Pullup ticket #5863 - requested by taca

www/drupal7: security update

Revisions pulled up:
- www/drupal7/Makefile                                          1.51-1.52
- www/drupal7/PLIST                                             1.19
- www/drupal7/distinfo                                          1.39-1.40
- www/drupal7/patches/patch-includes_bootstrap.inc              1.1
- www/drupal7/patches/patch-includes_form.inc                   1.1
- www/drupal7/patches/patch-includes_install.inc                1.1
- www/drupal7/patches/patch-includes_menu.inc                   1.1
- www/drupal7/patches/patch-includes_module.inc                 1.1
- www/drupal7/patches/patch-includes_theme.inc                  1.1
- www/drupal7/patches/patch-modules_book_book.module            1.1
- www/drupal7/patches/patch-modules_field_modules_list_list.install 1.1
- www/drupal7/patches/patch-modules_locale_locale.test          1.1
- www/drupal7/patches/patch-modules_simpletest_tests_themes_test__theme_theme-settings.php 1.1
- www/drupal7/patches/patch-modules_system_system.admin.inc     1.1
- www/drupal7/patches/patch-modules_system_system.test          1.1

-------------------------------------------------------------------
   Module Name:	pkgsrc
   Committed By:	prlw1
   Date:		Wed Oct  3 10:58:15 UTC 2018

   Modified Files:
   	pkgsrc/www/drupal7: Makefile PLIST distinfo
   Added Files:
   	pkgsrc/www/drupal7/patches: patch-includes_bootstrap.inc
   	    patch-includes_form.inc patch-includes_install.inc
   	    patch-includes_menu.inc patch-includes_module.inc
   	    patch-includes_theme.inc patch-modules_book_book.module
   	    patch-modules_field_modules_list_list.install
   	    patch-modules_locale_locale.test
   	    patch-modules_simpletest_tests_themes_test__theme_theme-settings.php
   	    patch-modules_system_system.admin.inc
   	    patch-modules_system_system.test

   Log Message:
   Update drupal7 to 7.59nb2

   PHP 7.2: Removed deprecated function each().
   PHP 7.2: Avoid count() calls on uncountable variables.
   PHP 7.2: Removed deprecated create_function() call.
   PHP 7.2: Make sure variables are arrays in theme_links().
   Fixed theme-settings.php not being loaded on cached forms


   To generate a diff of this commit:
   cvs rdiff -u -r1.50 -r1.51 pkgsrc/www/drupal7/Makefile
   cvs rdiff -u -r1.18 -r1.19 pkgsrc/www/drupal7/PLIST
   cvs rdiff -u -r1.38 -r1.39 pkgsrc/www/drupal7/distinfo
   cvs rdiff -u -r0 -r1.1 \
       pkgsrc/www/drupal7/patches/patch-includes_bootstrap.inc \
       pkgsrc/www/drupal7/patches/patch-includes_form.inc \
       pkgsrc/www/drupal7/patches/patch-includes_install.inc \
       pkgsrc/www/drupal7/patches/patch-includes_menu.inc \
       pkgsrc/www/drupal7/patches/patch-includes_module.inc \
       pkgsrc/www/drupal7/patches/patch-includes_theme.inc \
       pkgsrc/www/drupal7/patches/patch-modules_book_book.module \
       pkgsrc/www/drupal7/patches/patch-modules_field_modules_list_list.install \
       pkgsrc/www/drupal7/patches/patch-modules_locale_locale.test \
       pkgsrc/www/drupal7/patches/patch-modules_simpletest_tests_themes_test__theme_theme-settings.php \
       pkgsrc/www/drupal7/patches/patch-modules_system_system.admin.inc \
       pkgsrc/www/drupal7/patches/patch-modules_system_system.test

-------------------------------------------------------------------
   Module Name:	pkgsrc
   Committed By:	taca
   Date:		Thu Oct 18 14:32:48 UTC 2018

   Modified Files:
   	pkgsrc/www/drupal7: Makefile distinfo

   Log Message:
   www/drupal7: update to 7.60

   Drupal 7.60, 2018-10-18
   ------------------------
   - Fixed security issues. See SA-CORE-2018-006.


