diff --git a/D6-core-simpletest.patch b/D6-core-simpletest.patch index b9d5057..be60de6 100644 --- a/D6-core-simpletest.patch +++ b/D6-core-simpletest.patch @@ -1,119 +1,167 @@ -? sites/all/modules -? sites/default/files -? sites/default/settings.php -Index: install.php -=================================================================== -RCS file: /cvs/drupal/drupal/install.php,v -retrieving revision 1.113.2.12 -diff -u -p -r1.113.2.12 install.php ---- install.php 9 May 2010 14:13:31 -0000 1.113.2.12 -+++ install.php 7 Oct 2010 21:55:51 -0000 -@@ -20,6 +20,14 @@ function install_main() { - require_once './includes/bootstrap.inc'; - drupal_bootstrap(DRUPAL_BOOTSTRAP_CONFIGURATION); +diff --git a/includes/bootstrap.inc b/includes/bootstrap.inc +index 92e0c0f..1b0eb6b 100644 +--- a/includes/bootstrap.inc ++++ b/includes/bootstrap.inc +@@ -6,6 +6,16 @@ + */ -+ // The user agent header is used to pass a database prefix in the request when -+ // running tests. However, for security reasons, it is imperative that no -+ // installation be permitted using such a prefix. -+ if (isset($_SERVER['HTTP_USER_AGENT']) && strpos($_SERVER['HTTP_USER_AGENT'], "simpletest") !== FALSE) { -+ header($_SERVER['SERVER_PROTOCOL'] . ' 403 Forbidden'); -+ exit; -+ } + /** ++ * Indicates the version of SimpleTest patch installed. ++ */ ++define('SIMPLETEST_PATCH_VERSION', '6.1'); + - // This must go after drupal_bootstrap(), which unsets globals! - global $profile, $install_locale, $conf; - -Index: includes/bootstrap.inc -=================================================================== -RCS file: /cvs/drupal/drupal/includes/bootstrap.inc,v -retrieving revision 1.206.2.29 -diff -u -p -r1.206.2.29 bootstrap.inc ---- includes/bootstrap.inc 6 Aug 2010 11:50:24 -0000 1.206.2.29 -+++ includes/bootstrap.inc 7 Oct 2010 21:55:51 -0000 -@@ -1112,7 +1112,7 @@ function drupal_bootstrap($phase) { - } - - function _drupal_bootstrap($phase) { -- global $conf; -+ global $conf, $db_prefix; - - switch ($phase) { - -@@ -1138,6 +1138,19 @@ function _drupal_bootstrap($phase) { ++/** ++ * For convenience, define a short form of the request time global. ++ */ ++define('REQUEST_TIME', isset($_SERVER['REQUEST_TIME']) ? $_SERVER['REQUEST_TIME'] : time()); ++ ++/** + * Indicates that the item should never be removed unless explicitly told to + * using cache_clear_all() with a cache ID. + */ +@@ -1137,6 +1147,9 @@ function _drupal_bootstrap($phase) { break; case DRUPAL_BOOTSTRAP_DATABASE: -+ // The user agent header is used to pass a database prefix in the request when -+ // running tests. However, for security reasons, it is imperative that we -+ // validate we ourselves made the request. -+ $GLOBALS['simpletest_installed'] = TRUE; -+ if (isset($_SERVER['HTTP_USER_AGENT']) && preg_match("/^(simpletest\d+);/", $_SERVER['HTTP_USER_AGENT'], $matches)) { -+ if (!drupal_valid_test_ua($_SERVER['HTTP_USER_AGENT'])) { -+ header($_SERVER['SERVER_PROTOCOL'] . ' 403 Forbidden'); -+ exit; -+ } -+ $db_prefix_string = is_array($db_prefix) ? $db_prefix['default'] : $db_prefix; -+ $db_prefix = $db_prefix_string . $matches[1]; -+ } ++ // Intialize simpletest. ++ _drupal_bootstrap_database_simpletest(); + // Initialize the default database. require_once './includes/database.inc'; db_set_active(); -@@ -1331,3 +1344,46 @@ function ip_address() { +@@ -1330,3 +1343,127 @@ function ip_address() { return $ip_address; } + +/** -+ * Validate the HMAC and timestamp of a user agent header from simpletest. ++ * Calculate a base-64 encoded, URL-safe sha-256 hmac. ++ * ++ * @param $data ++ * String to be validated with the hmac. ++ * @param $key ++ * A secret