core/.eslintrc

@@ -80,7 +80,7 @@
     "space-infix-ops": 2,
     "space-unary-ops": [2, { "words": true, "nonwords": false }],
     "spaced-comment": [2, "always"],
-    "strict": 2,
+    "strict": [2, "function"],
     "yoda": [2, "never"],
     // Warnings.
     "max-nested-callbacks": [1, 3],

core/CHANGELOG.txt

+Drupal 8.2.8, 2017-04-19
+------------------------
+- Fixed security issues. See SA-CORE-2017-002.
+
+Drupal 8.2.7, 2017-03-15
+------------------------
+- Fixed security issues. See SA-CORE-2017-001.
+
+Drupal 8.2.3, 2016-11-16
+------------------------
+- Fixed security issues. See SA-CORE-2016-005.
+
+Drupal 8.2.0, 2016-10-05
+------------------------
+- Updated the git repository configuration to not normalize line endings for
+  files of unknown type.
+- Added vendor libraries:
+    * Added Stack/Cors 1.0.0.
+- Updated vendor libraries:
+    * Updated to jQuery 2.2.3.
+    * Updated to Twig 1.24.
+    * Updated to CKEditor 4.5.11.
+    * Updated to Symfony Routing 1.4.0.
+    * Updated to Stack/Builder 1.0.4.
+    * Updated to Guzzle 6.2.1.
+- Added modules:
+    * Added the Place Block module (experimental) to place a block on any page
+      without having to navigate to the backend administration form.
+    * Added the Settings Tray module (experimental) to edit the configuration of
+      any block on the page. Its machine name in this release is "outside_in".
+    * Added the Content Moderation module (experimental) to define and use
+      workflow states such as Draft, Archived and Published. This functionality
+      was previously provided by the contributed module Workbench Moderation.
+    * Added the Datetime Range module (experimental) that provides a new field
+      type with support for start and end dates.
+- Raised stability levels of experimental modules:
+    * Updated the BigPipe module from alpha to beta.
+    * See https://www.drupal.org/core/experimental#versions for more
+      information about the stability levels of experimental modules.
+- Improved authoring features:
+    * Relative URLs are automatically converted to absolute ones when content
+      is output to an RSS feed.
+    * Enabled revisions by default on new node types.
+    * Added a redirect option to site-wide contact forms.
+    * Whenever a new entity is created, a link to it is now provided in a
+      status message, for easy access to it regardless of the form workflow.
+    * Styled CKEditor dialogs to match Drupal dialogs.
+- Improved site administration experience:
+    * Numerous improvements to user interface text.
+- Improved site building features:
+    * Added the ability to remove a module's content entities prior to
+      uninstallation.
+    * Made it possible to select the comment view mode in the formatter form.
+    * Fixed the Migrate module to skip over migration sources that require
+      code from uninstalled modules.
+- Improved REST API and decoupled site features:
+    * Added support for reading (GET) configuration entities as REST resources.
+    * Added dedicated resources for user login, logout and registration.
+    * Added support for selecting an authentication provider as part of the
+      configuration of a REST Export Views Display.
+    * Added a cors.config service parameter for enabling and configuring
+      cross-origin resource sharing (CORS).
+    * Simplified REST configuration with per-resource configuration entities
+      and less verbose configuration structure. (The previous, advanced
+      configuration structure is also still supported.)
+    * Improved the response messages and status codes for requests with missing
+      or incorrect headers.
+    * Improved responses to PATCH requests to entity resources to contain the
+      updated entity in the response body.
+- Improved developer APIs:
+    * Added support for specifying the field item delta as part of an entity
+      query condition. This was possible in Drupal 7 via
+      EntityFieldQuery::fieldDeltaCondition(), but missing from earlier
+      versions of Drupal 8.
+- Improved performance/scalability:
+    * In the internal page cache, 404 responses are now cached for a shorter
+      time (1 hour by default), to consume less space.
+    * Breadcrumbs are now cached by the parent of the path rather than the full
+      path, for fewer cache entries and higher cache hit rates.
+- Changed coding standards:
+    * Local variables and parameters can now use camelCase.
+    * A blank line is now required after the <?php opening tag.
+- Testing improvements:
+    * Increased feature parity of BrowserTestBase with WebTestBase, including a
+      deprecated AssertLegacyTrait for easier conversions.
+    * Converted all kernel tests to the PHPUnit-based kernel test API.
+    * Improved error reporting for all PHPUnit tests (including unit, kernel,
+      browser, and JavaScript tests).
+
 Drupal 8.1.0, 2016-04-20
 ------------------------
 - Removed Composer-managed vendor from the git repository:

core/MAINTAINERS.txt

@@ -3,6 +3,9 @@ encouraged to submit issues and changes (patches) to improve Drupal, and to
 contribute in other ways -- see https://www.drupal.org/contribute to find out
 how.
 
