Index: update.php
===================================================================
RCS file: /cvs/drupal/drupal/update.php,v
retrieving revision 1.268
diff -u -p -r1.268 update.php
--- update.php	20 Dec 2008 18:24:32 -0000	1.268
+++ update.php	13 Jan 2009 21:58:51 -0000
@@ -420,6 +420,7 @@ function update_info_page() {
 
   update_task_list('info');
   drupal_set_title('Drupal database update');
+  $token = drupal_get_token('update');
   $output = '<p>Use this utility to update your database whenever a new release of Drupal or a module is installed.</p><p>For more detailed information, see the <a href="http://drupal.org/node/258">Installation and upgrading handbook</a>. If you are unsure what these terms mean you should probably contact your hosting provider.</p>';
   $output .= "<ol>\n";
   $output .= "<li><strong>Back up your database</strong>. This process will change your database values and in case of emergency you may need to revert to a backup.</li>\n";
@@ -428,7 +429,7 @@ function update_info_page() {
   $output .= "<li>Install your new files in the appropriate location, as described in the handbook.</li>\n";
   $output .= "</ol>\n";
   $output .= "<p>When you have performed the steps above, you may proceed.</p>\n";
-  $output .= '<form method="post" action="update.php?op=selection"><input type="submit" value="Continue" /></form>';
+  $output .= '<form method="post" action="update.php?op=selection&token='. $token .'"><input type="submit" value="Continue" /></form>';
   $output .= "\n";
   return $output;
 }
@@ -707,17 +708,20 @@ if (!empty($update_free_access) || $user
 
   $op = isset($_REQUEST['op']) ? $_REQUEST['op'] : '';
   switch ($op) {
-    // update.php ops
-    case 'info':
-      $output = update_info_page();
-      break;
-
     case 'selection':
-      $output = update_selection_page();
-      break;
+      if (isset($_GET['token']) && $_GET['token'] == drupal_get_token('update')) {
+        $output = update_selection_page();
+        break;
+      }
 
     case 'Apply pending updates':
-      update_batch();
+      if (isset($_GET['token']) && $_GET['token'] == drupal_get_token('update')) {
+        update_batch();
+        break;
+      }
+
+    case 'info':
+      $output = update_info_page();
       break;
 
     case 'results':
Index: modules/filter/filter.module
===================================================================
RCS file: /cvs/drupal/drupal/modules/filter/filter.module,v
retrieving revision 1.239
diff -u -p -r1.239 filter.module
--- modules/filter/filter.module	30 Dec 2008 16:43:17 -0000	1.239
+++ modules/filter/filter.module	13 Jan 2009 21:58:51 -0000
@@ -368,18 +368,33 @@ function filter_format_allowcache($forma
 
 /**
  * Retrieve a list of filters for a certain format.
+ *
+ * @param $format
+ *   The ID of the format for which filters will be retrieved.
+ * @param $reset
+ *   Whether to reset this function's internal cache.
  */
-function filter_list_format($format) {
+function filter_list_format($format, $reset = FALSE) {
   static $filters = array();
+  if ($reset) {
+    $filters = array();
+  }
 
   if (!isset($filters[$format])) {
-    $filters[$format] = array();
-    $result = db_query("SELECT * FROM {filter} WHERE format = %d ORDER BY weight, module, delta", $format);
-    while ($filter = db_fetch_object($result)) {
-      $list = module_invoke($filter->module, 'filter', 'list');
-      if (isset($list) && is_array($list) && isset($list[$filter->delta])) {
-        $filter->name = $list[$filter->delta];
-        $filters[$format][$filter->module . '/' . $filter->delta] = $filter;
+    $filter_list = db_query("SELECT * FROM {filter} WHERE format = :format ORDER BY weight, module, delta", array(':format' => $format))->fetchAllAssoc('fid');
+    if (empty($filter_list) && !db_result(db_query("SELECT 1 FROM {filter_format} WHERE format = :format", array(':format' => $format)))) {
+      // The format has no filters and does not exist, so use the default
+      // input format.
+      $filters[$format] = filter_list_format(variable_get('filter_default_format', 1));
+    }
+    else {
+      $filters[$format] = array();
+      foreach ($filter_list as $filter) {
+        $list = module_invoke($filter->module, 'filter', 'list');
+        if (isset($list) && is_array($list) && isset($list[$filter->delta])) {
+          $filter->name = $list[$filter->delta];
+          $filters[$format][$filter->module . '/' . $filter->delta] = $filter;
+        }
       }
     }
   }
Index: modules/filter/filter.test
===================================================================
RCS file: /cvs/drupal/drupal/modules/filter/filter.test,v
retrieving revision 1.12
diff -u -p -r1.12 filter.test
--- modules/filter/filter.test	28 Dec 2008 19:30:36 -0000	1.12
+++ modules/filter/filter.test	13 Jan 2009 21:58:51 -0000
@@ -60,27 +60,17 @@ class FilterAdminTestCase extends Drupal
     }
     $this->assertTrue(($filters[0]->delta == $second_filter && $filters[1]->delta == $first_filter), t('Order confirmed.'));
 