string key. ++ * ++ * @return ++ * A base-64 encoded sha-256 hmac, with + replaced with -, / with _ and ++ * any = padding characters removed. ++ */ ++function drupal_hmac_base64($data, $key) { ++ $hmac = base64_encode(hash_hmac('sha256', $data, $key, TRUE)); ++ // Modify the hmac so it's safe to use in URLs. ++ return strtr($hmac, array('+' => '-', '/' => '_', '=' => '')); ++} ++ ++/** ++ * Calculate a base-64 encoded, URL-safe sha-256 hash. ++ * ++ * @param $data ++ * String to be hashed. ++ * ++ * @return ++ * A base-64 encoded sha-256 hash, with + replaced with -, / with _ and ++ * any = padding characters removed. ++ */ ++function drupal_hash_base64($data) { ++ $hash = base64_encode(hash('sha256', $data, TRUE)); ++ // Modify the hash so it's safe to use in URLs. ++ return strtr($hash, array('+' => '-', '/' => '_', '=' => '')); ++} ++ ++/** ++ * Checks the current User-Agent string to see if this is an internal request ++ * from SimpleTest. If so, returns the test prefix for this test. ++ * ++ * @return ++ * Either the simpletest prefix (the string "simpletest" followed by any ++ * number of digits) or FALSE if the user agent does not contain a valid ++ * HMAC and timestamp. + */ -+function drupal_valid_test_ua($user_agent) { -+// global $dbatabases; -+ global $db_url; -+ -+ list($prefix, $time, $salt, $hmac) = explode(';', $user_agent); -+ $check_string = $prefix . ';' . $time . ';' . $salt; -+ // We use the database credentials from settings.php to make the HMAC key, since -+ // the database is not yet initialized and we can't access any Drupal variables. -+ // The file properties add more entropy not easily accessible to others. -+// $filepath = DRUPAL_ROOT . '/includes/bootstrap.inc'; -+ $filepath = './includes/bootstrap.inc'; -+// $key = sha1(serialize($databases) . filectime($filepath) . fileinode($filepath), TRUE); -+ $key = sha1(serialize($db_url) . filectime($filepath) . fileinode($filepath), TRUE); -+ // The HMAC must match. -+ return $hmac == base64_encode(hash_hmac('sha1', $check_string, $key, TRUE)); ++function drupal_valid_test_ua() { ++ // No reason to reset this. ++ static $test_prefix; ++ ++ if (isset($test_prefix)) { ++ return $test_prefix; ++ } ++ ++ if (isset($_SERVER['HTTP_USER_AGENT']) && preg_match("/^(simpletest\d+);(.+);(.+);(.+)$/", $_SERVER['HTTP_USER_AGENT'], $matches)) { ++ list(, $prefix, $time, $salt, $hmac) = $matches; ++ $check_string = $prefix . ';' . $time . ';' . $salt; ++ // We use the salt from settings.php to make the HMAC key, since ++ // the database is not yet initialized and we can't access any Drupal variables. ++ // The file properties add more entropy not easily accessible to others. ++ $key = drupal_get_hash_salt() . filectime(__FILE__) . fileinode(__FILE__); ++ $time_diff = REQUEST_TIME - $time; ++ // Since we are making a local request a 5 second time window is allowed, ++ // and the HMAC must match. ++ if ($time_diff >= 0 && $time_diff <= 5 && $hmac == drupal_hmac_base64($check_string, $key)) { ++ $test_prefix = $prefix; ++ return $test_prefix; ++ } ++ } ++ ++ return FALSE; +} + +/** + * Generate a user agent string with a HMAC and timestamp for simpletest. + */ +function drupal_generate_test_ua($prefix) { -+// global $dbatabases; -+ global $db_url; + static $key; + + if (!isset($key)) { -+ // We use the database credentials to make the HMAC key, since we -+ // check the HMAC before the database is initialized. filectime() -+ // and fileinode() are not easily determined from remote. -+// $filepath = DRUPAL_ROOT . '/includes/bootstrap.inc'; -+ $filepath = './includes/bootstrap.inc'; -+// $key = sha1(serialize($databases) . filectime($filepath) . fileinode($filepath), TRUE); -+ $key = sha1(serialize($db_url) . filectime($filepath) . fileinode($filepath), TRUE); ++ // We use the salt from settings.php to make the HMAC key, since ++ // the database is not yet initialized and we can't access any Drupal variables. ++ // The file properties add more entropy not easily accessible to others. ++ $key = drupal_get_hash_salt() . filectime(__FILE__) . fileinode(__FILE__); + } -+ // Generate a moderately secure HMAC based on the database credentials. -+ $salt = uniqid('', TRUE); -+ $check_string = $prefix . ';' . time() . ';' . $salt; -+ return $check_string . ';' . base64_encode(hash_hmac('sha1', $check_string, $key, TRUE)); ++ // Generate a moderately secure HMAC based on the database credentials. ++ $salt = uniqid('', TRUE); ++ $check_string = $prefix . ';' . time() . ';' . $salt; ++ return $check_string . ';' . drupal_hmac_base64($check_string, $key); +} -Index: includes/common.inc -=================================================================== -RCS file: /cvs/drupal/drupal/includes/common.inc,v -retrieving revision 1.756.2.98 -diff -u -p -r1.756.2.98 common.inc ---- includes/common.inc 6 Sep 2010 11:13:27 -0000 1.756.2.98 -+++ includes/common.inc 7 Oct 2010 21:55:51 -0000 -@@ -531,7 +531,7 @@ function drupal_http_request($url, $head ++ ++function _drupal_bootstrap_database_simpletest() { ++ // The user agent header is used to pass a database prefix in the request when ++ // running tests. However, for security reasons, it is imperative that we ++ // validate we ourselves made the request. ++ if ($test_prefix = drupal_valid_test_ua()) { ++ // Set the test run id for use in other parts of Drupal. ++ $test_info = &$GLOBALS['drupal_test_info']; ++ $test_info['test_run_id'] = $test_prefix; ++ $test_info['in_child_site'] = TRUE; ++ ++ // Extract the current default database prefix. ++ $current_prefix = $GLOBALS['db_prefix']; ++ if (is_array($current_prefix)) { ++ $current_prefix = $current_prefix['default']; ++ } ++ ++ // Remove the current database prefix and replace it by our own. ++ $GLOBALS['db_prefix'] = array( ++ 'default' => $current_prefix . $test_prefix, ++ ); ++ } ++} ++ ++/** ++ * Get a salt useful for hardening against SQL injection. ++ * ++ * @return ++ * A salt based on information in settings.php, not in the database. ++ */ ++function drupal_get_hash_salt() { ++ global $drupal_hash_salt, $db_url; ++ // If the $drupal_hash_salt variable is empty, a hash of the serialized ++ // database credentials is used as a fallback salt. ++ return empty($drupal_hash_salt) ? hash('sha256', serialize($db_url)) : $drupal_hash_salt; ++} +diff --git a/includes/common.inc b/includes/common.inc +index 3d73784..8da2fe2 100644 +--- a/includes/common.inc ++++ b/includes/common.inc +@@ -530,7 +530,7 @@ function drupal_http_request($url, $headers = array(), $method = 'GET', $data = // same time won't interfere with each other as they would if the database // prefix were stored statically in a file or database variable. if (is_string($db_prefix) && preg_match("/^simpletest\d+$/", $db_prefix, $matches)) { @@ -122,7 +170,7 @@ diff -u -p -r1.756.2.98 common.inc } foreach ($headers as $header => $value) { -@@ -2661,14 +2661,24 @@ function _drupal_bootstrap_full() { +@@ -2662,13 +2662,23 @@ function _drupal_bootstrap_full() { require_once './includes/mail.inc'; require_once './includes/actions.inc'; // Set the Drupal custom error handler. @@ -135,21 +183,19 @@ diff -u -p -r1.756.2.98 common.inc unicode_check(); // Undo magic quotes fix_gpc_magic(); -- // Load all enabled modules + -+ if (isset($_SERVER['HTTP_USER_AGENT']) && strpos($_SERVER['HTTP_USER_AGENT'], 'simpletest') !