Merge branch '7.18-security' into 7.x

diff --cc CHANGELOG.txt
index ec1d2f9,08acf95..fdafbaa
--- 1/CHANGELOG.txt
--- 2/CHANGELOG.txt
+++ b/CHANGELOG.txt
@@@ -1,28 -1,7 +1,32 @@@
 +
- Drupal 7.19, xxxx-xx-xx (development version)
++Drupal 7.20, xxxx-xx-xx (development version)
 +-----------------------
 +- Fixed entity argument not being passed to implementations of
 +  hook_file_download_access_alter(). The fix adds an additional context
 +  parameter that can be passed when calling drupal_alter() for any hook (API
 +  change: http://drupal.org/node/1882722).
 +- Fixed broken support for translatable comment fields (API change:
 +  http://drupal.org/node/1874724).
 +- Added an assertThemeOutput() method to Simpletest to allow tests to check
 +  that themed output matches an expected HTML string (API addition).
 +- Added a link to "Install another module" after a module has been successfully
 +  downloaded via the Update Manager (UI change).
 +- Added an optional "exclusive" flag to installation profile .info files which
 +  allows Drupal distributions to force a profile to be selected during
 +  installation (API addition).
 +- Fixed a bug which caused the database API to not properly close database
 +  connections.
 +- Added link to the URL for running cron from outside the site to the Cron
 +  settings page (UI change).
 +- Fixed a bug which prevented image styles from being reverted on PHP 5.4.
 +- Made the default .htaccess rules protocol sensitive to improve security for
 +  sites which use HTTPS and redirect between "www" and non-"www" versions of
 +  the page.
 +
+ Drupal 7.19, 2013-01-16
+ -----------------------
+ - Fixed security issues (multiple vulnerabilities). See SA-CORE-2013-001.
+ 
  Drupal 7.18, 2012-12-19
  -----------------------
  - Fixed security issues (multiple vulnerabilities). See SA-CORE-2012-004.

diff --cc includes/bootstrap.inc
index 7fa42d0,53f70e1..1fd497d
--- 1/includes/bootstrap.inc
--- 2/includes/bootstrap.inc
+++ b/includes/bootstrap.inc
@@@ -8,7 -8,7 +8,7 @@@
  /**
   * The current system version.
   */
- define('VERSION', '7.19-dev');
 -define('VERSION', '7.19');
++define('VERSION', '7.20-dev');
  
  /**
   * Core API compatibility.

diff --cc modules/book/book.pages.inc
index 19f6115,63a1d15..e5a04c5
--- 1/modules/book/book.pages.inc
--- 2/modules/book/book.pages.inc
+++ b/modules/book/book.pages.inc
@@@ -41,10 -36,17 +41,19 @@@ function book_render() 
   * @return
   *   A string representing the node and its children in the book hierarchy in a
   *   format determined by the $type parameter.
 + *
 + * @see book_menu()
   */
  function book_export($type, $nid) {
+   // Check that the node exists and that the current user has access to it.
+   $node = node_load($nid);
+   if (!$node) {
+     return MENU_NOT_FOUND;
+   }
+   if (!node_access('view', $node)) {
+     return MENU_ACCESS_DENIED;
+   }
+ 
    $type = drupal_strtolower($type);
  
    $export_function = 'book_export_' . $type;

diff --cc modules/book/book.test
index 71dc6fe,2708e36..81f4524
--- 1/modules/book/book.test
--- 2/modules/book/book.test
+++ b/modules/book/book.test
@@@ -288,7 -257,14 +288,14 @@@ class BookTestCase extends DrupalWebTes
  
      // Try getting the URL directly, and verify it fails.
      $this->drupalGet('book/export/html/' . $this->book->nid);
 -    $this->assertResponse('403', t('Anonymous user properly forbidden.'));
 +    $this->assertResponse('403', 'Anonymous user properly forbidden.');
+ 
+     // Now grant anonymous users permission to view the printer-friendly
+     // version and verify that node access restrictions still prevent them from
+     // seeing it.
+     user_role_grant_permissions(DRUPAL_ANONYMOUS_RID, array('access printer-friendly version'));
+     $this->drupalGet('book/export/html/' . $this->book->nid);
+     $this->assertResponse('403', 'Anonymous user properly forbidden from seeing the printer-friendly version when denied by node access.');
    }
  
    /**