+This file lists the active maintainers. For a list of past maintainers, see:
+https://www.drupal.org/core/maintainers/past
+
 
 Core committers
 ---------------
@@ -53,11 +56,10 @@ Actions
 - ?
 
 Aggregator
-- Paris Liakos 'ParisLiakos' https://www.drupal.org/u/parisliakos
+- ?
 
 Ajax
 - Alex Bronstein 'effulgentsia' https://www.drupal.org/u/effulgentsia
-- Earl Miles 'merlinofchaos' https://www.drupal.org/u/merlinofchaos
 - Tim Plunkett 'tim.plunkett' https://www.drupal.org/u/tim.plunkett
 
 Asset Library API
@@ -73,19 +75,17 @@ Ban
 - ?
 
 Bartik
-- Jen Simmons 'jensimmons' https://www.drupal.org/u/jensimmons
 - Emma Maria Karayiannis 'emma.maria' https://www.drupal.org/u/emma.maria
 
 Base system
-- Damien Tournoud 'damien-tournoud' https://www.drupal.org/u/damien-tournoud
-- Moshe Weitzman 'moshe weitzman' https://www.drupal.org/u/moshe-weitzman
+- ?
 
 Basic Auth
 - Klaus Purer 'klausi' https://www.drupal.org/u/klausi
 - Juampy Novillo Requena 'juampy' https://www.drupal.org/u/juampy
 
 Batch API
-- Yves Chedemois 'yched' https://www.drupal.org/u/yched
+- ?
 
 BigPipe
 - Wim Leers 'Wim Leers' https://www.drupal.org/u/wim-leers
@@ -109,9 +109,7 @@ Breakpoint
 - Marc Drummond 'mdrummond' https://www.drupal.org/u/mdrummond
 
 Cache
-- Damien Tournoud 'damien-tournoud' https://www.drupal.org/u/damien-tournoud
 - Nathaniel Catchpole 'catch' https://www.drupal.org/u/catch
-- Mark Sonnabaum 'msonnabaum' https://www.drupal.org/u/msonnabaum
 
 CKEditor
 - Wim Leers 'Wim Leers' https://www.drupal.org/u/wim-leers
@@ -125,18 +123,15 @@ Color
 - ?
 
 Comment
-- Dick Olsson 'dixon_' https://www.drupal.org/u/dixon_
 - Lee Rowlands 'larowlan' https://www.drupal.org/u/larowlan
 - Andrey Postnikov 'andypost' https://www.drupal.org/u/andypost
 
 Configuration API
-- Daniel F. Kudwien 'sun' https://www.drupal.org/u/sun
 - Alex Pott 'alexpott' https://www.drupal.org/u/alexpott
 - Matthew Tift 'mtift' https://www.drupal.org/u/mtift
 
 Configuration Entity API
 - Alex Pott 'alexpott' https://www.drupal.org/u/alexpott
-- Daniel F. Kudwien 'sun' https://www.drupal.org/u/sun
 - Tim Plunkett 'tim.plunkett' https://www.drupal.org/u/tim.plunkett
 
 Configuration UI
@@ -159,10 +154,10 @@ Content Translation
 - Francesco Placella 'plach' https://www.drupal.org/u/plach
 
 Contextual
-- Daniel F. Kudwien 'sun' https://www.drupal.org/u/sun
+- ?
 
 Cron
-- Derek Wright 'dww' https://www.drupal.org/u/dww
+- ?
 
 CSS
 - John Albin Wilkins 'JohnAlbin' https://www.drupal.org/u/johnalbin
@@ -175,14 +170,13 @@ Database API
   - David Strauss 'David Strauss' https://www.drupal.org/u/david-strauss
 
   PostgreSQL DB driver
-  - Damien Tournoud 'damien-tournoud' https://www.drupal.org/u/damien-tournoud
-  - Josh Waihi 'fiasco' https://www.drupal.org/u/fiasco
+  - ?
 
   Sqlite DB driver
-  - Damien Tournoud 'damien-tournoud' https://www.drupal.org/u/damien-tournoud
+  - ?
 
 Database Logging
-- Khalid Baheyeldin 'kbahey' https://www.drupal.org/u/kbahey
+- ?
 
 Database Update API
 - ?
@@ -203,15 +197,15 @@ Editor
 - Wim Leers 'Wim Leers' https://www.drupal.org/u/wim-leers
 
 Entity API
-- Wolfgang Ziegler 'fago' https://www.drupal.org/u/fago
 - Nathaniel Catchpole 'catch' https://www.drupal.org/u/catch
 - Sascha Grossenbacher 'Berdir' https://www.drupal.org/u/berdir
+- Francesco Placella 'plach' https://www.drupal.org/u/plach
+- Tobias Stöckler 'tstoeckler' https://www.drupal.org/u/tstoeckler
 
 Extension API
 - ?
 