== FALSE) { -+ // Valid SimpleTest user-agent, log fatal errors to test specific file -+ // directory. The user-agent is validated in DRUPAL_BOOTSTRAP_DATABASE -+ // phase so as long as it is a SimpleTest user-agent it is valid. ++ $test_info = &$GLOBALS['drupal_test_info']; ++ if (!empty($test_info['in_child_site'])) { ++ // Running inside the simpletest child site, log fatal errors to test ++ // specific file directory. + ini_set('log_errors', 1); -+ ini_set('error_log', file_directory_path() . '/error.log'); ++ ini_set('error_log', 'public://error.log'); + } + -+// Load all enabled modules + // Load all enabled modules module_load_all(); // Let all modules take action before menu system handles the request - // We do not want this while running update.php. -@@ -3789,3 +3799,264 @@ function _drupal_flush_css_js() { +@@ -3797,3 +3807,264 @@ function _drupal_flush_css_js() { } variable_set('css_js_query_string', $new_character . substr($string_history, 0, 19)); } @@ -414,3 +460,22 @@ diff -u -p -r1.756.2.98 common.inc + $string = $print_r ? print_r($data, TRUE) : var_export($data, TRUE); + trigger_error(trim($label ? "$label: $string" : $string)); +} +diff --git a/install.php b/install.php +index 8cac289..fd0d48e 100644 +--- a/install.php ++++ b/install.php +@@ -19,6 +19,14 @@ function install_main() { + require_once './includes/bootstrap.inc'; + drupal_bootstrap(DRUPAL_BOOTSTRAP_CONFIGURATION); + ++ // The user agent header is used to pass a database prefix in the request when ++ // running tests. However, for security reasons, it is imperative that no ++ // installation be permitted using such a prefix. ++ if (isset($_SERVER['HTTP_USER_AGENT']) && strpos($_SERVER['HTTP_USER_AGENT'], "simpletest") !== FALSE) { ++ header($_SERVER['SERVER_PROTOCOL'] . ' 403 Forbidden'); ++ exit; ++ } ++ + // This must go after drupal_bootstrap(), which unsets globals! + global $profile, $install_locale, $conf; + diff --git a/simpletest.install b/simpletest.install index 6c21315..8aff1e3 100644 --- a/simpletest.install +++ b/simpletest.install @@ -11,6 +11,11 @@ define('SIMPLETEST_MINIMUM_PHP_MEMORY_LIMIT', '64M'); /** + * The current version of the required core patch that must be applied. + */ +define('SIMPLETEST_REQUIRED_PATCH_VERSION', '6.1'); + +/** * Implements hook_requirements(). */ function simpletest_requirements($phase) { @@ -21,7 +26,6 @@ function simpletest_requirements($phase) { $has_hash = function_exists('hash_hmac'); $has_domdocument = method_exists('DOMDocument', 'loadHTML'); $open_basedir = ini_get('open_basedir'); - $patch_installed = isset($GLOBALS['simpletest_installed']); $requirements['curl'] = array( 'title' => $t('cURL'), @@ -66,18 +70,28 @@ function simpletest_requirements($phase) { $memory_limit = ini_get('memory_limit'); if ($memory_limit && $memory_limit != -1 && parse_size($memory_limit) < parse_size(SIMPLETEST_MINIMUM_PHP_MEMORY_LIMIT)) { $requirements['php_memory_limit']['severity'] = REQUIREMENT_ERROR; - $requirements['php_memory_limit']['description'] = t('The testing framework requires the PHP memory limit to be at least %memory_minimum_limit. The current value is %memory_limit. Follow these steps to continue.', array('%memory_limit' => $memory_limit, '%memory_minimum_limit' => SIMPLETEST_MINIMUM_PHP_MEMORY_LIMIT, '@url' => 'http://drupal.org/node/207036')); + $requirements['php_memory_limit']['description'] = $t('The testing framework requires the PHP memory limit to be at least %memory_minimum_limit. The current value is %memory_limit. Follow these steps to continue.', array('%memory_limit' => $memory_limit, '%memory_minimum_limit' => SIMPLETEST_MINIMUM_PHP_MEMORY_LIMIT, '@url' => 'http://drupal.org/node/207036')); } // Check that the global variable is defined signifying that the patch // was correctly applied to the Drupal 6 core. - $requirements['simpletest_patch'] = array( - 'title' => $t('SimpleTest code addition'), - 'value' => $patch_installed ? $t('Found') : $t('Not found'), - ); - if (!