Update to Drupal 8.0.0-rc3. For more information, see https://www.drupal.org/node/2608078

core/modules/user/src/AccountForm.php

@@ -7,6 +7,7 @@
 
 namespace Drupal\user;
 
+use Drupal\Component\Utility\Crypt;
 use Drupal\Core\Entity\ContentEntityForm;
 use Drupal\Core\Entity\EntityConstraintViolationListInterface;
 use Drupal\Core\Entity\EntityManagerInterface;
@@ -127,7 +128,7 @@ abstract class AccountForm extends ContentEntityForm {
       // one-time link and have the token in the URL. Store this in $form_state
       // so it persists even on subsequent Ajax requests.
       if (!$form_state->get('user_pass_reset')) {
-        $user_pass_reset = $pass_reset = isset($_SESSION['pass_reset_' . $account->id()]) && (\Drupal::request()->query->get('pass-reset-token') == $_SESSION['pass_reset_' . $account->id()]);
+        $user_pass_reset = isset($_SESSION['pass_reset_' . $account->id()]) && Crypt::hashEquals($_SESSION['pass_reset_' . $account->id()], \Drupal::request()->query->get('pass-reset-token'));
         $form_state->set('user_pass_reset', $user_pass_reset);
       }
 

core/modules/user/src/Controller/UserController.php

@@ -7,6 +7,7 @@
 
 namespace Drupal\user\Controller;
 
+use Drupal\Component\Utility\Crypt;
 use Drupal\Component\Utility\Xss;
 use Drupal\Core\Controller\ControllerBase;
 use Drupal\Core\Datetime\DateFormatterInterface;
@@ -123,7 +124,7 @@ class UserController extends ControllerBase {
         drupal_set_message($this->t('You have tried to use a one-time login link that has expired. Please request a new one using the form below.'), 'error');
         return $this->redirect('user.pass');
       }
-      elseif ($user->isAuthenticated() && ($timestamp >= $user->getLastLoginTime()) && ($timestamp <= $current) && ($hash === user_pass_rehash($user, $timestamp))) {
+      elseif ($user->isAuthenticated() && ($timestamp >= $user->getLastLoginTime()) && ($timestamp <= $current) && Crypt::hashEquals($hash, user_pass_rehash($user, $timestamp))) {
         $expiration_date = $user->getLastLoginTime() ? $this->dateFormatter->format($timestamp + $timeout) : NULL;
         return $this->formBuilder()->getForm('Drupal\user\Form\UserPasswordResetForm', $user, $expiration_date, $timestamp, $hash);
       }
@@ -198,7 +199,7 @@ class UserController extends ControllerBase {
     $account_data = $this->userData->get('user', $user->id());
     if (isset($account_data['cancel_method']) && !empty($timestamp) && !empty($hashed_pass)) {
       // Validate expiration and hashed password/login.
-      if ($timestamp <= $current && $current - $timestamp < $timeout && $user->id() && $timestamp >= $user->getLastLoginTime() && $hashed_pass == user_pass_rehash($user, $timestamp)) {
+      if ($timestamp <= $current && $current - $timestamp < $timeout && $user->id() && $timestamp >= $user->getLastLoginTime() && Crypt::hashEquals($hashed_pass, user_pass_rehash($user, $timestamp))) {
         $edit = array(
           'user_cancel_notify' => isset($account_data['cancel_notify']) ? $account_data['cancel_notify'] : $this->config('user.settings')->get('notify.status_canceled'),
         );

core/modules/user/src/Plugin/Menu/LoginLogoutMenuLink.php

@@ -2,7 +2,7 @@
 
 /**
  * @file
- * Contains \Drupal\user\Plugin\Menu\MyAccountMenuLink.
+ * Contains \Drupal\user\Plugin\Menu\LoginLogoutMenuLink.
  */
 
 namespace Drupal\user\Plugin\Menu;

core/modules/user/src/Plugin/views/access/Permission.php

@@ -31,7 +31,7 @@ use Symfony\Component\Routing\Route;
 class Permission extends AccessPluginBase implements CacheableDependencyInterface {
 
   /**
-   * Overrides Drupal\views\Plugin\Plugin::$usesOptions.
+   * {@inheritdoc}
    */
   protected $usesOptions = TRUE;
 

core/modules/user/src/Plugin/views/access/Role.php

@@ -30,7 +30,7 @@ use Drupal\Core\Session\AccountInterface;
 class Role extends AccessPluginBase implements CacheableDependencyInterface {
 
   /**
-   * Overrides Drupal\views\Plugin\Plugin::$usesOptions.
+   * {@inheritdoc}
    */
   protected $usesOptions = TRUE;
 

core/modules/user/src/Plugin/views/argument_default/CurrentUser.php

@@ -23,6 +23,9 @@ use Drupal\views\Plugin\views\argument_default\ArgumentDefaultPluginBase;
  */
 class CurrentUser extends ArgumentDefaultPluginBase implements CacheableDependencyInterface {
 
+  /**
+   * {@inheritdoc}
+   */
   public function getArgument() {
     return \Drupal::currentUser()->id();
   }

core/modules/user/src/Plugin/views/field/Permissions.php

@@ -66,7 +66,7 @@ class Permissions extends PrerenderList {
   }
 
   /**
-   * Overrides Drupal\views\Plugin\views\field\FieldPluginBase::init().
+   * {@inheritdoc}
    */
   public function init(ViewExecutable $view, DisplayPluginBase $display, array &$options = NULL) {
     parent::init($view, $display, $options);

core/modules/user/src/Plugin/views/field/Roles.php

@@ -55,7 +55,7 @@ class Roles extends PrerenderList {
   }
 
   /**
-   * Overrides Drupal\views\Plugin\views\field\FieldPluginBase::init().
+   * {@inheritdoc}
    */
   public function init(ViewExecutable $view, DisplayPluginBase $display, array &$options = NULL) {
     parent::init($view, $display, $options);

core/modules/user/src/Plugin/views/filter/Current.php

@@ -21,7 +21,7 @@ use Drupal\views\Plugin\views\filter\BooleanOperator;
 class Current extends BooleanOperator {
 
