Drupal 8.6.15

core/assets/vendor/jquery/jquery-extend-3.4.0.js

@@ -0,0 +1,111 @@
+/**
+ * For jQuery versions less than 3.4.0, this replaces the jQuery.extend
+ * function with the one from jQuery 3.4.0, slightly modified (documented
+ * below) to be compatible with older jQuery versions.
+ *
+ * This provides the Object.prototype pollution vulnerability fix to Drupal
+ * installations running older jQuery versions, including the version (3.2.1)
+ * shipped with Drupal core.
+ *
+ * @see https://github.com/jquery/jquery/pull/4333
+ */
+
+(function (jQuery) {
+
+// Do not override jQuery.extend() if the jQuery version is already >=3.4.0.
+var versionParts = jQuery.fn.jquery.split('.');
+var majorVersion = parseInt(versionParts[0]);
+var minorVersion = parseInt(versionParts[1]);
+var patchVersion = parseInt(versionParts[2]);
+var isPreReleaseVersion = (patchVersion.toString() !== versionParts[2]);
+if (
+  (majorVersion > 3) ||
+  (majorVersion === 3 && minorVersion > 4) ||
+  (majorVersion === 3 && minorVersion === 4 && patchVersion > 0) ||
+  (majorVersion === 3 && minorVersion === 4 && patchVersion === 0 && !isPreReleaseVersion)
+) {
+  return;
+}
+
+/**
+ * This is almost verbatim copied from jQuery 3.4.0.
+ *
+ * Only one minor change has been made:
+ * - The call to isFunction() is changed to jQuery.isFunction().
+ *
+ * The above change ensures compatibility with older jQuery versions,
+ * including 3.2.1 which is shipped with Drupal core.
+ */
+jQuery.extend = jQuery.fn.extend = function() {
+  var options, name, src, copy, copyIsArray, clone,
+    target = arguments[ 0 ] || {},
+    i = 1,
+    length = arguments.length,
+    deep = false;
+
+  // Handle a deep copy situation
+  if ( typeof target === "boolean" ) {
+    deep = target;
+
+    // Skip the boolean and the target
+    target = arguments[ i ] || {};
+    i++;
+  }
+
+  // Handle case when target is a string or something (possible in deep copy)
+  if ( typeof target !== "object" && !jQuery.isFunction( target ) ) {
+    target = {};
+  }
+
+  // Extend jQuery itself if only one argument is passed
+  if ( i === length ) {
+    target = this;
+    i--;
+  }
+
+  for ( ; i < length; i++ ) {
+
+    // Only deal with non-null/undefined values
+    if ( ( options = arguments[ i ] ) != null ) {
+
+      // Extend the base object
+      for ( name in options ) {
+        copy = options[ name ];
+
+        // Prevent Object.prototype pollution
+        // Prevent never-ending loop
+        if ( name === "__proto__" || target === copy ) {
+          continue;
+        }
+
+        // Recurse if we're merging plain objects or arrays
+        if ( deep && copy && ( jQuery.isPlainObject( copy ) ||
+          ( copyIsArray = Array.isArray( copy ) ) ) ) {
+          src = target[ name ];
+
+          // Ensure proper type for the source value
+          if ( copyIsArray && !Array.isArray( src ) ) {
+            clone = [];
+          } else if ( !copyIsArray && !jQuery.isPlainObject( src ) ) {
+            clone = {};
+          } else {
+            clone = src;
+          }
+          copyIsArray = false;
+
+          // Never move original objects, clone them
+          target[ name ] = jQuery.extend( deep, clone, copy );
+
+          // Don't bring in undefined values
+        } else if ( copy !== undefined ) {
+          target[ name ] = copy;
+        }
+      }
+    }
+  }
+
+  // Return the modified object
+  return target;
+};
+
+})(jQuery);

