From 79f51a1478530aae17f9bcf5f17645b44dbc14cd Mon Sep 17 00:00:00 2001
From: "stefan.r" <stefan.r@551886.no-reply.drupal.org>
Date: Wed, 1 Feb 2017 16:37:14 -0500
Subject: [PATCH 01/29] Back to 7.x-dev

---
 CHANGELOG.txt          | 3 +++
 includes/bootstrap.inc | 2 +-
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/CHANGELOG.txt b/CHANGELOG.txt
index c015fb4fa2b..76c2e693937 100644
--- a/CHANGELOG.txt
+++ b/CHANGELOG.txt
@@ -1,4 +1,7 @@
 
+Drupal 7.xx, xxxx-xx-xx (development version)
+-----------------------
+
 Drupal 7.54, 2017-02-01
 -----------------------
 - Modules are now able to define theme engines (API addition:
diff --git a/includes/bootstrap.inc b/includes/bootstrap.inc
index 99a5ac84dcf..36bd0facd16 100644
--- a/includes/bootstrap.inc
+++ b/includes/bootstrap.inc
@@ -8,7 +8,7 @@
 /**
  * The current system version.
  */
-define('VERSION', '7.54');
+define('VERSION', '7.55-dev');
 
 /**
  * Core API compatibility.

From 8008df236b80de0f202fd65537efb921fc5d528f Mon Sep 17 00:00:00 2001
From: David Rothstein <drothstein@gmail.com>
Date: Thu, 1 Jun 2017 19:02:31 -0400
Subject: [PATCH 02/29] Issue #2877243 by David_Rothstein, karoop,
 joseph.olstad, deminy: DATE_RFC7231 already defined in PHP 7.0.19 and 7.1.5

---
 CHANGELOG.txt          | 2 ++
 includes/bootstrap.inc | 7 ++++++-
 2 files changed, 8 insertions(+), 1 deletion(-)

diff --git a/CHANGELOG.txt b/CHANGELOG.txt
index 76c2e693937..7bd2405dbf6 100644
--- a/CHANGELOG.txt
+++ b/CHANGELOG.txt
@@ -1,6 +1,8 @@
 
 Drupal 7.xx, xxxx-xx-xx (development version)
 -----------------------
+- Fixed incompatibility with PHP versions 7.0.19 and 7.1.5 due to duplicate
+  DATE_RFC7231 definition.
 
 Drupal 7.54, 2017-02-01
 -----------------------
diff --git a/includes/bootstrap.inc b/includes/bootstrap.inc
index 36bd0facd16..755c74f84f1 100644
--- a/includes/bootstrap.inc
+++ b/includes/bootstrap.inc
@@ -254,8 +254,13 @@ define('DRUPAL_PHP_FUNCTION_PATTERN', '[a-zA-Z_\x7f-\xff][a-zA-Z0-9_\x7f-\xff]*'
  * http://tools.ietf.org/html/rfc7231#section-7.1.1.1
  *
  * Example: Sun, 06 Nov 1994 08:49:37 GMT
+ *
+ * This constant was introduced in PHP 7.0.19 and PHP 7.1.5 but needs to be
+ * defined by Drupal for earlier PHP versions.
  */
-define('DATE_RFC7231', 'D, d M Y H:i:s \G\M\T');
+if (!defined('DATE_RFC7231')) {
+  define('DATE_RFC7231', 'D, d M Y H:i:s \G\M\T');
+}
 
 /**
  * Provides a caching wrapper to be used in place of large array structures.

From 370fd890d80232166edf1f286e367f9e771c0bbb Mon Sep 17 00:00:00 2001
From: David Rothstein <drothstein@gmail.com>
Date: Thu, 1 Jun 2017 19:06:24 -0400
Subject: [PATCH 03/29] Issue #2880700 by David_Rothstein, cilefen, mpdonadio,
 xjm, Mile23: UserTimeZoneFunctionalTest fails on recent versions of PHP 7 and
 7.1

---
 modules/user/user.test | 20 +++++++++++++-------
 1 file changed, 13 insertions(+), 7 deletions(-)

diff --git a/modules/user/user.test b/modules/user/user.test
index 63143c3ced9..8500bad3a4b 100644
--- a/modules/user/user.test
+++ b/modules/user/user.test
@@ -1529,7 +1529,13 @@ class UserTimeZoneFunctionalTest extends DrupalWebTestCase {
     // Setup date/time settings for Los Angeles time.
     variable_set('date_default_timezone', 'America/Los_Angeles');
     variable_set('configurable_timezones', 1);
-    variable_set('date_format_medium', 'Y-m-d H:i T');
+
+    // Override the 'medium' date format, which is the default for node
+    // creation time. Since we are testing time zones with Daylight Saving
+    // Time, and need to future proof against changes to the zoneinfo database,
+    // we choose the 'I' format placeholder instead of a human-readable zone
+    // name. With 'I', a 1 means the date is in DST, and 0 if not.
+    variable_set('date_format_medium', 'Y-m-d H:i I');
 
     // Create a user account and login.
     $web_user = $this->drupalCreateUser();
@@ -1547,11 +1553,11 @@ class UserTimeZoneFunctionalTest extends DrupalWebTestCase {
 
     // Confirm date format and time zone.
     $this->drupalGet("node/$node1->nid");
-    $this->assertText('2007-03-09 21:00 PST', 'Date should be PST.');
+    $this->assertText('2007-03-09 21:00 0', 'Date should be PST.');
     $this->drupalGet("node/$node2->nid");
-    $this->assertText('2007-03-11 01:00 PST', 'Date should be PST.');
+    $this->assertText('2007-03-11 01:00 0', 'Date should be PST.');
     $this->drupalGet("node/$node3->nid");
-    $this->assertText('2007-03-20 21:00 PDT', 'Date should be PDT.');
+    $this->assertText('2007-03-20 21:00 1', 'Date should be PDT.');
 
     // Change user time zone to Santiago time.
     $edit = array();
@@ -1562,11 +1568,11 @@ class UserTimeZoneFunctionalTest extends DrupalWebTestCase {
 
     // Confirm date format and time zone.
     $this->drupalGet("node/$node1->nid");
-    $this->assertText('2007-03-10 02:00 CLST', 'Date should be Chile summer time; five hours ahead of PST.');
+    $this->assertText('2007-03-10 02:00 1', 'Date should be Chile summer time; five hours ahead of PST.');
     $this->drupalGet("node/$node2->nid");
-    $this->assertText('2007-03-11 05:00 CLT', 'Date should be Chile time; four hours ahead of PST');
+    $this->assertText('2007-03-11 05:00 0', 'Date should be Chile time; four hours ahead of PST');
     $this->drupalGet("node/$node3->nid");
-    $this->assertText('2007-03-21 00:00 CLT', 'Date should be Chile time; three hours ahead of PDT.');
+    $this->assertText('2007-03-21 00:00 0', 'Date should be Chile time; three hours ahead of PDT.');
   }
 }
 

From 1531198741e170a5aff02c93ea302409b4b2e6e4 Mon Sep 17 00:00:00 2001
From: David Rothstein <drothstein@gmail.com>
Date: Thu, 1 Jun 2017 19:13:52 -0400
Subject: [PATCH 04/29] Issue #2850773 by alexpott: Fix tempnam() usage in PHP
 7.1

---
 modules/locale/locale.test | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/modules/locale/locale.test b/modules/locale/locale.test
index 6fcf06fe5e6..db87e05548c 100644
--- a/modules/locale/locale.test
+++ b/modules/locale/locale.test
@@ -819,7 +819,7 @@ class LocalePluralFormatTest extends DrupalWebTestCase {
    *   Additional options to pass to the translation import form.
    */
   function importPoFile($contents, array $options = array()) {
-    $name = tempnam('temporary://', "po_") . '.po';
+    $name = drupal_tempnam('temporary://', "po_") . '.po';
     file_put_contents($name, $contents);
     $options['files[file]'] = $name;
     $this->drupalPost('admin/config/regional/translate/import', $options, t('Import'));
@@ -1113,7 +1113,7 @@ class LocaleImportFunctionalTest extends DrupalWebTestCase {
    *   Additional options to pass to the translation import form.
    */
   function importPoFile($contents, array $options = array()) {
-    $name = tempnam('temporary://', "po_") . '.po';
+    $name = drupal_tempnam('temporary://', "po_") . '.po';
     file_put_contents($name, $contents);
     $options['files[file]'] = $name;
     $this->drupalPost('admin/config/regional/translate/import', $options, t('Import'));
@@ -1340,7 +1340,7 @@ class LocaleExportFunctionalTest extends DrupalWebTestCase {
   function testExportTranslation() {
     // First import some known translations.
     // This will also automatically enable the 'fr' language.
-    $name = tempnam('temporary://', "po_") . '.po';
+    $name = drupal_tempnam('temporary://', "po_") . '.po';
     file_put_contents($name, $this->getPoFile());
     $this->drupalPost('admin/config/regional/translate/import', array(
       'langcode' => 'fr',

