diff -Naur drupal-7.51/.htaccess drupal-7.66/.htaccess
--- drupal-7.51/.htaccess	2016-10-05 20:45:42.000000000 +0200
+++ drupal-7.66/.htaccess	2019-04-17 22:20:46.000000000 +0200
@@ -3,8 +3,13 @@
 #
 
 # Protect files and directories from prying eyes.
-<FilesMatch "\.(engine|inc|info|install|make|module|profile|test|po|sh|.*sql|theme|tpl(\.php)?|xtmpl)(~|\.sw[op]|\.bak|\.orig|\.save)?$|^(\..*|Entries.*|Repository|Root|Tag|Template|composer\.(json|lock))$|^#.*#$|\.php(~|\.sw[op]|\.bak|\.orig\.save)$">
-  Order allow,deny
+<FilesMatch "\.(engine|inc|info|install|make|module|profile|test|po|sh|.*sql|theme|tpl(\.php)?|xtmpl)(~|\.sw[op]|\.bak|\.orig|\.save)?$|^(\.(?!well-known).*|Entries.*|Repository|Root|Tag|Template|composer\.(json|lock))$|^#.*#$|\.php(~|\.sw[op]|\.bak|\.orig\.save)$">
+  <IfModule mod_authz_core.c>
+    Require all denied
+  </IfModule>
+  <IfModule !mod_authz_core.c>
+    Order allow,deny
+  </IfModule>
 </FilesMatch>
 
 # Don't show directory listings for URLs which map to a directory.
@@ -80,7 +85,7 @@
   # If you do not have mod_rewrite installed, you should remove these
   # directories from your webroot or otherwise protect them from being
   # downloaded.
-  RewriteRule "(^|/)\." - [F]
+  RewriteRule "/\.|^\.(?!well-known/)" - [F]
 
   # If your site can be accessed both with and without the 'www.' prefix, you
   # can use one of the following settings to redirect users to your preferred
diff -Naur drupal-7.51/CHANGELOG.txt drupal-7.66/CHANGELOG.txt
--- drupal-7.51/CHANGELOG.txt	2016-10-05 20:45:42.000000000 +0200
+++ drupal-7.66/CHANGELOG.txt	2019-04-17 22:20:46.000000000 +0200
@@ -1,3 +1,114 @@
+Drupal 7.xx, xxxx-xx-xx (development version)
+-----------------------
+
+Drupal 7.66, 2019-04-17
+-----------------------
+- Fixed security issues:
+   - SA-CORE-2019-006
+
+Drupal 7.65, 2019-03-20
+-----------------------
+- Fixed security issues:
+   - SA-CORE-2019-004
+
+Drupal 7.64, 2019-02-06
+-----------------------
+- [regression] Unset the 'host' header in drupal_http_request() during redirect
+- Fixed: 7.x does not have Phar protection and Phar tests are failing on Drupal 7
+- Fixed: Notice: Undefined index: display_field in file_field_widget_value() (line 582 of /module/file/file.field.inc)
+- Performance improvement: Registry rebuild should not parse the same file twice in the same request
+- Fixed _registry_update() to clear caches after transaction is committed
+
+Drupal 7.63, 2019-01-16
+-----------------------
+- Fixed a fatal error for some Drush users introduced by SA-CORE-2019-002.
+
+Drupal 7.62, 2019-01-15
+-----------------------
+- Fixed security issues:
+   - SA-CORE-2019-001
+   - SA-CORE-2019-002
+
+Drupal 7.61, 2018-11-07
+-----------------------
+- File upload validation functions and hook_file_validate() implementations are
+  now always passed the correct file URI.
+- The default form cache expiration of 6 hours is now configurable (API
+  addition: https://www.drupal.org/node/2857751).
+- Allowed callers of drupal_http_request() to optionally specify an explicit
+  Host header.
+- Allowed the + character to appear in usernames.
+- PHP 7.2: Fixed Archive_Tar incompatibility.
+- PHP 7.2: Removed deprecated function each().
+- PHP 7.2: Avoid count() calls on uncountable variables.
+- PHP 7.2: Removed deprecated create_function() call.
+- PHP 7.2: Make sure variables are arrays in theme_links().
+- Fixed theme-settings.php not being loaded on cached forms
+- Fixed problem with IE11 & Chrome(PointerEvents enabled) & some Firefox scroll to the top of the page after dragging the bottom item with jquery 1.5 <-> 1.11
+
+Drupal 7.60, 2018-10-18
+------------------------
+- Fixed security issues. See SA-CORE-2018-006.
+
+Drupal 7.59, 2018-04-25
+-----------------------
+- Fixed security issues (remote code execution). See SA-CORE-2018-004.
+
+Drupal 7.58, 2018-03-28
+-----------------------
+- Fixed security issues (remote code execution). See SA-CORE-2018-002.
+
+Drupal 7.57, 2018-02-21
+-----------------------
+- Fixed security issues (multiple vulnerabilities). See SA-CORE-2018-001.
+
+Drupal 7.56, 2017-06-21
+-----------------------
+- Fixed security issues (access bypass). See SA-CORE-2017-003.
+
+Drupal 7.55, 2017-06-07
+-----------------------
+- Fixed incompatibility with PHP versions 7.0.19 and 7.1.5 due to duplicate
+  DATE_RFC7231 definition.
+- Made Drupal core pass all automated tests on PHP 7.1.
+- Allowed services such as Let's Encrypt to work with Drupal on Apache, by
+  making Drupal's .htaccess file allow access to the .well-known directory
+  defined by RFC 5785.
+- Made new Drupal sites work correctly on Apache 2.4 when the mod_access_compat
+  Apache module is disabled.
+- Fixed Drupal's URL-generating functions to always encode '[' and ']' so that
+  the URLs will pass HTML5 validation.
+- Various additional bug fixes.
+- Various API documentation improvements.
+- Additional automated test coverage.
+
+Drupal 7.54, 2017-02-01
+-----------------------
+- Modules are now able to define theme engines (API addition:
+  https://www.drupal.org/node/2826480).
+- Logging of searches can now be disabled (new option in the administrative
+  interface).
+- Added menu tree render structure to (pre-)process hooks for theme_menu_tree()
+  (API addition: https://www.drupal.org/node/2827134).
+- Added new function for determining whether an HTTPS request is being served
+  (API addition: https://www.drupal.org/node/2824590).
+- Fixed incorrect default value for short and medium date formats on the date
+  type configuration page.
+- File validation error message is now removed after subsequent upload of valid
+  file.
+- Numerous bug fixes.
+- Numerous API documentation improvements.
+- Additional performance improvements.
+- Additional automated test coverage.
+
+Drupal 7.53, 2016-12-07
+-----------------------
+- Fixed drag and drop support on newer Chrome/IE 11+ versions after 7.51 update
+  when jQuery is updated to 1.7-1.11.0.
+
+Drupal 7.52, 2016-11-16
+-----------------------
+- Fixed security issues (multiple vulnerabilities). See SA-CORE-2016-005.
 
 Drupal 7.51, 2016-10-05
 -----------------------
diff -Naur drupal-7.51/MAINTAINERS.txt drupal-7.66/MAINTAINERS.txt
--- drupal-7.51/MAINTAINERS.txt	2016-10-05 20:45:42.000000000 +0200
+++ drupal-7.66/MAINTAINERS.txt	2019-04-17 22:20:46.000000000 +0200
@@ -15,6 +15,7 @@
 - Fabian Franz 'Fabianx' https://www.drupal.org/u/fabianx
 - David Rothstein 'David_Rothstein' https://www.drupal.org/u/david_rothstein
 - Stefan Ruijsenaars 'stefan.r' https://www.drupal.org/u/stefanr-0
+- (provisional) Pol Dellaiera 'Pol' https://www.drupal.org/u/pol
 
 
 Component maintainers
@@ -44,10 +45,9 @@
 - Derek Wright 'dww' https://www.drupal.org/u/dww
 
 Database system
-- Larry Garfield 'Crell' https://www.drupal.org/u/crell
+- ?
 
   - MySQL driver
-    - Larry Garfield 'Crell' https://www.drupal.org/u/crell
     - David Strauss 'David Strauss' https://www.drupal.org/u/david-strauss
 
   - PostgreSQL driver
diff -Naur drupal-7.51/includes/bootstrap.inc drupal-7.66/includes/bootstrap.inc
--- drupal-7.51/includes/bootstrap.inc	2016-10-05 20:45:42.000000000 +0200
+++ drupal-7.66/includes/bootstrap.inc	2019-04-17 22:20:46.000000000 +0200
@@ -8,7 +8,7 @@
 /**
  * The current system version.
  */
-define('VERSION', '7.51');
+define('VERSION', '7.66');
 
 /**
  * Core API compatibility.
@@ -254,8 +254,13 @@
  * http://tools.ietf.org/html/rfc7231#section-7.1.1.1
  *
  * Example: Sun, 06 Nov 1994 08:49:37 GMT
+ *
+ * This constant was introduced in PHP 7.0.19 and PHP 7.1.5 but needs to be
+ * defined by Drupal for earlier PHP versions.
  */
-define('DATE_RFC7231', 'D, d M Y H:i:s \G\M\T');
+if (!defined('DATE_RFC7231')) {
+  define('DATE_RFC7231', 'D, d M Y H:i:s \G\M\T');
+}
 
 /**
  * Provides a caching wrapper to be used in place of large array structures.
@@ -699,6 +704,19 @@
   // Set sane locale settings, to ensure consistent string, dates, times and
   // numbers handling.
   setlocale(LC_ALL, 'C');
+
+  // PHP's built-in phar:// stream wrapper is not sufficiently secure. Override
+  // it with a more secure one, which requires PHP 5.3.3. For lower versions,
+  // unregister the built-in one without replacing it. Sites needing phar
+  // support for lower PHP versions must implement hook_stream_wrappers() to
+  // register their desired implementation.
+  if (in_array('phar', stream_get_wrappers(), TRUE)) {
+    stream_wrapper_unregister('phar');
+    if (version_compare(PHP_VERSION, '5.3.3', '>=')) {
+      include_once DRUPAL_ROOT . '/includes/file.phar.inc';
+      file_register_phar_wrapper();
+    }
+  }
 }
 
 /**
@@ -719,6 +737,16 @@
 }
 
 /**
+ * Checks whether an HTTPS request is being served.
+ *
+ * @return bool
+ *   TRUE if the request is HTTPS, FALSE otherwise.
+ */
+function drupal_is_https() {
+  return isset($_SERVER['HTTPS']) && strtolower($_SERVER['HTTPS']) == 'on';
+}
+
+/**
  * Sets the base URL, cookie domain, and session name from configuration.
  */
 function drupal_settings_initialize() {
@@ -731,7 +759,7 @@
   if (file_exists(DRUPAL_ROOT . '/' . conf_path() . '/settings.php')) {
     include_once DRUPAL_ROOT . '/' . conf_path() . '/settings.php';
   }
-  $is_https = isset($_SERVER['HTTPS']) && strtolower($_SERVER['HTTPS']) == 'on';
+  $is_https = drupal_is_https();
 
   if (isset($base_url)) {
     // Parse fixed base URL from settings.php.
@@ -2617,6 +2645,10 @@
   timer_start('page');
   // Initialize the configuration, including variables from settings.php.
   drupal_settings_initialize();
+
+  // Sanitize unsafe keys from the request.
+  require_once DRUPAL_ROOT . '/includes/request-sanitizer.inc';
+  DrupalRequestSanitizer::sanitize();
 }
 
 /**
@@ -2759,6 +2791,11 @@
       unset($_GET['destination']);
       unset($_REQUEST['destination']);
     }
+    // Use the DrupalRequestSanitizer to ensure that the destination's query
+    // parameters are not dangerous.
+    if (isset($_GET['destination'])) {
+      DrupalRequestSanitizer::cleanDestination();
+    }
     // If there's still something in $_REQUEST['destination'] that didn't come
     // from $_GET, check it too.
     if (isset($_REQUEST['destination']) && (!isset($_GET['destination']) || $_REQUEST['destination'] != $_GET['destination']) && url_is_external($_REQUEST['destination'])) {
@@ -3761,8 +3798,12 @@
   chdir(DRUPAL_ROOT);
 
   try {
-    while (list($key, $callback) = each($callbacks)) {
+    // Manually iterate over the array instead of using a foreach loop.
+    // A foreach operates on a copy of the array, so any shutdown functions that
+    // were added from other shutdown functions would never be called.
+    while ($callback = current($callbacks)) {
       call_user_func_array($callback['callback'], $callback['arguments']);
+      next($callbacks);
     }
   }
   catch (Exception $exception) {
diff -Naur drupal-7.51/includes/cache.inc drupal-7.66/includes/cache.inc
--- drupal-7.51/includes/cache.inc	2016-10-05 20:45:42.000000000 +0200
+++ drupal-7.66/includes/cache.inc	2019-04-17 22:20:46.000000000 +0200
@@ -122,7 +122,12 @@
  *     the administrator panel.
  *   - cache_path: Stores the system paths that have an alias.
  * @param $expire
- *   (optional) One of the following values:
+ *   (optional) Controls the maximum lifetime of this cache entry. Note that
+ *   caches might be subject to clearing at any time, so this setting does not
+ *   guarantee a minimum lifetime. With this in mind, the cache should not be
+ *   used for data that must be kept during a cache clear, like sessions.
+ *
+ *   Use one of the following values:
  *   - CACHE_PERMANENT: Indicates that the item should never be removed unless
  *     explicitly told to using cache_clear_all() with a cache ID.
  *   - CACHE_TEMPORARY: Indicates that the item should be removed at the next
@@ -262,7 +267,12 @@
    *   1MB in size to be stored by default. When caching large arrays or
    *   similar, take care to ensure $data does not exceed this size.
    * @param $expire
-   *   (optional) One of the following values:
+   *   (optional) Controls the maximum lifetime of this cache entry. Note that
+   *   caches might be subject to clearing at any time, so this setting does not
+   *   guarantee a minimum lifetime. With this in mind, the cache should not be
+   *   used for data that must be kept during a cache clear, like sessions.
+   *
+   *   Use one of the following values:
    *   - CACHE_PERMANENT: Indicates that the item should never be removed unless
    *     explicitly told to using cache_clear_all() with a cache ID.
    *   - CACHE_TEMPORARY: Indicates that the item should be removed at the next
diff -Naur drupal-7.51/includes/common.inc drupal-7.66/includes/common.inc
--- drupal-7.51/includes/common.inc	2016-10-05 20:45:42.000000000 +0200
+++ drupal-7.66/includes/common.inc	2019-04-17 22:20:46.000000000 +0200
@@ -487,7 +487,7 @@
   $params = array();
 
   foreach ($query as $key => $value) {
-    $key = ($parent ? $parent . '[' . rawurlencode($key) . ']' : rawurlencode($key));
+    $key = $parent ? $parent . rawurlencode('[' . $key . ']') : rawurlencode($key);
 
     // Recurse into children.
     if (is_array($value)) {
@@ -611,8 +611,9 @@
   }
   // The 'q' parameter contains the path of the current page if clean URLs are
   // disabled. It overrides the 'path' of the URL when present, even if clean
-  // URLs are enabled, due to how Apache rewriting rules work.
-  if (isset($options['query']['q'])) {
+  // URLs are enabled, due to how Apache rewriting rules work. The path
+  // parameter must be a string.
+  if (isset($options['query']['q']) && is_string($options['query']['q'])) {
     $options['path'] = $options['query']['q'];
     unset($options['query']['q']);
   }
@@ -866,8 +867,10 @@
       // Make the socket connection to a proxy server.
       $socket = 'tcp://' . $proxy_server . ':' . variable_get('proxy_port', 8080);
       // The Host header still needs to match the real request.
-      $options['headers']['Host'] = $uri['host'];
-      $options['headers']['Host'] .= isset($uri['port']) && $uri['port'] != 80 ? ':' . $uri['port'] : '';
+      if (!isset($options['headers']['Host'])) {
+        $options['headers']['Host'] = $uri['host'];
+        $options['headers']['Host'] .= isset($uri['port']) && $uri['port'] != 80 ? ':' . $uri['port'] : '';
+      }
       break;
 
     case 'http':
@@ -877,14 +880,18 @@
       // RFC 2616: "non-standard ports MUST, default ports MAY be included".
       // We don't add the standard port to prevent from breaking rewrite rules
       // checking the host that do not take into account the port number.
-      $options['headers']['Host'] = $uri['host'] . ($port != 80 ? ':' . $port : '');
+      if (!isset($options['headers']['Host'])) {
+        $options['headers']['Host'] = $uri['host'] . ($port != 80 ? ':' . $port : '');
+      }
       break;
 
     case 'https':
       // Note: Only works when PHP is compiled with OpenSSL support.
       $port = isset($uri['port']) ? $uri['port'] : 443;
       $socket = 'ssl://' . $uri['host'] . ':' . $port;
-      $options['headers']['Host'] = $uri['host'] . ($port != 443 ? ':' . $port : '');
+      if (!isset($options['headers']['Host'])) {
+        $options['headers']['Host'] = $uri['host'] . ($port != 443 ? ':' . $port : '');
+      }
       break;
 
     default:
@@ -1087,6 +1094,11 @@
       elseif ($options['max_redirects']) {
         // Redirect to the new location.
         $options['max_redirects']--;
+
+        // We need to unset the 'Host' header
+        // as we are redirecting to a new location.
+        unset($options['headers']['Host']);
+
         $result = drupal_http_request($location, $options);
         $result->redirect_code = $code;
       }
@@ -2236,8 +2248,11 @@
     'prefix' => ''
   );
 
+  // Determine whether this is an external link, but ensure that the current
+  // path is always treated as internal by default (to prevent external link
+  // injection vulnerabilities).
   if (!isset($options['external'])) {
-    $options['external'] = url_is_external($path);
+    $options['external'] = $path === $_GET['q'] ? FALSE : url_is_external($path);
   }
 
   // Preserve the original path before altering or aliasing.
@@ -2307,7 +2322,10 @@
     $language = isset($options['language']) && isset($options['language']->language) ? $options['language']->language : '';
     $alias = drupal_get_path_alias($original_path, $language);
     if ($alias != $original_path) {
-      $path = $alias;
+      // Strip leading slashes from internal path aliases to prevent them
+      // becoming external URLs without protocol. /example.com should not be
+      // turned into //example.com.
+      $path = ltrim($alias, '/');
     }
   }
 
@@ -3986,7 +4004,11 @@
   // be merged with content already on the base page. The HTML IDs must be
   // unique for the fully merged content. Therefore, initialize $seen_ids to
   // take into account IDs that are already in use on the base page.
-  $seen_ids_init = &drupal_static(__FUNCTION__ . ':init');
+  static $drupal_static_fast;
+  if (!isset($drupal_static_fast['seen_ids_init'])) {
+    $drupal_static_fast['seen_ids_init'] = &drupal_static(__FUNCTION__ . ':init');
+  }
+  $seen_ids_init = &$drupal_static_fast['seen_ids_init'];
   if (!isset($seen_ids_init)) {
     // Ideally, Drupal would provide an API to persist state information about
     // prior page requests in the database, and we'd be able to add this
@@ -4031,7 +4053,10 @@
       }
     }
   }
-  $seen_ids = &drupal_static(__FUNCTION__, $seen_ids_init);
+  if (!isset($drupal_static_fast['seen_ids'])) {
+    $drupal_static_fast['seen_ids'] = &drupal_static(__FUNCTION__, $seen_ids_init);
+  }
+  $seen_ids = &$drupal_static_fast['seen_ids'];
 
   $id = strtr(drupal_strtolower($id), array(' ' => '-', '_' => '-', '[' => '-', ']' => ''));
 
diff -Naur drupal-7.51/includes/database/pgsql/database.inc drupal-7.66/includes/database/pgsql/database.inc
--- drupal-7.51/includes/database/pgsql/database.inc	2016-10-05 20:45:42.000000000 +0200
+++ drupal-7.66/includes/database/pgsql/database.inc	2019-04-17 22:20:46.000000000 +0200
@@ -11,7 +11,7 @@
  */
 
 /**
- * The name by which to obtain a lock for retrive the next insert id.
+ * The name by which to obtain a lock for retrieving the next insert id.
  */
 define('POSTGRESQL_NEXTID_LOCK', 1000);
 
@@ -55,7 +55,7 @@
     $connection_options['pdo'] += array(
       // Prepared statements are most effective for performance when queries
       // are recycled (used several times). However, if they are not re-used,
-      // prepared statements become ineffecient. Since most of Drupal's
+      // prepared statements become inefficient. Since most of Drupal's
       // prepared queries are not re-used, it should be faster to emulate
       // the preparation than to actually ready statements for re-use. If in
       // doubt, reset to FALSE and measure performance.
@@ -175,14 +175,14 @@
   }
 
   /**
-   * Retrive a the next id in a sequence.
+   * Retrieve the next id in a sequence.
    *
    * PostgreSQL has built in sequences. We'll use these instead of inserting
    * and updating a sequences table.
    */
   public function nextId($existing = 0) {
 
-    // Retrive the name of the sequence. This information cannot be cached
+    // Retrieve the name of the sequence. This information cannot be cached
     // because the prefix may change, for example, like it does in simpletests.
     $sequence_name = $this->makeSequenceName('sequences', 'value');
 
@@ -194,7 +194,7 @@
     }
 
     // PostgreSQL advisory locks are simply locks to be used by an
-    // application such as Drupal. This will prevent other Drupal proccesses
+    // application such as Drupal. This will prevent other Drupal processes
     // from altering the sequence while we are.
     $this->query("SELECT pg_advisory_lock(" . POSTGRESQL_NEXTID_LOCK . ")");
 
@@ -209,7 +209,7 @@
     // Reset the sequence to a higher value than the existing id.
     $this->query("ALTER SEQUENCE " . $sequence_name . " RESTART WITH " . ($existing + 1));
 
-    // Retrive the next id. We know this will be as high as we want it.
+    // Retrieve the next id. We know this will be as high as we want it.
     $id = $this->query("SELECT nextval('" . $sequence_name . "')")->fetchField();
 
     $this->query("SELECT pg_advisory_unlock(" . POSTGRESQL_NEXTID_LOCK . ")");
diff -Naur drupal-7.51/includes/database/pgsql/install.inc drupal-7.66/includes/database/pgsql/install.inc
--- drupal-7.51/includes/database/pgsql/install.inc	2016-10-05 20:45:42.000000000 +0200
+++ drupal-7.66/includes/database/pgsql/install.inc	2019-04-17 22:20:46.000000000 +0200
@@ -165,7 +165,7 @@
         LANGUAGE \'sql\''
       );
 
-      // Using || to concatenate in Drupal is not recommeneded because there are
+      // Using || to concatenate in Drupal is not recommended because there are
       // database drivers for Drupal that do not support the syntax, however
       // they do support CONCAT(item1, item2) which we can replicate in
       // PostgreSQL. PostgreSQL requires the function to be defined for each
diff -Naur drupal-7.51/includes/database/pgsql/select.inc drupal-7.66/includes/database/pgsql/select.inc
--- drupal-7.51/includes/database/pgsql/select.inc	2016-10-05 20:45:42.000000000 +0200
+++ drupal-7.66/includes/database/pgsql/select.inc	2019-04-17 22:20:46.000000000 +0200
@@ -80,7 +80,7 @@
     }
 
     // If a table loads all fields, it can not be added again. It would
-    // result in an ambigious alias error because that field would be loaded
+    // result in an ambiguous alias error because that field would be loaded
     // twice: Once through table_alias.* and once directly. If the field
     // actually belongs to a different table, it must be added manually.
     foreach ($this->tables as $table) {
@@ -90,7 +90,7 @@
     }
 
     // If $field contains an characters which are not allowed in a field name
-    // it is considered an expression, these can't be handeld automatically
+    // it is considered an expression, these can't be handled automatically
     // either.
     if ($this->connection->escapeField($field) != $field) {
       return $return;
diff -Naur drupal-7.51/includes/database/query.inc drupal-7.66/includes/database/query.inc
--- drupal-7.51/includes/database/query.inc	2016-10-05 20:45:42.000000000 +0200
+++ drupal-7.66/includes/database/query.inc	2019-04-17 22:20:46.000000000 +0200
@@ -845,8 +845,8 @@
   /**
    * Executes the DELETE query.
    *
-   * @return
-   *   The return value is dependent on the database connection.
+   * @return int
+   *   The number of rows affected by the delete query.
    */
   public function execute() {
     $values = array();
@@ -1242,7 +1242,7 @@
  * MergeQuery::updateFields() and MergeQuery::insertFields() needs to be called
  * instead. MergeQuery::fields() can also be called which calls both of these
  * methods as the common case is to use the same column-value pairs for both
- * INSERT and UPDATE. However, this is not mandatory. Another convinient
+ * INSERT and UPDATE. However, this is not mandatory. Another convenient
  * wrapper is MergeQuery::key() which adds the same column-value pairs to the
  * condition and the INSERT query part.
  *
diff -Naur drupal-7.51/includes/database/schema.inc drupal-7.66/includes/database/schema.inc
--- drupal-7.51/includes/database/schema.inc	2016-10-05 20:45:42.000000000 +0200
+++ drupal-7.66/includes/database/schema.inc	2019-04-17 22:20:46.000000000 +0200
@@ -164,6 +164,9 @@
  * @see drupal_install_schema()
  */
 
+/**
+ * Base class for database schema definitions.
+ */
 abstract class DatabaseSchema implements QueryPlaceholderInterface {
 
   protected $connection;
@@ -291,7 +294,7 @@
   protected function buildTableNameCondition($table_name, $operator = '=', $add_prefix = TRUE) {
     $info = $this->connection->getConnectionOptions();
 
-    // Retrive the table name and schema
+    // Retrieve the table name and schema
     $table_info = $this->getPrefixInfo($table_name, $add_prefix);
 
     $condition = new DatabaseCondition('AND');
diff -Naur drupal-7.51/includes/database/select.inc drupal-7.66/includes/database/select.inc
--- drupal-7.51/includes/database/select.inc	2016-10-05 20:45:42.000000000 +0200
+++ drupal-7.66/includes/database/select.inc	2019-04-17 22:20:46.000000000 +0200
@@ -1231,6 +1231,21 @@
 
     // Modules may alter all queries or only those having a particular tag.
     if (isset($this->alterTags)) {
+      // Many contrib modules assume that query tags used for access-checking
+      // purposes follow the pattern $entity_type . '_access'. But this is
+      // not the case for taxonomy terms, since core used to add term_access
+      // instead of taxonomy_term_access to its queries. Provide backwards
+      // compatibility by adding both tags here instead of attempting to fix
+      // all contrib modules in a coordinated effort.
+      // TODO:
+      // - Extract this mechanism into a hook as part of a public (non-security)
+      //   issue.
+      // - Emit E_USER_DEPRECATED if term_access is used.
+      //   https://www.drupal.org/node/2575081
+      $term_access_tags = array('term_access' => 1, 'taxonomy_term_access' => 1);
+      if (array_intersect_key($this->alterTags, $term_access_tags)) {
+        $this->alterTags += $term_access_tags;
+      }
       $hooks = array('query');
       foreach ($this->alterTags as $tag => $value) {
         $hooks[] = 'query_' . $tag;
diff -Naur drupal-7.51/includes/database/sqlite/query.inc drupal-7.66/includes/database/sqlite/query.inc
--- drupal-7.51/includes/database/sqlite/query.inc	2016-10-05 20:45:42.000000000 +0200
+++ drupal-7.66/includes/database/sqlite/query.inc	2019-04-17 22:20:46.000000000 +0200
@@ -99,16 +99,15 @@
 
 /**
  * SQLite specific implementation of DeleteQuery.
- *
- * When the WHERE is omitted from a DELETE statement and the table being deleted
- * has no triggers, SQLite uses an optimization to erase the entire table content
- * without having to visit each row of the table individually.
- *
- * Prior to SQLite 3.6.5, SQLite does not return the actual number of rows deleted
- * by that optimized "truncate" optimization.
  */
 class DeleteQuery_sqlite extends DeleteQuery {
   public function execute() {
+    // When the WHERE is omitted from a DELETE statement and the table being
+    // deleted has no triggers, SQLite uses an optimization to erase the entire
+    // table content without having to visit each row of the table individually.
+    // Prior to SQLite 3.6.5, SQLite does not return the actual number of rows
+    // deleted by that optimized "truncate" optimization. But we want to return
+    // the number of rows affected, so we calculate it directly.
     if (!count($this->condition)) {
       $total_rows = $this->connection->query('SELECT COUNT(*) FROM {' . $this->connection->escapeTable($this->table) . '}')->fetchField();
       parent::execute();
diff -Naur drupal-7.51/includes/database/sqlite/schema.inc drupal-7.66/includes/database/sqlite/schema.inc
--- drupal-7.51/includes/database/sqlite/schema.inc	2016-10-05 20:45:42.000000000 +0200
+++ drupal-7.66/includes/database/sqlite/schema.inc	2019-04-17 22:20:46.000000000 +0200
@@ -244,7 +244,7 @@
     // database. So the syntax '...RENAME TO database.table' would fail.
     // So we must determine the full table name here rather than surrounding
     // the table with curly braces incase the db_prefix contains a reference
-    // to a database outside of our existsing database.
+    // to a database outside of our existing database.
     $info = $this->getPrefixInfo($new_name);
     $this->connection->query('ALTER TABLE {' . $table . '} RENAME TO ' . $info['table']);
 
diff -Naur drupal-7.51/includes/date.inc drupal-7.66/includes/date.inc
--- drupal-7.51/includes/date.inc	2016-10-05 20:45:42.000000000 +0200
+++ drupal-7.66/includes/date.inc	2019-04-17 22:20:46.000000000 +0200
@@ -14,11 +14,6 @@
   // Short date formats.
   $formats[] = array(
     'type' => 'short',
-    'format' => 'Y-m-d H:i',
-    'locales' => array(),
-  );
-  $formats[] = array(
-    'type' => 'short',
     'format' => 'm/d/Y - H:i',
     'locales' => array('en-us'),
   );
@@ -39,6 +34,11 @@
   );
   $formats[] = array(
     'type' => 'short',
+    'format' => 'Y-m-d H:i',
+    'locales' => array(),
+  );
+  $formats[] = array(
+    'type' => 'short',
     'format' => 'm/d/Y - g:ia',
     'locales' => array(),
   );
@@ -86,11 +86,6 @@
   // Medium date formats.
   $formats[] = array(
     'type' => 'medium',
-    'format' => 'D, Y-m-d H:i',
-    'locales' => array(),
-  );
-  $formats[] = array(
-    'type' => 'medium',
     'format' => 'D, m/d/Y - H:i',
     'locales' => array('en-us'),
   );
@@ -106,6 +101,11 @@
   );
   $formats[] = array(
     'type' => 'medium',
+    'format' => 'D, Y-m-d H:i',
+    'locales' => array(),
+  );
+  $formats[] = array(
+    'type' => 'medium',
     'format' => 'F j, Y - H:i',
     'locales' => array(),
   );
diff -Naur drupal-7.51/includes/errors.inc drupal-7.66/includes/errors.inc
--- drupal-7.51/includes/errors.inc	2016-10-05 20:45:42.000000000 +0200
+++ drupal-7.66/includes/errors.inc	2019-04-17 22:20:46.000000000 +0200
@@ -66,7 +66,7 @@
     _drupal_log_error(array(
       '%type' => isset($types[$error_level]) ? $severity_msg : 'Unknown error',
       // The standard PHP error handler considers that the error messages
-      // are HTML. We mimick this behavior here.
+      // are HTML. We mimic this behavior here.
       '!message' => filter_xss_admin($message),
       '%function' => $caller['function'],
       '%file' => $caller['file'],
@@ -114,7 +114,7 @@
   return array(
     '%type' => get_class($exception),
     // The standard PHP exception handler considers that the exception message
-    // is plain-text. We mimick this behavior here.
+    // is plain-text. We mimic this behavior here.
     '!message' => check_plain($message),
     '%function' => $caller['function'],
     '%file' => $caller['file'],
@@ -233,7 +233,7 @@
   }
   else {
     // Display the message if the current error reporting level allows this type
-    // of message to be displayed, and unconditionnaly in update.php.
+    // of message to be displayed, and unconditionally in update.php.
     if (error_displayable($error)) {
       $class = 'error';
 
diff -Naur drupal-7.51/includes/file.inc drupal-7.66/includes/file.inc
--- drupal-7.51/includes/file.inc	2016-10-05 20:45:42.000000000 +0200
+++ drupal-7.66/includes/file.inc	2019-04-17 22:20:46.000000000 +0200
@@ -535,7 +535,18 @@
 EOF;
 
   if ($private) {
-    $lines = "Deny from all\n\n" . $lines;
+    $lines = <<<EOF
+# Deny all requests from Apache 2.4+.
+<IfModule mod_authz_core.c>
+  Require all denied
+</IfModule>
+
+# Deny all requests from Apache 2.0-2.2.
+<IfModule !mod_authz_core.c>
+  Deny from all
+</IfModule>
+EOF
+    . "\n\n" . $lines;
   }
 
   return $lines;
@@ -889,7 +900,6 @@
  */
 function file_unmanaged_copy($source, $destination = NULL, $replace = FILE_EXISTS_RENAME) {
   $original_source = $source;
-  $original_destination = $destination;
 
   // Assert that the source file actually exists.
   if (!file_exists($source)) {
@@ -983,8 +993,15 @@
  * @return
  *   The destination filepath, or FALSE if the file already exists
  *   and FILE_EXISTS_ERROR is specified.
+ *
+ * @throws RuntimeException
+ *   Thrown if the filename contains invalid UTF-8.
  */
 function file_destination($destination, $replace) {
+  $basename = drupal_basename($destination);
+  if (!drupal_validate_utf8($basename)) {
+    throw new RuntimeException(sprintf("Invalid filename '%s'", $basename));
+  }
   if (file_exists($destination)) {
     switch ($replace) {
       case FILE_EXISTS_REPLACE:
@@ -992,7 +1009,6 @@
         break;
 
       case FILE_EXISTS_RENAME:
-        $basename = drupal_basename($destination);
         $directory = drupal_dirname($destination);
         $destination = file_create_filename($basename, $directory);
         break;
@@ -1208,11 +1224,20 @@
  * @return
  *   File path consisting of $directory and a unique filename based off
  *   of $basename.
+ *
+ * @throws RuntimeException
+ *   Thrown if the $basename is not valid UTF-8 or another error occurs
+ *   stripping control characters.
  */
 function file_create_filename($basename, $directory) {
+  $original = $basename;
   // Strip control characters (ASCII value < 32). Though these are allowed in
   // some filesystems, not many applications handle them well.
   $basename = preg_replace('/[\x00-\x1F]/u', '_', $basename);
+  if (preg_last_error() !== PREG_NO_ERROR) {
+    throw new RuntimeException(sprintf("Invalid filename '%s'", $original));
+  }
+
   if (substr(PHP_OS, 0, 3) == 'WIN') {
     // These characters are not allowed in Windows filenames
     $basename = str_replace(array(':', '*', '?', '"', '<', '>', '|'), '_', $basename);
@@ -1524,9 +1549,9 @@
   // rename filename.php.foo and filename.php to filename.php.foo.txt and
   // filename.php.txt, respectively). Don't rename if 'allow_insecure_uploads'
   // evaluates to TRUE.
-  if (!variable_get('allow_insecure_uploads', 0) && preg_match('/\.(php|pl|py|cgi|asp|js)(\.|$)/i', $file->filename) && (substr($file->filename, -4) != '.txt')) {
+  if (!variable_get('allow_insecure_uploads', 0) && preg_match('/\.(php|phar|pl|py|cgi|asp|js)(\.|$)/i', $file->filename) && (substr($file->filename, -4) != '.txt')) {
     $file->filemime = 'text/plain';
-    $file->uri .= '.txt';
+    // The destination filename will also later be used to create the URI.
     $file->filename .= '.txt';
     // The .txt extension may not be in the allowed list of extensions. We have
     // to add it here or else the file upload will fail.
@@ -1553,7 +1578,13 @@
   if (substr($destination, -1) != '/') {
     $destination .= '/';
   }
-  $file->destination = file_destination($destination . $file->filename, $replace);
+  try {
+    $file->destination = file_destination($destination . $file->filename, $replace);
+  }
+  catch (RuntimeException $e) {
+    drupal_set_message(t('The file %source could not be uploaded because the name is invalid.', array('%source' => $form_field_name)), 'error');
+    return FALSE;
+  }
   // If file_destination() returns FALSE then $replace == FILE_EXISTS_ERROR and
   // there's an existing file so we need to bail.
   if ($file->destination === FALSE) {
@@ -1604,6 +1635,20 @@
 
   // If we made it this far it's safe to record this file in the database.
   if ($file = file_save($file)) {
+    // Track non-public files in the session if they were uploaded by an
+    // anonymous user. This allows modules such as the File module to only
+    // grant view access to the specific anonymous user who uploaded the file.
+    // See file_file_download().
+    // The 'file_public_schema' variable is used to allow other publicly
+    // accessible file schemes to be treated the same as the public:// scheme
+    // provided by Drupal core and to avoid adding unnecessary data to the
+    // session (and the resulting bypass of the page cache) in those cases. For
+    // security reasons, only schemes that are completely publicly accessible,
+    // with no download restrictions, should be added to this variable. See
+    // file_managed_file_value().
+    if (!$user->uid && !in_array($destination_scheme, variable_get('file_public_schema', array('public')))) {
+      $_SESSION['anonymous_allowed_file_ids'][$file->fid] = $file->fid;
+    }
     // Add file to the cache.
     $upload_cache[$form_field_name] = $file;
     return $file;
@@ -2106,9 +2151,33 @@
  *   'filename', and 'name' members corresponding to the matching files.
  */
 function file_scan_directory($dir, $mask, $options = array(), $depth = 0) {
+  // Default nomask option.
+  $nomask = '/(\.\.?|CVS)$/';
+
+  // Overrides the $nomask variable accordingly if $options['nomask'] is set.
+  //
+  // Allow directories specified in settings.php to be ignored. You can use this
+  // to not check for files in common special-purpose directories. For example,
+  // node_modules and bower_components. Ignoring irrelevant directories is a
+  // performance boost.
+  if (!isset($options['nomask'])) {
+    $ignore_directories = variable_get(
+      'file_scan_ignore_directories',
+      array()
+    );
+
+    foreach ($ignore_directories as $index => $ignore_directory) {
+      $ignore_directories[$index] = preg_quote($ignore_directory, '/');
+    }
+
+    if (!empty($ignore_directories)) {
+      $nomask = '/^(\.\.?)|CVS|' . implode('|', $ignore_directories) . '$/';
+    }
+  }
+
   // Merge in defaults.
   $options += array(
-    'nomask' => '/(\.\.?|CVS)$/',
+    'nomask' => $nomask,
     'callback' => 0,
     'recurse' => TRUE,
     'key' => 'uri',
@@ -2553,7 +2622,6 @@
  *   An associative array of headers, as expected by file_transfer().
  */
 function file_get_content_headers($file) {
-  $name = mime_header_encode($file->filename);
   $type = mime_header_encode($file->filemime);
 
   return array(
diff -Naur drupal-7.51/includes/file.phar.inc drupal-7.66/includes/file.phar.inc
--- drupal-7.51/includes/file.phar.inc	1970-01-01 01:00:00.000000000 +0100
+++ drupal-7.66/includes/file.phar.inc	2019-04-17 22:20:46.000000000 +0200
@@ -0,0 +1,41 @@
+<?php
+
+use Drupal\Core\Security\PharExtensionInterceptor;
+use TYPO3\PharStreamWrapper\Manager as PharStreamWrapperManager;
+use TYPO3\PharStreamWrapper\Behavior as PharStreamWrapperBehavior;
+use TYPO3\PharStreamWrapper\PharStreamWrapper;
+
+/**
+ * Registers a phar stream wrapper that is more secure than PHP's built-in one.
+ *
+ * @see file_get_stream_wrappers()
+ */
+function file_register_phar_wrapper() {
+  $directory = DRUPAL_ROOT . '/misc/typo3/phar-stream-wrapper/src';
+  include_once $directory . '/Assertable.php';
+  include_once $directory . '/Behavior.php';
+  include_once $directory . '/Exception.php';
+  include_once $directory . '/Helper.php';
+  include_once $directory . '/Manager.php';
+  include_once $directory . '/PharStreamWrapper.php';
+  include_once DRUPAL_ROOT . '/misc/typo3/drupal-security/PharExtensionInterceptor.php';
+
+  // Set up a stream wrapper to handle insecurities due to PHP's built-in
+  // phar stream wrapper.
+  try {
+    $behavior = new PharStreamWrapperBehavior();
+    PharStreamWrapperManager::initialize(
+      $behavior->withAssertion(new PharExtensionInterceptor())
+    );
+  }
+  catch (\LogicException $e) {
+    // Continue if the PharStreamWrapperManager is already initialized.
+    // For example, this occurs following a drupal_static_reset(), such
+    // as during tests.
+  };
+
+  // To prevent file_stream_wrapper_valid_scheme() treating "phar" as a valid
+  // scheme, this is registered with PHP only, not with  hook_stream_wrappers()
+  // or the internal storage of file_get_stream_wrappers().
+  stream_wrapper_register('phar', '\\TYPO3\\PharStreamWrapper\\PharStreamWrapper');
+}
diff -Naur drupal-7.51/includes/form.inc drupal-7.66/includes/form.inc
--- drupal-7.51/includes/form.inc	2016-10-05 20:45:42.000000000 +0200
+++ drupal-7.66/includes/form.inc	2019-04-17 22:20:46.000000000 +0200
@@ -555,8 +555,10 @@
  * Stores a form in the cache.
  */
 function form_set_cache($form_build_id, $form, $form_state) {
-  // 6 hours cache life time for forms should be plenty.
-  $expire = 21600;
+  // The default cache_form expiration is 6 hours. On busy sites, the cache_form
+  // table can become very large. A shorter cache lifetime can help to keep the
+  // table's size under control.
+  $expire = variable_get('form_cache_expiration', 21600);
 
   // Ensure that the form build_id embedded in the form structure is the same as
   // the one passed in as a parameter. This is an additional safety measure to
@@ -1176,7 +1178,7 @@
   // If the session token was set by drupal_prepare_form(), ensure that it
   // matches the current user's session. This is duplicate to code in
   // form_builder() but left to protect any custom form handling code.
-  if (isset($form['#token'])) {
+  if (!empty($form['#token'])) {
     if (!drupal_valid_token($form_state['values']['form_token'], $form['#token']) || !empty($form_state['invalid_token'])) {
       _drupal_invalid_token_set_form_error();
       // Stop here and don't run any further validation handlers, because they
@@ -1438,10 +1440,12 @@
       // length if it's a string, and the item count if it's an array.
       // An unchecked checkbox has a #value of integer 0, different than string
       // '0', which could be a valid value.
-      $is_empty_multiple = (!count($elements['#value']));
+      $is_countable = is_array($elements['#value']) || $elements['#value'] instanceof Countable;
+      $is_empty_multiple = $is_countable && count($elements['#value']) == 0;
       $is_empty_string = (is_string($elements['#value']) && drupal_strlen(trim($elements['#value'])) == 0);
       $is_empty_value = ($elements['#value'] === 0);
-      if ($is_empty_multiple || $is_empty_string || $is_empty_value) {
+      $is_empty_null = is_null($elements['#value']);
+      if ($is_empty_multiple || $is_empty_string || $is_empty_value || $is_empty_null) {
         // Although discouraged, a #title is not mandatory for form elements. In
         // case there is no #title, we cannot set a form error message.
         // Instead of setting no #title, form constructors are encouraged to set
@@ -1837,7 +1841,7 @@
       // If the session token was set by drupal_prepare_form(), ensure that it
       // matches the current user's session.
       $form_state['invalid_token'] = FALSE;
-      if (isset($element['#token'])) {
+      if (!empty($element['#token'])) {
         if (empty($form_state['input']['form_token']) || !drupal_valid_token($form_state['input']['form_token'], $element['#token'])) {
           // Set an early form error to block certain input processing since that
           // opens the door for CSRF vulnerabilities.
diff -Naur drupal-7.51/includes/install.inc drupal-7.66/includes/install.inc
--- drupal-7.51/includes/install.inc	2016-10-05 20:45:42.000000000 +0200
+++ drupal-7.66/includes/install.inc	2019-04-17 22:20:46.000000000 +0200
@@ -779,7 +779,7 @@
     $module_list = array_flip(array_values($module_list));
 