core/composer.json

@@ -20,9 +20,9 @@
         "php": "^5.5.9|>=7.0.8",
         "symfony/class-loader": "~3.4.0",
         "symfony/console": "~3.4.0",
-        "symfony/dependency-injection": "~3.4.0",
+        "symfony/dependency-injection": "~3.4.26",
         "symfony/event-dispatcher": "~3.4.0",
-        "symfony/http-foundation": "~3.4.14",
+        "symfony/http-foundation": "~3.4.26",
         "symfony/http-kernel": "~3.4.14",
         "symfony/routing": "~3.4.0",
         "symfony/serializer": "~3.4.0",

core/core.libraries.yml

@@ -348,6 +348,9 @@ jquery:
     gpl-compatible: true
   js:
     assets/vendor/jquery/jquery.min.js: { minified: true, weight: -20 }
+    # This includes a security fix, so assign a weight that makes this load as
+    # soon after jquery.min.js is loaded as possible.
+    assets/vendor/jquery/jquery-extend-3.4.0.js: { weight: -19 }
 
 jquery.cookie:
   remote: https://github.com/carhartl/jquery-cookie

core/lib/Drupal.php

@@ -82,7 +82,7 @@ class Drupal {
   /**
    * The current system version.
    */
-  const VERSION = '8.6.13';
+  const VERSION = '8.6.15';
 
   /**
    * Core API compatibility.

core/lib/Drupal/Core/Session/SessionManager.php

@@ -216,7 +216,9 @@ public function regenerate($destroy = FALSE, $lifetime = NULL) {
       throw new \InvalidArgumentException('The optional parameters $destroy and $lifetime of SessionManager::regenerate() are not supported currently');
     }
 
-    if ($this->isStarted()) {
+    // Only migrate the session if the session is really started and not only
+    // lazy started.
+    if ($this->started) {
       $old_session_id = $this->getId();
       // Save and close the old session. Call the parent method to avoid issue
       // with session destruction due to the session being considered obsolete.
@@ -340,4 +342,19 @@ protected function migrateStoredSession($old_session_id) {
       ->execute();
   }
 
+  /**
+   * Checks if the session is started.
+   *
+   * Beginning with symfony/http-foundation 3.4.24, the session will no longer
+   * save unless this method returns true. The parent method returns true if
+   * $this->started is true, but we need the session to also save if we lazy
+   * started, so we override isStarted() here.
+   *
+   * @return bool
+   *   True if started, false otherwise
+   */
+  public function isStarted() {
+    return parent::isStarted() || $this->startedLazy;
+  }
+
 }

core/modules/action/action.info.yml

@@ -6,8 +6,8 @@ package: Core
 # core: 8.x
 configure: entity.action.collection
 
-# Information added by Drupal.org packaging script on 2019-03-20
-version: '8.6.13'
+# Information added by Drupal.org packaging script on 2019-04-17
+version: '8.6.15'
 core: '8.x'
 project: 'drupal'
-datestamp: 1553100246
+datestamp: 1555533461

core/modules/action/tests/action_bulk_test/action_bulk_test.info.yml

@@ -9,8 +9,8 @@ dependencies:
   - drupal:views
   - drupal:node
 
-# Information added by Drupal.org packaging script on 2019-03-20
-version: '8.6.13'
+# Information added by Drupal.org packaging script on 2019-04-17
+version: '8.6.15'
 core: '8.x'
 project: 'drupal'
-datestamp: 1553100246
+datestamp: 1555533461

core/modules/action/tests/action_form_ajax_test/action_form_ajax_test.info.yml

@@ -6,8 +6,8 @@ package: Core
 # core: 8.x
 hidden: true
 
-# Information added by Drupal.org packaging script on 2019-03-20
-version: '8.6.13'
+# Information added by Drupal.org packaging script on 2019-04-17
+version: '8.6.15'
 core: '8.x'
 project: 'drupal'
-datestamp: 1553100246
+datestamp: 1555533461