From f73b791a2ff6e45b1da1bba9e4891b93257a76b1 Mon Sep 17 00:00:00 2001
From: David Rothstein <drothstein@gmail.com>
Date: Fri, 2 Jun 2017 17:10:14 -0400
Subject: [PATCH 05/29] Issue #2847325 by sammuell, John Morahan, mfb,
 sanduhrs, D34dMan, C_Logemann, xumepadismal, serg2, walterebert, David Grudl:
 Support RFC 5785 on Apache by whitelisting the .well-known directory

---
 .htaccess     | 4 ++--
 CHANGELOG.txt | 3 +++
 2 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/.htaccess b/.htaccess
index 440cabc6de0..3d6c2dd4418 100644
--- a/.htaccess
+++ b/.htaccess
@@ -3,7 +3,7 @@
 #
 
 # Protect files and directories from prying eyes.
-<FilesMatch "\.(engine|inc|info|install|make|module|profile|test|po|sh|.*sql|theme|tpl(\.php)?|xtmpl)(~|\.sw[op]|\.bak|\.orig|\.save)?$|^(\..*|Entries.*|Repository|Root|Tag|Template|composer\.(json|lock))$|^#.*#$|\.php(~|\.sw[op]|\.bak|\.orig\.save)$">
+<FilesMatch "\.(engine|inc|info|install|make|module|profile|test|po|sh|.*sql|theme|tpl(\.php)?|xtmpl)(~|\.sw[op]|\.bak|\.orig|\.save)?$|^(\.(?!well-known).*|Entries.*|Repository|Root|Tag|Template|composer\.(json|lock))$|^#.*#$|\.php(~|\.sw[op]|\.bak|\.orig\.save)$">
   Order allow,deny
 </FilesMatch>
 
@@ -80,7 +80,7 @@ DirectoryIndex index.php index.html index.htm
   # If you do not have mod_rewrite installed, you should remove these
   # directories from your webroot or otherwise protect them from being
   # downloaded.
-  RewriteRule "(^|/)\." - [F]
+  RewriteRule "/\.|^\.(?!well-known/)" - [F]
 
   # If your site can be accessed both with and without the 'www.' prefix, you
   # can use one of the following settings to redirect users to your preferred
diff --git a/CHANGELOG.txt b/CHANGELOG.txt
index 7bd2405dbf6..8963a898d29 100644
--- a/CHANGELOG.txt
+++ b/CHANGELOG.txt
@@ -3,6 +3,9 @@ Drupal 7.xx, xxxx-xx-xx (development version)
 -----------------------
 - Fixed incompatibility with PHP versions 7.0.19 and 7.1.5 due to duplicate
   DATE_RFC7231 definition.
+- Allowed services such as Let's Encrypt to work with Drupal on Apache, by
+  making Drupal's .htaccess file allow access to the .well-known directory
+  defined by RFC 5785.
 
 Drupal 7.54, 2017-02-01
 -----------------------

From c55fe935e5c6dfc629c0a74d07d4c1d880f460eb Mon Sep 17 00:00:00 2001
From: David Rothstein <drothstein@gmail.com>
Date: Fri, 2 Jun 2017 17:27:35 -0400
Subject: [PATCH 06/29] Issue #2819787 by chiranjeeb2410, shashikant_chauhan,
 stefan.r, Kartagis, naveenvalecha: The install message referencing
 insufficient PDO drivers links to the wrong documentation page

---
 modules/system/system.install | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/system/system.install b/modules/system/system.install
index ae55b892fed..d5e67435d8d 100644
--- a/modules/system/system.install
+++ b/modules/system/system.install
@@ -160,7 +160,7 @@ function system_requirements($phase) {
       if (empty($drivers)) {
         $database_ok = FALSE;
         $pdo_message = $t('Your web server does not appear to support any common PDO database extensions. Check with your hosting provider to see if they support PDO (PHP Data Objects) and offer any databases that <a href="@drupal-databases">Drupal supports</a>.', array(
-          '@drupal-databases' => 'http://drupal.org/node/270#database',
+          '@drupal-databases' => 'https://www.drupal.org/requirements/database',
         ));
       }
       // Make sure the native PDO extension is available, not the older PEAR

From 833779ebf54b5ad16398bdc184ddd3ba79be18e1 Mon Sep 17 00:00:00 2001
From: David Rothstein <drothstein@gmail.com>
Date: Fri, 2 Jun 2017 17:31:22 -0400
Subject: [PATCH 07/29] Issue #1886868 by IRuslan, zvse: Unused
 $original_destination variable in file_unmanaged_copy()

---
 includes/file.inc | 1 -
 1 file changed, 1 deletion(-)

diff --git a/includes/file.inc b/includes/file.inc
index de9d17d6916..7157ea90164 100644
--- a/includes/file.inc
+++ b/includes/file.inc
@@ -889,7 +889,6 @@ function file_valid_uri($uri) {
  */
 function file_unmanaged_copy($source, $destination = NULL, $replace = FILE_EXISTS_RENAME) {
   $original_source = $source;
-  $original_destination = $destination;
 
   // Assert that the source file actually exists.
   if (!file_exists($source)) {

From 950e45648154241f503f577bd76ecbbb7a9b8c74 Mon Sep 17 00:00:00 2001
From: David Rothstein <drothstein@gmail.com>
Date: Fri, 2 Jun 2017 17:33:13 -0400
Subject: [PATCH 08/29] Issue #2851665 by tameeshb: In the database schema.inc
 file, the class DatabaseSchema has no class documentation block

---
 includes/database/schema.inc | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/includes/database/schema.inc b/includes/database/schema.inc
index d8344c62696..8461350730f 100644
--- a/includes/database/schema.inc
+++ b/includes/database/schema.inc
@@ -164,6 +164,9 @@ require_once dirname(__FILE__) . '/query.inc';
  * @see drupal_install_schema()
  */
 
+/**
+ * Base class for database schema definitions.
+ */
 abstract class DatabaseSchema implements QueryPlaceholderInterface {
 
   protected $connection;

From 5abd299fb91a91361626f1c1362be03e4c6b2a1b Mon Sep 17 00:00:00 2001
From: David Rothstein <drothstein@gmail.com>
Date: Fri, 2 Jun 2017 17:38:40 -0400
Subject: [PATCH 09/29] Issue #1854074 by jp.stacey, jhodgdon, kiwimind:
 Docblock in field.tpl.php needs clarification in its reference to theme_field

---
 modules/field/theme/field.tpl.php | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/modules/field/theme/field.tpl.php b/modules/field/theme/field.tpl.php
index f0f9d583ffe..460fd2e266e 100644
--- a/modules/field/theme/field.tpl.php
+++ b/modules/field/theme/field.tpl.php
@@ -4,8 +4,10 @@
  * @file field.tpl.php
  * Default template implementation to display the value of a field.
  *
- * This file is not used and is here as a starting point for customization only.
- * @see theme_field()
+ * This file is not used by Drupal core, which uses theme functions instead for
+ * performance reasons. The markup is the same, though, so if you want to use
+ * template files rather than functions to extend field theming, copy this to
+ * your custom theme. See theme_field() for a discussion of performance.
  *
  * Available variables:
  * - $items: An array of field values. Use render() to output them.
@@ -45,7 +47,7 @@
  */
 ?>
 <!--
-THIS FILE IS NOT USED AND IS HERE AS A STARTING POINT FOR CUSTOMIZATION ONLY.
+This file is not used by Drupal core, which uses theme functions instead.
 See http://api.drupal.org/api/function/theme_field/7 for details.
 After copying this file to your theme's folder and customizing it, remove this
 HTML comment.

