Update to Drupal 8.2.0. For more information, see https://www.drupal.org/project/drupal/releases/8.2.0

core/modules/user/src/Authentication/Provider/Cookie.php

@@ -62,7 +62,7 @@ class Cookie implements AuthenticationProviderInterface {
    * @param \Symfony\Component\HttpFoundation\Session\SessionInterface $session
    *   The session.
    *
-   * @return \Drupal\Core\Session\AccountInterface|NULL
+   * @return \Drupal\Core\Session\AccountInterface|null
    *   The UserSession object for the current user, or NULL if this is an
    *   anonymous session.
    */

core/modules/user/src/Controller/UserAuthenticationController.php

@@ -0,0 +1,345 @@
+<?php
+
+namespace Drupal\user\Controller;
+
+use Drupal\Core\Access\CsrfTokenGenerator;
+use Drupal\Core\Controller\ControllerBase;
+use Drupal\Core\DependencyInjection\ContainerInjectionInterface;
+use Drupal\Core\Flood\FloodInterface;
+use Drupal\Core\Routing\RouteProviderInterface;
+use Drupal\user\UserAuthInterface;
+use Drupal\user\UserInterface;
+use Drupal\user\UserStorageInterface;
+use Symfony\Component\DependencyInjection\ContainerInterface;
+use Symfony\Component\HttpFoundation\Request;
+use Symfony\Component\HttpFoundation\Response;
+use Symfony\Component\HttpKernel\Exception\AccessDeniedHttpException;
+use Symfony\Component\HttpKernel\Exception\BadRequestHttpException;
+use Symfony\Component\Serializer\Encoder\JsonEncoder;
+use Symfony\Component\Serializer\Serializer;
+
+/**
+ * Provides controllers for login, login status and logout via HTTP requests.
+ */
+class UserAuthenticationController extends ControllerBase implements ContainerInjectionInterface {
+
+  /**
+   * String sent in responses, to describe the user as being logged in.
+   *
+   * @var string
+   */
+  const LOGGED_IN = 1;
+
+  /**
+   * String sent in responses, to describe the user as being logged out.
+   *
+   * @var string
+   */
+  const LOGGED_OUT = 0;
+
+  /**
+   * The flood controller.
+   *
+   * @var \Drupal\Core\Flood\FloodInterface
+   */
+  protected $flood;
+
+  /**
+   * The user storage.
+   *
+   * @var \Drupal\user\UserStorageInterface
+   */
+  protected $userStorage;
+
+  /**
+   * The CSRF token generator.
+   *
+   * @var \Drupal\Core\Access\CsrfTokenGenerator
+   */
+  protected $csrfToken;
+
+  /**
+   * The user authentication.
+   *
+   * @var \Drupal\user\UserAuthInterface
+   */
+  protected $userAuth;
+
+  /**
+   * The route provider.
+   *
+   * @var \Drupal\Core\Routing\RouteProviderInterface
+   */
+  protected $routeProvider;
+
+  /**
+   * The serializer.
+   *
+   * @var \Symfony\Component\Serializer\Serializer
+   */
+  protected $serializer;
+
+  /**
+   * The available serialization formats.
+   *
+   * @var array
+   */
+  protected $serializerFormats = [];
+
+  /**
+   * Constructs a new UserAuthenticationController object.
+   *
+   * @param \Drupal\Core\Flood\FloodInterface $flood
+   *   The flood controller.
+   * @param \Drupal\user\UserStorageInterface $user_storage
+   *   The user storage.
+   * @param \Drupal\Core\Access\CsrfTokenGenerator $csrf_token
+   *   The CSRF token generator.
+   * @param \Drupal\user\UserAuthInterface $user_auth
+   *   The user authentication.
+   * @param \Drupal\Core\Routing\RouteProviderInterface $route_provider
+   *   The route provider.
+   * @param \Symfony\Component\Serializer\Serializer $serializer
+   *   The serializer.
+   * @param array $serializer_formats
+   *   The available serialization formats.
+   */
+  public function __construct(FloodInterface $flood, UserStorageInterface $user_storage, CsrfTokenGenerator $csrf_token, UserAuthInterface $user_auth, RouteProviderInterface $route_provider, Serializer $serializer, array $serializer_formats) {
+    $this->flood = $flood;
+    $this->userStorage = $user_storage;
+    $this->csrfToken = $csrf_token;
+    $this->userAuth = $user_auth;
+    $this->serializer = $serializer;
+    $this->serializerFormats = $serializer_formats;
+    $this->routeProvider = $route_provider;
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public static function create(ContainerInterface $container) {
+    if ($container->hasParameter('serializer.formats') && $container->has('serializer')) {
+      $serializer = $container->get('serializer');
+      $formats = $container->getParameter('serializer.formats');
+    }
+    else {
+      $formats = ['json'];
+      $encoders = [new JsonEncoder()];
+      $serializer = new Serializer([], $encoders);
+    }
+
+    return new static(
+      $container->get('flood'),
+      $container->get('entity_type.manager')->getStorage('user'),
+      $container->get('csrf_token'),
+      $container->get('user.auth'),
+      $container->get('router.route_provider'),
+      $serializer,
+      $formats
+    );
+  }
+
+  /**
+   * Logs in a user.
+   *
+   * @param \Symfony\Component\HttpFoundation\Request $request
+   *   The request.
+   *
+   * @return \Symfony\Component\HttpFoundation\Response
+   *   A response which contains the ID and CSRF token.
+   */
+  public function login(Request $request) {
+    $format = $this->getRequestFormat($request);
+
+    $content = $request->getContent();
+    $credentials = $this->serializer->decode($content, $format);
+    if (!isset($credentials['name']) && !isset($credentials['pass'])) {
+      throw new BadRequestHttpException('Missing credentials.');
+    }
+
+    if (!isset($credentials['name'])) {
+      throw new BadRequestHttpException('Missing credentials.name.');
+    }
+    if (!isset($credentials['pass'])) {
+      throw new BadRequestHttpException('Missing credentials.pass.');
+    }
+
+    $this->floodControl($request, $credentials['name']);
+
+    if ($this->userIsBlocked($credentials['name'])) {
+      throw new BadRequestHttpException('The user has not been activated or is blocked.');
+    }
+
+    if ($uid = $this->userAuth->authenticate($credentials['name'], $credentials['pass'])) {
+      $this->flood->clear('user.http_login', $this->getLoginFloodIdentifier($request, $credentials['name']));
+      /** @var \Drupal\user\UserInterface $user */
