Upgrade to Backdrop 1.18.3

Author: herbdool

README.md

@@ -82,6 +82,24 @@ Developer Documentation
 -----------------------
 Please see the the [Backdrop API Documentation](https://api.backdropcms.org).
 
+Code of Conduct
+---------------
+
+A primary goal of the Backdrop CMS community is to be inclusive to the largest
+number of contributors, with the most varied and diverse backgrounds possible.
+As such, we are committed to providing a friendly, safe and welcoming
+environment for all, regardless of ability, ethnicity, gender, sexual
+orientation, sexual preferences, socioeconomic status, geographic location, or
+religion (or lack thereof).
+
+Our
+[code of conduct](https://github.com/backdrop-ops/conduct/blob/main/code_of_conduct.md)
+outlines our expectations for all those who participate in our community, as
+well as the consequences for unacceptable behavior.
+
+We invite all those who participate in the Backdrop CMS community to help us
+create safe and positive experiences for everyone.
+
 License
 -------
 Backdrop is [GPL v2](http://www.gnu.org/licenses/gpl-2.0.html) (or higher)

core/includes/bootstrap.inc

@@ -7,7 +7,7 @@
 /**
  * The current system version.
  */
-define('BACKDROP_VERSION', '1.18.2');
+define('BACKDROP_VERSION', '1.18.3');
 
 /**
  * Core API compatibility.
@@ -4009,6 +4009,7 @@ function backdrop_autoload($class) {
     // module_invoke_all() because it uses array_merge_recursive(), which is an
     // expensive O(n^2) operation. Instead we use module_implements() and merge
     // the array manually, which is O(n).
+    include_once BACKDROP_ROOT . '/core/includes/module.inc';
     foreach (module_implements('autoload_info') as $module) {
       $module_classes = module_invoke($module, 'autoload_info');
       $module_path = backdrop_get_path('module', $module);

core/includes/common.inc

@@ -1946,7 +1946,13 @@ function _filter_xss_attributes($attr) {
         // Attribute name, href for instance.
         if (preg_match('/^([-a-zA-Z]+)/', $attr, $match)) {
           $attrname = strtolower($match[1]);
-          $skip = ($attrname == 'style' || substr($attrname, 0, 2) == 'on');
+          $skip = (
+            $attrname == 'style' ||
+            substr($attrname, 0, 2) == 'on' ||
+            substr($attrname, 0, 1) == '-' ||
+            // Ignore long attributes to avoid unnecessary processing overhead.
+            strlen($attrname) > 96
+          );
           $working = $mode = 1;
           $attr = preg_replace('/^[-a-zA-Z]+/', '', $attr);
         }