From 7edef74f71b06595de99651c47c97fabd76b2189 Mon Sep 17 00:00:00 2001
From: "stefan.r" <stefan.r@551886.no-reply.drupal.org>
Date: Mon, 5 Jun 2017 11:25:11 +0200
Subject: [PATCH 10/29] Issue #2870289 by markcarver: file_ajax_upload() causes
 malformed Drupal.settings

---
 CHANGELOG.txt            | 1 +
 modules/file/file.module | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/CHANGELOG.txt b/CHANGELOG.txt
index 8963a898d29..9eedfdde5f6 100644
--- a/CHANGELOG.txt
+++ b/CHANGELOG.txt
@@ -6,6 +6,7 @@ Drupal 7.xx, xxxx-xx-xx (development version)
 - Allowed services such as Let's Encrypt to work with Drupal on Apache, by
   making Drupal's .htaccess file allow access to the .well-known directory
   defined by RFC 5785.
+- Several bug fixes.
 
 Drupal 7.54, 2017-02-01
 -----------------------
diff --git a/modules/file/file.module b/modules/file/file.module
index 18ed2654eb4..c8e17f85834 100644
--- a/modules/file/file.module
+++ b/modules/file/file.module
@@ -283,7 +283,7 @@ function file_ajax_upload() {
   $form['#prefix'] .= theme('status_messages');
   $output = drupal_render($form);
   $js = drupal_add_js();
-  $settings = call_user_func_array('array_merge_recursive', $js['settings']['data']);
+  $settings = drupal_array_merge_deep_array($js['settings']['data']);
 
   $commands[] = ajax_command_replace(NULL, $output, $settings);
   return array('#type' => 'ajax', '#commands' => $commands);

From c9493f51e6a383e6b27c1fcb828b2c52c0e9ab27 Mon Sep 17 00:00:00 2001
From: "stefan.r" <stefan.r@551886.no-reply.drupal.org>
Date: Mon, 5 Jun 2017 11:25:33 +0200
Subject: [PATCH 11/29] Issue #2883202 by David_Rothstein: Statistics module
 subtracts an empty string from an integer, causing PHP 7.1 test failures

---
 modules/statistics/statistics.module | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/statistics/statistics.module b/modules/statistics/statistics.module
index b2561d24b5c..356a0e25135 100644
--- a/modules/statistics/statistics.module
+++ b/modules/statistics/statistics.module
@@ -245,7 +245,7 @@ function statistics_user_delete($account) {
  * Implements hook_cron().
  */
 function statistics_cron() {
-  $statistics_timestamp = variable_get('statistics_day_timestamp', '');
+  $statistics_timestamp = variable_get('statistics_day_timestamp', 0);
 
   if ((REQUEST_TIME - $statistics_timestamp) >= 86400) {
     // Reset day counts.

From 5314ffd6bd7b2892fd67372638df27342e096625 Mon Sep 17 00:00:00 2001
From: David Rothstein <drothstein@gmail.com>
Date: Mon, 5 Jun 2017 09:45:28 -0400
Subject: [PATCH 12/29] Add issue #2883202 to CHANGELOG.txt.

---
 CHANGELOG.txt | 1 +
 1 file changed, 1 insertion(+)

diff --git a/CHANGELOG.txt b/CHANGELOG.txt
index 9eedfdde5f6..cf0a4d9c1bf 100644
--- a/CHANGELOG.txt
+++ b/CHANGELOG.txt
@@ -3,6 +3,7 @@ Drupal 7.xx, xxxx-xx-xx (development version)
 -----------------------
 - Fixed incompatibility with PHP versions 7.0.19 and 7.1.5 due to duplicate
   DATE_RFC7231 definition.
+- Made Drupal core pass all automated tests on PHP 7.1.
 - Allowed services such as Let's Encrypt to work with Drupal on Apache, by
   making Drupal's .htaccess file allow access to the .well-known directory
   defined by RFC 5785.

From cf56426868d9dcf0f104f85879153989443435db Mon Sep 17 00:00:00 2001
From: David Rothstein <drothstein@gmail.com>
Date: Mon, 5 Jun 2017 09:51:13 -0400
Subject: [PATCH 13/29] Issue #2807393 by armrus, joseph.olstad,
 pankajchaudhari: Console error on Firefox due to redeclared function argument
 in Drupal.formatPlural

---
 misc/drupal.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/misc/drupal.js b/misc/drupal.js
index 03eef50edc9..2f03ec7ce64 100644
--- a/misc/drupal.js
+++ b/misc/drupal.js
@@ -251,7 +251,7 @@ Drupal.t = function (str, args, options) {
  *   A translated string.
  */
 Drupal.formatPlural = function (count, singular, plural, args, options) {
-  var args = args || {};
+  args = args || {};
   args['@count'] = count;
   // Determine the index of the plural form.
   var index = Drupal.locale.pluralFormula ? Drupal.locale.pluralFormula(args['@count']) : ((args['@count'] == 1) ? 0 : 1);

From ed5ad0faabe389460f425480fe5d595e3f1c8741 Mon Sep 17 00:00:00 2001
From: David Rothstein <drothstein@gmail.com>
Date: Mon, 5 Jun 2017 13:01:35 -0400
Subject: [PATCH 14/29] Issue #2289867 by joseph.olstad, jamesrward, dman,
 superspring, legolasbo, bceyssens, mdeletter, anrikun, Damien Tournoud: W3C
 HTML5 Validation error with PHP array-based query-strings built with url()
 containing [ ] characters

---
 CHANGELOG.txt                        | 2 ++
 includes/common.inc                  | 2 +-
 modules/simpletest/tests/common.test | 2 +-
 3 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/CHANGELOG.txt b/CHANGELOG.txt
index cf0a4d9c1bf..a5d591c0ebe 100644
--- a/CHANGELOG.txt
+++ b/CHANGELOG.txt
@@ -7,6 +7,8 @@ Drupal 7.xx, xxxx-xx-xx (development version)
 - Allowed services such as Let's Encrypt to work with Drupal on Apache, by
   making Drupal's .htaccess file allow access to the .well-known directory
   defined by RFC 5785.
+- Fixed Drupal's URL-generating functions to always encode '[' and ']' so that
+  the URLs will pass HTML5 validation.
 - Several bug fixes.
 
 Drupal 7.54, 2017-02-01
diff --git a/includes/common.inc b/includes/common.inc
index da8996a1b9a..a32930a519a 100644
--- a/includes/common.inc
+++ b/includes/common.inc
@@ -487,7 +487,7 @@ function drupal_http_build_query(array $query, $parent = '') {
   $params = array();
 
   foreach ($query as $key => $value) {
-    $key = ($parent ? $parent . '[' . rawurlencode($key) . ']' : rawurlencode($key));
+    $key = $parent ? $parent . rawurlencode('[' . $key . ']') : rawurlencode($key);
 
     // Recurse into children.
     if (is_array($value)) {
diff --git a/modules/simpletest/tests/common.test b/modules/simpletest/tests/common.test
index 0f991c3c740..83161fad959 100644
--- a/modules/simpletest/tests/common.test
+++ b/modules/simpletest/tests/common.test
@@ -169,7 +169,7 @@ class CommonURLUnitTest extends DrupalWebTestCase {
     $this->assertEqual(drupal_http_build_query(array('a' => ' &#//+%20@۞')), 'a=%20%26%23//%2B%2520%40%DB%9E', 'Value was properly encoded.');
     $this->assertEqual(drupal_http_build_query(array(' &#//+%20@۞' => 'a')), '%20%26%23%2F%2F%2B%2520%40%DB%9E=a', 'Key was properly encoded.');
     $this->assertEqual(drupal_http_build_query(array('a' => '1', 'b' => '2', 'c' => '3')), 'a=1&b=2&c=3', 'Multiple values were properly concatenated.');
-    $this->assertEqual(drupal_http_build_query(array('a' => array('b' => '2', 'c' => '3'), 'd' => 'foo')), 'a[b]=2&a[c]=3&d=foo', 'Nested array was properly encoded.');
+    $this->assertEqual(drupal_http_build_query(array('a' => array('b' => '2', 'c' => '3'), 'd' => 'foo')), 'a%5Bb%5D=2&a%5Bc%5D=3&d=foo', 'Nested array was properly encoded.');
   }
 