     $profile = drupal_get_profile();
-    while (list($module) = each($module_list)) {
+    foreach (array_keys($module_list) as $module) {
       if (!isset($module_data[$module]) || drupal_get_installed_schema_version($module) == SCHEMA_UNINSTALLED) {
         // This module doesn't exist or is already uninstalled. Skip it.
         unset($module_list[$module]);
diff -Naur drupal-7.51/includes/menu.inc drupal-7.66/includes/menu.inc
--- drupal-7.51/includes/menu.inc	2016-10-05 20:45:42.000000000 +0200
+++ drupal-7.66/includes/menu.inc	2019-04-17 22:20:46.000000000 +0200
@@ -576,7 +576,8 @@
           // 'load arguments' in the hook_menu() entry, but they need
           // some processing. In this case the $function is the key to the
           // load_function array, and the value is the list of arguments.
-          list($function, $args) = each($function);
+          $args = current($function);
+          $function = key($function);
           $load_functions[$index] = $function;
 
           // Some arguments are placeholders for dynamic items to process.
@@ -1606,6 +1607,7 @@
  * Implements template_preprocess_HOOK() for theme_menu_tree().
  */
 function template_preprocess_menu_tree(&$variables) {
+  $variables['#tree'] = $variables['tree'];
   $variables['tree'] = $variables['tree']['#children'];
 }
 
@@ -2401,7 +2403,8 @@
       // a stripped down menu tree containing the active trail only, in case
       // the given menu has not been built in this request yet.
       $tree = menu_tree_page_data($preferred_link['menu_name'], NULL, TRUE);
-      list($key, $curr) = each($tree);
+      $curr = current($tree);
+      next($tree);
     }
     // There is no link for the current path.
     else {
@@ -2431,7 +2434,8 @@
         }
         $tree = $curr['below'] ? $curr['below'] : array();
       }
-      list($key, $curr) = each($tree);
+      $curr = current($tree);
+      next($tree);
     }
     // Make sure the current page is in the trail to build the page title, by
     // appending either the preferred link or the menu router item for the
@@ -2682,7 +2686,7 @@
 }
 
 /**
- * Clears the cached cached data for a single named menu.
+ * Clears the cached data for a single named menu.
  */
 function menu_cache_clear($menu_name = 'navigation') {
   $cache_cleared = &drupal_static(__FUNCTION__, array());
diff -Naur drupal-7.51/includes/module.inc drupal-7.66/includes/module.inc
--- drupal-7.51/includes/module.inc	2016-10-05 20:45:42.000000000 +0200
+++ drupal-7.66/includes/module.inc	2019-04-17 22:20:46.000000000 +0200
@@ -404,7 +404,11 @@
     // Create an associative array with weights as values.
     $module_list = array_flip(array_values($module_list));
 
-    while (list($module) = each($module_list)) {
+    // The array is iterated over manually (instead of using a foreach) because
+    // modules may be added to the list within the loop and we need to process
+    // them.
+    while ($module = key($module_list)) {
+      next($module_list);
       if (!isset($module_data[$module])) {
         // This module is not found in the filesystem, abort.
         return FALSE;
@@ -540,7 +544,11 @@
     $module_list = array_flip(array_values($module_list));
 
     $profile = drupal_get_profile();
-    while (list($module) = each($module_list)) {
+    // The array is iterated over manually (instead of using a foreach) because
+    // modules may be added to the list within the loop and we need to process
+    // them.
+    while ($module = key($module_list)) {
+      next($module_list);
       if (!isset($module_data[$module]) || !$module_data[$module]->status) {
         // This module doesn't exist or is already disabled, skip it.
         unset($module_list[$module]);
diff -Naur drupal-7.51/includes/registry.inc drupal-7.66/includes/registry.inc
--- drupal-7.51/includes/registry.inc	2016-10-05 20:45:42.000000000 +0200
+++ drupal-7.66/includes/registry.inc	2019-04-17 22:20:46.000000000 +0200
@@ -19,7 +19,6 @@
  * Does the work for registry_update().
  */
 function _registry_update() {
-
   // The registry serves as a central autoloader for all classes, including
   // the database query builders. However, the registry rebuild process
   // requires write ability to the database, which means having access to the
@@ -33,6 +32,11 @@
   require_once DRUPAL_ROOT . '/includes/database/select.inc';
   require_once DRUPAL_ROOT . '/includes/database/' . $driver . '/query.inc';
 
+  // During the first registry rebuild in a request, we check all the files.
+  // During subsequent rebuilds, we only add new files. It makes the rebuilding
+  // process faster during installation of modules.
+  static $check_existing_files = TRUE;
+
   // Get current list of modules and their files.
   $modules = db_query("SELECT * FROM {system} WHERE type = 'module'")->fetchAll();
   // Get the list of files we are going to parse.
@@ -55,6 +59,9 @@
     $files["$filename"] = array('module' => '', 'weight' => 0);
   }
 
+  // Initialize an empty array for the unchanged files.
+  $unchanged_files = array();
+
   $transaction = db_transaction();
   try {
     // Allow modules to manually modify the list of files before the registry
@@ -63,10 +70,19 @@
     // list can then be added to the list of files that the registry will parse,
     // or modify attributes of a file.
     drupal_alter('registry_files', $files, $modules);
+
     foreach (registry_get_parsed_files() as $filename => $file) {
       // Add the hash for those files we have already parsed.
       if (isset($files[$filename])) {
-        $files[$filename]['hash'] = $file['hash'];
+        if ($check_existing_files === TRUE) {
+          $files[$filename]['hash'] = $file['hash'];
+        }
+        else {
+          // Ignore that file for this request, it has been parsed previously
+          // and it is unlikely it has changed.
+          unset($files[$filename]);
+          $unchanged_files[$filename] = $file;
+        }
       }
       else {
         // Flush the registry of resources in files that are no longer on disc
@@ -79,8 +95,12 @@
           ->execute();
       }
     }
+
     $parsed_files = _registry_parse_files($files);
 
+    // Add unchanged files to the files.
+    $files += $unchanged_files;
+
     $unchanged_resources = array();
     $lookup_cache = array();
     if ($cache = cache_get('lookup_cache', 'cache_bootstrap')) {
@@ -89,12 +109,10 @@
     foreach ($lookup_cache as $key => $file) {
       // If the file for this cached resource is carried over unchanged from
       // the last registry build, then we can safely re-cache it.
-      if ($file && in_array($file, array_keys($files)) && !in_array($file, $parsed_files)) {
+      if ($file && isset($files[$file]) && !in_array($file, $parsed_files, TRUE)) {
         $unchanged_resources[$key] = $file;
       }
     }
-    module_implements('', FALSE, TRUE);
-    _registry_check_code(REGISTRY_RESET_LOOKUP_CACHE);
   }
   catch (Exception $e) {
     $transaction->rollback();
@@ -102,6 +120,13 @@
     throw $e;
   }
 
+  module_implements('', FALSE, TRUE);
+  _registry_check_code(REGISTRY_RESET_LOOKUP_CACHE);
+
+  // During the next run in this request, don't bother re-checking existing
+  // files.
+  $check_existing_files = FALSE;
+
   // We have some unchanged resources, warm up the cache - no need to pay
   // for looking them up again.
   if (count($unchanged_resources) > 0) {
diff -Naur drupal-7.51/includes/request-sanitizer.inc drupal-7.66/includes/request-sanitizer.inc
--- drupal-7.51/includes/request-sanitizer.inc	1970-01-01 01:00:00.000000000 +0100
+++ drupal-7.66/includes/request-sanitizer.inc	2019-04-17 22:20:46.000000000 +0200
@@ -0,0 +1,114 @@
+<?php
+
+/**
+ * @file
+ * Contains code for sanitizing user input from the request.
+ */
+
+/**
+ * Sanitizes user input from the request.
+ */
+class DrupalRequestSanitizer {
+
+  /**
+   * Tracks whether the request was already sanitized.
+   */
+  protected static $sanitized = FALSE;
+
+  /**
+   * Modifies the request to strip dangerous keys from user input.
+   */
+  public static function sanitize() {
+    if (!self::$sanitized) {
+      $whitelist = variable_get('sanitize_input_whitelist', array());
+      $log_sanitized_keys = variable_get('sanitize_input_logging', FALSE);
+
+      // Process query string parameters.
+      $get_sanitized_keys = array();
+      $_GET = self::stripDangerousValues($_GET, $whitelist, $get_sanitized_keys);
+      if ($log_sanitized_keys && $get_sanitized_keys) {
+        _drupal_trigger_error_with_delayed_logging(format_string('Potentially unsafe keys removed from query string parameters (GET): @keys', array('@keys' => implode(', ', $get_sanitized_keys))), E_USER_NOTICE);
+      }
+
+      // Process request body parameters.
+      $post_sanitized_keys = array();
+      $_POST = self::stripDangerousValues($_POST, $whitelist, $post_sanitized_keys);
+      if ($log_sanitized_keys && $post_sanitized_keys) {
+        _drupal_trigger_error_with_delayed_logging(format_string('Potentially unsafe keys removed from request body parameters (POST): @keys', array('@keys' => implode(', ', $post_sanitized_keys))), E_USER_NOTICE);
+      }
+
+      // Process cookie parameters.
+      $cookie_sanitized_keys = array();
+      $_COOKIE = self::stripDangerousValues($_COOKIE, $whitelist, $cookie_sanitized_keys);
+      if ($log_sanitized_keys && $cookie_sanitized_keys) {
+        _drupal_trigger_error_with_delayed_logging(format_string('Potentially unsafe keys removed from cookie parameters (COOKIE): @keys', array('@keys' => implode(', ', $cookie_sanitized_keys))), E_USER_NOTICE);
+      }
+
+      $request_sanitized_keys = array();
+      $_REQUEST = self::stripDangerousValues($_REQUEST, $whitelist, $request_sanitized_keys);
+
+      self::$sanitized = TRUE;
+    }
+  }
+
+  /**
+   * Removes the destination if it is dangerous.
+   *
+   * Note this can only be called after common.inc has been included.
+   *
+   * @return bool
+   *   TRUE if the destination has been removed from $_GET, FALSE if not.
+   */
+  public static function cleanDestination() {
+    $dangerous_keys = array();
+    $log_sanitized_keys = variable_get('sanitize_input_logging', FALSE);
+
+    $parts = drupal_parse_url($_GET['destination']);
+    // If there is a query string, check its query parameters.
+    if (!empty($parts['query'])) {
+      $whitelist = variable_get('sanitize_input_whitelist', array());
+
+      self::stripDangerousValues($parts['query'], $whitelist, $dangerous_keys);
+      if (!empty($dangerous_keys)) {
+        // The destination is removed rather than sanitized to mirror the
+        // handling of external destinations.
+        unset($_GET['destination']);
+        unset($_REQUEST['destination']);
+        if ($log_sanitized_keys) {
+          trigger_error(format_string('Potentially unsafe destination removed from query string parameters (GET) because it contained the following keys: @keys', array('@keys' => implode(', ', $dangerous_keys))));
+        }
+        return TRUE;
+      }
+    }
+    return FALSE;
+  }
+
+  /**
+   * Strips dangerous keys from the provided input.
+   *
+   * @param mixed $input
+   *   The input to sanitize.
+   * @param string[] $whitelist
+   *   An array of keys to whitelist as safe.
+   * @param string[] $sanitized_keys
+   *   An array of keys that have been removed.
+   *
+   * @return mixed
+   *   The sanitized input.
+   */
+  protected static function stripDangerousValues($input, array $whitelist, array &$sanitized_keys) {
+    if (is_array($input)) {
+      foreach ($input as $key => $value) {
+        if ($key !== '' && $key[0] === '#' && !in_array($key, $whitelist, TRUE)) {
+          unset($input[$key]);
+          $sanitized_keys[] = $key;
+        }
+        else {
+          $input[$key] = self::stripDangerousValues($input[$key], $whitelist, $sanitized_keys);
+        }
+      }
+    }
+    return $input;
+  }
+
+}
diff -Naur drupal-7.51/includes/stream_wrappers.inc drupal-7.66/includes/stream_wrappers.inc
--- drupal-7.51/includes/stream_wrappers.inc	2016-10-05 20:45:42.000000000 +0200
+++ drupal-7.66/includes/stream_wrappers.inc	2019-04-17 22:20:46.000000000 +0200
@@ -133,7 +133,7 @@
    * @param $uri
    *   A string containing the URI that should be used for this instance.
    */
-  function setUri($uri);
+  public function setUri($uri);
 
   /**
    * Returns the stream resource URI.
@@ -219,7 +219,6 @@
   public function dirname($uri = NULL);
 }
 
-
 /**
  * Drupal stream wrapper base class for local files.
  *
@@ -550,6 +549,155 @@
   }
 
   /**
+   * Sets metadata on the stream.
+   *
+   * WARNING: Do not call this method directly! It will be called internally by
+   * PHP itself when one of the following functions is called on a stream URL:
+   *
+   * @param string $uri
+   *   A string containing the URI to the file to set metadata on.
+   * @param int $option
+   *   One of:
+   *   - STREAM_META_TOUCH: The method was called in response to touch().
+   *   - STREAM_META_OWNER_NAME: The method was called in response to chown()
+   *     with string parameter.
+   *   - STREAM_META_OWNER: The method was called in response to chown().
+   *   - STREAM_META_GROUP_NAME: The method was called in response to chgrp().
+   *   - STREAM_META_GROUP: The method was called in response to chgrp().
+   *   - STREAM_META_ACCESS: The method was called in response to chmod().
+   * @param mixed $value
+   *   If option is:
+   *   - STREAM_META_TOUCH: Array consisting of two arguments of the touch()
+   *     function.
+   *   - STREAM_META_OWNER_NAME or STREAM_META_GROUP_NAME: The name of the owner
+   *     user/group as string.
+   *   - STREAM_META_OWNER or STREAM_META_GROUP: The value of the owner
+   *     user/group as integer.
+   *   - STREAM_META_ACCESS: The argument of the chmod() as integer.
+   *
+   * @return bool
+   *   Returns TRUE on success or FALSE on failure. If $option is not
+   *   implemented, FALSE should be returned.
+   *
+   * @see touch()
+   * @see chmod()
+   * @see chown()
+   * @see chgrp()
+   * @link http://php.net/manual/streamwrapper.stream-metadata.php
+   */
+  public function stream_metadata($uri, $option, $value) {
+    $target = $this->getLocalPath($uri);
+    $return = FALSE;
+    switch ($option) {
+      case STREAM_META_TOUCH:
+        if (!empty($value)) {
+          $return = touch($target, $value[0], $value[1]);
+        }
+        else {
+          $return = touch($target);
+        }
+        break;
+
+      case STREAM_META_OWNER_NAME:
+      case STREAM_META_OWNER:
+        $return = chown($target, $value);
+        break;
+
+      case STREAM_META_GROUP_NAME:
+      case STREAM_META_GROUP:
+        $return = chgrp($target, $value);
+        break;
+
+      case STREAM_META_ACCESS:
+        $return = chmod($target, $value);
+        break;
+    }
+    if ($return) {
+      // For convenience clear the file status cache of the underlying file,
+      // since metadata operations are often followed by file status checks.
+      clearstatcache(TRUE, $target);
+    }
+    return $return;
+  }
+
+  /**
+   * Truncate stream.
+   *
+   * Will respond to truncation; e.g., through ftruncate().
+   *
+   * @param int $new_size
+   *   The new size.
+   *
+   * @return bool
+   *   TRUE on success, FALSE otherwise.
+   */
+  public function stream_truncate($new_size) {
+    return ftruncate($this->handle, $new_size);
+  }
+
+  /**
+   * Retrieve the underlying stream resource.
+   *
+   * This method is called in response to stream_select().
+   *
+   * @param int $cast_as
+   *   Can be STREAM_CAST_FOR_SELECT when stream_select() is calling
+   *   stream_cast() or STREAM_CAST_AS_STREAM when stream_cast() is called for
+   *   other uses.
+   *
+   * @return resource|false
+   *   The underlying stream resource or FALSE if stream_select() is not
+   *   supported.
+   *
+   * @see stream_select()
+   * @link http://php.net/manual/streamwrapper.stream-cast.php
+   */
+  public function stream_cast($cast_as) {
+    return $this->handle ? $this->handle : FALSE;
+  }
+
+  /**
+   * Change stream options.
+   *
+   * This method is called to set options on the stream.
+   *
+   * Since Windows systems do not allow it and it is not needed for most use
+   * cases anyway, this method is not supported on local files and will trigger
+   * an error and return false. If needed, custom subclasses can provide
+   * OS-specific implementations for advanced use cases.
+   *
+   * @param int $option
+   *   One of:
+   *   - STREAM_OPTION_BLOCKING: The method was called in response to
+   *     stream_set_blocking().
+   *   - STREAM_OPTION_READ_TIMEOUT: The method was called in response to
+   *     stream_set_timeout().
+   *   - STREAM_OPTION_WRITE_BUFFER: The method was called in response to
+   *     stream_set_write_buffer().
+   * @param int $arg1
+   *   If option is:
+   *   - STREAM_OPTION_BLOCKING: The requested blocking mode:
+   *     - 1 means blocking.
+   *     - 0 means not blocking.
+   *   - STREAM_OPTION_READ_TIMEOUT: The timeout in seconds.
+   *   - STREAM_OPTION_WRITE_BUFFER: The buffer mode, STREAM_BUFFER_NONE or
+   *     STREAM_BUFFER_FULL.
+   * @param int $arg2
+   *   If option is:
+   *   - STREAM_OPTION_BLOCKING: This option is not set.
+   *   - STREAM_OPTION_READ_TIMEOUT: The timeout in microseconds.
+   *   - STREAM_OPTION_WRITE_BUFFER: The requested buffer size.
+   *
+   * @return bool
+   *   TRUE on success, FALSE otherwise. If $option is not implemented, FALSE
+   *   should be returned.
+   */
+  public function stream_set_option($option, $arg1, $arg2) {
+    trigger_error('stream_set_option() not supported for local file based stream wrappers', E_USER_WARNING);
+    return FALSE;
+  }
+
+  /**
    * Support for unlink().
    *
    * @param $uri
diff -Naur drupal-7.51/includes/theme.inc drupal-7.66/includes/theme.inc
--- drupal-7.51/includes/theme.inc	2016-10-05 20:45:42.000000000 +0200
+++ drupal-7.66/includes/theme.inc	2019-04-17 22:20:46.000000000 +0200
@@ -1776,13 +1776,13 @@
  *     http://www.w3.org/TR/WCAG-TECHS/H42.html for more information.
  */
 function theme_links($variables) {
-  $links = $variables['links'];
-  $attributes = $variables['attributes'];
+  $links = (array) $variables['links'];
+  $attributes = (array) $variables['attributes'];
   $heading = $variables['heading'];
   global $language_url;
   $output = '';
 
-  if (count($links) > 0) {
+  if (!empty($links)) {
     // Treat the heading first if it is present to prepend it to the
     // list of links.
     if (!empty($heading)) {
@@ -1995,7 +1995,7 @@
   $empty = $variables['empty'];
 
   // Add sticky headers, if applicable.
-  if (count($header) && $sticky) {
+  if (!empty($header) && $sticky) {
     drupal_add_js('misc/tableheader.js');
     // Add 'sticky-enabled' class to the table to identify it for JS.
     // This is needed to target tables constructed by this function.
@@ -2009,7 +2009,7 @@
   }
 
   // Format the table columns:
-  if (count($colgroups)) {
+  if (!empty($colgroups)) {
     foreach ($colgroups as $number => $colgroup) {
       $attributes = array();
 
@@ -2044,38 +2044,40 @@
   }
 
   // Add the 'empty' row message if available.
-  if (!count($rows) && $empty) {
+  if (empty($rows) && $empty) {
     $header_count = 0;
-    foreach ($header as $header_cell) {
-      if (is_array($header_cell)) {
-        $header_count += isset($header_cell['colspan']) ? $header_cell['colspan'] : 1;
-      }
-      else {
-        $header_count++;
+    if (!empty($header)) {
+      foreach ($header as $header_cell) {
+        if (is_array($header_cell)) {
+          $header_count += isset($header_cell['colspan']) ? $header_cell['colspan'] : 1;
+        }
+        else {
+          $header_count++;
+        }
       }
     }
     $rows[] = array(array('data' => $empty, 'colspan' => $header_count, 'class' => array('empty', 'message')));
   }
 
   // Format the table header:
-  if (count($header)) {
+  if (!empty($header)) {
     $ts = tablesort_init($header);
     // HTML requires that the thead tag has tr tags in it followed by tbody
     // tags. Using ternary operator to check and see if we have any rows.
-    $output .= (count($rows) ? ' <thead><tr>' : ' <tr>');
+    $output .= (!empty($rows) ? ' <thead><tr>' : ' <tr>');
     foreach ($header as $cell) {
       $cell = tablesort_header($cell, $header, $ts);
       $output .= _theme_table_cell($cell, TRUE);
     }
     // Using ternary operator to close the tags based on whether or not there are rows
-    $output .= (count($rows) ? " </tr></thead>\n" : "</tr>\n");
+    $output .= (!empty($rows) ? " </tr></thead>\n" : "</tr>\n");
   }
   else {
     $ts = array();
   }
 
   // Format the table rows:
-  if (count($rows)) {
+  if (!empty($rows)) {
     $output .= "<tbody>\n";
     $flip = array('even' => 'odd', 'odd' => 'even');
     $class = 'even';
@@ -2095,7 +2097,7 @@
         $attributes = array();
         $no_striping = FALSE;
       }
-      if (count($cells)) {
+      if (!empty($cells)) {
         // Add odd/even class
         if (!$no_striping) {
           $class = $flip[$class];
diff -Naur drupal-7.51/misc/drupal.js drupal-7.66/misc/drupal.js
--- drupal-7.51/misc/drupal.js	2016-10-05 20:45:42.000000000 +0200
+++ drupal-7.66/misc/drupal.js	2019-04-17 22:20:46.000000000 +0200
@@ -28,6 +28,42 @@
 $.fn.init.prototype = jquery_init.prototype;
 
 /**
+ * Pre-filter Ajax requests to guard against XSS attacks.
+ *
+ * See https://github.com/jquery/jquery/issues/2432
+ */
+if ($.ajaxPrefilter) {
+  // For newer versions of jQuery, use an Ajax prefilter to prevent
+  // auto-executing script tags from untrusted domains. This is similar to the
+  // fix that is built in to jQuery 3.0 and higher.
+  $.ajaxPrefilter(function (s) {
+    if (s.crossDomain) {
+      s.contents.script = false;
+    }
+  });
+}
+else if ($.httpData) {
+  // For the version of jQuery that ships with Drupal core, override
+  // jQuery.httpData to prevent auto-detecting "script" data types from
+  // untrusted domains.
+  var jquery_httpData = $.httpData;
+  $.httpData = function (xhr, type, s) {
+    // @todo Consider backporting code from newer jQuery versions to check for
+    //   a cross-domain request here, rather than using Drupal.urlIsLocal() to
+    //   block scripts from all URLs that are not on the same site.
+    if (!type && !Drupal.urlIsLocal(s.url)) {
+      var content_type = xhr.getResponseHeader('content-type') || '';
+      if (content_type.indexOf('javascript') >= 0) {
+        // Default to a safe data type.
+        type = 'text';
+      }
+    }
+    return jquery_httpData.call(this, xhr, type, s);
+  };
+  $.httpData.prototype = jquery_httpData.prototype;
+}
+
+/**
  * Attach all registered behaviors to a page element.
  *
  * Behaviors are event-triggered actions that attach to page elements, enhancing
@@ -137,7 +173,7 @@
  */
 Drupal.checkPlain = function (str) {
   var character, regex,
-      replace = { '&': '&amp;', '"': '&quot;', '<': '&lt;', '>': '&gt;' };
+      replace = { '&': '&amp;', "'": '&#39;', '"': '&quot;', '<': '&lt;', '>': '&gt;' };
   str = String(str);
   for (character in replace) {
     if (replace.hasOwnProperty(character)) {
@@ -168,23 +204,76 @@
 Drupal.formatString = function(str, args) {
   // Transform arguments before inserting them.
   for (var key in args) {
-    switch (key.charAt(0)) {
-      // Escaped only.
-      case '@':
-        args[key] = Drupal.checkPlain(args[key]);
-      break;
-      // Pass-through.
-      case '!':
-        break;
-      // Escaped and placeholder.
-      case '%':
-      default:
-        args[key] = Drupal.theme('placeholder', args[key]);
-        break;
+    if (args.hasOwnProperty(key)) {
+      switch (key.charAt(0)) {
+        // Escaped only.
+        case '@':
+          args[key] = Drupal.checkPlain(args[key]);
+          break;
+        // Pass-through.
+        case '!':
+          break;
+        // Escaped and placeholder.
+        default:
+          args[key] = Drupal.theme('placeholder', args[key]);
+          break;
+      }
     }
-    str = str.replace(key, args[key]);
   }
-  return str;
+
+  return Drupal.stringReplace(str, args, null);
+};
+
+/**
+ * Replace substring.
+ *
+ * The longest keys will be tried first. Once a substring has been replaced,
+ * its new value will not be searched again.
+ *
+ * @param {String} str
+ *   A string with placeholders.
+ * @param {Object} args
+ *   Key-value pairs.
+ * @param {Array|null} keys
+ *   Array of keys from the "args".  Internal use only.
+ *
+ * @return {String}
+ *   Returns the replaced string.
+ */
+Drupal.stringReplace = function (str, args, keys) {
+  if (str.length === 0) {
+    return str;
+  }
+
+  // If the array of keys is not passed then collect the keys from the args.
+  if (!$.isArray(keys)) {
+    keys = [];
+    for (var k in args) {
+      if (args.hasOwnProperty(k)) {
+        keys.push(k);
+      }
+    }
+
+    // Order the keys by the character length. The shortest one is the first.
+    keys.sort(function (a, b) { return a.length - b.length; });
+  }
+
+  if (keys.length === 0) {
+    return str;
+  }
+
+  // Take next longest one from the end.
+  var key = keys.pop();
+  var fragments = str.split(key);
+
+  if (keys.length) {
+    for (var i = 0; i < fragments.length; i++) {
+      // Process each fragment with a copy of remaining keys.
+      fragments[i] = Drupal.stringReplace(fragments[i], args, keys.slice(0));
+    }
+  }
+
+  return fragments.join(args[key]);
 };
 
 /**
@@ -251,7 +340,7 @@
  *   A translated string.
  */
 Drupal.formatPlural = function (count, singular, plural, args, options) {
-  var args = args || {};
+  args = args || {};
   args['@count'] = count;
   // Determine the index of the plural form.
   var index = Drupal.locale.pluralFormula ? Drupal.locale.pluralFormula(args['@count']) : ((args['@count'] == 1) ? 0 : 1);
diff -Naur drupal-7.51/misc/jquery-extend-3.4.0.js drupal-7.66/misc/jquery-extend-3.4.0.js
--- drupal-7.51/misc/jquery-extend-3.4.0.js	1970-01-01 01:00:00.000000000 +0100
+++ drupal-7.66/misc/jquery-extend-3.4.0.js	2019-04-17 22:20:46.000000000 +0200
@@ -0,0 +1,112 @@
+/**
+ * For jQuery versions less than 3.4.0, this replaces the jQuery.extend
+ * function with the one from jQuery 3.4.0, slightly modified (documented
+ * below) to be compatible with older jQuery versions and browsers.
+ *
+ * This provides the Object.prototype pollution vulnerability fix to Drupal
+ * installations running older jQuery versions, including the versions shipped
+ * with Drupal core and https://www.drupal.org/project/jquery_update.
+ *
+ * @see https://github.com/jquery/jquery/pull/4333
+ */
+
+(function (jQuery) {
+
+// Do not override jQuery.extend() if the jQuery version is already >=3.4.0.
+var versionParts = jQuery.fn.jquery.split('.');
+var majorVersion = parseInt(versionParts[0]);
+var minorVersion = parseInt(versionParts[1]);
+var patchVersion = parseInt(versionParts[2]);
+var isPreReleaseVersion = (patchVersion.toString() !== versionParts[2]);
+if (
+  (majorVersion > 3) ||
+  (majorVersion === 3 && minorVersion > 4) ||
+  (majorVersion === 3 && minorVersion === 4 && patchVersion > 0) ||
+  (majorVersion === 3 && minorVersion === 4 && patchVersion === 0 && !isPreReleaseVersion)
+) {
+  return;
+}
+
+/**
+ * This is almost verbatim copied from jQuery 3.4.0.
+ *
+ * Only two minor changes have been made:
+ * - The call to isFunction() is changed to jQuery.isFunction().
+ * - The two calls to Array.isArray() is changed to jQuery.isArray().
+ *
+ * The above two changes ensure compatibility with all older jQuery versions
+ * (1.4.4 - 3.3.1) and older browser versions (e.g., IE8).
+ */
+jQuery.extend = jQuery.fn.extend = function() {
+  var options, name, src, copy, copyIsArray, clone,
+    target = arguments[ 0 ] || {},
+    i = 1,
+    length = arguments.length,
+    deep = false;
+
+  // Handle a deep copy situation
+  if ( typeof target === "boolean" ) {
+    deep = target;
+
+    // Skip the boolean and the target
+    target = arguments[ i ] || {};
+    i++;
+  }
+
+  // Handle case when target is a string or something (possible in deep copy)
+  if ( typeof target !== "object" && !jQuery.isFunction( target ) ) {
+    target = {};
+  }
+
+  // Extend jQuery itself if only one argument is passed
+  if ( i === length ) {
+    target = this;
+    i--;
+  }
+
+  for ( ; i < length; i++ ) {
+
+    // Only deal with non-null/undefined values
+    if ( ( options = arguments[ i ] ) != null ) {
+
+      // Extend the base object
+      for ( name in options ) {
+        copy = options[ name ];
+
+        // Prevent Object.prototype pollution
+        // Prevent never-ending loop
+        if ( name === "__proto__" || target === copy ) {
+          continue;
+        }
+
+        // Recurse if we're merging plain objects or arrays
+        if ( deep && copy && ( jQuery.isPlainObject( copy ) ||
+          ( copyIsArray = jQuery.isArray( copy ) ) ) ) {
+          src = target[ name ];
+
+          // Ensure proper type for the source value
+          if ( copyIsArray && !jQuery.isArray( src ) ) {
+            clone = [];
+          } else if ( !copyIsArray && !jQuery.isPlainObject( src ) ) {
+            clone = {};
+          } else {
+            clone = src;
+          }
+          copyIsArray = false;
+
+          // Never move original objects, clone them
+          target[ name ] = jQuery.extend( deep, clone, copy );
+
+          // Don't bring in undefined values
+        } else if ( copy !== undefined ) {
+          target[ name ] = copy;
+        }
+      }
+    }
+  }
+
+  // Return the modified object
+  return target;
+};
+
+})(jQuery);
diff -Naur drupal-7.51/misc/tabledrag.js drupal-7.66/misc/tabledrag.js
--- drupal-7.51/misc/tabledrag.js	2016-10-05 20:45:42.000000000 +0200
+++ drupal-7.66/misc/tabledrag.js	2019-04-17 22:20:46.000000000 +0200
@@ -580,13 +580,43 @@
  * Get the mouse coordinates from the event (allowing for browser differences).
  */
 Drupal.tableDrag.prototype.mouseCoords = function (event) {
-  if (event.pageX || event.pageY) {
-    return { x: event.pageX, y: event.pageY };
+
+  // Match both null and undefined, but not zero, by using != null.
+  // See https://stackoverflow.com/questions/2647867/how-to-determine-if-variable-is-undefined-or-null
+  if (event.pageX != null && event.pageY != null) {
+    return {x: event.pageX, y: event.pageY};
+  }
+
+  // Complete support for pointer events was only introduced to jQuery in
+  // version 1.11.1; between versions 1.7 and 1.11.0 pointer events have the
+  // pageX and pageY properties undefined. In those cases, the properties must
+  // be retrieved from the event.originalEvent object instead.
+  if (event.originalEvent && event.originalEvent.pageX != null && event.originalEvent.pageY != null) {
+    return {x: event.originalEvent.pageX, y: event.originalEvent.pageY};
+  }
+
+  // Some old browsers do not support MouseEvent.pageX and *.pageY at all.
+  // See https://developer.mozilla.org/en-US/docs/Web/API/MouseEvent/pageY
+  // For those, we look at event.clientX and event.clientY instead.
+  if (event.clientX == null || event.clientY == null) {
+    // In some jQuery versions, some events created by jQuery do not have
+    // clientX and clientY. But the original event might have.
+    if (!event.originalEvent) {
+      throw new Error("The event has no coordinates, and no event.originalEvent.");
+    }
+    event = event.originalEvent;
+    if (event.clientX == null || event.clientY == null) {
+      throw new Error("The original event has no coordinates.");
+    }
   }
-  return {
-    x: event.clientX + document.body.scrollLeft - document.body.clientLeft,
-    y: event.clientY + document.body.scrollTop  - document.body.clientTop
-  };
+
+  // Copied from jQuery.event.fix() in jQuery 1.4.1.
+  // In newer jQuery versions, this code is in jQuery.event.mouseHooks.filter().
+  var doc = document.documentElement, body = document.body;
+  var pageX = event.clientX + ( doc && doc.scrollLeft || body && body.scrollLeft || 0 ) - ( doc && doc.clientLeft || body && body.clientLeft || 0 );
+  var pageY = event.clientY + ( doc && doc.scrollTop  || body && body.scrollTop  || 0 ) - ( doc && doc.clientTop  || body && body.clientTop  || 0 );
+
+  return {x: pageX, y: pageY};
 };
 
