BobbyMods

• Advisory ID: DRUPAL-SA-CONTRIB-2012-014
• Project: Drupal Commerce (third-party module)
• Version: 7.x
• Date: 2012-January-25
• Security risk: Moderately critical
• Exploitable from: Remote
• Vulnerability: Cross Site Scripting

Description

Drupal Commerce is a flexible eCommerce framework built on Drupal 7 that lets you construct any type of eCommerce website. Part of its flexibility lies in its ability to render product fields into node displays through the product reference field used to build dynamic Add to Cart forms. In Drupal Commerce 1.1 this feature was expanded to also incorporate the "extra fields" of products, i.e. the product title and SKU.

The theme functions used to render product titles and SKUs prints those variables to the page without properly sanitizing them first. A user with the proper permissions could create a product that ends up in a node display where a malicious title or SKU is rendered.

This vulnerability is mitigated by the fact that the attacker must have a role with a product creation permission, and since Drupal Commerce 1.1, the site must have been updated to make use of these extra fields in product display nodes as they default to being hidden on all product displays.

Versions affected

• Drupal Commerce version 7.x-1.1.

Drupal core is not affected. If you do not use the contributed Drupal Commerce module, there is nothing you need to do.

Solution

Install the latest version:

• If you use Drupal Commerce 7.x-1.1, upgrade to Drupal Commerce 7.x-1.2

See also the Drupal Commerce project page.

Reported by

• Ivo Van Geertruyen (mr.baileys) of the Drupal Security Team

Fixed by

• Ivo Van Geertruyen (mr.baileys) of the Drupal Security Team
• Ryan Szrama (rszrama) the module maintainer

Contact and More Information

The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact.

Learn more about the Drupal Security team and their policies, writing secure code for Drupal, and securing your site.

• Advisory ID: DRUPAL-SA-CONTRIB-2012-013
• Project: Search Autocomplete (third-party module)
• Version: 7.x
• Date: 2012-January-25
• Security risk: Critical
• Exploitable from: Remote
• Vulnerability: SQL Injection

Description

The Search Autocomplete module allows you to add autocomplete functionality to the search fields of a Drupal site.

Search Autocomplete does not properly use Drupal's database API, making it possible for a malicious user to carryout SQL injection on the site. This vulnerability is mitigated by the fact that users must have a role with permission "use search_autocomplete" to exploit.

Versions affected

• Search Autocomplete versions prior to 7.x-2.1.

Drupal core is not affected. If you do not use the contributed Search Autocomplete module, there is nothing you need to do.

Solution

Install the latest version:

• If you use the Search Autocomplete module for Drupal 7.x, upgrade to Search Autocomplete 7.x-2.1

See the Search Autocomplete project page for more information.

Reported by

• Miguel Hermo (serans)

Fixed by

• Dominique Clause (Miroslav Talenberg) the module maintainer
• Miguel Hermo (serans)

Coordinated by

• Ben Jeavons of the Drupal Security Team

Contact and More Information

The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact.

Learn more about the Drupal Security team and their policies, writing secure code for Drupal, and securing your site.

The PHP development team announces the 6th release candidate of PHP 5.4. PHP 5.4 includes new language features and removes several legacy (deprecated) behaviours. Windows binaries can be downloaded from the Windows QA site. THIS IS A RELEASE CANDIDATE - DO NOT USE IT IN PRODUCTION!. This is the 6th release candidate. The release candidate phase is intended as a period of bug fixing prior to the stable release. No new features should be included before the final version of PHP 5.4.0. The 6th release candidate focused on improving traits. Please test them carefully and help us to identify bugs in order to ensure that the release is solid and all things behave as expected. Please take the time to test this release candidate against your code base and report any problems that you encounter to the QA mailing list and/or the PHP bug tracker. A complete list of changes since the last release candidate can be found at NEWS The next candidate will be released on Feb 2.

Introduction

Drupal.org has over 725,000 registered members in 228 countries. However, only a very small percentage of this members contribute back to the project. Why is this? How can we attract more contributors? What can we do to make it easier for people to contribute? Which areas of the Drupal project would people want to contribute?