   /**

From f5df7abbfaaf15cccd346bcad6b44698b179502c Mon Sep 17 00:00:00 2001
From: David Rothstein <drothstein@gmail.com>
Date: Mon, 5 Jun 2017 13:38:13 -0400
Subject: [PATCH 15/29] =?UTF-8?q?Issue=20#2182265=20by=20Sweetchuck,=20jos?=
 =?UTF-8?q?eph.olstad,=20nod=5F,=20andrejsmuzikovs,=20G=C3=A1bor=20Hojtsy,?=
 =?UTF-8?q?=20droplet,=20mr.baileys:=20Drupal.t()=20placeholder=20substitu?=
 =?UTF-8?q?tion=20doesn't=20always=20work=20correctly?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 misc/drupal.js | 83 +++++++++++++++++++++++++++++++++++++++++---------
 1 file changed, 68 insertions(+), 15 deletions(-)

diff --git a/misc/drupal.js b/misc/drupal.js
index 2f03ec7ce64..d86ea1faebb 100644
--- a/misc/drupal.js
+++ b/misc/drupal.js
@@ -168,23 +168,76 @@ Drupal.checkPlain = function (str) {
 Drupal.formatString = function(str, args) {
   // Transform arguments before inserting them.
   for (var key in args) {
-    switch (key.charAt(0)) {
-      // Escaped only.
-      case '@':
-        args[key] = Drupal.checkPlain(args[key]);
-      break;
-      // Pass-through.
-      case '!':
-        break;
-      // Escaped and placeholder.
-      case '%':
-      default:
-        args[key] = Drupal.theme('placeholder', args[key]);
-        break;
+    if (args.hasOwnProperty(key)) {
+      switch (key.charAt(0)) {
+        // Escaped only.
+        case '@':
+          args[key] = Drupal.checkPlain(args[key]);
+          break;
+        // Pass-through.
+        case '!':
+          break;
+        // Escaped and placeholder.
+        default:
+          args[key] = Drupal.theme('placeholder', args[key]);
+          break;
+      }
     }
-    str = str.replace(key, args[key]);
   }
-  return str;
+
+  return Drupal.stringReplace(str, args, null);
+};
+
+/**
+ * Replace substring.
+ *
+ * The longest keys will be tried first. Once a substring has been replaced,
+ * its new value will not be searched again.
+ *
+ * @param {String} str
+ *   A string with placeholders.
+ * @param {Object} args
+ *   Key-value pairs.
+ * @param {Array|null} keys
+ *   Array of keys from the "args".  Internal use only.
+ *
+ * @return {String}
+ *   Returns the replaced string.
+ */
+Drupal.stringReplace = function (str, args, keys) {
+  if (str.length === 0) {
+    return str;
+  }
+
+  // If the array of keys is not passed then collect the keys from the args.
+  if (!$.isArray(keys)) {
+    keys = [];
+    for (var k in args) {
+      if (args.hasOwnProperty(k)) {
+        keys.push(k);
+      }
+    }
+
+    // Order the keys by the character length. The shortest one is the first.
+    keys.sort(function (a, b) { return a.length - b.length; });
+  }
+
+  if (keys.length === 0) {
+    return str;
+  }
+
+  // Take next longest one from the end.
+  var key = keys.pop();
+  var fragments = str.split(key);
+
+  if (keys.length) {
+    for (var i = 0; i < fragments.length; i++) {
+      // Process each fragment with a copy of remaining keys.
+      fragments[i] = Drupal.stringReplace(fragments[i], args, keys.slice(0));
+    }
+  }
+
+  return fragments.join(args[key]);
 };
 
 /**

From de9aa2b7e0ce6b9ecec16aee6ecb16aa92d7399d Mon Sep 17 00:00:00 2001
From: David Rothstein <drothstein@gmail.com>
Date: Mon, 5 Jun 2017 17:45:55 -0400
Subject: [PATCH 16/29] Issue #1851530 by JvE, jcovington, tatarbj: Notice:
 Undefined index: status in _block_rehash()

---
 modules/block/block.module | 19 ++++++++-----------
 1 file changed, 8 insertions(+), 11 deletions(-)

diff --git a/modules/block/block.module b/modules/block/block.module
index 73e11621137..d68ea9e7a9a 100644
--- a/modules/block/block.module
+++ b/modules/block/block.module
@@ -432,23 +432,20 @@ function _block_rehash($theme = NULL) {
   drupal_alter('block_info', $current_blocks, $theme, $code_blocks);
   foreach ($current_blocks as $module => $module_blocks) {
     foreach ($module_blocks as $delta => $block) {
-      if (!isset($block['pages'])) {
-        // {block}.pages is type 'text', so it cannot have a
-        // default value, and not null, so we need to provide
-        // value if the module did not.
-        $block['pages']  = '';
-      }
-      // Make sure weight is set.
-      if (!isset($block['weight'])) {
-        $block['weight'] = 0;
-      }
+      // Make sure certain attributes are set.
+      $block += array(
+        'pages' => '',
+        'weight' => 0,
+        'status' => 0,
+      );
+      // Check for active blocks in regions that are not available.
       if (!empty($block['region']) && $block['region'] != BLOCK_REGION_NONE && !isset($regions[$block['region']]) && $block['status'] == 1) {
         drupal_set_message(t('The block %info was assigned to the invalid region %region and has been disabled.', array('%info' => $block['info'], '%region' => $block['region'])), 'warning');
         // Disabled modules are moved into the BLOCK_REGION_NONE later so no
         // need to move the block to another region.
         $block['status'] = 0;
       }
-      // Set region to none if not enabled and make sure status is set.
+      // Set region to none if not enabled.
       if (empty($block['status'])) {
         $block['status'] = 0;
         $block['region'] = BLOCK_REGION_NONE;

From 0528883b9e5146cbe57d6d2f5606d7ccb3824014 Mon Sep 17 00:00:00 2001
From: David Rothstein <drothstein@gmail.com>
Date: Tue, 6 Jun 2017 00:10:28 -0400
Subject: [PATCH 17/29] Issue #1823504 by axel.rutz, michalis.kambi, Sylvain
 Lecoy: Unit tests (descendants of DrupalUnitTestCase) do not work when
 default site language is not English

---
 modules/simpletest/drupal_web_test_case.php | 16 ++++++++++++++--
 1 file changed, 14 insertions(+), 2 deletions(-)

diff --git a/modules/simpletest/drupal_web_test_case.php b/modules/simpletest/drupal_web_test_case.php
index 51407991dd6..b78125e2249 100644
--- a/modules/simpletest/drupal_web_test_case.php
+++ b/modules/simpletest/drupal_web_test_case.php
@@ -719,11 +719,17 @@ function __construct($test_id = NULL) {
    * method.
    */
   protected function setUp() {
-    global $conf;
+    global $conf, $language;
 
     // Store necessary current values before switching to the test environment.
     $this->originalFileDirectory = variable_get('file_public_path', conf_path() . '/files');
 
+    // Set up English language.
+    $this->originalLanguage = $language;
+    $this->originalLanguageDefault = variable_get('language_default');
+    unset($conf['language_default']);
+    $language = language_default();
+
     // Reset all statics so that test is performed with a clean environment.
     drupal_static_reset();
 
@@ -764,7 +770,7 @@ protected function setUp() {
   }
 
   protected function tearDown() {
-    global $conf;
+    global $conf, $language;
 
     // Get back to the original connection.
     Database::removeConnection('default');
@@ -775,6 +781,12 @@ protected function tearDown() {
     if (isset($this->originalModuleList)) {
       module_list(TRUE, FALSE, FALSE, $this->originalModuleList);
     }
+
+    // Reset language.
+    $language = $this->originalLanguage;
+    if ($this->originalLanguageDefault) {
+      $GLOBALS['conf']['language_default'] = $this->originalLanguageDefault;
+    }
   }
 }
 

From ff27da6b35d70cfd601994394fab378ff1df3efb Mon Sep 17 00:00:00 2001
From: David Rothstein <drothstein@gmail.com>
Date: Tue, 6 Jun 2017 00:15:04 -0400
Subject: [PATCH 18/29] Issue #1599774 by longwave, ben.bunk, Rob C, stefan.r,
 David_Rothstein, BTMash, kristofferwiklund, marcingy, mpdonadio, DuneBL,
 serundeputy, Letharion, quicksketch, alexpott, J-Lee, Morbus Iff: Drupal
 fails to boot with 503 error and .htaccess protections do not work on Apache
 2.4 without mod_access_compat

---
 .htaccess         |  7 ++++++-
 CHANGELOG.txt     |  2 ++
 includes/file.inc | 13 ++++++++++++-
 3 files changed, 20 insertions(+), 2 deletions(-)

diff --git a/.htaccess b/.htaccess
index 3d6c2dd4418..37fce10d32a 100644
--- a/.htaccess
+++ b/.htaccess
@@ -4,7 +4,12 @@
 
