govCMS / GovCMS7

Current stable release of the main Drupal 7 GovCMS distribution, with releases mirrored at https://www.drupal.org/project/govcms
https://www.govcms.gov.au/
GNU General Public License v2.0
113 stars 76 forks source link

[SA-CONTRIB-2019-034/035/036] Update views 7.x-3.21 (from 7.x-3.17) #842

Closed suhyeonh closed 5 years ago

suhyeonh commented 5 years ago

https://www.drupal.org/sa-contrib-2019-034

Views - Moderately critical - Information Disclosure - SA-CONTRIB-2019-034

https://www.drupal.org/sa-contrib-2019-035

Views - Moderately critical - Information disclosure - SA-CONTRIB-2019-035

https://www.drupal.org/sa-contrib-2019-036

Views - Less critical - Cross site scripting - SA-CONTRIB-2019-036

https://www.drupal.org/project/views/releases/7.x-3.21

Release notes This resolves issues for the following security advisories:

SA-CONTRIB-2019-034 SA-CONTRIB-2019-035 SA-CONTRIB-2019-036 No other changes are included.

Known issues A syntax regression was accidentally committed causing this release to not work with PHP 5.3. A solution is available and will be included in the next stable release, but we also recommend people upgrade their sites to newer releases of PHP.

https://www.drupal.org/project/views/releases/7.x-3.20

Release notes This fixes a critical bug in the last release, updating is recommended for all sites.

I am sincerely sorry for the oversight with renaming the hook - I did not think many modules would be using it, because of what it did, but I neglected to double-check my hypothesis before committing the change. Had I checked I would have realized that many critical modules used it - Features, Authcache, Webform, even the drupal.org custom code.

Changes since 7.x-3.19:

2725131 by esolitos: [regression] Revert renaming of hook_views_pre_view().

2071607 by joelpittet, andrewbelcher, Anybody: Saving a view causes the entire cache to be invalidated.

https://www.drupal.org/project/views/releases/7.x-3.19

Release notes PLEASE NOTE: This release includes a critical regression that was fixed in 7.x-3.20, please install that version instead.

This release includes a wealth of small fixes and improvements. Updating is suggested for all sites. Please open new issues for any regressions that are discovered. As always, a huge thank you to all of the contributors who made this release possible!

Change notices Views handlers and plugins now allow option definitions to be altered hook_views_pre_view() renamed to hook_views_prepreview() Contributors thekevinday, robertwb, steinmb, DamienMcKenna, joseph.olstad, chamilsanjeewa, Proteo, dawehner, steverweber, hubScrappy, tim.plunkett, colan, acbramley, stevector, merlinofchaos, sylus, seanB, scott.whittaker, matheushamonangan, drmabuse, bellerophons_pegasus, boombatower, dasha_v, eosrei, prinds, jamix, rbp, fadi.assaad, drupov, bmango, Countzero, darrenmothersele, ultimateboy, phiscock, JayDarnell, nicrodgers, David_Rothstein, hkirsman, drumm, MrHaroldA, AdamPS, fonant, zmove, phergo, jojonaloha, jantoine, Mav-im, jweowu, joanpebupe, shagren, fabio84, dsnopek, nvahalik, bardenjed, joegl, MustangGB, rudiedirkx, flaviovs, vistree, Neo13, wfragakis, introfini, bpleduc, marvin_B8, dikini, larsmw, Dinesh18, RenatoG, joelpittet, dsutter, gdaw, rsvelko, alan.cole, volkswagenchick, prafull.addweb, loopduplicate, willzyx, weri

Issues: 28 issues resolved.

Full changelog Changes since 7.x-3.18:

Bug

1331056 by thekevinday, robertwb, steinmb, DamienMcKenna, joseph.olstad, chamilsanjeewa, Proteo, dawehner, steverweber, hubScrappy, tim.plunkett, colan, acbramley, stevector, merlinofchaos, sylus, seanB, scott.whittaker, matheushamonangan, drmabuse_, bellerophons_pegasus: Regression: Improper use of GROUP BY statement produces ambiguous column error.

2725131 by DamienMcKenna, boombatower, dasha_v: Rename hook_views_pre_view() because it doesn't work as described

1417090 by eosrei, prinds, jamix, rbp, fadi.assaad, drupov, bmango, Countzero, dawehner, darrenmothersele: Taxonomy term "Representative node" views with filters and sorts don't work.

1875878 by DamienMcKenna, joseph.olstad, ultimateboy, phiscock, JayDarnell: User picture field doesn't have alt attribute when using non-default image style.

2476297 by nicrodgers, David_Rothstein: Views cache should be segmented based on content language, not just interface language.

