Author: dunlop
Security advisories: Drupal core – Moderately critical – Access bypass – SA-CORE-2021-009
Project: Drupal coreDate: 2021-September-15Security risk: Moderately critical 10∕25 AC:Basic/A:User/CI:Some/II:None/E:Theoretical/TD:DefaultVulnerability: Access bypassCVE IDs: CVE-2020-13676Description: The QuickEdit module does not properly check access to fields in some circumstances, which can lead to unintended disclosure of field data. Sites are only affected if the QuickEdit module (which comes with the Standard profile) is installed. This advisory is not covered by Drupal Steward.Solution: Install the latest…
Security advisories: Drupal core – Moderately critical – Access bypass – SA-CORE-2021-008
Project: Drupal coreDate: 2021-September-15Security risk: Moderately critical 11∕25 AC:Basic/A:None/CI:None/II:Some/E:Theoretical/TD:UncommonVulnerability: Access bypassCVE IDs: CVE-2020-13675Description: Drupal’s JSON:API and REST/File modules allow file uploads through their HTTP APIs. The modules do not correctly run all file validation, which causes an access bypass vulnerability. An attacker might be able to upload files that bypass the file validation process implemented by modules on the site. This…
Security advisories: Drupal core – Moderately critical – Cross Site Request Forgery – SA-CORE-2021-007
Project: Drupal coreDate: 2021-September-15Security risk: Moderately critical 14∕25 AC:Complex/A:None/CI:Some/II:Some/E:Theoretical/TD:DefaultVulnerability: Cross Site Request ForgeryCVE IDs: CVE-2020-13674Description: The QuickEdit module does not properly validate access to routes, which could allow cross-site request forgery under some circumstances and lead to possible data integrity issues. Sites are only affected if the QuickEdit module (which comes with the Standard profile) is installed. Removing the “access in-place…
Security advisories: Drupal core – Moderately critical – Cross Site Request Forgery – SA-CORE-2021-006
Project: Drupal coreDate: 2021-September-15Security risk: Moderately critical 10∕25 AC:Basic/A:User/CI:None/II:Some/E:Theoretical/TD:DefaultVulnerability: Cross Site Request ForgeryCVE IDs: CVE-2020-13673Description: The Drupal core Media module allows embedding internal and external media in content fields. In certain circumstances, the filter could allow an unprivileged user to inject HTML into a page when it is accessed by a trusted user with permission to embed media. In some cases,…
robertroose.com: Design tips for Drupal developers
As a Drupal developer you don’t always have the time or resources to spend on designing the things you build. In this blog post I will share a few easy to follow guidelines that will make your work instantly look better.
Tag1 Consulting: Serenity Notes: End-to-End Encrypted Collaborative Notes
Serenity Notes is a new application that enables you to collaborate on Notes across devices, with multiple users, in real-time, using end-to-end encryption to keep all your data and info private and secure. It has a game changing SDK enabling the addition of e2e real-time collaboration to your applications, without the complicated underlying complexities. In…
ComputerMinds.co.uk: Get Hook-ed on Object-Oriented Programming
When writing a hook implementation, for example of hook_cron, there’s often a tendency to write purely procedural code, like this: function my_module_cron() { $entity_type_manager = Drupal::entityTypeManager(); $node_storage = $entity_type_manager->getStorage(‘node’); // More code goes here. } If you’ve got one or two easily understandable lines of code, fine, but frequently you’ll end up with a little…
Agiledrop.com Blog: 6 challenges of hybrid work and how to overcome them
In this article, we address 6 main challenges to implementing hybrid work and offer solutions for them. READ MORE
Innoraft Drupal Blogs: 7 Reasons Why Should You Choose Drupal for eCommerce Website
7 Reasons Why Should You Choose Drupal for eCommerce Website Drupal CMS has hundreds of modules and themes that add magic to your online business. Read this article why to choose Drupal for eCommerce Website development. Tanjeet Wed, 09/15/2021 – 12:12 Drupal Development Drupal Planet Ecommerce Website Development Ecommerce Development
OpenSense Labs: The State of Headless Architecture in 2021
The State of Headless Architecture in 2021 Gurpreet Kaur Tue, 09/14/2021 – 19:47 Every year the technology trends keep on changing and every year it keeps on astounding us. And I believe it is these technological advancements that keep the world moving, and standstill isn’t something that any of us would like or even prefer. …