Update to Drupal 8.1.2. For more information, see https://www.drupal.org/project/drupal/releases/8.1.2

core/modules/update/src/Form/UpdateManagerInstall.php

@@ -122,8 +122,8 @@ class UpdateManagerInstall extends FormBase {
    * {@inheritdoc}
    */
   public function validateForm(array &$form, FormStateInterface $form_state) {
-    $uploaded_file = $this->getRequest()->files->get('files[project_upload]', NULL, TRUE);
-    if (!($form_state->getValue('project_url') xor !empty($uploaded_file))) {
+    $all_files = $this->getRequest()->files->get('files', []);
+    if (!($form_state->getValue('project_url') xor !empty($all_files['project_upload']))) {
       $form_state->setErrorByName('project_url', $this->t('You must either provide a URL or upload an archive file to install.'));
     }
   }
@@ -219,12 +219,17 @@ class UpdateManagerInstall extends FormBase {
       'local_url' => $project_real_location,
     );
 
+    // This process is inherently difficult to test therefore use a state flag.
+    $test_authorize = FALSE;
+    if (drupal_valid_test_ua()) {
+      $test_authorize = \Drupal::state()->get('test_uploaders_via_prompt', FALSE);
+    }
     // If the owner of the directory we extracted is the same as the owner of
     // our configuration directory (e.g. sites/default) where we're trying to
     // install the code, there's no need to prompt for FTP/SSH credentials.
     // Instead, we instantiate a Drupal\Core\FileTransfer\Local and invoke
     // update_authorize_run_install() directly.
-    if (fileowner($project_real_location) == fileowner($this->sitePath)) {
+    if (fileowner($project_real_location) == fileowner($this->sitePath) && !$test_authorize) {
       $this->moduleHandler->loadInclude('update', 'inc', 'update.authorize');
       $filetransfer = new Local($this->root);
       $response = call_user_func_array('update_authorize_run_install', array_merge(array($filetransfer), $arguments));

core/modules/update/src/Tests/FileTransferAuthorizeFormTest.php

@@ -0,0 +1,58 @@
+<?php
+
+namespace Drupal\update\Tests;
+
+/**
+ * Tests the Update Manager module upload via authorize.php functionality.
+ *
+ * @group update
+ */
+class FileTransferAuthorizeFormTest extends UpdateTestBase {
+
+  /**
+   * Modules to enable.
+   *
+   * @var array
+   */
+  public static $modules = array('update', 'update_test');
+
+  protected function setUp() {
+    parent::setUp();
+    $admin_user = $this->drupalCreateUser(array('administer modules', 'administer software updates', 'administer site configuration'));
+    $this->drupalLogin($admin_user);
+
+    // Create a local cache so the module is not downloaded from drupal.org.
+    $cache_directory = _update_manager_cache_directory(TRUE);
+    $validArchiveFile = __DIR__ . '/../../tests/update_test_new_module/8.x-1.0/update_test_new_module.tar.gz';
+    copy($validArchiveFile, $cache_directory . '/update_test_new_module.tar.gz');
+  }
+
+  /**
+   * Tests the Update Manager module upload via authorize.php functionality.
+   */
+  public function testViaAuthorize() {
+    // Ensure the that we can select which file transfer backend to use.
+    \Drupal::state()->set('test_uploaders_via_prompt', TRUE);
+
+    // Ensure the module does not already exist.
+    $this->drupalGet('admin/modules');
+    $this->assertNoText('Update test new module');
+
+    $edit = [
+      // This project has been cached in the test's setUp() method.
+      'project_url' => 'https://ftp.drupal.org/files/projects/update_test_new_module.tar.gz',
+    ];
+    $this->drupalPostForm('admin/modules/install', $edit, t('Install'));
+    $edit = [
+      'connection_settings[authorize_filetransfer_default]' => 'system_test',
+      'connection_settings[system_test][update_test_username]' => $this->randomMachineName(),
+    ];
+    $this->drupalPostForm(NULL, $edit, t('Continue'));
+    $this->assertText(t('Installation was completed successfully.'));
+
+    // Ensure the module is available to install.
+    $this->drupalGet('admin/modules');
+    $this->assertText('Update test new module');
+  }
+
+}

core/modules/update/src/Tests/UpdateContribTest.php

@@ -345,6 +345,9 @@ class UpdateContribTest extends UpdateTestBase {
     );
     $this->config('update_test.settings')->set('system_info', $system_info)->save();
 
