[meta] Priorities for 2023-06-07 release of Drupal 7

Assorted todo lists carried over from #3292217: [meta] Priorities for 2022-12-07 release of Drupal 7.

These are not necessarily in priority order.

Top priorities

• #3304807: [META] Make Drupal 7 compatible with PHP 8.2
• #3293648: [D7 backport] Update status does not verify the identity or authenticity of the release history URL

Simple fixes

• #3345570: list_allowed_values_setting_validate dies with PHP Fatal error on PHP 8.1
• #1777166: hook_comment_publish() docs are completely wrong
• #3308471: [D7] Update CommonXssUnitTest::testBadProtocolStripping() to check other allowed / dangerous protocols
• #3015142: drupal_goto short circuits and doesn't set things to cache
• #2550519: Crypt::randomBytes()/drupal_random_bytes() doesn't actually return cryptographically secure random bytes
• #3019792: The description for the value returned from form_type_token_value() is wrong
• #2133309: Change link for language code identifier when creating custom languages
• #2412151: taxonomy_overview_terms undefined index (repeatable)
• #3325533: Undefined variables in system.tar.inc
• #1470236: Array flip error when a taxonomy term field has a NULL value
• #1281732: Fatal error when taxonomy_options_list() tries to call an undefined callback function
• #1821178: Performance tune text_field_load()
• #2060235: Getting a PDOException when adding new image style named thumbnail, medium and large
• #3007538: Cron.php does not check for maintenance mode correctly
• #1621334: Notice: Undefined property: stdClass::$forum_tid in forum_node_view()
• #2177335: Selecting 'Disabled' does not move the block to the disabled region when there are no disabled blocks
• #998632: drupal_write_record() throws PHP notices if any fields use DB-specific data types

Important fixes

• #3214047: [D7] Add phtml files to the list of potentially malicious extensions Security improvement - already in D8/9/10
• #3358515: Make phpinfo on the admin status report configurable [D7]
• #2164025: Improve security of session ID against DB exposure or SQL injection Security improvement - already in D8/9/10
• #3326994: [D7] Username enumeration via one time login route Security improvement - username disclosure
• #1705618: Double click prevention on form submission Important to prevent double submission of forms, creating duplicate nodes, etc. Must clear browser cache to take effect.
• #2539478: [D7] Allow image fields to use any extensions the current image toolkit supports (instead of hard-coding jpg, png and gif only) Remove hardcoded image files extensions.
• #3017522: Make SSL options configurable in drupal_http_request() Verifies SSL certificates in OpenSSL connections (Critical)
• #2749007: Autocomplete broken for servers enforcing clean URLs Security Regression
• #1158322: Add backtrace to all errors
• #3255713: [D7] Login fails and no warning is issued if cookies are not enabled This is a D7 backport of #2946: Login fails and no warning is issued if cookies are not enabled, an 18 year old issue that was marked as major and committed to drupal 9.3.x in June 2021.
• #2752783: [D7] file_unmanaged_move() should issue rename() where possible instead of copy() & unlink() Important fix. Mcdruid urging commit. @joseph.olstad: "D8 has this already. It is a good idea."
• #1415278: Using entity_get_info in a hook_hook_info results in an incomplete module_implements cache.
• #1209226: Avoid slow query for path alias whitelists
• #1978176: Build menu_tree without loading so many objects @joseph.olstad: "... the performance improvement is huge! .. After several years I see no credible reports of an issue with this patch"
• #2487269: Postgres insert queries that fail in a transaction break the entire transaction
• #2783153: [D7] Convert drupalSettings from JavaScript to JSON, to allow for CSP in the future FabianX said it looks good, has updated tests
• #2970929: [D7] Support X-Forwarded-* HTTP headers alternates Important backport for reverse proxies and load balance.
• #1899126: [D7] Add wrappers to fix permission checks Required for POSIX filesystem. Fixed in D8? @orlitzky: "I'm just going to keep updating the patch for drupal-7.x for the rest of my life." "I'll keep posting patches until I don't have to any more."
• #2418755: Path alias filter by system path (D10 patch, still Needs review) includes 6 year old patch for D7 in comment #1 that has been RTBC and without the patch "it's very hard to find alias which contains few slashes in path."
• #3210388: Potential dataloss when opting in to "Avoid field storage write when field content did not change" and changing the bundle type of an existing entity
• #3176634: [D7] node_access filters out accessible nodes when node is left joined Issue identified as major. D8/9 fix pending.

Unsorted fixes

• #3284424: pg_attribute.attrelid error
• #3026560: After upgrade to 7.63, 8.5.10, 8.6.7, 9.4.0 get TYPO3 phar error for drush
• #1982810: Core entity_get_controller gets a NULL controller class
• #2345695: Users are able to upload 0-byte images
• #3304385: [D7] node/add page misses content types when menu links are moved or disabled
• #2456193: Menu links - not possible to create numeric paths
• #111702: Set fixed "from:" and add "Reply-to:" to comply with DMARC
• #2962374: [D7] Path alias validation should test for relative path, no trailing slash requirements
• #2793297: [D7] Automatically shorten cid's in DrupalDatabaseCache
• #1992010: Reverting to revisions prior to addition of field translations is broken Issue is 9 years old, marked as critical and has patch that is RTBC and passes automated tests. Are tests sufficient?
• #1328696: Problem with _drupal_wrap_mail_line and attachment files Attachment of docx file or files with long names results in email that is not correct. Fixed in D8, backport for D7 has patch.
• #2847484: Support boolean attributes in drupal_attributes()
• #691932: Add hook_field_schema_alter()
• #1451072: Deleting a comment author while the Comment module is disabled leads to an EntityMalformedException error after it's reenabled
• #2978218: Add "delete" link on node Translate tab Operations
• #3035571: [D7] ImageStyle::transformDimensions unable to deal with all effects.
• #1565892: node_type_delete() doesn't check the value returned from node_type_get_type()
• #965078: HTTP request checking is unreliable and should be removed in favor of watchdog() calls Needs work and needs CR
• #139015: breadcrumbs wrong on dblog event detail pages Issue seems in good shape, needs a bit of work as of Aug-4
• #1951408: Core Update manager doesn't correctly handle "status" UPDATE_NOT_CHECKED Includes D7 core patch in comment #16 that passes tests and is RTBC. Required for update_advanced module that is used by 2,700 sites. Does not appear to be relevant to D8/D9.
• #498752: Partial word search for Drupal 7 Includes working patch from 5 yrs ago. Was closed as won't fix feature request. Now that a similar feature is proposed for D9 core #103548: Partial Search in Drupal Core maybe it's worth considering.