 /**
diff -Naur drupal-7.51/misc/typo3/drupal-security/PharExtensionInterceptor.php drupal-7.66/misc/typo3/drupal-security/PharExtensionInterceptor.php
--- drupal-7.51/misc/typo3/drupal-security/PharExtensionInterceptor.php	1970-01-01 01:00:00.000000000 +0100
+++ drupal-7.66/misc/typo3/drupal-security/PharExtensionInterceptor.php	2019-04-17 22:20:46.000000000 +0200
@@ -0,0 +1,79 @@
+<?php
+
+namespace Drupal\Core\Security;
+
+use TYPO3\PharStreamWrapper\Assertable;
+use TYPO3\PharStreamWrapper\Helper;
+use TYPO3\PharStreamWrapper\Exception;
+
+/**
+ * An alternate PharExtensionInterceptor to support phar-based CLI tools.
+ *
+ * @see \TYPO3\PharStreamWrapper\Interceptor\PharExtensionInterceptor
+ */
+class PharExtensionInterceptor implements Assertable {
+
+  /**
+   * Determines whether phar file is allowed to execute.
+   *
+   * The phar file is allowed to execute if:
+   * - the base file name has a ".phar" suffix.
+   * - it is the CLI tool that has invoked the interceptor.
+   *
+   * @param string $path
+   *   The path of the phar file to check.
+   * @param string $command
+   *   The command being carried out.
+   *
+   * @return bool
+   *   TRUE if the phar file is allowed to execute.
+   *
+   * @throws Exception
+   *   Thrown when the file is not allowed to execute.
+   */
+  public function assert($path, $command) {
+    if ($this->baseFileContainsPharExtension($path)) {
+      return TRUE;
+    }
+    throw new Exception(
+      sprintf(
+        'Unexpected file extension in "%s"',
+        $path
+      ),
+      1535198703
+    );
+  }
+
+  /**
+   * Determines if a path has a .phar extension or invoked execution.
+   *
+   * @param string $path
+   *   The path of the phar file to check.
+   *
+   * @return bool
+   *   TRUE if the file has a .phar extension or if the execution has been
+   *   invoked by the phar file.
+   */
+  private function baseFileContainsPharExtension($path) {
+    $baseFile = Helper::determineBaseFile($path);
+    if ($baseFile === NULL) {
+      return FALSE;
+    }
+    // If the stream wrapper is registered by invoking a phar file that does
+    // not not have .phar extension then this should be allowed. For
+    // example, some CLI tools recommend removing the extension.
+    $backtrace = debug_backtrace(DEBUG_BACKTRACE_IGNORE_ARGS);
+    // Find the last entry in the backtrace containing a 'file' key as
+    // sometimes the last caller is executed outside the scope of a file. For
+    // example, this occurs with shutdown functions.
+    do {
+      $caller = array_pop($backtrace);
+    } while (empty($caller['file']) && !empty($backtrace));
+    if (isset($caller['file']) && $baseFile === Helper::determineBaseFile($caller['file'])) {
+      return TRUE;
+    }
+    $fileExtension = pathinfo($baseFile, PATHINFO_EXTENSION);
+    return strtolower($fileExtension) === 'phar';
+  }
+
+}
diff -Naur drupal-7.51/misc/typo3/phar-stream-wrapper/LICENSE drupal-7.66/misc/typo3/phar-stream-wrapper/LICENSE
--- drupal-7.51/misc/typo3/phar-stream-wrapper/LICENSE	1970-01-01 01:00:00.000000000 +0100
+++ drupal-7.66/misc/typo3/phar-stream-wrapper/LICENSE	2019-04-17 22:20:46.000000000 +0200
@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2018 TYPO3 project - https://typo3.org/
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
diff -Naur drupal-7.51/misc/typo3/phar-stream-wrapper/README.md drupal-7.66/misc/typo3/phar-stream-wrapper/README.md
--- drupal-7.51/misc/typo3/phar-stream-wrapper/README.md	1970-01-01 01:00:00.000000000 +0100
+++ drupal-7.66/misc/typo3/phar-stream-wrapper/README.md	2019-04-17 22:20:46.000000000 +0200
@@ -0,0 +1,155 @@
+[![Scrutinizer Code Quality](https://scrutinizer-ci.com/g/TYPO3/phar-stream-wrapper/badges/quality-score.png?b=v2)](https://scrutinizer-ci.com/g/TYPO3/phar-stream-wrapper/?branch=v2)
+[![Travis CI Build Status](https://travis-ci.org/TYPO3/phar-stream-wrapper.svg?branch=v2)](https://travis-ci.org/TYPO3/phar-stream-wrapper)
+
+# PHP Phar Stream Wrapper
+
+## Abstract & History
+
+Based on Sam Thomas' findings concerning
+[insecure deserialization in combination with obfuscation strategies](https://blog.secarma.co.uk/labs/near-phar-dangerous-unserialization-wherever-you-are)
+allowing to hide Phar files inside valid image resources, the TYPO3 project
+decided back then to introduce a `PharStreamWrapper` to intercept invocations
+of the `phar://` stream in PHP and only allow usage for defined locations in
+the file system.
+
+Since the TYPO3 mission statement is **inspiring people to share**, we thought
+it would be helpful for others to release our `PharStreamWrapper` as standalone
+package to the PHP community.
+
+The mentioned security issue was reported to TYPO3 on 10th June 2018 by Sam Thomas
+and has been addressed concerning the specific attack vector and for this generic
+`PharStreamWrapper` in TYPO3 versions 7.6.30 LTS, 8.7.17 LTS and 9.3.1 on 12th
+July 2018.
+
+* https://typo3.org/security/advisory/typo3-core-sa-2018-002/
+* https://blog.secarma.co.uk/labs/near-phar-dangerous-unserialization-wherever-you-are
+* https://youtu.be/GePBmsNJw6Y
+
+## License
+
+In general the TYPO3 core is released under the GNU General Public License version
+2 or any later version (`GPL-2.0-or-later`). In order to avoid licensing issues and
+incompatibilities this `PharStreamWrapper` is licenced under the MIT License. In case
+you duplicate or modify source code, credits are not required but really appreciated.
+
+## Credits
+
+Thanks to [Alex Pott](https://github.com/alexpott), Drupal for creating
+back-ports of all sources in order to provide compatibility with PHP v5.3.
+
+## Installation
+
+The `PharStreamWrapper` is provided as composer package `typo3/phar-stream-wrapper`
+and has minimum requirements of PHP v5.3 ([`v2`](https://github.com/TYPO3/phar-stream-wrapper/tree/v2) branch) and PHP v7.0 ([`master`](https://github.com/TYPO3/phar-stream-wrapper) branch).
+
+### Installation for PHP v7.0
+
+```
+composer require typo3/phar-stream-wrapper ^3.0
+```
+
+### Installation for PHP v5.3
+
+```
+composer require typo3/phar-stream-wrapper ^2.0
+```
+
+## Example
+
+The following example is bundled within this package, the shown
+`PharExtensionInterceptor` denies all stream wrapper invocations files
+not having the `.phar` suffix. Interceptor logic has to be individual and
+adjusted to according requirements.
+
+```
+$behavior = new \TYPO3\PharStreamWrapper\Behavior();
+Manager::initialize(
+    $behavior->withAssertion(new PharExtensionInterceptor())
+);
+
+if (in_array('phar', stream_get_wrappers())) {
+    stream_wrapper_unregister('phar');
+    stream_wrapper_register('phar', 'TYPO3\\PharStreamWrapper\\PharStreamWrapper');
+}
+```
+
+* `PharStreamWrapper` defined as class reference will be instantiated each time
+  `phar://` streams shall be processed.
+* `Manager` as singleton pattern being called by `PharStreamWrapper` instances
+  in order to retrieve individual behavior and settings.
+* `Behavior` holds reference to interceptor(s) that shall assert correct/allowed
+  invocation of a given `$path` for a given `$command`. Interceptors implement
+  the interface `Assertable`. Interceptors can act individually on following
+  commands or handle all of them in case not defined specifically:  
+  + `COMMAND_DIR_OPENDIR`
+  + `COMMAND_MKDIR`
+  + `COMMAND_RENAME`
+  + `COMMAND_RMDIR`
+  + `COMMAND_STEAM_METADATA`
+  + `COMMAND_STREAM_OPEN`
+  + `COMMAND_UNLINK`
+  + `COMMAND_URL_STAT`
+
+## Interceptor
+
+The following interceptor is shipped with the package and ready to use in order
+to block any Phar invocation of files not having a `.phar` suffix. Besides that
+individual interceptors are possible of course.
+
+```
+class PharExtensionInterceptor implements Assertable
+{
+    /**
+     * Determines whether the base file name has a ".phar" suffix.
+     *
+     * @param string $path
+     * @param string $command
+     * @return bool
+     * @throws Exception
+     */
+    public function assert($path, $command)
+    {
+        if ($this->baseFileContainsPharExtension($path)) {
+            return true;
+        }
+        throw new Exception(
+            sprintf(
+                'Unexpected file extension in "%s"',
+                $path
+            ),
+            1535198703
+        );
+    }
+
+    /**
+     * @param string $path
+     * @return bool
+     */
+    private function baseFileContainsPharExtension($path)
+    {
+        $baseFile = Helper::determineBaseFile($path);
+        if ($baseFile === null) {
+            return false;
+        }
+        $fileExtension = pathinfo($baseFile, PATHINFO_EXTENSION);
+        return strtolower($fileExtension) === 'phar';
+    }
+}
+```
+
+## Helper
+
+* `Helper::determineBaseFile(string $path)`: Determines base file that can be
+  accessed using the regular file system. For instance the following path
+  `phar:///home/user/bundle.phar/content.txt` would be resolved to
+  `/home/user/bundle.phar`.
+* `Helper::resetOpCache()`: Resets PHP's OPcache if enabled as work-around for
+  issues in `include()` or `require()` calls and OPcache delivering wrong
+  results. More details can be found in PHP's bug tracker, for instance like
+  https://bugs.php.net/bug.php?id=66569
+
+## Security Contact
+
+In case of finding additional security issues in the TYPO3 project or in this
+`PharStreamWrapper` package in particular, please get in touch with the
+[TYPO3 Security Team](mailto:security@typo3.org).
diff -Naur drupal-7.51/misc/typo3/phar-stream-wrapper/composer.json drupal-7.66/misc/typo3/phar-stream-wrapper/composer.json
--- drupal-7.51/misc/typo3/phar-stream-wrapper/composer.json	1970-01-01 01:00:00.000000000 +0100
+++ drupal-7.66/misc/typo3/phar-stream-wrapper/composer.json	2019-04-17 22:20:46.000000000 +0200
@@ -0,0 +1,24 @@
+{
+    "name": "typo3/phar-stream-wrapper",
+    "description": "Interceptors for PHP's native phar:// stream handling",
+    "type": "library",
+    "license": "MIT",
+    "homepage": "https://typo3.org/",
+    "keywords": ["php", "phar", "stream-wrapper", "security"],
+    "require": {
+        "php": "^5.3.3|^7.0"
+    },
+    "require-dev": {
+        "phpunit/phpunit": "^4.8.36"
+    },
+    "autoload": {
+        "psr-4": {
+            "TYPO3\\PharStreamWrapper\\": "src/"
+        }
+    },
+    "autoload-dev": {
+        "psr-4": {
+            "TYPO3\\PharStreamWrapper\\Tests\\": "tests/"
+        }
+    }
+}
diff -Naur drupal-7.51/misc/typo3/phar-stream-wrapper/src/Assertable.php drupal-7.66/misc/typo3/phar-stream-wrapper/src/Assertable.php
--- drupal-7.51/misc/typo3/phar-stream-wrapper/src/Assertable.php	1970-01-01 01:00:00.000000000 +0100
+++ drupal-7.66/misc/typo3/phar-stream-wrapper/src/Assertable.php	2019-04-17 22:20:46.000000000 +0200
@@ -0,0 +1,22 @@
+<?php
+namespace TYPO3\PharStreamWrapper;
+
+/*
+ * This file is part of the TYPO3 project.
+ *
+ * It is free software; you can redistribute it and/or modify it under the terms
+ * of the MIT License (MIT). For the full copyright and license information,
+ * please read the LICENSE file that was distributed with this source code.
+ *
+ * The TYPO3 project - inspiring people to share!
+ */
+
+interface Assertable
+{
+    /**
+     * @param string $path
+     * @param string $command
+     * @return bool
+     */
+    public function assert($path, $command);
+}
diff -Naur drupal-7.51/misc/typo3/phar-stream-wrapper/src/Behavior.php drupal-7.66/misc/typo3/phar-stream-wrapper/src/Behavior.php
--- drupal-7.51/misc/typo3/phar-stream-wrapper/src/Behavior.php	1970-01-01 01:00:00.000000000 +0100
+++ drupal-7.66/misc/typo3/phar-stream-wrapper/src/Behavior.php	2019-04-17 22:20:46.000000000 +0200
@@ -0,0 +1,124 @@
+<?php
+namespace TYPO3\PharStreamWrapper;
+
+/*
+ * This file is part of the TYPO3 project.
+ *
+ * It is free software; you can redistribute it and/or modify it under the terms
+ * of the MIT License (MIT). For the full copyright and license information,
+ * please read the LICENSE file that was distributed with this source code.
+ *
+ * The TYPO3 project - inspiring people to share!
+ */
+
+class Behavior implements Assertable
+{
+    const COMMAND_DIR_OPENDIR = 'dir_opendir';
+    const COMMAND_MKDIR = 'mkdir';
+    const COMMAND_RENAME = 'rename';
+    const COMMAND_RMDIR = 'rmdir';
+    const COMMAND_STEAM_METADATA = 'stream_metadata';
+    const COMMAND_STREAM_OPEN = 'stream_open';
+    const COMMAND_UNLINK = 'unlink';
+    const COMMAND_URL_STAT = 'url_stat';
+
+    /**
+     * @var string[]
+     */
+    private $availableCommands = array(
+        self::COMMAND_DIR_OPENDIR,
+        self::COMMAND_MKDIR,
+        self::COMMAND_RENAME,
+        self::COMMAND_RMDIR,
+        self::COMMAND_STEAM_METADATA,
+        self::COMMAND_STREAM_OPEN,
+        self::COMMAND_UNLINK,
+        self::COMMAND_URL_STAT,
+    );
+
+    /**
+     * @var Assertable[]
+     */
+    private $assertions;
+
+    /**
+     * @param Assertable $assertable
+     * @return static
+     */
+    public function withAssertion(Assertable $assertable)
+    {
+        $commands = func_get_args();
+        array_shift($commands);
+        $this->assertCommands($commands);
+        $commands = $commands ?: $this->availableCommands;
+
+        $target = clone $this;
+        foreach ($commands as $command) {
+            $target->assertions[$command] = $assertable;
+        }
+        return $target;
+    }
+
+    /**
+     * @param string $path
+     * @param string $command
+     * @return bool
+     */
+    public function assert($path, $command)
+    {
+        $this->assertCommand($command);
+        $this->assertAssertionCompleteness();
+
+        return $this->assertions[$command]->assert($path, $command);
+    }
+
+    /**
+     * @param array $commands
+     */
+    private function assertCommands(array $commands)
+    {
+        $unknownCommands = array_diff($commands, $this->availableCommands);
+        if (empty($unknownCommands)) {
+            return;
+        }
+        throw new \LogicException(
+            sprintf(
+                'Unknown commands: %s',
+                implode(', ', $unknownCommands)
+            ),
+            1535189881
+        );
+    }
+
+    private function assertCommand($command)
+    {
+        if (in_array($command, $this->availableCommands, true)) {
+            return;
+        }
+        throw new \LogicException(
+            sprintf(
+                'Unknown command "%s"',
+                $command
+            ),
+            1535189882
+        );
+    }
+
+    private function assertAssertionCompleteness()
+    {
+        $undefinedAssertions = array_diff(
+            $this->availableCommands,
+            array_keys($this->assertions)
+        );
+        if (empty($undefinedAssertions)) {
+            return;
+        }
+        throw new \LogicException(
+            sprintf(
+                'Missing assertions for commands: %s',
+                implode(', ', $undefinedAssertions)
+            ),
+            1535189883
+        );
+    }
+}
diff -Naur drupal-7.51/misc/typo3/phar-stream-wrapper/src/Exception.php drupal-7.66/misc/typo3/phar-stream-wrapper/src/Exception.php
--- drupal-7.51/misc/typo3/phar-stream-wrapper/src/Exception.php	1970-01-01 01:00:00.000000000 +0100
+++ drupal-7.66/misc/typo3/phar-stream-wrapper/src/Exception.php	2019-04-17 22:20:46.000000000 +0200
@@ -0,0 +1,16 @@
+<?php
+namespace TYPO3\PharStreamWrapper;
+
+/*
+ * This file is part of the TYPO3 project.
+ *
+ * It is free software; you can redistribute it and/or modify it under the terms
+ * of the MIT License (MIT). For the full copyright and license information,
+ * please read the LICENSE file that was distributed with this source code.
+ *
+ * The TYPO3 project - inspiring people to share!
+ */
+
+class Exception extends \RuntimeException
+{
+}
diff -Naur drupal-7.51/misc/typo3/phar-stream-wrapper/src/Helper.php drupal-7.66/misc/typo3/phar-stream-wrapper/src/Helper.php
--- drupal-7.51/misc/typo3/phar-stream-wrapper/src/Helper.php	1970-01-01 01:00:00.000000000 +0100
+++ drupal-7.66/misc/typo3/phar-stream-wrapper/src/Helper.php	2019-04-17 22:20:46.000000000 +0200
@@ -0,0 +1,183 @@
+<?php
+namespace TYPO3\PharStreamWrapper;
+
+/*
+ * This file is part of the TYPO3 project.
+ *
+ * It is free software; you can redistribute it and/or modify it under the terms
+ * of the MIT License (MIT). For the full copyright and license information,
+ * please read the LICENSE file that was distributed with this source code.
+ *
+ * The TYPO3 project - inspiring people to share!
+ */
+
+class Helper
+{
+    /*
+     * Resets PHP's OPcache if enabled as work-around for issues in `include()`
+     * or `require()` calls and OPcache delivering wrong results.
+     *
+     * @see https://bugs.php.net/bug.php?id=66569
+     */
+    public static function resetOpCache()
+    {
+        if (function_exists('opcache_reset')
+            && function_exists('opcache_get_status')
+        ) {
+            $status = opcache_get_status();
+            if (!empty($status['opcache_enabled'])) {
+                opcache_reset();
+            }
+        }
+    }
+
+    /**
+     * Determines base file that can be accessed using the regular file system.
+     * For e.g. "phar:///home/user/bundle.phar/content.txt" that would result
+     * into "/home/user/bundle.phar".
+     *
+     * @param string $path
+     * @return string|null
+     */
+    public static function determineBaseFile($path)
+    {
+        $parts = explode('/', static::normalizePath($path));
+
+        while (count($parts)) {
+            $currentPath = implode('/', $parts);
+            if (@is_file($currentPath)) {
+                return $currentPath;
+            }
+            array_pop($parts);
+        }
+
+        return null;
+    }
+
+    /**
+     * @param string $path
+     * @return string
+     */
+    public static function removePharPrefix($path)
+    {
+        $path = trim($path);
+        if (stripos($path, 'phar://') !== 0) {
+            return $path;
+        }
+        return substr($path, 7);
+    }
+
+    /**
+     * Normalizes a path, removes phar:// prefix, fixes Windows directory
+     * separators. Result is without trailing slash.
+     *
+     * @param string $path
+     * @return string
+     */
+    public static function normalizePath($path)
+    {
+        return rtrim(
+            static::getCanonicalPath(
+                static::removePharPrefix($path)
+            ),
+            '/'
+        );
+    }
+
+    /**
+     * Fixes a path for windows-backslashes and reduces double-slashes to single slashes
+     *
+     * @param string $path File path to process
+     * @return string
+     */
+    private static function normalizeWindowsPath($path)
+    {
+        return str_replace('\\', '/', $path);
+    }
+
+    /**
+     * Resolves all dots, slashes and removes spaces after or before a path...
+     *
+     * @param string $path Input string
+     * @return string Canonical path, always without trailing slash
+     */
+    private static function getCanonicalPath($path)
+    {
+        $path = static::normalizeWindowsPath($path);
+
+        $absolutePathPrefix = '';
+        if (static::isAbsolutePath($path)) {
+            if (static::isWindows() && strpos($path, ':/') === 1) {
+                $absolutePathPrefix = substr($path, 0, 3);
+                $path = substr($path, 3);
+            } else {
+                $path = ltrim($path, '/');
+                $absolutePathPrefix = '/';
+            }
+        }
+
+        $pathParts = explode('/', $path);
+        $pathPartsLength = count($pathParts);
+        for ($partCount = 0; $partCount < $pathPartsLength; $partCount++) {
+            // double-slashes in path: remove element
+            if ($pathParts[$partCount] === '') {
+                array_splice($pathParts, $partCount, 1);
+                $partCount--;
+                $pathPartsLength--;
+            }
+            // "." in path: remove element
+            if ((isset($pathParts[$partCount]) ? $pathParts[$partCount] : '') === '.') {
+                array_splice($pathParts, $partCount, 1);
+                $partCount--;
+                $pathPartsLength--;
+            }
+            // ".." in path:
+            if ((isset($pathParts[$partCount]) ? $pathParts[$partCount] : '') === '..') {
+                if ($partCount === 0) {
+                    array_splice($pathParts, $partCount, 1);
+                    $partCount--;
+                    $pathPartsLength--;
+                } elseif ($partCount >= 1) {
+                    // Rremove this and previous element
+                    array_splice($pathParts, $partCount - 1, 2);
+                    $partCount -= 2;
+                    $pathPartsLength -= 2;
+                } elseif ($absolutePathPrefix) {
+                    // can't go higher than root dir
+                    // simply remove this part and continue
+                    array_splice($pathParts, $partCount, 1);
+                    $partCount--;
+                    $pathPartsLength--;
+                }
+            }
+        }
+
+        return $absolutePathPrefix . implode('/', $pathParts);
+    }
+
+    /**
+     * Checks if the $path is absolute or relative (detecting either '/' or
+     * 'x:/' as first part of string) and returns TRUE if so.
+     *
+     * @param string $path File path to evaluate
+     * @return bool
+     */
+    private static function isAbsolutePath($path)
+    {
+        // Path starting with a / is always absolute, on every system
+        // On Windows also a path starting with a drive letter is absolute: X:/
+        return (isset($path[0]) ? $path[0] : null) === '/'
+            || static::isWindows() && (
+                strpos($path, ':/') === 1
+                || strpos($path, ':\\') === 1
+            );
+    }
+
+    /**
+     * @return bool
+     */
+    private static function isWindows()
+    {
+        return stripos(PHP_OS, 'WIN') === 0;
+    }
+}
\ No newline at end of file
diff -Naur drupal-7.51/misc/typo3/phar-stream-wrapper/src/Interceptor/PharExtensionInterceptor.php drupal-7.66/misc/typo3/phar-stream-wrapper/src/Interceptor/PharExtensionInterceptor.php
--- drupal-7.51/misc/typo3/phar-stream-wrapper/src/Interceptor/PharExtensionInterceptor.php	1970-01-01 01:00:00.000000000 +0100
+++ drupal-7.66/misc/typo3/phar-stream-wrapper/src/Interceptor/PharExtensionInterceptor.php	2019-04-17 22:20:46.000000000 +0200
@@ -0,0 +1,55 @@
+<?php
+namespace TYPO3\PharStreamWrapper\Interceptor;
+
+/*
+ * This file is part of the TYPO3 project.
+ *
+ * It is free software; you can redistribute it and/or modify it under the terms
+ * of the MIT License (MIT). For the full copyright and license information,
+ * please read the LICENSE file that was distributed with this source code.
+ *
+ * The TYPO3 project - inspiring people to share!
+ */
+
+use TYPO3\PharStreamWrapper\Assertable;
+use TYPO3\PharStreamWrapper\Helper;
+use TYPO3\PharStreamWrapper\Exception;
+
+class PharExtensionInterceptor implements Assertable
+{
+    /**
+     * Determines whether the base file name has a ".phar" suffix.
+     *
+     * @param string $path
+     * @param string $command
+     * @return bool
+     * @throws Exception
+     */
+    public function assert($path, $command)
+    {
+        if ($this->baseFileContainsPharExtension($path)) {
+            return true;
+        }
+        throw new Exception(
+            sprintf(
+                'Unexpected file extension in "%s"',
+                $path
+            ),
+            1535198703
+        );
+    }
+
+    /**
+     * @param string $path
+     * @return bool
+     */
+    private function baseFileContainsPharExtension($path)
+    {
+        $baseFile = Helper::determineBaseFile($path);
+        if ($baseFile === null) {
+            return false;
+        }
+        $fileExtension = pathinfo($baseFile, PATHINFO_EXTENSION);
+        return strtolower($fileExtension) === 'phar';
+    }
+}
diff -Naur drupal-7.51/misc/typo3/phar-stream-wrapper/src/Manager.php drupal-7.66/misc/typo3/phar-stream-wrapper/src/Manager.php
--- drupal-7.51/misc/typo3/phar-stream-wrapper/src/Manager.php	1970-01-01 01:00:00.000000000 +0100
+++ drupal-7.66/misc/typo3/phar-stream-wrapper/src/Manager.php	2019-04-17 22:20:46.000000000 +0200
@@ -0,0 +1,85 @@
+<?php
+namespace TYPO3\PharStreamWrapper;
+
+/*
+ * This file is part of the TYPO3 project.
+ *
+ * It is free software; you can redistribute it and/or modify it under the terms
+ * of the MIT License (MIT). For the full copyright and license information,
+ * please read the LICENSE file that was distributed with this source code.
+ *
+ * The TYPO3 project - inspiring people to share!
+ */
+
+class Manager implements Assertable
+{
+    /**
+     * @var self
+     */
+    private static $instance;
+
+    /**
+     * @var Behavior
+     */
+    private $behavior;
+
+    /**
+     * @param Behavior $behaviour
+     * @return self
+     */
+    public static function initialize(Behavior $behaviour)
+    {
+        if (self::$instance === null) {
+            self::$instance = new self($behaviour);
+            return self::$instance;
+        }
+        throw new \LogicException(
+            'Manager can only be initialized once',
+            1535189871
+        );
+    }
+
+    /**
+     * @return self
+     */
+    public static function instance()
+    {
+        if (self::$instance !== null) {
+            return self::$instance;
+        }
+        throw new \LogicException(
+            'Manager needs to be initialized first',
+            1535189872
+        );
+    }
+
+    /**
+     * @return bool
+     */
+    public static function destroy()
+    {
+        if (self::$instance === null) {
+            return false;
+        }
+        self::$instance = null;
+        return true;
+    }
+
+    /**
+     * @param Behavior $behaviour
+     */
+    private function __construct(Behavior $behaviour)
+    {
+        $this->behavior = $behaviour;
+    }
+
+    /**
+     * @param string $path
+     * @param string $command
+     * @return bool
+     */
+    public function assert($path, $command)
+    {
+        return $this->behavior->assert($path, $command);
+    }
+}
diff -Naur drupal-7.51/misc/typo3/phar-stream-wrapper/src/PharStreamWrapper.php drupal-7.66/misc/typo3/phar-stream-wrapper/src/PharStreamWrapper.php
--- drupal-7.51/misc/typo3/phar-stream-wrapper/src/PharStreamWrapper.php	1970-01-01 01:00:00.000000000 +0100
+++ drupal-7.66/misc/typo3/phar-stream-wrapper/src/PharStreamWrapper.php	2019-04-17 22:20:46.000000000 +0200
@@ -0,0 +1,477 @@
+<?php
+namespace TYPO3\PharStreamWrapper;
+
+/*
+ * This file is part of the TYPO3 project.
+ *
+ * It is free software; you can redistribute it and/or modify it under the terms
+ * of the MIT License (MIT). For the full copyright and license information,
+ * please read the LICENSE file that was distributed with this source code.
+ *
+ * The TYPO3 project - inspiring people to share!
+ */
+
+class PharStreamWrapper
+{
+    /**
+     * Internal stream constants that are not exposed to PHP, but used...
+     * @see https://github.com/php/php-src/blob/e17fc0d73c611ad0207cac8a4a01ded38251a7dc/main/php_streams.h
+     */
+    const STREAM_OPEN_FOR_INCLUDE = 128;
+
+    /**
+     * @var resource
+     */
+    public $context;
+
+    /**
+     * @var resource
+     */
+    protected $internalResource;
+
+    /**
+     * @return bool
+     */
+    public function dir_closedir()
+    {
+        if (!is_resource($this->internalResource)) {
+            return false;
+        }
+
+        $this->invokeInternalStreamWrapper(
+            'closedir',
+            $this->internalResource
+        );
+        return !is_resource($this->internalResource);
+    }
+
+    /**
+     * @param string $path
+     * @param int $options
+     * @return bool
+     */
+    public function dir_opendir($path, $options)
+    {
+        $this->assert($path, Behavior::COMMAND_DIR_OPENDIR);
+        $this->internalResource = $this->invokeInternalStreamWrapper(
+            'opendir',
+            $path,
+            $this->context
+        );
+        return is_resource($this->internalResource);
+    }
+
+    /**
+     * @return string|false
+     */
+    public function dir_readdir()
+    {
+        return $this->invokeInternalStreamWrapper(
+            'readdir',
+            $this->internalResource
+        );
+    }
+
+    /**
+     * @return bool
+     */
+    public function dir_rewinddir()
+    {
+        if (!is_resource($this->internalResource)) {
+            return false;
+        }
+
+        $this->invokeInternalStreamWrapper(
+            'rewinddir',
+            $this->internalResource
+        );
+        return is_resource($this->internalResource);
+    }
+
+    /**
+     * @param string $path
+     * @param int $mode
+     * @param int $options
+     * @return bool
+     */
+    public function mkdir($path, $mode, $options)
+    {
+        $this->assert($path, Behavior::COMMAND_MKDIR);
+        return $this->invokeInternalStreamWrapper(
+            'mkdir',
+            $path,
+            $mode,
+            (bool) ($options & STREAM_MKDIR_RECURSIVE),
+            $this->context
+        );
+    }
+
+    /**
+     * @param string $path_from
+     * @param string $path_to
+     * @return bool
+     */
+    public function rename($path_from, $path_to)
+    {
+        $this->assert($path_from, Behavior::COMMAND_RENAME);
+        $this->assert($path_to, Behavior::COMMAND_RENAME);
+        return $this->invokeInternalStreamWrapper(
+            'rename',
+            $path_from,
+            $path_to,
+            $this->context
+        );
+    }
+
+    /**
+     * @param string $path
+     * @param int $options
+     * @return bool
+     */
+    public function rmdir($path, $options)
+    {
+        $this->assert($path, Behavior::COMMAND_RMDIR);
+        return $this->invokeInternalStreamWrapper(
+            'rmdir',
+            $path,
+            $this->context
+        );
+    }
+
+    /**
+     * @param int $cast_as
+     */
+    public function stream_cast($cast_as)
+    {
+        throw new Exception(
+            'Method stream_select() cannot be used',
+            1530103999
+        );
+    }
+
+    public function stream_close()
+    {
+        $this->invokeInternalStreamWrapper(
+            'fclose',
+            $this->internalResource
+        );
+    }
+
+    /**
+     * @return bool
+     */
+    public function stream_eof()
+    {
+        return $this->invokeInternalStreamWrapper(
+            'feof',
+            $this->internalResource
+        );
+    }
+
+    /**
+     * @return bool
+     */
+    public function stream_flush()
+    {
+        return $this->invokeInternalStreamWrapper(
+            'fflush',
+            $this->internalResource
+        );
+    }
+
+    /**
+     * @param int $operation
+     * @return bool
+     */
+    public function stream_lock($operation)
+    {
+        return $this->invokeInternalStreamWrapper(
+            'flock',
+            $this->internalResource,
+            $operation
+        );
+    }
+
+    /**
+     * @param string $path
+     * @param int $option
+     * @param string|int $value
+     * @return bool
+     */
+    public function stream_metadata($path, $option, $value)
+    {
+        $this->assert($path, Behavior::COMMAND_STEAM_METADATA);
+        if ($option === STREAM_META_TOUCH) {
+            return call_user_func_array(
+                array($this, 'invokeInternalStreamWrapper'),
+                array_merge(array('touch', $path), (array) $value)
+            );
+        }
+        if ($option === STREAM_META_OWNER_NAME || $option === STREAM_META_OWNER) {
+            return $this->invokeInternalStreamWrapper(
+                'chown',
+                $path,
+                $value
+            );
+        }
+        if ($option === STREAM_META_GROUP_NAME || $option === STREAM_META_GROUP) {
+            return $this->invokeInternalStreamWrapper(
+                'chgrp',
+                $path,
+                $value
+            );
+        }
+        if ($option === STREAM_META_ACCESS) {
+            return $this->invokeInternalStreamWrapper(
+                'chmod',
+                $path,
+                $value
+            );
+        }
+        return false;
+    }
+
+    /**
+     * @param string $path
+     * @param string $mode
+     * @param int $options
+     * @param string|null $opened_path
+     * @return bool
+     */
+    public function stream_open(
+        $path,
+        $mode,
+        $options,
+        &$opened_path = null
+    ) {
+        $this->assert($path, Behavior::COMMAND_STREAM_OPEN);
+        $arguments = array($path, $mode, (bool) ($options & STREAM_USE_PATH));
+        // only add stream context for non include/require calls
+        if (!($options & static::STREAM_OPEN_FOR_INCLUDE)) {
+            $arguments[] = $this->context;
+        // work around https://bugs.php.net/bug.php?id=66569
+        // for including files from Phar stream with OPcache enabled
+        } else {
+            Helper::resetOpCache();
+        }
+        $this->internalResource = call_user_func_array(
+            array($this, 'invokeInternalStreamWrapper'),
+            array_merge(array('fopen'), $arguments)
+        );
+        if (!is_resource($this->internalResource)) {
+            return false;
+        }
+        if ($opened_path !== null) {
+            $metaData = stream_get_meta_data($this->internalResource);
+            $opened_path = $metaData['uri'];
+        }
+        return true;
+    }
+
+    /**
+     * @param int $count
+     * @return string
+     */
+    public function stream_read($count)
+    {
+        return $this->invokeInternalStreamWrapper(
+            'fread',
+            $this->internalResource,
+            $count
+        );
+    }
+
+    /**
+     * @param int $offset
+     * @param int $whence
+     * @return bool
+     */
+    public function stream_seek($offset, $whence = SEEK_SET)
+    {
+        return $this->invokeInternalStreamWrapper(
+            'fseek',
+            $this->internalResource,
+            $offset,
+            $whence
+        ) !== -1;
+    }
+
+    /**
+     * @param int $option
+     * @param int $arg1
+     * @param int $arg2
+     * @return bool
+     */
+    public function stream_set_option($option, $arg1, $arg2)
+    {
+        if ($option === STREAM_OPTION_BLOCKING) {
+            return $this->invokeInternalStreamWrapper(
+                'stream_set_blocking',
+                $this->internalResource,
+                $arg1
+            );
+        }
+        if ($option === STREAM_OPTION_READ_TIMEOUT) {
+            return $this->invokeInternalStreamWrapper(
+                'stream_set_timeout',
+                $this->internalResource,
+                $arg1,
+                $arg2
+            );
+        }
+        if ($option === STREAM_OPTION_WRITE_BUFFER) {
+            return $this->invokeInternalStreamWrapper(
+                'stream_set_write_buffer',
+                $this->internalResource,
+                $arg2
+            ) === 0;
+        }
+        return false;
+    }
+
+    /**
+     * @return array
+     */
+    public function stream_stat()
+    {
+        return $this->invokeInternalStreamWrapper(
+            'fstat',
+            $this->internalResource
+        );
+    }
+
+    /**
+     * @return int
+     */
+    public function stream_tell()
+    {
+        return $this->invokeInternalStreamWrapper(
+            'ftell',
+            $this->internalResource
+        );
+    }
+
+    /**
+     * @param int $new_size
+     * @return bool
+     */
+    public function stream_truncate($new_size)
+    {
+        return $this->invokeInternalStreamWrapper(
+            'ftruncate',
+            $this->internalResource,
+            $new_size
+        );
+    }
+
+    /**
+     * @param string $data
+     * @return int
+     */
+    public function stream_write($data)
+    {
+        return $this->invokeInternalStreamWrapper(
+            'fwrite',
+            $this->internalResource,
+            $data
+        );
+    }
+
+    /**
+     * @param string $path
+     * @return bool
+     */
+    public function unlink($path)
+    {
+        $this->assert($path, Behavior::COMMAND_UNLINK);
+        return $this->invokeInternalStreamWrapper(
+            'unlink',
+            $path,
+            $this->context
+        );
+    }
+
+    /**
+     * @param string $path
+     * @param int $flags
+     * @return array|false
+     */
+    public function url_stat($path, $flags)
+    {
+        $this->assert($path, Behavior::COMMAND_URL_STAT);
+        $functionName = $flags & STREAM_URL_STAT_QUIET ? '@stat' : 'stat';
+        return $this->invokeInternalStreamWrapper($functionName, $path);
+    }
+
+    /**
+     * @param string $path
+     * @param string $command
+     */
+    protected function assert($path, $command)
+    {
+        if ($this->resolveAssertable()->assert($path, $command) === true) {
+            return;
+        }
+
+        throw new Exception(
+            sprintf(
+                'Denied invocation of "%s" for command "%s"',
+                $path,
+                $command
+            ),
+            1535189880
+        );
+    }
+
+    /**
+     * @return Assertable
+     */
+    protected function resolveAssertable()
+    {
+        return Manager::instance();
+    }
+
+    /**
+     * Invokes commands on the native PHP Phar stream wrapper.
+     *
+     * @param string $functionName
+     * @param mixed ...$arguments
+     * @return mixed
+     */
+    private function invokeInternalStreamWrapper($functionName)
+    {
+        $arguments = func_get_args();
+        array_shift($arguments);
+        $silentExecution = $functionName{0} === '@';
+        $functionName = ltrim($functionName, '@');
+        $this->restoreInternalSteamWrapper();
+
+        try {
+            if ($silentExecution) {
+                $result = @call_user_func_array($functionName, $arguments);
+            } else {
+                $result = call_user_func_array($functionName, $arguments);
+            }
+        } catch (\Exception $exception) {
+            $this->registerStreamWrapper();
+            throw $exception;
+        } catch (\Throwable $throwable) {
+            $this->registerStreamWrapper();
+            throw $throwable;
+        }
+
+        $this->registerStreamWrapper();
+        return $result;
+    }
+
+    private function restoreInternalSteamWrapper()
+    {
+        stream_wrapper_restore('phar');
+    }
+
+    private function registerStreamWrapper()
+    {
+        stream_wrapper_unregister('phar');
+        stream_wrapper_register('phar', get_class($this));
+    }
+}
diff -Naur drupal-7.51/modules/aggregator/aggregator.info drupal-7.66/modules/aggregator/aggregator.info
--- drupal-7.51/modules/aggregator/aggregator.info	2016-10-05 21:02:54.000000000 +0200
+++ drupal-7.66/modules/aggregator/aggregator.info	2019-04-17 22:39:36.000000000 +0200
@@ -7,8 +7,7 @@
 configure = admin/config/services/aggregator/settings
 stylesheets[all][] = aggregator.css
 
-; Information added by Drupal.org packaging script on 2016-10-05
-version = "7.51"
+; Information added by Drupal.org packaging script on 2019-04-17
+version = "7.66"
 project = "drupal"
-datestamp = "1475694174"
-
+datestamp = "1555533576"
diff -Naur drupal-7.51/modules/aggregator/aggregator.module drupal-7.66/modules/aggregator/aggregator.module
--- drupal-7.51/modules/aggregator/aggregator.module	2016-10-05 20:45:42.000000000 +0200
+++ drupal-7.66/modules/aggregator/aggregator.module	2019-04-17 22:20:46.000000000 +0200
@@ -455,6 +455,14 @@
       db_delete('aggregator_category')
         ->condition('cid', $edit['cid'])
         ->execute();
+      // Remove category from feeds.
+      db_delete('aggregator_category_feed')
+        ->condition('cid', $edit['cid'])
+        ->execute();
+      // Remove category from feed items.
+      db_delete('aggregator_category_item')
+        ->condition('cid', $edit['cid'])
+        ->execute();
       // Make sure there is no active block for this category.
       if (module_exists('block')) {
         db_delete('block')
diff -Naur drupal-7.51/modules/aggregator/aggregator.test drupal-7.66/modules/aggregator/aggregator.test
--- drupal-7.51/modules/aggregator/aggregator.test	2016-10-05 20:45:42.000000000 +0200
+++ drupal-7.66/modules/aggregator/aggregator.test	2019-04-17 22:20:46.000000000 +0200
@@ -418,7 +418,7 @@
   }
 
   /**
-   * Creates a feed and makes sure you can add more than one category to it.
+   * Creates a feed and makes sure you can add/delete categories to it.
    */
   function testCategorizeFeed() {
 
@@ -448,7 +448,31 @@
     // Assert the feed has two categories.
     $this->getFeedCategories($db_feed);
     $this->assertEqual(count($db_feed->categories), 2, 'Feed has 2 categories');
+
+    // Use aggregator_save_feed() to delete a category.
+    $category = reset($categories);
+    aggregator_save_category(array('cid' => $category->cid));
+
+    // Assert that category is deleted.
+    $db_category = db_query("SELECT COUNT(*) FROM {aggregator_category} WHERE cid = :cid", array(':cid' => $category->cid))->fetchField();
+    $this->assertFalse($db_category, format_string('The category %title has been deleted.', array('%title' => $category->title)));
+
+    // Assert that category has been removed from feed.
+    $categorized_feeds = db_query("SELECT COUNT(*) FROM {aggregator_category_feed} WHERE cid = :cid", array(':cid' => $category->cid))->fetchField();
+    $this->assertFalse($categorized_feeds, format_string('The category %title has been removed from feed %feed_title.', array('%title' => $category->title, '%feed_title' => $feed['title'])));
+
+    // Assert that no broken links (associated with the deleted category)
+    // appear on one of the other category pages.
+    $this->createSampleNodes();
+    $this->drupalGet('admin/config/services/aggregator');
+    $this->clickLink('update items');
+    $categories = $this->getCategories();
+    $category = reset($categories);
+    $this->drupalGet('aggregator/categories/' . $category->cid);
+    global $base_path;
+    $this->assertNoRaw('<a href="' . $base_path . 'aggregator/categories/"></a>,');
   }
+
 }
 
 /**
@@ -685,9 +709,21 @@
       }
     }
 
+    // Delete category from feed items when category is deleted.
+    $cid = reset($feed->categories);
+    $categories = $this->getCategories();
+    $category_title = $categories[$cid]->title;
+
+    // Delete category.
+    aggregator_save_category(array('cid' => $cid));
+
+    // Assert category has been removed from feed items.
+    $categorized_count = db_query("SELECT COUNT(*) FROM {aggregator_category_item} WHERE cid = :cid", array(':cid' => $cid))->fetchField();
+    $this->assertFalse($categorized_count, format_string('The category %title has been removed from feed items.', array('%title' => $category_title)));
     // Delete feed.
     $this->deleteFeed($feed);
   }
+
 }
 
 /**
diff -Naur drupal-7.51/modules/aggregator/tests/aggregator_test.info drupal-7.66/modules/aggregator/tests/aggregator_test.info
--- drupal-7.51/modules/aggregator/tests/aggregator_test.info	2016-10-05 21:02:54.000000000 +0200
+++ drupal-7.66/modules/aggregator/tests/aggregator_test.info	2019-04-17 22:39:36.000000000 +0200
@@ -5,8 +5,7 @@
 core = 7.x
 hidden = TRUE
 
-; Information added by Drupal.org packaging script on 2016-10-05
-version = "7.51"
+; Information added by Drupal.org packaging script on 2019-04-17
+version = "7.66"
 project = "drupal"
-datestamp = "1475694174"
-
+datestamp = "1555533576"
diff -Naur drupal-7.51/modules/block/block.info drupal-7.66/modules/block/block.info
--- drupal-7.51/modules/block/block.info	2016-10-05 21:02:54.000000000 +0200
+++ drupal-7.66/modules/block/block.info	2019-04-17 22:39:36.000000000 +0200
@@ -6,8 +6,7 @@
 files[] = block.test
 configure = admin/structure/block
 
-; Information added by Drupal.org packaging script on 2016-10-05
-version = "7.51"
+; Information added by Drupal.org packaging script on 2019-04-17
+version = "7.66"
 project = "drupal"
-datestamp = "1475694174"
-
+datestamp = "1555533576"
diff -Naur drupal-7.51/modules/block/block.module drupal-7.66/modules/block/block.module
--- drupal-7.51/modules/block/block.module	2016-10-05 20:45:42.000000000 +0200
+++ drupal-7.66/modules/block/block.module	2019-04-17 22:20:46.000000000 +0200
@@ -432,23 +432,20 @@
   drupal_alter('block_info', $current_blocks, $theme, $code_blocks);
   foreach ($current_blocks as $module => $module_blocks) {
     foreach ($module_blocks as $delta => $block) {
-      if (!isset($block['pages'])) {
-        // {block}.pages is type 'text', so it cannot have a
-        // default value, and not null, so we need to provide
-        // value if the module did not.
-        $block['pages']  = '';
-      }
-      // Make sure weight is set.
-      if (!isset($block['weight'])) {
-        $block['weight'] = 0;
-      }
+      // Make sure certain attributes are set.
+      $block += array(
+        'pages' => '',
+        'weight' => 0,
+        'status' => 0,
+      );
+      // Check for active blocks in regions that are not available.
       if (!empty($block['region']) && $block['region'] != BLOCK_REGION_NONE && !isset($regions[$block['region']]) && $block['status'] == 1) {
         drupal_set_message(t('The block %info was assigned to the invalid region %region and has been disabled.', array('%info' => $block['info'], '%region' => $block['region'])), 'warning');
         // Disabled modules are moved into the BLOCK_REGION_NONE later so no
         // need to move the block to another region.
         $block['status'] = 0;
       }
-      // Set region to none if not enabled and make sure status is set.
+      // Set region to none if not enabled.
       if (empty($block['status'])) {
         $block['status'] = 0;
         $block['region'] = BLOCK_REGION_NONE;
diff -Naur drupal-7.51/modules/block/tests/block_test.info drupal-7.66/modules/block/tests/block_test.info
--- drupal-7.51/modules/block/tests/block_test.info	2016-10-05 21:02:54.000000000 +0200
+++ drupal-7.66/modules/block/tests/block_test.info	2019-04-17 22:39:36.000000000 +0200
@@ -5,8 +5,7 @@
 core = 7.x
 hidden = TRUE
 
-; Information added by Drupal.org packaging script on 2016-10-05
-version = "7.51"
+; Information added by Drupal.org packaging script on 2019-04-17
+version = "7.66"
 project = "drupal"
-datestamp = "1475694174"
-
+datestamp = "1555533576"
diff -Naur drupal-7.51/modules/block/tests/themes/block_test_theme/block_test_theme.info drupal-7.66/modules/block/tests/themes/block_test_theme/block_test_theme.info
--- drupal-7.51/modules/block/tests/themes/block_test_theme/block_test_theme.info	2016-10-05 21:02:54.000000000 +0200
+++ drupal-7.66/modules/block/tests/themes/block_test_theme/block_test_theme.info	2019-04-17 22:39:36.000000000 +0200
@@ -13,8 +13,7 @@
 regions[highlighted] = Highlighted
 regions[help] = Help
 
-; Information added by Drupal.org packaging script on 2016-10-05
-version = "7.51"
+; Information added by Drupal.org packaging script on 2019-04-17
+version = "7.66"
 project = "drupal"
-datestamp = "1475694174"
-
+datestamp = "1555533576"
diff -Naur drupal-7.51/modules/blog/blog.info drupal-7.66/modules/blog/blog.info
--- drupal-7.51/modules/blog/blog.info	2016-10-05 21:02:54.000000000 +0200
+++ drupal-7.66/modules/blog/blog.info	2019-04-17 22:39:36.000000000 +0200
@@ -5,8 +5,7 @@
 core = 7.x
 files[] = blog.test
 
-; Information added by Drupal.org packaging script on 2016-10-05
-version = "7.51"
+; Information added by Drupal.org packaging script on 2019-04-17
+version = "7.66"
 project = "drupal"
-datestamp = "1475694174"
-
+datestamp = "1555533576"
diff -Naur drupal-7.51/modules/book/book.info drupal-7.66/modules/book/book.info
--- drupal-7.51/modules/book/book.info	2016-10-05 21:02:54.000000000 +0200
+++ drupal-7.66/modules/book/book.info	2019-04-17 22:39:36.000000000 +0200
@@ -7,8 +7,7 @@
 configure = admin/content/book/settings
 stylesheets[all][] = book.css
 
-; Information added by Drupal.org packaging script on 2016-10-05
-version = "7.51"
+; Information added by Drupal.org packaging script on 2019-04-17
+version = "7.66"
 project = "drupal"
-datestamp = "1475694174"
-
+datestamp = "1555533576"
diff -Naur drupal-7.51/modules/book/book.module drupal-7.66/modules/book/book.module
--- drupal-7.51/modules/book/book.module	2016-10-05 20:45:42.000000000 +0200
+++ drupal-7.66/modules/book/book.module	2019-04-17 22:20:46.000000000 +0200
@@ -768,11 +768,13 @@
     return NULL;
   }
   $flat = book_get_flat_menu($book_link);
-  // Assigning the array to $flat resets the array pointer for use with each().
+  reset($flat);
   $curr = NULL;
   do {
     $prev = $curr;
-    list($key, $curr) = each($flat);
+    $curr = current($flat);
+    $key = key($flat);
+    next($flat);
   } while ($key && $key != $book_link['mlid']);
 
   if ($key == $book_link['mlid']) {
@@ -806,9 +808,10 @@
  */
 function book_next($book_link) {
   $flat = book_get_flat_menu($book_link);
-  // Assigning the array to $flat resets the array pointer for use with each().
+  reset($flat);
   do {
-    list($key, $curr) = each($flat);
+    $key = key($flat);
+    next($flat);
   }
   while ($key && $key != $book_link['mlid']);
 
diff -Naur drupal-7.51/modules/color/color.info drupal-7.66/modules/color/color.info
--- drupal-7.51/modules/color/color.info	2016-10-05 21:02:54.000000000 +0200
+++ drupal-7.66/modules/color/color.info	2019-04-17 22:39:36.000000000 +0200
@@ -5,8 +5,7 @@
 core = 7.x
 files[] = color.test
 
-; Information added by Drupal.org packaging script on 2016-10-05
-version = "7.51"
+; Information added by Drupal.org packaging script on 2019-04-17
+version = "7.66"
 project = "drupal"
-datestamp = "1475694174"
-
+datestamp = "1555533576"
diff -Naur drupal-7.51/modules/color/color.test drupal-7.66/modules/color/color.test
--- drupal-7.51/modules/color/color.test	2016-10-05 20:45:42.000000000 +0200
+++ drupal-7.66/modules/color/color.test	2019-04-17 22:20:46.000000000 +0200
@@ -122,7 +122,7 @@
       $edit['palette[bg]'] = $color;
       $this->drupalPost($settings_path, $edit, t('Save configuration'));
 
-      if($is_valid) {
+      if ($is_valid) {
         $this->assertText('The configuration options have been saved.');
       }
       else {
diff -Naur drupal-7.51/modules/comment/comment.info drupal-7.66/modules/comment/comment.info
--- drupal-7.51/modules/comment/comment.info	2016-10-05 21:02:54.000000000 +0200
+++ drupal-7.66/modules/comment/comment.info	2019-04-17 22:39:36.000000000 +0200
@@ -9,8 +9,7 @@
 configure = admin/content/comment
 stylesheets[all][] = comment.css
 