+    // Ensure that the update information is correct before testing.
+    $this->drupalGet('admin/reports/updates');
+
     $xml_mapping = array(
       'drupal' => '0.0',
       'aaa_update_test' => '1_0',

core/modules/update/src/Tests/UpdateCoreTest.php

@@ -65,11 +65,17 @@ class UpdateCoreTest extends UpdateTestBase {
    */
   function testNormalUpdateAvailable() {
     $this->setSystemInfo('8.0.0');
+
+    // Ensure that the update check requires a token.
+    $this->drupalGet('admin/reports/updates/check');
+    $this->assertResponse(403, 'Accessing admin/reports/updates/check without a CSRF token results in access denied.');
+
     foreach (array(0, 1) as $minor_version) {
       foreach (array('-alpha1', '-beta1', '') as $extra_version) {
         $this->refreshUpdateStatus(array('drupal' => "$minor_version.1" . $extra_version));
         $this->standardTests();
-        $this->drupalGet('admin/reports/updates/check');
+        $this->drupalGet('admin/reports/updates');
+        $this->clickLink(t('Check manually'));
         $this->assertNoText(t('Security update required!'));
         $this->assertRaw(\Drupal::l("8.$minor_version.1" . $extra_version, Url::fromUri("http://example.com/drupal-8-$minor_version-1$extra_version-release")), 'Link to release appears.');
         $this->assertRaw(\Drupal::l(t('Download'), Url::fromUri("http://example.com/drupal-8-$minor_version-1$extra_version.tar.gz")), 'Link to download appears.');
@@ -131,7 +137,8 @@ class UpdateCoreTest extends UpdateTestBase {
           $this->setSystemInfo("8.$minor_version.$patch_version" . $extra_version);
           $this->refreshUpdateStatus(array('drupal' => '9'));
           $this->standardTests();
-          $this->drupalGet('admin/reports/updates/check');
+          $this->drupalGet('admin/reports/updates');
+          $this->clickLink(t('Check manually'));
           $this->assertNoText(t('Security update required!'));
           $this->assertRaw(\Drupal::l('9.0.0', Url::fromUri("http://example.com/drupal-9-0-0-release")), 'Link to release appears.');
           $this->assertRaw(\Drupal::l(t('Download'), Url::fromUri("http://example.com/drupal-9-0-0.tar.gz")), 'Link to download appears.');

core/modules/update/src/Tests/UpdateTestBase.php

@@ -67,7 +67,8 @@ abstract class UpdateTestBase extends WebTestBase {
     // Save the map for UpdateTestController::updateTest() to use.
     $this->config('update_test.settings')->set('xml_map', $xml_map)->save();
     // Manually check the update status.
-    $this->drupalGet('admin/reports/updates/check');
+    $this->drupalGet('admin/reports/updates');
+    $this->clickLink(t('Check manually'));
   }
 
   /**
@@ -78,4 +79,5 @@ abstract class UpdateTestBase extends WebTestBase {
     $this->assertRaw(\Drupal::l(t('Drupal'), Url::fromUri('http://example.com/project/drupal')), 'Link to the Drupal project appears.');
     $this->assertNoText(t('No available releases found'));
   }
+
 }

core/modules/update/src/Tests/UpdateUploadTest.php

@@ -30,6 +30,9 @@ class UpdateUploadTest extends UpdateTestBase {
    * Tests upload, extraction, and update of a module.
    */
   public function testUploadModule() {
+    // Ensure that the update information is correct before testing.
+    update_get_available(TRUE);
+
     // Images are not valid archives, so get one and try to install it. We
     // need an extra variable to store the result of drupalGetTestFiles()
     // since reset() takes an argument by reference and passing in a constant

core/modules/update/src/UpdateFetcherInterface.php

@@ -56,4 +56,5 @@ interface UpdateFetcherInterface {
    * @see \Drupal\update\UpdateManager::getProjects()
    */
   public function buildFetchUrl(array $project, $site_key = '');
+
 }

core/modules/update/src/UpdateManagerInterface.php

@@ -98,4 +98,5 @@ interface UpdateManagerInterface {
    *   array when the storage is cleared.
    */
   public function projectStorage($key);
+
 }

core/modules/update/src/UpdateProcessorInterface.php

@@ -78,4 +78,5 @@ interface UpdateProcessorInterface {
    * @see \Drupal\Core\Queue\QueueInterface::deleteItem()
    */
   public function deleteQueueItem($item);
+
 }