-    // Add filter.
-    $edit = array();
-    $edit['name'] = $this->randomName();
-    $edit['roles[2]'] = TRUE;
-    $edit['filters[filter/' . $second_filter . ']'] = TRUE;
-    $edit['filters[filter/' . $first_filter . ']'] = TRUE;
-    $this->drupalPost('admin/settings/filters/add', $edit, t('Save configuration'));
-    $this->assertRaw(t('Added input format %format.', array('%format' => $edit['name'])), t('New filter created.'));
-
-    $format = $this->getFilter($edit['name']);
-    $this->assertNotNull($format, t('Format found in database.'));
-
-    if ($format !== NULL) {
-      $this->assertFieldByName('roles[2]', '', t('Role found.'));
-      $this->assertFieldByName('filters[filter/' . $second_filter . ']', '', t('Line break filter found.'));
-      $this->assertFieldByName('filters[filter/' . $first_filter . ']', '', t('Url filter found.'));
-
-      // Delete new filter.
-      $this->drupalPost('admin/settings/filters/delete/' . $format->format, array(), t('Delete'));
-      $this->assertRaw(t('Deleted input format %format.', array('%format' => $edit['name'])), t('Format successfully deleted.'));
-    }
+    // Add an input format and check for the expected information on the page.
+    $format = $this->drupalCreateInputFormat(array('filter/' . $second_filter, 'filter/' . $first_filter), array(DRUPAL_AUTHENTICATED_RID));
+    $this->assertRaw(t('Added input format %format.', array('%format' => $format->name)), t('Message about the new input format appears on the page.'));
+    $this->assertFieldByName('roles[' . DRUPAL_AUTHENTICATED_RID . ']', '', t('Role found.'));
+    $this->assertFieldByName('filters[filter/' . $second_filter . ']', '', t('Line break filter found.'));
+    $this->assertFieldByName('filters[filter/' . $first_filter . ']', '', t('Url filter found.'));
+
+    // Delete the input format and check for the expected information on the
+    // page.
+    $this->drupalDeleteInputFormat($format->format);
+    $this->assertRaw(t('Deleted input format %format.', array('%format' => $format->name)), t('Message about the deleted input format appears on the page.'));
 
     // Change default filter back.
     $edit = array();
@@ -166,16 +156,6 @@ class FilterAdminTestCase extends Drupal
 
     return array($filtered, $full);
   }
-
-  /**
-   * Get filter by name.
-   *
-   * @param string $name Name of filter to find.
-   * @return object Filter object.
-   */
-  function getFilter($name) {
-    return db_fetch_object(db_query("SELECT * FROM {filter_format} WHERE name = '%s'", $name));
-  }
 }
 
 class FilterTestCase extends DrupalWebTestCase {
@@ -214,23 +194,61 @@ class FilterTestCase extends DrupalWebTe
    * Test the HTML filter
    */
   function testHtmlFilter() {
-
   }
+}
+
+class FilterListFormatTestCase extends DrupalWebTestCase {
+  protected $admin_user;
 
-  function createFormat($filter) {
-    $edit = array(
-      'name' => $this->randomName(),
-      'roles[2]' => TRUE,
-      'filters[filter/' . $filter . ']' => TRUE,
+  function getInfo() {
+    return array(
+      'name' => t('Filter list functionality'),
+      'description' => t('Test that filters for an input format can be retrieved correctly.'),
+      'group' => t('Filter'),
     );
-    $this->drupalPost('admin/settings/filters/add', $edit, t('Save configuration'));
-    return db_fetch_object(db_query("SELECT * FROM {filter_format} WHERE name = '%s'", $edit['name']));
   }
 