+      $user = $this->userStorage->load($uid);
+      $this->userLoginFinalize($user);
+
+      // Send basic metadata about the logged in user.
+      $response_data = [];
+      if ($user->get('uid')->access('view', $user)) {
+        $response_data['current_user']['uid'] = $user->id();
+      }
+      if ($user->get('roles')->access('view', $user)) {
+        $response_data['current_user']['roles'] = $user->getRoles();
+      }
+      if ($user->get('name')->access('view', $user)) {
+        $response_data['current_user']['name'] = $user->getAccountName();
+      }
+      $response_data['csrf_token'] = $this->csrfToken->get('rest');
+
+      $logout_route = $this->routeProvider->getRouteByName('user.logout.http');
+      // Trim '/' off path to match \Drupal\Core\Access\CsrfAccessCheck.
+      $logout_path = ltrim($logout_route->getPath(), '/');
+      $response_data['logout_token'] = $this->csrfToken->get($logout_path);
+
+      $encoded_response_data = $this->serializer->encode($response_data, $format);
+      return new Response($encoded_response_data);
+    }
+
+    $flood_config = $this->config('user.flood');
+    if ($identifier = $this->getLoginFloodIdentifier($request, $credentials['name'])) {
+      $this->flood->register('user.http_login', $flood_config->get('user_window'), $identifier);
+    }
+    // Always register an IP-based failed login event.
+    $this->flood->register('user.failed_login_ip', $flood_config->get('ip_window'));
+    throw new BadRequestHttpException('Sorry, unrecognized username or password.');
+  }
+
+  /**
+   * Verifies if the user is blocked.
+   *
+   * @param string $name
+   *   The username.
+   *
+   * @return bool
+   *   TRUE if the user is blocked, otherwise FALSE.
+   */
+  protected function userIsBlocked($name) {
+    return user_is_blocked($name);
+  }
+
+  /**
+   * Finalizes the user login.
+   *
+   * @param \Drupal\user\UserInterface $user
+   *   The user.
+   */
+  protected function userLoginFinalize(UserInterface $user) {
+    user_login_finalize($user);
+  }
+
+  /**
+   * Logs out a user.
+   *
+   * @return \Drupal\rest\ResourceResponse
+   *   The response object.
+   */
+  public function logout() {
+    $this->userLogout();
+    return new Response(NULL, 204);
+  }
+
+  /**
+   * Logs the user out.
+   */
+  protected function userLogout() {
+    user_logout();
+  }
+
+  /**
+   * Checks whether a user is logged in or not.
+   *
+   * @return \Symfony\Component\HttpFoundation\Response
+   *   The response.
+   */
+  public function loginStatus() {
+    if ($this->currentUser()->isAuthenticated()) {
+      $response = new Response(self::LOGGED_IN);
+    }
+    else {
+      $response = new Response(self::LOGGED_OUT);
+    }
+    $response->headers->set('Content-Type', 'text/plain');
+    return $response;
+  }
+
+  /**
+   * Gets the format of the current request.
+   *
+   * @param \Symfony\Component\HttpFoundation\Request $request
+   *   The current request.
+   *
+   * @return string
+   *   The format of the request.
+   */
+  protected function getRequestFormat(Request $request) {
+    $format = $request->getRequestFormat();
+    if (!in_array($format, $this->serializerFormats)) {
+      throw new BadRequestHttpException("Unrecognized format: $format.");
+    }
+    return $format;
+  }
+
+  /**
+   * Enforces flood control for the current login request.
+   *
+   * @param \Symfony\Component\HttpFoundation\Request $request
+   *   The current request.
+   * @param string $username
+   *   The user name sent for login credentials.
+   */
+  protected function floodControl(Request $request, $username) {
+    $flood_config = $this->config('user.flood');
+    if (!$this->flood->isAllowed('user.failed_login_ip', $flood_config->get('ip_limit'), $flood_config->get('ip_window'))) {
+      throw new AccessDeniedHttpException('Access is blocked because of IP based flood prevention.', NULL, Response::HTTP_TOO_MANY_REQUESTS);
+    }
+
+    if ($identifier = $this->getLoginFloodIdentifier($request, $username)) {
+      // Don't allow login if the limit for this user has been reached.
+      // Default is to allow 5 failed attempts every 6 hours.
+      if (!$this->flood->isAllowed('user.http_login', $flood_config->get('user_limit'), $flood_config->get('user_window'), $identifier)) {
+        if ($flood_config->get('uid_only')) {
+          $error_message = sprintf('There have been more than %s failed login attempts for this account. It is temporarily blocked. Try again later or request a new password.', $flood_config->get('user_limit'));
+        }
+        else {
+          $error_message = 'Too many failed login attempts from your IP address. This IP address is temporarily blocked.';
+        }
+        throw new AccessDeniedHttpException($error_message, NULL, Response::HTTP_TOO_MANY_REQUESTS);
+      }
+    }
+  }
+
+  /**
+   * Gets the login identifier for user login flood control.
+   *
+   * @param \Symfony\Component\HttpFoundation\Request $request
+   *   The current request.
+   * @param string $username
+   *   The username supplied in login credentials.
+   *
+   * @return string
+   *   The login identifier or if the user does not exist an empty string.
+   */
+  protected function getLoginFloodIdentifier(Request $request, $username) {
+    $flood_config = $this->config('user.flood');
+    $accounts = $this->userStorage->loadByProperties(['name' => $username, 'status' => 1]);
+    if ($account = reset($accounts)) {
+      if ($flood_config->get('uid_only')) {
+        // Register flood events based on the uid only, so they apply for any
+        // IP address. This is the most secure option.
+        $identifier = $account->id();
+      }
+      else {
+        // The default identifier is a combination of uid and IP address. This
+        // is less secure but more resistant to denial-of-service attacks that
+        // could lock out all users with public user names.
+        $identifier = $account->id() . '-' . $request->getClientIp();
+      }
+      return $identifier;
+    }
+    return '';
+  }
+
+}