 Field API
-- Yves Chedemois 'yched' https://www.drupal.org/u/yched
 - Andrei Mateescu 'amateescu' https://www.drupal.org/u/amateescu
 
 Field UI
@@ -219,19 +213,16 @@ Field UI
 - Andrei Mateescu 'amateescu' https://www.drupal.org/u/amateescu
 
 File
-- Andrew Morton 'drewish' https://www.drupal.org/u/drewish
-- Aaron Winborn 'aaron' https://www.drupal.org/u/aaron
+- ?
 
 Filter
-- Daniel F. Kudwien 'sun' https://www.drupal.org/u/sun
+- ?
 
 Forum
 - Lee Rowlands 'larowlan' https://www.drupal.org/u/larowlan
 
 Form API
 - Alex Bronstein 'effulgentsia' https://www.drupal.org/u/effulgentsia
-- Wolfgang Ziegler 'fago' https://www.drupal.org/u/fago
-- Daniel F. Kudwien 'sun' https://www.drupal.org/u/sun
 - Tim Plunkett 'tim.plunkett' https://www.drupal.org/u/tim.plunkett
 
 History
@@ -264,24 +255,28 @@ Link Field
 - Weber Macedo 'Mac_Weber' https://www.drupal.org/u/mac_weber
 
 Lock
-- Damien Tournoud 'damien-tournoud' https://www.drupal.org/u/damien-tournoud
+- ?
 
 Mail
 - ?
 
 Markup
-- Daniel F. Kudwien 'sun' https://www.drupal.org/u/sun
+- ?
 
 Migrate
 - Adam Globus-Hoenich 'phenaproxima' https://www.drupal.org/u/phenaproxima
 - Ben Dougherty 'benjy' https://www.drupal.org/u/benjy
+- Lucas Hedding 'heddn' https://www.drupal.org/u/heddn
 - Michael Anello 'ultimike' https://www.drupal.org/u/ultimike
 - Mike Ryan 'mikeryan' https://www.drupal.org/u/mikeryan
+- Vicki Spagnolo 'quietone' https://www.drupal.org/u/quietone
 
 Migrate (Drupal)
 - Ben Dougherty 'benjy' https://www.drupal.org/u/benjy
+- Lucas Hedding 'heddn' https://www.drupal.org/u/heddn
 - Michael Anello 'ultimike' https://www.drupal.org/u/ultimike
 - Mike Ryan 'mikeryan' https://www.drupal.org/u/mikeryan
+- Vicki Spagnolo 'quietone' https://www.drupal.org/u/quietone
 
 Menu
 - Daniel Wehner 'dawehner' https://www.drupal.org/u/dawehner
@@ -295,16 +290,15 @@ Menu UI
 - ?
 
 Node
-- Moshe Weitzman 'moshe weitzman' https://www.drupal.org/u/moshe-weitzman
-- David Strauss 'David Strauss' https://www.drupal.org/u/david-strauss
+- ?
 
 Node Access
-- Moshe Weitzman 'moshe weitzman' https://www.drupal.org/u/moshe-weitzman
 - Ken Rickard 'agentrickard' https://www.drupal.org/u/agentrickard
+- Moshe Weitzman 'moshe weitzman' https://www.drupal.org/u/moshe-weitzman
 - Jess Myrbo 'xjm' https://www.drupal.org/u/xjm
 
 Options
-- Yves Chedemois 'yched' https://www.drupal.org/u/yched
+- ?
 
 Outside In
 - Ted Bowman 'tedbow' https://www.drupal.org/u/tedbow
@@ -323,7 +317,6 @@ Plugin
 
 Queue
 - James Gilliland 'neclimdul' https://www.drupal.org/u/neclimdul
-- Mark Sonnabaum 'msonnabaum' https://www.drupal.org/u/msonnabaum
 
 Quick Edit
 - Wim Leers 'Wim Leers' https://www.drupal.org/u/wim-leers
@@ -333,8 +326,8 @@ RDF
 - Stéphane Corlosquet 'scor' https://www.drupal.org/u/scor
 
 Render API
-- Moshe Weitzman 'moshe weitzman' https://www.drupal.org/u/moshe-weitzman
 - Alex Bronstein 'effulgentsia' https://www.drupal.org/u/effulgentsia
+- Moshe Weitzman 'moshe weitzman' https://www.drupal.org/u/moshe-weitzman
 
 Request Processing
 - Larry Garfield 'Crell' https://www.drupal.org/u/crell
@@ -366,11 +359,6 @@ Shortcut
 - Tobias Stöckler 'tstoeckler' https://www.drupal.org/u/tstoeckler
 - Jibran Ijaz 'jibran' https://www.drupal.org/u/jibran
 