-; Information added by Drupal.org packaging script on 2016-10-05
-version = "7.51"
+; Information added by Drupal.org packaging script on 2019-04-17
+version = "7.66"
 project = "drupal"
-datestamp = "1475694174"
-
+datestamp = "1555533576"
diff -Naur drupal-7.51/modules/comment/comment.test drupal-7.66/modules/comment/comment.test
--- drupal-7.51/modules/comment/comment.test	2016-10-05 20:45:42.000000000 +0200
+++ drupal-7.66/modules/comment/comment.test	2019-04-17 22:20:46.000000000 +0200
@@ -11,7 +11,13 @@
   protected $node;
 
   function setUp() {
-    parent::setUp('comment', 'search');
+    $modules = func_get_args();
+    if (isset($modules[0]) && is_array($modules[0])) {
+      $modules = $modules[0];
+    }
+    $modules[] = 'comment';
+    parent::setUp($modules);
+
     // Create users and test node.
     $this->admin_user = $this->drupalCreateUser(array('administer content types', 'administer comments', 'administer blocks', 'administer actions', 'administer fields'));
     $this->web_user = $this->drupalCreateUser(array('access comments', 'post comments', 'create article content', 'edit own comments'));
@@ -1490,7 +1496,7 @@
   }
 
   function setUp() {
-    DrupalWebTestCase::setUp('comment', 'search', 'node_access_test');
+    parent::setUp('search', 'node_access_test');
     node_access_rebuild();
 
     // Create users and test node.
diff -Naur drupal-7.51/modules/contact/contact.info drupal-7.66/modules/contact/contact.info
--- drupal-7.51/modules/contact/contact.info	2016-10-05 21:02:54.000000000 +0200
+++ drupal-7.66/modules/contact/contact.info	2019-04-17 22:39:36.000000000 +0200
@@ -6,8 +6,7 @@
 files[] = contact.test
 configure = admin/structure/contact
 
-; Information added by Drupal.org packaging script on 2016-10-05
-version = "7.51"
+; Information added by Drupal.org packaging script on 2019-04-17
+version = "7.66"
 project = "drupal"
-datestamp = "1475694174"
-
+datestamp = "1555533576"
diff -Naur drupal-7.51/modules/contact/contact.module drupal-7.66/modules/contact/contact.module
--- drupal-7.51/modules/contact/contact.module	2016-10-05 20:45:42.000000000 +0200
+++ drupal-7.66/modules/contact/contact.module	2019-04-17 22:20:46.000000000 +0200
@@ -234,7 +234,14 @@
  * Implements hook_user_presave().
  */
 function contact_user_presave(&$edit, $account, $category) {
-  $edit['data']['contact'] = isset($edit['contact']) ? $edit['contact'] : variable_get('contact_default_status', 1);
+  if (isset($edit['contact'])) {
+    // Set new value.
+    $edit['data']['contact'] = $edit['contact'];
+  }
+  elseif (!isset($account->data['contact'])) {
+    // Use default if none has been set.
+    $edit['data']['contact'] = variable_get('contact_default_status', 1);
+  }
 }
 
 /**
diff -Naur drupal-7.51/modules/contact/contact.test drupal-7.66/modules/contact/contact.test
--- drupal-7.51/modules/contact/contact.test	2016-10-05 20:45:42.000000000 +0200
+++ drupal-7.66/modules/contact/contact.test	2019-04-17 22:20:46.000000000 +0200
@@ -346,6 +346,28 @@
     $this->drupalGet('user/' . $this->contact_user->uid . '/contact');
     $this->assertResponse(200);
 
+    // Test that users can disable their contact form.
+    $this->drupalLogin($this->contact_user);
+    $edit = array('contact' => FALSE);
+    $this->drupalPost('user/' . $this->contact_user->uid . '/edit', $edit, 'Save');
+    $this->drupalLogout();
+    $this->drupalGet('user/' . $this->contact_user->uid . '/contact');
+    $this->assertResponse(403);
+
+    // Test that user's contact status stays disabled when saving.
+    $contact_user_temp = user_load($this->contact_user->uid, TRUE);
+    user_save($contact_user_temp);
+    $this->drupalGet('user/' . $this->contact_user->uid . '/contact');
+    $this->assertResponse(403);
+
+    // Test that users can enable their contact form.
+    $this->drupalLogin($this->contact_user);
+    $edit = array('contact' => TRUE);
+    $this->drupalPost('user/' . $this->contact_user->uid . '/edit', $edit, 'Save');
+    $this->drupalLogout();
+    $this->drupalGet('user/' . $this->contact_user->uid . '/contact');
+    $this->assertResponse(200);
+
     // Revoke the personal contact permission for the anonymous user.
     user_role_revoke_permissions(DRUPAL_ANONYMOUS_RID, array('access user contact forms'));
     $this->drupalGet('user/' . $this->contact_user->uid . '/contact');
diff -Naur drupal-7.51/modules/contextual/contextual.info drupal-7.66/modules/contextual/contextual.info
--- drupal-7.51/modules/contextual/contextual.info	2016-10-05 21:02:54.000000000 +0200
+++ drupal-7.66/modules/contextual/contextual.info	2019-04-17 22:39:36.000000000 +0200
@@ -5,8 +5,7 @@
 core = 7.x
 files[] = contextual.test
 
-; Information added by Drupal.org packaging script on 2016-10-05
-version = "7.51"
+; Information added by Drupal.org packaging script on 2019-04-17
+version = "7.66"
 project = "drupal"
-datestamp = "1475694174"
-
+datestamp = "1555533576"
diff -Naur drupal-7.51/modules/dashboard/dashboard.info drupal-7.66/modules/dashboard/dashboard.info
--- drupal-7.51/modules/dashboard/dashboard.info	2016-10-05 21:02:54.000000000 +0200
+++ drupal-7.66/modules/dashboard/dashboard.info	2019-04-17 22:39:36.000000000 +0200
@@ -7,8 +7,7 @@
 dependencies[] = block
 configure = admin/dashboard/customize
 
-; Information added by Drupal.org packaging script on 2016-10-05
-version = "7.51"
+; Information added by Drupal.org packaging script on 2019-04-17
+version = "7.66"
 project = "drupal"
-datestamp = "1475694174"
-
+datestamp = "1555533576"
diff -Naur drupal-7.51/modules/dblog/dblog.admin.inc drupal-7.66/modules/dblog/dblog.admin.inc
--- drupal-7.51/modules/dblog/dblog.admin.inc	2016-10-05 20:45:42.000000000 +0200
+++ drupal-7.66/modules/dblog/dblog.admin.inc	2019-04-17 22:20:46.000000000 +0200
@@ -420,6 +420,6 @@
  */
 function dblog_clear_log_submit() {
   $_SESSION['dblog_overview_filter'] = array();
-  db_delete('watchdog')->execute();
+  db_truncate('watchdog')->execute();
   drupal_set_message(t('Database log cleared.'));
 }
diff -Naur drupal-7.51/modules/dblog/dblog.info drupal-7.66/modules/dblog/dblog.info
--- drupal-7.51/modules/dblog/dblog.info	2016-10-05 21:02:54.000000000 +0200
+++ drupal-7.66/modules/dblog/dblog.info	2019-04-17 22:39:36.000000000 +0200
@@ -5,8 +5,7 @@
 core = 7.x
 files[] = dblog.test
 
-; Information added by Drupal.org packaging script on 2016-10-05
-version = "7.51"
+; Information added by Drupal.org packaging script on 2019-04-17
+version = "7.66"
 project = "drupal"
-datestamp = "1475694174"
-
+datestamp = "1555533576"
diff -Naur drupal-7.51/modules/field/field.info drupal-7.66/modules/field/field.info
--- drupal-7.51/modules/field/field.info	2016-10-05 21:02:54.000000000 +0200
+++ drupal-7.66/modules/field/field.info	2019-04-17 22:39:36.000000000 +0200
@@ -11,8 +11,7 @@
 required = TRUE
 stylesheets[all][] = theme/field.css
 
-; Information added by Drupal.org packaging script on 2016-10-05
-version = "7.51"
+; Information added by Drupal.org packaging script on 2019-04-17
+version = "7.66"
 project = "drupal"
-datestamp = "1475694174"
-
+datestamp = "1555533576"
diff -Naur drupal-7.51/modules/field/modules/field_sql_storage/field_sql_storage.info drupal-7.66/modules/field/modules/field_sql_storage/field_sql_storage.info
--- drupal-7.51/modules/field/modules/field_sql_storage/field_sql_storage.info	2016-10-05 21:02:54.000000000 +0200
+++ drupal-7.66/modules/field/modules/field_sql_storage/field_sql_storage.info	2019-04-17 22:39:36.000000000 +0200
@@ -7,8 +7,7 @@
 files[] = field_sql_storage.test
 required = TRUE
 
-; Information added by Drupal.org packaging script on 2016-10-05
-version = "7.51"
+; Information added by Drupal.org packaging script on 2019-04-17
+version = "7.66"
 project = "drupal"
-datestamp = "1475694174"
-
+datestamp = "1555533576"
diff -Naur drupal-7.51/modules/field/modules/list/list.info drupal-7.66/modules/field/modules/list/list.info
--- drupal-7.51/modules/field/modules/list/list.info	2016-10-05 21:02:54.000000000 +0200
+++ drupal-7.66/modules/field/modules/list/list.info	2019-04-17 22:39:36.000000000 +0200
@@ -7,8 +7,7 @@
 dependencies[] = options
 files[] = tests/list.test
 
-; Information added by Drupal.org packaging script on 2016-10-05
-version = "7.51"
+; Information added by Drupal.org packaging script on 2019-04-17
+version = "7.66"
 project = "drupal"
-datestamp = "1475694174"
-
+datestamp = "1555533576"
diff -Naur drupal-7.51/modules/field/modules/list/list.install drupal-7.66/modules/field/modules/list/list.install
--- drupal-7.51/modules/field/modules/list/list.install	2016-10-05 20:45:42.000000000 +0200
+++ drupal-7.66/modules/field/modules/list/list.install	2019-04-17 22:20:46.000000000 +0200
@@ -61,7 +61,7 @@
 
       // Additionally, float keys need to be disambiguated ('.5' is '0.5').
       if ($field['type'] == 'list_number' && !empty($allowed_values)) {
-        $keys = array_map(create_function('$a', 'return (string) (float) $a;'), array_keys($allowed_values));
+        $keys = array_map('_list_update_7001_float_string_cast', array_keys($allowed_values));
         $allowed_values = array_combine($keys, array_values($allowed_values));
       }
 
@@ -89,6 +89,13 @@
 }
 
 /**
+ * Helper callback function to cast the array element.
+ */
+function _list_update_7001_float_string_cast($element) {
+  return (string) (float) $element;
+}
+
+/**
  * Helper function for list_update_7001: extract allowed values from a string.
  *
  * This reproduces the parsing logic in use before D7 RC2.
diff -Naur drupal-7.51/modules/field/modules/list/tests/list_test.info drupal-7.66/modules/field/modules/list/tests/list_test.info
--- drupal-7.51/modules/field/modules/list/tests/list_test.info	2016-10-05 21:02:54.000000000 +0200
+++ drupal-7.66/modules/field/modules/list/tests/list_test.info	2019-04-17 22:39:36.000000000 +0200
@@ -5,8 +5,7 @@
 version = VERSION
 hidden = TRUE
 
-; Information added by Drupal.org packaging script on 2016-10-05
-version = "7.51"
+; Information added by Drupal.org packaging script on 2019-04-17
+version = "7.66"
 project = "drupal"
-datestamp = "1475694174"
-
+datestamp = "1555533576"
diff -Naur drupal-7.51/modules/field/modules/number/number.info drupal-7.66/modules/field/modules/number/number.info
--- drupal-7.51/modules/field/modules/number/number.info	2016-10-05 21:02:54.000000000 +0200
+++ drupal-7.66/modules/field/modules/number/number.info	2019-04-17 22:39:36.000000000 +0200
@@ -6,8 +6,7 @@
 dependencies[] = field
 files[] = number.test
 
-; Information added by Drupal.org packaging script on 2016-10-05
-version = "7.51"
+; Information added by Drupal.org packaging script on 2019-04-17
+version = "7.66"
 project = "drupal"
-datestamp = "1475694174"
-
+datestamp = "1555533576"
diff -Naur drupal-7.51/modules/field/modules/number/number.module drupal-7.66/modules/field/modules/number/number.module
--- drupal-7.51/modules/field/modules/number/number.module	2016-10-05 20:45:42.000000000 +0200
+++ drupal-7.66/modules/field/modules/number/number.module	2019-04-17 22:20:46.000000000 +0200
@@ -164,6 +164,15 @@
       }
     }
   }
+  if ($field['type'] == 'number_float') {
+    // Remove the decimal point from float values with decimal
+    // point but no decimal numbers.
+    foreach ($items as $delta => $item) {
+      if (isset($item['value'])) {
+        $items[$delta]['value'] = floatval($item['value']);
+      }
+    }
+  }
 }
 
 /**
diff -Naur drupal-7.51/modules/field/modules/number/number.test drupal-7.66/modules/field/modules/number/number.test
--- drupal-7.51/modules/field/modules/number/number.test	2016-10-05 20:45:42.000000000 +0200
+++ drupal-7.66/modules/field/modules/number/number.test	2019-04-17 22:20:46.000000000 +0200
@@ -69,7 +69,7 @@
     preg_match('|test-entity/manage/(\d+)/edit|', $this->url, $match);
     $id = $match[1];
     $this->assertRaw(t('test_entity @id has been created.', array('@id' => $id)), 'Entity was created');
-    $this->assertRaw(round($value, 2), 'Value is displayed.');
+    $this->assertRaw($value, 'Value is displayed.');
 
     // Try to create entries with more than one decimal separator; assert fail.
     $wrong_entries = array(
@@ -152,4 +152,50 @@
     );
     $this->drupalPost(NULL, $edit, t('Save'));
   }
+
+  /**
+   * Test number_float field.
+   */
+  function testNumberFloatField() {
+    $this->field = array(
+      'field_name' => drupal_strtolower($this->randomName()),
+      'type' => 'number_float',
+      'settings' => array(
+        'precision' => 8, 'scale' => 4, 'decimal_separator' => '.',
+      )
+    );
+    field_create_field($this->field);
+    $this->instance = array(
+      'field_name' => $this->field['field_name'],
+      'entity_type' => 'test_entity',
+      'bundle' => 'test_bundle',
+      'widget' => array(
+        'type' => 'number',
+      ),
+      'display' => array(
+        'default' => array(
+          'type' => 'number_float',
+        ),
+      ),
+    );
+    field_create_instance($this->instance);
+
+    $langcode = LANGUAGE_NONE;
+    $value = array(
+      '9.' => '9',
+      '.' => '0',
+      '123.55' => '123.55',
+      '.55' => '0.55',
+      '-0.55' => '-0.55',
+    );
+    foreach($value as $key => $value) {
+      $edit = array(
+        "{$this->field['field_name']}[$langcode][0][value]" => $key,
+      );
+      $this->drupalPost('test-entity/add/test-bundle', $edit, t('Save'));
+      $this->assertNoText("PDOException");
+      $this->assertRaw($value, 'Correct value is displayed.');
+    }
+  }
+
 }
diff -Naur drupal-7.51/modules/field/modules/options/options.info drupal-7.66/modules/field/modules/options/options.info
--- drupal-7.51/modules/field/modules/options/options.info	2016-10-05 21:02:54.000000000 +0200
+++ drupal-7.66/modules/field/modules/options/options.info	2019-04-17 22:39:36.000000000 +0200
@@ -6,8 +6,7 @@
 dependencies[] = field
 files[] = options.test
 
-; Information added by Drupal.org packaging script on 2016-10-05
-version = "7.51"
+; Information added by Drupal.org packaging script on 2019-04-17
+version = "7.66"
 project = "drupal"
-datestamp = "1475694174"
-
+datestamp = "1555533576"
diff -Naur drupal-7.51/modules/field/modules/options/options.test drupal-7.66/modules/field/modules/options/options.test
--- drupal-7.51/modules/field/modules/options/options.test	2016-10-05 20:45:42.000000000 +0200
+++ drupal-7.66/modules/field/modules/options/options.test	2019-04-17 22:20:46.000000000 +0200
@@ -23,8 +23,15 @@
       'type' => 'list_integer',
       'cardinality' => 1,
       'settings' => array(
-        // Make sure that 0 works as an option.
-        'allowed_values' => array(0 => 'Zero', 1 => 'One', 2 => 'Some <script>dangerous</script> & unescaped <strong>markup</strong>',  3 => 'Some HTML encoded markup with &lt; &amp; &gt;'),
+        'allowed_values' => array(
+          // Make sure that 0 works as an option.
+          0 => 'Zero',
+          1 => 'One',
+          // Make sure that option text is properly sanitized.
+          2 => 'Some <script>dangerous</script> & unescaped <strong>markup</strong>',
+          // Make sure that HTML entities in option text are not double-encoded.
+          3 => 'Some HTML encoded markup with &lt; &amp; &gt;',
+        ),
       ),
     );
     $this->card_1 = field_create_field($this->card_1);
@@ -35,8 +42,13 @@
       'type' => 'list_integer',
       'cardinality' => 2,
       'settings' => array(
-        // Make sure that 0 works as an option.
-        'allowed_values' => array(0 => 'Zero', 1 => 'One', 2 => 'Some <script>dangerous</script> & unescaped <strong>markup</strong>'),
+        'allowed_values' => array(
+          // Make sure that 0 works as an option.
+          0 => 'Zero',
+          1 => 'One',
+          // Make sure that option text is properly sanitized.
+          2 => 'Some <script>dangerous</script> & unescaped <strong>markup</strong>',
+        ),
       ),
     );
     $this->card_2 = field_create_field($this->card_2);
@@ -47,8 +59,12 @@
       'type' => 'list_boolean',
       'cardinality' => 1,
       'settings' => array(
-        // Make sure that 0 works as a 'on' value'.
-        'allowed_values' => array(1 => 'Zero', 0 => 'Some <script>dangerous</script> & unescaped <strong>markup</strong>'),
+        'allowed_values' => array(
+          // Make sure that 1 works as a 'on' value'.
+          1 => 'Zero',
+          // Make sure that option text is properly sanitized.
+          0 => 'Some <script>dangerous</script> & unescaped <strong>markup</strong>',
+        ),
       ),
     );
     $this->bool = field_create_field($this->bool);
diff -Naur drupal-7.51/modules/field/modules/text/text.info drupal-7.66/modules/field/modules/text/text.info
--- drupal-7.51/modules/field/modules/text/text.info	2016-10-05 21:02:54.000000000 +0200
+++ drupal-7.66/modules/field/modules/text/text.info	2019-04-17 22:39:36.000000000 +0200
@@ -7,8 +7,7 @@
 files[] = text.test
 required = TRUE
 
-; Information added by Drupal.org packaging script on 2016-10-05
-version = "7.51"
+; Information added by Drupal.org packaging script on 2019-04-17
+version = "7.66"
 project = "drupal"
-datestamp = "1475694174"
-
+datestamp = "1555533576"
diff -Naur drupal-7.51/modules/field/tests/field_test.info drupal-7.66/modules/field/tests/field_test.info
--- drupal-7.51/modules/field/tests/field_test.info	2016-10-05 21:02:54.000000000 +0200
+++ drupal-7.66/modules/field/tests/field_test.info	2019-04-17 22:39:36.000000000 +0200
@@ -6,8 +6,7 @@
 version = VERSION
 hidden = TRUE
 
-; Information added by Drupal.org packaging script on 2016-10-05
-version = "7.51"
+; Information added by Drupal.org packaging script on 2019-04-17
+version = "7.66"
 project = "drupal"
-datestamp = "1475694174"
-
+datestamp = "1555533576"
diff -Naur drupal-7.51/modules/field/theme/field.tpl.php drupal-7.66/modules/field/theme/field.tpl.php
--- drupal-7.51/modules/field/theme/field.tpl.php	2016-10-05 20:45:42.000000000 +0200
+++ drupal-7.66/modules/field/theme/field.tpl.php	2019-04-17 22:20:46.000000000 +0200
@@ -4,8 +4,10 @@
  * @file field.tpl.php
  * Default template implementation to display the value of a field.
  *
- * This file is not used and is here as a starting point for customization only.
- * @see theme_field()
+ * This file is not used by Drupal core, which uses theme functions instead for
+ * performance reasons. The markup is the same, though, so if you want to use
+ * template files rather than functions to extend field theming, copy this to
+ * your custom theme. See theme_field() for a discussion of performance.
  *
  * Available variables:
  * - $items: An array of field values. Use render() to output them.
@@ -45,7 +47,7 @@
  */
 ?>
 <!--
-THIS FILE IS NOT USED AND IS HERE AS A STARTING POINT FOR CUSTOMIZATION ONLY.
+This file is not used by Drupal core, which uses theme functions instead.
 See http://api.drupal.org/api/function/theme_field/7 for details.
 After copying this file to your theme's folder and customizing it, remove this
 HTML comment.
diff -Naur drupal-7.51/modules/field_ui/field_ui.info drupal-7.66/modules/field_ui/field_ui.info
--- drupal-7.51/modules/field_ui/field_ui.info	2016-10-05 21:02:54.000000000 +0200
+++ drupal-7.66/modules/field_ui/field_ui.info	2019-04-17 22:39:36.000000000 +0200
@@ -6,8 +6,7 @@
 dependencies[] = field
 files[] = field_ui.test
 
-; Information added by Drupal.org packaging script on 2016-10-05
-version = "7.51"
+; Information added by Drupal.org packaging script on 2019-04-17
+version = "7.66"
 project = "drupal"
-datestamp = "1475694174"
-
+datestamp = "1555533576"
diff -Naur drupal-7.51/modules/file/file.field.inc drupal-7.66/modules/file/file.field.inc
--- drupal-7.51/modules/file/file.field.inc	2016-10-05 20:45:42.000000000 +0200
+++ drupal-7.66/modules/file/file.field.inc	2019-04-17 22:20:46.000000000 +0200
@@ -599,7 +599,7 @@
     // If the display field is present make sure its unchecked value is saved.
     $field = field_widget_field($element, $form_state);
     if (empty($input['display'])) {
-      $input['display'] = $field['settings']['display_field'] ? 0 : 1;
+      $input['display'] = !empty($field['settings']['display_field']) ? 0 : 1;
     }
   }
 
diff -Naur drupal-7.51/modules/file/file.info drupal-7.66/modules/file/file.info
--- drupal-7.51/modules/file/file.info	2016-10-05 21:02:54.000000000 +0200
+++ drupal-7.66/modules/file/file.info	2019-04-17 22:39:36.000000000 +0200
@@ -6,8 +6,7 @@
 dependencies[] = field
 files[] = tests/file.test
 
-; Information added by Drupal.org packaging script on 2016-10-05
-version = "7.51"
+; Information added by Drupal.org packaging script on 2019-04-17
+version = "7.66"
 project = "drupal"
-datestamp = "1475694174"
-
+datestamp = "1555533576"
diff -Naur drupal-7.51/modules/file/file.module drupal-7.66/modules/file/file.module
--- drupal-7.51/modules/file/file.module	2016-10-05 20:45:42.000000000 +0200
+++ drupal-7.66/modules/file/file.module	2019-04-17 22:20:46.000000000 +0200
@@ -140,14 +140,15 @@
   }
 
   // Find out which (if any) fields of this type contain the file.
-  $references = file_get_file_references($file, NULL, FIELD_LOAD_CURRENT, $field_type);
+  $references = file_get_file_references($file, NULL, FIELD_LOAD_CURRENT, $field_type, FALSE);
 
   // Stop processing if there are no references in order to avoid returning
   // headers for files controlled by other modules. Make an exception for
   // temporary files where the host entity has not yet been saved (for example,
   // an image preview on a node/add form) in which case, allow download by the
-  // file's owner.
-  if (empty($references) && ($file->status == FILE_STATUS_PERMANENT || $file->uid != $user->uid)) {
+  // file's owner. For anonymous file owners, only the browser session that
+  // uploaded the file should be granted access.
+  if (empty($references) && ($file->status == FILE_STATUS_PERMANENT || $file->uid != $user->uid || (!$user->uid && empty($_SESSION['anonymous_allowed_file_ids'][$file->fid])))) {
       return;
   }
 
@@ -238,6 +239,9 @@
   $form_parents = func_get_args();
   $form_build_id = (string) array_pop($form_parents);
 
+  // Sanitize form parents before using them.
+  $form_parents = array_filter($form_parents, 'element_child');
+
   if (empty($_POST['form_build_id']) || $form_build_id != $_POST['form_build_id']) {
     // Invalid request.
     drupal_set_message(t('An unrecoverable error occurred. The uploaded file likely exceeded the maximum file size (@size) that this server supports.', array('@size' => format_size(file_upload_max_size()))), 'error');
@@ -280,9 +284,10 @@
     $form['#suffix'] .= '<span class="ajax-new-content"></span>';
   }
 
-  $output = theme('status_messages') . drupal_render($form);
+  $form['#prefix'] .= theme('status_messages');
+  $output = drupal_render($form);
   $js = drupal_add_js();
-  $settings = call_user_func_array('array_merge_recursive', $js['settings']['data']);
+  $settings = drupal_array_merge_deep_array($js['settings']['data']);
 
   $commands[] = ajax_command_replace(NULL, $output, $settings);
   return array('#type' => 'ajax', '#commands' => $commands);
@@ -1065,11 +1070,18 @@
  * @param $field_type
  *   (optional) The name of a field type. If given, limits the reference check
  *   to fields of the given type.
+ * @param $check_access
+ *   (optional) A boolean that specifies whether the permissions of the current
+ *   user should be checked when retrieving references. If FALSE, all
+ *   references to the file are returned. If TRUE, only references from
+ *   entities that the current user has access to are returned. Defaults to
+ *   TRUE for backwards compatibility reasons, but FALSE is recommended for
+ *   most situations.
  *
  * @return
  *   An integer value.
  */
-function file_get_file_references($file, $field = NULL, $age = FIELD_LOAD_REVISION, $field_type = 'file') {
+function file_get_file_references($file, $field = NULL, $age = FIELD_LOAD_REVISION, $field_type = 'file', $check_access = TRUE) {
   $references = drupal_static(__FUNCTION__, array());
   $fields = isset($field) ? array($field['field_name'] => $field) : field_info_fields();
 
@@ -1080,6 +1092,11 @@
       $query
         ->fieldCondition($file_field, 'fid', $file->fid)
         ->age($age);
+      if (!$check_access) {
+        // Neutralize the 'entity_field_access' query tag added by
+        // field_sql_storage_field_storage_query().
+        $query->addTag('DANGEROUS_ACCESS_CHECK_OPT_OUT');
+      }
       $references[$field_name] = $query->execute();
     }
   }
diff -Naur drupal-7.51/modules/file/tests/file.test drupal-7.66/modules/file/tests/file.test
--- drupal-7.51/modules/file/tests/file.test	2016-10-05 20:45:42.000000000 +0200
+++ drupal-7.66/modules/file/tests/file.test	2019-04-17 22:20:46.000000000 +0200
@@ -597,6 +597,56 @@
   }
 
   /**
+   * Tests validation with the Upload button.
+   */
+  function testWidgetValidation() {
+    $type_name = 'article';
+    $field_name = strtolower($this->randomName());
+    $this->createFileField($field_name, $type_name);
+    $this->updateFileField($field_name, $type_name, array('file_extensions' => 'txt'));
+
+    foreach (array('nojs', 'js') as $type) {
+      // Create node and prepare files for upload.
+      $node = $this->drupalCreateNode(array('type' => 'article'));
+      $nid = $node->nid;
+      $this->drupalGet("node/$nid/edit");
+      $test_file_text = $this->getTestFile('text');
+      $test_file_image = $this->getTestFile('image');
+      $field = field_info_field($field_name);
+      $name = 'files[' . $field_name . '_' . LANGUAGE_NONE . '_0]';
+
+      // Upload file with incorrect extension, check for validation error.
+      $edit[$name] = drupal_realpath($test_file_image->uri);
+      switch ($type) {
+        case 'nojs':
+          $this->drupalPost(NULL, $edit, t('Upload'));
+          break;
+
+        case 'js':
+          $button = $this->xpath('//input[@type="submit" and @value="' . t('Upload') . '"]');
+          $this->drupalPostAJAX(NULL, $edit, array((string) $button[0]['name'] => (string) $button[0]['value']));
+          break;
+      }
+      $error_message = t('Only files with the following extensions are allowed: %files-allowed.', array('%files-allowed' => 'txt'));
+      $this->assertRaw($error_message, t('Validation error when file with wrong extension uploaded (JSMode=%type).', array('%type' => $type)));
+
+      // Upload file with correct extension, check that error message is removed.
+      $edit[$name] = drupal_realpath($test_file_text->uri);
+      switch ($type) {
+        case 'nojs':
+          $this->drupalPost(NULL, $edit, t('Upload'));
+          break;
+
+        case 'js':
+          $button = $this->xpath('//input[@type="submit" and @value="' . t('Upload') . '"]');
+          $this->drupalPostAJAX(NULL, $edit, array((string) $button[0]['name'] => (string) $button[0]['value']));
+          break;
+      }
+      $this->assertNoRaw($error_message, t('Validation error removed when file with correct extension uploaded (JSMode=%type).', array('%type' => $type)));
+    }
+  }
+
+  /**
    * Helper for testing exploiting the temporary file removal using fid.
    *
    * @param int $victim_uid
@@ -1501,6 +1551,153 @@
     $this->assertNoRaw($node_file->filename, 'File without view field access permission does not appear after attempting to attach it to a new node.');
     $this->drupalGet(file_create_url($node_file->uri));
     $this->assertResponse(403, 'Confirmed that access is denied for the file without view field access permission after attempting to attach it to a new node.');
+
+    // As an anonymous user, create a temporary file with no references and
+    // confirm that only the session that uploaded it may view it.
+    $this->drupalLogout();
+    user_role_grant_permissions(DRUPAL_ANONYMOUS_RID, array(
+      "create $type_name content",
+      'access content',
+    ));
+    $test_file = $this->getTestFile('text');
+    $this->drupalGet('node/add/' . $type_name);
+    $edit = array('files[' . $field_name . '_' . LANGUAGE_NONE . '_0]' => drupal_realpath($test_file->uri));
+    $this->drupalPost(NULL, $edit, t('Upload'));
+    $files = file_load_multiple(array(), array('uid' => 0));
+    $this->assertEqual(1, count($files), 'Loaded one anonymous file.');
+    $file = end($files);
+    $this->assertNotEqual($file->status, FILE_STATUS_PERMANENT, 'File is temporary.');
+    $usage = file_usage_list($file);
+    $this->assertFalse($usage, 'No file usage found.');
+    $file_url = file_create_url($file->uri);
+    $this->drupalGet($file_url);
+    $this->assertResponse(200, 'Confirmed that the anonymous uploader has access to the temporary file.');
+    // Close the prior connection and remove the session cookie.
+    $this->curlClose();
+    $this->cookies = array();
+    $this->drupalGet($file_url);
+    $this->assertResponse(403, 'Confirmed that another anonymous user cannot access the temporary file.');
+
+    // As an anonymous user, create a permanent file that is referenced by a
+    // published node and confirm that all anonymous users may view it.
+    $test_file = $this->getTestFile('text');
+    $this->drupalGet('node/add/' . $type_name);
+    $edit = array();
+    $edit['title'] = $this->randomName();
+    $edit['files[' . $field_name . '_' . LANGUAGE_NONE . '_0]'] = drupal_realpath($test_file->uri);
+    $this->drupalPost(NULL, $edit, t('Save'));
+    $new_node = $this->drupalGetNodeByTitle($edit['title']);
+    $file = file_load($new_node->{$field_name}[LANGUAGE_NONE][0]['fid']);
+    $this->assertEqual($file->status, FILE_STATUS_PERMANENT, 'File is permanent.');
+    $usage = file_usage_list($file);
+    $this->assertTrue($usage, 'File usage found.');
+    $file_url = file_create_url($file->uri);
+    $this->drupalGet($file_url);
+    $this->assertResponse(200, 'Confirmed that the anonymous uploader has access to the permanent file that is referenced by a published node.');
+    // Close the prior connection and remove the session cookie.
+    $this->curlClose();
+    $this->cookies = array();
+    $this->drupalGet($file_url);
+    $this->assertResponse(200, 'Confirmed that another anonymous user also has access to the permanent file that is referenced by a published node.');
+
+    // As an anonymous user, create a permanent file that is referenced by an
+    // unpublished node and confirm that no anonymous users may view it (even
+    // the session that uploaded the file) because they cannot view the
+    // unpublished node.
+    $test_file = $this->getTestFile('text');
+    $this->drupalGet('node/add/' . $type_name);
+    $edit = array();
+    $edit['title'] = $this->randomName();
+    $edit['files[' . $field_name . '_' . LANGUAGE_NONE . '_0]'] = drupal_realpath($test_file->uri);
+    $this->drupalPost(NULL, $edit, t('Save'));
+    $new_node = $this->drupalGetNodeByTitle($edit['title']);
+    $new_node->status = NODE_NOT_PUBLISHED;
+    node_save($new_node);
+    $file = file_load($new_node->{$field_name}[LANGUAGE_NONE][0]['fid']);
+    $this->assertEqual($file->status, FILE_STATUS_PERMANENT, 'File is permanent.');
+    $usage = file_usage_list($file);
+    $this->assertTrue($usage, 'File usage found.');
+    $file_url = file_create_url($file->uri);
+    $this->drupalGet($file_url);
+    $this->assertResponse(403, 'Confirmed that the anonymous uploader cannot access the permanent file when it is referenced by an unpublished node.');
+    // Close the prior connection and remove the session cookie.
+    $this->curlClose();
+    $this->cookies = array();
+    $this->drupalGet($file_url);
+    $this->assertResponse(403, 'Confirmed that another anonymous user cannot access the permanent file when it is referenced by an unpublished node.');
+  }
+
+  /**
+   * Tests file access for private nodes when file download access is granted.
+   */
+  function testPrivateFileDownloadAccessGranted() {
+    // Tell file_module_test to attempt to grant access to all private files,
+    // and ensure that it is doing so correctly.
+    $test_file = $this->getTestFile('text');
+    $uri = file_unmanaged_move($test_file->uri, 'private://');
+    $file_url = file_create_url($uri);
+    $this->drupalGet($file_url);
+    $this->assertResponse(403, 'Access is not granted to an arbitrary private file by default.');
+    variable_set('file_module_test_grant_download_access', TRUE);
+    $this->drupalGet($file_url);
+    $this->assertResponse(200, 'Access is granted to an arbitrary private file after a module grants access to all private files in hook_file_download().');
+
+    // Create a public node with a file attached.
+    $type_name = 'page';
+    $field_name = strtolower($this->randomName());
+    $this->createFileField($field_name, $type_name, array('uri_scheme' => 'private'));
+    $test_file = $this->getTestFile('text');
+    $nid = $this->uploadNodeFile($test_file, $field_name, $type_name, TRUE, array('private' => FALSE));
+    $node = node_load($nid, NULL, TRUE);
+    $file_url = file_create_url($node->{$field_name}[LANGUAGE_NONE][0]['uri']);
+
+    // Unpublish the node and ensure that only administrators (not anonymous
+    // users) can access the node and download the file; the expectation is
+    // that the File module's hook_file_download() implementation will deny
+    // access and thereby override the file_module_test module's access grant.
+    $node->status = NODE_NOT_PUBLISHED;
+    node_save($node);
+    $this->drupalLogin($this->admin_user);
+    $this->drupalGet("node/$nid");
+    $this->assertResponse(200, 'Administrator can access the unpublished node.');
+    $this->drupalGet($file_url);
+    $this->assertResponse(200, 'Administrator can download the file attached to the unpublished node.');
+    $this->drupalLogOut();
+    $this->drupalGet("node/$nid");
+    $this->assertResponse(403, 'Anonymous user cannot access the unpublished node.');
+    $this->drupalGet($file_url);
+    $this->assertResponse(403, 'Anonymous user cannot download the file attached to the unpublished node.');
+
+    // Re-publish the node and ensure that the node and file can be accessed by
+    // everyone.
+    $node->status = NODE_PUBLISHED;
+    node_save($node);
+    $this->drupalLogin($this->admin_user);
+    $this->drupalGet("node/$nid");
+    $this->assertResponse(200, 'Administrator can access the published node.');
+    $this->drupalGet($file_url);
+    $this->assertResponse(200, 'Administrator can download the file attached to the published node.');
+    $this->drupalLogOut();
+    $this->drupalGet("node/$nid");
+    $this->assertResponse(200, 'Anonymous user can access the published node.');
+    $this->drupalGet($file_url);
+    $this->assertResponse(200, 'Anonymous user can download the file attached to the published node.');
+
+    // Make the node private via the node access system and test that only
+    // administrators (not anonymous users) can access the node and download
+    // the file.
+    $node->private = TRUE;
+    node_save($node);
+    $this->drupalLogin($this->admin_user);
+    $this->drupalGet("node/$nid");
+    $this->assertResponse(200, 'Administrator can access the private node.');
+    $this->drupalGet($file_url);
+    $this->assertResponse(200, 'Administrator can download the file attached to the private node.');
+    $this->drupalLogOut();
+    $this->drupalGet("node/$nid");
+    $this->assertResponse(403, 'Anonymous user cannot access the private node.');
+    $this->drupalGet($file_url);
+    $this->assertResponse(403, 'Anonymous user cannot download the file attached to the private node.');
   }
 }
 
@@ -1678,3 +1875,60 @@
   }
 
 }
+
+/**
+ * Tests the file_scan_directory() function.
+ */
+class FileScanDirectory extends FileFieldTestCase {
+
+  /**
+   * @var string
+   */
+  protected $path;
+
+  /**
+   * {@inheritdoc}
+   */
+  public static function getInfo() {
+    return array(
+      'name' => 'File ScanDirectory',
+      'description' => 'Tests the file_scan_directory() function.',
+      'group' => 'File',
+    );
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  function setUp() {
+    parent::setUp();
+
+    $this->path = 'modules/file/tests/fixtures/file_scan_ignore';
+  }
+
+  /**
+   * Tests file_scan_directory() obeys 'file_scan_ignore_directories' setting.
+   * If nomask is not passed as argument, it should use the default settings.
+   * If nomask is passed as argument, it should obey this rule.
+   */
+  public function testNoMask() {
+    $files = file_scan_directory($this->path, '/\.txt$/');
+    $this->assertEqual(3, count($files), '3 text files found when not ignoring directories.');
+
+    global $conf;
+    $conf['file_scan_ignore_directories'] = array('frontend_framework');
+
+    $files = file_scan_directory($this->path, '/\.txt$/');
+    $this->assertEqual(1, count($files), '1 text files found when ignoring directories called "frontend_framework".');
+
+    // Make that directories specified by default still work when a new nomask is provided.
+    $files = file_scan_directory($this->path, '/\.txt$/', array('nomask' => '/^c.txt/'));
+    $this->assertEqual(2, count($files), '2 text files found when an "nomask" option is passed in.');
+
+    // Ensure that the directories in file_scan_ignore_directories are escaped using preg_quote.
+    $conf['file_scan_ignore_directories'] = array('frontend.*');
+    $files = file_scan_directory($this->path, '/\.txt$/');
+    $this->assertEqual(3, count($files), '2 text files found when ignoring a directory that is not there.');
+  }
+
+}
diff -Naur drupal-7.51/modules/file/tests/file_module_test.info drupal-7.66/modules/file/tests/file_module_test.info
--- drupal-7.51/modules/file/tests/file_module_test.info	2016-10-05 21:02:54.000000000 +0200
+++ drupal-7.66/modules/file/tests/file_module_test.info	2019-04-17 22:39:36.000000000 +0200
@@ -5,8 +5,7 @@
 core = 7.x
 hidden = TRUE
 
-; Information added by Drupal.org packaging script on 2016-10-05
-version = "7.51"
+; Information added by Drupal.org packaging script on 2019-04-17
+version = "7.66"
 project = "drupal"
-datestamp = "1475694174"
-
+datestamp = "1555533576"
diff -Naur drupal-7.51/modules/file/tests/file_module_test.module drupal-7.66/modules/file/tests/file_module_test.module
--- drupal-7.51/modules/file/tests/file_module_test.module	2016-10-05 20:45:42.000000000 +0200
+++ drupal-7.66/modules/file/tests/file_module_test.module	2019-04-17 22:20:46.000000000 +0200
@@ -67,3 +67,18 @@
   }
   drupal_set_message(t('The file id is %fid.', array('%fid' => $fid)));
 }
+
+/**
+ * Implements hook_file_download().
+ */
+function file_module_test_file_download($uri) {
+  if (variable_get('file_module_test_grant_download_access')) {
+    // Mimic what file_get_content_headers() would do if we had a full $file
+    // object to pass to it.
+    return array(
+      'Content-Type' => mime_header_encode(file_get_mimetype($uri)),
+      'Content-Length' => filesize($uri),
+      'Cache-Control' => 'private',
+    );
+  }
+}
diff -Naur drupal-7.51/modules/filter/filter.info drupal-7.66/modules/filter/filter.info
--- drupal-7.51/modules/filter/filter.info	2016-10-05 21:02:54.000000000 +0200
+++ drupal-7.66/modules/filter/filter.info	2019-04-17 22:39:36.000000000 +0200
@@ -7,8 +7,7 @@
 required = TRUE
 configure = admin/config/content/formats
 
-; Information added by Drupal.org packaging script on 2016-10-05
-version = "7.51"
+; Information added by Drupal.org packaging script on 2019-04-17
+version = "7.66"
 project = "drupal"
-datestamp = "1475694174"
-
+datestamp = "1555533576"
diff -Naur drupal-7.51/modules/filter/filter.module drupal-7.66/modules/filter/filter.module
--- drupal-7.51/modules/filter/filter.module	2016-10-05 20:45:42.000000000 +0200
+++ drupal-7.66/modules/filter/filter.module	2019-04-17 22:20:46.000000000 +0200
@@ -1638,7 +1638,7 @@
   // Replace all HTML coments with a '<!-- [hash] -->' placeholder.
   if ($mode) {
     $content = $match[1];
-    $hash = md5($content);
+    $hash = hash('sha256', $content);
     $comments[$hash] = $content;
     return "<!-- $hash -->";
   }
diff -Naur drupal-7.51/modules/forum/forum.info drupal-7.66/modules/forum/forum.info
--- drupal-7.51/modules/forum/forum.info	2016-10-05 21:02:54.000000000 +0200
+++ drupal-7.66/modules/forum/forum.info	2019-04-17 22:39:36.000000000 +0200
@@ -9,8 +9,7 @@
 configure = admin/structure/forum
 stylesheets[all][] = forum.css
 
-; Information added by Drupal.org packaging script on 2016-10-05
-version = "7.51"
+; Information added by Drupal.org packaging script on 2019-04-17
+version = "7.66"
 project = "drupal"
-datestamp = "1475694174"
-
+datestamp = "1555533576"
diff -Naur drupal-7.51/modules/help/help.info drupal-7.66/modules/help/help.info
--- drupal-7.51/modules/help/help.info	2016-10-05 21:02:54.000000000 +0200
+++ drupal-7.66/modules/help/help.info	2019-04-17 22:39:36.000000000 +0200
@@ -5,8 +5,7 @@
 core = 7.x
 files[] = help.test
 