core/modules/aggregator/aggregator.info.yml

@@ -9,8 +9,8 @@ dependencies:
   - drupal:file
   - drupal:options
 
-# Information added by Drupal.org packaging script on 2019-03-20
-version: '8.6.13'
+# Information added by Drupal.org packaging script on 2019-04-17
+version: '8.6.15'
 core: '8.x'
 project: 'drupal'
-datestamp: 1553100246
+datestamp: 1555533461

core/modules/aggregator/tests/modules/aggregator_test/aggregator_test.info.yml

@@ -5,8 +5,8 @@ package: Testing
 # version: VERSION
 # core: 8.x
 
-# Information added by Drupal.org packaging script on 2019-03-20
-version: '8.6.13'
+# Information added by Drupal.org packaging script on 2019-04-17
+version: '8.6.15'
 core: '8.x'
 project: 'drupal'
-datestamp: 1553100246
+datestamp: 1555533461

core/modules/aggregator/tests/modules/aggregator_test_views/aggregator_test_views.info.yml

@@ -8,8 +8,8 @@ dependencies:
   - drupal:aggregator
   - drupal:views
 
-# Information added by Drupal.org packaging script on 2019-03-20
-version: '8.6.13'
+# Information added by Drupal.org packaging script on 2019-04-17
+version: '8.6.15'
 core: '8.x'
 project: 'drupal'
-datestamp: 1553100246
+datestamp: 1555533461

core/modules/automated_cron/automated_cron.info.yml

@@ -6,8 +6,8 @@ package: Core
 # core: 8.x
 configure: system.cron_settings
 
-# Information added by Drupal.org packaging script on 2019-03-20
-version: '8.6.13'
+# Information added by Drupal.org packaging script on 2019-04-17
+version: '8.6.15'
 core: '8.x'
 project: 'drupal'
-datestamp: 1553100246
+datestamp: 1555533461

core/modules/ban/ban.info.yml

@@ -6,8 +6,8 @@ package: Core
 # core: 8.x
 configure: ban.admin_page
 
-# Information added by Drupal.org packaging script on 2019-03-20
-version: '8.6.13'
+# Information added by Drupal.org packaging script on 2019-04-17
+version: '8.6.15'
 core: '8.x'
 project: 'drupal'
-datestamp: 1553100246
+datestamp: 1555533461

core/modules/basic_auth/basic_auth.info.yml

@@ -7,8 +7,8 @@ package: Web services
 dependencies:
   - drupal:user
 
-# Information added by Drupal.org packaging script on 2019-03-20
-version: '8.6.13'
+# Information added by Drupal.org packaging script on 2019-04-17
+version: '8.6.15'
 core: '8.x'
 project: 'drupal'
-datestamp: 1553100246
+datestamp: 1555533461

core/modules/basic_auth/tests/modules/basic_auth_test/basic_auth_test.info.yml

@@ -5,8 +5,8 @@ package: Testing
 # version: VERSION
 # core: 8.x
 
-# Information added by Drupal.org packaging script on 2019-03-20
-version: '8.6.13'
+# Information added by Drupal.org packaging script on 2019-04-17
+version: '8.6.15'
 core: '8.x'
 project: 'drupal'
-datestamp: 1553100246
+datestamp: 1555533461

core/modules/big_pipe/big_pipe.info.yml

@@ -5,8 +5,8 @@ package: Core
 # version: VERSION
 # core: 8.x
 
-# Information added by Drupal.org packaging script on 2019-03-20
-version: '8.6.13'
+# Information added by Drupal.org packaging script on 2019-04-17
+version: '8.6.15'
 core: '8.x'
 project: 'drupal'
-datestamp: 1553100246
+datestamp: 1555533461

core/modules/big_pipe/tests/modules/big_pipe_regression_test/big_pipe_regression_test.info.yml

@@ -5,8 +5,8 @@ package: Testing
 # version: VERSION
 # core: 8.x
 
-# Information added by Drupal.org packaging script on 2019-03-20
-version: '8.6.13'
+# Information added by Drupal.org packaging script on 2019-04-17
+version: '8.6.15'
 core: '8.x'
 project: 'drupal'
-datestamp: 1553100246
+datestamp: 1555533461