core/modules/user/src/Entity/User.php

@@ -425,21 +425,17 @@ class User extends ContentEntityBase implements UserInterface {
    * {@inheritdoc}
    */
   public static function baseFieldDefinitions(EntityTypeInterface $entity_type) {
-    $fields['uid'] = BaseFieldDefinition::create('integer')
-      ->setLabel(t('User ID'))
-      ->setDescription(t('The user ID.'))
-      ->setReadOnly(TRUE)
-      ->setSetting('unsigned', TRUE);
+    /** @var \Drupal\Core\Field\BaseFieldDefinition[] $fields */
+    $fields = parent::baseFieldDefinitions($entity_type);
 
-    $fields['uuid'] = BaseFieldDefinition::create('uuid')
-      ->setLabel(t('UUID'))
-      ->setDescription(t('The user UUID.'))
-      ->setReadOnly(TRUE);
+    $fields['uid']->setLabel(t('User ID'))
+      ->setDescription(t('The user ID.'));
 
-    $fields['langcode'] = BaseFieldDefinition::create('language')
-      ->setLabel(t('Language code'))
+    $fields['uuid']->setDescription(t('The user UUID.'));
+
+    $fields['langcode']->setLabel(t('Language code'))
       ->setDescription(t('The user language code.'))
-      ->setTranslatable(TRUE);
+      ->setDisplayOptions('form', ['type' => 'hidden']);
 
     $fields['preferred_langcode'] = BaseFieldDefinition::create('language')
       ->setLabel(t('Preferred language code'))

core/modules/user/src/Form/UserLoginForm.php

@@ -232,7 +232,7 @@ class UserLoginForm extends FormBase {
         // handlers that ran earlier than this one.
         $user_input = $form_state->getUserInput();
         $query = isset($user_input['name']) ? array('name' => $user_input['name']) : array();
-        $form_state->setErrorByName('name', $this->t('Unrecognized username or password. <a href=":password">Have you forgotten your password?</a>', array(':password' => $this->url('user.pass', [], array('query' => $query)))));
+        $form_state->setErrorByName('name', $this->t('Unrecognized username or password. <a href=":password">Forgot your password?</a>', array(':password' => $this->url('user.pass', [], array('query' => $query)))));
         $accounts = $this->userStorage->loadByProperties(array('name' => $form_state->getValue('name')));
         if (!empty($accounts)) {
           $this->logger('user')->notice('Login attempt failed for %user.', array('%user' => $form_state->getValue('name')));

core/modules/user/src/Form/UserPermissionsForm.php

@@ -42,7 +42,7 @@ class UserPermissionsForm extends FormBase {
    *   The permission handler.
    * @param \Drupal\user\RoleStorageInterface $role_storage
    *   The role storage.
-   * @param \Drupal\Core\Extension\ModuleHandlerInterface
+   * @param \Drupal\Core\Extension\ModuleHandlerInterface $module_handler
    *   The module handler.
    */
   public function __construct(PermissionHandlerInterface $permission_handler, RoleStorageInterface $role_storage, ModuleHandlerInterface $module_handler) {
@@ -100,7 +100,6 @@ class UserPermissionsForm extends FormBase {
       '#value' => $role_names,
     );
     // Render role/permission overview:
-    $options = array();
     $hide_descriptions = system_admin_compact_mode();
 