-Simpletest
-- Daniel F. Kudwien 'sun' https://www.drupal.org/u/sun
-- Sascha Grossenbacher 'Berdir' https://www.drupal.org/u/berdir
-- Alex Pott 'alexpott' https://www.drupal.org/u/alexpott
-
 Stable
 - Scott Reeves 'Cottser' https://www.drupal.org/u/cottser
 
@@ -389,23 +377,27 @@ System (module)
 Taxonomy
 - Jess Myrbo 'xjm' https://www.drupal.org/u/xjm
 - Nathaniel Catchpole 'catch' https://www.drupal.org/u/catch
-- Benjamin Doherty 'bangpound' https://www.drupal.org/u/bangpound
 
 Telephone
-- Dave Reid 'dave-reid' https://www.drupal.org/u/dave-reid
+- ?
+
+Testing framework
+- Alex Pott 'alexpott' https://www.drupal.org/u/alexpott
+- Sascha Grossenbacher 'Berdir' https://www.drupal.org/u/berdir
+- Klaus Purer 'klausi' https://www.drupal.org/u/klausi
+- Daniel Wehner 'dawehner' https://www.drupal.org/u/dawehner
 
 Text Field
 - ?
 
 Theme API
 - Alex Bronstein 'effulgentsia' https://www.drupal.org/u/effulgentsia
-- Scott Reeves 'Cottser' https://www.drupal.org/u/cottser
 - Fabian Franz 'Fabianx' https://www.drupal.org/u/fabianx
 - Joël Pittet 'joelpittet' https://www.drupal.org/u/joelpittet
 - Lauri Eskola 'lauriii' https://www.drupal.org/u/lauriii
 
 Token
-- Dave Reid 'davereid' https://www.drupal.org/u/davereid
+- ?
 
 Toolbar
 - Théodore Biadala 'nod_' https://www.drupal.org/u/nod_
@@ -414,22 +406,19 @@ Tour
 - Nick Schuch 'nick_schuch' https://www.drupal.org/u/nick_schuch
 
 Tracker
-- David Strauss 'David Strauss' https://www.drupal.org/u/david-strauss
+- ?
 
 Transliteration
 - Andrei Mateescu 'amateescu' https://www.drupal.org/u/amateescu
-- Damien Tournoud 'damien-tournoud' https://www.drupal.org/u/damien-tournoud
-- Daniel F. Kudwien 'sun' https://www.drupal.org/u/sun
 
 Typed Data
 - Wolfgang Ziegler 'fago' https://www.drupal.org/u/fago
 
 Update UI
-- Derek Wright 'dww' https://www.drupal.org/u/dww
+- ?
 
 User
 - Moshe Weitzman 'moshe weitzman' https://www.drupal.org/u/moshe-weitzman
-- David Strauss 'David Strauss' https://www.drupal.org/u/david-strauss
 
 Views
 - Daniel Wehner 'dawehner' https://www.drupal.org/u/dawehner
@@ -438,18 +427,11 @@ Views
 - Jess Myrbo 'xjm' https://www.drupal.org/u/xjm
 - Len Swaneveld 'Lendude' https://www.drupal.org/u/lendude
 
-Views UI
-- Daniel Wehner 'dawehner' https://www.drupal.org/u/dawehner
-- Tim Plunkett 'tim.plunkett' https://www.drupal.org/u/tim.plunkett
-- Damian Lee 'damiankloip' https://www.drupal.org/u/damiankloip
-- Len Swaneveld 'Lendude' https://www.drupal.org/u/lendude
-
 Topic maintainers
 -----------------
 
 Accessibility
 - Mike Gifford 'mgifford' https://www.drupal.org/u/mgifford
-- Jesse Renée Beach 'jessebeach' https://www.drupal.org/u/jessebeach
 - Andrew Macpherson 'andrewmacpherson' https://www.drupal.org/u/andrewmacpherson
 
 Documentation
@@ -488,24 +470,16 @@ re-architect or otherwise improve large areas of Drupal core. See
 https://www.drupal.org/community-initiatives/drupal-core for more information on
 their responsibilities. The initiative coordinators for Drupal 8 are:
 
-Configuration management
-- Greg Dunlap 'heyrocker' https://www.drupal.org/u/heyrocker
-
-Design
-- Jeff Burns 'Jeff Burnz' https://www.drupal.org/u/jeff-burnz
-
-Mobile
-- John Albin Wilkins 'JohnAlbin' https://www.drupal.org/u/johnalbin
-
 Multi-lingual
 - Gábor Hojtsy 'Gábor Hojtsy' https://www.drupal.org/u/gábor-hojtsy
 
-Web services
-- Larry Garfield 'Crell' https://www.drupal.org/u/crell
-
 Workflow Initiative
 - Dick Olsson 'dixon_' https://www.drupal.org/u/dixon_
 
+PHPUnit Initiative
+- Klaus Purer 'klausi' https://www.drupal.org/u/klausi
+- Daniel Wehner 'dawehner' https://www.drupal.org/u/dawehner
+
 Provisional membership: None at this time.
 