   To generate a diff of this commit:
   cvs rdiff -u -r1.51 -r1.52 pkgsrc/www/drupal7/Makefile
   cvs rdiff -u -r1.39 -r1.40 pkgsrc/www/drupal7/distinfo

15 files changed, 468 insertions, 10 deletions

diff --git a/www/drupal7/Makefile b/www/drupal7/Makefile
index 51282da4bbd..800be9a357c 100644
--- a/www/drupal7/Makefile
+++ b/www/drupal7/Makefile
@@ -1,8 +1,7 @@
-# $NetBSD: Makefile,v 1.50 2018/08/02 16:18:47 prlw1 Exp $
+# $NetBSD: Makefile,v 1.50.2.1 2018/10/29 19:57:08 spz Exp $
 
-DISTNAME=	drupal-7.59
+DISTNAME=	drupal-7.60
 PKGNAME=	${PHP_PKG_PREFIX}-${DISTNAME}
-PKGREVISION=	1
 CATEGORIES=	www
 MASTER_SITES=	https://ftp.drupal.org/files/projects/
 
@@ -66,6 +65,22 @@ INSTALLATION_DIRS+=	${DRUPAL}/${i}
 post-extract:
 	${CP} ${FILESDIR}/drupal.conf ${WRKSRC}
 
+pre-install:
+	${RM} \
+	${WRKSRC}/includes/bootstrap.inc.orig \
+	${WRKSRC}/includes/form.inc.orig \
+	${WRKSRC}/includes/install.inc.orig \
+	${WRKSRC}/includes/menu.inc.orig \
+	${WRKSRC}/includes/module.inc.orig \
+	${WRKSRC}/includes/theme.inc.orig \
+	${WRKSRC}/modules/book/book.module.orig \
+	${WRKSRC}/modules/field/modules/list/list.install.orig \
+	${WRKSRC}/modules/locale/locale.test.orig \
+	${WRKSRC}/modules/simpletest/tests/themes/test_theme/theme-settings.php.orig \
+	${WRKSRC}/modules/system/system.admin.inc.orig \
+	${WRKSRC}/modules/system/system.test.orig \
+	${WRKSRC}/modules/system/system.tar.inc.orig
+
 do-install:
 	${INSTALL_DATA} ${WRKSRC}/robots.txt ${DESTDIR}${PREFIX}/${DRUPAL}
 	${INSTALL_DATA} ${WRKSRC}/drupal.conf \
diff --git a/www/drupal7/PLIST b/www/drupal7/PLIST
index cc5c2af260d..a8f7ebefac7 100644
--- a/www/drupal7/PLIST
+++ b/www/drupal7/PLIST
@@ -1,4 +1,4 @@
-@comment $NetBSD: PLIST,v 1.18 2018/08/06 14:42:53 prlw1 Exp $
+@comment $NetBSD: PLIST,v 1.18.2.1 2018/10/29 19:57:08 spz Exp $
 share/doc/drupal/CHANGELOG.txt
 share/doc/drupal/COPYRIGHT.txt
 share/doc/drupal/INSTALL.mysql.txt
@@ -761,6 +761,7 @@ share/drupal/modules/simpletest/tests/themes/test_subtheme/test_subtheme.info
 share/drupal/modules/simpletest/tests/themes/test_theme/template.php
 share/drupal/modules/simpletest/tests/themes/test_theme/templates/node--1.tpl.php
 share/drupal/modules/simpletest/tests/themes/test_theme/test_theme.info
+share/drupal/modules/simpletest/tests/themes/test_theme/theme-settings.php
 share/drupal/modules/simpletest/tests/themes/test_theme_nyan_cat/templates/theme_test_template_test.nyan-cat.html
 share/drupal/modules/simpletest/tests/themes/test_theme_nyan_cat/test_theme_nyan_cat.info
 share/drupal/modules/simpletest/tests/unicode.test
@@ -860,7 +861,6 @@ share/drupal/modules/system/system.messages.css
 share/drupal/modules/system/system.module
 share/drupal/modules/system/system.queue.inc
 share/drupal/modules/system/system.tar.inc
-share/drupal/modules/system/system.tar.inc.orig
 share/drupal/modules/system/system.test
 share/drupal/modules/system/system.theme-rtl.css
 share/drupal/modules/system/system.theme.css
diff --git a/www/drupal7/distinfo b/www/drupal7/distinfo
index e3fba88c5a8..2797d95be00 100644
--- a/www/drupal7/distinfo
+++ b/www/drupal7/distinfo
@@ -1,7 +1,19 @@
-$NetBSD: distinfo,v 1.38 2018/08/02 16:18:47 prlw1 Exp $
+$NetBSD: distinfo,v 1.38.2.1 2018/10/29 19:57:08 spz Exp $
 
