Update to Drupal 8.1.2. For more information, see https://www.drupal.org/project/drupal/releases/8.1.2

core/modules/update/src/Form/UpdateManagerInstall.php

@@ -122,8 +122,8 @@ class UpdateManagerInstall extends FormBase {
    * {@inheritdoc}
    */
   public function validateForm(array &$form, FormStateInterface $form_state) {
-    $uploaded_file = $this->getRequest()->files->get('files[project_upload]', NULL, TRUE);
-    if (!($form_state->getValue('project_url') xor !empty($uploaded_file))) {
+    $all_files = $this->getRequest()->files->get('files', []);
+    if (!($form_state->getValue('project_url') xor !empty($all_files['project_upload']))) {
       $form_state->setErrorByName('project_url', $this->t('You must either provide a URL or upload an archive file to install.'));
     }
   }
@@ -219,12 +219,17 @@ class UpdateManagerInstall extends FormBase {
       'local_url' => $project_real_location,
     );
 
+    // This process is inherently difficult to test therefore use a state flag.
+    $test_authorize = FALSE;
+    if (drupal_valid_test_ua()) {
+      $test_authorize = \Drupal::state()->get('test_uploaders_via_prompt', FALSE);
+    }
     // If the owner of the directory we extracted is the same as the owner of
     // our configuration directory (e.g. sites/default) where we're trying to
     // install the code, there's no need to prompt for FTP/SSH credentials.
     // Instead, we instantiate a Drupal\Core\FileTransfer\Local and invoke
     // update_authorize_run_install() directly.
-    if (fileowner($project_real_location) == fileowner($this->sitePath)) {
+    if (fileowner($project_real_location) == fileowner($this->sitePath) && !$test_authorize) {
       $this->moduleHandler->loadInclude('update', 'inc', 'update.authorize');
       $filetransfer = new Local($this->root);
       $response = call_user_func_array('update_authorize_run_install', array_merge(array($filetransfer), $arguments));

core/modules/update/src/Tests/FileTransferAuthorizeFormTest.php

@@ -0,0 +1,58 @@
+<?php
+
+namespace Drupal\update\Tests;
+
+/**
+ * Tests the Update Manager module upload via authorize.php functionality.
+ *
+ * @group update
+ */
+class FileTransferAuthorizeFormTest extends UpdateTestBase {
+
+  /**
+   * Modules to enable.
+   *
+   * @var array
+   */
+  public static $modules = array('update', 'update_test');
+
+  protected function setUp() {
+    parent::setUp();
+    $admin_user = $this->drupalCreateUser(array('administer modules', 'administer software updates', 'administer site configuration'));
+    $this->drupalLogin($admin_user);
+
+    // Create a local cache so the module is not downloaded from drupal.org.
+    $cache_directory = _update_manager_cache_directory(TRUE);
+    $validArchiveFile = __DIR__ . '/../../tests/update_test_new_module/8.x-1.0/update_test_new_module.tar.gz';
+    copy($validArchiveFile, $cache_directory . '/update_test_new_module.tar.gz');
+  }
+
+  /**
+   * Tests the Update Manager module upload via authorize.php functionality.
+   */
+  public function testViaAuthorize() {
+    // Ensure the that we can select which file transfer backend to use.
+    \Drupal::state()->set('test_uploaders_via_prompt', TRUE);
+
+    // Ensure the module does not already exist.
+    $this->drupalGet('admin/modules');
+    $this->assertNoText('Update test new module');
+
+    $edit = [
+      // This project has been cached in the test's setUp() method.
+      'project_url' => 'https://ftp.drupal.org/files/projects/update_test_new_module.tar.gz',
+    ];
+    $this->drupalPostForm('admin/modules/install', $edit, t('Install'));
+    $edit = [
+      'connection_settings[authorize_filetransfer_default]' => 'system_test',
+      'connection_settings[system_test][update_test_username]' => $this->randomMachineName(),
+    ];
+    $this->drupalPostForm(NULL, $edit, t('Continue'));
+    $this->assertText(t('Installation was completed successfully.'));
+
+    // Ensure the module is available to install.
+    $this->drupalGet('admin/modules');
+    $this->assertText('Update test new module');
+  }
+
+}

core/modules/update/src/Tests/UpdateContribTest.php

@@ -345,6 +345,9 @@ class UpdateContribTest extends UpdateTestBase {
     );
     $this->config('update_test.settings')->set('system_info', $system_info)->save();
 