     $form['system_compact_link'] = array(
@@ -145,7 +144,6 @@ class UserPermissionsForm extends FormBase {
           'restrict access' => FALSE,
           'warning' => !empty($perm_item['restrict access']) ? $this->t('Warning: Give to trusted roles only; this permission has security implications.') : '',
         );
-        $options[$perm] = $perm_item['title'];
         $form['permissions'][$perm]['description'] = array(
           '#type' => 'inline_template',
           '#template' => '<div class="permission"><span class="title">{{ title }}</span>{% if description or warning %}<div class="description">{% if warning %}<em class="permission-warning">{{ warning }}</em> {% endif %}{{ description }}</div>{% endif %}</div>',
@@ -158,7 +156,6 @@ class UserPermissionsForm extends FormBase {
           $form['permissions'][$perm]['description']['#context']['description'] = $perm_item['description'];
           $form['permissions'][$perm]['description']['#context']['warning'] = $perm_item['warning'];
         }
-        $options[$perm] = '';
         foreach ($role_names as $rid => $name) {
           $form['permissions'][$perm][$rid] = array(
             '#title' => $name . ': ' . $perm_item['title'],

core/modules/user/src/PermissionHandler.php

@@ -2,7 +2,7 @@
 
 namespace Drupal\user;
 
-use Drupal\Component\Discovery\YamlDiscovery;
+use Drupal\Core\Discovery\YamlDiscovery;
 use Drupal\Core\Controller\ControllerResolverInterface;
 use Drupal\Core\Extension\ModuleHandlerInterface;
 use Drupal\Core\StringTranslation\StringTranslationTrait;
@@ -59,7 +59,7 @@ class PermissionHandler implements PermissionHandlerInterface {
   /**
    * The YAML discovery class to find all .permissions.yml files.
    *
-   * @var \Drupal\Component\Discovery\YamlDiscovery
+   * @var \Drupal\Core\Discovery\YamlDiscovery
    */
   protected $yamlDiscovery;
 
@@ -91,7 +91,7 @@ class PermissionHandler implements PermissionHandlerInterface {
   /**
    * Gets the YAML discovery.
    *
-   * @return \Drupal\Component\Discovery\YamlDiscovery
+   * @return \Drupal\Core\Discovery\YamlDiscovery
    *   The YAML discovery.
    */
   protected function getYamlDiscovery() {

core/modules/user/src/Plugin/Validation/Constraint/UserNameConstraintValidator.php

@@ -29,7 +29,7 @@ class UserNameConstraintValidator extends ConstraintValidator {
     if (strpos($name, '  ') !== FALSE) {
       $this->context->addViolation($constraint->multipleSpacesMessage);
     }
-    if (preg_match('/[^\x{80}-\x{F7} a-z0-9@_.\'-]/i', $name)
+    if (preg_match('/[^\x{80}-\x{F7} a-z0-9@+_.\'-]/i', $name)
       || preg_match(
         // Non-printable ISO-8859-1 + NBSP
         '/[\x{80}-\x{A0}' .

core/modules/user/src/Plugin/migrate/process/d6/UserUpdate7002.php

@@ -25,11 +25,11 @@ class UserUpdate7002 extends ProcessPluginBase implements ContainerFactoryPlugin
    */
   protected static $timezones;
 
- /**
-  * Contains the system.theme configuration object.
-  *
-  * @var \Drupal\Core\Config\Config
-  */
+  /**
+   * Contains the system.theme configuration object.
+   *
+   * @var \Drupal\Core\Config\Config
+   */
   protected $dateConfig;
 
   /**

core/modules/user/src/Plugin/views/argument_default/CurrentUser.php

@@ -9,7 +9,7 @@ use Drupal\views\Plugin\views\argument_default\ArgumentDefaultPluginBase;
 /**
  * Default argument plugin to extract the current user
  *
- * This plugin actually has no options so it odes not need to do a great deal.
+ * This plugin actually has no options so it does not need to do a great deal.
  *
  * @ViewsArgumentDefault(
  *   id = "current_user",

core/modules/user/src/Plugin/views/field/Permissions.php

@@ -112,16 +112,4 @@ class Permissions extends PrerenderList {
     return $item['permission'];
   }
 
-  /*
-  protected function documentSelfTokens(&$tokens) {
-    $tokens['[' . $this->options['id'] . '-role' . ']'] = $this->t('The name of the role.');
-    $tokens['[' . $this->options['id'] . '-rid' . ']'] = $this->t('The role ID of the role.');
-  }
-
-  protected function addSelfTokens(&$tokens, $item) {
-    $tokens['[' . $this->options['id'] . '-role' . ']'] = $item['role'];
-    $tokens['[' . $this->options['id'] . '-rid' . ']'] = $item['rid'];
-  }
-  */
-
 }

core/modules/user/src/Plugin/views/filter/Name.php

@@ -96,9 +96,9 @@ class Name extends InOperator {
     // prevent array filter from removing our anonymous user.
   }
 