-; Information added by Drupal.org packaging script on 2016-10-05
-version = "7.51"
+; Information added by Drupal.org packaging script on 2019-04-17
+version = "7.66"
 project = "drupal"
-datestamp = "1475694174"
-
+datestamp = "1555533576"
diff -Naur drupal-7.51/modules/image/image.admin.inc drupal-7.66/modules/image/image.admin.inc
--- drupal-7.51/modules/image/image.admin.inc	2016-10-05 20:45:42.000000000 +0200
+++ drupal-7.66/modules/image/image.admin.inc	2019-04-17 22:20:46.000000000 +0200
@@ -736,7 +736,8 @@
     if (!isset($form[$key]['#access']) || $form[$key]['#access']) {
       $rows[] = array(
         'data' => $row,
-        'class' => !empty($form[$key]['weight']['#access']) || $key == 'new' ? array('draggable') : array(),
+        // Use a strict (===) comparison since $key can be 0.
+        'class' => !empty($form[$key]['weight']['#access']) || $key === 'new' ? array('draggable') : array(),
       );
     }
   }
diff -Naur drupal-7.51/modules/image/image.info drupal-7.66/modules/image/image.info
--- drupal-7.51/modules/image/image.info	2016-10-05 21:02:54.000000000 +0200
+++ drupal-7.66/modules/image/image.info	2019-04-17 22:39:36.000000000 +0200
@@ -7,8 +7,7 @@
 files[] = image.test
 configure = admin/config/media/image-styles
 
-; Information added by Drupal.org packaging script on 2016-10-05
-version = "7.51"
+; Information added by Drupal.org packaging script on 2019-04-17
+version = "7.66"
 project = "drupal"
-datestamp = "1475694174"
-
+datestamp = "1555533576"
diff -Naur drupal-7.51/modules/image/tests/image_module_test.info drupal-7.66/modules/image/tests/image_module_test.info
--- drupal-7.51/modules/image/tests/image_module_test.info	2016-10-05 21:02:54.000000000 +0200
+++ drupal-7.66/modules/image/tests/image_module_test.info	2019-04-17 22:39:36.000000000 +0200
@@ -6,8 +6,7 @@
 files[] = image_module_test.module
 hidden = TRUE
 
-; Information added by Drupal.org packaging script on 2016-10-05
-version = "7.51"
+; Information added by Drupal.org packaging script on 2019-04-17
+version = "7.66"
 project = "drupal"
-datestamp = "1475694174"
-
+datestamp = "1555533576"
diff -Naur drupal-7.51/modules/locale/locale.info drupal-7.66/modules/locale/locale.info
--- drupal-7.51/modules/locale/locale.info	2016-10-05 21:02:54.000000000 +0200
+++ drupal-7.66/modules/locale/locale.info	2019-04-17 22:39:36.000000000 +0200
@@ -6,8 +6,7 @@
 files[] = locale.test
 configure = admin/config/regional/language
 
-; Information added by Drupal.org packaging script on 2016-10-05
-version = "7.51"
+; Information added by Drupal.org packaging script on 2019-04-17
+version = "7.66"
 project = "drupal"
-datestamp = "1475694174"
-
+datestamp = "1555533576"
diff -Naur drupal-7.51/modules/locale/locale.test drupal-7.66/modules/locale/locale.test
--- drupal-7.51/modules/locale/locale.test	2016-10-05 20:45:42.000000000 +0200
+++ drupal-7.66/modules/locale/locale.test	2019-04-17 22:20:46.000000000 +0200
@@ -819,7 +819,7 @@
    *   Additional options to pass to the translation import form.
    */
   function importPoFile($contents, array $options = array()) {
-    $name = tempnam('temporary://', "po_") . '.po';
+    $name = drupal_tempnam('temporary://', "po_") . '.po';
     file_put_contents($name, $contents);
     $options['files[file]'] = $name;
     $this->drupalPost('admin/config/regional/translate/import', $options, t('Import'));
@@ -1113,7 +1113,7 @@
    *   Additional options to pass to the translation import form.
    */
   function importPoFile($contents, array $options = array()) {
-    $name = tempnam('temporary://', "po_") . '.po';
+    $name = drupal_tempnam('temporary://', "po_") . '.po';
     file_put_contents($name, $contents);
     $options['files[file]'] = $name;
     $this->drupalPost('admin/config/regional/translate/import', $options, t('Import'));
@@ -1340,7 +1340,7 @@
   function testExportTranslation() {
     // First import some known translations.
     // This will also automatically enable the 'fr' language.
-    $name = tempnam('temporary://', "po_") . '.po';
+    $name = drupal_tempnam('temporary://', "po_") . '.po';
     file_put_contents($name, $this->getPoFile());
     $this->drupalPost('admin/config/regional/translate/import', array(
       'langcode' => 'fr',
@@ -3188,11 +3188,7 @@
     foreach (language_types_info() as $type => $info) {
       if (isset($info['fixed'])) {
         $negotiation = variable_get("language_negotiation_$type", array());
-        $equal = count($info['fixed']) == count($negotiation);
-        while ($equal && list($id) = each($negotiation)) {
-          list(, $info_id) = each($info['fixed']);
-          $equal = $info_id == $id;
-        }
+        $equal = array_keys($negotiation) === array_values($info['fixed']);
         $this->assertTrue($equal, format_string('language negotiation for %type is properly set up', array('%type' => $type)));
       }
     }
diff -Naur drupal-7.51/modules/locale/tests/locale_test.info drupal-7.66/modules/locale/tests/locale_test.info
--- drupal-7.51/modules/locale/tests/locale_test.info	2016-10-05 21:02:54.000000000 +0200
+++ drupal-7.66/modules/locale/tests/locale_test.info	2019-04-17 22:39:36.000000000 +0200
@@ -5,8 +5,7 @@
 version = VERSION
 hidden = TRUE
 
-; Information added by Drupal.org packaging script on 2016-10-05
-version = "7.51"
+; Information added by Drupal.org packaging script on 2019-04-17
+version = "7.66"
 project = "drupal"
-datestamp = "1475694174"
-
+datestamp = "1555533576"
diff -Naur drupal-7.51/modules/menu/menu.info drupal-7.66/modules/menu/menu.info
--- drupal-7.51/modules/menu/menu.info	2016-10-05 21:02:54.000000000 +0200
+++ drupal-7.66/modules/menu/menu.info	2019-04-17 22:39:36.000000000 +0200
@@ -6,8 +6,7 @@
 files[] = menu.test
 configure = admin/structure/menu
 
-; Information added by Drupal.org packaging script on 2016-10-05
-version = "7.51"
+; Information added by Drupal.org packaging script on 2019-04-17
+version = "7.66"
 project = "drupal"
-datestamp = "1475694174"
-
+datestamp = "1555533576"
diff -Naur drupal-7.51/modules/node/node.info drupal-7.66/modules/node/node.info
--- drupal-7.51/modules/node/node.info	2016-10-05 21:02:54.000000000 +0200
+++ drupal-7.66/modules/node/node.info	2019-04-17 22:39:36.000000000 +0200
@@ -9,8 +9,7 @@
 configure = admin/structure/types
 stylesheets[all][] = node.css
 
-; Information added by Drupal.org packaging script on 2016-10-05
-version = "7.51"
+; Information added by Drupal.org packaging script on 2019-04-17
+version = "7.66"
 project = "drupal"
-datestamp = "1475694174"
-
+datestamp = "1555533576"
diff -Naur drupal-7.51/modules/node/tests/node_access_test.info drupal-7.66/modules/node/tests/node_access_test.info
--- drupal-7.51/modules/node/tests/node_access_test.info	2016-10-05 21:02:54.000000000 +0200
+++ drupal-7.66/modules/node/tests/node_access_test.info	2019-04-17 22:39:36.000000000 +0200
@@ -5,8 +5,7 @@
 core = 7.x
 hidden = TRUE
 
-; Information added by Drupal.org packaging script on 2016-10-05
-version = "7.51"
+; Information added by Drupal.org packaging script on 2019-04-17
+version = "7.66"
 project = "drupal"
-datestamp = "1475694174"
-
+datestamp = "1555533576"
diff -Naur drupal-7.51/modules/node/tests/node_test.info drupal-7.66/modules/node/tests/node_test.info
--- drupal-7.51/modules/node/tests/node_test.info	2016-10-05 21:02:54.000000000 +0200
+++ drupal-7.66/modules/node/tests/node_test.info	2019-04-17 22:39:36.000000000 +0200
@@ -5,8 +5,7 @@
 core = 7.x
 hidden = TRUE
 
-; Information added by Drupal.org packaging script on 2016-10-05
-version = "7.51"
+; Information added by Drupal.org packaging script on 2019-04-17
+version = "7.66"
 project = "drupal"
-datestamp = "1475694174"
-
+datestamp = "1555533576"
diff -Naur drupal-7.51/modules/node/tests/node_test_exception.info drupal-7.66/modules/node/tests/node_test_exception.info
--- drupal-7.51/modules/node/tests/node_test_exception.info	2016-10-05 21:02:54.000000000 +0200
+++ drupal-7.66/modules/node/tests/node_test_exception.info	2019-04-17 22:39:36.000000000 +0200
@@ -5,8 +5,7 @@
 core = 7.x
 hidden = TRUE
 
-; Information added by Drupal.org packaging script on 2016-10-05
-version = "7.51"
+; Information added by Drupal.org packaging script on 2019-04-17
+version = "7.66"
 project = "drupal"
-datestamp = "1475694174"
-
+datestamp = "1555533576"
diff -Naur drupal-7.51/modules/openid/openid.info drupal-7.66/modules/openid/openid.info
--- drupal-7.51/modules/openid/openid.info	2016-10-05 21:02:54.000000000 +0200
+++ drupal-7.66/modules/openid/openid.info	2019-04-17 22:39:36.000000000 +0200
@@ -5,8 +5,7 @@
 core = 7.x
 files[] = openid.test
 
-; Information added by Drupal.org packaging script on 2016-10-05
-version = "7.51"
+; Information added by Drupal.org packaging script on 2019-04-17
+version = "7.66"
 project = "drupal"
-datestamp = "1475694174"
-
+datestamp = "1555533576"
diff -Naur drupal-7.51/modules/openid/tests/openid_test.info drupal-7.66/modules/openid/tests/openid_test.info
--- drupal-7.51/modules/openid/tests/openid_test.info	2016-10-05 21:02:54.000000000 +0200
+++ drupal-7.66/modules/openid/tests/openid_test.info	2019-04-17 22:39:36.000000000 +0200
@@ -6,8 +6,7 @@
 dependencies[] = openid
 hidden = TRUE
 
-; Information added by Drupal.org packaging script on 2016-10-05
-version = "7.51"
+; Information added by Drupal.org packaging script on 2019-04-17
+version = "7.66"
 project = "drupal"
-datestamp = "1475694174"
-
+datestamp = "1555533576"
diff -Naur drupal-7.51/modules/overlay/overlay.info drupal-7.66/modules/overlay/overlay.info
--- drupal-7.51/modules/overlay/overlay.info	2016-10-05 21:02:54.000000000 +0200
+++ drupal-7.66/modules/overlay/overlay.info	2019-04-17 22:39:36.000000000 +0200
@@ -4,8 +4,7 @@
 version = VERSION
 core = 7.x
 
-; Information added by Drupal.org packaging script on 2016-10-05
-version = "7.51"
+; Information added by Drupal.org packaging script on 2019-04-17
+version = "7.66"
 project = "drupal"
-datestamp = "1475694174"
-
+datestamp = "1555533576"
diff -Naur drupal-7.51/modules/path/path.info drupal-7.66/modules/path/path.info
--- drupal-7.51/modules/path/path.info	2016-10-05 21:02:54.000000000 +0200
+++ drupal-7.66/modules/path/path.info	2019-04-17 22:39:36.000000000 +0200
@@ -6,8 +6,7 @@
 files[] = path.test
 configure = admin/config/search/path
 
-; Information added by Drupal.org packaging script on 2016-10-05
-version = "7.51"
+; Information added by Drupal.org packaging script on 2019-04-17
+version = "7.66"
 project = "drupal"
-datestamp = "1475694174"
-
+datestamp = "1555533576"
diff -Naur drupal-7.51/modules/path/path.test drupal-7.66/modules/path/path.test
--- drupal-7.51/modules/path/path.test	2016-10-05 20:45:42.000000000 +0200
+++ drupal-7.66/modules/path/path.test	2019-04-17 22:20:46.000000000 +0200
@@ -21,7 +21,7 @@
     parent::setUp('path');
 
     // Create test user and login.
-    $web_user = $this->drupalCreateUser(array('create page content', 'edit own page content', 'administer url aliases', 'create url aliases'));
+    $web_user = $this->drupalCreateUser(array('create page content', 'edit own page content', 'administer url aliases', 'create url aliases', 'access content overview'));
     $this->drupalLogin($web_user);
   }
 
@@ -160,6 +160,34 @@
     $this->drupalGet($edit['path[alias]']);
     $this->assertNoText($node1->title, 'Alias was successfully deleted.');
     $this->assertResponse(404);
+
+    // Create third test node.
+    $node3 = $this->drupalCreateNode();
+
+    // Create an invalid alias with a leading slash and verify that the slash
+    // is removed when the link is generated. This ensures that URL aliases
+    // cannot be used to inject external URLs.
+    // @todo The user interface should either display an error message or
+    //   automatically trim these invalid aliases, rather than allowing them to
+    //   be silently created, at which point the functional aspects of this
+    //   test will need to be moved elsewhere and switch to using a
+    //   programmatically-created alias instead.
+    $alias = $this->randomName(8);
+    $edit = array('path[alias]' => '/' . $alias);
+    $this->drupalPost('node/' . $node3->nid . '/edit', $edit, t('Save'));
+    $this->drupalGet('admin/content');
+    // This checks the link href before clicking it, rather than using
+    // DrupalWebTestCase::assertUrl() after clicking it, because the test
+    // browser does not always preserve the correct number of slashes in the
+    // URL when it visits internal links; using DrupalWebTestCase::assertUrl()
+    // would actually make the test pass unconditionally on the testbot (or
+    // anywhere else where Drupal is installed in a subdirectory).
+    $link_xpath = $this->xpath('//a[normalize-space(text())=:label]', array(':label' => $node3->title));
+    $link_href = (string) $link_xpath[0]['href'];
+    $link_prefix = base_path() . (variable_get('clean_url', 0) ? '' : '?q=');
+    $this->assertEqual($link_href, $link_prefix . $alias);
+    $this->clickLink($node3->title);
+    $this->assertResponse(404);
   }
 
   /**
diff -Naur drupal-7.51/modules/php/php.info drupal-7.66/modules/php/php.info
--- drupal-7.51/modules/php/php.info	2016-10-05 21:02:54.000000000 +0200
+++ drupal-7.66/modules/php/php.info	2019-04-17 22:39:36.000000000 +0200
@@ -5,8 +5,7 @@
 core = 7.x
 files[] = php.test
 
-; Information added by Drupal.org packaging script on 2016-10-05
-version = "7.51"
+; Information added by Drupal.org packaging script on 2019-04-17
+version = "7.66"
 project = "drupal"
-datestamp = "1475694174"
-
+datestamp = "1555533576"
diff -Naur drupal-7.51/modules/poll/poll.info drupal-7.66/modules/poll/poll.info
--- drupal-7.51/modules/poll/poll.info	2016-10-05 21:02:54.000000000 +0200
+++ drupal-7.66/modules/poll/poll.info	2019-04-17 22:39:36.000000000 +0200
@@ -6,8 +6,7 @@
 files[] = poll.test
 stylesheets[all][] = poll.css
 
-; Information added by Drupal.org packaging script on 2016-10-05
-version = "7.51"
+; Information added by Drupal.org packaging script on 2019-04-17
+version = "7.66"
 project = "drupal"
-datestamp = "1475694174"
-
+datestamp = "1555533576"
diff -Naur drupal-7.51/modules/profile/profile.info drupal-7.66/modules/profile/profile.info
--- drupal-7.51/modules/profile/profile.info	2016-10-05 21:02:54.000000000 +0200
+++ drupal-7.66/modules/profile/profile.info	2019-04-17 22:39:36.000000000 +0200
@@ -11,8 +11,7 @@
 ; See user_system_info_alter().
 hidden = TRUE
 
-; Information added by Drupal.org packaging script on 2016-10-05
-version = "7.51"
+; Information added by Drupal.org packaging script on 2019-04-17
+version = "7.66"
 project = "drupal"
-datestamp = "1475694174"
-
+datestamp = "1555533576"
diff -Naur drupal-7.51/modules/rdf/rdf.info drupal-7.66/modules/rdf/rdf.info
--- drupal-7.51/modules/rdf/rdf.info	2016-10-05 21:02:54.000000000 +0200
+++ drupal-7.66/modules/rdf/rdf.info	2019-04-17 22:39:36.000000000 +0200
@@ -5,8 +5,7 @@
 core = 7.x
 files[] = rdf.test
 
-; Information added by Drupal.org packaging script on 2016-10-05
-version = "7.51"
+; Information added by Drupal.org packaging script on 2019-04-17
+version = "7.66"
 project = "drupal"
-datestamp = "1475694174"
-
+datestamp = "1555533576"
diff -Naur drupal-7.51/modules/rdf/tests/rdf_test.info drupal-7.66/modules/rdf/tests/rdf_test.info
--- drupal-7.51/modules/rdf/tests/rdf_test.info	2016-10-05 21:02:54.000000000 +0200
+++ drupal-7.66/modules/rdf/tests/rdf_test.info	2019-04-17 22:39:36.000000000 +0200
@@ -6,8 +6,7 @@
 hidden = TRUE
 dependencies[] = blog
 
-; Information added by Drupal.org packaging script on 2016-10-05
-version = "7.51"
+; Information added by Drupal.org packaging script on 2019-04-17
+version = "7.66"
 project = "drupal"
-datestamp = "1475694174"
-
+datestamp = "1555533576"
diff -Naur drupal-7.51/modules/search/search.admin.inc drupal-7.66/modules/search/search.admin.inc
--- drupal-7.51/modules/search/search.admin.inc	2016-10-05 20:45:42.000000000 +0200
+++ drupal-7.66/modules/search/search.admin.inc	2019-04-17 22:20:46.000000000 +0200
@@ -125,6 +125,16 @@
     '#options' => $module_options,
     '#description' => t('Choose which search module is the default.')
   );
+  $form['logging'] = array(
+    '#type' => 'fieldset',
+    '#title' => t('Logging')
+  );
+  $form['logging']['search_logging'] = array(
+    '#type' => 'checkbox',
+    '#title' => t('Log searches'),
+    '#default_value' => variable_get('search_logging', 1),
+    '#description' => t('If checked, all searches will be logged. Uncheck to skip logging. Logging may affect performance.'),
+  );
   $form['#validate'][] = 'search_admin_settings_validate';
   $form['#submit'][] = 'search_admin_settings_submit';
 
diff -Naur drupal-7.51/modules/search/search.info drupal-7.66/modules/search/search.info
--- drupal-7.51/modules/search/search.info	2016-10-05 21:02:54.000000000 +0200
+++ drupal-7.66/modules/search/search.info	2019-04-17 22:39:36.000000000 +0200
@@ -8,8 +8,7 @@
 configure = admin/config/search/settings
 stylesheets[all][] = search.css
 
-; Information added by Drupal.org packaging script on 2016-10-05
-version = "7.51"
+; Information added by Drupal.org packaging script on 2019-04-17
+version = "7.66"
 project = "drupal"
-datestamp = "1475694174"
-
+datestamp = "1555533576"
diff -Naur drupal-7.51/modules/search/search.install drupal-7.66/modules/search/search.install
--- drupal-7.51/modules/search/search.install	2016-10-05 20:45:42.000000000 +0200
+++ drupal-7.66/modules/search/search.install	2019-04-17 22:20:46.000000000 +0200
@@ -12,6 +12,7 @@
   variable_del('minimum_word_size');
   variable_del('overlap_cjk');
   variable_del('search_cron_limit');
+  variable_del('search_logging');
 }
 
 /**
diff -Naur drupal-7.51/modules/search/search.pages.inc drupal-7.66/modules/search/search.pages.inc
--- drupal-7.51/modules/search/search.pages.inc	2016-10-05 20:45:42.000000000 +0200
+++ drupal-7.66/modules/search/search.pages.inc	2019-04-17 22:20:46.000000000 +0200
@@ -57,9 +57,10 @@
     }
     // Only search if there are keywords or non-empty conditions.
     if ($keys || !empty($conditions)) {
-      // Log the search keys.
-      watchdog('search', 'Searched %type for %keys.', array('%keys' => $keys, '%type' => $info['title']), WATCHDOG_NOTICE, l(t('results'), 'search/' . $info['path'] . '/' . $keys));
-
+       if (variable_get('search_logging', TRUE)) {
+         // Log the search keys.
+         watchdog('search', 'Searched %type for %keys.', array('%keys' => $keys, '%type' => $info['title']), WATCHDOG_NOTICE, l(t('results'), 'search/' . $info['path'] . '/' . $keys));
+       }
       // Collect the search results.
       $results = search_data($keys, $info['module'], $conditions);
     }
diff -Naur drupal-7.51/modules/search/search.test drupal-7.66/modules/search/search.test
--- drupal-7.51/modules/search/search.test	2016-10-05 20:45:42.000000000 +0200
+++ drupal-7.66/modules/search/search.test	2019-04-17 22:20:46.000000000 +0200
@@ -1453,7 +1453,7 @@
     parent::setUp('search', 'search_extra_type');
 
     // Login as a user that can create and search content.
-    $this->search_user = $this->drupalCreateUser(array('search content', 'administer search', 'administer nodes', 'bypass node access', 'access user profiles', 'administer users', 'administer blocks'));
+    $this->search_user = $this->drupalCreateUser(array('search content', 'administer search', 'administer nodes', 'bypass node access', 'access user profiles', 'administer users', 'administer blocks', 'access site reports'));
     $this->drupalLogin($this->search_user);
 
     // Add a single piece of content and index it.
@@ -1502,6 +1502,19 @@
     );
     $this->drupalPost('admin/config/search/settings', $edit, t('Save configuration'));
     $this->assertNoText(t('The configuration options have been saved.'), 'Form does not save with an invalid word length.');
+
+    // Test logging setting. It should be on by default.
+    $text = $this->randomName(5);
+    $this->drupalPost('search/node', array('keys' => $text), t('Search'));
+    $this->drupalGet('admin/reports/dblog');
+    $this->assertLink('Searched Content for ' . $text . '.', 0, 'Search was logged');
+
+    // Turn off logging.
+    variable_set('search_logging', FALSE);
+    $text = $this->randomName(5);
+    $this->drupalPost('search/node', array('keys' => $text), t('Search'));
+    $this->drupalGet('admin/reports/dblog');
+    $this->assertNoLink('Searched Content for ' . $text . '.', 'Search was not logged');
   }
 
   /**
diff -Naur drupal-7.51/modules/search/tests/search_embedded_form.info drupal-7.66/modules/search/tests/search_embedded_form.info
--- drupal-7.51/modules/search/tests/search_embedded_form.info	2016-10-05 21:02:54.000000000 +0200
+++ drupal-7.66/modules/search/tests/search_embedded_form.info	2019-04-17 22:39:36.000000000 +0200
@@ -5,8 +5,7 @@
 core = 7.x
 hidden = TRUE
 
-; Information added by Drupal.org packaging script on 2016-10-05
-version = "7.51"
+; Information added by Drupal.org packaging script on 2019-04-17
+version = "7.66"
 project = "drupal"
-datestamp = "1475694174"
-
+datestamp = "1555533576"
diff -Naur drupal-7.51/modules/search/tests/search_extra_type.info drupal-7.66/modules/search/tests/search_extra_type.info
--- drupal-7.51/modules/search/tests/search_extra_type.info	2016-10-05 21:02:54.000000000 +0200
+++ drupal-7.66/modules/search/tests/search_extra_type.info	2019-04-17 22:39:36.000000000 +0200
@@ -5,8 +5,7 @@
 core = 7.x
 hidden = TRUE
 
-; Information added by Drupal.org packaging script on 2016-10-05
-version = "7.51"
+; Information added by Drupal.org packaging script on 2019-04-17
+version = "7.66"
 project = "drupal"
-datestamp = "1475694174"
-
+datestamp = "1555533576"
diff -Naur drupal-7.51/modules/search/tests/search_node_tags.info drupal-7.66/modules/search/tests/search_node_tags.info
--- drupal-7.51/modules/search/tests/search_node_tags.info	2016-10-05 21:02:54.000000000 +0200
+++ drupal-7.66/modules/search/tests/search_node_tags.info	2019-04-17 22:39:36.000000000 +0200
@@ -5,8 +5,7 @@
 core = 7.x
 hidden = TRUE
 
-; Information added by Drupal.org packaging script on 2016-10-05
-version = "7.51"
+; Information added by Drupal.org packaging script on 2019-04-17
+version = "7.66"
 project = "drupal"
-datestamp = "1475694174"
-
+datestamp = "1555533576"
diff -Naur drupal-7.51/modules/shortcut/shortcut.info drupal-7.66/modules/shortcut/shortcut.info
--- drupal-7.51/modules/shortcut/shortcut.info	2016-10-05 21:02:54.000000000 +0200
+++ drupal-7.66/modules/shortcut/shortcut.info	2019-04-17 22:39:36.000000000 +0200
@@ -6,8 +6,7 @@
 files[] = shortcut.test
 configure = admin/config/user-interface/shortcut
 
-; Information added by Drupal.org packaging script on 2016-10-05
-version = "7.51"
+; Information added by Drupal.org packaging script on 2019-04-17
+version = "7.66"
 project = "drupal"
-datestamp = "1475694174"
-
+datestamp = "1555533576"
diff -Naur drupal-7.51/modules/simpletest/drupal_web_test_case.php drupal-7.66/modules/simpletest/drupal_web_test_case.php
--- drupal-7.51/modules/simpletest/drupal_web_test_case.php	2016-10-05 20:45:42.000000000 +0200
+++ drupal-7.66/modules/simpletest/drupal_web_test_case.php	2019-04-17 22:20:46.000000000 +0200
@@ -40,6 +40,13 @@
   protected $originalFileDirectory = NULL;
 
   /**
+   * URL to the verbose output file directory.
+   *
+   * @var string
+   */
+  protected $verboseDirectoryUrl;
+
+  /**
    * Time limit for the test.
    */
   protected $timeLimit = 500;
@@ -461,8 +468,11 @@
   protected function verbose($message) {
     if ($id = simpletest_verbose($message)) {
       $class_safe = str_replace('\\', '_', get_class($this));
-      $url = file_create_url($this->originalFileDirectory . '/simpletest/verbose/' . $class_safe . '-' . $id . '.html');
-      $this->error(l(t('Verbose message'), $url, array('attributes' => array('target' => '_blank'))), 'User notice');
+      $url = $this->verboseDirectoryUrl . '/' . $class_safe . '-' . $id . '.html';
+      // Not using l() to avoid invoking the theme system, so that unit tests
+      // can use verbose() as well.
+      $link = '<a href="' . $url . '" target="_blank">' . t('Verbose message') . '</a>';
+      $this->error($link, 'User notice');
     }
   }
 
@@ -719,10 +729,17 @@
    * method.
    */
   protected function setUp() {
-    global $conf;
+    global $conf, $language;
 
     // Store necessary current values before switching to the test environment.
     $this->originalFileDirectory = variable_get('file_public_path', conf_path() . '/files');
+    $this->verboseDirectoryUrl = file_create_url($this->originalFileDirectory . '/simpletest/verbose');
+
+    // Set up English language.
+    $this->originalLanguage = $language;
+    $this->originalLanguageDefault = variable_get('language_default');
+    unset($conf['language_default']);
+    $language = language_default();
 
     // Reset all statics so that test is performed with a clean environment.
     drupal_static_reset();
@@ -764,7 +781,7 @@
   }
 
   protected function tearDown() {
-    global $conf;
+    global $conf, $language;
 
     // Get back to the original connection.
     Database::removeConnection('default');
@@ -775,6 +792,12 @@
     if (isset($this->originalModuleList)) {
       module_list(TRUE, FALSE, FALSE, $this->originalModuleList);
     }
+
+    // Reset language.
+    $language = $this->originalLanguage;
+    if ($this->originalLanguageDefault) {
+      $GLOBALS['conf']['language_default'] = $this->originalLanguageDefault;
+    }
   }
 }
 
@@ -1374,12 +1397,14 @@
    * @see DrupalWebTestCase::tearDown()
    */
   protected function prepareEnvironment() {
-    global $user, $language, $conf;
+    global $user, $language, $language_url, $conf;
 
     // Store necessary current values before switching to prefixed database.
     $this->originalLanguage = $language;
+    $this->originalLanguageUrl = $language_url;
     $this->originalLanguageDefault = variable_get('language_default');
     $this->originalFileDirectory = variable_get('file_public_path', conf_path() . '/files');
+    $this->verboseDirectoryUrl = file_create_url($this->originalFileDirectory . '/simpletest/verbose');
     $this->originalProfile = drupal_get_profile();
     $this->originalCleanUrl = variable_get('clean_url', 0);
     $this->originalUser = $user;
@@ -1387,7 +1412,7 @@
     // Set to English to prevent exceptions from utf8_truncate() from t()
     // during install if the current language is not 'en'.
     // The following array/object conversion is copied from language_default().
-    $language = (object) array('language' => 'en', 'name' => 'English', 'native' => 'English', 'direction' => 0, 'enabled' => 1, 'plurals' => 0, 'formula' => '', 'domain' => '', 'prefix' => '', 'weight' => 0, 'javascript' => '');
+    $language_url = $language = (object) array('language' => 'en', 'name' => 'English', 'native' => 'English', 'direction' => 0, 'enabled' => 1, 'plurals' => 0, 'formula' => '', 'domain' => '', 'prefix' => '', 'weight' => 0, 'javascript' => '');
 
     // Save and clean the shutdown callbacks array because it is static cached
     // and will be changed by the test run. Otherwise it will contain callbacks
@@ -1445,7 +1470,7 @@
    * @see DrupalWebTestCase::prepareEnvironment()
    */
   protected function setUp() {
-    global $user, $language, $conf;
+    global $user, $language, $language_url, $conf;
 
     // Create the database prefix for this test.
     $this->prepareDatabasePrefix();
@@ -1542,7 +1567,7 @@
 
     // Set up English language.
     unset($conf['language_default']);
-    $language = language_default();
+    $language_url = $language = language_default();
 
     // Use the test mail class instead of the default mail handler class.
     variable_set('mail_system', array('default-system' => 'TestingMailSystem'));
@@ -1636,7 +1661,7 @@
    * and reset the database prefix.
    */
   protected function tearDown() {
-    global $user, $language;
+    global $user, $language, $language_url;
 
     // In case a fatal error occurred that was not in the test process read the
     // log to pick up any fatal errors.
@@ -1701,6 +1726,7 @@
 
     // Reset language.
     $language = $this->originalLanguage;
+    $language_url = $this->originalLanguageUrl;
     if ($this->originalLanguageDefault) {
       $GLOBALS['conf']['language_default'] = $this->originalLanguageDefault;
     }
@@ -2986,7 +3012,7 @@
     if (!$message) {
       $message = t('Raw "@raw" found', array('@raw' => $raw));
     }
-    return $this->assert(strpos($this->drupalGetContent(), $raw) !== FALSE, $message, $group);
+    return $this->assert(strpos($this->drupalGetContent(), (string) $raw) !== FALSE, $message, $group);
   }
 
   /**
@@ -3006,7 +3032,7 @@
     if (!$message) {
       $message = t('Raw "@raw" not found', array('@raw' => $raw));
     }
-    return $this->assert(strpos($this->drupalGetContent(), $raw) === FALSE, $message, $group);
+    return $this->assert(strpos($this->drupalGetContent(), (string) $raw) === FALSE, $message, $group);
   }
 
   /**
diff -Naur drupal-7.51/modules/simpletest/files/phar-1.phar drupal-7.66/modules/simpletest/files/phar-1.phar
--- drupal-7.51/modules/simpletest/files/phar-1.phar	1970-01-01 01:00:00.000000000 +0100
+++ drupal-7.66/modules/simpletest/files/phar-1.phar	2019-04-17 22:20:46.000000000 +0200
@@ -0,0 +1,301 @@
+<?php
+
+$web = 'index.php';
+
+if (in_array('phar', stream_get_wrappers()) && class_exists('Phar', 0)) {
+Phar::interceptFileFuncs();
+set_include_path('phar://' . __FILE__ . PATH_SEPARATOR . get_include_path());
+Phar::webPhar(null, $web);
+include 'phar://' . __FILE__ . '/' . Extract_Phar::START;
+return;
+}
+
+if (@(isset($_SERVER['REQUEST_URI']) && isset($_SERVER['REQUEST_METHOD']) && ($_SERVER['REQUEST_METHOD'] == 'GET' || $_SERVER['REQUEST_METHOD'] == 'POST'))) {
+Extract_Phar::go(true);
+$mimes = array(
+'phps' => 2,
+'c' => 'text/plain',
+'cc' => 'text/plain',
+'cpp' => 'text/plain',
+'c++' => 'text/plain',
+'dtd' => 'text/plain',
+'h' => 'text/plain',
+'log' => 'text/plain',
+'rng' => 'text/plain',
+'txt' => 'text/plain',
+'xsd' => 'text/plain',
+'php' => 1,
+'inc' => 1,
+'avi' => 'video/avi',
+'bmp' => 'image/bmp',
+'css' => 'text/css',
+'gif' => 'image/gif',
+'htm' => 'text/html',
+'html' => 'text/html',
+'htmls' => 'text/html',
+'ico' => 'image/x-ico',
+'jpe' => 'image/jpeg',
+'jpg' => 'image/jpeg',
+'jpeg' => 'image/jpeg',
+'js' => 'application/x-javascript',
+'midi' => 'audio/midi',
+'mid' => 'audio/midi',
+'mod' => 'audio/mod',
+'mov' => 'movie/quicktime',
+'mp3' => 'audio/mp3',
+'mpg' => 'video/mpeg',
+'mpeg' => 'video/mpeg',
+'pdf' => 'application/pdf',
+'png' => 'image/png',
+'swf' => 'application/shockwave-flash',
+'tif' => 'image/tiff',
+'tiff' => 'image/tiff',
+'wav' => 'audio/wav',
+'xbm' => 'image/xbm',
+'xml' => 'text/xml',
+);
+
+header("Cache-Control: no-cache, must-revalidate");
+header("Pragma: no-cache");
+
+$basename = basename(__FILE__);
+if (!strpos($_SERVER['REQUEST_URI'], $basename)) {
+chdir(Extract_Phar::$temp);
+include $web;
+return;
+}
+$pt = substr($_SERVER['REQUEST_URI'], strpos($_SERVER['REQUEST_URI'], $basename) + strlen($basename));
+if (!$pt || $pt == '/') {
+$pt = $web;
+header('HTTP/1.1 301 Moved Permanently');
+header('Location: ' . $_SERVER['REQUEST_URI'] . '/' . $pt);
+exit;
+}
+$a = realpath(Extract_Phar::$temp . DIRECTORY_SEPARATOR . $pt);
+if (!$a || strlen(dirname($a)) < strlen(Extract_Phar::$temp)) {
+header('HTTP/1.0 404 Not Found');
+echo "<html>\n <head>\n  <title>File Not Found<title>\n </head>\n <body>\n  <h1>404 - File Not Found</h1>\n </body>\n</html>";
+exit;
+}
+$b = pathinfo($a);
+if (!isset($b['extension'])) {
+header('Content-Type: text/plain');
+header('Content-Length: ' . filesize($a));
+readfile($a);
+exit;
+}
+if (isset($mimes[$b['extension']])) {
+if ($mimes[$b['extension']] === 1) {
+include $a;
+exit;
+}
+if ($mimes[$b['extension']] === 2) {
+highlight_file($a);
+exit;
+}
+header('Content-Type: ' .$mimes[$b['extension']]);
+header('Content-Length: ' . filesize($a));
+readfile($a);
+exit;
+}
+}
+
+class Extract_Phar
+{
+static $temp;
+static $origdir;
+const GZ = 0x1000;
+const BZ2 = 0x2000;
+const MASK = 0x3000;
+const START = 'index.php';
+const LEN = 6643;
+
+static function go($return = false)
+{
+$fp = fopen(__FILE__, 'rb');
+fseek($fp, self::LEN);
+$L = unpack('V', $a = fread($fp, 4));
+$m = '';
+
+do {
+$read = 8192;
+if ($L[1] - strlen($m) < 8192) {
+$read = $L[1] - strlen($m);
+}
+$last = fread($fp, $read);
+$m .= $last;
+} while (strlen($last) && strlen($m) < $L[1]);
+
+if (strlen($m) < $L[1]) {
+die('ERROR: manifest length read was "' .
+strlen($m) .'" should be "' .
+$L[1] . '"');
+}
+
+$info = self::_unpack($m);
+$f = $info['c'];
+
+if ($f & self::GZ) {
+if (!function_exists('gzinflate')) {
+die('Error: zlib extension is not enabled -' .
+' gzinflate() function needed for zlib-compressed .phars');
+}
+}
+
+if ($f & self::BZ2) {
+if (!function_exists('bzdecompress')) {
+die('Error: bzip2 extension is not enabled -' .
+' bzdecompress() function needed for bz2-compressed .phars');
+}
+}
+
+$temp = self::tmpdir();
+
+if (!$temp || !is_writable($temp)) {
+$sessionpath = session_save_path();
+if (strpos ($sessionpath, ";") !== false)
+$sessionpath = substr ($sessionpath, strpos ($sessionpath, ";")+1);
+if (!file_exists($sessionpath) || !is_dir($sessionpath)) {
+die('Could not locate temporary directory to extract phar');
+}
+$temp = $sessionpath;
+}
+
+$temp .= '/pharextract/'.basename(__FILE__, '.phar');
+self::$temp = $temp;
+self::$origdir = getcwd();
+@mkdir($temp, 0777, true);
+$temp = realpath($temp);
+
+if (!file_exists($temp . DIRECTORY_SEPARATOR . md5_file(__FILE__))) {
+self::_removeTmpFiles($temp, getcwd());
+@mkdir($temp, 0777, true);
+@file_put_contents($temp . '/' . md5_file(__FILE__), '');
+
+foreach ($info['m'] as $path => $file) {
+$a = !file_exists(dirname($temp . '/' . $path));
+@mkdir(dirname($temp . '/' . $path), 0777, true);
+clearstatcache();
+
+if ($path[strlen($path) - 1] == '/') {
+@mkdir($temp . '/' . $path, 0777);
+} else {
+file_put_contents($temp . '/' . $path, self::extractFile($path, $file, $fp));
+@chmod($temp . '/' . $path, 0666);
+}
+}
+}
+
+chdir($temp);
+
+if (!$return) {
+include self::START;
+}
+}
+
+static function tmpdir()
+{
+if (strpos(PHP_OS, 'WIN') !== false) {
+if ($var = getenv('TMP') ? getenv('TMP') : getenv('TEMP')) {
+return $var;
+}
+if (is_dir('/temp') || mkdir('/temp')) {
+return realpath('/temp');
+}
+return false;
+}
+if ($var = getenv('TMPDIR')) {
+return $var;
+}
+return realpath('/tmp');
+}
+
+static function _unpack($m)
+{
+$info = unpack('V', substr($m, 0, 4));
+ $l = unpack('V', substr($m, 10, 4));
+$m = substr($m, 14 + $l[1]);
+$s = unpack('V', substr($m, 0, 4));
+$o = 0;
+$start = 4 + $s[1];
+$ret['c'] = 0;
+
+for ($i = 0; $i < $info[1]; $i++) {
+ $len = unpack('V', substr($m, $start, 4));
+$start += 4;
+ $savepath = substr($m, $start, $len[1]);
+$start += $len[1];
+   $ret['m'][$savepath] = array_values(unpack('Va/Vb/Vc/Vd/Ve/Vf', substr($m, $start, 24)));
+$ret['m'][$savepath][3] = sprintf('%u', $ret['m'][$savepath][3]
+& 0xffffffff);
+$ret['m'][$savepath][7] = $o;
+$o += $ret['m'][$savepath][2];
+$start += 24 + $ret['m'][$savepath][5];
+$ret['c'] |= $ret['m'][$savepath][4] & self::MASK;
+}
+return $ret;
+}
+
+static function extractFile($path, $entry, $fp)
+{
+$data = '';
+$c = $entry[2];
+
+while ($c) {
+if ($c < 8192) {
+$data .= @fread($fp, $c);
+$c = 0;
+} else {
+$c -= 8192;
+$data .= @fread($fp, 8192);
+}
+}
+
+if ($entry[4] & self::GZ) {
+$data = gzinflate($data);
+} elseif ($entry[4] & self::BZ2) {
+$data = bzdecompress($data);
+}
+
+if (strlen($data) != $entry[0]) {
+die("Invalid internal .phar file (size error " . strlen($data) . " != " .
+$stat[7] . ")");
+}
+
+if ($entry[3] != sprintf("%u", crc32($data) & 0xffffffff)) {
+die("Invalid internal .phar file (checksum error)");
+}
+
+return $data;
+}
+
+static function _removeTmpFiles($temp, $origdir)
+{
+chdir($temp);
+
+foreach (glob('*') as $f) {
+if (file_exists($f)) {
+is_dir($f) ? @rmdir($f) : @unlink($f);
+if (file_exists($f) && is_dir($f)) {
+self::_removeTmpFiles($f, getcwd());
+}
+}
+}
+
+@rmdir($temp);
+clearstatcache();
+chdir($origdir);
+}
+}
+
+Extract_Phar::go();
+__HALT_COMPILER(); ?>7	index.php�8!�[�u��<?php
+/**
+ * @file
+ * This test file is used to test Drupal's phar stream wrapper functionality.
+ *
+ * @see \Drupal\KernelTests\Core\File\PharWrapperTest
+ */
+
+echo 'Hello, world!';
+�1qV�5�['�y�	R�C�AGBMB
\ No newline at end of file
diff -Naur drupal-7.51/modules/simpletest/simpletest.info drupal-7.66/modules/simpletest/simpletest.info
--- drupal-7.51/modules/simpletest/simpletest.info	2016-10-05 21:02:54.000000000 +0200
+++ drupal-7.66/modules/simpletest/simpletest.info	2019-04-17 22:39:36.000000000 +0200
@@ -57,8 +57,7 @@
 files[] = tests/upgrade/update.field.test
 files[] = tests/upgrade/update.user.test
 
-; Information added by Drupal.org packaging script on 2016-10-05
-version = "7.51"
+; Information added by Drupal.org packaging script on 2019-04-17
+version = "7.66"
 project = "drupal"
-datestamp = "1475694174"
-
+datestamp = "1555533576"
diff -Naur drupal-7.51/modules/simpletest/tests/actions_loop_test.info drupal-7.66/modules/simpletest/tests/actions_loop_test.info
--- drupal-7.51/modules/simpletest/tests/actions_loop_test.info	2016-10-05 21:02:54.000000000 +0200
+++ drupal-7.66/modules/simpletest/tests/actions_loop_test.info	2019-04-17 22:39:36.000000000 +0200
@@ -5,8 +5,7 @@
 core = 7.x
 hidden = TRUE
 