+    // Ensure that the update information is correct before testing.
+    $this->drupalGet('admin/reports/updates');
+
     $xml_mapping = array(
       'drupal' => '0.0',
       'aaa_update_test' => '1_0',

core/modules/update/src/Tests/UpdateCoreTest.php

@@ -65,11 +65,17 @@ class UpdateCoreTest extends UpdateTestBase {
    */
   function testNormalUpdateAvailable() {
     $this->setSystemInfo('8.0.0');
+
+    // Ensure that the update check requires a token.
+    $this->drupalGet('admin/reports/updates/check');
+    $this->assertResponse(403, 'Accessing admin/reports/updates/check without a CSRF token results in access denied.');
+
     foreach (array(0, 1) as $minor_version) {
       foreach (array('-alpha1', '-beta1', '') as $extra_version) {
         $this->refreshUpdateStatus(array('drupal' => "$minor_version.1" . $extra_version));
         $this->standardTests();
-        $this->drupalGet('admin/reports/updates/check');
+        $this->drupalGet('admin/reports/updates');
+        $this->clickLink(t('Check manually'));
         $this->assertNoText(t('Security update required!'));
         $this->assertRaw(\Drupal::l("8.$minor_version.1" . $extra_version, Url::fromUri("http://example.com/drupal-8-$minor_version-1$extra_version-release")), 'Link to release appears.');
         $this->assertRaw(\Drupal::l(t('Download'), Url::fromUri("http://example.com/drupal-8-$minor_version-1$extra_version.tar.gz")), 'Link to download appears.');
@@ -131,7 +137,8 @@ class UpdateCoreTest extends UpdateTestBase {
           $this->setSystemInfo("8.$minor_version.$patch_version" . $extra_version);
           $this->refreshUpdateStatus(array('drupal' => '9'));
           $this->standardTests();
-          $this->drupalGet('admin/reports/updates/check');
+          $this->drupalGet('admin/reports/updates');
+          $this->clickLink(t('Check manually'));
           $this->assertNoText(t('Security update required!'));
           $this->assertRaw(\Drupal::l('9.0.0', Url::fromUri("http://example.com/drupal-9-0-0-release")), 'Link to release appears.');
           $this->assertRaw(\Drupal::l(t('Download'), Url::fromUri("http://example.com/drupal-9-0-0.tar.gz")), 'Link to download appears.');

core/modules/update/src/Tests/UpdateTestBase.php

@@ -67,7 +67,8 @@ abstract class UpdateTestBase extends WebTestBase {
     // Save the map for UpdateTestController::updateTest() to use.
     $this->config('update_test.settings')->set('xml_map', $xml_map)->save();
     // Manually check the update status.
-    $this->drupalGet('admin/reports/updates/check');
+    $this->drupalGet('admin/reports/updates');
+    $this->clickLink(t('Check manually'));
   }
 
   /**
@@ -78,4 +79,5 @@ abstract class UpdateTestBase extends WebTestBase {
     $this->assertRaw(\Drupal::l(t('Drupal'), Url::fromUri('http://example.com/project/drupal')), 'Link to the Drupal project appears.');
     $this->assertNoText(t('No available releases found'));
   }
+
 }

core/modules/update/src/Tests/UpdateUploadTest.php

@@ -30,6 +30,9 @@ class UpdateUploadTest extends UpdateTestBase {
    * Tests upload, extraction, and update of a module.
    */
   public function testUploadModule() {
+    // Ensure that the update information is correct before testing.
+    update_get_available(TRUE);
+
     // Images are not valid archives, so get one and try to install it. We
     // need an extra variable to store the result of drupalGetTestFiles()
     // since reset() takes an argument by reference and passing in a constant

core/modules/update/src/UpdateFetcherInterface.php

@@ -56,4 +56,5 @@ interface UpdateFetcherInterface {
    * @see \Drupal\update\UpdateManager::getProjects()
    */
   public function buildFetchUrl(array $project, $site_key = '');
+
 }

core/modules/update/src/UpdateManagerInterface.php

@@ -98,4 +98,5 @@ interface UpdateManagerInterface {
    *   array when the storage is cleared.
    */
   public function projectStorage($key);
+
 }

core/modules/update/src/UpdateProcessorInterface.php

@@ -78,4 +78,5 @@ interface UpdateProcessorInterface {
    * @see \Drupal\Core\Queue\QueueInterface::deleteItem()
    */
   public function deleteQueueItem($item);
+
 }

