drupal 7.92

Maintenance release of the Drupal 7 series. Includes bug fixes and small API/feature improvements only (no major, non-backwards-compatible new functionality).

No security fixes are included in this release.

Changes have been made to the main .htaccess and to default.settings.php. More details in the Change Records for major changes below.

No changes have been made to the web.config or robots.txt files in this release, so upgrading custom versions of those files is not necessary.

As always, many thanks to everyone that contributed to this release of Drupal 7, especially to D7's new Provisional Maintainer poker10 who did the majority of the work for this release!

Major changes in 7.92:

• Drupal 7's .htaccess protects .orig and .save files
• drupal_http_request() now strips Cookie and Authorization headers on HTTP downgrade or HTTP host change
• Image and file fields on taxonomy terms using private filesystem will no longer return 403 / access denied
• ID attribute changed on DIV wrappers in managed_file form element markup
• l() now strips dangerous protocols from the $path
• PagerSelectExtender::getElement() allows consuming code to know the pager id used by a query
• path_load() will now consistently load the newest alias

Changes since 7.91:

• #702778 by Pasqualle, poker10, mcdruid, Fabianx: Multiple pagers on the same page
• #2749245 by poker10, rafalB, mcdruid, David_Rothstein, vijaycs85, morbiD: (backport) Incorrect handling of file upload limit exceeded - file widget disappears
• #3293649 by mcdruid: drupal_http_request() fails to strip Cookie or Authorization headers on HTTP downgrade
• #2594955 by poker10, predy, David_Rothstein: [D7] Duplicate HTML IDs are created for file_managed_file fields
• #2990723 by poker10, tatarbj, DamienMcKenna: Security improvement for l() function
• #1327224 by Berdir, johnv, ryan.gibson, poker10, chris.leversuch, nyirocsaba, edb, bkosborne, vikashsoni, xjm, andypost, alexpott: Access denied to taxonomy term image
• #1160764 by ianthomas_uk, Désiré, poker10, Dave Reid, SebCorbin, agentrickard: URL alias load is inconsistent if there are more then one alias
• #2779833 by iryston, amar.deokar, poker10: Fix Drupal 7 .htaccess to protect .orig and .save files from view
• #2884171 by mcdruid, Seth Snyder: The drupal_render() function could use a bit more protection
• #3138348 by poker10, awset, mikeytown2: system_batch_page() should call drupal_exit() after drupal_access_denied()
• #2669254 by Marty2081, poker10: PDOException when calling locale_add_language() with $enabled = FALSE
• #2474943 by douggreen, poker10, Fabianx, donaldinou: system_list('bootstrap') returns numeric keys instead of module names
• #3006007 by marco: Don't try to load the user picture if it's not set
• #2679983 by poker10, ChaseOnTheWeb: Specified role weights not preserved in admin
• #1530486 by poker10, chimericdream: [D7] list_field_validate() doesn't seem to accommodate select lists with
• #2218647 by poker10, swim, Patil_kunal27: [D7] Undefined property: stdClass::$nid in node_tokens()
• #2582069 by plach, poker10, Nephele: [D7] Unable to use Condition objects with joins
• #2644276 by poker10, pashupathi nath gajawada, henryhu: Mixed case taxonomy terms not loaded from the internal entity cache
• #920840 by nagba, poker10, hefox, Dave Reid: Broken images displayed and PHP notices when file/image field values are missing
• #873722 by ezheidtmann, aaron.r.carlton, catch, poker10, MaskyS, damiankloip, naxoc: 'autocreate' == 0
• #1994292 by David_Rothstein: LanguageInterface::TYPE_URL (D8) and LANGUAGE_TYPE_URL (D7) have no name or description
• #2926150 by MrHaroldA, BarisW: D7 Remove the open_basedir requirement check
• #2649926 by SeanA, poker10, walangitan: [D7] Field UX: machine name disappears
• #3273723 by djdevin, loopy1492, swim: fopen() error in stream_wrappers.inc on PHP 8
• #3000191 by poker10, drunken monkey: Complex cloned query dependent on __toString() call
• #3064734 by sjerdo, geoffreyr, karan_mudi: DatabaseStatementPrefetch::current PHP function array_unshift() are used incorrectly
• #2021571 by rszrama: Preview of menu machine name is inaccurate on while adding a menu
• #2772107 by poker10, cgv, eojthebrave, q0rban, daffie, johnnydarkko, drewish, David_Rothstein, cbergmann: UNION queries don't support ORDER BY clauses
• #3299271 by poker10: [D7 PHP 8.1] strlen(): Passing null to parameter #1 ($string) of type string is deprecated in drupal_random_bytes()
• #3276848 by DamienMcKenna: run-tests.sh gives "Deprecated: str_replace(): Passing null to parameter" with PHP 8.0
• #2574003 by poker10, stBorchert: Table alias missing in query condition in taxonomy_select_nodes()
• #3004215 by arifkhn46: Method DatabaseCondition::__toString() must return a string value
• #3299725 by mcdruid, Fabianx, poker10, Dries: Add poker10 as a provisional D7 maintainer