-SHA1 (drupal-7.59.tar.gz) = aa4c5ee88c37b82fc90765189919bbe22c231486
-RMD160 (drupal-7.59.tar.gz) = f7cd3f36611a7004910e4c53cc639aa4285f177a
-SHA512 (drupal-7.59.tar.gz) = 68f02b39d1a4658adc0f0046c22cc1059b68f952f9cd753f5a3e379cf93705be308b4727519e90d77a42437442daebaa78d76745954be4d40e1a5105c319069c
-Size (drupal-7.59.tar.gz) = 3282260 bytes
+SHA1 (drupal-7.60.tar.gz) = aa54d7fc85d2bc2dc20a639208b91256f8f8d2b0
+RMD160 (drupal-7.60.tar.gz) = 839ce4dc73fa52cf0cdbae9d8bcd74772c9b0c5b
+SHA512 (drupal-7.60.tar.gz) = fee59cf303a6c44e3fa3cbeda4912f7d61ffe8294282f9ad0416a6536cc6ea65cf114a6a801dd1f68572185c2b1e300f58f907f9bd61f96beaba3706c527d512
+Size (drupal-7.60.tar.gz) = 3283058 bytes
+SHA1 (patch-includes_bootstrap.inc) = 19af750379de283a17a1f8f202586d588fa58569
+SHA1 (patch-includes_form.inc) = 3f8955b576ebf292573f0953f0a07467dbdd4f64
+SHA1 (patch-includes_install.inc) = ff182d242f4637f7bbb509a1b043671ebd952f64
+SHA1 (patch-includes_menu.inc) = 7aa6f4ae82b37f024d54cc7dc6c6d5433f352916
+SHA1 (patch-includes_module.inc) = 4af9f2c26eb16d39bbcd08949183b54a78391b25
+SHA1 (patch-includes_theme.inc) = 4421f9ad1235825f7b3c360e44bbac994fcfe214
+SHA1 (patch-modules_book_book.module) = bab6aabf09736f5ebb7e60860a96116c2779db06
+SHA1 (patch-modules_field_modules_list_list.install) = 45fffa25115818babe9e743fb1f02020d620efca
+SHA1 (patch-modules_locale_locale.test) = 66f82c0517d32100da28f33b10d1caa27de839be
+SHA1 (patch-modules_simpletest_tests_themes_test__theme_theme-settings.php) = 40f7c7578f4f3c802cd2aaf55130ad9b22b9fea2
+SHA1 (patch-modules_system_system.admin.inc) = d052516a117ca5fecf0da81779ecaac9ef1c4e18
 SHA1 (patch-modules_system_system.tar.inc) = f5bbca9c1b0f5dbb52b744fd5627f83fb8e71cc6
+SHA1 (patch-modules_system_system.test) = 5761278afaa8369453b5857f806cd5d34a2589d0
diff --git a/www/drupal7/patches/patch-includes_bootstrap.inc b/www/drupal7/patches/patch-includes_bootstrap.inc
new file mode 100644
index 00000000000..e3d5be7b510
--- /dev/null
+++ b/www/drupal7/patches/patch-includes_bootstrap.inc
@@ -0,0 +1,22 @@
+$NetBSD: patch-includes_bootstrap.inc,v 1.1.2.2 2018/10/29 19:57:08 spz Exp $
+
+Issue #2925449
+Function each() is deprecated since PHP 7.2
+commit 28de6772813387bf02a4bf6f75b9119c4c20a3f4
+
+--- includes/bootstrap.inc.orig	2018-04-25 15:32:27.000000000 +0000
++++ includes/bootstrap.inc
+@@ -3785,8 +3785,12 @@ function _drupal_shutdown_function() {
+   chdir(DRUPAL_ROOT);
+ 
+   try {
+-    while (list($key, $callback) = each($callbacks)) {
++    // Manually iterate over the array instead of using a foreach loop.
++    // A foreach operates on a copy of the array, so any shutdown functions that
++    // were added from other shutdown functions would never be called.
++    while ($callback = current($callbacks)) {
+       call_user_func_array($callback['callback'], $callback['arguments']);
++      next($callbacks);
+     }
+   }
+   catch (Exception $exception) {
diff --git a/www/drupal7/patches/patch-includes_form.inc b/www/drupal7/patches/patch-includes_form.inc
new file mode 100644
index 00000000000..e2ea93b23b5
--- /dev/null
+++ b/www/drupal7/patches/patch-includes_form.inc
@@ -0,0 +1,23 @@
+$NetBSD: patch-includes_form.inc,v 1.1.2.2 2018/10/29 19:57:08 spz Exp $
+
+Issue #2885610
+Avoid count() calls on uncountable variables
+commit 73e12f0ddf1ed60c13331dc3a9b8ea16d1599307
+
+--- includes/form.inc.orig	2018-04-25 15:32:27.000000000 +0000
++++ includes/form.inc
+@@ -1438,10 +1438,12 @@ function _form_validate(&$elements, &$fo
+       // length if it's a string, and the item count if it's an array.
+       // An unchecked checkbox has a #value of integer 0, different than string
+       // '0', which could be a valid value.
+-      $is_empty_multiple = (!count($elements['#value']));