-/**
- * {@inheritdoc}
- */
+  /**
+   * {@inheritdoc}
+   */
   public function getValueOptions() {
     return $this->valueOptions;
   }
@@ -108,7 +108,8 @@ class Name extends InOperator {
     $this->valueOptions = array();
 
     if ($this->value) {
-      $result = entity_load_multiple_by_properties('user', array('uid' => $this->value));
+      $result = \Drupal::entityTypeManager()->getStorage('user')
+        ->loadByProperties(['uid' => $this->value]);
       foreach ($result as $account) {
         if ($account->id()) {
           $this->valueOptions[$account->id()] = $account->label();

core/modules/user/src/Tests/UserAdminTest.php

@@ -100,7 +100,7 @@ class UserAdminTest extends WebTestBase {
     $config
       ->set('notify.status_blocked', TRUE)
       ->save();
-    $this->drupalPostForm('admin/people', $edit, t('Apply'), array(
+    $this->drupalPostForm('admin/people', $edit, t('Apply to selected items'), array(
       // Sort the table by username so that we know reliably which user will be
       // targeted with the blocking action.
       'query' => array('order' => 'name', 'sort' => 'asc')
@@ -121,7 +121,7 @@ class UserAdminTest extends WebTestBase {
     $editunblock = array();
     $editunblock['action'] = 'user_unblock_user_action';
     $editunblock['user_bulk_form[4]'] = TRUE;
-    $this->drupalPostForm('admin/people', $editunblock, t('Apply'), array(
+    $this->drupalPostForm('admin/people', $editunblock, t('Apply to selected items'), array(
       // Sort the table by username so that we know reliably which user will be
       // targeted with the blocking action.
       'query' => array('order' => 'name', 'sort' => 'asc')
@@ -174,8 +174,8 @@ class UserAdminTest extends WebTestBase {
       ->save();
     // Register a new user account.
     $edit = array();
-    $edit['name'] = $name = $this->randomMachineName();
-    $edit['mail'] = $mail = $edit['name'] . '@example.com';
+    $edit['name'] = $this->randomMachineName();
+    $edit['mail'] = $edit['name'] . '@example.com';
     $this->drupalPostForm('user/register', $edit, t('Create new account'));
     $subject = 'Account details for ' . $edit['name'] . ' at ' . $system->get('name') . ' (pending admin approval)';
     // Ensure that admin notification mail is sent to the configured

core/modules/user/src/Tests/UserBlocksTest.php

@@ -34,9 +34,9 @@ class UserBlocksTest extends WebTestBase {
     $this->drupalLogout($this->adminUser);
   }
 
-   /**
-    * Tests that user login block is hidden from user/login.
-    */
+  /**
+   * Tests that user login block is hidden from user/login.
+   */
   function testUserLoginBlockVisibility() {
     // Array keyed list where key being the URL address and value being expected
     // visibility as boolean type.
@@ -51,7 +51,7 @@ class UserBlocksTest extends WebTestBase {
       $elements = $this->xpath('//div[contains(@class,"block-user-login-block") and @role="form"]');
       if ($expected_visibility) {
         $this->assertTrue(!empty($elements), 'User login block in path "' . $path . '" should be visible');
-     }
+      }
       else {
         $this->assertTrue(empty($elements), 'User login block in path "' . $path . '" should not be visible');
       }
@@ -87,6 +87,17 @@ class UserBlocksTest extends WebTestBase {
     $this->drupalPostForm('http://example.com/', $edit, t('Log in'), array('external' => FALSE));
     // Check that we remain on the site after login.
     $this->assertUrl($user->url('canonical', ['absolute' => TRUE]), [], 'Redirected to user profile page after login from the frontpage');
+
+    // Verify that form validation errors are displayed immediately for forms
+    // in blocks and not on subsequent page requests.
+    $this->drupalLogout();
+    $edit = array();
+    $edit['name'] = 'foo';
+    $edit['pass'] = 'invalid password';
+    $this->drupalPostForm('filter/tips', $edit, t('Log in'));
+    $this->assertText(t('Unrecognized username or password. Forgot your password?'));
+    $this->drupalGet('filter/tips');
+    $this->assertNoText(t('Unrecognized username or password. Forgot your password?'));
   }
 
   /**

core/modules/user/src/Tests/UserCancelTest.php

@@ -124,7 +124,7 @@ class UserCancelTest extends WebTestBase {
       'action' => 'user_cancel_user_action',
       'user_bulk_form[0]' => TRUE,
     );
-    $this->drupalPostForm('admin/people', $edit, t('Apply'));
+    $this->drupalPostForm('admin/people', $edit, t('Apply to selected items'));
 
     // Verify that uid 1's account was not cancelled.
     $user_storage->resetCache(array(1));
@@ -353,7 +353,7 @@ class UserCancelTest extends WebTestBase {
     $test_node = $node_storage->load($node->id());
     $this->assertTrue(($test_node->getOwnerId() == 0 && $test_node->isPublished()), 'Node of the user has been attributed to anonymous user.');
     $test_node = node_revision_load($revision, TRUE);
-    $this->assertTrue(($test_node->getRevisionAuthor()->id() == 0 && $test_node->isPublished()), 'Node revision of the user has been attributed to anonymous user.');
+    $this->assertTrue(($test_node->getRevisionUser()->id() == 0 && $test_node->isPublished()), 'Node revision of the user has been attributed to anonymous user.');
     $node_storage->resetCache(array($revision_node->id()));
     $test_node = $node_storage->load($revision_node->id());
     $this->assertTrue(($test_node->getOwnerId() != 0 && $test_node->isPublished()), "Current revision of the user's node was not attributed to anonymous user.");
@@ -567,7 +567,7 @@ class UserCancelTest extends WebTestBase {
     for ($i = 0; $i <= 4; $i++) {
       $edit['user_bulk_form[' . $i . ']'] = TRUE;
     }
-    $this->drupalPostForm('admin/people', $edit, t('Apply'));
+    $this->drupalPostForm('admin/people', $edit, t('Apply to selected items'));
     $this->assertText(t('Are you sure you want to cancel these user accounts?'), 'Confirmation form to cancel accounts displayed.');
     $this->assertText(t('When cancelling these accounts'), 'Allows to select account cancellation method.');
     $this->assertText(t('Require email confirmation to cancel account'), 'Allows to send confirmation mail.');