   /**
-   * Overrides Drupal\views\Plugin\views\filter\BooleanOperator::init().
+   * {@inheritdoc}
    */
   public function init(ViewExecutable $view, DisplayPluginBase $display, array &$options = NULL) {
     parent::init($view, $display, $options);

core/modules/user/src/Plugin/views/wizard/Users.php

@@ -44,7 +44,7 @@ class Users extends WizardPluginBase {
   );
 
   /**
-   * Overrides Drupal\views\Plugin\views\wizard\WizardPluginBase::defaultDisplayOptions().
+   * {@inheritdoc}
    */
   protected function defaultDisplayOptions() {
     $display_options = parent::defaultDisplayOptions();

core/modules/user/src/RegisterForm.php

@@ -63,7 +63,7 @@ class RegisterForm extends AccountForm {
   }
 
   /**
-   * Overrides Drupal\Core\Entity\EntityForm::actions().
+   * {@inheritdoc}
    */
   protected function actions(array $form, FormStateInterface $form_state) {
     $element = parent::actions($form, $form_state);

core/modules/user/src/Tests/Migrate/d6/MigrateUserTest.php

@@ -8,6 +8,7 @@
 namespace Drupal\user\Tests\Migrate\d6;
 
 use Drupal\migrate\Entity\Migration;
+use Drupal\migrate\MigrateExecutable;
 use Drupal\user\Entity\User;
 use Drupal\file\Entity\File;
 use Drupal\Core\Database\Database;
@@ -29,6 +30,10 @@ class MigrateUserTest extends MigrateDrupal6TestBase {
 
     $this->installEntitySchema('file');
     $this->installSchema('file', ['file_usage']);
+    $this->installEntitySchema('node');
+    $this->installSchema('user', ['users_data']);
+    // Make sure uid 1 is created.
+    user_install();
 
     $file = File::create(array(
       'fid' => 2,
@@ -68,7 +73,7 @@ class MigrateUserTest extends MigrateDrupal6TestBase {
     $users = Database::getConnection('default', 'migrate')
       ->select('users', 'u')
       ->fields('u')
-      ->condition('uid', 1, '>')
+      ->condition('uid', 0, '>')
       ->execute()
       ->fetchAll();
 
@@ -117,6 +122,23 @@ class MigrateUserTest extends MigrateDrupal6TestBase {
       // conform the Drupal >= 7.
       $this->assertTrue(\Drupal::service('password')->check($source->pass_plain, $user->getPassword()));
     }
+    // Rollback the migration and make sure everything is deleted but uid 1.
+    (new MigrateExecutable($this->migration, $this))->rollback();
+    $users = Database::getConnection('default', 'migrate')
+      ->select('users', 'u')
+      ->fields('u', ['uid'])
+      ->condition('uid', 0, '>')
+      ->execute()
+      ->fetchCol();
+    foreach ($users as $uid) {
+      $account = User::load($uid);
+      if ($uid == 1) {
+        $this->assertNotNull($account, 'User 1 was preserved after rollback');
+      }
+      else {
+        $this->assertNull($account);
+      }
+    }
   }
 
 }

core/modules/user/src/Tests/UserTranslationUITest.php

@@ -40,14 +40,14 @@ class UserTranslationUITest extends ContentTranslationUITestBase {
   }
 
   /**
-   * Overrides \Drupal\content_translation\Tests\ContentTranslationUITestBase::getTranslatorPermission().
+   * {@inheritdoc}
    */
   protected function getTranslatorPermissions() {
     return array_merge(parent::getTranslatorPermissions(), array('administer users'));
   }
 
   /**
-   * Overrides \Drupal\content_translation\Tests\ContentTranslationUITestBase::getNewEntityValues().
+   * {@inheritdoc}
    */
   protected function getNewEntityValues($langcode) {
     // User name is not translatable hence we use a fixed value.

core/modules/user/src/UserData.php

@@ -32,7 +32,7 @@ class UserData implements UserDataInterface {
   }
 
   /**
-   * Implements \Drupal\user\UserDataInterface::get().
+   * {@inheritdoc}
    */
   public function get($module, $uid = NULL, $name = NULL) {
     $query = $this->connection->select('users_data', 'ud')
@@ -80,7 +80,7 @@ class UserData implements UserDataInterface {
   }
 
   /**
-   * Implements \Drupal\user\UserDataInterface::set().
+   * {@inheritdoc}
    */
   public function set($module, $uid, $name, $value) {
     $serialized = 0;
@@ -102,7 +102,7 @@ class UserData implements UserDataInterface {
   }
 
   /**
-   * Implements \Drupal\user\UserDataInterface::delete().
+   * {@inheritdoc}
    */
   public function delete($module = NULL, $uid = NULL, $name = NULL) {
     $query = $this->connection->delete('users_data');

core/modules/user/user.module

@@ -434,7 +434,7 @@ function user_template_preprocess_default_variables_alter(&$variables) {
   $user = \Drupal::currentUser();
 
   $variables['user'] = clone $user;
-  // Remove password and session IDs, $form_state, since themes should not need nor see them.
+  // Remove password and session IDs, since themes should not need nor see them.
   unset($variables['user']->pass, $variables['user']->sid, $variables['user']->ssid);
 
   $variables['is_admin'] = $user->hasPermission('access administration pages');