1984694 by hkirsman, drumm: Increase weight #delta along with the number of grouped filters

2452655 by MrHaroldA, AdamPS, fonant, zmove: Defaults not working for grouped filter with multiple selections

2638220 by phergo, jojonaloha, jantoine, Mav-im, jweowu, joanpebupe, shagren, fabio84: "Content translation: Translations" relationship broken.

1264794 by dsnopek: Views exposed autocomplete + ajax view = form submit happens too early.

2295379 by DamienMcKenna, nvahalik, fonant, bmango, bardenjed, joegl: SQLSTATE[42S22]: Column not found: 1054 Unknown column 'users.uid1' in 'where clause'.

1995056 by bpleduc, marvin_B8: Exposed grouped filter gives WSOD+error "Cannot create references to/from string offsets nor overloaded objects".

2492687 by dikini: An infinite loop in include/handlers.inc can cause denial of service.

2921934 by DamienMcKenna: aggregator_views_data() contains two definitions for $data['aggregator_item']['iid'].

2904610 by larsmw, DamienMcKenna, Dinesh18, MustangGB, RenatoG: Unnecessarily microtime() call in views_block_view().

2834290 by larsmw, RenatoG: Unnecessary array copy in views_handler_field_field->set_items.

2862348 by DamienMcKenna, rsvelko, alan.cole: ajax_view.js is not compatible with jQuery 3+, use .length instead of .size().

2904559 by volkswagenchick, prafull.addweb, RenatoG, loopduplicate: Typo in views_plugin_pager_full::exposed_form_validate() error message.

2908538 by weri: Extras "OR" conditions not enclosed correctly.

2920737 by DamienMcKenna, MustangGB: Major code cleanup; resolved most of the coding standards violations, excluding class, method and property names.

Feature

2610418 by MustangGB, DamienMcKenna, rudiedirkx, flaviovs: Add option_definition alter to make all handlers & plugins more extensible.

Task

2684749 by vistree, Neo13, wfragakis, introfini: Error in views_handler_field_user_picture.inc if user picture fid exists but file cannot be loaded.

2946216 by DamienMcKenna: Remove usage of deprecrated each() function for PHP 7.2+ future proofing

2653214 by joelpittet, joseph.olstad, dsutter, gdaw: Replace views_include() with include_once.

2653266 by joelpittet, joseph.olstad, dsutter, gdaw: Avoid excess t() calls in field_views_field_default_views_data().

2760405 by joelpittet, joseph.olstad, dsutter, gdaw: Reduce the calls to the same t() in views_fetch_fields().

2760419 by joelpittet, joseph.olstad, DamienMcKenna, willzyx, dsutter: get_option() micro optimization by using isset() before array_key_exists().

2913993 by DamienMcKenna: Document how to run all of the tests in one go.

https://www.drupal.org/project/views/releases/7.x-3.18

Release notes This release fixes a number of bugs, several of them regressions from previous releases. No security-related bugs are included in this release, but updating is still recommended. Please see the issue queue to identify other known regressions.

Thanks as always to our many contributors, and a special thanks to MustangGB for spending a lot of time triaging the issue queue.

All changes since 7.x-3.17:

2384395 by jonathan_hunt, krina.addweb, RenatoG: Typo in views pager full validation error message

2890079 by RenatoG: Fixed unused variables

2890367 by RenatoG: Update README file for new template of Drupal.org

2595333 by dbt102, cherebedov.s, dhruveshdtripathi, RenatoG: Add hook_help() implementation

2887227 by sumanthkumarc, Algarte, RenatoG: Display comments option not shown in row style options for node view

2890785 by RenatoG: Fixed pareview recomendations for Views UI

2838338 by RenatoG, RAWDESK, nico.knaepen: Pager more link opens in new window (target _blank)

2903006 by Stevel, DamienMcKenna: Fix tests for 7.x-3.x.

2852791 by akshay4627: Fixed: Undefined index: field_FIELDNAME in views_handler_filter_term_node_tid->exposed_validate().

2879960 by Jill L: The "extra" parameter in search_dataset must be an array like all other definitions.

2866370 by hargobind, Rudi Teschner, DamienMcKenna, schwarli4783, Dmitry Pogodaev, dotline, alzz, bohz, hartsak, loze, perarg, steveganz, sergei_brill, knalstaaf, berenddeboer, attisan, AlfTheCat, nironan, RoSk0, J-Lee, artis, drupalfan2, marco-s, hossein425: Join 'extras' should be an array.

fubarhouse commented 5 years ago

Note that the target version isn't what it needs to be to be included in the milestone. Please update it when you can.

pandaskii commented 5 years ago

PR itself looks good to me.

However, few regressions are required our attention: