@
 *    specification). Each specification is an array containing the name of
 *    the referenced table ('table'), and an array of column mappings
 *    ('columns'). Column mappings are defined by key pairs ('source_column' =>
- *    'referenced_column').
+ *    'referenced_column'). This key is for documentation purposes only; foreign
+ *    keys are not created in the database, nor are they enforced by Drupal.
 *  - 'indexes':  An associative array of indexes ('indexname' =>
 *    specification). Each specification is an array of one or more
 *    key column specifiers (see below) that form an index on the
@@ -144,6 +145,8 @@
 *   'unique keys' => array(
 *     'vid' => array('vid'),
 *   ),
+ *   // For documentation purposes only; foreign keys are not created in the
+ *   // database.
 *   'foreign keys' => array(
 *     'node_revision' => array(
 *       'table' => 'node_revision',

--- a/includes/database/select.inc
+++ b/includes/database/select.inc
@@ -1231,6 +1231,21 @@ public function preExecute(SelectQueryInterface $query = NULL) {
    // Modules may alter all queries or only those having a particular tag.
    if (isset($this->alterTags)) {
+      // Many contrib modules assume that query tags used for access-checking
+      // purposes follow the pattern $entity_type . '_access'. But this is
+      // not the case for taxonomy terms, since core used to add term_access
+      // instead of taxonomy_term_access to its queries. Provide backwards
+      // compatibility by adding both tags here instead of attempting to fix
+      // all contrib modules in a coordinated effort.
+      // TODO:
+      // - Extract this mechanism into a hook as part of a public (non-security)
+      //   issue.
+      // - Emit E_USER_DEPRECATED if term_access is used.
+      //   https://www.drupal.org/node/2575081
+      $term_access_tags = array('term_access' => 1, 'taxonomy_term_access' => 1);
+      if (array_intersect_key($this->alterTags, $term_access_tags)) {
+        $this->alterTags += $term_access_tags;
+      }
      $hooks = array('query');
      foreach ($this->alterTags as $tag => $value) {
        $hooks[] = 'query_' . $tag;

--- a/includes/database/sqlite/database.inc
+++ b/includes/database/sqlite/database.inc
@@ -378,6 +378,14 @@ public function popTransaction($name) {
    }
  }
+  public function utf8mb4IsActive() {
+    return TRUE;
+  }
+  public function utf8mb4IsSupported() {
+    return TRUE;
+  }
 }
 /**

--- a/includes/database/sqlite/install.inc
+++ b/includes/database/sqlite/install.inc
@@ -14,8 +14,6 @@ public function name() {
  /**
   * Minimum engine version.
-   *
-   * @todo: consider upping to 3.6.8 in Drupal 8 to get SAVEPOINT support.
   */
  public function minimumVersion() {
    return '3.3.7';