-; Information added by Drupal.org packaging script on 2016-10-05
-version = "7.51"
+; Information added by Drupal.org packaging script on 2019-04-17
+version = "7.66"
 project = "drupal"
-datestamp = "1475694174"
-
+datestamp = "1555533576"
diff -Naur drupal-7.51/modules/simpletest/tests/ajax_forms_test.info drupal-7.66/modules/simpletest/tests/ajax_forms_test.info
--- drupal-7.51/modules/simpletest/tests/ajax_forms_test.info	2016-10-05 21:02:54.000000000 +0200
+++ drupal-7.66/modules/simpletest/tests/ajax_forms_test.info	2019-04-17 22:39:36.000000000 +0200
@@ -5,8 +5,7 @@
 version = VERSION
 hidden = TRUE
 
-; Information added by Drupal.org packaging script on 2016-10-05
-version = "7.51"
+; Information added by Drupal.org packaging script on 2019-04-17
+version = "7.66"
 project = "drupal"
-datestamp = "1475694174"
-
+datestamp = "1555533576"
diff -Naur drupal-7.51/modules/simpletest/tests/ajax_test.info drupal-7.66/modules/simpletest/tests/ajax_test.info
--- drupal-7.51/modules/simpletest/tests/ajax_test.info	2016-10-05 21:02:54.000000000 +0200
+++ drupal-7.66/modules/simpletest/tests/ajax_test.info	2019-04-17 22:39:36.000000000 +0200
@@ -5,8 +5,7 @@
 core = 7.x
 hidden = TRUE
 
-; Information added by Drupal.org packaging script on 2016-10-05
-version = "7.51"
+; Information added by Drupal.org packaging script on 2019-04-17
+version = "7.66"
 project = "drupal"
-datestamp = "1475694174"
-
+datestamp = "1555533576"
diff -Naur drupal-7.51/modules/simpletest/tests/batch_test.info drupal-7.66/modules/simpletest/tests/batch_test.info
--- drupal-7.51/modules/simpletest/tests/batch_test.info	2016-10-05 21:02:54.000000000 +0200
+++ drupal-7.66/modules/simpletest/tests/batch_test.info	2019-04-17 22:39:36.000000000 +0200
@@ -5,8 +5,7 @@
 core = 7.x
 hidden = TRUE
 
-; Information added by Drupal.org packaging script on 2016-10-05
-version = "7.51"
+; Information added by Drupal.org packaging script on 2019-04-17
+version = "7.66"
 project = "drupal"
-datestamp = "1475694174"
-
+datestamp = "1555533576"
diff -Naur drupal-7.51/modules/simpletest/tests/boot_test_1.info drupal-7.66/modules/simpletest/tests/boot_test_1.info
--- drupal-7.51/modules/simpletest/tests/boot_test_1.info	2016-10-05 21:02:54.000000000 +0200
+++ drupal-7.66/modules/simpletest/tests/boot_test_1.info	2019-04-17 22:39:36.000000000 +0200
@@ -5,8 +5,7 @@
 version = VERSION
 hidden = TRUE
 
-; Information added by Drupal.org packaging script on 2016-10-05
-version = "7.51"
+; Information added by Drupal.org packaging script on 2019-04-17
+version = "7.66"
 project = "drupal"
-datestamp = "1475694174"
-
+datestamp = "1555533576"
diff -Naur drupal-7.51/modules/simpletest/tests/boot_test_2.info drupal-7.66/modules/simpletest/tests/boot_test_2.info
--- drupal-7.51/modules/simpletest/tests/boot_test_2.info	2016-10-05 21:02:54.000000000 +0200
+++ drupal-7.66/modules/simpletest/tests/boot_test_2.info	2019-04-17 22:39:36.000000000 +0200
@@ -5,8 +5,7 @@
 version = VERSION
 hidden = TRUE
 
-; Information added by Drupal.org packaging script on 2016-10-05
-version = "7.51"
+; Information added by Drupal.org packaging script on 2019-04-17
+version = "7.66"
 project = "drupal"
-datestamp = "1475694174"
-
+datestamp = "1555533576"
diff -Naur drupal-7.51/modules/simpletest/tests/bootstrap.test drupal-7.66/modules/simpletest/tests/bootstrap.test
--- drupal-7.51/modules/simpletest/tests/bootstrap.test	2016-10-05 20:45:42.000000000 +0200
+++ drupal-7.66/modules/simpletest/tests/bootstrap.test	2019-04-17 22:20:46.000000000 +0200
@@ -729,16 +729,12 @@
    * Tests that the drupal_check_memory_limit() function works as expected.
    */
   function testCheckMemoryLimit() {
-    $memory_limit = ini_get('memory_limit');
     // Test that a very reasonable amount of memory is available.
     $this->assertTrue(drupal_check_memory_limit('30MB'), '30MB of memory tested available.');
 
-    // Get the available memory and multiply it by two to make it unreasonably
-    // high.
-    $twice_avail_memory = ($memory_limit * 2) . 'MB';
-
+    // Test an unlimited memory limit.
     // The function should always return true if the memory limit is set to -1.
-    $this->assertTrue(drupal_check_memory_limit($twice_avail_memory, -1), 'drupal_check_memory_limit() returns TRUE when a limit of -1 (none) is supplied');
+    $this->assertTrue(drupal_check_memory_limit('9999999999YB', -1), 'drupal_check_memory_limit() returns TRUE when a limit of -1 (none) is supplied');
 
     // Test that even though we have 30MB of memory available - the function
     // returns FALSE when given an upper limit for how much memory can be used.
diff -Naur drupal-7.51/modules/simpletest/tests/common.test drupal-7.66/modules/simpletest/tests/common.test
--- drupal-7.51/modules/simpletest/tests/common.test	2016-10-05 20:45:42.000000000 +0200
+++ drupal-7.66/modules/simpletest/tests/common.test	2019-04-17 22:20:46.000000000 +0200
@@ -76,7 +76,7 @@
 class CommonURLUnitTest extends DrupalWebTestCase {
   public static function getInfo() {
     return array(
-      'name' => 'URL generation tests',
+      'name' => 'URL generation unit tests',
       'description' => 'Confirm that url(), drupal_get_query_parameters(), drupal_http_build_query(), and l() work correctly with various input.',
       'group' => 'System',
     );
@@ -169,7 +169,7 @@
     $this->assertEqual(drupal_http_build_query(array('a' => ' &#//+%20@۞')), 'a=%20%26%23//%2B%2520%40%DB%9E', 'Value was properly encoded.');
     $this->assertEqual(drupal_http_build_query(array(' &#//+%20@۞' => 'a')), '%20%26%23%2F%2F%2B%2520%40%DB%9E=a', 'Key was properly encoded.');
     $this->assertEqual(drupal_http_build_query(array('a' => '1', 'b' => '2', 'c' => '3')), 'a=1&b=2&c=3', 'Multiple values were properly concatenated.');
-    $this->assertEqual(drupal_http_build_query(array('a' => array('b' => '2', 'c' => '3'), 'd' => 'foo')), 'a[b]=2&a[c]=3&d=foo', 'Nested array was properly encoded.');
+    $this->assertEqual(drupal_http_build_query(array('a' => array('b' => '2', 'c' => '3'), 'd' => 'foo')), 'a%5Bb%5D=2&a%5Bc%5D=3&d=foo', 'Nested array was properly encoded.');
   }
 
   /**
@@ -373,6 +373,38 @@
 }
 
 /**
+ * Web tests for URL generation functions.
+ */
+class CommonURLWebTest extends DrupalWebTestCase {
+  public static function getInfo() {
+    return array(
+      'name' => 'URL generation web tests',
+      'description' => 'Confirm that URL-generating functions work correctly on specific site paths.',
+      'group' => 'System',
+    );
+  }
+
+  function setUp() {
+    parent::setUp('common_test');
+  }
+
+  /**
+   * Tests the url() function on internal paths which mimic external URLs.
+   */
+  function testInternalPathMimicsExternal() {
+    // Ensure that calling url(current_path()) on "/http://example.com" (an
+    // internal path which mimics an external URL) always links to the internal
+    // path, not the external URL. This helps protect against external URL link
+    // injection vulnerabilities.
+    variable_set('common_test_link_to_current_path', TRUE);
+    $this->drupalGet('/http://example.com');
+    $this->clickLink('link which should point to the current path');
+    $this->assertUrl('/http://example.com');
+    $this->assertText('link which should point to the current path');
+  }
+}
+
+/**
  * Tests url_is_external().
  */
 class UrlIsExternalUnitTest extends DrupalUnitTestCase {
diff -Naur drupal-7.51/modules/simpletest/tests/common_test.info drupal-7.66/modules/simpletest/tests/common_test.info
--- drupal-7.51/modules/simpletest/tests/common_test.info	2016-10-05 21:02:54.000000000 +0200
+++ drupal-7.66/modules/simpletest/tests/common_test.info	2019-04-17 22:39:36.000000000 +0200
@@ -7,8 +7,7 @@
 stylesheets[print][] = common_test.print.css
 hidden = TRUE
 
-; Information added by Drupal.org packaging script on 2016-10-05
-version = "7.51"
+; Information added by Drupal.org packaging script on 2019-04-17
+version = "7.66"
 project = "drupal"
-datestamp = "1475694174"
-
+datestamp = "1555533576"
diff -Naur drupal-7.51/modules/simpletest/tests/common_test.module drupal-7.66/modules/simpletest/tests/common_test.module
--- drupal-7.51/modules/simpletest/tests/common_test.module	2016-10-05 20:45:42.000000000 +0200
+++ drupal-7.66/modules/simpletest/tests/common_test.module	2019-04-17 22:20:46.000000000 +0200
@@ -99,6 +99,9 @@
   if (variable_get('common_test_redirect_current_path', FALSE)) {
     drupal_goto(current_path());
   }
+  if (variable_get('common_test_link_to_current_path', FALSE)) {
+    drupal_set_message(l('link which should point to the current path', current_path()));
+  }
 }
 
 /**
diff -Naur drupal-7.51/modules/simpletest/tests/common_test_cron_helper.info drupal-7.66/modules/simpletest/tests/common_test_cron_helper.info
--- drupal-7.51/modules/simpletest/tests/common_test_cron_helper.info	2016-10-05 21:02:54.000000000 +0200
+++ drupal-7.66/modules/simpletest/tests/common_test_cron_helper.info	2019-04-17 22:39:36.000000000 +0200
@@ -5,8 +5,7 @@
 core = 7.x
 hidden = TRUE
 
-; Information added by Drupal.org packaging script on 2016-10-05
-version = "7.51"
+; Information added by Drupal.org packaging script on 2019-04-17
+version = "7.66"
 project = "drupal"
-datestamp = "1475694174"
-
+datestamp = "1555533576"
diff -Naur drupal-7.51/modules/simpletest/tests/database_test.info drupal-7.66/modules/simpletest/tests/database_test.info
--- drupal-7.51/modules/simpletest/tests/database_test.info	2016-10-05 21:02:54.000000000 +0200
+++ drupal-7.66/modules/simpletest/tests/database_test.info	2019-04-17 22:39:36.000000000 +0200
@@ -5,8 +5,7 @@
 version = VERSION
 hidden = TRUE
 
-; Information added by Drupal.org packaging script on 2016-10-05
-version = "7.51"
+; Information added by Drupal.org packaging script on 2019-04-17
+version = "7.66"
 project = "drupal"
-datestamp = "1475694174"
-
+datestamp = "1555533576"
diff -Naur drupal-7.51/modules/simpletest/tests/drupal_autoload_test/drupal_autoload_test.info drupal-7.66/modules/simpletest/tests/drupal_autoload_test/drupal_autoload_test.info
--- drupal-7.51/modules/simpletest/tests/drupal_autoload_test/drupal_autoload_test.info	2016-10-05 21:02:54.000000000 +0200
+++ drupal-7.66/modules/simpletest/tests/drupal_autoload_test/drupal_autoload_test.info	2019-04-17 22:39:36.000000000 +0200
@@ -7,8 +7,7 @@
 core = 7.x
 hidden = TRUE
 
-; Information added by Drupal.org packaging script on 2016-10-05
-version = "7.51"
+; Information added by Drupal.org packaging script on 2019-04-17
+version = "7.66"
 project = "drupal"
-datestamp = "1475694174"
-
+datestamp = "1555533576"
diff -Naur drupal-7.51/modules/simpletest/tests/drupal_system_listing_compatible_test/drupal_system_listing_compatible_test.info drupal-7.66/modules/simpletest/tests/drupal_system_listing_compatible_test/drupal_system_listing_compatible_test.info
--- drupal-7.51/modules/simpletest/tests/drupal_system_listing_compatible_test/drupal_system_listing_compatible_test.info	2016-10-05 21:02:54.000000000 +0200
+++ drupal-7.66/modules/simpletest/tests/drupal_system_listing_compatible_test/drupal_system_listing_compatible_test.info	2019-04-17 22:39:36.000000000 +0200
@@ -5,8 +5,7 @@
 core = 7.x
 hidden = TRUE
 
-; Information added by Drupal.org packaging script on 2016-10-05
-version = "7.51"
+; Information added by Drupal.org packaging script on 2019-04-17
+version = "7.66"
 project = "drupal"
-datestamp = "1475694174"
-
+datestamp = "1555533576"
diff -Naur drupal-7.51/modules/simpletest/tests/drupal_system_listing_incompatible_test/drupal_system_listing_incompatible_test.info drupal-7.66/modules/simpletest/tests/drupal_system_listing_incompatible_test/drupal_system_listing_incompatible_test.info
--- drupal-7.51/modules/simpletest/tests/drupal_system_listing_incompatible_test/drupal_system_listing_incompatible_test.info	2016-10-05 21:02:54.000000000 +0200
+++ drupal-7.66/modules/simpletest/tests/drupal_system_listing_incompatible_test/drupal_system_listing_incompatible_test.info	2019-04-17 22:39:36.000000000 +0200
@@ -5,8 +5,7 @@
 core = 7.x
 hidden = TRUE
 
-; Information added by Drupal.org packaging script on 2016-10-05
-version = "7.51"
+; Information added by Drupal.org packaging script on 2019-04-17
+version = "7.66"
 project = "drupal"
-datestamp = "1475694174"
-
+datestamp = "1555533576"
diff -Naur drupal-7.51/modules/simpletest/tests/entity_cache_test.info drupal-7.66/modules/simpletest/tests/entity_cache_test.info
--- drupal-7.51/modules/simpletest/tests/entity_cache_test.info	2016-10-05 21:02:54.000000000 +0200
+++ drupal-7.66/modules/simpletest/tests/entity_cache_test.info	2019-04-17 22:39:36.000000000 +0200
@@ -6,8 +6,7 @@
 dependencies[] = entity_cache_test_dependency
 hidden = TRUE
 
-; Information added by Drupal.org packaging script on 2016-10-05
-version = "7.51"
+; Information added by Drupal.org packaging script on 2019-04-17
+version = "7.66"
 project = "drupal"
-datestamp = "1475694174"
-
+datestamp = "1555533576"
diff -Naur drupal-7.51/modules/simpletest/tests/entity_cache_test_dependency.info drupal-7.66/modules/simpletest/tests/entity_cache_test_dependency.info
--- drupal-7.51/modules/simpletest/tests/entity_cache_test_dependency.info	2016-10-05 21:02:54.000000000 +0200
+++ drupal-7.66/modules/simpletest/tests/entity_cache_test_dependency.info	2019-04-17 22:39:36.000000000 +0200
@@ -5,8 +5,7 @@
 core = 7.x
 hidden = TRUE
 
-; Information added by Drupal.org packaging script on 2016-10-05
-version = "7.51"
+; Information added by Drupal.org packaging script on 2019-04-17
+version = "7.66"
 project = "drupal"
-datestamp = "1475694174"
-
+datestamp = "1555533576"
diff -Naur drupal-7.51/modules/simpletest/tests/entity_crud_hook_test.info drupal-7.66/modules/simpletest/tests/entity_crud_hook_test.info
--- drupal-7.51/modules/simpletest/tests/entity_crud_hook_test.info	2016-10-05 21:02:54.000000000 +0200
+++ drupal-7.66/modules/simpletest/tests/entity_crud_hook_test.info	2019-04-17 22:39:36.000000000 +0200
@@ -5,8 +5,7 @@
 version = VERSION
 hidden = TRUE
 
-; Information added by Drupal.org packaging script on 2016-10-05
-version = "7.51"
+; Information added by Drupal.org packaging script on 2019-04-17
+version = "7.66"
 project = "drupal"
-datestamp = "1475694174"
-
+datestamp = "1555533576"
diff -Naur drupal-7.51/modules/simpletest/tests/entity_query_access_test.info drupal-7.66/modules/simpletest/tests/entity_query_access_test.info
--- drupal-7.51/modules/simpletest/tests/entity_query_access_test.info	2016-10-05 21:02:54.000000000 +0200
+++ drupal-7.66/modules/simpletest/tests/entity_query_access_test.info	2019-04-17 22:39:36.000000000 +0200
@@ -5,8 +5,7 @@
 core = 7.x
 hidden = TRUE
 
-; Information added by Drupal.org packaging script on 2016-10-05
-version = "7.51"
+; Information added by Drupal.org packaging script on 2019-04-17
+version = "7.66"
 project = "drupal"
-datestamp = "1475694174"
-
+datestamp = "1555533576"
diff -Naur drupal-7.51/modules/simpletest/tests/error_test.info drupal-7.66/modules/simpletest/tests/error_test.info
--- drupal-7.51/modules/simpletest/tests/error_test.info	2016-10-05 21:02:54.000000000 +0200
+++ drupal-7.66/modules/simpletest/tests/error_test.info	2019-04-17 22:39:36.000000000 +0200
@@ -5,8 +5,7 @@
 core = 7.x
 hidden = TRUE
 
-; Information added by Drupal.org packaging script on 2016-10-05
-version = "7.51"
+; Information added by Drupal.org packaging script on 2019-04-17
+version = "7.66"
 project = "drupal"
-datestamp = "1475694174"
-
+datestamp = "1555533576"
diff -Naur drupal-7.51/modules/simpletest/tests/file.test drupal-7.66/modules/simpletest/tests/file.test
--- drupal-7.51/modules/simpletest/tests/file.test	2016-10-05 20:45:42.000000000 +0200
+++ drupal-7.66/modules/simpletest/tests/file.test	2019-04-17 22:20:46.000000000 +0200
@@ -957,6 +957,15 @@
     $path = file_create_filename($basename, $directory);
     $this->assertEqual($path, $expected, format_string('Creating a new filepath from %original equals %new.', array('%new' => $path, '%original' => $original)), 'File');
 
+    try {
+      $filename = "a\xFFtest\x80€.txt";
+      file_create_filename($filename, $directory);
+      $this->fail('Expected exception not thrown');
+    }
+    catch (RuntimeException $e) {
+      $this->assertEqual("Invalid filename '$filename'", $e->getMessage());
+    }
+
     // @TODO: Finally we copy a file into a directory several times, to ensure a properly iterating filename suffix.
   }
 
@@ -989,6 +998,14 @@
     $this->assertNotEqual($path, $destination, 'A new filepath destination is created when filepath destination already exists with FILE_EXISTS_RENAME.', 'File');
     $path = file_destination($destination, FILE_EXISTS_ERROR);
     $this->assertEqual($path, FALSE, 'An error is returned when filepath destination already exists with FILE_EXISTS_ERROR.', 'File');
+
+    try {
+      file_destination("core/misc/a\xFFtest\x80€.txt", FILE_EXISTS_REPLACE);
+      $this->fail('Expected exception not thrown');
+    }
+    catch (RuntimeException $e) {
+      $this->assertEqual("Invalid filename 'a\xFFtest\x80€.txt'", $e->getMessage());
+    }
   }
 
   /**
@@ -2766,4 +2783,64 @@
     $this->assertTrue(file_stream_wrapper_valid_scheme(file_uri_scheme('public://asdf')), 'Got a valid stream scheme from public://asdf');
     $this->assertFalse(file_stream_wrapper_valid_scheme(file_uri_scheme('foo://asdf')), 'Did not get a valid stream scheme from foo://asdf');
   }
+
+  /**
+   * Tests that phar stream wrapper is registered as expected.
+   *
+   * @see file_get_stream_wrappers()
+   */
+  public function testPharStreamWrapperRegistration() {
+    if (!class_exists('Phar', FALSE)) {
+      $this->assertFalse(in_array('phar', stream_get_wrappers(), TRUE), 'PHP is compiled without phar support. Therefore, no phar stream wrapper is registered.');
+    }
+    elseif (version_compare(PHP_VERSION, '5.3.3', '<')) {
+      $this->assertFalse(in_array('phar', stream_get_wrappers(), TRUE), 'The PHP version is <5.3.3. The built-in phar stream wrapper has been unregistered and not replaced.');
+    }
+    else {
+      $this->assertTrue(in_array('phar', stream_get_wrappers(), TRUE), 'A phar stream wrapper is registered.');
+      $this->assertFalse(file_stream_wrapper_valid_scheme('phar'), 'The phar scheme is not a valid scheme for Drupal File API usage.');
+    }
+
+    // Ensure that calling file_get_stream_wrappers() multiple times, both
+    // without and with a drupal_static_reset() in between, does not create
+    // errors due to the PharStreamWrapperManager singleton.
+    file_get_stream_wrappers();
+    file_get_stream_wrappers();
+    drupal_static_reset('file_get_stream_wrappers');
+    file_get_stream_wrappers();
+  }
+
+  /**
+   * Tests that only valid phar files can be used.
+   */
+  public function testPharFile() {
+    if (!in_array('phar', stream_get_wrappers(), TRUE)) {
+      $this->pass('There is no phar stream wrapper registered.');
+      // Nothing else in this test is relevant when there's no phar stream
+      // wrapper. testPharStreamWrapperRegistration() is sufficient for testing
+      // the conditions of when the stream wrapper should or should not be
+      // registered.
+      return;
+    }
+
+    $base = dirname(dirname(__FILE__)) . '/files';
+
+    // Ensure that file operations via the phar:// stream wrapper work for phar
+    // files with the .phar extension.
+    $this->assertFalse(file_exists("phar://$base/phar-1.phar/no-such-file.php"));
+    $this->assertTrue(file_exists("phar://$base/phar-1.phar/index.php"));
+    $file_contents = file_get_contents("phar://$base/phar-1.phar/index.php");
+    $expected_hash = 'c7e7904ea573c5ebea3ef00bb08c1f86af1a45961fbfbeb1892ff4a98fd73ad5';
+    $this->assertIdentical($expected_hash, hash('sha256', $file_contents));
+
+    // Ensure that file operations via the phar:// stream wrapper throw an
+    // exception for files without the .phar extension.
+    try {
+      file_exists("phar://$base/image-2.jpg/index.php");
+      $this->fail('Expected exception failed to be thrown when accessing an invalid phar file.');
+    }
+    catch (Exception $e) {
+      $this->assertEqual(get_class($e), 'TYPO3\PharStreamWrapper\Exception', 'Expected exception thrown when accessing an invalid phar file.');
+    }
+  }
 }
diff -Naur drupal-7.51/modules/simpletest/tests/file_test.info drupal-7.66/modules/simpletest/tests/file_test.info
--- drupal-7.51/modules/simpletest/tests/file_test.info	2016-10-05 21:02:54.000000000 +0200
+++ drupal-7.66/modules/simpletest/tests/file_test.info	2019-04-17 22:39:36.000000000 +0200
@@ -6,8 +6,7 @@
 files[] = file_test.module
 hidden = TRUE
 
-; Information added by Drupal.org packaging script on 2016-10-05
-version = "7.51"
+; Information added by Drupal.org packaging script on 2019-04-17
+version = "7.66"
 project = "drupal"
-datestamp = "1475694174"
-
+datestamp = "1555533576"
diff -Naur drupal-7.51/modules/simpletest/tests/filter_test.info drupal-7.66/modules/simpletest/tests/filter_test.info
--- drupal-7.51/modules/simpletest/tests/filter_test.info	2016-10-05 21:02:54.000000000 +0200
+++ drupal-7.66/modules/simpletest/tests/filter_test.info	2019-04-17 22:39:36.000000000 +0200
@@ -5,8 +5,7 @@
 core = 7.x
 hidden = TRUE
 
-; Information added by Drupal.org packaging script on 2016-10-05
-version = "7.51"
+; Information added by Drupal.org packaging script on 2019-04-17
+version = "7.66"
 project = "drupal"
-datestamp = "1475694174"
-
+datestamp = "1555533576"
diff -Naur drupal-7.51/modules/simpletest/tests/form.test drupal-7.66/modules/simpletest/tests/form.test
--- drupal-7.51/modules/simpletest/tests/form.test	2016-10-05 20:45:42.000000000 +0200
+++ drupal-7.66/modules/simpletest/tests/form.test	2019-04-17 22:20:46.000000000 +0200
@@ -691,6 +691,14 @@
   }
 
   /**
+   * Tests that a form with a disabled CSRF token can be validated.
+   */
+  function testDisabledToken() {
+    $this->drupalPost('form-test/validate-no-token', array(), 'Save');
+    $this->assertText('The form_test_validate_no_token form has been submitted successfully.');
+  }
+
+  /**
    * Tests partial form validation through #limit_validation_errors.
    */
   function testValidateLimitErrors() {
@@ -1413,6 +1421,59 @@
 }
 
 /**
+ * Test cache_form.
+ */
+class FormsFormCacheTestCase extends DrupalWebTestCase {
+  public static function getInfo() {
+    return array(
+      'name' => 'Form caching',
+      'description' => 'Tests storage and retrieval of forms from cache.',
+      'group' => 'Form API',
+    );
+  }
+
+  function setUp() {
+    parent::setUp('form_test');
+  }
+
+  /**
+   * Tests storing and retrieving the form from cache.
+   */
+  function testCacheForm() {
+    $form = drupal_get_form('form_test_cache_form');
+    $form_state = array('foo' => 'bar', 'build_info' => array('baz'));
+    form_set_cache($form['#build_id'], $form, $form_state);
+
+    $cached_form_state = array();
+    $cached_form = form_get_cache($form['#build_id'], $cached_form_state);
+
+    $this->assertEqual($cached_form['#build_id'], $form['#build_id'], 'Form retrieved from cache_form successfully.');
+    $this->assertEqual($cached_form_state['foo'], 'bar', 'Data retrieved from cache_form successfully.');
+  }
+
+  /**
+   * Tests changing form_cache_expiration.
+   */
+  function testCacheFormCustomExpiration() {
+    variable_set('form_cache_expiration', -1 * (24 * 60 * 60));
+
+    $form = drupal_get_form('form_test_cache_form');
+    $form_state = array('foo' => 'bar', 'build_info' => array('baz'));
+    form_set_cache($form['#build_id'], $form, $form_state);
+
+    // Clear expired entries from cache_form, which should include the entry we
+    // just stored. Without this, the form will still be retrieved from cache.
+    cache_clear_all(NULL, 'cache_form');
+
+    $cached_form_state = array();
+    $cached_form = form_get_cache($form['#build_id'], $cached_form_state);
+
+    $this->assertNull($cached_form, 'Expired form was not returned from cache.');
+    $this->assertTrue(empty($cached_form_state), 'No data retrieved from cache for expired form.');
+  }
+}
+
+/**
  * Test wrapper form callbacks.
  */
 class FormsFormWrapperTestCase extends DrupalWebTestCase {
diff -Naur drupal-7.51/modules/simpletest/tests/form_test.info drupal-7.66/modules/simpletest/tests/form_test.info
--- drupal-7.51/modules/simpletest/tests/form_test.info	2016-10-05 21:02:54.000000000 +0200
+++ drupal-7.66/modules/simpletest/tests/form_test.info	2019-04-17 22:39:36.000000000 +0200
@@ -5,8 +5,7 @@
 core = 7.x
 hidden = TRUE
 
-; Information added by Drupal.org packaging script on 2016-10-05
-version = "7.51"
+; Information added by Drupal.org packaging script on 2019-04-17
+version = "7.66"
 project = "drupal"
-datestamp = "1475694174"
-
+datestamp = "1555533576"
diff -Naur drupal-7.51/modules/simpletest/tests/form_test.module drupal-7.66/modules/simpletest/tests/form_test.module
--- drupal-7.51/modules/simpletest/tests/form_test.module	2016-10-05 20:45:42.000000000 +0200
+++ drupal-7.66/modules/simpletest/tests/form_test.module	2019-04-17 22:20:46.000000000 +0200
@@ -37,6 +37,13 @@
     'access callback' => TRUE,
     'type' => MENU_CALLBACK,
   );
+  $items['form-test/validate-no-token'] = array(
+    'title' => 'Form validation without a CSRF token',
+    'page callback' => 'drupal_get_form',
+    'page arguments' => array('form_test_validate_no_token'),
+    'access callback' => TRUE,
+    'type' => MENU_CALLBACK,
+  );
   $items['form-test/limit-validation-errors'] = array(
     'title' => 'Form validation with some error suppression',
     'page callback' => 'drupal_get_form',
@@ -455,6 +462,27 @@
 }
 
 /**
+ * Form builder for testing submission of a form without a CSRF token.
+ */
+function form_test_validate_no_token($form, &$form_state) {
+  $form['submit'] = array(
+    '#type' => 'submit',
+    '#value' => 'Save',
+  );
+
+  $form['#token'] = FALSE;
+
+  return $form;
+}
+
+/**
+ * Form submission handler for form_test_validate_no_token().
+ */
+function form_test_validate_no_token_submit($form, &$form_state) {
+  drupal_set_message('The form_test_validate_no_token form has been submitted successfully.');
+}
+
+/**
  * Builds a simple form with a button triggering partial validation.
  */
 function form_test_limit_validation_errors_form($form, &$form_state) {
@@ -891,6 +919,24 @@
 }
 
 /**
+ * A simple form for testing form caching.
+ */
+function form_test_cache_form($form, &$form_state) {
+  $form['title'] = array(
+    '#type' => 'textfield',
+    '#title' => 'Title',
+    '#required' => TRUE,
+  );
+
+  $form['submit'] = array(
+    '#type' => 'submit',
+    '#value' => 'Save',
+  );
+
+  return $form;
+}
+
+/**
  * A form for testing form labels and required marks.
  */
 function form_label_test_form() {
diff -Naur drupal-7.51/modules/simpletest/tests/image.test drupal-7.66/modules/simpletest/tests/image.test
--- drupal-7.51/modules/simpletest/tests/image.test	2016-10-05 20:45:42.000000000 +0200
+++ drupal-7.66/modules/simpletest/tests/image.test	2019-04-17 22:20:46.000000000 +0200
@@ -335,7 +335,9 @@
     );
 
     // Systems using non-bundled GD2 don't have imagerotate. Test if available.
-    if (function_exists('imagerotate')) {
+    // @todo Remove the version check once https://www.drupal.org/node/2918570
+    //   is resolved.
+    if (function_exists('imagerotate') && (version_compare(PHP_VERSION, '7.0.26', '<') || (version_compare(PHP_VERSION, '7.1', '>=') && version_compare(PHP_VERSION, '7.1.12', '<')))) {
       $operations += array(
         'rotate_90' => array(
           'function' => 'rotate',
@@ -357,8 +359,8 @@
       // See https://bugs.php.net/bug.php?id=65148.
       // For the 40x20 test images, the dimensions resulting from rotation will
       // be 1 pixel smaller in both width and height in PHP 5.5 and above.
-      // @todo: If and when the PHP bug gets solved, add an upper limit
-      //   version check.
+      // @todo: The PHP bug was fixed in PHP 7.0.26 and 7.1.12. Change the code
+      //   below to reflect that in https://www.drupal.org/node/2918570.
       if (version_compare(PHP_VERSION, '5.5', '>=')) {
         $operations += array(
           'rotate_5' => array(
diff -Naur drupal-7.51/modules/simpletest/tests/image_test.info drupal-7.66/modules/simpletest/tests/image_test.info
--- drupal-7.51/modules/simpletest/tests/image_test.info	2016-10-05 21:02:54.000000000 +0200
+++ drupal-7.66/modules/simpletest/tests/image_test.info	2019-04-17 22:39:36.000000000 +0200
@@ -5,8 +5,7 @@
 core = 7.x
 hidden = TRUE
 
-; Information added by Drupal.org packaging script on 2016-10-05
-version = "7.51"
+; Information added by Drupal.org packaging script on 2019-04-17
+version = "7.66"
 project = "drupal"
-datestamp = "1475694174"
-
+datestamp = "1555533576"
diff -Naur drupal-7.51/modules/simpletest/tests/menu_test.info drupal-7.66/modules/simpletest/tests/menu_test.info
--- drupal-7.51/modules/simpletest/tests/menu_test.info	2016-10-05 21:02:54.000000000 +0200
+++ drupal-7.66/modules/simpletest/tests/menu_test.info	2019-04-17 22:39:36.000000000 +0200
@@ -5,8 +5,7 @@
 core = 7.x
 hidden = TRUE
 
-; Information added by Drupal.org packaging script on 2016-10-05
-version = "7.51"
+; Information added by Drupal.org packaging script on 2019-04-17
+version = "7.66"
 project = "drupal"
-datestamp = "1475694174"
-
+datestamp = "1555533576"
diff -Naur drupal-7.51/modules/simpletest/tests/module_test.info drupal-7.66/modules/simpletest/tests/module_test.info
--- drupal-7.51/modules/simpletest/tests/module_test.info	2016-10-05 21:02:54.000000000 +0200
+++ drupal-7.66/modules/simpletest/tests/module_test.info	2019-04-17 22:39:36.000000000 +0200
@@ -5,8 +5,7 @@
 core = 7.x
 hidden = TRUE
 
-; Information added by Drupal.org packaging script on 2016-10-05
-version = "7.51"
+; Information added by Drupal.org packaging script on 2019-04-17
+version = "7.66"
 project = "drupal"
-datestamp = "1475694174"
-
+datestamp = "1555533576"
diff -Naur drupal-7.51/modules/simpletest/tests/path_test.info drupal-7.66/modules/simpletest/tests/path_test.info
--- drupal-7.51/modules/simpletest/tests/path_test.info	2016-10-05 21:02:54.000000000 +0200
+++ drupal-7.66/modules/simpletest/tests/path_test.info	2019-04-17 22:39:36.000000000 +0200
@@ -5,8 +5,7 @@
 core = 7.x
 hidden = TRUE
 
-; Information added by Drupal.org packaging script on 2016-10-05
-version = "7.51"
+; Information added by Drupal.org packaging script on 2019-04-17
+version = "7.66"
 project = "drupal"
-datestamp = "1475694174"
-
+datestamp = "1555533576"
diff -Naur drupal-7.51/modules/simpletest/tests/psr_0_test/psr_0_test.info drupal-7.66/modules/simpletest/tests/psr_0_test/psr_0_test.info
--- drupal-7.51/modules/simpletest/tests/psr_0_test/psr_0_test.info	2016-10-05 21:02:54.000000000 +0200
+++ drupal-7.66/modules/simpletest/tests/psr_0_test/psr_0_test.info	2019-04-17 22:39:36.000000000 +0200
@@ -5,8 +5,7 @@
 hidden = TRUE
 package = Testing
 
-; Information added by Drupal.org packaging script on 2016-10-05
-version = "7.51"
+; Information added by Drupal.org packaging script on 2019-04-17
+version = "7.66"
 project = "drupal"
-datestamp = "1475694174"
-
+datestamp = "1555533576"
diff -Naur drupal-7.51/modules/simpletest/tests/psr_4_test/psr_4_test.info drupal-7.66/modules/simpletest/tests/psr_4_test/psr_4_test.info
--- drupal-7.51/modules/simpletest/tests/psr_4_test/psr_4_test.info	2016-10-05 21:02:54.000000000 +0200
+++ drupal-7.66/modules/simpletest/tests/psr_4_test/psr_4_test.info	2019-04-17 22:39:36.000000000 +0200
@@ -5,8 +5,7 @@
 hidden = TRUE
 package = Testing
 
-; Information added by Drupal.org packaging script on 2016-10-05
-version = "7.51"
+; Information added by Drupal.org packaging script on 2019-04-17
+version = "7.66"
 project = "drupal"
-datestamp = "1475694174"
-
+datestamp = "1555533576"
diff -Naur drupal-7.51/modules/simpletest/tests/requirements1_test.info drupal-7.66/modules/simpletest/tests/requirements1_test.info
--- drupal-7.51/modules/simpletest/tests/requirements1_test.info	2016-10-05 21:02:54.000000000 +0200
+++ drupal-7.66/modules/simpletest/tests/requirements1_test.info	2019-04-17 22:39:36.000000000 +0200
@@ -5,8 +5,7 @@
 core = 7.x
 hidden = TRUE
 
-; Information added by Drupal.org packaging script on 2016-10-05
-version = "7.51"
+; Information added by Drupal.org packaging script on 2019-04-17
+version = "7.66"
 project = "drupal"
-datestamp = "1475694174"
-
+datestamp = "1555533576"
diff -Naur drupal-7.51/modules/simpletest/tests/requirements2_test.info drupal-7.66/modules/simpletest/tests/requirements2_test.info
--- drupal-7.51/modules/simpletest/tests/requirements2_test.info	2016-10-05 21:02:54.000000000 +0200
+++ drupal-7.66/modules/simpletest/tests/requirements2_test.info	2019-04-17 22:39:36.000000000 +0200
@@ -7,8 +7,7 @@
 core = 7.x
 hidden = TRUE
 
-; Information added by Drupal.org packaging script on 2016-10-05
-version = "7.51"
+; Information added by Drupal.org packaging script on 2019-04-17
+version = "7.66"
 project = "drupal"
-datestamp = "1475694174"
-
+datestamp = "1555533576"
diff -Naur drupal-7.51/modules/simpletest/tests/session_test.info drupal-7.66/modules/simpletest/tests/session_test.info
--- drupal-7.51/modules/simpletest/tests/session_test.info	2016-10-05 21:02:54.000000000 +0200
+++ drupal-7.66/modules/simpletest/tests/session_test.info	2019-04-17 22:39:36.000000000 +0200
@@ -5,8 +5,7 @@
 core = 7.x
 hidden = TRUE
 
-; Information added by Drupal.org packaging script on 2016-10-05
-version = "7.51"
+; Information added by Drupal.org packaging script on 2019-04-17
+version = "7.66"
 project = "drupal"
-datestamp = "1475694174"
-
+datestamp = "1555533576"
diff -Naur drupal-7.51/modules/simpletest/tests/system_dependencies_test.info drupal-7.66/modules/simpletest/tests/system_dependencies_test.info
--- drupal-7.51/modules/simpletest/tests/system_dependencies_test.info	2016-10-05 21:02:54.000000000 +0200
+++ drupal-7.66/modules/simpletest/tests/system_dependencies_test.info	2019-04-17 22:39:36.000000000 +0200
@@ -6,8 +6,7 @@
 hidden = TRUE
 dependencies[] = _missing_dependency
 
-; Information added by Drupal.org packaging script on 2016-10-05
-version = "7.51"
+; Information added by Drupal.org packaging script on 2019-04-17
+version = "7.66"
 project = "drupal"
-datestamp = "1475694174"
-
+datestamp = "1555533576"
diff -Naur drupal-7.51/modules/simpletest/tests/system_incompatible_core_version_dependencies_test.info drupal-7.66/modules/simpletest/tests/system_incompatible_core_version_dependencies_test.info
--- drupal-7.51/modules/simpletest/tests/system_incompatible_core_version_dependencies_test.info	2016-10-05 21:02:54.000000000 +0200
+++ drupal-7.66/modules/simpletest/tests/system_incompatible_core_version_dependencies_test.info	2019-04-17 22:39:36.000000000 +0200
@@ -6,8 +6,7 @@
 hidden = TRUE
 dependencies[] = system_incompatible_core_version_test
 
-; Information added by Drupal.org packaging script on 2016-10-05
-version = "7.51"
+; Information added by Drupal.org packaging script on 2019-04-17
+version = "7.66"
 project = "drupal"
-datestamp = "1475694174"
-
+datestamp = "1555533576"
diff -Naur drupal-7.51/modules/simpletest/tests/system_incompatible_core_version_test.info drupal-7.66/modules/simpletest/tests/system_incompatible_core_version_test.info
--- drupal-7.51/modules/simpletest/tests/system_incompatible_core_version_test.info	2016-10-05 21:02:54.000000000 +0200
+++ drupal-7.66/modules/simpletest/tests/system_incompatible_core_version_test.info	2019-04-17 22:39:36.000000000 +0200
@@ -5,8 +5,7 @@
 core = 5.x
 hidden = TRUE
 
-; Information added by Drupal.org packaging script on 2016-10-05
-version = "7.51"
+; Information added by Drupal.org packaging script on 2019-04-17
+version = "7.66"
 project = "drupal"
-datestamp = "1475694174"
-
+datestamp = "1555533576"
diff -Naur drupal-7.51/modules/simpletest/tests/system_incompatible_module_version_dependencies_test.info drupal-7.66/modules/simpletest/tests/system_incompatible_module_version_dependencies_test.info
--- drupal-7.51/modules/simpletest/tests/system_incompatible_module_version_dependencies_test.info	2016-10-05 21:02:54.000000000 +0200
+++ drupal-7.66/modules/simpletest/tests/system_incompatible_module_version_dependencies_test.info	2019-04-17 22:39:36.000000000 +0200
@@ -7,8 +7,7 @@
 ; system_incompatible_module_version_test declares version 1.0
 dependencies[] = system_incompatible_module_version_test (>2.0)
 
-; Information added by Drupal.org packaging script on 2016-10-05
-version = "7.51"
+; Information added by Drupal.org packaging script on 2019-04-17
+version = "7.66"
 project = "drupal"
-datestamp = "1475694174"
-
+datestamp = "1555533576"
diff -Naur drupal-7.51/modules/simpletest/tests/system_incompatible_module_version_test.info drupal-7.66/modules/simpletest/tests/system_incompatible_module_version_test.info
--- drupal-7.51/modules/simpletest/tests/system_incompatible_module_version_test.info	2016-10-05 21:02:54.000000000 +0200
+++ drupal-7.66/modules/simpletest/tests/system_incompatible_module_version_test.info	2019-04-17 22:39:36.000000000 +0200
@@ -5,8 +5,7 @@
 core = 7.x
 hidden = TRUE
 
-; Information added by Drupal.org packaging script on 2016-10-05
-version = "7.51"
+; Information added by Drupal.org packaging script on 2019-04-17
+version = "7.66"
 project = "drupal"
-datestamp = "1475694174"
-
+datestamp = "1555533576"
diff -Naur drupal-7.51/modules/simpletest/tests/system_project_namespace_test.info drupal-7.66/modules/simpletest/tests/system_project_namespace_test.info
--- drupal-7.51/modules/simpletest/tests/system_project_namespace_test.info	2016-10-05 21:02:54.000000000 +0200
+++ drupal-7.66/modules/simpletest/tests/system_project_namespace_test.info	2019-04-17 22:39:36.000000000 +0200
@@ -6,8 +6,7 @@
 hidden = TRUE
 dependencies[] = drupal:filter
 
-; Information added by Drupal.org packaging script on 2016-10-05
-version = "7.51"
+; Information added by Drupal.org packaging script on 2019-04-17
+version = "7.66"
 project = "drupal"
-datestamp = "1475694174"
-
+datestamp = "1555533576"
diff -Naur drupal-7.51/modules/simpletest/tests/system_test.info drupal-7.66/modules/simpletest/tests/system_test.info
--- drupal-7.51/modules/simpletest/tests/system_test.info	2016-10-05 21:02:54.000000000 +0200
+++ drupal-7.66/modules/simpletest/tests/system_test.info	2019-04-17 22:39:36.000000000 +0200
@@ -6,8 +6,7 @@
 files[] = system_test.module
 hidden = TRUE
 