core/modules/user/src/Tests/UserLoginTest.php

@@ -171,7 +171,7 @@ class UserLoginTest extends WebTestBase {
       }
     }
     else {
-      $this->assertText(t('Unrecognized username or password. Have you forgotten your password?'));
+      $this->assertText(t('Unrecognized username or password. Forgot your password?'));
     }
   }
 

core/modules/user/src/Tests/UserPasswordResetTest.php

@@ -88,7 +88,7 @@ class UserPasswordResetTest extends PageCacheTagsTestBase {
     $edit['name'] = $this->account->getUsername();
     $this->drupalPostForm(NULL, $edit, t('Submit'));
 
-     // Verify that the user was sent an email.
+    // Verify that the user was sent an email.
     $this->assertMail('to', $this->account->getEmail(), 'Password email sent to user.');
     $subject = t('Replacement login information for @username at @site', array('@username' => $this->account->getUsername(), '@site' => $this->config('system.site')->get('name')));
     $this->assertMail('subject', $subject, 'Password reset email subject is correct.');
@@ -287,7 +287,7 @@ class UserPasswordResetTest extends PageCacheTagsTestBase {
       'pass' => $this->randomMachineName(),
     );
     $this->drupalPostForm('user/login', $edit, t('Log in'));
-    $this->assertRaw(t('Unrecognized username or password. <a href=":password">Have you forgotten your password?</a>',
+    $this->assertRaw(t('Unrecognized username or password. <a href=":password">Forgot your password?</a>',
       array(':password' => \Drupal::url('user.pass', [], array('query' => array('name' => $edit['name']))))));
     unset($edit['pass']);
     $this->drupalGet('user/password', array('query' => array('name' => $edit['name'])));
@@ -332,6 +332,6 @@ class UserPasswordResetTest extends PageCacheTagsTestBase {
     $this->assertNoText($user2->getUsername(), 'The invalid password reset page does not show the user name.');
     $this->assertUrl('user/password', array(), 'The user is redirected to the password reset request page.');
     $this->assertText('You have tried to use a one-time login link that has either been used or is no longer valid. Please request a new one using the form below.');
-   }
+  }
 
 }

core/modules/user/src/Tests/UserRegistrationTest.php

@@ -40,7 +40,10 @@ class UserRegistrationTest extends WebTestBase {
     $edit['mail'] = $mail = $edit['name'] . '@example.com';
     $this->drupalPostForm('user/register', $edit, t('Create new account'));
     $this->assertText(t('A welcome message with further instructions has been sent to your email address.'), 'User registered successfully.');
-    $accounts = entity_load_multiple_by_properties('user', array('name' => $name, 'mail' => $mail));
+
+    /** @var EntityStorageInterface $storage */
+    $storage = $this->container->get('entity_type.manager')->getStorage('user');
+    $accounts = $storage->loadByProperties(['name' => $name, 'mail' => $mail]);
     $new_user = reset($accounts);
     $this->assertTrue($new_user->isActive(), 'New account is active after registration.');
     $resetURL = user_pass_reset_url($new_user);
@@ -54,7 +57,7 @@ class UserRegistrationTest extends WebTestBase {
     $edit['mail'] = $mail = $edit['name'] . '@example.com';
     $this->drupalPostForm('user/register', $edit, t('Create new account'));
     $this->container->get('entity.manager')->getStorage('user')->resetCache();
-    $accounts = entity_load_multiple_by_properties('user', array('name' => $name, 'mail' => $mail));
+    $accounts = $storage->loadByProperties(['name' => $name, 'mail' => $mail]);
     $new_user = reset($accounts);
     $this->assertFalse($new_user->isActive(), 'New account is blocked until approved by an administrator.');
   }
@@ -83,7 +86,8 @@ class UserRegistrationTest extends WebTestBase {
     $edit['pass[pass2]'] = $new_pass;
     $this->drupalPostForm('user/register', $edit, t('Create new account'));
     $this->container->get('entity.manager')->getStorage('user')->resetCache();
-    $accounts = entity_load_multiple_by_properties('user', array('name' => $name, 'mail' => $mail));
+    $accounts = $this->container->get('entity_type.manager')->getStorage('user')
+      ->loadByProperties(['name' => $name, 'mail' => $mail]);
     $new_user = reset($accounts);
     $this->assertNotNull($new_user, 'New account successfully created with matching passwords.');
     $this->assertText(t('Registration successful. You are now logged in.'), 'Users are logged in after registering.');
@@ -108,7 +112,8 @@ class UserRegistrationTest extends WebTestBase {
     $this->assertText(t('The username @name has not been activated or is blocked.', array('@name' => $name)), 'User cannot log in yet.');
 