 
@@ -523,7 +497,6 @@ participate in mentoring.
 - Lucas Hedding 'heddn' https://www.drupal.org/u/heddn
 - Valery Lourie 'valthebald' https://www.drupal.org/u/valthebald
 - Alina Mackenzie 'alimac' https://www.drupal.org/u/alimac
-- Chris McCafferty 'cilefen' https://www.drupal.org/u/cilefen
 - Jess Myrbo 'xjm' https://www.drupal.org/u/xjm
 - Andrea Soper 'ZenDoodles' https://www.drupal.org/u/zendoodles
 - Cathy Theys 'YesCT' https://www.drupal.org/u/yesct

core/composer.json

@@ -31,7 +31,7 @@
         "symfony/psr-http-message-bridge": "v0.2",
         "zendframework/zend-diactoros": "~1.1",
         "composer/semver": "~1.0",
-        "paragonie/random_compat": "~1.0",
+        "paragonie/random_compat": "^1|^2",
         "asm89/stack-cors": "~1.0"
     },
     "require-dev": {
@@ -40,7 +40,7 @@
         "jcalderonzumba/gastonjs": "~1.0.2",
         "jcalderonzumba/mink-phantomjs-driver": "~0.3.1",
         "mikey179/vfsStream": "~1.2",
-        "phpunit/phpunit": "~4.8",
+        "phpunit/phpunit": ">=4.8.28 <5",
         "symfony/css-selector": "~2.8"
     },
     "replace": {

core/core.api.php

@@ -1073,8 +1073,9 @@
  *   yourmodule/tests/src/Unit directory, according to the PSR-4 standard.
  * - Your test class needs a phpDoc comment block with a description and
  *   a @group annotation, which gives information about the test.
- * - Methods in your test class whose names start with 'test' are the actual
- *   test cases. Each one should test a logical subset of the functionality.
+ * - Add test cases by adding method names that start with 'test' and have no
+ *   arguments, for example testYourTestCase(). Each one should test a logical
+ *   subset of the functionality.
  * For more details, see:
  * - https://www.drupal.org/phpunit for full documentation on how to write
  *   PHPUnit tests for Drupal.
@@ -1110,9 +1111,9 @@
  *   set up content types and similar procedures.
  * - In some cases, you may need to write a test module to support your test;
  *   put such modules under the yourmodule/tests/modules directory.
- * - Methods in your test class whose names start with 'test', and which have
- *   no arguments, are the actual test cases. Each one should test a logical
- *   subset of the functionality, and each one runs in a new, isolated test
+ * - Add test cases by adding method names that start with 'test' and have no
+ *   arguments, for example testYourTestCase(). Each one should test a logical
+ *   subset of the functionality. Each method runs in a new, isolated test
  *   environment, so it can only rely on the setUp() method, not what has
  *   been set up by other test methods.
  * For more details, see:
@@ -1121,6 +1122,52 @@
  * - @link oo_conventions Object-oriented programming topic @endlink for more
  *   on PSR-4, namespaces, and where to place classes.
  *
+ * @section write_functional_phpunit Write functional PHP tests (phpunit)
+ * Functional tests extend the BrowserTestBase base class, and use PHPUnit as
+ * their underlying framework. They use a simulated browser, in which the test
+ * can click links, visit URLs, post to forms, etc. To write a functional test:
+ * - Extend \Drupal\Tests\BrowserTestBase.
+ * - Place the test in the yourmodule/tests/src/Functional/ directory and use
+ *   the \Drupal\Tests\yourmodule\Functional namespace.
+ * - Add a @group annotation. For example, if the test is for a Drupal 6
+ *   migration process, the group core uses is migrate_drupal_6. Use yourmodule
+ *   as the group name if the test does not belong to another larger group.
+ * - You may also override the default setUp() method, which can be used to set
+ *   up content types and similar procedures. Don't forget to call the parent
+ *   method.
+ * - In some cases, you may need to write a test module to support your test;
+ *   put such modules under the yourmodule/tests/modules directory.
+ * - Add test cases by adding method names that start with 'test' and have no
+ *   arguments, for example testYourTestCase(). Each one should test a logical
+ *   subset of the functionality. Each method runs in a new, isolated test
+ *   environment, so it can only rely on the setUp() method, not what has
+ *   been set up by other test methods.
+ * For more details, see:
+ * - https://www.drupal.org/docs/8/phpunit/phpunit-browser-test-tutorial for
+ *   a full tutorial on how to write functional PHPUnit tests for Drupal.
+ * - https://www.drupal.org/phpunit for the full documentation on how to write
+ *   PHPUnit tests for Drupal.
+ *
+ * @section write_jsfunctional_phpunit Write functional JavaScript tests (phpunit)
+ * To write a functional test that relies on JavaScript:
+ * - Extend \Drupal\FunctionalJavaScriptTests\JavascriptTestBase.
+ * - Place the test into the yourmodule/tests/src/FunctionalJavascript/
+ *   directory and use the \Drupal\Tests\yourmodule\FunctionalJavascript
+ *   namespace.
+ * - Add a @group annotation. Use yourmodule as the group name if the test does
+ *   not belong to another larger group.
+ * - Set up PhantomJS; see http://phantomjs.org/download.html.
+ * - To run tests, see core/tests/README.md.
+ * - When clicking a link/button with Ajax behavior attached, keep in mind that
+ *   the underlying browser might take time to deliver changes to the HTML. Use
+ *   $this->assertSession()->assertWaitOnAjaxRequest() to wait for the Ajax
+ *   request to finish.
+ * For more details, see:
+ * - https://www.drupal.org/docs/8/phpunit/phpunit-javascript-testing-tutorial
+ *   for a full tutorial on how to write PHPUnit JavaScript tests for Drupal.
+ * - https://www.drupal.org/phpunit for the full documentation on how to write
+ *   PHPUnit tests for Drupal.
+ *
  * @section running Running tests
  * You can run both Simpletest and PHPUnit tests by enabling the core Testing
  * module (core/modules/simpletest). Once that module is enabled, tests can be
@@ -2493,7 +2540,7 @@ function hook_validation_constraint_alter(array &$definitions) {
  *   this class is subscribed to, and which methods on the class should be
  *   called for each one. Example:
  *   @code
- *   public function getSubscribedEvents() {
+ *   public static function getSubscribedEvents() {
  *     // Subscribe to kernel terminate with priority 100.
  *     $events[KernelEvents::TERMINATE][] = array('onTerminate', 100);
  *     // Subscribe to kernel request with default priority of 0.