-; Information added by Drupal.org packaging script on 2016-10-05
-version = "7.51"
+; Information added by Drupal.org packaging script on 2019-04-17
+version = "7.66"
 project = "drupal"
-datestamp = "1475694174"
-
+datestamp = "1555533576"
diff -Naur drupal-7.51/modules/simpletest/tests/taxonomy_test.info drupal-7.66/modules/simpletest/tests/taxonomy_test.info
--- drupal-7.51/modules/simpletest/tests/taxonomy_test.info	2016-10-05 21:02:54.000000000 +0200
+++ drupal-7.66/modules/simpletest/tests/taxonomy_test.info	2019-04-17 22:39:36.000000000 +0200
@@ -6,8 +6,7 @@
 hidden = TRUE
 dependencies[] = taxonomy
 
-; Information added by Drupal.org packaging script on 2016-10-05
-version = "7.51"
+; Information added by Drupal.org packaging script on 2019-04-17
+version = "7.66"
 project = "drupal"
-datestamp = "1475694174"
-
+datestamp = "1555533576"
diff -Naur drupal-7.51/modules/simpletest/tests/taxonomy_test.module drupal-7.66/modules/simpletest/tests/taxonomy_test.module
--- drupal-7.51/modules/simpletest/tests/taxonomy_test.module	2016-10-05 20:45:42.000000000 +0200
+++ drupal-7.66/modules/simpletest/tests/taxonomy_test.module	2019-04-17 22:20:46.000000000 +0200
@@ -109,3 +109,33 @@
     ->execute()
     ->fetchField();
 }
+
+/**
+ * Implements hook_query_alter().
+ */
+function taxonomy_test_query_alter(QueryAlterableInterface $query) {
+  $value = variable_get(__FUNCTION__);
+  if (isset($value)) {
+    variable_set(__FUNCTION__, ++$value);
+  }
+}
+
+/**
+ * Implements hook_query_TAG_alter().
+ */
+function taxonomy_test_query_term_access_alter(QueryAlterableInterface $query) {
+  $value = variable_get(__FUNCTION__);
+  if (isset($value)) {
+    variable_set(__FUNCTION__, ++$value);
+  }
+}
+
+/**
+ * Implements hook_query_TAG_alter().
+ */
+function taxonomy_test_query_taxonomy_term_access_alter(QueryAlterableInterface $query) {
+  $value = variable_get(__FUNCTION__);
+  if (isset($value)) {
+    variable_set(__FUNCTION__, ++$value);
+  }
+}
diff -Naur drupal-7.51/modules/simpletest/tests/theme.test drupal-7.66/modules/simpletest/tests/theme.test
--- drupal-7.51/modules/simpletest/tests/theme.test	2016-10-05 20:45:42.000000000 +0200
+++ drupal-7.66/modules/simpletest/tests/theme.test	2019-04-17 22:20:46.000000000 +0200
@@ -646,3 +646,34 @@
   }
 
 }
+
+/**
+ * Tests module-provided theme engines.
+ */
+class ModuleProvidedThemeEngineTestCase extends DrupalWebTestCase {
+
+  public static function getInfo() {
+    return array(
+      'name' => 'Theme engine test',
+      'description' => 'Tests module-provided theme engines.',
+      'group' => 'Theme',
+    );
+  }
+
+  function setUp() {
+    parent::setUp('theme_test');
+    theme_enable(array('test_theme', 'test_theme_nyan_cat'));
+  }
+
+  /**
+   * Ensures that the module provided theme engine is found and used by core.
+   */
+  function testEngineIsFoundAndWorking() {
+    variable_set('theme_default', 'test_theme_nyan_cat');
+    variable_set('admin_theme', 'test_theme_nyan_cat');
+
+    $this->drupalGet('theme-test/engine-info-test');
+    $this->assertText('Miaou');
+  }
+
+}
diff -Naur drupal-7.51/modules/simpletest/tests/theme_test.info drupal-7.66/modules/simpletest/tests/theme_test.info
--- drupal-7.51/modules/simpletest/tests/theme_test.info	2016-10-05 21:02:54.000000000 +0200
+++ drupal-7.66/modules/simpletest/tests/theme_test.info	2019-04-17 22:39:36.000000000 +0200
@@ -5,8 +5,7 @@
 core = 7.x
 hidden = TRUE
 
-; Information added by Drupal.org packaging script on 2016-10-05
-version = "7.51"
+; Information added by Drupal.org packaging script on 2019-04-17
+version = "7.66"
 project = "drupal"
-datestamp = "1475694174"
-
+datestamp = "1555533576"
diff -Naur drupal-7.51/modules/simpletest/tests/theme_test.module drupal-7.66/modules/simpletest/tests/theme_test.module
--- drupal-7.51/modules/simpletest/tests/theme_test.module	2016-10-05 20:45:42.000000000 +0200
+++ drupal-7.66/modules/simpletest/tests/theme_test.module	2019-04-17 22:20:46.000000000 +0200
@@ -27,10 +27,19 @@
   $themes['test_theme'] = drupal_get_path('module', 'theme_test') . '/themes/test_theme/test_theme.info';
   $themes['test_basetheme'] = drupal_get_path('module', 'theme_test') . '/themes/test_basetheme/test_basetheme.info';
   $themes['test_subtheme'] = drupal_get_path('module', 'theme_test') . '/themes/test_subtheme/test_subtheme.info';
+  $themes['test_theme_nyan_cat'] = drupal_get_path('module', 'theme_test') . '/themes/test_theme_nyan_cat/test_theme_nyan_cat.info';
   return $themes;
 }
 
 /**
+ * Implements hook_system_theme_engine_info().
+ */
+function theme_test_system_theme_engine_info() {
+  $theme_engines['nyan_cat'] = drupal_get_path('module', 'theme_test') . '/themes/engines/nyan_cat/nyan_cat.engine';
+  return $theme_engines;
+}
+
+/**
  * Implements hook_menu().
  */
 function theme_test_menu() {
@@ -58,6 +67,12 @@
     'access callback' => TRUE,
     'type' => MENU_CALLBACK,
   );
+  $items['theme-test/engine-info-test'] = array(
+    'description' => "Serves a simple page rendered using a Nyan Cat theme engine template.",
+    'page callback' => '_theme_test_engine_info_test',
+    'access callback' => TRUE,
+    'type' => MENU_CALLBACK,
+  );
   return $items;
 }
 
@@ -140,6 +155,15 @@
 }
 
 /**
+ * Serves a simple page renderered using a Nyan Cat theme engine template.
+ */
+function _theme_test_engine_info_test() {
+  return array(
+    '#markup' => theme('theme_test_template_test'),
+  );
+}
+
+/**
  * Theme function for testing theme('theme_test_foo').
  */
 function theme_theme_test_foo($variables) {
diff -Naur drupal-7.51/modules/simpletest/tests/themes/engines/nyan_cat/nyan_cat.engine drupal-7.66/modules/simpletest/tests/themes/engines/nyan_cat/nyan_cat.engine
--- drupal-7.51/modules/simpletest/tests/themes/engines/nyan_cat/nyan_cat.engine	1970-01-01 01:00:00.000000000 +0100
+++ drupal-7.66/modules/simpletest/tests/themes/engines/nyan_cat/nyan_cat.engine	2019-04-17 22:20:46.000000000 +0200
@@ -0,0 +1,53 @@
+<?php
+
+/**
+ * @file
+ * Handles integration of Nyan cat templates because we love kittens.
+ */
+
+/**
+ * Includes .theme file from themes.
+ */
+function nyan_cat_init($template) {
+  $file = dirname($template->filename) . '/template.theme';
+  if (file_exists($file)) {
+    include_once DRUPAL_ROOT . '/' . $file;
+  }
+}
+
+/**
+ * Implements hook_theme().
+ */
+function nyan_cat_theme($existing, $type, $theme, $path) {
+  $templates = drupal_find_theme_functions($existing, array($theme));
+  $templates += drupal_find_theme_templates($existing, '.nyan-cat.html', $path);
+  return $templates;
+}
+
+/**
+ * Implements hook_extension().
+ */
+function nyan_cat_extension() {
+  return '.nyan-cat.html';
+}
+
+/**
+ * Implements hook_render_template().
+ *
+ * @param string $template_file
+ *   The filename of the template to render.
+ * @param mixed[] $variables
+ *   A keyed array of variables that will appear in the output.
+ *
+ * @return string
+ *   The output generated by the template.
+ */
+function nyan_cat_render_template($template_file, $variables) {
+  $output = str_replace('div', 'nyancat', file_get_contents(DRUPAL_ROOT . '/' . $template_file));
+  foreach ($variables as $key => $variable) {
+    if (strpos($output, '9' . $key) !== FALSE) {
+      $output = str_replace('9' . $key, $variable, $output);
+    }
+  }
+  return $output;
+}
diff -Naur drupal-7.51/modules/simpletest/tests/themes/test_basetheme/test_basetheme.info drupal-7.66/modules/simpletest/tests/themes/test_basetheme/test_basetheme.info
--- drupal-7.51/modules/simpletest/tests/themes/test_basetheme/test_basetheme.info	2016-10-05 21:02:54.000000000 +0200
+++ drupal-7.66/modules/simpletest/tests/themes/test_basetheme/test_basetheme.info	2019-04-17 22:39:36.000000000 +0200
@@ -6,8 +6,7 @@
 settings[basetheme_only] = base theme value
 settings[subtheme_override] = base theme value
 
-; Information added by Drupal.org packaging script on 2016-10-05
-version = "7.51"
+; Information added by Drupal.org packaging script on 2019-04-17
+version = "7.66"
 project = "drupal"
-datestamp = "1475694174"
-
+datestamp = "1555533576"
diff -Naur drupal-7.51/modules/simpletest/tests/themes/test_subtheme/test_subtheme.info drupal-7.66/modules/simpletest/tests/themes/test_subtheme/test_subtheme.info
--- drupal-7.51/modules/simpletest/tests/themes/test_subtheme/test_subtheme.info	2016-10-05 21:02:54.000000000 +0200
+++ drupal-7.66/modules/simpletest/tests/themes/test_subtheme/test_subtheme.info	2019-04-17 22:39:36.000000000 +0200
@@ -6,8 +6,7 @@
 
 settings[subtheme_override] = subtheme value
 
-; Information added by Drupal.org packaging script on 2016-10-05
-version = "7.51"
+; Information added by Drupal.org packaging script on 2019-04-17
+version = "7.66"
 project = "drupal"
-datestamp = "1475694174"
-
+datestamp = "1555533576"
diff -Naur drupal-7.51/modules/simpletest/tests/themes/test_theme/test_theme.info drupal-7.66/modules/simpletest/tests/themes/test_theme/test_theme.info
--- drupal-7.51/modules/simpletest/tests/themes/test_theme/test_theme.info	2016-10-05 21:02:54.000000000 +0200
+++ drupal-7.66/modules/simpletest/tests/themes/test_theme/test_theme.info	2019-04-17 22:39:36.000000000 +0200
@@ -17,8 +17,7 @@
 
 settings[theme_test_setting] = default value
 
-; Information added by Drupal.org packaging script on 2016-10-05
-version = "7.51"
+; Information added by Drupal.org packaging script on 2019-04-17
+version = "7.66"
 project = "drupal"
-datestamp = "1475694174"
-
+datestamp = "1555533576"
diff -Naur drupal-7.51/modules/simpletest/tests/themes/test_theme/theme-settings.php drupal-7.66/modules/simpletest/tests/themes/test_theme/theme-settings.php
--- drupal-7.51/modules/simpletest/tests/themes/test_theme/theme-settings.php	1970-01-01 01:00:00.000000000 +0100
+++ drupal-7.66/modules/simpletest/tests/themes/test_theme/theme-settings.php	2019-04-17 22:20:46.000000000 +0200
@@ -0,0 +1,32 @@
+<?php
+
+/**
+ * @file
+ * Theme setting callbacks for the test_theme theme.
+ */
+
+/**
+ * Implements hook_form_FORM_ID_alter().
+ */
+function test_theme_form_system_theme_settings_alter(&$form, &$form_state) {
+  $form['test_theme_checkbox'] = array(
+    '#type' => 'checkbox',
+    '#title' => 'Test theme checkbox',
+    '#default_value' => theme_get_setting('test_theme_checkbox'),
+  );
+
+  // Force the form to be cached so we can test that this file is properly
+  // loaded and the custom submit handler is properly called even on a cached
+  // form build.
+  $form_state['cache'] = TRUE;
+  $form['#submit'][] = 'test_theme_form_system_theme_settings_submit';
+}
+
+/**
+ * Form submission handler for the test theme settings form.
+ *
+ * @see test_theme_form_system_theme_settings_alter()
+ */
+function test_theme_form_system_theme_settings_submit($form, &$form_state) {
+  drupal_set_message('The test theme setting was saved.');
+}
diff -Naur drupal-7.51/modules/simpletest/tests/themes/test_theme_nyan_cat/templates/theme_test_template_test.nyan-cat.html drupal-7.66/modules/simpletest/tests/themes/test_theme_nyan_cat/templates/theme_test_template_test.nyan-cat.html
--- drupal-7.51/modules/simpletest/tests/themes/test_theme_nyan_cat/templates/theme_test_template_test.nyan-cat.html	1970-01-01 01:00:00.000000000 +0100
+++ drupal-7.66/modules/simpletest/tests/themes/test_theme_nyan_cat/templates/theme_test_template_test.nyan-cat.html	2019-04-17 22:20:46.000000000 +0200
@@ -0,0 +1 @@
+Miaou
\ No newline at end of file
diff -Naur drupal-7.51/modules/simpletest/tests/themes/test_theme_nyan_cat/test_theme_nyan_cat.info drupal-7.66/modules/simpletest/tests/themes/test_theme_nyan_cat/test_theme_nyan_cat.info
--- drupal-7.51/modules/simpletest/tests/themes/test_theme_nyan_cat/test_theme_nyan_cat.info	1970-01-01 01:00:00.000000000 +0100
+++ drupal-7.66/modules/simpletest/tests/themes/test_theme_nyan_cat/test_theme_nyan_cat.info	2019-04-17 22:39:36.000000000 +0200
@@ -0,0 +1,10 @@
+name = Nyan cat engine based test theme
+description = Theme for testing the module-provided theme engines.
+core = 7.x
+hidden = TRUE
+engine = nyan_cat
+
+; Information added by Drupal.org packaging script on 2019-04-17
+version = "7.66"
+project = "drupal"
+datestamp = "1555533576"
diff -Naur drupal-7.51/modules/simpletest/tests/update_script_test.info drupal-7.66/modules/simpletest/tests/update_script_test.info
--- drupal-7.51/modules/simpletest/tests/update_script_test.info	2016-10-05 21:02:54.000000000 +0200
+++ drupal-7.66/modules/simpletest/tests/update_script_test.info	2019-04-17 22:39:36.000000000 +0200
@@ -5,8 +5,7 @@
 core = 7.x
 hidden = TRUE
 
-; Information added by Drupal.org packaging script on 2016-10-05
-version = "7.51"
+; Information added by Drupal.org packaging script on 2019-04-17
+version = "7.66"
 project = "drupal"
-datestamp = "1475694174"
-
+datestamp = "1555533576"
diff -Naur drupal-7.51/modules/simpletest/tests/update_test_1.info drupal-7.66/modules/simpletest/tests/update_test_1.info
--- drupal-7.51/modules/simpletest/tests/update_test_1.info	2016-10-05 21:02:54.000000000 +0200
+++ drupal-7.66/modules/simpletest/tests/update_test_1.info	2019-04-17 22:39:36.000000000 +0200
@@ -5,8 +5,7 @@
 core = 7.x
 hidden = TRUE
 
-; Information added by Drupal.org packaging script on 2016-10-05
-version = "7.51"
+; Information added by Drupal.org packaging script on 2019-04-17
+version = "7.66"
 project = "drupal"
-datestamp = "1475694174"
-
+datestamp = "1555533576"
diff -Naur drupal-7.51/modules/simpletest/tests/update_test_2.info drupal-7.66/modules/simpletest/tests/update_test_2.info
--- drupal-7.51/modules/simpletest/tests/update_test_2.info	2016-10-05 21:02:54.000000000 +0200
+++ drupal-7.66/modules/simpletest/tests/update_test_2.info	2019-04-17 22:39:36.000000000 +0200
@@ -5,8 +5,7 @@
 core = 7.x
 hidden = TRUE
 
-; Information added by Drupal.org packaging script on 2016-10-05
-version = "7.51"
+; Information added by Drupal.org packaging script on 2019-04-17
+version = "7.66"
 project = "drupal"
-datestamp = "1475694174"
-
+datestamp = "1555533576"
diff -Naur drupal-7.51/modules/simpletest/tests/update_test_3.info drupal-7.66/modules/simpletest/tests/update_test_3.info
--- drupal-7.51/modules/simpletest/tests/update_test_3.info	2016-10-05 21:02:54.000000000 +0200
+++ drupal-7.66/modules/simpletest/tests/update_test_3.info	2019-04-17 22:39:36.000000000 +0200
@@ -5,8 +5,7 @@
 core = 7.x
 hidden = TRUE
 
-; Information added by Drupal.org packaging script on 2016-10-05
-version = "7.51"
+; Information added by Drupal.org packaging script on 2019-04-17
+version = "7.66"
 project = "drupal"
-datestamp = "1475694174"
-
+datestamp = "1555533576"
diff -Naur drupal-7.51/modules/simpletest/tests/url_alter_test.info drupal-7.66/modules/simpletest/tests/url_alter_test.info
--- drupal-7.51/modules/simpletest/tests/url_alter_test.info	2016-10-05 21:02:54.000000000 +0200
+++ drupal-7.66/modules/simpletest/tests/url_alter_test.info	2019-04-17 22:39:36.000000000 +0200
@@ -5,8 +5,7 @@
 version = VERSION
 hidden = TRUE
 
-; Information added by Drupal.org packaging script on 2016-10-05
-version = "7.51"
+; Information added by Drupal.org packaging script on 2019-04-17
+version = "7.66"
 project = "drupal"
-datestamp = "1475694174"
-
+datestamp = "1555533576"
diff -Naur drupal-7.51/modules/simpletest/tests/xmlrpc_test.info drupal-7.66/modules/simpletest/tests/xmlrpc_test.info
--- drupal-7.51/modules/simpletest/tests/xmlrpc_test.info	2016-10-05 21:02:54.000000000 +0200
+++ drupal-7.66/modules/simpletest/tests/xmlrpc_test.info	2019-04-17 22:39:36.000000000 +0200
@@ -5,8 +5,7 @@
 core = 7.x
 hidden = TRUE
 
-; Information added by Drupal.org packaging script on 2016-10-05
-version = "7.51"
+; Information added by Drupal.org packaging script on 2019-04-17
+version = "7.66"
 project = "drupal"
-datestamp = "1475694174"
-
+datestamp = "1555533576"
diff -Naur drupal-7.51/modules/statistics/statistics.info drupal-7.66/modules/statistics/statistics.info
--- drupal-7.51/modules/statistics/statistics.info	2016-10-05 21:02:54.000000000 +0200
+++ drupal-7.66/modules/statistics/statistics.info	2019-04-17 22:39:36.000000000 +0200
@@ -6,8 +6,7 @@
 files[] = statistics.test
 configure = admin/config/system/statistics
 
-; Information added by Drupal.org packaging script on 2016-10-05
-version = "7.51"
+; Information added by Drupal.org packaging script on 2019-04-17
+version = "7.66"
 project = "drupal"
-datestamp = "1475694174"
-
+datestamp = "1555533576"
diff -Naur drupal-7.51/modules/statistics/statistics.module drupal-7.66/modules/statistics/statistics.module
--- drupal-7.51/modules/statistics/statistics.module	2016-10-05 20:45:42.000000000 +0200
+++ drupal-7.66/modules/statistics/statistics.module	2019-04-17 22:20:46.000000000 +0200
@@ -245,7 +245,7 @@
  * Implements hook_cron().
  */
 function statistics_cron() {
-  $statistics_timestamp = variable_get('statistics_day_timestamp', '');
+  $statistics_timestamp = variable_get('statistics_day_timestamp', 0);
 
   if ((REQUEST_TIME - $statistics_timestamp) >= 86400) {
     // Reset day counts.
diff -Naur drupal-7.51/modules/syslog/syslog.info drupal-7.66/modules/syslog/syslog.info
--- drupal-7.51/modules/syslog/syslog.info	2016-10-05 21:02:54.000000000 +0200
+++ drupal-7.66/modules/syslog/syslog.info	2019-04-17 22:39:36.000000000 +0200
@@ -6,8 +6,7 @@
 files[] = syslog.test
 configure = admin/config/development/logging
 
-; Information added by Drupal.org packaging script on 2016-10-05
-version = "7.51"
+; Information added by Drupal.org packaging script on 2019-04-17
+version = "7.66"
 project = "drupal"
-datestamp = "1475694174"
-
+datestamp = "1555533576"
diff -Naur drupal-7.51/modules/system/system.admin.inc drupal-7.66/modules/system/system.admin.inc
--- drupal-7.51/modules/system/system.admin.inc	2016-10-05 20:45:42.000000000 +0200
+++ drupal-7.66/modules/system/system.admin.inc	2019-04-17 22:20:46.000000000 +0200
@@ -572,9 +572,10 @@
     // Process the theme and all its base themes.
     foreach ($theme_keys as $theme) {
       // Include the theme-settings.php file.
-      $filename = DRUPAL_ROOT . '/' . str_replace("/$theme.info", '', $themes[$theme]->filename) . '/theme-settings.php';
-      if (file_exists($filename)) {
-        require_once $filename;
+      $theme_settings_path = drupal_get_path('theme', $theme) . '/theme-settings.php';
+      if (file_exists(DRUPAL_ROOT . '/' . $theme_settings_path)) {
+        require_once DRUPAL_ROOT . '/' . $theme_settings_path;
+        $form_state['build_info']['files'][] = $theme_settings_path;
       }
 
       // Call theme-specific settings.
@@ -1812,7 +1813,7 @@
     '#title' => t('Private file system path'),
     '#default_value' => variable_get('file_private_path', ''),
     '#maxlength' => 255,
-    '#description' => t('An existing local file system path for storing private files. It should be writable by Drupal and not accessible over the web. See the online handbook for <a href="@handbook">more information about securing private files</a>.', array('@handbook' => 'http://drupal.org/documentation/modules/file')),
+    '#description' => t('An existing local file system path for storing private files. It should be writable by Drupal and not accessible over the web. See the online handbook for <a href="@handbook">more information about securing private files</a>.', array('@handbook' => 'https://www.drupal.org/docs/7/core/modules/file/overview')),
     '#after_build' => array('system_check_directory'),
   );
 
@@ -2565,9 +2566,21 @@
 /**
  * Returns HTML for the status report.
  *
+ * This theme function is dependent on install.inc being loaded, because
+ * that's where the constants are defined.
+ *
  * @param $variables
  *   An associative array containing:
- *   - requirements: An array of requirements.
+ *   - requirements: An array of requirements/status items. Each requirement
+ *     is an associative array containing the following elements:
+ *     - title: The name of the requirement.
+ *     - value: (optional) The current value (version, time, level, etc).
+ *     - description: (optional) The description of the requirement.
+ *     - severity: (optional) The requirement's result/severity level, one of:
+ *       - REQUIREMENT_INFO: Status information.
+ *       - REQUIREMENT_OK: The requirement is satisfied.
+ *       - REQUIREMENT_WARNING: The requirement failed with a warning.
+ *       - REQUIREMENT_ERROR: The requirement failed with an error.
  *
  * @ingroup themeable
  */
diff -Naur drupal-7.51/modules/system/system.api.php drupal-7.66/modules/system/system.api.php
--- drupal-7.51/modules/system/system.api.php	2016-10-05 20:45:42.000000000 +0200
+++ drupal-7.66/modules/system/system.api.php	2019-04-17 22:20:46.000000000 +0200
@@ -1888,8 +1888,8 @@
  *
  * This hook is not run on cached pages.
  *
- * To add CSS or JS that should be present on all pages, modules should not
- * implement this hook, but declare these files in their .info file.
+ * To add CSS or JS files that should be present on all pages, modules should
+ * not implement this hook, but declare these files in their .info file.
  *
  * @see hook_boot()
  */
@@ -2051,6 +2051,22 @@
 }
 
 /**
+ * Return additional theme engines provided by modules.
+ *
+ * This hook is invoked from _system_rebuild_theme_data() and allows modules to
+ * register additional theme engines outside of the regular 'themes/engines'
+ * directories of a Drupal installation.
+ *
+ * @return
+ *   An associative array. Each key is the system name of a theme engine and
+ *   each value is the corresponding path to the theme engine's .engine file.
+ */
+function hook_system_theme_engine_info() {
+  $theme_engines['izumi'] = drupal_get_path('module', 'mymodule') . '/izumi/izumi.engine';
+  return $theme_engines;
+}
+
+/**
  * Alter the information parsed from module and theme .info files
  *
  * This hook is invoked in _system_rebuild_module_data() and in
diff -Naur drupal-7.51/modules/system/system.info drupal-7.66/modules/system/system.info
--- drupal-7.51/modules/system/system.info	2016-10-05 21:02:54.000000000 +0200
+++ drupal-7.66/modules/system/system.info	2019-04-17 22:39:36.000000000 +0200
@@ -12,8 +12,7 @@
 required = TRUE
 configure = admin/config/system
 
-; Information added by Drupal.org packaging script on 2016-10-05
-version = "7.51"
+; Information added by Drupal.org packaging script on 2019-04-17
+version = "7.66"
 project = "drupal"
-datestamp = "1475694174"
-
+datestamp = "1555533576"
diff -Naur drupal-7.51/modules/system/system.install drupal-7.66/modules/system/system.install
--- drupal-7.51/modules/system/system.install	2016-10-05 20:45:42.000000000 +0200
+++ drupal-7.66/modules/system/system.install	2019-04-17 22:20:46.000000000 +0200
@@ -160,7 +160,7 @@
       if (empty($drivers)) {
         $database_ok = FALSE;
         $pdo_message = $t('Your web server does not appear to support any common PDO database extensions. Check with your hosting provider to see if they support PDO (PHP Data Objects) and offer any databases that <a href="@drupal-databases">Drupal supports</a>.', array(
-          '@drupal-databases' => 'http://drupal.org/node/270#database',
+          '@drupal-databases' => 'https://www.drupal.org/requirements/database',
         ));
       }
       // Make sure the native PDO extension is available, not the older PEAR
@@ -2870,7 +2870,7 @@
     if (!db_table_exists('system_update_7061')) {
       $table = array(
         'description' => t('Stores temporary data for system_update_7061.'),
-        'fields' => array('vid' => array('type' => 'int')),
+        'fields' => array('vid' => array('type' => 'int', 'not null' => TRUE)),
         'primary key' => array('vid'),
       );
       db_create_table('system_update_7061', $table);
@@ -3286,6 +3286,13 @@
 }
 
 /**
+ * Add 'jquery-extend-3.4.0.js' to the 'jquery' library.
+ */
+function system_update_7082() {
+  // Empty update to force a rebuild of hook_library() and JS aggregates.
+}
+
+/**
  * @} End of "defgroup updates-7.x-extra".
  * The next series of updates should start at 8000.
  */
diff -Naur drupal-7.51/modules/system/system.mail.inc drupal-7.66/modules/system/system.mail.inc
--- drupal-7.51/modules/system/system.mail.inc	2016-10-05 20:45:42.000000000 +0200
+++ drupal-7.66/modules/system/system.mail.inc	2019-04-17 22:20:46.000000000 +0200
@@ -70,7 +70,9 @@
     // hosts. The return value of this method will still indicate whether mail
     // was sent successfully.
     if (!isset($_SERVER['WINDIR']) && strpos($_SERVER['SERVER_SOFTWARE'], 'Win32') === FALSE) {
-      if (isset($message['Return-Path']) && !ini_get('safe_mode')) {
+      // We validate the return path, unless it is equal to the site mail, which
+      // we assume to be safe.
+      if (isset($message['Return-Path']) && !ini_get('safe_mode') && (variable_get('site_mail', ini_get('sendmail_from')) === $message['Return-Path'] || self::_isShellSafe($message['Return-Path']))) {
         // On most non-Windows systems, the "-f" option to the sendmail command
         // is used to set the Return-Path. There is no space between -f and
         // the value of the return path.
@@ -109,6 +111,36 @@
      }
      return $mail_result;
   }
+
+  /**
+   * Disallows potentially unsafe shell characters.
+   *
+   * Functionally similar to PHPMailer::isShellSafe() which resulted from
+   * CVE-2016-10045. Note that escapeshellarg and escapeshellcmd are inadequate
+   * for this purpose.
+   *
+   * @param string $string
+   *   The string to be validated.
+   *
+   * @return bool
+   *   True if the string is shell-safe.
+   *
+   * @see https://github.com/PHPMailer/PHPMailer/issues/924
+   * @see https://github.com/PHPMailer/PHPMailer/blob/v5.2.21/class.phpmailer.php#L1430
+   *
+   * @todo Rename to ::isShellSafe() and/or discuss whether this is the correct
+   *   location for this helper.
+   */
+  protected static function _isShellSafe($string) {
+    if (escapeshellcmd($string) !== $string || !in_array(escapeshellarg($string), array("'$string'", "\"$string\""))) {
+      return FALSE;
+    }
+    if (preg_match('/[^a-zA-Z0-9@_\-.]/', $string) !== 0) {
+      return FALSE;
+    }
+    return TRUE;
+  }
+
 }
 
 /**
diff -Naur drupal-7.51/modules/system/system.module drupal-7.66/modules/system/system.module
--- drupal-7.51/modules/system/system.module	2016-10-05 20:45:42.000000000 +0200
+++ drupal-7.66/modules/system/system.module	2019-04-17 22:20:46.000000000 +0200
@@ -1182,6 +1182,9 @@
     'version' => '1.4.4',
     'js' => array(
       'misc/jquery.js' => array('group' => JS_LIBRARY, 'weight' => -20),
+      // This includes a security fix, so assign a weight that makes this load
+      // as soon after jquery.js is loaded as possible.
+      'misc/jquery-extend-3.4.0.js' => array('group' => JS_LIBRARY, 'weight' => -19),
     ),
   );
 
@@ -2521,6 +2524,16 @@
 
   // Find theme engines
   $engines = drupal_system_listing('/^' . DRUPAL_PHP_FUNCTION_PATTERN . '\.engine$/', 'themes/engines');
+  // Allow modules to add further theme engines.
+  if ($module_engines = module_invoke_all('system_theme_engine_info')) {
+    foreach ($module_engines as $name => $theme_engine_path) {
+      $engines[$name] = (object) array(
+        'uri' => $theme_engine_path,
+        'filename' => basename($theme_engine_path),
+        'name' => $name,
+      );
+    }
+  }
 
   // Set defaults for theme info.
   $defaults = array(
@@ -2883,7 +2896,7 @@
 
   // Prepare cancel link.
   if (isset($_GET['destination'])) {
-    $options = drupal_parse_url(urldecode($_GET['destination']));
+    $options = drupal_parse_url($_GET['destination']);
   }
   elseif (is_array($path)) {
     $options = $path;
diff -Naur drupal-7.51/modules/system/system.tar.inc drupal-7.66/modules/system/system.tar.inc
--- drupal-7.51/modules/system/system.tar.inc	2016-10-05 20:45:42.000000000 +0200
+++ drupal-7.66/modules/system/system.tar.inc	2019-04-17 22:20:46.000000000 +0200
@@ -41,8 +41,8 @@
 
  /**
  * Note on Drupal 8 porting.
- * This file origin is Tar.php, release 1.4.0 (stable) with some code
- * from PEAR.php, release 1.9.5 (stable) both at http://pear.php.net.
+ * This file origin is Tar.php, release 1.4.5 (stable) with some code
+ * from PEAR.php, release 1.10.5 (stable) both at http://pear.php.net.
  * To simplify future porting from pear of this file, you should not
  * do cosmetic or other non significant changes to this file.
  * The following changes have been done:
@@ -259,6 +259,19 @@
                 return false;
             }
         }
+
+
+        if (version_compare(PHP_VERSION, "5.5.0-dev") < 0) {
+            $this->_fmt = "a100filename/a8mode/a8uid/a8gid/a12size/a12mtime/" .
+                   "a8checksum/a1typeflag/a100link/a6magic/a2version/" .
+                   "a32uname/a32gname/a8devmajor/a8devminor/a131prefix";
+        } else {
+            $this->_fmt = "Z100filename/Z8mode/Z8uid/Z8gid/Z12size/Z12mtime/" .
+                   "Z8checksum/Z1typeflag/Z100link/Z6magic/Z2version/" .
+                   "Z32uname/Z32gname/Z8devmajor/Z8devminor/Z131prefix";
+        }
+
+
     }
 
     public function __destruct()
@@ -278,7 +291,7 @@
     * @param string $ext The extension name
     * @return bool Success or not on the dl() call
     */
-    function loadExtension($ext)
+    public static function loadExtension($ext)
     {
         if (extension_loaded($ext)) {
             return true;
@@ -287,8 +300,7 @@
         // if either returns true dl() will produce a FATAL error, stop that
         if (
             function_exists('dl') === false ||
-            ini_get('enable_dl') != 1 ||
-            ini_get('safe_mode') == 1
+            ini_get('enable_dl') != 1
         ) {
             return false;
         }
@@ -714,7 +726,7 @@
         }
 
         // ----- Get the arguments
-        $v_att_list = & func_get_args();
+        $v_att_list = func_get_args();
 
         // ----- Read the attributes
         $i = 0;
@@ -1394,10 +1406,22 @@
         if ($p_stored_filename == '') {
             $p_stored_filename = $p_filename;
         }
-        $v_reduce_filename = $this->_pathReduction($p_stored_filename);
 
-        if (strlen($v_reduce_filename) > 99) {
-            if (!$this->_writeLongHeader($v_reduce_filename)) {
+        $v_reduced_filename = $this->_pathReduction($p_stored_filename);
+
+        if (strlen($v_reduced_filename) > 99) {
+            if (!$this->_writeLongHeader($v_reduced_filename, false)) {
+                return false;
+            }
+        }
+
+        $v_linkname = '';
+        if (@is_link($p_filename)) {
+            $v_linkname = readlink($p_filename);
+        }
+
+        if (strlen($v_linkname) > 99) {
+            if (!$this->_writeLongHeader($v_linkname, true)) {
                 return false;
             }
         }
@@ -1406,14 +1430,10 @@
         $v_uid = sprintf("%07s", DecOct($v_info[4]));
         $v_gid = sprintf("%07s", DecOct($v_info[5]));
         $v_perms = sprintf("%07s", DecOct($v_info['mode'] & 000777));
-
         $v_mtime = sprintf("%011s", DecOct($v_info['mtime']));
 
-        $v_linkname = '';
-
         if (@is_link($p_filename)) {
             $v_typeflag = '2';
-            $v_linkname = readlink($p_filename);
             $v_size = sprintf("%011s", DecOct(0));
         } elseif (@is_dir($p_filename)) {
             $v_typeflag = "5";
@@ -1425,7 +1445,6 @@
         }
 
         $v_magic = 'ustar ';
-
         $v_version = ' ';
 
         if (function_exists('posix_getpwuid')) {
@@ -1440,14 +1459,12 @@
         }
 
         $v_devmajor = '';
-
         $v_devminor = '';
-
         $v_prefix = '';
 
         $v_binary_data_first = pack(
             "a100a8a8a8a12a12",
-            $v_reduce_filename,
+            $v_reduced_filename,
             $v_perms,
             $v_uid,
             $v_gid,
@@ -1487,7 +1504,7 @@
         $this->_writeBlock($v_binary_data_first, 148);
 
         // ----- Write the calculated checksum
-        $v_checksum = sprintf("%06s ", DecOct($v_checksum));
+        $v_checksum = sprintf("%06s\0 ", DecOct($v_checksum));
         $v_binary_data = pack("a8", $v_checksum);
         $this->_writeBlock($v_binary_data, 8);
 
@@ -1519,7 +1536,7 @@
         $p_filename = $this->_pathReduction($p_filename);
 
         if (strlen($p_filename) > 99) {
-            if (!$this->_writeLongHeader($p_filename)) {
+            if (!$this->_writeLongHeader($p_filename, false)) {
                 return false;
             }
         }
@@ -1615,36 +1632,31 @@
      * @param string $p_filename
      * @return bool
      */
-    public function _writeLongHeader($p_filename)
+    public function _writeLongHeader($p_filename, $is_link = false)
     {
-        $v_size = sprintf("%11s ", DecOct(strlen($p_filename)));
-
-        $v_typeflag = 'L';
-
+        $v_uid = sprintf("%07s", 0);
+        $v_gid = sprintf("%07s", 0);
+        $v_perms = sprintf("%07s", 0);
+        $v_size = sprintf("%'011s", DecOct(strlen($p_filename)));
+        $v_mtime = sprintf("%011s", 0);
+        $v_typeflag = ($is_link ? 'K' : 'L');
         $v_linkname = '';
-
-        $v_magic = '';
-
-        $v_version = '';
-
+        $v_magic = 'ustar ';
+        $v_version = ' ';
         $v_uname = '';
-
         $v_gname = '';
-
         $v_devmajor = '';
-
         $v_devminor = '';
-
         $v_prefix = '';
 
         $v_binary_data_first = pack(
             "a100a8a8a8a12a12",
             '././@LongLink',
-            0,
-            0,
-            0,
+            $v_perms,
+            $v_uid,
+            $v_gid,
             $v_size,
-            0
+            $v_mtime
         );
         $v_binary_data_last = pack(
             "a1a100a6a2a32a32a8a8a155a12",
@@ -1679,7 +1691,7 @@
         $this->_writeBlock($v_binary_data_first, 148);
 
         // ----- Write the calculated checksum
-        $v_checksum = sprintf("%06s ", DecOct($v_checksum));
+        $v_checksum = sprintf("%06s\0 ", DecOct($v_checksum));
         $v_binary_data = pack("a8", $v_checksum);
         $this->_writeBlock($v_binary_data, 8);
 
@@ -1720,28 +1732,13 @@
         // ----- Calculate the checksum
         $v_checksum = 0;
         // ..... First part of the header
-        for ($i = 0; $i < 148; $i++) {
-            $v_checksum += ord(substr($v_binary_data, $i, 1));
-        }
-        // ..... Ignore the checksum value and replace it by ' ' (space)
-        for ($i = 148; $i < 156; $i++) {
-            $v_checksum += ord(' ');
-        }
-        // ..... Last part of the header
-        for ($i = 156; $i < 512; $i++) {
-            $v_checksum += ord(substr($v_binary_data, $i, 1));
-        }
+        $v_binary_split = str_split($v_binary_data);
+        $v_checksum += array_sum(array_map('ord', array_slice($v_binary_split, 0, 148)));
+        $v_checksum += array_sum(array_map('ord', array(' ', ' ', ' ', ' ', ' ', ' ', ' ', ' ',)));
+        $v_checksum += array_sum(array_map('ord', array_slice($v_binary_split, 156, 512)));
 
-        if (version_compare(PHP_VERSION, "5.5.0-dev") < 0) {
-            $fmt = "a100filename/a8mode/a8uid/a8gid/a12size/a12mtime/" .
-                "a8checksum/a1typeflag/a100link/a6magic/a2version/" .
-                "a32uname/a32gname/a8devmajor/a8devminor/a131prefix";
-        } else {
-            $fmt = "Z100filename/Z8mode/Z8uid/Z8gid/Z12size/Z12mtime/" .
-                "Z8checksum/Z1typeflag/Z100link/Z6magic/Z2version/" .
-                "Z32uname/Z32gname/Z8devmajor/Z8devminor/Z131prefix";
-        }
-        $v_data = unpack($fmt, $v_binary_data);
+
+        $v_data = unpack($this->_fmt, $v_binary_data);
 
         if (strlen($v_data["prefix"]) > 0) {
             $v_data["filename"] = "$v_data[prefix]/$v_data[filename]";
@@ -1777,7 +1774,7 @@
         $v_header['mode'] = OctDec(trim($v_data['mode']));
         $v_header['uid'] = OctDec(trim($v_data['uid']));
         $v_header['gid'] = OctDec(trim($v_data['gid']));
-        $v_header['size'] = OctDec(trim($v_data['size']));
+        $v_header['size'] = $this->_tarRecToSize($v_data['size']);
         $v_header['mtime'] = OctDec(trim($v_data['mtime']));
         if (($v_header['typeflag'] = $v_data['typeflag']) == "5") {
             $v_header['size'] = 0;
@@ -1797,6 +1794,40 @@
     }
 
     /**
+     * Convert Tar record size to actual size
+     *
+     * @param string $tar_size
+     * @return size of tar record in bytes
+     */
+    private function _tarRecToSize($tar_size)
+    {
+        /*
+         * First byte of size has a special meaning if bit 7 is set.
+         *
+         * Bit 7 indicates base-256 encoding if set.
+         * Bit 6 is the sign bit.
+         * Bits 5:0 are most significant value bits.
+         */
+        $ch = ord($tar_size[0]);
+        if ($ch & 0x80) {
+            // Full 12-bytes record is required.
+            $rec_str = $tar_size . "\x00";
+
+            $size = ($ch & 0x40) ? -1 : 0;
+            $size = ($size << 6) | ($ch & 0x3f);
+
+            for ($num_ch = 1; $num_ch < 12; ++$num_ch) {
+                $size = ($size * 256) + ord($rec_str[$num_ch]);
+            }
+
+            return $size;
+
+        } else {
+            return OctDec(trim($tar_size));
+        }
+    }
+
+    /**
      * Detect and report a malicious file name
      *
      * @param string $file
@@ -1805,10 +1836,13 @@
      */
     private function _maliciousFilename($file)
     {
-        if (strpos($file, '/../') !== false) {
+        if (strpos($file, 'phar://') === 0) {
+            return true;
+        }
+        if (strpos($file, DIRECTORY_SEPARATOR . '..' . DIRECTORY_SEPARATOR) !== false) {
             return true;
         }
-        if (strpos($file, '../') === 0) {
+        if (strpos($file, '..' . DIRECTORY_SEPARATOR) === 0) {
             return true;
         }
         return false;
@@ -1873,11 +1907,20 @@
                 continue;
             }
 
-            // ----- Look for long filename
-            if ($v_header['typeflag'] == 'L') {
-                if (!$this->_readLongHeader($v_header)) {
-                    return null;
-                }
+            switch ($v_header['typeflag']) {
+                case 'L': {
+                    if (!$this->_readLongHeader($v_header)) {
+                        return null;
+                    }
+                } break;
+
+                case 'K': {
+                    $v_link_header = $v_header;
+                    if (!$this->_readLongHeader($v_link_header)) {
+                        return null;
+                    }
+                    $v_header['link'] = $v_link_header['filename'];
+                } break;
             }
 
             if ($v_header['filename'] == $p_filename) {
@@ -1978,11 +2021,20 @@
                 continue;
             }
 
-            // ----- Look for long filename
-            if ($v_header['typeflag'] == 'L') {
-                if (!$this->_readLongHeader($v_header)) {
-                    return false;
-                }
+            switch ($v_header['typeflag']) {
+                case 'L': {
+                    if (!$this->_readLongHeader($v_header)) {
+                        return null;
+                    }
+                } break;
+
+                case 'K': {
+                    $v_link_header = $v_header;
+                    if (!$this->_readLongHeader($v_link_header)) {
+                        return null;
+                    }
+                    $v_header['link'] = $v_link_header['filename'];
+                } break;
             }
 