     // Activate the new account.
-    $accounts = entity_load_multiple_by_properties('user', array('name' => $name, 'mail' => $mail));
+    $accounts = $this->container->get('entity_type.manager')->getStorage('user')
+      ->loadByProperties(['name' => $name, 'mail' => $mail]);
     $new_user = reset($accounts);
     $admin_user = $this->drupalCreateUser(array('administer users'));
     $this->drupalLogin($admin_user);
@@ -248,7 +253,8 @@ class UserRegistrationTest extends WebTestBase {
     $this->drupalPostForm(NULL, $edit, t('Create new account'));
 
     // Check user fields.
-    $accounts = entity_load_multiple_by_properties('user', array('name' => $name, 'mail' => $mail));
+    $accounts = $this->container->get('entity_type.manager')->getStorage('user')
+      ->loadByProperties(['name' => $name, 'mail' => $mail]);
     $new_user = reset($accounts);
     $this->assertEqual($new_user->getUsername(), $name, 'Username matches.');
     $this->assertEqual($new_user->getEmail(), $mail, 'Email address matches.');
@@ -338,7 +344,8 @@ class UserRegistrationTest extends WebTestBase {
     $edit['test_user_field[0][value]'] = $value;
     $this->drupalPostForm(NULL, $edit, t('Create new account'));
     // Check user fields.
-    $accounts = entity_load_multiple_by_properties('user', array('name' => $name, 'mail' => $mail));
+    $accounts = $this->container->get('entity_type.manager')->getStorage('user')
+      ->loadByProperties(['name' => $name, 'mail' => $mail]);
     $new_user = reset($accounts);
     $this->assertEqual($new_user->test_user_field->value, $value, 'The field value was correctly saved.');
 
@@ -367,7 +374,8 @@ class UserRegistrationTest extends WebTestBase {
       $edit['mail'] = $mail = $edit['name'] . '@example.com';
       $this->drupalPostForm(NULL, $edit, t('Create new account'));
       // Check user fields.
-      $accounts = entity_load_multiple_by_properties('user', array('name' => $name, 'mail' => $mail));
+      $accounts = $this->container->get('entity_type.manager')->getStorage('user')
+        ->loadByProperties(array('name' => $name, 'mail' => $mail));
       $new_user = reset($accounts);
       $this->assertEqual($new_user->test_user_field[0]->value, $value, format_string('@js : The field value was correctly saved.', array('@js' => $js)));
       $this->assertEqual($new_user->test_user_field[1]->value, $value + 1, format_string('@js : The field value was correctly saved.', array('@js' => $js)));

core/modules/user/src/Tests/UserRoleAdminTest.php

@@ -113,7 +113,7 @@ class UserRoleAdminTest extends WebTestBase {
       $saved_rids[] = $role->id();
       $weight--;
     }
-    $this->drupalPostForm('admin/people/roles', $edit, t('Save order'));
+    $this->drupalPostForm('admin/people/roles', $edit, t('Save'));
     $this->assertText(t('The role settings have been updated.'), 'The role settings form submitted successfully.');
 
     // Load up the user roles with the new weights.

core/modules/user/src/Tests/UserSearchTest.php

@@ -21,8 +21,9 @@ class UserSearchTest extends WebTestBase {
 
   function testUserSearch() {
     // Verify that a user without 'administer users' permission cannot search
-    // for users by email address.
-    $user1 = $this->drupalCreateUser(array('access user profiles', 'search content'));
+    // for users by email address. Additionally, ensure that the username has a
+    // plus sign to ensure searching works with that.
+    $user1 = $this->drupalCreateUser(array('access user profiles', 'search content'), "foo+bar");
     $this->drupalLogin($user1);
     $keys = $user1->getEmail();
     $edit = array('keys' => $keys);

core/modules/user/src/Tests/UserTimeZoneTest.php

@@ -2,6 +2,7 @@
 
 namespace Drupal\user\Tests;
 
+use Drupal\Core\Datetime\Entity\DateFormat;
 use Drupal\simpletest\WebTestBase;
 
 /**
@@ -27,7 +28,7 @@ class UserTimeZoneTest extends WebTestBase {
       ->set('timezone.user.configurable', 1)
       ->set('timezone.default', 'America/Los_Angeles')
       ->save();
-    entity_load('date_format', 'medium')
+    DateFormat::load('medium')
       ->setPattern('Y-m-d H:i T')
       ->save();
 

core/modules/user/src/Tests/UserTranslationUITest.php

@@ -53,7 +53,10 @@ class UserTranslationUITest extends ContentTranslationUITestBase {
    * {@inheritdoc}
    */
   protected function doTestTranslationEdit() {
-    $entity = entity_load($this->entityTypeId, $this->entityId, TRUE);
+    $storage = $this->container->get('entity_type.manager')
+      ->getStorage($this->entityTypeId);
+    $storage->resetCache([$this->entityId]);
+    $entity = $storage->load($this->entityId);
     $languages = $this->container->get('language_manager')->getLanguages();
 
     foreach ($this->langcodes as $langcode) {

core/modules/user/src/Tests/Views/BulkFormAccessTest.php

@@ -50,7 +50,7 @@ class BulkFormAccessTest extends UserTestBase {
       'user_bulk_form[' . ($no_edit_user->id() - 1) . ']' => TRUE,
       'action' => 'user_block_user_action',
     );
-    $this->drupalPostForm('test-user-bulk-form', $edit, t('Apply'));
+    $this->drupalPostForm('test-user-bulk-form', $edit, t('Apply to selected items'));
     $this->assertResponse(200);
 