++      $is_countable = is_array($elements['#value']) || $elements['#value'] instanceof \Countable;
++      $is_empty_multiple = $is_countable && count($elements['#value']) == 0;
+       $is_empty_string = (is_string($elements['#value']) && drupal_strlen(trim($elements['#value'])) == 0);
+       $is_empty_value = ($elements['#value'] === 0);
+-      if ($is_empty_multiple || $is_empty_string || $is_empty_value) {
++      $is_empty_null = is_null($elements['#value']);
++      if ($is_empty_multiple || $is_empty_string || $is_empty_value || $is_empty_null) {
+         // Although discouraged, a #title is not mandatory for form elements. In
+         // case there is no #title, we cannot set a form error message.
+         // Instead of setting no #title, form constructors are encouraged to set
diff --git a/www/drupal7/patches/patch-includes_install.inc b/www/drupal7/patches/patch-includes_install.inc
new file mode 100644
index 00000000000..82ec5a86b6e
--- /dev/null
+++ b/www/drupal7/patches/patch-includes_install.inc
@@ -0,0 +1,17 @@
+$NetBSD: patch-includes_install.inc,v 1.1.2.2 2018/10/29 19:57:08 spz Exp $
+
+Issue #2925449
+Function each() is deprecated since PHP 7.2
+commit 28de6772813387bf02a4bf6f75b9119c4c20a3f4
+
+--- includes/install.inc.orig	2018-04-25 15:32:27.000000000 +0000
++++ includes/install.inc
+@@ -779,7 +779,7 @@ function drupal_uninstall_modules($modul
+     $module_list = array_flip(array_values($module_list));
+ 
+     $profile = drupal_get_profile();
+-    while (list($module) = each($module_list)) {
++    foreach (array_keys($module_list) as $module) {
+       if (!isset($module_data[$module]) || drupal_get_installed_schema_version($module) == SCHEMA_UNINSTALLED) {
+         // This module doesn't exist or is already uninstalled. Skip it.
+         unset($module_list[$module]);
diff --git a/www/drupal7/patches/patch-includes_menu.inc b/www/drupal7/patches/patch-includes_menu.inc
new file mode 100644
index 00000000000..d305ee250b0
--- /dev/null
+++ b/www/drupal7/patches/patch-includes_menu.inc
@@ -0,0 +1,38 @@
+$NetBSD: patch-includes_menu.inc,v 1.1.2.2 2018/10/29 19:57:08 spz Exp $
+
+Issue #2925449
+Function each() is deprecated since PHP 7.2
+commit 28de6772813387bf02a4bf6f75b9119c4c20a3f4
+
+--- includes/menu.inc.orig	2018-04-25 15:32:27.000000000 +0000
++++ includes/menu.inc
+@@ -576,7 +576,8 @@ function _menu_load_objects(&$item, &$ma
+           // 'load arguments' in the hook_menu() entry, but they need
+           // some processing. In this case the $function is the key to the
+           // load_function array, and the value is the list of arguments.
+-          list($function, $args) = each($function);
++          $args = current($function);
++          $function = key($function);
+           $load_functions[$index] = $function;
+ 
+           // Some arguments are placeholders for dynamic items to process.
+@@ -2402,7 +2403,8 @@ function menu_set_active_trail($new_trai
+       // a stripped down menu tree containing the active trail only, in case
+       // the given menu has not been built in this request yet.
+       $tree = menu_tree_page_data($preferred_link['menu_name'], NULL, TRUE);
+-      list($key, $curr) = each($tree);
++      $curr = current($tree);
++      next($tree);
+     }
+     // There is no link for the current path.
+     else {
+@@ -2432,7 +2434,8 @@ function menu_set_active_trail($new_trai
+         }
+         $tree = $curr['below'] ? $curr['below'] : array();
+       }
+-      list($key, $curr) = each($tree);
++      $curr = current($tree);
++      next($tree);
+     }
+     // Make sure the current page is in the trail to build the page title, by
+     // appending either the preferred link or the menu router item for the
diff --git a/www/drupal7/patches/patch-includes_module.inc b/www/drupal7/patches/patch-includes_module.inc