$patch_installed) { - $requirements['simpletest_patch']['severity'] = REQUIREMENT_ERROR; - $requirements['simpletest_patch']['description'] = $t('SimpleTest could not be installed. The required core patch must be applied. See the included INSTALL.txt.', array('@install' => base_path() . drupal_get_path('module', 'simpletest') . '/INSTALL.txt')); + if ($phase == 'runtime') { + $requirements['simpletest_patch'] = array( + 'title' => $t('SimpleTest core patch'), + ); + if (!defined('SIMPLETEST_PATCH_VERSION') && !isset($GLOBALS['simpletest_installed'])) { + $requirements['simpletest_patch']['value'] = $t('Not applied'); + $requirements['simpletest_patch']['severity'] = REQUIREMENT_ERROR; + $requirements['simpletest_patch']['description'] = $t('The required SimpleTest core patch must be applied. See the included INSTALL.txt.', array('@install' => base_path() . drupal_get_path('module', 'simpletest') . '/INSTALL.txt')); + } + elseif (isset($GLOBALS['simpletest_installed']) || SIMPLETEST_PATCH_VERSION !== SIMPLETEST_REQUIRED_PATCH_VERSION) { + $requirements['simpletest_patch']['value'] = $t('Needs updating'); + $requirements['simpletest_patch']['severity'] = REQUIREMENT_ERROR; + $requirements['simpletest_patch']['description'] = $t('The required SimpleTest core patch has been changed and needs to be re-applied to core. See the included INSTALL.txt.', array('@install' => base_path() . drupal_get_path('module', 'simpletest') . '/INSTALL.txt')); + } + else { + $requirements['simpletest_patch']['value'] = $t('Applied (version @version)', array('@version' => SIMPLETEST_PATCH_VERSION)); + } } return $requirements; diff --git a/simpletest.module b/simpletest.module index da3af75..8eeccab 100644 --- a/simpletest.module +++ b/simpletest.module @@ -21,9 +21,25 @@ function simpletest_help($path, $arg) { $output .= '
' . t('After the tests run, a message will be displayed next to each test group indicating whether tests within it passed, failed, or had exceptions. A pass means that the test returned the expected results, while fail means that it did not. An exception normally indicates an error outside of the test, such as a PHP warning or notice. If there were failures or exceptions, the results will be expanded to show details, and the tests that had failures or exceptions will be indicated in red or pink rows. You can then use these results to refine your code and tests, until all tests pass.') . '
'; $output .= ''; return $output; + case 'admin/build/testing': + // Check for status report errors. + if (simpletest_check_status() && user_access('administer site configuration')) { + drupal_set_message(t('One or more problems were detected with your Drupal installation and SimpleTest module. Check the status report for more information.', array('@status' => url('admin/reports/status'))), 'error'); + } + return; } } +function simpletest_check_status() { + // Load .install files + module_load_install('simpletest'); + + // Check run-time requirements and status information. + $requirements = module_invoke('simpletest', 'requirements', 'runtime'); + usort($requirements, '_system_sort_requirements'); + return drupal_requirements_severity($requirements) == REQUIREMENT_ERROR; +} + /** * Implements hook_menu(). */