 # Protect files and directories from prying eyes.
 <FilesMatch "\.(engine|inc|info|install|make|module|profile|test|po|sh|.*sql|theme|tpl(\.php)?|xtmpl)(~|\.sw[op]|\.bak|\.orig|\.save)?$|^(\.(?!well-known).*|Entries.*|Repository|Root|Tag|Template|composer\.(json|lock))$|^#.*#$|\.php(~|\.sw[op]|\.bak|\.orig\.save)$">
-  Order allow,deny
+  <IfModule mod_authz_core.c>
+    Require all denied
+  </IfModule>
+  <IfModule !mod_authz_core.c>
+    Order allow,deny
+  </IfModule>
 </FilesMatch>
 
 # Don't show directory listings for URLs which map to a directory.
diff --git a/CHANGELOG.txt b/CHANGELOG.txt
index a5d591c0ebe..559c98b8d8f 100644
--- a/CHANGELOG.txt
+++ b/CHANGELOG.txt
@@ -7,6 +7,8 @@ Drupal 7.xx, xxxx-xx-xx (development version)
 - Allowed services such as Let's Encrypt to work with Drupal on Apache, by
   making Drupal's .htaccess file allow access to the .well-known directory
   defined by RFC 5785.
+- Made new Drupal sites work correctly on Apache 2.4 when the mod_access_compat
+  Apache module is disabled.
 - Fixed Drupal's URL-generating functions to always encode '[' and ']' so that
   the URLs will pass HTML5 validation.
 - Several bug fixes.
diff --git a/includes/file.inc b/includes/file.inc
index 7157ea90164..6a580c3ef86 100644
--- a/includes/file.inc
+++ b/includes/file.inc
@@ -535,7 +535,18 @@ SetHandler Drupal_Security_Do_Not_Remove_See_SA_2006_006
 EOF;
 
   if ($private) {
-    $lines = "Deny from all\n\n" . $lines;
+    $lines = <<<EOF
+# Deny all requests from Apache 2.4+.
+<IfModule mod_authz_core.c>
+  Require all denied
+</IfModule>
+
+# Deny all requests from Apache 2.0-2.2.
+<IfModule !mod_authz_core.c>
+  Deny from all
+</IfModule>
+EOF
+    . "\n\n" . $lines;
   }
 
   return $lines;

From 039472e9dd657ce8aa2f9e5a3c4ab31e0f378364 Mon Sep 17 00:00:00 2001
From: David Rothstein <drothstein@gmail.com>
Date: Tue, 6 Jun 2017 00:41:24 -0400
Subject: [PATCH 19/29] Issue #1611430 by Berdir, brad.bulger, Stevel, sun,
 catch: Verbose debug output in unit tests relies on the database

---
 modules/simpletest/drupal_web_test_case.php | 16 ++++++++++++++--
 1 file changed, 14 insertions(+), 2 deletions(-)

diff --git a/modules/simpletest/drupal_web_test_case.php b/modules/simpletest/drupal_web_test_case.php
index b78125e2249..3124ffe82a8 100644
--- a/modules/simpletest/drupal_web_test_case.php
+++ b/modules/simpletest/drupal_web_test_case.php
@@ -39,6 +39,13 @@ abstract class DrupalTestCase {
    */
   protected $originalFileDirectory = NULL;
 
+  /**
+   * URL to the verbose output file directory.
+   *
+   * @var string
+   */
+  protected $verboseDirectoryUrl;
+
   /**
    * Time limit for the test.
    */
@@ -461,8 +468,11 @@ protected function error($message = '', $group = 'Other', array $caller = NULL)
   protected function verbose($message) {
     if ($id = simpletest_verbose($message)) {
       $class_safe = str_replace('\\', '_', get_class($this));
-      $url = file_create_url($this->originalFileDirectory . '/simpletest/verbose/' . $class_safe . '-' . $id . '.html');
-      $this->error(l(t('Verbose message'), $url, array('attributes' => array('target' => '_blank'))), 'User notice');
+      $url = $this->verboseDirectoryUrl . '/' . $class_safe . '-' . $id . '.html';
+      // Not using l() to avoid invoking the theme system, so that unit tests
+      // can use verbose() as well.
+      $link = '<a href="' . $url . '" target="_blank">' . t('Verbose message') . '</a>';
+      $this->error($link, 'User notice');
     }
   }
 
@@ -723,6 +733,7 @@ protected function setUp() {
 
     // Store necessary current values before switching to the test environment.
     $this->originalFileDirectory = variable_get('file_public_path', conf_path() . '/files');
+    $this->verboseDirectoryUrl = file_create_url($this->originalFileDirectory . '/simpletest/verbose');
 
     // Set up English language.
     $this->originalLanguage = $language;
@@ -1393,6 +1404,7 @@ protected function prepareEnvironment() {
     $this->originalLanguageUrl = $language_url;
     $this->originalLanguageDefault = variable_get('language_default');
     $this->originalFileDirectory = variable_get('file_public_path', conf_path() . '/files');
+    $this->verboseDirectoryUrl = file_create_url($this->originalFileDirectory . '/simpletest/verbose');
     $this->originalProfile = drupal_get_profile();
     $this->originalCleanUrl = variable_get('clean_url', 0);
     $this->originalUser = $user;

From 694c9fe1c9d59f515ca39b4b5d9e6fd5a07cd2f4 Mon Sep 17 00:00:00 2001
From: David Rothstein <drothstein@gmail.com>
Date: Tue, 6 Jun 2017 01:25:43 -0400
Subject: [PATCH 20/29] Issue #348815 by twistor, aerozeppelin, xjm, PROMES,
 nileema.jadhav, Jill L: Remove category from feed and feed items when
 category is deleted

---
 modules/aggregator/aggregator.module |  8 ++++++
 modules/aggregator/aggregator.test   | 38 +++++++++++++++++++++++++++-
 2 files changed, 45 insertions(+), 1 deletion(-)

diff --git a/modules/aggregator/aggregator.module b/modules/aggregator/aggregator.module
index 70f8c5cd828..02c9ec46a99 100644
--- a/modules/aggregator/aggregator.module
+++ b/modules/aggregator/aggregator.module
@@ -455,6 +455,14 @@ function aggregator_save_category($edit) {
       db_delete('aggregator_category')
         ->condition('cid', $edit['cid'])
         ->execute();
+      // Remove category from feeds.
+      db_delete('aggregator_category_feed')
+        ->condition('cid', $edit['cid'])
+        ->execute();
+      // Remove category from feed items.
+      db_delete('aggregator_category_item')
+        ->condition('cid', $edit['cid'])
+        ->execute();
       // Make sure there is no active block for this category.
       if (module_exists('block')) {
         db_delete('block')
diff --git a/modules/aggregator/aggregator.test b/modules/aggregator/aggregator.test
index d84ee78526b..afa791d633b 100644
--- a/modules/aggregator/aggregator.test
+++ b/modules/aggregator/aggregator.test
@@ -418,7 +418,7 @@ class CategorizeFeedTestCase extends AggregatorTestCase {
   }
 
   /**
-   * Creates a feed and makes sure you can add more than one category to it.
+   * Creates a feed and makes sure you can add/delete categories to it.
    */
   function testCategorizeFeed() {
 
@@ -448,7 +448,31 @@ class CategorizeFeedTestCase extends AggregatorTestCase {
     // Assert the feed has two categories.
     $this->getFeedCategories($db_feed);
     $this->assertEqual(count($db_feed->categories), 2, 'Feed has 2 categories');
+
+    // Use aggregator_save_feed() to delete a category.
+    $category = reset($categories);
+    aggregator_save_category(array('cid' => $category->cid));
+
+    // Assert that category is deleted.
+    $db_category = db_query("SELECT COUNT(*) FROM {aggregator_category} WHERE cid = :cid", array(':cid' => $category->cid))->fetchField();
+    $this->assertFalse($db_category, format_string('The category %title has been deleted.', array('%title' => $category->title)));
+
+    // Assert that category has been removed from feed.
+    $categorized_feeds = db_query("SELECT COUNT(*) FROM {aggregator_category_feed} WHERE cid = :cid", array(':cid' => $category->cid))->fetchField();
+    $this->assertFalse($categorized_feeds, format_string('The category %title has been removed from feed %feed_title.', array('%title' => $category->title, '%feed_title' => $feed['title'])));
+
+    // Assert that no broken links (associated with the deleted category)
+    // appear on one of the other category pages.
+    $this->createSampleNodes();
+    $this->drupalGet('admin/config/services/aggregator');
+    $this->clickLink('update items');
+    $categories = $this->getCategories();
+    $category = reset($categories);
+    $this->drupalGet('aggregator/categories/' . $category->cid);
+    global $base_path;
+    $this->assertNoRaw('<a href="' . $base_path . 'aggregator/categories/"></a>,');
   }
+
 }
 