new file mode 100644
index 00000000000..ca959360222
--- /dev/null
+++ b/www/drupal7/patches/patch-includes_module.inc
@@ -0,0 +1,34 @@
+$NetBSD: patch-includes_module.inc,v 1.1.2.2 2018/10/29 19:57:08 spz Exp $
+
+Issue #2925449
+Function each() is deprecated since PHP 7.2
+commit 28de6772813387bf02a4bf6f75b9119c4c20a3f4
+
+--- includes/module.inc.orig	2018-04-25 15:32:27.000000000 +0000
++++ includes/module.inc
+@@ -404,7 +404,11 @@ function module_enable($module_list, $en
+     // Create an associative array with weights as values.
+     $module_list = array_flip(array_values($module_list));
+ 
+-    while (list($module) = each($module_list)) {
++    // The array is iterated over manually (instead of using a foreach) because
++    // modules may be added to the list within the loop and we need to process
++    // them.
++    while ($module = key($module_list)) {
++      next($module_list);
+       if (!isset($module_data[$module])) {
+         // This module is not found in the filesystem, abort.
+         return FALSE;
+@@ -540,7 +544,11 @@ function module_disable($module_list, $d
+     $module_list = array_flip(array_values($module_list));
+ 
+     $profile = drupal_get_profile();
+-    while (list($module) = each($module_list)) {
++    // The array is iterated over manually (instead of using a foreach) because
++    // modules may be added to the list within the loop and we need to process
++    // them.
++    while ($module = key($module_list)) {
++      next($module_list);
+       if (!isset($module_data[$module]) || !$module_data[$module]->status) {
+         // This module doesn't exist or is already disabled, skip it.
+         unset($module_list[$module]);
diff --git a/www/drupal7/patches/patch-includes_theme.inc b/www/drupal7/patches/patch-includes_theme.inc
new file mode 100644
index 00000000000..d0f90d6b2a1
--- /dev/null
+++ b/www/drupal7/patches/patch-includes_theme.inc
@@ -0,0 +1,103 @@
+$NetBSD: patch-includes_theme.inc,v 1.1.2.2 2018/10/29 19:57:08 spz Exp $
+
+Issue #2885610
+Avoid count() calls on uncountable variables
+commit 73e12f0ddf1ed60c13331dc3a9b8ea16d1599307
+
+Issue #2996519
+PHP 7.2 compatibility - make sure some variables are arrays in
+theme_links()
+commit 083a4eca4a2ebc5276eed2f11fc4a595b07898ba
+
+--- includes/theme.inc.orig	2018-10-03 09:32:02.932500773 +0000
++++ includes/theme.inc
+@@ -1776,8 +1776,8 @@ function theme_link($variables) {
+  *     http://www.w3.org/TR/WCAG-TECHS/H42.html for more information.
+  */
+ function theme_links($variables) {
+-  $links = $variables['links'];
+-  $attributes = $variables['attributes'];
++  $links = (array) $variables['links'];
++  $attributes = (array) $variables['attributes'];
+   $heading = $variables['heading'];
+   global $language_url;
+   $output = '';
+@@ -1995,7 +1995,7 @@ function theme_table($variables) {
+   $empty = $variables['empty'];
+ 
+   // Add sticky headers, if applicable.
+-  if (count($header) && $sticky) {
++  if (!empty($header) && $sticky) {
+     drupal_add_js('misc/tableheader.js');
+     // Add 'sticky-enabled' class to the table to identify it for JS.
+     // This is needed to target tables constructed by this function.
+@@ -2009,7 +2009,7 @@ function theme_table($variables) {
+   }
+ 
+   // Format the table columns:
+-  if (count($colgroups)) {
++  if (!empty($colgroups)) {
+     foreach ($colgroups as $number => $colgroup) {
+       $attributes = array();
+ 
+@@ -2044,38 +2044,40 @@ function theme_table($variables) {
+   }
+ 
+   // Add the 'empty' row message if available.
+-  if (!count($rows) && $empty) {
++  if (empty($rows) && $empty) {
+     $header_count = 0;
+-    foreach ($header as $header_cell) {
+-      if (is_array($header_cell)) {
+-        $header_count += isset($header_cell['colspan']) ? $header_cell['colspan'] : 1;