core/modules/update/tests/modules/update_test/src/MockFileTransfer.php

@@ -1,31 +0,0 @@
-<?php
-
-namespace Drupal\update_test;
-
-/**
- * Mocks a FileTransfer object to test the settings form functionality.
- */
-class MockFileTransfer {
-
-  /**
-   * Returns a Drupal\update_test\MockFileTransfer object.
-   *
-   * @return \Drupal\update_test\MockFileTransfer
-   *   A new Drupal\update_test\MockFileTransfer object.
-   */
-  public static function factory() {
-    return new FileTransfer();
-  }
-
-  /**
-   * Returns a settings form with a text field to input a username.
-   */
-  public function getSettingsForm() {
-    $form = array();
-    $form['update_test_username'] = array(
-      '#type' => 'textfield',
-      '#title' => t('Update Test Username'),
-    );
-    return $form;
-  }
-}

core/modules/update/tests/modules/update_test/src/TestFileTransferWithSettingsForm.php

@@ -0,0 +1,40 @@
+<?php
+
+namespace Drupal\update_test;
+
+use Drupal\Core\FileTransfer\Local;
+
+/**
+ * Provides an object to test the settings form functionality.
+ *
+ * This class extends \Drupal\Core\FileTransfer\Local to make module install
+ * testing via \Drupal\Core\FileTransfer\Form\FileTransferAuthorizeForm and
+ * authorize.php possible.
+ *
+ * @see \Drupal\update\Tests\FileTransferAuthorizeFormTest
+ */
+class TestFileTransferWithSettingsForm extends Local {
+
+  /**
+   * Returns a Drupal\update_test\TestFileTransferWithSettingsForm object.
+   *
+   * @return \Drupal\update_test\TestFileTransferWithSettingsForm
+   *   A new Drupal\update_test\TestFileTransferWithSettingsForm object.
+   */
+  public static function factory($jail, $settings) {
+    return new static($jail);
+  }
+
+  /**
+   * Returns a settings form with a text field to input a username.
+   */
+  public function getSettingsForm() {
+    $form = array();
+    $form['update_test_username'] = array(
+      '#type' => 'textfield',
+      '#title' => t('Update Test Username'),
+    );
+    return $form;
+  }
+
+}

core/modules/update/tests/modules/update_test/update_test.module

@@ -59,13 +59,13 @@ function update_test_update_status_alter(&$projects) {
  * Implements hook_filetransfer_info().
  */
 function update_test_filetransfer_info() {
-  // Define a mock file transfer method, to ensure that there will always be
-  // at least one method available in the user interface (regardless of the
+  // Define a test file transfer method, to ensure that there will always be at
+  // least one method available in the user interface (regardless of the
   // environment in which the update manager tests are run).
   return array(
     'system_test' => array(
       'title' => t('Update Test FileTransfer'),
-      'class' => 'Drupal\update_test\MockFileTransfer',
+      'class' => 'Drupal\update_test\TestFileTransferWithSettingsForm',
       'weight' => -20,
     ),
   );

core/modules/update/update.install

@@ -148,3 +148,20 @@ function _update_requirement_check($project, $type) {
   $requirement['value'] = \Drupal::l($requirement_label, new Url(_update_manager_access() ? 'update.report_update' : 'update.status'));
   return $requirement;
 }
+
+/**
+ * @addtogroup updates-8.1.x
+ * @{
+ */
+
+/**
+ * Rebuild the router to ensure admin/reports/updates/check has CSRF protection.
+ */
+function update_update_8001() {
+  // Empty update forces a call to drupal_flush_all_caches() which rebuilds the
+  // router.
+}
+
+/**
+ * @} End of "addtogroup updates-8.1.x".
+ */

core/modules/update/update.module

@@ -375,7 +375,6 @@ function update_get_available($refresh = FALSE) {
  *   project.
  *
  * @see \Drupal\update\UpdateFetcher::createFetchTask()
- *
  */
 function update_create_fetch_task($project) {
   \Drupal::service('update.processor')->createFetchTask($project);

core/modules/update/update.routing.yml

@@ -21,6 +21,7 @@ update.manual_status:
     _controller: '\Drupal\update\Controller\UpdateController::updateStatusManually'
   requirements:
     _permission: 'administer site configuration'
+    _csrf_token: 'TRUE'
 
 update.report_install:
   path: '/admin/reports/updates/install'