 /**
@@ -685,9 +709,21 @@ class CategorizeFeedItemTestCase extends AggregatorTestCase {
       }
     }
 
+    // Delete category from feed items when category is deleted.
+    $cid = reset($feed->categories);
+    $categories = $this->getCategories();
+    $category_title = $categories[$cid]->title;
+
+    // Delete category.
+    aggregator_save_category(array('cid' => $cid));
+
+    // Assert category has been removed from feed items.
+    $categorized_count = db_query("SELECT COUNT(*) FROM {aggregator_category_item} WHERE cid = :cid", array(':cid' => $cid))->fetchField();
+    $this->assertFalse($categorized_count, format_string('The category %title has been removed from feed items.', array('%title' => $category_title)));
     // Delete feed.
     $this->deleteFeed($feed);
   }
+
 }
 
 /**

From ef9608dc1d8b7ef0eaa7b76b07b64a16f73e3bbe Mon Sep 17 00:00:00 2001
From: David Rothstein <drothstein@gmail.com>
Date: Tue, 6 Jun 2017 01:40:45 -0400
Subject: [PATCH 21/29] Issue #2451449 by drumm: User's contact setting reverts
 to default when saving

---
 modules/contact/contact.module |  9 ++++++++-
 modules/contact/contact.test   | 22 ++++++++++++++++++++++
 2 files changed, 30 insertions(+), 1 deletion(-)

diff --git a/modules/contact/contact.module b/modules/contact/contact.module
index 9a48f23120e..9c6671a91d9 100644
--- a/modules/contact/contact.module
+++ b/modules/contact/contact.module
@@ -234,7 +234,14 @@ function contact_form_user_profile_form_alter(&$form, &$form_state) {
  * Implements hook_user_presave().
  */
 function contact_user_presave(&$edit, $account, $category) {
-  $edit['data']['contact'] = isset($edit['contact']) ? $edit['contact'] : variable_get('contact_default_status', 1);
+  if (isset($edit['contact'])) {
+    // Set new value.
+    $edit['data']['contact'] = $edit['contact'];
+  }
+  elseif (!isset($account->data['contact'])) {
+    // Use default if none has been set.
+    $edit['data']['contact'] = variable_get('contact_default_status', 1);
+  }
 }
 
 /**
diff --git a/modules/contact/contact.test b/modules/contact/contact.test
index 6693b574912..6a1674a0dfb 100644
--- a/modules/contact/contact.test
+++ b/modules/contact/contact.test
@@ -346,6 +346,28 @@ class ContactPersonalTestCase extends DrupalWebTestCase {
     $this->drupalGet('user/' . $this->contact_user->uid . '/contact');
     $this->assertResponse(200);
 
+    // Test that users can disable their contact form.
+    $this->drupalLogin($this->contact_user);
+    $edit = array('contact' => FALSE);
+    $this->drupalPost('user/' . $this->contact_user->uid . '/edit', $edit, 'Save');
+    $this->drupalLogout();
+    $this->drupalGet('user/' . $this->contact_user->uid . '/contact');
+    $this->assertResponse(403);
+
+    // Test that user's contact status stays disabled when saving.
+    $contact_user_temp = user_load($this->contact_user->uid, TRUE);
+    user_save($contact_user_temp);
+    $this->drupalGet('user/' . $this->contact_user->uid . '/contact');
+    $this->assertResponse(403);
+
+    // Test that users can enable their contact form.
+    $this->drupalLogin($this->contact_user);
+    $edit = array('contact' => TRUE);
+    $this->drupalPost('user/' . $this->contact_user->uid . '/edit', $edit, 'Save');
+    $this->drupalLogout();
+    $this->drupalGet('user/' . $this->contact_user->uid . '/contact');
+    $this->assertResponse(200);
+
     // Revoke the personal contact permission for the anonymous user.
     user_role_revoke_permissions(DRUPAL_ANONYMOUS_RID, array('access user contact forms'));
     $this->drupalGet('user/' . $this->contact_user->uid . '/contact');

From 948066265b8751b22e5014120ab74cf2c38eee70 Mon Sep 17 00:00:00 2001
From: David Rothstein <drothstein@gmail.com>
Date: Tue, 6 Jun 2017 01:57:06 -0400
Subject: [PATCH 22/29] Issue #2851725 by Jigar.addweb, tameeshb: Fix typos in
 various code comments in the includes directory

---
 includes/database/pgsql/database.inc | 12 ++++++------
 includes/database/pgsql/install.inc  |  2 +-
 includes/database/pgsql/select.inc   |  4 ++--
 includes/database/query.inc          |  2 +-
 includes/database/schema.inc         |  2 +-
 includes/database/sqlite/schema.inc  |  2 +-
 includes/errors.inc                  |  6 +++---
 7 files changed, 15 insertions(+), 15 deletions(-)

diff --git a/includes/database/pgsql/database.inc b/includes/database/pgsql/database.inc
index 41579659bfe..fb3d0ab5130 100644
--- a/includes/database/pgsql/database.inc
+++ b/includes/database/pgsql/database.inc
@@ -11,7 +11,7 @@
  */
 
 /**
- * The name by which to obtain a lock for retrive the next insert id.
+ * The name by which to obtain a lock for retrieving the next insert id.
  */
 define('POSTGRESQL_NEXTID_LOCK', 1000);
 
@@ -55,7 +55,7 @@ class DatabaseConnection_pgsql extends DatabaseConnection {
     $connection_options['pdo'] += array(
       // Prepared statements are most effective for performance when queries
       // are recycled (used several times). However, if they are not re-used,
-      // prepared statements become ineffecient. Since most of Drupal's
+      // prepared statements become inefficient. Since most of Drupal's
       // prepared queries are not re-used, it should be faster to emulate
       // the preparation than to actually ready statements for re-use. If in
       // doubt, reset to FALSE and measure performance.
@@ -175,14 +175,14 @@ class DatabaseConnection_pgsql extends DatabaseConnection {
   }
 
   /**
-   * Retrive a the next id in a sequence.
+   * Retrieve the next id in a sequence.
    *
    * PostgreSQL has built in sequences. We'll use these instead of inserting
    * and updating a sequences table.
    */
   public function nextId($existing = 0) {
 
-    // Retrive the name of the sequence. This information cannot be cached
+    // Retrieve the name of the sequence. This information cannot be cached
     // because the prefix may change, for example, like it does in simpletests.
     $sequence_name = $this->makeSequenceName('sequences', 'value');
 
@@ -194,7 +194,7 @@ class DatabaseConnection_pgsql extends DatabaseConnection {
     }
 
     // PostgreSQL advisory locks are simply locks to be used by an
-    // application such as Drupal. This will prevent other Drupal proccesses
+    // application such as Drupal. This will prevent other Drupal processes
     // from altering the sequence while we are.
     $this->query("SELECT pg_advisory_lock(" . POSTGRESQL_NEXTID_LOCK . ")");
 
@@ -209,7 +209,7 @@ class DatabaseConnection_pgsql extends DatabaseConnection {
     // Reset the sequence to a higher value than the existing id.
     $this->query("ALTER SEQUENCE " . $sequence_name . " RESTART WITH " . ($existing + 1));
 
-    // Retrive the next id. We know this will be as high as we want it.
+    // Retrieve the next id. We know this will be as high as we want it.
     $id = $this->query("SELECT nextval('" . $sequence_name . "')")->fetchField();
 
     $this->query("SELECT pg_advisory_unlock(" . POSTGRESQL_NEXTID_LOCK . ")");
diff --git a/includes/database/pgsql/install.inc b/includes/database/pgsql/install.inc
index c77f4ea78ce..122031ee5de 100644
--- a/includes/database/pgsql/install.inc
+++ b/includes/database/pgsql/install.inc
@@ -165,7 +165,7 @@ class DatabaseTasks_pgsql extends DatabaseTasks {
         LANGUAGE \'sql\''
       );
 
-      // Using || to concatenate in Drupal is not recommeneded because there are
+      // Using || to concatenate in Drupal is not recommended because there are
       // database drivers for Drupal that do not support the syntax, however
       // they do support CONCAT(item1, item2) which we can replicate in
       // PostgreSQL. PostgreSQL requires the function to be defined for each
diff --git a/includes/database/pgsql/select.inc b/includes/database/pgsql/select.inc
index f6a83db7f45..5b8736d6805 100644
--- a/includes/database/pgsql/select.inc
+++ b/includes/database/pgsql/select.inc
@@ -80,7 +80,7 @@ class SelectQuery_pgsql extends SelectQuery {
     }
 
