Maintenance release of the Drupal 7 series. Includes bug fixes and small API/feature improvements only (no major, non-backwards-compatible new functionality).
No security fixes are included in this release.
Changes have been made to default.settings.php. More details in the Change Records for major changes below.
No changes have been made to .htaccess, web.config or robots.txt files in this release, so upgrading custom versions of those files is not necessary.
This is the first Drupal 7 release to pass tests in PHP 8.3. However there may still be problems not revealed by Drupal core's test suite, especially on sites with contrib (and custom) modules. Please test, and report any problems in the appropriate issue queue.
As always, many thanks to everyone that contributed to this - and every - release of Drupal 7.
Major changes in 7.103:
- #3319062: [D7] PhpMail : broken mail headers in PHP 8.0+ because of LF characters
- #3478716: [D7] Full path disclosure from errors on maintenance pages
- #3444017: [D7] HTTP_HOST header cannot be trusted
- #3383223: URL aliases can be used to override trusted urls
All changes:
- #3319062 by arx-e, poker10, rclemings, down2under, mcdruid, aitala, longwave, edvanleeuwen, jbiechele, davidwhthomas, danrod, stevewilson, Chase.: [D7] PhpMail : broken mail headers in PHP 8.0+ because of LF characters
- #3478716 by ram4nd, mcdruid, poker10: [D7] Full path disclosure from errors on maintenance pages
- #3444017 by poker10, avpaderno, akalata, mcdruid: [D7] HTTP_HOST header cannot be trusted
- #3438308 by avpaderno, ceonizm, poker10, aaron.ferris, robcarr: dirname(): Passing null to parameter #1 ($path) of type string is deprecated in drupal_get_path()
- #3383223 by poker10, dokumori, dsnopek, catch, berdir, effulgentsia, mlhess, samuel.mortenson, poiu, moshe weitzman: URL aliases can be used to override trusted urls
- #1447236 by C. Lee, avpaderno, mfb, poker10: DefaultMailSystem implements MailSystemInterface::format() incorrectly
- #3182166 by stefanos.petrakis@gmail.com, poker10, almador, adinan cenci, czunigaco, rhip, benjifisher, neclimdul, cilefen: [D7] preg_split in _filter_url breaks for long html tags
- #3397882 by poker10, andypost, joseph.olstad: [D7 PHP 8.3] TextSummaryTestCase::testLength() fails on some libxml versions
- #3446569 by poker10, joseph.olstad: [D7 PHP 8.3] Fix SessionHttpsTestCase->testEmptySessionId() failure
- #3464097 by avpaderno, poker10: CacheClearCase::testClearArray() sets a persistent variable that has no effect
- #3467905 by avpaderno: drupal_var_export() initializes a variable that is never used
- #3467781 by avpaderno: drupal_var_export() passes a third argument to itself, when it uses just two parameters
- #3463022 by avpaderno: Correct a comment in drupal_settings_initialize()
- #2453785 by adammalone: Password hashing tests do not cover all options
- #2401743 by EPashkin: Wrong link to test results in settings form