core/includes/entity.inc

@@ -539,12 +539,12 @@ function entity_get_display($entity_type, $bundle, $view_mode) {
  *   When the entity form display is not available in configuration, you can
  *   create a new EntityFormDisplay object using:
  * @code
- * $values = ('entity_form_display', array(
+ * $values = array(
  *  'targetEntityType' => $entity_type,
  *  'bundle' => $bundle,
  *  'mode' => $form_mode,
  *  'status' => TRUE,
- * ));
+ * );
  * \Drupal::entityTypeManager()
  *   ->getStorage('entity_form_display')
  *   ->create($values);

core/includes/form.inc

@@ -511,8 +511,6 @@ function template_preprocess_form_element_label(&$variables) {
     $variables['title'] = ['#markup' => $element['#title']];
   }
 
-  $variables['attributes'] = array();
-
   // Pass elements title_display to template.
   $variables['title_display'] = $element['#title_display'];
 

core/includes/install.core.inc

@@ -20,6 +20,7 @@
 use Drupal\Core\Site\Settings;
 use Drupal\Core\StringTranslation\Translator\FileTranslation;
 use Drupal\Core\StackMiddleware\ReverseProxyMiddleware;
+use Drupal\Core\StreamWrapper\PublicStream;
 use Drupal\Core\Extension\ExtensionDiscovery;
 use Drupal\Core\DependencyInjection\ContainerBuilder;
 use Drupal\Core\Url;
@@ -1036,6 +1037,21 @@ function install_base_system(&$install_state) {
   // Install system.module.
   drupal_install_system($install_state);
 
+  // Prevent the installer from using the system temporary directory after the
+  // system module has been installed.
+  if (drupal_valid_test_ua()) {
+    // While the temporary directory could be preset/enforced in settings.php
+    // like the public files directory, some tests expect it to be configurable
+    // in the UI. If declared in settings.php, they would no longer be
+    // configurable. The temporary directory needs to match what is set in each
+    // test types ::prepareEnvironment() step.
+    $temporary_directory = dirname(PublicStream::basePath()) . '/temp';
+    file_prepare_directory($temporary_directory, FILE_MODIFY_PERMISSIONS | FILE_CREATE_DIRECTORY);
+    \Drupal::configFactory()->getEditable('system.file')
+      ->set('path.temporary', $temporary_directory)
+      ->save();
+  }
+
   // Call file_ensure_htaccess() to ensure that all of Drupal's standard
   // directories (e.g., the public files directory and config directory) have
   // appropriate .htaccess files. These directories will have already been