-  function deleteFormat($format) {
-    if ($format !== NULL) {
-      // Delete new filter.
-      $this->drupalPost('admin/settings/filters/delete/' . $format->format, array(), t('Delete'));
+  function setUp() {
+    parent::setUp();
+    $admin_user = $this->drupalCreateUser(array('administer filters'));
+    $this->drupalLogin($admin_user);
+  }
+
+  function testFilterListFormat() {
+    $line_break_filter = 'filter/1';
+    $url_filter = 'filter/2';
+    $formats = array();
+
+    // Add an empty input format, an input format with one filter, and an
+    // input format with multiple filters.
+    $filters_list = array(
+      'empty' => array(),
+      'one' => array($line_break_filter),
+      'multiple' => array($line_break_filter, $url_filter),
+    );
+    foreach ($filters_list as $label => $filters) {
+      $formats[$label] = $this->drupalCreateInputFormat($filters);
     }
+
+    // Check that each format contains the correct filters.
+    foreach ($formats as $label => $format) {
+      $found_filters = array_keys(filter_list_format($format->format));
+      sort($found_filters);
+      $expected_filters = $filters_list[$label];
+      sort($expected_filters);
+      $this->assertEqual($found_filters, $expected_filters, empty($expected_filters) ? t('The input format contains no filters.') : t('The input format contains the expected filters: %filters', array('%filters' => implode(', ', $expected_filters))));
+    }
+
+    // Delete one of the input formats, and check that it now uses the
+    // filters for the default input format. (This is a security feature
+    // that prevents content stored with a deleted input format from
+    // being displayed without any filtering.)
+    $format = $formats['one']->format;
+    $this->drupalDeleteInputFormat($format);
+    // Reset the static cache since we have changed formats in the same
+    // page request.
+    $deleted_format_filters = filter_list_format($format, TRUE);
+    $default_format_filters = filter_list_format(variable_get('filter_default_format', 1));
+    $this->assertEqual($deleted_format_filters, $default_format_filters, t('A deleted input format users the filters from the default input format: %filters', array('%filters' => implode(', ', array_keys($default_format_filters)))));
   }
 }
Index: modules/simpletest/drupal_web_test_case.php
===================================================================
RCS file: /cvs/drupal/drupal/modules/simpletest/drupal_web_test_case.php,v
retrieving revision 1.79
diff -u -p -r1.79 drupal_web_test_case.php
--- modules/simpletest/drupal_web_test_case.php	6 Jan 2009 12:44:20 -0000	1.79
+++ modules/simpletest/drupal_web_test_case.php	13 Jan 2009 21:58:51 -0000
@@ -572,6 +572,63 @@ class DrupalWebTestCase {
   }
 
   /**
+   * Creates a new input format.
+   *
+   * @param $filters
+   *   An array containing the combined 'module/delta' value for each filter
+   *   to be added to this input format.
+   * @param $roles
+   *   An array of role IDs which will have access to this filter.
+   * @param $name
+   *   The name of the filter. (If not set, a random name is used.)
+   * @return
+   *   An object representing the new input format.
+   */
+  protected function drupalCreateInputFormat($filters = array(), $roles = array(), $name = NULL) {
+    $edit = array();
+
+    // The filters for the default input format are automatically enabled
+    // on the form for adding a new format. So we need to explicitly disable
+    // them.
+    foreach (array_keys(filter_list_format(variable_get('filter_default_format', 1))) as $filter) {
+      $edit['filters[' . $filter . ']'] = FALSE;
+    }
+
+    // Now add the parameters that were provided.
+    foreach ($filters as $filter) {
+      $edit['filters[' . $filter . ']'] = TRUE;
+    }
+    foreach ($roles as $role) {
+      $edit['roles[' . $role . ']'] = TRUE;
+    }
+    $edit['name'] = !isset($name) ? $this->randomName() : $name;
+
+    // Submit the form.
+    $this->drupalPost('admin/settings/filters/add', $edit, t('Save configuration'));
+
+    // Verify that the input format exists in the database.
+    $format = db_query("SELECT * FROM {filter_format} WHERE name = :name", array(':name' => $edit['name']))->fetchObject();
+    $this->assertTrue($format, t('New input format successfully loaded.'));
+
+    return $format;
+  }
+
+  /**
+   * Delete an input format.
+   *
+   * @param $format
+   *   The ID of the input format to delete.
+   */
+  protected function drupalDeleteInputFormat($format) {
+    // Submit the form.
+    $this->drupalPost('admin/settings/filters/delete/' . $format, array(), t('Delete'));
+
+    // Verify that the deleted input format does not exist in the database.
+    $format = db_query("SELECT * FROM {filter_format} WHERE format = :format", array(':format' => $format))->fetchObject();
+    $this->assertFalse($format, t('Input format deleted successfully.'));
+  }
+
+  /**
    * Get a list files that can be used in tests.
    *
    * @param $type