To get answers to these questions, two surveys were conducted in 2011 by the community to understand the experience of contributing or considering to contribute to the Drupal project.

This is a combined report of 358 respondents’ responses to the surveys.

Methodology

The first survey focused on the Drupal contribution experience for the Prairie initiative and received 303 responses. It was written and conducted by Leisa Reichelt (leisareichelt) that ran from April 25, 2011 to September 20, 2011.

The second, the Getting Involved survey, [list of questions] received 55 responses. It was written and conducted by Heather James (heather), Dharmesh Mistry (dcmistry) and Lisa Rex (lisarex) from October 21, 2011 to November 9, 2011. This survey focused on the respondent’s Drupal profile; their expectations, roadblocks, motivations; and Drupal areas that need most contributors, among many other things.

Profile of the respondents Prairie Survey

Of the 303 respondents, 64% were non-coders and 31% were non-active contributors.
A big majority (71%) of the respondents from the survey identified themselves as “an established, active member of the community”. The majority of the respondents regularly contribute (41%) and a good amount stated that they contribute occasionally (36%). The majority of the non-active contributors (36%) have never contributed to the project.

Getting Involved Survey

The majority of the respondents identified themselves as Site Builder (68%), and/or Developer (59%). A significant portion of respondents identified themselves as Themer (34%) and/or Project Manager (29%). It is also worth noting that 73% of the respondents cited Drupal as their source of income.

Note: Each of the surveys focused on different aspects of Drupal contributions.

Executive Summary

The findings from both surveys are summarized below, but also see:

• Detailed analysis and findings from the Prairie 2011 survey
• Detailed analysis and findings from the Getting Involved 2011 survey

The contributing experience

From the Getting Involved survey, it was found that the big motivator for people to contribute was simply to improve Drupal and support its community (40%). The other motivator was to grow their knowledge and network (25%). However, when the Getting Involved survey asked about their opinion about the existing community structure, a majority of the respondents (48.9%) had a negative reaction. They thought it was fragmented, chaotic, not great and could use improvements.

The majority of respondents of the Prairie survey thought the experience of contributing was:

• “Very much” rewarding and collaborative: Majority of the respondents of the Prairie survey thought the experience of contributing to the Drupal project was “very much” collaborative (47%) and rewarding (46%). However, the non-coders and the non-active contributors either stayed with “somewhat” or swayed between “very much” and “somewhat” with no statistical significance.
• “Not really” to “somewhat” efficient: Majority thought the process of contribution was “not really” efficient (43%) or “somewhat” efficient (40%) with no significant statistical difference between the responses. Non coders shared the same feeling.
• “Somewhat” intimidating, confusing, unwieldy and supportive: The respondents of the second survey thought the experience of contributing to the Drupal project was “somewhat” intimidating (46%), confusing (49%), unwieldy (43%) and supportive (52%).
• Split between “Very much” and “Somewhat” inspiring, exciting and friendly: When asked about the experience of contributing in terms of inspiration, excitement and friendliness, the majority swayed between “very much” and “somewhat” responses with no significant statistical difference. It is worth noting that in all the four categories (Rewarding, Inspiring, Excitement and Friendly), the majority of non-coders and non-active contributors stuck to “somewhat”.

What do people want to contribute?

Respondents of the Getting Involved survey mostly want to contribute on Documentation/technical writing and PHP development/LAMP (54% each). The next area with the most interest is training (46%) and Mentoring/Support (32%).

What areas need the most contributions?

The respondents thought documentation (12 respondents), Drupal.org. (7 respondents) and Design/UX/Usability (6 respondents) needed the most attention from other contributors.

What areas of Drupal community do you think need the most contributions?

Although the respondents from the second survey thought the contributing experience was “very much” collaborative, majority (47%) thought “Redesign the issue page to make it easier to collaborative effectively” as a “very important” initiative. Besides that, the respondents (overall, non coders and non active contributors) agreed (47%) that “Redesigning parts of Drupal.org to help newbies find ways to start contributing” as “very important”. This number was higher for non active contributors (55%) than the others.

