drupal 7.99

Maintenance release of the Drupal 7 series. Includes bug fixes and small API/feature improvements only (no major, non-backwards-compatible new functionality).

No security fixes are included in this release.

Changes have been made to default.settings.php but only within comments.

No changes have been made to .htaccess, web.config or robots.txt files in this release, so upgrading custom versions of those files is not necessary.

As always, many thanks to everyone that contributed to this release of Drupal 7.

Major changes in 7.99:

• Menu link 'Parent link' is limited to the current menu when creating new custom menu links through the UI in Drupal 7
• hook_field_schema_alter() was added in Drupal 7
• file_validate_image_resolution() now validates minimum dimensions against the resized image in Drupal 7
• Node translations table now contains a link to delete translation in Drupal 7
• ModuleUpdater::getSchemaUpdates() was removed in Drupal 7
• When a user fails login, the reset password link no longer pre-fills the username in Drupal 7
• Drupal 7's aggregator feed now displays up to 255 characters from description if no title is found
• Protection against abuse of DrupalCacheArray::__destruct() in Drupal 7

All changes:

• #3405443 by fjgarlin, poker10: [D7] phpcs job fails when run on-commit
• #2180877 by poker10, ClassicCut, juankvillegas: file_validate_image_resolution() doesn't recalculate the image dimensions after checking $maximum_dimensions
• #2847553 by poker10, Jill L, David_Rothstein: XSS attribute handling mangles valid attribute names containing numbers (D7 backport)
• #3384397 by poker10, Fabianx: [D7] When adding a new menu link, restrict the available parents to the current menu
• #764408 by poker10, sgtpep, acrollet, David_Rothstein, checker, Fabianx, bkouchi: [D7] Drupal.t() does not respect locale_custom_strings
• #691932 by BTMash, Shellingfox, jhedstrom, dinarcon, AndyF, zhangtaihao, catch, MustangGB, wamilton, Barry_Fisher, brad.bulger, yched, xjm, Sylvain Lecoy, 5n00py, chx, droplet, tim.plunkett, ohthehugemanatee, parasolx, cilefen, andypost, poker10, Fabianx: Add hook_field_schema_alter()
• #3396440 by poker10, joelpittet, tibezh, Fabianx: [D7 PHP 8.1] html_entity_decode(): Passing null to parameter #1 ($string) of type string is deprecated in decode_entities()
• #3026560 by alexpott, mcdruid, generalredneck, pbirk, plach, xjm, Hitby, kevinquillen, Alex Monaghan, MustangGB, DamienMcKenna, greg.1.anderson, littlepixiez, bartvig, poker10, catch, Anybody, bserem, juampynr: After upgrade to 7.63, 8.5.10, 8.6.7, 9.4.0 get TYPO3 phar error for drush
• #2345695 by poker10, formatC'vt, frodri, quietone, mgifford, mondrake, thirdender, james.williams: Users are able to upload 0-byte images
• #3386936 by poker10: Remove unused/non-working function getSchemaUpdates()
• #3326994 by klonos, poker10, BramDriesen: Username enumeration via one time login route
• #3383556 by poker10, BramDriesen, cussack: Username disclosure in /user/password
• #1721506 by dcam, andymartha, Charles Belov, poker10, Dries: In update.php instructions, move database backup after maintenance mode
• #2677118 by Chi, poker10: Wrong usage of watchdog in system.api.php
• #2801329 by gianani, poker10, MustangGB: Remove system.cron.js
• #808416 by lostchord, gaurav.kapoor, daniels220, JacobSanford, jp.stacey, er.pushpinderrana, jhodgdon, oriol_e9g, kiwimind, Damien Tournoud, Gábor Hojtsy, poker10, Dries: Document that clock drift will cause lock system to fail
• #2978218 by heilop, poker10, langelhc: Add "delete" link on node Translate tab Operations
• #3403989 by dimitriskr, fjgarlin: [D7] GitLab CI tests for MariaDB currently not working
• #3402945 by fjgarlin: [D7] Test-only job shouldn't require constant rebases to detect which files were changed
• #3384545 by poker10: Update the list of reserved keywords in DatabaseConnection_mysql
• #2880910 by tatarbj, joseph.olstad, vijaycs85, poker10, klausi, oadaeh, mahalingam_cs, David_Rothstein, mcdruid: [D7] Nothing clears the "5 failed login attempts" security message when a user resets their own password
• #3362409 by durifal, mrinalini9, klausi, mcdruid, poker10: Vertical tabs result in jQuery error when overlay-context hashtag is added to URL
• #3195566 by SAVEL, poker10: Add a note on MySQL 8 sql_mode override
• #3348669 by Chase., poker10: system.mail.inc: strpos(): Passing null to parameter #1 ($haystack) of type string is deprecated
• #3372666 by hadsie, poker10, ayushmishra206, jibran, larowlan, amietpatial, alexpott, aalamaki, afox, mark_fullmer, mohit_aghera, Wim Leers, wroxbox, tanubansal, rteijeiro, NikolaAt, rakesh.gectcr, richardbporter: D7 Backport: Links with "@" are converted into email addresses even if there is no domain suffix present
• #2540830 by swarad07, mikemadison, jhodgdon, poker10, David_Rothstein, cilefen: Sanitize watchdog() link in dblog_event()
• #3397117 by fjgarlin: SQLite testing in GitlabCI - apache2(98)Address already in use
• #3397119 by fjgarlin: Allow failures in D7 GitlabCI PHPCS checks
• #3396515 by fjgarlin: GitlabCI test-only job - ambiguous argument in git diff
• #3387052 by fjgarlin, poker10, mcdruid: [D7] GitLab CI integration for core
• #3380876 by poker10: [D7 PHP 8.3] unserialize(): Extra data starting at offset
• #3379524 by poker10, mcdruid: Update PHP requirements for D7 according to the PSA-2023-06-07
• #3393147 by fjgarlin, mcdruid, poker10: Exceptions ignored in errorHandler for DrupalTestCase
• #3373222 by Gábor Hojtsy, mcdruid: Fallback to feed item description does not strip HTML, only takes 40 chars even though field allows 255
• #3386055 by fjgarlin: Cookie base path not check in the test but set in code
• #3381481 by mcdruid, poker10: add tests for PHP Gadget Chain Drupal7/RCE1 protection
• #3378257 by mcdruid, poker10: harden D7 against PHP Gadget Chain Drupal7/RCE1
• #3365407 by mcdruid, Dries, Fabianx: Promote poker10 to full D7 maintainer