core/includes/install.inc

@@ -930,27 +930,35 @@ function drupal_requirements_url($severity) {
  */
 function drupal_check_profile($profile) {
   $info = install_profile_info($profile);
-
   // Collect requirement testing results.
   $requirements = array();
-
   // Performs an ExtensionDiscovery scan as the system module is unavailable and
   // we don't yet know where all the modules are located.
   // @todo Remove as part of https://www.drupal.org/node/2186491
-  $listing = new ExtensionDiscovery(\Drupal::root());
-  $module_list = $listing->scan('module');
+  $drupal_root = \Drupal::root();
+  $module_list = (new ExtensionDiscovery($drupal_root))->scan('module');
+
   foreach ($info['dependencies'] as $module) {
-    $file = \Drupal::root() . '/' . $module_list[$module]->getPath() . "/$module.install";
-    if (is_file($file)) {
-      require_once $file;
-    }
-    $function = $module . '_requirements';
+    // If the module is in the module list we know it exists and we can continue
+    // including and registering it.
+    // @see \Drupal\Core\Extension\ExtensionDiscovery::scanDirectory()
+    if (isset($module_list[$module])) {
+      $function = $module . '_requirements';
+      $module_path = $module_list[$module]->getPath();
+      $install_file = "$drupal_root/$module_path/$module.install";
+
+      if (is_file($install_file)) {
+        require_once $install_file;
+      }
+
+      drupal_classloader_register($module, $module_path);
 
-    drupal_classloader_register($module, $module_list[$module]->getPath());
-    if (function_exists($function)) {
-      $requirements = array_merge($requirements, $function('install'));
+      if (function_exists($function)) {
+        $requirements = array_merge($requirements, $function('install'));
+      }
     }
   }
+
   return $requirements;
 }
 
@@ -1036,10 +1044,11 @@ function drupal_check_module($module) {
  *
  * Example of .info.yml file:
  * @code
- *    name = Minimal
- *    description = Start fresh, with only a few modules enabled.
- *    dependencies[] = block
- *    dependencies[] = dblog
+ *    name: Minimal
+ *    description: Start fresh, with only a few modules enabled.
+ *    dependencies:
+ *      - block
+ *      - dblog
  * @endcode
  *
  * @param $profile

core/includes/schema.inc

@@ -74,7 +74,7 @@ function drupal_get_schema_versions($module) {
  *   module is not installed.
  */
 function drupal_get_installed_schema_version($module, $reset = FALSE, $array = FALSE) {
-  static $versions = array();
+  $versions = &drupal_static(__FUNCTION__, array());
 
   if ($reset) {
     $versions = array();

core/lib/Drupal.php

@@ -81,7 +81,7 @@ class Drupal {
   /**
    * The current system version.
    */
-  const VERSION = '8.2.0-dev';
+  const VERSION = '8.2.8-dev';
 
   /**
    * Core API compatibility.
@@ -556,8 +556,7 @@ public static function linkGenerator() {
    * Renders a link with a given link text and Url object.
    *
    * This method is a convenience wrapper for the link generator service's
-   * generate() method. For detailed documentation, see
-   * \Drupal\Core\Routing\LinkGeneratorInterface::generate().
+   * generate() method.
    *
    * @param string $text
    *   The link text for the anchor tag.

core/lib/Drupal/Component/Diff/DiffFormatter.php

@@ -36,6 +36,16 @@ class DiffFormatter {
    */
   public $trailing_context_lines = 0;
 
+  /**
+   * The line stats.
+   *
+   * @var array
+   */
+  protected $line_stats = array(
+    'counter' => array('x' => 0, 'y' => 0),
+    'offset' => array('x' => 0, 'y' => 0),
+  );
+
   /**
    * Format a diff.
    *

core/lib/Drupal/Component/Render/FormattableMarkup.php

@@ -147,7 +147,7 @@ public function jsonSerialize() {
    *     A call like:
    *     @code
    *       $string = "%output_text";
-   *       $arguments = ['output_text' => 'text output here.'];
+   *       $arguments = ['%output_text' => 'text output here.'];
    *       $this->placeholderFormat($string, $arguments);
    *     @endcode
    *     makes the following HTML code:
@@ -227,11 +227,18 @@ protected static function placeholderFormat($string, array $args) {
         default:
           // We do not trigger an error for placeholder that start with an
           // alphabetic character.
+          // @todo https://www.drupal.org/node/2807743 Change to an exception
+          //   and always throw regardless of the first character.
           if (!ctype_alpha($key[0])) {
             // We trigger an error as we may want to introduce new placeholders
             // in the future without breaking backward compatibility.
             trigger_error('Invalid placeholder (' . $key . ') in string: ' . $string, E_USER_ERROR);
           }
+          elseif (strpos($string, $key) !== FALSE) {
+            trigger_error('Invalid placeholder (' . $key . ') in string: ' . $string, E_USER_DEPRECATED);
+          }
+          // No replacement possible therefore we can discard the argument.
+          unset($args[$key]);
           break;
       }
     }