     // If a table loads all fields, it can not be added again. It would
-    // result in an ambigious alias error because that field would be loaded
+    // result in an ambiguous alias error because that field would be loaded
     // twice: Once through table_alias.* and once directly. If the field
     // actually belongs to a different table, it must be added manually.
     foreach ($this->tables as $table) {
@@ -90,7 +90,7 @@ class SelectQuery_pgsql extends SelectQuery {
     }
 
     // If $field contains an characters which are not allowed in a field name
-    // it is considered an expression, these can't be handeld automatically
+    // it is considered an expression, these can't be handled automatically
     // either.
     if ($this->connection->escapeField($field) != $field) {
       return $return;
diff --git a/includes/database/query.inc b/includes/database/query.inc
index c9c5a8328a4..7ebe5eb4b62 100644
--- a/includes/database/query.inc
+++ b/includes/database/query.inc
@@ -1242,7 +1242,7 @@ class UpdateQuery extends Query implements QueryConditionInterface {
  * MergeQuery::updateFields() and MergeQuery::insertFields() needs to be called
  * instead. MergeQuery::fields() can also be called which calls both of these
  * methods as the common case is to use the same column-value pairs for both
- * INSERT and UPDATE. However, this is not mandatory. Another convinient
+ * INSERT and UPDATE. However, this is not mandatory. Another convenient
  * wrapper is MergeQuery::key() which adds the same column-value pairs to the
  * condition and the INSERT query part.
  *
diff --git a/includes/database/schema.inc b/includes/database/schema.inc
index 8461350730f..31862db3940 100644
--- a/includes/database/schema.inc
+++ b/includes/database/schema.inc
@@ -294,7 +294,7 @@ abstract class DatabaseSchema implements QueryPlaceholderInterface {
   protected function buildTableNameCondition($table_name, $operator = '=', $add_prefix = TRUE) {
     $info = $this->connection->getConnectionOptions();
 
-    // Retrive the table name and schema
+    // Retrieve the table name and schema
     $table_info = $this->getPrefixInfo($table_name, $add_prefix);
 
     $condition = new DatabaseCondition('AND');
diff --git a/includes/database/sqlite/schema.inc b/includes/database/sqlite/schema.inc
index df19d2fa54c..281d8fc6bf2 100644
--- a/includes/database/sqlite/schema.inc
+++ b/includes/database/sqlite/schema.inc
@@ -244,7 +244,7 @@ class DatabaseSchema_sqlite extends DatabaseSchema {
     // database. So the syntax '...RENAME TO database.table' would fail.
     // So we must determine the full table name here rather than surrounding
     // the table with curly braces incase the db_prefix contains a reference
-    // to a database outside of our existsing database.
+    // to a database outside of our existing database.
     $info = $this->getPrefixInfo($new_name);
     $this->connection->query('ALTER TABLE {' . $table . '} RENAME TO ' . $info['table']);
 
diff --git a/includes/errors.inc b/includes/errors.inc
index 7393148e9be..3548d1fd827 100644
--- a/includes/errors.inc
+++ b/includes/errors.inc
@@ -66,7 +66,7 @@ function _drupal_error_handler_real($error_level, $message, $filename, $line, $c
     _drupal_log_error(array(
       '%type' => isset($types[$error_level]) ? $severity_msg : 'Unknown error',
       // The standard PHP error handler considers that the error messages
-      // are HTML. We mimick this behavior here.
+      // are HTML. We mimic this behavior here.
       '!message' => filter_xss_admin($message),
       '%function' => $caller['function'],
       '%file' => $caller['file'],
@@ -114,7 +114,7 @@ function _drupal_decode_exception($exception) {
   return array(
     '%type' => get_class($exception),
     // The standard PHP exception handler considers that the exception message
-    // is plain-text. We mimick this behavior here.
+    // is plain-text. We mimic this behavior here.
     '!message' => check_plain($message),
     '%function' => $caller['function'],
     '%file' => $caller['file'],
@@ -233,7 +233,7 @@ function _drupal_log_error($error, $fatal = FALSE) {
   }
   else {
     // Display the message if the current error reporting level allows this type
-    // of message to be displayed, and unconditionnaly in update.php.
+    // of message to be displayed, and unconditionally in update.php.
     if (error_displayable($error)) {
       $class = 'error';
 

From 8a09ddd4e39d31ed61a67d9e11ab53f4a0fa5ffd Mon Sep 17 00:00:00 2001
From: David Rothstein <drothstein@gmail.com>
Date: Tue, 6 Jun 2017 03:21:47 -0400
Subject: [PATCH 23/29] Issue #2042239 by lucaslg, tbradbury, snehi, pkiraly,
 pjonckiere, oriol_e9g, ivanchaer, jhodgdon, chx, cilefen, David_Rothstein:
 Fix DeleteQuery::execute() return value documentation and DeleteQuery_sqlite
 documentation

---
 includes/database/query.inc        |  4 ++--
 includes/database/sqlite/query.inc | 13 ++++++-------
 2 files changed, 8 insertions(+), 9 deletions(-)

diff --git a/includes/database/query.inc b/includes/database/query.inc
index 7ebe5eb4b62..048c8a2654d 100644
--- a/includes/database/query.inc
+++ b/includes/database/query.inc
@@ -845,8 +845,8 @@ class DeleteQuery extends Query implements QueryConditionInterface {
   /**
    * Executes the DELETE query.
    *
-   * @return
-   *   The return value is dependent on the database connection.
+   * @return int
+   *   The number of rows affected by the delete query.
    */
   public function execute() {
     $values = array();
diff --git a/includes/database/sqlite/query.inc b/includes/database/sqlite/query.inc
index 1c6289bd71e..c9c028bb079 100644
--- a/includes/database/sqlite/query.inc
+++ b/includes/database/sqlite/query.inc
@@ -99,16 +99,15 @@ class UpdateQuery_sqlite extends UpdateQuery {
 
 /**
  * SQLite specific implementation of DeleteQuery.
- *
- * When the WHERE is omitted from a DELETE statement and the table being deleted
- * has no triggers, SQLite uses an optimization to erase the entire table content
- * without having to visit each row of the table individually.
- *
- * Prior to SQLite 3.6.5, SQLite does not return the actual number of rows deleted
- * by that optimized "truncate" optimization.
  */
 class DeleteQuery_sqlite extends DeleteQuery {
   public function execute() {
+    // When the WHERE is omitted from a DELETE statement and the table being
+    // deleted has no triggers, SQLite uses an optimization to erase the entire
+    // table content without having to visit each row of the table individually.
+    // Prior to SQLite 3.6.5, SQLite does not return the actual number of rows
+    // deleted by that optimized "truncate" optimization. But we want to return
+    // the number of rows affected, so we calculate it directly.
     if (!count($this->condition)) {
       $total_rows = $this->connection->query('SELECT COUNT(*) FROM {' . $this->connection->escapeTable($this->table) . '}')->fetchField();
       parent::execute();

From f72778cff50edf4b0b3ed61185ea6b454a1a4ca4 Mon Sep 17 00:00:00 2001
From: David Rothstein <drothstein@gmail.com>
Date: Tue, 6 Jun 2017 03:30:37 -0400
Subject: [PATCH 24/29] Issue #2853160 by hgoto, RenatoG: Variable $name is
 defined but not used in file_get_content_headers()

---
 includes/file.inc | 1 -
 1 file changed, 1 deletion(-)

diff --git a/includes/file.inc b/includes/file.inc
index 6a580c3ef86..fafc33da53a 100644
--- a/includes/file.inc
+++ b/includes/file.inc
@@ -2563,7 +2563,6 @@ function file_directory_temp() {
  *   An associative array of headers, as expected by file_transfer().
  */
 function file_get_content_headers($file) {
-  $name = mime_header_encode($file->filename);
   $type = mime_header_encode($file->filemime);
 
   return array(

From c58a1f14760fa30e749079cc53f0e541f423e7be Mon Sep 17 00:00:00 2001
From: David Rothstein <drothstein@gmail.com>
Date: Tue, 6 Jun 2017 03:37:19 -0400
Subject: [PATCH 25/29] Revert "Issue #2853160 by hgoto, RenatoG: Variable
 $name is defined but not used in file_get_content_headers()"