     $this->assertRaw(SafeMarkup::format('No access to execute %action on the @entity_type_label %entity_label.', [
@@ -71,7 +71,7 @@ class BulkFormAccessTest extends UserTestBase {
       'user_bulk_form[' . ($normal_user->id() - 1) . ']' => TRUE,
       'action' => 'user_block_user_action',
     );
-    $this->drupalPostForm('test-user-bulk-form', $edit, t('Apply'));
+    $this->drupalPostForm('test-user-bulk-form', $edit, t('Apply to selected items'));
 
     $normal_user = User::load($normal_user->id());
     $this->assertTrue($normal_user->isBlocked(), 'The user is blocked.');
@@ -83,7 +83,7 @@ class BulkFormAccessTest extends UserTestBase {
       'user_bulk_form[' . ($normal_user->id() - 1) . ']' => TRUE,
       'action' => 'user_unblock_user_action',
     );
-    $this->drupalPostForm('test-user-bulk-form', $edit, t('Apply'));
+    $this->drupalPostForm('test-user-bulk-form', $edit, t('Apply to selected items'));
 
     // Re-load the normal user and ensure it is still blocked.
     $normal_user = User::load($normal_user->id());
@@ -114,7 +114,7 @@ class BulkFormAccessTest extends UserTestBase {
       'user_bulk_form[' . ($account2->id() - 1) . ']' => TRUE,
       'action' => 'user_cancel_user_action',
     );
-    $this->drupalPostForm('test-user-bulk-form', $edit, t('Apply'));
+    $this->drupalPostForm('test-user-bulk-form', $edit, t('Apply to selected items'));
     $edit = array(
       'user_cancel_method' => 'user_cancel_delete',
     );

core/modules/user/src/Tests/Views/BulkFormTest.php

@@ -2,6 +2,7 @@
 
 namespace Drupal\user\Tests\Views;
 
+use Drupal\user\Entity\User;
 use Drupal\user\RoleInterface;
 use Drupal\views\Views;
 
@@ -45,7 +46,7 @@ class BulkFormTest extends UserTestBase {
     $edit = array(
       'action' => 'user_block_user_action',
     );
-    $this->drupalPostForm('test-user-bulk-form', $edit, t('Apply'));
+    $this->drupalPostForm('test-user-bulk-form', $edit, t('Apply to selected items'));
     $this->assertText(t('No users selected.'));
 
     // Assign a role to a user.
@@ -59,7 +60,7 @@ class BulkFormTest extends UserTestBase {
       'user_bulk_form[1]' => TRUE,
       'action' => 'user_add_role_action.' . $role,
     );
-    $this->drupalPostForm(NULL, $edit, t('Apply'));
+    $this->drupalPostForm(NULL, $edit, t('Apply to selected items'));
     // Re-load the user and check their roles.
     $user_storage->resetCache(array($account->id()));
     $account = $user_storage->load($account->id());
@@ -69,7 +70,7 @@ class BulkFormTest extends UserTestBase {
       'user_bulk_form[1]' => TRUE,
       'action' => 'user_remove_role_action.' . $role,
     );
-    $this->drupalPostForm(NULL, $edit, t('Apply'));
+    $this->drupalPostForm(NULL, $edit, t('Apply to selected items'));
     // Re-load the user and check their roles.
     $user_storage->resetCache(array($account->id()));
     $account = $user_storage->load($account->id());
@@ -82,7 +83,7 @@ class BulkFormTest extends UserTestBase {
       'user_bulk_form[1]' => TRUE,
       'action' => 'user_block_user_action',
     );
-    $this->drupalPostForm(NULL, $edit, t('Apply'));
+    $this->drupalPostForm(NULL, $edit, t('Apply to selected items'));
     // Re-load the user and check their status.
     $user_storage->resetCache(array($account->id()));
     $account = $user_storage->load($account->id());
@@ -103,7 +104,7 @@ class BulkFormTest extends UserTestBase {
       'user_bulk_form[0]' => TRUE,
       'action' => 'user_block_user_action',
     );
-    $this->drupalPostForm(NULL, $edit, t('Apply'));
+    $this->drupalPostForm(NULL, $edit, t('Apply to selected items'));
     $anonymous_account = $user_storage->load(0);
     $this->assertTrue($anonymous_account->isBlocked(), 'Ensure the anonymous user got blocked.');
 
@@ -130,7 +131,7 @@ class BulkFormTest extends UserTestBase {
    */
   public function testBulkFormCombineFilter() {
     // Add a user.
-    $account = entity_load('user', $this->users[0]->id());
+    User::load($this->users[0]->id());
     $view = Views::getView('test_user_bulk_form_combine_filter');
     $errors = $view->validate();
     $this->assertEqual(reset($errors['default']), t('Field %field set in %filter is not usable for this filter type. Combined field filter only works for simple fields.', array('%field' => 'User: Bulk update', '%filter' => 'Global: Combine fields filter')));