core/lib/Drupal/Component/Utility/Random.php

@@ -288,7 +288,6 @@ public function image($destination, $min_resolution, $max_resolution) {
     // Make a perfect circle in the image middle.
     $color = imagecolorallocate($im, rand(0, 255), rand(0, 255), rand(0, 255));
     $smaller_dimension = min($width, $height);
-    $smaller_dimension = ($smaller_dimension % 2) ? $smaller_dimension : $smaller_dimension;
     imageellipse($im, $width / 2, $height / 2, $smaller_dimension, $smaller_dimension, $color);
 
     $save_function = 'image' . ($extension == 'jpg' ? 'jpeg' : $extension);

core/lib/Drupal/Core/Access/CsrfAccessCheck.php

@@ -54,7 +54,7 @@ public function access(Route $route, Request $request, RouteMatchInterface $rout
       $path = str_replace("{{$param}}", $value, $path);
     }
 
-    if ($this->csrfToken->validate($request->query->get('token'), $path)) {
+    if ($this->csrfToken->validate($request->query->get('token', ''), $path)) {
       $result = AccessResult::allowed();
     }
     else {

core/lib/Drupal/Core/Access/CsrfRequestHeaderAccessCheck.php

@@ -97,12 +97,15 @@ public function access(Request $request, AccountInterface $account) {
       && $account->isAuthenticated()
       && $this->sessionConfiguration->hasSession($request)
     ) {
+      if (!$request->headers->has('X-CSRF-Token')) {
+        return AccessResult::forbidden()->setReason('X-CSRF-Token request header is missing')->setCacheMaxAge(0);
+      }
       $csrf_token = $request->headers->get('X-CSRF-Token');
       // @todo Remove validate call using 'rest' in 8.3.
       //   Kept here for sessions active during update.
       if (!$this->csrfToken->validate($csrf_token, self::TOKEN_KEY)
         && !$this->csrfToken->validate($csrf_token, 'rest')) {
-        return AccessResult::forbidden()->setReason('X-CSRF-Token request header is missing')->setCacheMaxAge(0);
+        return AccessResult::forbidden()->setReason('X-CSRF-Token request header is invalid')->setCacheMaxAge(0);
       }
     }
     // Let other access checkers decide if the request is legit.

core/lib/Drupal/Core/Access/CsrfTokenGenerator.php

@@ -87,7 +87,7 @@ public function validate($token, $value = '') {
       return FALSE;
     }
 
-    return $token === $this->computeToken($seed, $value);
+    return Crypt::hashEquals($this->computeToken($seed, $value), $token);
   }
 
   /**

core/lib/Drupal/Core/Ajax/OpenDialogCommand.php

@@ -2,6 +2,8 @@
 
 namespace Drupal\Core\Ajax;
 
+use Drupal\Component\Render\PlainTextOutput;
+
 /**
  * Defines an AJAX command to open certain content in a dialog.
  *
@@ -69,6 +71,7 @@ class OpenDialogCommand implements CommandInterface, CommandWithAttachedAssetsIn
    *   populated automatically from the current request.
    */
   public function __construct($selector, $title, $content, array $dialog_options = array(), $settings = NULL) {
+    $title = PlainTextOutput::renderFromHtml($title);
     $dialog_options += array('title' => $title);
     $this->selector = $selector;
     $this->content = $content;

core/lib/Drupal/Core/Asset/AssetResolver.php

@@ -214,7 +214,7 @@ public function getJsAssets(AttachedAssetsInterface $assets, $optimize) {
     // hook_library_info_alter(). Additionally add the current language to
     // support translation of JavaScript files via hook_js_alter().
     $libraries_to_load = $this->getLibrariesToLoad($assets);
-    $cid = 'js:' . $theme_info->getName() . ':' . $this->languageManager->getCurrentLanguage()->getId() . ':' . Crypt::hashBase64(serialize($libraries_to_load) . serialize($assets->getLibraries())) . (int) (count($assets->getSettings()) > 0) . (int) $optimize;
+    $cid = 'js:' . $theme_info->getName() . ':' . $this->languageManager->getCurrentLanguage()->getId() . ':' . Crypt::hashBase64(serialize($libraries_to_load)) . (int) (count($assets->getSettings()) > 0) . (int) $optimize;
 
     if ($cached = $this->cache->get($cid)) {
       list($js_assets_header, $js_assets_footer, $settings, $settings_in_header) = $cached->data;