+-      }
+-      else {
+-        $header_count++;
++    if (!empty($header)) {
++      foreach ($header as $header_cell) {
++        if (is_array($header_cell)) {
++          $header_count += isset($header_cell['colspan']) ? $header_cell['colspan'] : 1;
++        }
++        else {
++          $header_count++;
++        }
+       }
+     }
+     $rows[] = array(array('data' => $empty, 'colspan' => $header_count, 'class' => array('empty', 'message')));
+   }
+ 
+   // Format the table header:
+-  if (count($header)) {
++  if (!empty($header)) {
+     $ts = tablesort_init($header);
+     // HTML requires that the thead tag has tr tags in it followed by tbody
+     // tags. Using ternary operator to check and see if we have any rows.
+-    $output .= (count($rows) ? ' <thead><tr>' : ' <tr>');
++    $output .= (!empty($rows) ? ' <thead><tr>' : ' <tr>');
+     foreach ($header as $cell) {
+       $cell = tablesort_header($cell, $header, $ts);
+       $output .= _theme_table_cell($cell, TRUE);
+     }
+     // Using ternary operator to close the tags based on whether or not there are rows
+-    $output .= (count($rows) ? " </tr></thead>\n" : "</tr>\n");
++    $output .= (!empty($rows) ? " </tr></thead>\n" : "</tr>\n");
+   }
+   else {
+     $ts = array();
+   }
+ 
+   // Format the table rows:
+-  if (count($rows)) {
++  if (!empty($rows)) {
+     $output .= "<tbody>\n";
+     $flip = array('even' => 'odd', 'odd' => 'even');
+     $class = 'even';
+@@ -2095,7 +2097,7 @@ function theme_table($variables) {
+         $attributes = array();
+         $no_striping = FALSE;
+       }
+-      if (count($cells)) {
++      if (!empty($cells)) {
+         // Add odd/even class
+         if (!$no_striping) {
+           $class = $flip[$class];
diff --git a/www/drupal7/patches/patch-modules_book_book.module b/www/drupal7/patches/patch-modules_book_book.module
new file mode 100644
index 00000000000..394224306c0
--- /dev/null
+++ b/www/drupal7/patches/patch-modules_book_book.module
@@ -0,0 +1,37 @@
+$NetBSD: patch-modules_book_book.module,v 1.1.2.2 2018/10/29 19:57:08 spz Exp $
+
+Issue #2925449
+Function each() is deprecated since PHP 7.2
+commit 28de6772813387bf02a4bf6f75b9119c4c20a3f4
+
+--- modules/book/book.module.orig	2018-04-25 15:32:27.000000000 +0000
++++ modules/book/book.module
+@@ -768,11 +768,13 @@ function book_prev($book_link) {
+     return NULL;
+   }
+   $flat = book_get_flat_menu($book_link);
+-  // Assigning the array to $flat resets the array pointer for use with each().
++  reset($flat);
+   $curr = NULL;
+   do {
+     $prev = $curr;
+-    list($key, $curr) = each($flat);
++    $curr = current($flat);
++    $key = key($flat);
++    next($flat);
+   } while ($key && $key != $book_link['mlid']);
+ 
+   if ($key == $book_link['mlid']) {
+@@ -806,9 +808,10 @@ function book_prev($book_link) {
+  */
+ function book_next($book_link) {
+   $flat = book_get_flat_menu($book_link);
+-  // Assigning the array to $flat resets the array pointer for use with each().
++  reset($flat);
+   do {
+-    list($key, $curr) = each($flat);
++    $key = key($flat);
++    next($flat);
+   }
+   while ($key && $key != $book_link['mlid']);
+ 
diff --git a/www/drupal7/patches/patch-modules_field_modules_list_list.install b/www/drupal7/patches/patch-modules_field_modules_list_list.install
new file mode 100644
index 00000000000..f1ab843a123
--- /dev/null
+++ b/www/drupal7/patches/patch-modules_field_modules_list_list.install
@@ -0,0 +1,31 @@
+$NetBSD: patch-modules_field_modules_list_list.install,v 1.1.2.2 2018/10/29 19:57:08 spz Exp $
+
+Issue #2885129
+create_function() is deprecated
+commit 76a4dc7098771a14e7d64a827457dcadd7feafbc
+
+--- modules/field/modules/list/list.install.orig	2018-04-25 15:32:27.000000000 +0000