Other Findings

Across profiles (of the second survey), “Creating ‘team’ pages to aggregate activities and people interested in a topic” (48%) and “Designing better tools for planning large initiatives” (41%) were deemed as “quite important”.

For “Designing a reputation system to show what different people are expert in and how well they are known by the Drupal community” majority of respondents swayed between quite important (32%) to less important (39%). This was also true for non coders and non active contributors.

Roadblocks to contributing

The major roadblock from they getting involved was lack of information on how to get involved (and whom to contact) (42%). This issue of getting started (48%) was also found in the Prairie survey.

• Lack of information on how to contribute, what to work on or whom to contact (42%)
• Don’t have time (18%)
• “I don’t know enough technically” (16%)
• Intimidation factor (13%)
• Want to talk/need guidance from mentors (13%)
• Slow turn around time to get feedback/or to get committed (7%)

‘Get Involved’ pages and Drupal.org

Only 16% of the respondents of the Prairie survey visit the ‘Get Involved’ pages on Drupal.org. 46% of Prairie survey respondents took the opportunity to complain about Drupal.org. They wanted a better Drupal.org. (24%), better tools to collaborate (5%), and an efficient issue queue (5%). For Drupal.org., they particularly wanted to find information easily (4%).

How could we improve the experience?

To make the experience of contributing better, non-contributors wanted better information to get started. And the contributors reiterated this when asked what would have been helpful when they started contributing. Besides that, the second most important thing that mattered was the human aspect. The personal touch would have been helpful to the contributors while they were starting and the non contributors want to work with experienced contributors. It is worth noting here that a significant number of respondents are interested in helping with this (Training - 46%, Mentoring/Support - 32%). (Responses from the Getting Involved survey)

Other noteworthy things

• Designers and non-programmers who responded (11) to open-ended question in the Prairie survey complained that contributing to the project was heavily code focused, that designers did not get the credit they deserved, and that they did not know how the non-coders could contribute to the project. Like the respondents from the Getting Involved survey, the non-programmers also reiterated that they did not know where they were needed.
• A small but considerate amount of Prairie survey respondents were discouraged by other community members and slow turn around time (8% each)
• The Getting Involved survey also asked as to what do they expect from a community leader, and they wanted someone who could moderate discussions/issues, offer guidance, and carve a plan for the community.

What do you think about the existing community structure?

Conclusion

We hope the findings from the survey will be helpful to the Drupal Association and the community on the next big priorities for Drupal.org. It is evident from the findings that a significant effort is required to provide effective, easy-to-find information on how to get started with contributing to the Drupal community. However, help from other community members is needed to keep the momentum going.

Next steps

Some conversations/efforts have begun toward this goal of improving the contributor experience, such as redesigning the Community, Support and Getting started landing pages, redesigning the issue queue and more.

We need to identify areas that need leaders, and areas that need contributors. Contributors are in demand for documentation especially.

If you are interested to contribute to this effort to provide better documentation for getting started with contributing, great! There are several open issues on improving Getting Involved content, including the Getting Involved landing page and Getting Involved Guide. Please visit this link to read about other community initiatives that might be of interest to you. If you are unsure where you can best help, please contact Lisa Rex (lisarex), who can point you in the right direction.

If you have any questions about the survey/findings, please feel free to contact Dharmesh Mistry (dcmistry).

ConFoo 2012 in Montreal, Canada on Feb 29 - Mar 02 ConFoo is the unique web conference in Canada gathering different tech communities in one place. find working solutions for your day to day challenges; discover new tools that increase your productivity; network with people from some of the world’s biggest companies; 160 presentations focusing on core competencies improvement; Don't miss this great opportunity and register today! Also check out our two training days around PHP, HTML5, Symfony2 and security topics right before the conference.

Come one, come all! As of January 18, 2012 nominations are open for the 2012 elections of two "at large" directors of the Drupal Association.

The at large directors are intended to represent the Drupal community. Specifics of the election were decided through a community-based process with participation by dozens of Drupal community members. More details are in the proposal that was approved by the Drupal Association board.

