By alexpott on
Change record status: 
Published (View all published change records)
Project: 
Drupal core
Introduced in branch: 
8.3.x
Introduced in version: 
8.3.0
Issue links: 
https://www.drupal.org/node/2665152
Description: 

The form element names for the install module checkboxes on admin/modules have changed. They no longer contain the package name.

This is because suhosin variant of PHP has additional protections that prevent potentially malicious data in the $_GET and $_POST. You can blacklist array keys that contain certain characters using the following setting: suhosin.request.array_index_blacklist => '"+<>;(). The default value breaks the module install form where the package contains brackets. This is true for experimental modules in core and for commerce packages.

If you install modules via the UI in tests you will need to update them for 8.3.x. Form arrays are not API and are not guaranteed by the Drupal 8 backward compatibility policy.

Before

    $edit['modules[Core][book][enable]'] = 'book';
    $this->drupalPostForm('admin/modules', $edit, t('Install'));

After

    $edit['modules[book][enable]'] = 'book';
    $this->drupalPostForm('admin/modules', $edit, t('Install'));
Impacts: 
Module developers