++++ modules/field/modules/list/list.install
+@@ -61,7 +61,7 @@ function list_update_7001() {
+ 
+       // Additionally, float keys need to be disambiguated ('.5' is '0.5').
+       if ($field['type'] == 'list_number' && !empty($allowed_values)) {
+-        $keys = array_map(create_function('$a', 'return (string) (float) $a;'), array_keys($allowed_values));
++        $keys = array_map('_list_update_7001_float_string_cast', array_keys($allowed_values));
+         $allowed_values = array_combine($keys, array_values($allowed_values));
+       }
+ 
+@@ -89,6 +89,13 @@ function list_update_7001() {
+ }
+ 
+ /**
++ * Helper callback function to cast the array element.
++ */
++function _list_update_7001_float_string_cast($element) {
++  return (string) (float) $element;
++}
++
++/**
+  * Helper function for list_update_7001: extract allowed values from a string.
+  *
+  * This reproduces the parsing logic in use before D7 RC2.
diff --git a/www/drupal7/patches/patch-modules_locale_locale.test b/www/drupal7/patches/patch-modules_locale_locale.test
new file mode 100644
index 00000000000..f684c8040b9
--- /dev/null
+++ b/www/drupal7/patches/patch-modules_locale_locale.test
@@ -0,0 +1,21 @@
+$NetBSD: patch-modules_locale_locale.test,v 1.1.2.2 2018/10/29 19:57:08 spz Exp $
+
+Issue #2925449
+Function each() is deprecated since PHP 7.2
+commit 28de6772813387bf02a4bf6f75b9119c4c20a3f4
+
+--- modules/locale/locale.test.orig	2018-04-25 15:32:27.000000000 +0000
++++ modules/locale/locale.test
+@@ -3188,11 +3188,7 @@ class LocaleLanguageNegotiationInfoFunct
+     foreach (language_types_info() as $type => $info) {
+       if (isset($info['fixed'])) {
+         $negotiation = variable_get("language_negotiation_$type", array());
+-        $equal = count($info['fixed']) == count($negotiation);
+-        while ($equal && list($id) = each($negotiation)) {
+-          list(, $info_id) = each($info['fixed']);
+-          $equal = $info_id == $id;
+-        }
++        $equal = array_keys($negotiation) === array_values($info['fixed']);
+         $this->assertTrue($equal, format_string('language negotiation for %type is properly set up', array('%type' => $type)));
+       }
+     }
diff --git a/www/drupal7/patches/patch-modules_simpletest_tests_themes_test__theme_theme-settings.php b/www/drupal7/patches/patch-modules_simpletest_tests_themes_test__theme_theme-settings.php
new file mode 100644
index 00000000000..1004f78e438
--- /dev/null
+++ b/www/drupal7/patches/patch-modules_simpletest_tests_themes_test__theme_theme-settings.php
@@ -0,0 +1,42 @@
+$NetBSD: patch-modules_simpletest_tests_themes_test__theme_theme-settings.php,v 1.1.2.2 2018/10/29 19:57:08 spz Exp $
+
+Issue #2900373
+When a theme has a managed_file field and a submit callback, call
+to undefined function error is thrown
+commit b014c196e1eab417e0703c3fc77e340a213a8824
+
+--- modules/simpletest/tests/themes/test_theme/theme-settings.php.orig	2018-10-03 09:31:14.310243910 +0000
++++ modules/simpletest/tests/themes/test_theme/theme-settings.php
+@@ -0,0 +1,32 @@
++<?php
++
++/**
++ * @file
++ * Theme setting callbacks for the test_theme theme.
++ */
++
++/**
++ * Implements hook_form_FORM_ID_alter().
++ */
++function test_theme_form_system_theme_settings_alter(&$form, &$form_state) {
++  $form['test_theme_checkbox'] = array(
++    '#type' => 'checkbox',
++    '#title' => 'Test theme checkbox',
++    '#default_value' => theme_get_setting('test_theme_checkbox'),
++  );
++
++  // Force the form to be cached so we can test that this file is properly
++  // loaded and the custom submit handler is properly called even on a cached
++  // form build.
++  $form_state['cache'] = TRUE;
++  $form['#submit'][] = 'test_theme_form_system_theme_settings_submit';
++}
++
++/**