Who can vote?

Voting is open to all individuals who have a drupal.org account by the time the elections begin and who have logged in at least once in the past year. These individuals' accounts will be added to the voters list on association.drupal.org and they will have access to the voting.

To vote, you will rank candidates in order of your preference (1st, 2nd, 3rd, etc.). The results will be calculated using an "instant runoff" method. For an accessible explanation of how instant runoff vote tabulation works, see videos linked in this discussion.

How to run

Candidates needed! If you are considering running, please head over to the nominations page and read up on what's involved. From there you can fill out a candidate profile. You'll be asked for some information about yourself, like why you're running . When the nominations close, your candidate profile will be published and available for Drupal community members to browse. Comments will be enabled, so please monitor your candidate profile so you can respond to questions from community members.

Elections process

Elections will be held from January 30 to February 7, 2012. During this period, you can review and comment on candidate profiles on association.drupal.org and engage all candidates through posting to the Drupal Association group. We'll also be scheduling and announcing two phone-in all candidates meetings, where community members and candidates can ask questions and get to know each other.

Thanks and see you at the polls! We'll post another front-page announcement and announce via @drupal on Twitter when we're ready to go.

• Advisory ID: DRUPAL-SA-CONTRIB-2012-012
• Project: Quick Tabs (third-party module)
• Version: 6.x, 7.x
• Date: 2012-January-18
• Security risk: Moderately critical
• Exploitable from: Remote
• Vulnerability: Cross Site Scripting

Description

The Quick Tabs module allows users to create blocks of tabbed content, specifying a title for the block and the individual tabs.
Quick Tabs does not do sufficient filtering of user supplied text which presents a cross site scripting vulnerability.
This vulnerability is mitigated by the fact that an attacker must have a user account with a role permitted to create or edit a Quicktabs instance.

Versions affected

• Quicktabs 6.x-2.x versions prior to 6.x-2.1.
• Quicktabs 6.x-3.x versions prior to 6.x-3.1.
• Quicktabs 7.x-3.x versions prior to 7.x-3.3.

Drupal core is not affected. If you do not use the contributed Quick Tabs module, there is nothing you need to do.

Solution

Install the latest version:

• If you use the Quicktabs 2.x module for Drupal 6.x, upgrade to Quicktabs 6.x-2.1
• If you use the Quicktabs 3.x module for Drupal 6.x, upgrade to Quicktabs 6.x-3.1
• If you use the Quicktabs 3.x module for Drupal 7.x, upgrade to Quicktabs 7.x-3.3

See also the Quick Tabs project page.

Reported by

• Owen Barton of the Drupal Security Team
• Michael Smith

Fixed by

• Katherine Bailey the module maintainer
• Michael Smith

Contact and More Information

The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact.

Learn more about the Drupal Security team and their policies, writing secure code for Drupal, and securing your site.

• Advisory ID: DRUPAL-SA-CONTRIB-2012-011
• Project: Panels (third-party module)
• Version: 6.x
• Date: 2012-January-18
• Security risk: Moderately critical
• Exploitable from: Remote
• Vulnerability: Cross Site Scripting

Description

The Panels module allows a site administrator to create customized layouts for multiple uses.
The module doesn't sufficiently sanitize administrator supplied data.
This vulnerability is mitigated by the fact that an attacker must have a role with the permission "administer panel layouts".

Versions affected

• Panels 6.x-2.x versions prior to 6.x-3.10.

Drupal core is not affected. If you do not use the contributed Panels module, there is nothing you need to do.

Solution

Install the latest version:

• If you use the Panels module for Drupal 6.x, upgrade to Panels 6.x-3.10

See also the Panels project page.

Reported by

• Justin Klein Keane

Fixed by

• Justin Klein Keane
• Earl Miles the module maintainer

Coordinated by

• Greg Knaddison of the Drupal Security Team

Contact and More Information

The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact.

Learn more about the Drupal Security team and their policies, writing secure code for Drupal, and securing your site.