drupal 7.83

Maintenance release of the Drupal 7 series. Includes bug fixes and small API/feature improvements only (no major, non-backwards-compatible new functionality).

No security fixes are included in this release.

Note that Drupal 7.84 was released as a hotfix shortly after this release.

This release is the first where D7 core's test suite passes tests in PHP 8.1. However, there may be remaining problems with PHP 8 in core, and it's very likely that there are problems in contrib. Please test, and report any problems in the appropriate issue queue.

No changes have been made to the .htaccess, web.config or robots.txt files in this release, so upgrading custom versions of those files is not necessary.

There are multiple changes in default.settings.php

There is at least one change to the database schema, so database updates need to be run either via update.php or e.g. drush updb.

Major changes in Drupal 7.83:

• Drupal 7 now has a "changed" property on the user entity - database schema update required
• Drupal 7 now has a date-based default for the directory that file uploads are saved to
• Drupal 7 now has a skip_permissions_hardening setting
• The has_js cookie has been removed from Drupal 7
• Drupal 7 no longer strips leading www. from cookie domain by default because that leaks session cookies to subdomains - sites may want to set $cookie_domain in settings.php to opt out of this change
• Changes to password reset process in Drupal 7 to prevent email or username enumeration
• Link tags with duplicate href attributes and different hreflang attributes are now supported in Drupal 7

All changes:

• #3063048 by mcdruid, darkodev, asvira: Error 500 when requesting partial image style paths
• #2802159 by hgoto, David_Rothstein, mcdruid, bircher, Fabianx, Berdir, catch, chx, mr.baileys, pwolanin, webchick, larowlan, hussainweb, cilefen, dawehner, greggles: SQL $match_operator is vulnerable to injection attack
• #1768622 by guilhermevp, no2e, quietone: Dzongkha language is missing (wrongly labeled as "Bhutani")
• #2907409 by ZeiP, preksha: Fix the typo in hook_node_validate() documentation
• #2789723 by mcdruid, pcambra: drupal_mkdir does not set permissions on directories it created recursively
• #1835754 by tamarpe, Alex Bukach, Cauliflower, joseph.olstad: Add last 'changed' property to user entity
• #2128055 by slashrsm, anavarre, timhilliard, estoyausente, nielsvm, effulgentsia, zopa, rteijeiro, rootwork, stijntilleman, vijaycs85, jonhattan, DamienMcKenna, Crell, webchick, Dave Reid, attiks, Fidelix, toamit, Pls, meba, YesCT, saltednut, erwangel: Files should be uploaded to per year/month directories by default
• #2522002 by mcdruid, pwolanin, mvc, Patil_kunal27, fgm, znerol, alexpott: Do not strip www. from cookie domain by default because that leaks session cookies to subdomains
• #3025439 by joelpittet: list_allowed_values_string() warning when list options are determined by 'allowed_values_function'
• #3249605 by mcdruid, demeritcowboy: Fix regression in color module
• #3002101 by jenlampton: Ajax upload with validation can cause PHP notice on PHP 7
• #1232572 by deviantintegral, mcdruid, joachim, cweagans, Lennard Westerveld, kenorb, hanoii, webflo, bleen, esod, johnennew, Elijah Lynn, ron_s, csmdgl, sriharsha.uppuluri, cman9090, Berdir, catch, q0rban, alexpott, anavarre: Backport skip_permissions_hardening
• #3142821 by amjad1233, mcdruid, craigra, larowlan: PDO Exception - Column weight cannot be null in menu.inc
• #3248997 by mcdruid, alexpott, Gábor Hojtsy, andypost, catch, longwave, daffie: [PHP 8.1] Add PDO::ATTR_STRINGIFY_FETCHES to MySQL connection options
• #3248756 by mcdruid: [PHP 8.1] Return type of SkipDotsRecursiveDirectoryIterator methods deprecation fix
• #3248752 by mcdruid: [PHP 8.1] Implicit conversion from float to int loses precision
• #3241427 by Ayesh, mcdruid: [PHP 8.1] Database classes signature mismatch fixes
• #3241422 by mcdruid, Ayesh: [PHP 8.1] Passing null to internal functions deprecation fixes
• #3241412 by Ayesh: [PHP 8.1] DrupalCacheArray deprecation notices due to tentative return types
• #3247935 by mfb: drupal_add_html_head_link(): URL in link HTTP header should not be HTML-encoded
• #3231530 by mcdruid: DrupalWebTestCase->storeSetupCache() error: time() expects exactly 0 parameters, 1 given
• #3209417 by jedihe, mcdruid, DamienMcKenna, Fabianx, Berdir, pietmarcus, mikran, David_Rothstein: Backport from D8: run-tests.sh should allow single test methods to be run
• #3200198 by mcdruid, Ronino, izmeez, darrenwh, jozzy_a, cjgratacos, aerozeppelin, quietone, lomasr, ravi.shankar, zuhair_ak, tar_inet, sokru, robpowell, mangy.fox, mjpa, Carsten Müller, AlanHDev, cilefen, Sophie.SK, Spokje, kim.pepper, izus, dww, Vivek Panicker, ashu1629, Aunion, ankitgarg, Leeteq, David_Rothstein, no2e, longwave, markpavlitski, acbramley, anagp, penyaskito, pdrake, klausi, claudiu.cristea, jlbellido, larowlan, dpi, mohit1604, matteodem, luismagr, gordon, jain_deepak, nginex, ronald.garcia, YesCT, alexpott, Kristen Pol, Elendev, webchuck, C-Logemann: [D7] password reset form prevent revealing email or username in use
• #229825 by nod_, mcdruid, sun, ApacheEx, lightsurge, legovaer, pounard, RobLoach, Frederikvho, Robin Monks, cburschka, yched, keith.smith, Kiphaas7, treksler, jbrauer, catch, Dave Reid, aspilicious, Damien Tournoud, Wim Leers, giupenni, ressa, Fabianx, webchick: backport "$_COOKIE['has_js'] must die" patch to 7.x
• #3217445 by Beakerboy: Remove DatabaseUpdateTestCase::testPrimaryKeyUpdate() - backport from D8
• #3210215 by Mulambo: [PHP 8] Error: TypeError: round() in parse_size function
• #3090214 by dalin: PHP 7.2 Warning: count(): Parameter must be an array or an object that implements Countable in taxonomy_form_term_submit() in taxonomy.admin.inc
• #3165377 by MaxMendez, Eugene Bocharov, joseph.olstad, MustangGB: element_property() causes a notice in 7.4 if $key is an integer
• #3102159 by mcdruid: Add tests for Archive_Tar
• #3247738 by mcdruid: sync system.tar.inc with Archive_Tar 1.4.14
• #2959727 by mfb, mcdruid, ejanus, msankhala, Fabianx: drupal_add_html_head_link() needs to allow multiple hreflang tags to point to one URL