++ * Form submission handler for the test theme settings form.
++ *
++ * @see test_theme_form_system_theme_settings_alter()
++ */
++function test_theme_form_system_theme_settings_submit($form, &$form_state) {
++  drupal_set_message('The test theme setting was saved.');
++}
diff --git a/www/drupal7/patches/patch-modules_system_system.admin.inc b/www/drupal7/patches/patch-modules_system_system.admin.inc
new file mode 100644
index 00000000000..935165d7ce8
--- /dev/null
+++ b/www/drupal7/patches/patch-modules_system_system.admin.inc
@@ -0,0 +1,23 @@
+$NetBSD: patch-modules_system_system.admin.inc,v 1.1.2.2 2018/10/29 19:57:08 spz Exp $
+
+Issue #2900373
+When a theme has a managed_file field and a submit callback, call
+to undefined function error is thrown
+commit b014c196e1eab417e0703c3fc77e340a213a8824
+
+--- modules/system/system.admin.inc.orig	2018-04-25 15:32:27.000000000 +0000
++++ modules/system/system.admin.inc
+@@ -572,9 +572,10 @@ function system_theme_settings($form, &$
+     // Process the theme and all its base themes.
+     foreach ($theme_keys as $theme) {
+       // Include the theme-settings.php file.
+-      $filename = DRUPAL_ROOT . '/' . str_replace("/$theme.info", '', $themes[$theme]->filename) . '/theme-settings.php';
+-      if (file_exists($filename)) {
+-        require_once $filename;
++      $theme_settings_path = drupal_get_path('theme', $theme) . '/theme-settings.php';
++      if (file_exists(DRUPAL_ROOT . '/' . $theme_settings_path)) {
++        require_once DRUPAL_ROOT . '/' . $theme_settings_path;
++        $form_state['build_info']['files'][] = $theme_settings_path;
+       }
+ 
+       // Call theme-specific settings.
diff --git a/www/drupal7/patches/patch-modules_system_system.test b/www/drupal7/patches/patch-modules_system_system.test
new file mode 100644
index 00000000000..72cf909a1a8
--- /dev/null
+++ b/www/drupal7/patches/patch-modules_system_system.test
@@ -0,0 +1,40 @@
+$NetBSD: patch-modules_system_system.test,v 1.1.2.2 2018/10/29 19:57:08 spz Exp $
+
+Issue #2900373
+When a theme has a managed_file field and a submit callback, call
+to undefined function error is thrown
+commit b014c196e1eab417e0703c3fc77e340a213a8824
+
+--- modules/system/system.test.orig	2018-04-25 15:32:27.000000000 +0000
++++ modules/system/system.test
+@@ -1944,6 +1944,30 @@ class SystemThemeFunctionalTest extends 
+     $this->assertEqual($elements[0]['src'], file_create_url($uploaded_filename));
+   }
+ 
++
++  /**
++   * Test the individual per-theme settings form.
++   */
++  function testPerThemeSettings() {
++    // Enable the test theme and the module that controls it. Clear caches in
++    // between so that the module's hook_system_theme_info() implementation is
++    // correctly registered.
++    module_enable(array('theme_test'));
++    drupal_flush_all_caches();
++    theme_enable(array('test_theme'));
++
++    // Test that the theme-specific settings form can be saved and that the
++    // theme-specific checkbox is checked and unchecked as appropriate.
++    $this->drupalGet('admin/appearance/settings/test_theme');
++    $this->assertNoFieldChecked('edit-test-theme-checkbox', 'The test_theme_checkbox setting is unchecked.');
++    $this->drupalPost(NULL, array('test_theme_checkbox' => TRUE), t('Save configuration'));
++    $this->assertText('The test theme setting was saved.');
++    $this->assertFieldChecked('edit-test-theme-checkbox', 'The test_theme_checkbox setting is checked.');
++    $this->drupalPost(NULL, array('test_theme_checkbox' => FALSE), t('Save configuration'));
++    $this->assertText('The test theme setting was saved.');
++    $this->assertNoFieldChecked('edit-test-theme-checkbox', 'The test_theme_checkbox setting is unchecked.');
++  }
++
+   /**
+    * Test the administration theme functionality.
+    */