Updated to Drupal 8.6.4, which is PHP 7.3 friendly. Also updated HTMLaw library....

[yaffs-website] / web / core / modules / media / media.install

diff --git a/web/core/modules/media/media.install b/web/core/modules/media/media.install
index 86a95188d1f72d840da3c3f3a887b76072f990cf..d3386ea35a77564b99955b53a040516f15170924 100644 (file)
--- a/web/core/modules/media/media.install
+++ b/web/core/modules/media/media.install
@@ -5,7 +5,11 @@
  * Install, uninstall and update hooks for Media module.
  */
 
+use Drupal\Core\Url;
+use Drupal\media\MediaTypeInterface;
+use Drupal\media\Plugin\media\Source\OEmbedInterface;
 use Drupal\user\RoleInterface;
+use Drupal\user\Entity\Role;
 
 /**
  * Implements hook_install().
@@ -74,6 +78,88 @@ function media_requirements($phase) {
       }
     }
   }
+  elseif ($phase === 'runtime') {
+    // Check that oEmbed content is served in an iframe on a different domain,
+    // and complain if it isn't.
+    $domain = \Drupal::config('media.settings')->get('iframe_domain');
+
+    if (!\Drupal::service('media.oembed.iframe_url_helper')->isSecure($domain)) {
+      // Find all media types which use a source plugin that implements
+      // OEmbedInterface.
+      $media_types = \Drupal::entityTypeManager()
+        ->getStorage('media_type')
+        ->loadMultiple();
+
+      $oembed_types = array_filter($media_types, function (MediaTypeInterface $media_type) {
+        return $media_type->getSource() instanceof OEmbedInterface;
+      });
+
+      if ($oembed_types) {
+        // @todo Potentially allow site administrators to suppress this warning
+        // permanently. See https://www.drupal.org/project/drupal/issues/2962753
+        // for more information.
+        $requirements['media_insecure_iframe'] = [
+          'title' => t('Media'),
+          'description' => t('It is potentially insecure to display oEmbed content in a frame that is served from the same domain as your main Drupal site, as this may allow execution of third-party code. <a href=":url">You can specify a different domain for serving oEmbed content here</a>.', [
+            ':url' => Url::fromRoute('media.settings')->setAbsolute()->toString(),
+          ]),
+          'severity' => REQUIREMENT_WARNING,
+        ];
+      }
+    }
+  }
 
   return $requirements;
 }
+
+/**
+ * Introduce per-bundle permissions.
+ */
+function media_update_8500() {
+  $media_types = \Drupal::entityQuery('media_type')->execute();
+
+  /** @var \Drupal\user\RoleInterface $role */
+  foreach (Role::loadMultiple() as $role) {
+    if ($role->hasPermission('update media')) {
+      foreach ($media_types as $media_type) {
+        $role->grantPermission("edit own $media_type media");
+      }
+    }
+
+    if ($role->hasPermission('update any media')) {
+      foreach ($media_types as $media_type) {
+        $role->grantPermission("edit any $media_type media");
+      }
+    }
+
+    if ($role->hasPermission('delete media')) {
+      foreach ($media_types as $media_type) {
+        $role->grantPermission("delete own $media_type media");
+      }
+    }
+
+    if ($role->hasPermission('delete any media')) {
+      foreach ($media_types as $media_type) {
+        $role->grantPermission("delete any $media_type media");
+      }
+    }
+
+    if ($role->hasPermission('create media')) {
+      foreach ($media_types as $media_type) {
+        $role->grantPermission("create $media_type media");
+      }
+    }
+
+    $role->save();
+  }
+}
+
+/**
+ * Updates media.settings to support OEmbed.
+ */
+function media_update_8600() {
+  \Drupal::configFactory()->getEditable('media.settings')
+    ->set('iframe_domain', '')
+    ->set('oembed_providers_url', 'https://oembed.com/providers.json')
+    ->save(TRUE);
+}