7.x-1.14 Release

CHANGELOG.txt

 Drupal 7.xx, xxxx-xx-xx (development version)
 -----------------------
 
+Drupal 7.66, 2019-04-17
+-----------------------
+- Fixed security issues:
+   - SA-CORE-2019-006
+
 Drupal 7.65, 2019-03-20
 -----------------------
 - Fixed security issues:

includes/bootstrap.inc

@@ -8,7 +8,7 @@
 /**
  * The current system version.
  */
-define('VERSION', '7.65');
+define('VERSION', '7.66');
 
 /**
  * Core API compatibility.

misc/jquery-extend-3.4.0.js

+/**
+ * For jQuery versions less than 3.4.0, this replaces the jQuery.extend
+ * function with the one from jQuery 3.4.0, slightly modified (documented
+ * below) to be compatible with older jQuery versions and browsers.
+ *
+ * This provides the Object.prototype pollution vulnerability fix to Drupal
+ * installations running older jQuery versions, including the versions shipped
+ * with Drupal core and https://www.drupal.org/project/jquery_update.
+ *
+ * @see https://github.com/jquery/jquery/pull/4333
+ */
+
+(function (jQuery) {
+
+// Do not override jQuery.extend() if the jQuery version is already >=3.4.0.
+var versionParts = jQuery.fn.jquery.split('.');
+var majorVersion = parseInt(versionParts[0]);
+var minorVersion = parseInt(versionParts[1]);
+var patchVersion = parseInt(versionParts[2]);
+var isPreReleaseVersion = (patchVersion.toString() !== versionParts[2]);
+if (
+  (majorVersion > 3) ||
+  (majorVersion === 3 && minorVersion > 4) ||
+  (majorVersion === 3 && minorVersion === 4 && patchVersion > 0) ||
+  (majorVersion === 3 && minorVersion === 4 && patchVersion === 0 && !isPreReleaseVersion)
+) {
+  return;
+}
+
+/**
+ * This is almost verbatim copied from jQuery 3.4.0.
+ *
+ * Only two minor changes have been made:
+ * - The call to isFunction() is changed to jQuery.isFunction().
+ * - The two calls to Array.isArray() is changed to jQuery.isArray().
+ *
+ * The above two changes ensure compatibility with all older jQuery versions
+ * (1.4.4 - 3.3.1) and older browser versions (e.g., IE8).
+ */
+jQuery.extend = jQuery.fn.extend = function() {
+  var options, name, src, copy, copyIsArray, clone,
+    target = arguments[ 0 ] || {},
+    i = 1,
+    length = arguments.length,
+    deep = false;
+
+  // Handle a deep copy situation
+  if ( typeof target === "boolean" ) {
+    deep = target;
+
+    // Skip the boolean and the target
+    target = arguments[ i ] || {};
+    i++;
+  }
+
+  // Handle case when target is a string or something (possible in deep copy)
+  if ( typeof target !== "object" && !jQuery.isFunction( target ) ) {
+    target = {};
+  }
+
+  // Extend jQuery itself if only one argument is passed
+  if ( i === length ) {
+    target = this;
+    i--;
+  }
+
+  for ( ; i < length; i++ ) {
+
+    // Only deal with non-null/undefined values
+    if ( ( options = arguments[ i ] ) != null ) {
+
+      // Extend the base object
+      for ( name in options ) {
+        copy = options[ name ];
+
+        // Prevent Object.prototype pollution
+        // Prevent never-ending loop
+        if ( name === "__proto__" || target === copy ) {
+          continue;
+        }
+
+        // Recurse if we're merging plain objects or arrays
+        if ( deep && copy && ( jQuery.isPlainObject( copy ) ||
+          ( copyIsArray = jQuery.isArray( copy ) ) ) ) {
+          src = target[ name ];
+
+          // Ensure proper type for the source value
+          if ( copyIsArray && !jQuery.isArray( src ) ) {
+            clone = [];
+          } else if ( !copyIsArray && !jQuery.isPlainObject( src ) ) {
+            clone = {};
+          } else {
+            clone = src;
+          }
+          copyIsArray = false;
+
+          // Never move original objects, clone them
+          target[ name ] = jQuery.extend( deep, clone, copy );
+
+          // Don't bring in undefined values
+        } else if ( copy !== undefined ) {
+          target[ name ] = copy;
+        }
+      }
+    }
+  }
+
+  // Return the modified object
+  return target;
+};
+
+})(jQuery);

modules/system/system.install

@@ -3300,6 +3300,13 @@ function system_update_7081() {
     ->execute();
 }
 
+/**
+ * Add 'jquery-extend-3.4.0.js' to the 'jquery' library.
+ */
+function system_update_7082() {
+  // Empty update to force a rebuild of hook_library() and JS aggregates.
+}
+
 /**
  * @} End of "defgroup updates-7.x-extra".
  * The next series of updates should start at 8000.

modules/system/system.module

@@ -1182,6 +1182,9 @@ function system_library() {
     'version' => '1.4.4',
     'js' => array(
       'misc/jquery.js' => array('group' => JS_LIBRARY, 'weight' => -20),
+      // This includes a security fix, so assign a weight that makes this load
+      // as soon after jquery.js is loaded as possible.
+      'misc/jquery-extend-3.4.0.js' => array('group' => JS_LIBRARY, 'weight' => -19),
     ),
   );
 

profiles/wcm_base/CHANGELOG.txt

+WCM Base 7.x-1.14-rc3, 2019-04-14
+---------------------------------
+- WCM Omega:
+  - Added panels layout 11a.
+  - Added margin below breadcrumbs.
+
 WCM Base 7.x-1.14-rc2, 2019-04-04
 ---------------------------------
 - OCIO Media: Added PDF mimetype to document type missing since Panopoly 1.65.

profiles/wcm_base/themes/wcm_omega/package.json

@@ -6,7 +6,9 @@
   "scripts": {
     "postinstall": "find node_modules -type f -name '*.info' | xargs rm"
   },
-  "dependencies": {},
+  "dependencies": {
+    "node-sass": "^4.11.0"
+  },
   "devDependencies": {
     "breakpoint-sass": "^2.6.1",
     "browser-sync": "^2.9.8",

profiles/wcm_base/themes/wcm_omega/panels/layouts/wcm-omega-layouts.css

@@ -28,7 +28,6 @@
   width: 100%;
 }
 
-
 .column-panel.column-left {
   float: left;
   clear: both;
@@ -38,8 +37,6 @@
   margin-right: 0;
 }
 
-
-
 /* tile rows */
 .tile-panel {
   float: left;
@@ -52,7 +49,6 @@
   margin-right: 0;
 }
 
-
 /* tile rows alternate (division of 5) */
 .tile-5 {
   width: 18%;
@@ -64,7 +60,6 @@
   margin-right: 0;
 }
 
-
 /* exceptions and overrides */
 .wcm-omega-8a .row-1 {
   margin-bottom: 1.5em;
@@ -72,12 +67,19 @@
 
 /* iPad or less */
 @media only screen and (max-width: 759px) {
-  .span2, .span3, .span4, .span6, .span8, .span9, .span10, .tile-5 {
+  .span2,
+  .span3,
+  .span4,
+  .span6,
+  .span8,
+  .span9,
+  .span10,
+  .tile-5 {
     width: 100%;
     float: none;
     margin-right: 0;
-  }  
-  
+  }
+
   .column-panel.column-right {
     margin-top: 30px;
   }