This reverts commit f72778cff50edf4b0b3ed61185ea6b454a1a4ca4.
---
 includes/file.inc | 1 +
 1 file changed, 1 insertion(+)

diff --git a/includes/file.inc b/includes/file.inc
index fafc33da53a..6a580c3ef86 100644
--- a/includes/file.inc
+++ b/includes/file.inc
@@ -2563,6 +2563,7 @@ function file_directory_temp() {
  *   An associative array of headers, as expected by file_transfer().
  */
 function file_get_content_headers($file) {
+  $name = mime_header_encode($file->filename);
   $type = mime_header_encode($file->filemime);
 
   return array(

From 8238d81c7e9f3617463935aa36d5995a22d04730 Mon Sep 17 00:00:00 2001
From: David Rothstein <drothstein@gmail.com>
Date: Tue, 6 Jun 2017 03:37:58 -0400
Subject: [PATCH 26/29] Issue #2853160 by hgoto, smaaz: Variable $name is
 defined but not used in file_get_content_headers()

---
 includes/file.inc | 1 -
 1 file changed, 1 deletion(-)

diff --git a/includes/file.inc b/includes/file.inc
index 6a580c3ef86..fafc33da53a 100644
--- a/includes/file.inc
+++ b/includes/file.inc
@@ -2563,7 +2563,6 @@ function file_directory_temp() {
  *   An associative array of headers, as expected by file_transfer().
  */
 function file_get_content_headers($file) {
-  $name = mime_header_encode($file->filename);
   $type = mime_header_encode($file->filemime);
 
   return array(

From 3047f785d569588cdf88a2efc88efab8cfd898c8 Mon Sep 17 00:00:00 2001
From: "stefan.r" <stefan.r@551886.no-reply.drupal.org>
Date: Tue, 6 Jun 2017 13:08:17 +0200
Subject: [PATCH 27/29] Issue #1858486 by idebr, David_Rothstein, trawekp,
 joseph.olstad, MrHaroldA, jhedstrom: Ajax call breaks Password Reset

---
 modules/user/user.module |  9 ++++---
 modules/user/user.test   | 56 ++++++++++++++++++++++++++++++++++++++++
 2 files changed, 62 insertions(+), 3 deletions(-)

diff --git a/modules/user/user.module b/modules/user/user.module
index b818d79ab57..12ca2800999 100644
--- a/modules/user/user.module
+++ b/modules/user/user.module
@@ -1088,13 +1088,16 @@ function user_account_form(&$form, &$form_state) {
       '#description' => t('To change the current user password, enter the new password in both fields.'),
     );
     // To skip the current password field, the user must have logged in via a
-    // one-time link and have the token in the URL.
-    $pass_reset = isset($_SESSION['pass_reset_' . $account->uid]) && isset($_GET['pass-reset-token']) && ($_GET['pass-reset-token'] == $_SESSION['pass_reset_' . $account->uid]);
+    // one-time link and have the token in the URL. Store this in $form_state
+    // so it persists even on subsequent Ajax requests.
+    if (!isset($form_state['user_pass_reset'])) {
+      $form_state['user_pass_reset'] = isset($_SESSION['pass_reset_' . $account->uid]) && isset($_GET['pass-reset-token']) && ($_GET['pass-reset-token'] == $_SESSION['pass_reset_' . $account->uid]);
+    }
     $protected_values = array();
     $current_pass_description = '';
     // The user may only change their own password without their current
     // password if they logged in via a one-time login link.
-    if (!$pass_reset) {
+    if (!$form_state['user_pass_reset']) {
       $protected_values['mail'] = $form['account']['mail']['#title'];
       $protected_values['pass'] = t('Password');
       $request_new = l(t('Request new password'), 'user/password', array('attributes' => array('title' => t('Request new password via e-mail.'))));
diff --git a/modules/user/user.test b/modules/user/user.test
index 8500bad3a4b..0875e0ac792 100644
--- a/modules/user/user.test
+++ b/modules/user/user.test
@@ -465,6 +465,19 @@ class UserPasswordResetTestCase extends DrupalWebTestCase {
     );
   }
 
+  /**
+   * Retrieves password reset email and extracts the login link.
+   */
+  public function getResetURL() {
+    // Assume the most recent email.
+    $_emails = $this->drupalGetMails();
+    $email = end($_emails);
+    $urls = array();
+    preg_match('#.+user/reset/.+#', $email['body'], $urls);
+
+    return $urls[0];
+  }
+
   /**
    * Tests password reset functionality.
    */
@@ -478,6 +491,49 @@ class UserPasswordResetTestCase extends DrupalWebTestCase {
     $this->drupalPost('user/password', $edit, t('E-mail new password'));
     // Confirm the password reset.
     $this->assertText(t('Further instructions have been sent to your e-mail address.'), 'Password reset instructions mailed message displayed.');
+
+    // Create an image field to enable an Ajax request on the user profile page.
+    $field = array(
+      'field_name' => 'field_avatar',
+      'type' => 'image',
+      'settings' => array(),
+      'cardinality' => 1,
+    );
+    field_create_field($field);
+
+    $instance = array(
+      'field_name' => $field['field_name'],
+      'entity_type' => 'user',
+      'label' => 'Avatar',
+      'bundle' => 'user',
+      'required' => FALSE,
+      'settings' => array(),
+      'widget' => array(
+        'type' => 'image_image',
+        'settings' => array(),
+      ),
+    );
+    field_create_instance($instance);
+
+    $resetURL = $this->getResetURL();
+    $this->drupalGet($resetURL);
+
+    // Check successful login.
+    $this->drupalPost(NULL, NULL, t('Log in'));
+
+    // Make sure the Ajax request from uploading a file does not invalidate the
+    // reset token.
+    $image = current($this->drupalGetTestFiles('image'));
+    $edit = array(
+      'files[field_avatar_und_0]' => drupal_realpath($image->uri),
+    );
+    $this->drupalPostAJAX(NULL, $edit, 'field_avatar_und_0_upload_button');
+
+    // Change the forgotten password.
+    $password = user_password();
+    $edit = array('pass[pass1]' => $password, 'pass[pass2]' => $password);
+    $this->drupalPost(NULL, $edit, t('Save'));
+    $this->assertText(t('The changes have been saved.'), 'Forgotten password changed.');
   }
 
   /**

From 22b9a0b6bc91c3e2bb9a3663d8b54275d025b58e Mon Sep 17 00:00:00 2001
From: David Rothstein <drothstein@gmail.com>
Date: Tue, 6 Jun 2017 23:23:17 -0400
Subject: [PATCH 28/29] Update CHANGELOG.txt in preparation for the 7.55
 release.

---
 CHANGELOG.txt | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/CHANGELOG.txt b/CHANGELOG.txt
index 559c98b8d8f..d7781d2e0ea 100644
--- a/CHANGELOG.txt
+++ b/CHANGELOG.txt
@@ -11,7 +11,9 @@ Drupal 7.xx, xxxx-xx-xx (development version)
   Apache module is disabled.
 - Fixed Drupal's URL-generating functions to always encode '[' and ']' so that
   the URLs will pass HTML5 validation.
-- Several bug fixes.
+- Various additional bug fixes.
+- Various API documentation improvements.
+- Additional automated test coverage.
 
 Drupal 7.54, 2017-02-01
 -----------------------

From ae4576324e1aaa7bbddd664053573fd26e46b461 Mon Sep 17 00:00:00 2001
From: David Rothstein <drothstein@gmail.com>
Date: Wed, 7 Jun 2017 18:12:09 -0400
Subject: [PATCH 29/29] Drupal 7.55

---
 CHANGELOG.txt          | 2 +-
 includes/bootstrap.inc | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/CHANGELOG.txt b/CHANGELOG.txt
index d7781d2e0ea..6a20156af04 100644
--- a/CHANGELOG.txt
+++ b/CHANGELOG.txt
@@ -1,5 +1,5 @@
 
-Drupal 7.xx, xxxx-xx-xx (development version)
+Drupal 7.55, 2017-06-07
 -----------------------
 - Fixed incompatibility with PHP versions 7.0.19 and 7.1.5 due to duplicate
   DATE_RFC7231 definition.
diff --git a/includes/bootstrap.inc b/includes/bootstrap.inc
index 755c74f84f1..d5864ff0bfc 100644
--- a/includes/bootstrap.inc
+++ b/includes/bootstrap.inc
@@ -8,7 +8,7 @@
 /**
  * The current system version.
  */
-define('VERSION', '7.55-dev');
+define('VERSION', '7.55');
 
 /**
  * Core API compatibility.