             // ignore extended / pax headers
diff -Naur drupal-7.51/modules/system/system.test drupal-7.66/modules/system/system.test
--- drupal-7.51/modules/system/system.test	2016-10-05 20:45:42.000000000 +0200
+++ drupal-7.66/modules/system/system.test	2019-04-17 22:20:46.000000000 +0200
@@ -1461,6 +1461,60 @@
   }
 }
 
+/**
+ * Tests date format configuration.
+ */
+class DateFormatTestCase extends DrupalWebTestCase {
+  public static function getInfo() {
+    return array(
+      'name' => 'Date format',
+      'description' => 'Test date format configuration and defaults.',
+      'group' => 'System',
+    );
+  }
+
+  function setUp() {
+    parent::setUp();
+
+    // Create admin user and log in admin user.
+    $this->admin_user = $this->drupalCreateUser(array('administer site configuration'));
+    $this->drupalLogin($this->admin_user);
+  }
+
+  /**
+   * Test the default date type formats are consistent.
+   */
+  function testDefaultDateFormats() {
+    // These are the default format values from format_date().
+    $default_formats = array(
+      'short' => 'm/d/Y - H:i',
+      'medium' => 'D, m/d/Y - H:i',
+      'long' => 'l, F j, Y - H:i',
+    );
+
+    // Clear the date format variables.
+    variable_del('date_format_short');
+    variable_del('date_format_medium');
+    variable_del('date_format_long');
+
+    $this->drupalGet('admin/config/regional/date-time');
+
+    foreach ($default_formats as $format_name => $format_value) {
+      $id = 'edit-date-format-' . $format_name;
+      // Check that the configuration fields match the default format.
+      $this->assertOptionSelected(
+        $id,
+        $format_value,
+        format_string('The @type format type matches the expected format @format.',
+        array(
+          '@type' => $format_name,
+          '@format' => $format_value,
+        )
+      ));
+    }
+  }
+}
+
 class PageTitleFiltering extends DrupalWebTestCase {
   protected $content_user;
   protected $saved_title;
@@ -1890,6 +1944,30 @@
     $this->assertEqual($elements[0]['src'], file_create_url($uploaded_filename));
   }
 
+
+  /**
+   * Test the individual per-theme settings form.
+   */
+  function testPerThemeSettings() {
+    // Enable the test theme and the module that controls it. Clear caches in
+    // between so that the module's hook_system_theme_info() implementation is
+    // correctly registered.
+    module_enable(array('theme_test'));
+    drupal_flush_all_caches();
+    theme_enable(array('test_theme'));
+
+    // Test that the theme-specific settings form can be saved and that the
+    // theme-specific checkbox is checked and unchecked as appropriate.
+    $this->drupalGet('admin/appearance/settings/test_theme');
+    $this->assertNoFieldChecked('edit-test-theme-checkbox', 'The test_theme_checkbox setting is unchecked.');
+    $this->drupalPost(NULL, array('test_theme_checkbox' => TRUE), t('Save configuration'));
+    $this->assertText('The test theme setting was saved.');
+    $this->assertFieldChecked('edit-test-theme-checkbox', 'The test_theme_checkbox setting is checked.');
+    $this->drupalPost(NULL, array('test_theme_checkbox' => FALSE), t('Save configuration'));
+    $this->assertText('The test theme setting was saved.');
+    $this->assertNoFieldChecked('edit-test-theme-checkbox', 'The test_theme_checkbox setting is unchecked.');
+  }
+
   /**
    * Test the administration theme functionality.
    */
diff -Naur drupal-7.51/modules/system/tests/cron_queue_test.info drupal-7.66/modules/system/tests/cron_queue_test.info
--- drupal-7.51/modules/system/tests/cron_queue_test.info	2016-10-05 21:02:54.000000000 +0200
+++ drupal-7.66/modules/system/tests/cron_queue_test.info	2019-04-17 22:39:36.000000000 +0200
@@ -5,8 +5,7 @@
 core = 7.x
 hidden = TRUE
 
-; Information added by Drupal.org packaging script on 2016-10-05
-version = "7.51"
+; Information added by Drupal.org packaging script on 2019-04-17
+version = "7.66"
 project = "drupal"
-datestamp = "1475694174"
-
+datestamp = "1555533576"
diff -Naur drupal-7.51/modules/system/tests/system_cron_test.info drupal-7.66/modules/system/tests/system_cron_test.info
--- drupal-7.51/modules/system/tests/system_cron_test.info	2016-10-05 21:02:54.000000000 +0200
+++ drupal-7.66/modules/system/tests/system_cron_test.info	2019-04-17 22:39:36.000000000 +0200
@@ -5,8 +5,7 @@
 core = 7.x
 hidden = TRUE
 
-; Information added by Drupal.org packaging script on 2016-10-05
-version = "7.51"
+; Information added by Drupal.org packaging script on 2019-04-17
+version = "7.66"
 project = "drupal"
-datestamp = "1475694174"
-
+datestamp = "1555533576"
diff -Naur drupal-7.51/modules/taxonomy/taxonomy.info drupal-7.66/modules/taxonomy/taxonomy.info
--- drupal-7.51/modules/taxonomy/taxonomy.info	2016-10-05 21:02:54.000000000 +0200
+++ drupal-7.66/modules/taxonomy/taxonomy.info	2019-04-17 22:39:36.000000000 +0200
@@ -8,8 +8,7 @@
 files[] = taxonomy.test
 configure = admin/structure/taxonomy
 
-; Information added by Drupal.org packaging script on 2016-10-05
-version = "7.51"
+; Information added by Drupal.org packaging script on 2019-04-17
+version = "7.66"
 project = "drupal"
-datestamp = "1475694174"
-
+datestamp = "1555533576"
diff -Naur drupal-7.51/modules/taxonomy/taxonomy.module drupal-7.66/modules/taxonomy/taxonomy.module
--- drupal-7.51/modules/taxonomy/taxonomy.module	2016-10-05 20:45:42.000000000 +0200
+++ drupal-7.66/modules/taxonomy/taxonomy.module	2019-04-17 22:20:46.000000000 +0200
@@ -283,6 +283,8 @@
     'title' => 'Taxonomy term',
     'title callback' => 'taxonomy_term_title',
     'title arguments' => array(2),
+    // The page callback also invokes drupal_set_title() in case
+    // the menu router's title is overridden by a menu link.
     'page callback' => 'taxonomy_term_page',
     'page arguments' => array(2),
     'access arguments' => array('access content'),
@@ -1023,7 +1025,7 @@
     $query->join('taxonomy_term_hierarchy', 'h', 'h.parent = t.tid');
     $query->addField('t', 'tid');
     $query->condition('h.tid', $tid);
-    $query->addTag('term_access');
+    $query->addTag('taxonomy_term_access');
     $query->orderBy('t.weight');
     $query->orderBy('t.name');
     $tids = $query->execute()->fetchCol();
@@ -1081,7 +1083,7 @@
     if ($vid) {
       $query->condition('t.vid', $vid);
     }
-    $query->addTag('term_access');
+    $query->addTag('taxonomy_term_access');
     $query->orderBy('t.weight');
     $query->orderBy('t.name');
     $tids = $query->execute()->fetchCol();
@@ -1129,7 +1131,7 @@
     $query->join('taxonomy_term_hierarchy', 'h', 'h.tid = t.tid');
     $result = $query
       ->addTag('translatable')
-      ->addTag('term_access')
+      ->addTag('taxonomy_term_access')
       ->fields('t')
       ->fields('h', array('parent'))
       ->condition('t.vid', $vid)
@@ -1249,7 +1251,7 @@
   protected function buildQuery($ids, $conditions = array(), $revision_id = FALSE) {
     $query = parent::buildQuery($ids, $conditions, $revision_id);
     $query->addTag('translatable');
-    $query->addTag('term_access');
+    $query->addTag('taxonomy_term_access');
     // When name is passed as a condition use LIKE.
     if (isset($conditions['name'])) {
       $query_conditions = &$query->conditions();
@@ -1714,13 +1716,15 @@
 }
 
 /**
- * Title callback for term pages.
+ * Title callback: Returns the title of the taxonomy term.
  *
  * @param $term
  *   A term object.
  *
  * @return
- *   The term name to be used as the page title.
+ *   An unsanitized string that is the title of the taxonomy term.
+ *
+ * @see taxonomy_menu()
  */
 function taxonomy_term_title($term) {
   return $term->name;
diff -Naur drupal-7.51/modules/taxonomy/taxonomy.pages.inc drupal-7.66/modules/taxonomy/taxonomy.pages.inc
--- drupal-7.51/modules/taxonomy/taxonomy.pages.inc	2016-10-05 20:45:42.000000000 +0200
+++ drupal-7.66/modules/taxonomy/taxonomy.pages.inc	2019-04-17 22:20:46.000000000 +0200
@@ -150,7 +150,7 @@
 
     $query = db_select('taxonomy_term_data', 't');
     $query->addTag('translatable');
-    $query->addTag('term_access');
+    $query->addTag('taxonomy_term_access');
 
     // Do not select already entered terms.
     if (!empty($tags_typed)) {
diff -Naur drupal-7.51/modules/taxonomy/taxonomy.test drupal-7.66/modules/taxonomy/taxonomy.test
--- drupal-7.51/modules/taxonomy/taxonomy.test	2016-10-05 20:45:42.000000000 +0200
+++ drupal-7.66/modules/taxonomy/taxonomy.test	2019-04-17 22:20:46.000000000 +0200
@@ -1983,3 +1983,113 @@
   }
 
 }
+
+/**
+ * Tests that appropriate query tags are added.
+ */
+class TaxonomyQueryAlterTestCase extends TaxonomyWebTestCase {
+  public static function getInfo() {
+    return array(
+      'name' => 'Taxonomy query tags',
+      'description' => 'Verifies that taxonomy_term_access tags are added to queries.',
+      'group' => 'Taxonomy',
+    );
+  }
+
+  public function setUp() {
+    parent::setUp('taxonomy_test');
+  }
+
+  /**
+   * Tests that appropriate tags are added when querying the database.
+   */
+  public function testTaxonomyQueryAlter() {
+    // Create a new vocabulary and add a few terms to it.
+    $vocabulary = $this->createVocabulary();
+    $terms = array();
+    for ($i = 0; $i < 5; $i++) {
+      $terms[$i] = $this->createTerm($vocabulary);
+    }
+
+    // Set up hierarchy. Term 2 is a child of 1.
+    $terms[2]->parent = array($terms[1]->tid);
+    taxonomy_term_save($terms[2]);
+
+    $this->setupQueryTagTestHooks();
+    $loaded_term = taxonomy_term_load($terms[0]->tid);
+    $this->assertEqual($loaded_term->tid, $terms[0]->tid, 'First term was loaded');
+    $this->assertQueryTagTestResult(1, 'taxonomy_term_load()');
+
+    $this->setupQueryTagTestHooks();
+    $loaded_terms = taxonomy_get_tree($vocabulary->vid);
+    $this->assertEqual(count($loaded_terms), count($terms), 'All terms were loaded');
+    $this->assertQueryTagTestResult(1, 'taxonomy_get_tree()');
+
+    $this->setupQueryTagTestHooks();
+    $loaded_terms = taxonomy_get_parents($terms[2]->tid);
+    $this->assertEqual(count($loaded_terms), 1, 'All parent terms were loaded');
+    $this->assertQueryTagTestResult(2, 'taxonomy_get_parents()');
+
+    $this->setupQueryTagTestHooks();
+    $loaded_terms = taxonomy_get_children($terms[1]->tid);
+    $this->assertEqual(count($loaded_terms), 1, 'All child terms were loaded');
+    $this->assertQueryTagTestResult(2, 'taxonomy_get_children()');
+
+    $this->setupQueryTagTestHooks();
+    $query = db_select('taxonomy_term_data', 't');
+    $query->addField('t', 'tid');
+    $query->addTag('taxonomy_term_access');
+    $tids = $query->execute()->fetchCol();
+    $this->assertEqual(count($tids), count($terms), 'All term IDs were retrieved');
+    $this->assertQueryTagTestResult(1, 'custom db_select() with taxonomy_term_access tag (preferred)');
+
+    $this->setupQueryTagTestHooks();
+    $query = db_select('taxonomy_term_data', 't');
+    $query->addField('t', 'tid');
+    $query->addTag('term_access');
+    $tids = $query->execute()->fetchCol();
+    $this->assertEqual(count($tids), count($terms), 'All term IDs were retrieved');
+    $this->assertQueryTagTestResult(1, 'custom db_select() with term_access tag (deprecated)');
+
+    $this->setupQueryTagTestHooks();
+    $query = new EntityFieldQuery();
+    $query->entityCondition('entity_type', 'taxonomy_term');
+    $query->addTag('taxonomy_term_access');
+    $result = $query->execute();
+    $this->assertEqual(count($result['taxonomy_term']), count($terms), 'All term IDs were retrieved');
+    $this->assertQueryTagTestResult(1, 'custom EntityFieldQuery with taxonomy_term_access tag (preferred)');
+
+    $this->setupQueryTagTestHooks();
+    $query = new EntityFieldQuery();
+    $query->entityCondition('entity_type', 'taxonomy_term');
+    $query->addTag('term_access');
+    $result = $query->execute();
+    $this->assertEqual(count($result['taxonomy_term']), count($terms), 'All term IDs were retrieved');
+    $this->assertQueryTagTestResult(1, 'custom EntityFieldQuery with term_access tag (deprecated)');
+  }
+
+  /**
+   * Sets up the hooks in the test module.
+   */
+  protected function setupQueryTagTestHooks() {
+    taxonomy_terms_static_reset();
+    variable_set('taxonomy_test_query_alter', 0);
+    variable_set('taxonomy_test_query_term_access_alter', 0);
+    variable_set('taxonomy_test_query_taxonomy_term_access_alter', 0);
+  }
+
+  /**
+   * Verifies invocation of the hooks in the test module.
+   *
+   * @param int $expected_invocations
+   *   The number of times the hooks are expected to have been invoked.
+   * @param string $method
+   *   A string describing the invoked function which generated the query.
+   */
+  protected function assertQueryTagTestResult($expected_invocations, $method) {
+    $this->assertIdentical($expected_invocations, variable_get('taxonomy_test_query_alter'), 'hook_query_alter() invoked when executing ' . $method);
+    $this->assertIdentical($expected_invocations, variable_get('taxonomy_test_query_term_access_alter'), 'Deprecated hook_query_term_access_alter() invoked when executing ' . $method);
+    $this->assertIdentical($expected_invocations, variable_get('taxonomy_test_query_taxonomy_term_access_alter'), 'Preferred hook_query_taxonomy_term_access_alter() invoked when executing ' . $method);
+  }
+
+}
diff -Naur drupal-7.51/modules/toolbar/toolbar.info drupal-7.66/modules/toolbar/toolbar.info
--- drupal-7.51/modules/toolbar/toolbar.info	2016-10-05 21:02:54.000000000 +0200
+++ drupal-7.66/modules/toolbar/toolbar.info	2019-04-17 22:39:36.000000000 +0200
@@ -4,8 +4,7 @@
 package = Core
 version = VERSION
 
-; Information added by Drupal.org packaging script on 2016-10-05
-version = "7.51"
+; Information added by Drupal.org packaging script on 2019-04-17
+version = "7.66"
 project = "drupal"
-datestamp = "1475694174"
-
+datestamp = "1555533576"
diff -Naur drupal-7.51/modules/tracker/tracker.info drupal-7.66/modules/tracker/tracker.info
--- drupal-7.51/modules/tracker/tracker.info	2016-10-05 21:02:54.000000000 +0200
+++ drupal-7.66/modules/tracker/tracker.info	2019-04-17 22:39:36.000000000 +0200
@@ -6,8 +6,7 @@
 core = 7.x
 files[] = tracker.test
 
-; Information added by Drupal.org packaging script on 2016-10-05
-version = "7.51"
+; Information added by Drupal.org packaging script on 2019-04-17
+version = "7.66"
 project = "drupal"
-datestamp = "1475694174"
-
+datestamp = "1555533576"
diff -Naur drupal-7.51/modules/translation/tests/translation_test.info drupal-7.66/modules/translation/tests/translation_test.info
--- drupal-7.51/modules/translation/tests/translation_test.info	2016-10-05 21:02:54.000000000 +0200
+++ drupal-7.66/modules/translation/tests/translation_test.info	2019-04-17 22:39:36.000000000 +0200
@@ -5,8 +5,7 @@
 version = VERSION
 hidden = TRUE
 
-; Information added by Drupal.org packaging script on 2016-10-05
-version = "7.51"
+; Information added by Drupal.org packaging script on 2019-04-17
+version = "7.66"
 project = "drupal"
-datestamp = "1475694174"
-
+datestamp = "1555533576"
diff -Naur drupal-7.51/modules/translation/translation.info drupal-7.66/modules/translation/translation.info
--- drupal-7.51/modules/translation/translation.info	2016-10-05 21:02:54.000000000 +0200
+++ drupal-7.66/modules/translation/translation.info	2019-04-17 22:39:36.000000000 +0200
@@ -6,8 +6,7 @@
 core = 7.x
 files[] = translation.test
 
-; Information added by Drupal.org packaging script on 2016-10-05
-version = "7.51"
+; Information added by Drupal.org packaging script on 2019-04-17
+version = "7.66"
 project = "drupal"
-datestamp = "1475694174"
-
+datestamp = "1555533576"
diff -Naur drupal-7.51/modules/trigger/tests/trigger_test.info drupal-7.66/modules/trigger/tests/trigger_test.info
--- drupal-7.51/modules/trigger/tests/trigger_test.info	2016-10-05 21:02:54.000000000 +0200
+++ drupal-7.66/modules/trigger/tests/trigger_test.info	2019-04-17 22:39:36.000000000 +0200
@@ -4,8 +4,7 @@
 core = 7.x
 hidden = TRUE
 
-; Information added by Drupal.org packaging script on 2016-10-05
-version = "7.51"
+; Information added by Drupal.org packaging script on 2019-04-17
+version = "7.66"
 project = "drupal"
-datestamp = "1475694174"
-
+datestamp = "1555533576"
diff -Naur drupal-7.51/modules/trigger/trigger.info drupal-7.66/modules/trigger/trigger.info
--- drupal-7.51/modules/trigger/trigger.info	2016-10-05 21:02:54.000000000 +0200
+++ drupal-7.66/modules/trigger/trigger.info	2019-04-17 22:39:36.000000000 +0200
@@ -6,8 +6,7 @@
 files[] = trigger.test
 configure = admin/structure/trigger
 
-; Information added by Drupal.org packaging script on 2016-10-05
-version = "7.51"
+; Information added by Drupal.org packaging script on 2019-04-17
+version = "7.66"
 project = "drupal"
-datestamp = "1475694174"
-
+datestamp = "1555533576"
diff -Naur drupal-7.51/modules/update/tests/aaa_update_test.info drupal-7.66/modules/update/tests/aaa_update_test.info
--- drupal-7.51/modules/update/tests/aaa_update_test.info	2016-10-05 21:02:54.000000000 +0200
+++ drupal-7.66/modules/update/tests/aaa_update_test.info	2019-04-17 22:39:36.000000000 +0200
@@ -4,8 +4,7 @@
 core = 7.x
 hidden = TRUE
 
-; Information added by Drupal.org packaging script on 2016-10-05
-version = "7.51"
+; Information added by Drupal.org packaging script on 2019-04-17
+version = "7.66"
 project = "drupal"
-datestamp = "1475694174"
-
+datestamp = "1555533576"
diff -Naur drupal-7.51/modules/update/tests/bbb_update_test.info drupal-7.66/modules/update/tests/bbb_update_test.info
--- drupal-7.51/modules/update/tests/bbb_update_test.info	2016-10-05 21:02:54.000000000 +0200
+++ drupal-7.66/modules/update/tests/bbb_update_test.info	2019-04-17 22:39:36.000000000 +0200
@@ -4,8 +4,7 @@
 core = 7.x
 hidden = TRUE
 
-; Information added by Drupal.org packaging script on 2016-10-05
-version = "7.51"
+; Information added by Drupal.org packaging script on 2019-04-17
+version = "7.66"
 project = "drupal"
-datestamp = "1475694174"
-
+datestamp = "1555533576"
diff -Naur drupal-7.51/modules/update/tests/ccc_update_test.info drupal-7.66/modules/update/tests/ccc_update_test.info
--- drupal-7.51/modules/update/tests/ccc_update_test.info	2016-10-05 21:02:54.000000000 +0200
+++ drupal-7.66/modules/update/tests/ccc_update_test.info	2019-04-17 22:39:36.000000000 +0200
@@ -4,8 +4,7 @@
 core = 7.x
 hidden = TRUE
 
-; Information added by Drupal.org packaging script on 2016-10-05
-version = "7.51"
+; Information added by Drupal.org packaging script on 2019-04-17
+version = "7.66"
 project = "drupal"
-datestamp = "1475694174"
-
+datestamp = "1555533576"
diff -Naur drupal-7.51/modules/update/tests/themes/update_test_admintheme/update_test_admintheme.info drupal-7.66/modules/update/tests/themes/update_test_admintheme/update_test_admintheme.info
--- drupal-7.51/modules/update/tests/themes/update_test_admintheme/update_test_admintheme.info	2016-10-05 21:02:54.000000000 +0200
+++ drupal-7.66/modules/update/tests/themes/update_test_admintheme/update_test_admintheme.info	2019-04-17 22:39:36.000000000 +0200
@@ -3,8 +3,7 @@
 core = 7.x
 hidden = TRUE
 
-; Information added by Drupal.org packaging script on 2016-10-05
-version = "7.51"
+; Information added by Drupal.org packaging script on 2019-04-17
+version = "7.66"
 project = "drupal"
-datestamp = "1475694174"
-
+datestamp = "1555533576"
diff -Naur drupal-7.51/modules/update/tests/themes/update_test_basetheme/update_test_basetheme.info drupal-7.66/modules/update/tests/themes/update_test_basetheme/update_test_basetheme.info
--- drupal-7.51/modules/update/tests/themes/update_test_basetheme/update_test_basetheme.info	2016-10-05 21:02:54.000000000 +0200
+++ drupal-7.66/modules/update/tests/themes/update_test_basetheme/update_test_basetheme.info	2019-04-17 22:39:36.000000000 +0200
@@ -3,8 +3,7 @@
 core = 7.x
 hidden = TRUE
 
-; Information added by Drupal.org packaging script on 2016-10-05
-version = "7.51"
+; Information added by Drupal.org packaging script on 2019-04-17
+version = "7.66"
 project = "drupal"
-datestamp = "1475694174"
-
+datestamp = "1555533576"
diff -Naur drupal-7.51/modules/update/tests/themes/update_test_subtheme/update_test_subtheme.info drupal-7.66/modules/update/tests/themes/update_test_subtheme/update_test_subtheme.info
--- drupal-7.51/modules/update/tests/themes/update_test_subtheme/update_test_subtheme.info	2016-10-05 21:02:54.000000000 +0200
+++ drupal-7.66/modules/update/tests/themes/update_test_subtheme/update_test_subtheme.info	2019-04-17 22:39:36.000000000 +0200
@@ -4,8 +4,7 @@
 base theme = update_test_basetheme
 hidden = TRUE
 
-; Information added by Drupal.org packaging script on 2016-10-05
-version = "7.51"
+; Information added by Drupal.org packaging script on 2019-04-17
+version = "7.66"
 project = "drupal"
-datestamp = "1475694174"
-
+datestamp = "1555533576"
diff -Naur drupal-7.51/modules/update/tests/update_test.info drupal-7.66/modules/update/tests/update_test.info
--- drupal-7.51/modules/update/tests/update_test.info	2016-10-05 21:02:54.000000000 +0200
+++ drupal-7.66/modules/update/tests/update_test.info	2019-04-17 22:39:36.000000000 +0200
@@ -5,8 +5,7 @@
 core = 7.x
 hidden = TRUE
 
-; Information added by Drupal.org packaging script on 2016-10-05
-version = "7.51"
+; Information added by Drupal.org packaging script on 2019-04-17
+version = "7.66"
 project = "drupal"
-datestamp = "1475694174"
-
+datestamp = "1555533576"
diff -Naur drupal-7.51/modules/update/update.info drupal-7.66/modules/update/update.info
--- drupal-7.51/modules/update/update.info	2016-10-05 21:02:54.000000000 +0200
+++ drupal-7.66/modules/update/update.info	2019-04-17 22:39:36.000000000 +0200
@@ -6,8 +6,7 @@
 files[] = update.test
 configure = admin/reports/updates/settings
 
-; Information added by Drupal.org packaging script on 2016-10-05
-version = "7.51"
+; Information added by Drupal.org packaging script on 2019-04-17
+version = "7.66"
 project = "drupal"
-datestamp = "1475694174"
-
+datestamp = "1555533576"
diff -Naur drupal-7.51/modules/user/tests/user_form_test.info drupal-7.66/modules/user/tests/user_form_test.info
--- drupal-7.51/modules/user/tests/user_form_test.info	2016-10-05 21:02:54.000000000 +0200
+++ drupal-7.66/modules/user/tests/user_form_test.info	2019-04-17 22:39:36.000000000 +0200
@@ -5,8 +5,7 @@
 core = 7.x
 hidden = TRUE
 
-; Information added by Drupal.org packaging script on 2016-10-05
-version = "7.51"
+; Information added by Drupal.org packaging script on 2019-04-17
+version = "7.66"
 project = "drupal"
-datestamp = "1475694174"
-
+datestamp = "1555533576"
diff -Naur drupal-7.51/modules/user/user.info drupal-7.66/modules/user/user.info
--- drupal-7.51/modules/user/user.info	2016-10-05 21:02:54.000000000 +0200
+++ drupal-7.66/modules/user/user.info	2019-04-17 22:39:36.000000000 +0200
@@ -9,8 +9,7 @@
 configure = admin/config/people
 stylesheets[all][] = user.css
 
-; Information added by Drupal.org packaging script on 2016-10-05
-version = "7.51"
+; Information added by Drupal.org packaging script on 2019-04-17
+version = "7.66"
 project = "drupal"
-datestamp = "1475694174"
-
+datestamp = "1555533576"
diff -Naur drupal-7.51/modules/user/user.module drupal-7.66/modules/user/user.module
--- drupal-7.51/modules/user/user.module	2016-10-05 20:45:42.000000000 +0200
+++ drupal-7.66/modules/user/user.module	2019-04-17 22:20:46.000000000 +0200
@@ -637,7 +637,7 @@
   if (strpos($name, '  ') !== FALSE) {
     return t('The username cannot contain multiple spaces in a row.');
   }
-  if (preg_match('/[^\x{80}-\x{F7} a-z0-9@_.\'-]/i', $name)) {
+  if (preg_match('/[^\x{80}-\x{F7} a-z0-9@+_.\'-]/i', $name)) {
     return t('The username contains an illegal character.');
   }
   if (preg_match('/[\x{80}-\x{A0}' .         // Non-printable ISO-8859-1 + NBSP
@@ -689,7 +689,7 @@
   $validators = array(
     'file_validate_is_image' => array(),
     'file_validate_image_resolution' => array(variable_get('user_picture_dimensions', '85x85')),
-    'file_validate_size' => array(variable_get('user_picture_file_size', '30') * 1024),
+    'file_validate_size' => array((int) variable_get('user_picture_file_size', '30') * 1024),
   );
 
   // Save the file as a temporary file.
@@ -1088,13 +1088,16 @@
       '#description' => t('To change the current user password, enter the new password in both fields.'),
     );
     // To skip the current password field, the user must have logged in via a
-    // one-time link and have the token in the URL.
-    $pass_reset = isset($_SESSION['pass_reset_' . $account->uid]) && isset($_GET['pass-reset-token']) && ($_GET['pass-reset-token'] == $_SESSION['pass_reset_' . $account->uid]);
+    // one-time link and have the token in the URL. Store this in $form_state
+    // so it persists even on subsequent Ajax requests.
+    if (!isset($form_state['user_pass_reset'])) {
+      $form_state['user_pass_reset'] = isset($_SESSION['pass_reset_' . $account->uid]) && isset($_GET['pass-reset-token']) && ($_GET['pass-reset-token'] == $_SESSION['pass_reset_' . $account->uid]);
+    }
     $protected_values = array();
     $current_pass_description = '';
     // The user may only change their own password without their current
     // password if they logged in via a one-time login link.
-    if (!$pass_reset) {
+    if (!$form_state['user_pass_reset']) {
       $protected_values['mail'] = $form['account']['mail']['#title'];
       $protected_values['pass'] = t('Password');
       $request_new = l(t('Request new password'), 'user/password', array('attributes' => array('title' => t('Request new password via e-mail.'))));
diff -Naur drupal-7.51/modules/user/user.test drupal-7.66/modules/user/user.test
--- drupal-7.51/modules/user/user.test	2016-10-05 20:45:42.000000000 +0200
+++ drupal-7.66/modules/user/user.test	2019-04-17 22:20:46.000000000 +0200
@@ -276,6 +276,7 @@
       'foo@example.com'        => array('Valid username', 'assertNull'),
       'foo@-example.com'       => array('Valid username', 'assertNull'), // invalid domains are allowed in usernames
       'þòøÇßªř€'               => array('Valid username', 'assertNull'),
+      'foo+bar'                => array('Valid username', 'assertNull'), // '+' symbol is allowed
       'ᚠᛇᚻ᛫ᛒᛦᚦ'                => array('Valid UTF8 username', 'assertNull'), // runes
       ' foo'                   => array('Invalid username that starts with a space', 'assertNotNull'),
       'foo '                   => array('Invalid username that ends with a space', 'assertNotNull'),
@@ -466,6 +467,19 @@
   }
 
   /**
+   * Retrieves password reset email and extracts the login link.
+   */
+  public function getResetURL() {
+    // Assume the most recent email.
+    $_emails = $this->drupalGetMails();
+    $email = end($_emails);
+    $urls = array();
+    preg_match('#.+user/reset/.+#', $email['body'], $urls);
+
+    return $urls[0];
+  }
+
+  /**
    * Tests password reset functionality.
    */
   function testUserPasswordReset() {
@@ -478,6 +492,49 @@
     $this->drupalPost('user/password', $edit, t('E-mail new password'));
     // Confirm the password reset.
     $this->assertText(t('Further instructions have been sent to your e-mail address.'), 'Password reset instructions mailed message displayed.');
+
+    // Create an image field to enable an Ajax request on the user profile page.
+    $field = array(
+      'field_name' => 'field_avatar',
+      'type' => 'image',
+      'settings' => array(),
+      'cardinality' => 1,
+    );
+    field_create_field($field);
+
+    $instance = array(
+      'field_name' => $field['field_name'],
+      'entity_type' => 'user',
+      'label' => 'Avatar',
+      'bundle' => 'user',
+      'required' => FALSE,
+      'settings' => array(),
+      'widget' => array(
+        'type' => 'image_image',
+        'settings' => array(),
+      ),
+    );
+    field_create_instance($instance);
+
+    $resetURL = $this->getResetURL();
+    $this->drupalGet($resetURL);
+
+    // Check successful login.
+    $this->drupalPost(NULL, NULL, t('Log in'));
+
+    // Make sure the Ajax request from uploading a file does not invalidate the
+    // reset token.
+    $image = current($this->drupalGetTestFiles('image'));
+    $edit = array(
+      'files[field_avatar_und_0]' => drupal_realpath($image->uri),
+    );
+    $this->drupalPostAJAX(NULL, $edit, 'field_avatar_und_0_upload_button');
+
+    // Change the forgotten password.
+    $password = user_password();
+    $edit = array('pass[pass1]' => $password, 'pass[pass2]' => $password);
+    $this->drupalPost(NULL, $edit, t('Save'));
+    $this->assertText(t('The changes have been saved.'), 'Forgotten password changed.');
   }
 
   /**
@@ -1529,7 +1586,13 @@
     // Setup date/time settings for Los Angeles time.
     variable_set('date_default_timezone', 'America/Los_Angeles');
     variable_set('configurable_timezones', 1);
-    variable_set('date_format_medium', 'Y-m-d H:i T');
+
+    // Override the 'medium' date format, which is the default for node
+    // creation time. Since we are testing time zones with Daylight Saving
+    // Time, and need to future proof against changes to the zoneinfo database,
+    // we choose the 'I' format placeholder instead of a human-readable zone
+    // name. With 'I', a 1 means the date is in DST, and 0 if not.
+    variable_set('date_format_medium', 'Y-m-d H:i I');
 
     // Create a user account and login.
     $web_user = $this->drupalCreateUser();
@@ -1547,11 +1610,11 @@
 
     // Confirm date format and time zone.
     $this->drupalGet("node/$node1->nid");
-    $this->assertText('2007-03-09 21:00 PST', 'Date should be PST.');
+    $this->assertText('2007-03-09 21:00 0', 'Date should be PST.');
     $this->drupalGet("node/$node2->nid");
-    $this->assertText('2007-03-11 01:00 PST', 'Date should be PST.');
+    $this->assertText('2007-03-11 01:00 0', 'Date should be PST.');
     $this->drupalGet("node/$node3->nid");
-    $this->assertText('2007-03-20 21:00 PDT', 'Date should be PDT.');
+    $this->assertText('2007-03-20 21:00 1', 'Date should be PDT.');
 
     // Change user time zone to Santiago time.
     $edit = array();
@@ -1562,11 +1625,11 @@
 
     // Confirm date format and time zone.
     $this->drupalGet("node/$node1->nid");
-    $this->assertText('2007-03-10 02:00 CLST', 'Date should be Chile summer time; five hours ahead of PST.');
+    $this->assertText('2007-03-10 02:00 1', 'Date should be Chile summer time; five hours ahead of PST.');
     $this->drupalGet("node/$node2->nid");
-    $this->assertText('2007-03-11 05:00 CLT', 'Date should be Chile time; four hours ahead of PST');
+    $this->assertText('2007-03-11 05:00 0', 'Date should be Chile time; four hours ahead of PST');
     $this->drupalGet("node/$node3->nid");
-    $this->assertText('2007-03-21 00:00 CLT', 'Date should be Chile time; three hours ahead of PDT.');
+    $this->assertText('2007-03-21 00:00 0', 'Date should be Chile time; three hours ahead of PDT.');
   }
 }
 
@@ -2324,7 +2387,13 @@
   }
 
   function testUserSearch() {
+    // Verify that a user without 'administer users' permission cannot search
+    // for users by email address. Additionally, ensure that the username has a
+    // plus sign to ensure searching works with that.
     $user1 = $this->drupalCreateUser(array('access user profiles', 'search content', 'use advanced search'));
+    $edit['name'] = 'foo+bar';
+    $edit['mail'] = $edit['name'] . '@example.com';
+    user_save($user1, $edit);
     $this->drupalLogin($user1);
     $keys = $user1->mail;
     $edit = array('keys' => $keys);
diff -Naur drupal-7.51/profiles/minimal/minimal.info drupal-7.66/profiles/minimal/minimal.info
--- drupal-7.51/profiles/minimal/minimal.info	2016-10-05 21:02:54.000000000 +0200
+++ drupal-7.66/profiles/minimal/minimal.info	2019-04-17 22:39:36.000000000 +0200
@@ -5,8 +5,7 @@
 dependencies[] = block
 dependencies[] = dblog
 
-; Information added by Drupal.org packaging script on 2016-10-05
-version = "7.51"
+; Information added by Drupal.org packaging script on 2019-04-17
+version = "7.66"
 project = "drupal"
-datestamp = "1475694174"
-
+datestamp = "1555533576"
diff -Naur drupal-7.51/profiles/standard/standard.info drupal-7.66/profiles/standard/standard.info
--- drupal-7.51/profiles/standard/standard.info	2016-10-05 21:02:54.000000000 +0200
+++ drupal-7.66/profiles/standard/standard.info	2019-04-17 22:39:36.000000000 +0200
@@ -24,8 +24,7 @@
 dependencies[] = file
 dependencies[] = rdf
 
-; Information added by Drupal.org packaging script on 2016-10-05
-version = "7.51"
+; Information added by Drupal.org packaging script on 2019-04-17
+version = "7.66"
 project = "drupal"
-datestamp = "1475694174"
-
+datestamp = "1555533576"
diff -Naur drupal-7.51/profiles/testing/modules/drupal_system_listing_compatible_test/drupal_system_listing_compatible_test.info drupal-7.66/profiles/testing/modules/drupal_system_listing_compatible_test/drupal_system_listing_compatible_test.info
--- drupal-7.51/profiles/testing/modules/drupal_system_listing_compatible_test/drupal_system_listing_compatible_test.info	2016-10-05 21:02:54.000000000 +0200
+++ drupal-7.66/profiles/testing/modules/drupal_system_listing_compatible_test/drupal_system_listing_compatible_test.info	2019-04-17 22:39:36.000000000 +0200
@@ -6,8 +6,7 @@
 hidden = TRUE
 files[] = drupal_system_listing_compatible_test.test
 
-; Information added by Drupal.org packaging script on 2016-10-05
-version = "7.51"
+; Information added by Drupal.org packaging script on 2019-04-17
+version = "7.66"
 project = "drupal"
-datestamp = "1475694174"
-
+datestamp = "1555533576"
diff -Naur drupal-7.51/profiles/testing/modules/drupal_system_listing_incompatible_test/drupal_system_listing_incompatible_test.info drupal-7.66/profiles/testing/modules/drupal_system_listing_incompatible_test/drupal_system_listing_incompatible_test.info
--- drupal-7.51/profiles/testing/modules/drupal_system_listing_incompatible_test/drupal_system_listing_incompatible_test.info	2016-10-05 21:02:54.000000000 +0200
+++ drupal-7.66/profiles/testing/modules/drupal_system_listing_incompatible_test/drupal_system_listing_incompatible_test.info	2019-04-17 22:39:36.000000000 +0200
@@ -8,8 +8,7 @@
 core = 6.x
 hidden = TRUE
 
-; Information added by Drupal.org packaging script on 2016-10-05
-version = "7.51"
+; Information added by Drupal.org packaging script on 2019-04-17
+version = "7.66"
 project = "drupal"
-datestamp = "1475694174"
-
+datestamp = "1555533576"
diff -Naur drupal-7.51/profiles/testing/testing.info drupal-7.66/profiles/testing/testing.info
--- drupal-7.51/profiles/testing/testing.info	2016-10-05 21:02:54.000000000 +0200
+++ drupal-7.66/profiles/testing/testing.info	2019-04-17 22:39:36.000000000 +0200
@@ -4,8 +4,7 @@
 core = 7.x
 hidden = TRUE
 
-; Information added by Drupal.org packaging script on 2016-10-05
-version = "7.51"
+; Information added by Drupal.org packaging script on 2019-04-17
+version = "7.66"
 project = "drupal"
-datestamp = "1475694174"
-
+datestamp = "1555533576"
diff -Naur drupal-7.51/sites/default/default.settings.php drupal-7.66/sites/default/default.settings.php
--- drupal-7.51/sites/default/default.settings.php	2016-10-05 20:45:42.000000000 +0200
+++ drupal-7.66/sites/default/default.settings.php	2019-04-17 22:20:46.000000000 +0200
@@ -479,6 +479,23 @@
 # $conf['block_cache_bypass_node_grants'] = TRUE;
 
 /**
+ * Expiration of cache_form entries:
+ *
+ * Drupal's Form API stores details of forms in cache_form and these entries are
+ * kept for at least 6 hours by default. Expired entries are cleared by cron.
+ * Busy sites can encounter problems with the cache_form table becoming very
+ * large. It's possible to mitigate this by setting a shorter expiration for
+ * cached forms. In some cases it may be desirable to set a longer cache
+ * expiration, for example to prolong cache_form entries for Ajax forms in
+ * cached HTML.
+ *
+ * @see form_set_cache()
+ * @see system_cron()
+ * @see ajax_get_form()
+ */
+# $conf['form_cache_expiration'] = 21600;
+
+/**
  * String overrides:
  *
  * To override specific strings on your site with or without enabling the Locale
@@ -628,3 +645,17 @@
  * @see drupal_clean_css_identifier()
  */
 # $conf['allow_css_double_underscores'] = TRUE;
+
+/**
+ * The default list of directories that will be ignored by Drupal's file API.
+ *
+ * By default ignore node_modules and bower_components folders to avoid issues
+ * with common frontend tools and recursive scanning of directories looking for
+ * extensions.
+ *
+ * @see file_scan_directory()
+ */
+$conf['file_scan_ignore_directories'] = array(
+  'node_modules',
+  'bower_components',
+);
diff -Naur drupal-7.51/themes/bartik/bartik.info drupal-7.66/themes/bartik/bartik.info
--- drupal-7.51/themes/bartik/bartik.info	2016-10-05 21:02:54.000000000 +0200
+++ drupal-7.66/themes/bartik/bartik.info	2019-04-17 22:39:36.000000000 +0200
@@ -34,8 +34,7 @@
 settings[shortcut_module_link] = 0
 
 
-; Information added by Drupal.org packaging script on 2016-10-05
-version = "7.51"
+; Information added by Drupal.org packaging script on 2019-04-17
+version = "7.66"
 project = "drupal"
-datestamp = "1475694174"
-
+datestamp = "1555533576"
diff -Naur drupal-7.51/themes/garland/garland.info drupal-7.66/themes/garland/garland.info
--- drupal-7.51/themes/garland/garland.info	2016-10-05 21:02:54.000000000 +0200
+++ drupal-7.66/themes/garland/garland.info	2019-04-17 22:39:36.000000000 +0200
@@ -7,8 +7,7 @@
 stylesheets[print][] = print.css
 settings[garland_width] = fluid
 
-; Information added by Drupal.org packaging script on 2016-10-05
-version = "7.51"
+; Information added by Drupal.org packaging script on 2019-04-17
+version = "7.66"
 project = "drupal"
-datestamp = "1475694174"
-
+datestamp = "1555533576"
diff -Naur drupal-7.51/themes/seven/seven.info drupal-7.66/themes/seven/seven.info
--- drupal-7.51/themes/seven/seven.info	2016-10-05 21:02:54.000000000 +0200
+++ drupal-7.66/themes/seven/seven.info	2019-04-17 22:39:36.000000000 +0200
@@ -13,8 +13,7 @@
 regions[sidebar_first] = First sidebar
 regions_hidden[] = sidebar_first
 
-; Information added by Drupal.org packaging script on 2016-10-05
-version = "7.51"
+; Information added by Drupal.org packaging script on 2019-04-17
+version = "7.66"
 project = "drupal"
-datestamp = "1475694174"
-
+datestamp = "1555533576"
diff -Naur drupal-7.51/themes/stark/stark.info drupal-7.66/themes/stark/stark.info
--- drupal-7.51/themes/stark/stark.info	2016-10-05 21:02:54.000000000 +0200
+++ drupal-7.66/themes/stark/stark.info	2019-04-17 22:39:36.000000000 +0200
@@ -5,8 +5,7 @@
 core = 7.x
 stylesheets[all][] = layout.css
 
-; Information added by Drupal.org packaging script on 2016-10-05
-version = "7.51"
+; Information added by Drupal.org packaging script on 2019-04-17
+version = "7.66"
 project = "drupal"
-datestamp = "1475694174"
-
+datestamp = "1555533576"
