Update to Drupal 8.1.7. For more information, see https://www.drupal.org/project/drupal/releases/8.1.7

core/CHANGELOG.txt

@@ -1,3 +1,7 @@
+Drupal 8.1.7, 2016-07-18
+------------------------
+- Fixed security issue. SA-CORE-2016-003.
+
 Drupal 8.1.3, 2016-06-15
 ------------------------
 - Fixed security issue. SA-CORE-2016-002.

core/composer.json

@@ -21,7 +21,7 @@
         "twig/twig": "^1.23.1",
         "doctrine/common": "2.5.*",
         "doctrine/annotations": "1.2.*",
-        "guzzlehttp/guzzle": "~6.1",
+        "guzzlehttp/guzzle": "~6.2",
         "symfony-cmf/routing": "1.3.*",
         "easyrdf/easyrdf": "0.9.*",
         "zendframework/zend-feed": "~2.4",

core/lib/Drupal.php

@@ -81,7 +81,7 @@ class Drupal {
   /**
    * The current system version.
    */
-  const VERSION = '8.1.5';
+  const VERSION = '8.1.7';
 
   /**
    * Core API compatibility.

core/lib/Drupal/Core/Config/Entity/ConfigDependencyManager.php

@@ -206,7 +206,7 @@ class ConfigDependencyManager {
    * @return int
    *   The comparison result for uasort().
    */
-  protected function sortGraphByWeight(array $a, array $b) {
+  protected static function sortGraphByWeight(array $a, array $b) {
     $weight_cmp = SortArray::sortByKeyInt($a, $b, 'weight');
 
     if ($weight_cmp === 0) {
@@ -227,7 +227,7 @@ class ConfigDependencyManager {
    * @return int
    *   The comparison result for uasort().
    */
-  public function sortGraph(array $a, array $b) {
+  public static function sortGraph(array $a, array $b) {
     $weight_cmp = SortArray::sortByKeyInt($a, $b, 'weight') * -1;
 
     if ($weight_cmp === 0) {

core/lib/Drupal/Core/Http/ClientFactory.php

@@ -52,6 +52,13 @@ class ClientFactory {
         'User-Agent' => 'Drupal/' . \Drupal::VERSION . ' (+https://www.drupal.org/) ' . \GuzzleHttp\default_user_agent(),
       ],
       'handler' => $this->stack,
+      // Security consideration: prevent Guzzle from using environment variables
+      // to configure the outbound proxy.
+      'proxy' => [
+        'http' => NULL,
+        'https' => NULL,
+        'no' => [],
+      ]
     ];
 
     $config = NestedArray::mergeDeep($default_config, Settings::get('http_client_config', []), $config);

core/modules/ckeditor/ckeditor.module

@@ -68,13 +68,14 @@ function ckeditor_ckeditor_css_alter(array &$css, Editor $editor) {
 }
 
 /**
- * Retrieves the default theme's CKEditor stylesheets defined in the .info file.
+ * Retrieves the default theme's CKEditor stylesheets.
  *
  * Themes may specify iframe-specific CSS files for use with CKEditor by
- * including a "ckeditor_stylesheets" key in the theme .info file.
+ * including a "ckeditor_stylesheets" key in their .info.yml file.
  *
  * @code
- * ckeditor_stylesheets[] = css/ckeditor-iframe.css
+ * ckeditor_stylesheets:
+ *   - css/ckeditor-iframe.css
  * @endcode
  */
 function _ckeditor_theme_css($theme = NULL) {

core/modules/system/system.install

@@ -797,22 +797,6 @@ function system_requirements($phase) {
     }
   }
 
-  // Check if the Twig C extension is available.
-  if ($phase == 'runtime') {
-    $url = 'http://twig.sensiolabs.org/doc/installation.html#installing-the-c-extension';
-    $requirements['twig_c_extension'] = [
-      'title' => t('Twig C extension'),
-      'severity' => REQUIREMENT_INFO,
-    ];
-    if (!function_exists('twig_template_get_attributes')) {
-      $requirements['twig_c_extension']['value'] = t('Not available');
-      $requirements['twig_c_extension']['description'] = t('Enabling the Twig C extension can greatly increase rendering performance. See <a href=":url">the installation instructions</a> for more detail.', [':url' => $url]);
-    }
-    else {
-      $requirements['twig_c_extension']['description'] = t('The <a href=":url">Twig C extension</a> is available', [':url' => $url]);
-    }
-  }
-
   // Check xdebug.max_nesting_level, as some pages will not work if it is too
   // low.
   if (extension_loaded('xdebug')) {

core/modules/user/src/MigratePassword.php

@@ -0,0 +1,5 @@
+<?php
+// @codingStandardsIgnoreFile
+// This file is intentionally empty so that it overwrites when sites are
+// updated from a zip/tarball without deleting the /core folder first.
+// @todo: remove in 8.3.x

core/modules/user/src/UserServiceProvider.php

@@ -0,0 +1,5 @@
+<?php
+// @codingStandardsIgnoreFile
+// This file is intentionally empty so that it overwrites when sites are
+// updated from a zip/tarball without deleting the /core folder first.
+// @todo: remove in 8.3.x

core/themes/classy/templates/layout/page.html.twig

@@ -28,7 +28,6 @@
  *
  * Regions:
  * - page.header: Items for the header region.
- * - page.highlighted: Items for the highlighted region.
  * - page.primary_menu: Items for the primary menu region.
  * - page.secondary_menu: Items for the secondary menu region.
  * - page.highlighted: Items for the highlighted content region.