Development News

Bulgaria PHP Conference 2016

PHP Announcements - 2 hours 48 min ago
Bulgaria PHP Conference is the premier PHP conference, gathering PHP and frontend developers and engineers from all around Europe. Co-organized by the Bulgaria PHP User Group and SiteGround web hosting, the conference is bringing internationally renowned experts from the PHP industry to talk about APIs, Frameworks, Security, Testing, Continuous Integration, and much more! Highlights: 500+ passionate attendees 27 world renowned speakers 4 practical workshops 3 actioned-packed days 1 legendary after party Games, JeoPHPardy, Hackaton Amazing food, swag and gifts inlcuded Get your discounted ticket today. Price increases to the regular one (129 EUR) on September 1, 2016. Still not convinced? Here are several reasons to head to Sofia for Bulgaria PHP Conference.
Categories: Development News, PHP, PHP News

Site Verify - Moderately Critical - Cross Site Scripting - SA-CONTRIB-2017-051

Drupal Contributed Security - Wed, 05/24/2017 - 12:37
Description

The Site Verify module enables privilege users to verify a site with services like Google Webmaster Tools using meta tags or file uploads.

The module doesn't sufficiently sanitize input or restrict uploads.

This vulnerability is mitigated by the fact that an attacker must have a role with the permission "administer site verify".

CVE identifier(s) issued
  • A CVE identifier will be requested, and added upon issuance, in accordance with Drupal Security Team processes.
Versions affected
  • Site Verify 7.x-1.x versions prior to 7.x-1.2.

Drupal core is not affected. If you do not use the contributed Site verification module, there is nothing you need to do.

Solution

Install the latest version:

Also see the Site verification project page.

Reported by Fixed by Coordinated by Contact and More Information

The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact.

Learn more about the Drupal Security team and their policies, writing secure code for Drupal, and securing your site.

Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity

What’s new on Drupal.org? - April 2017

Drupal News - Wed, 05/24/2017 - 11:20

Read our Roadmap to understand how this work falls into priorities set by the Drupal Association with direction and collaboration from the Board and community.

DrupalCon Baltimore logo Apr 24-28

At the end of April we joined the community at DrupalCon Baltimore. We met with many of you there, gave our update at the public board meeting, and hosted a panel detailing the last 6 months worth of changes on Drupal.org. If you weren't able to join us for this con, we hope to see you in Vienna!

Drupal.org updates DrupalCon Vienna Full Site Launched!

DrupalCon Vienna logo Sep 26-29 2017

Speaking of Vienna, in April we launched the full site for DrupalCon Vienna which will take place from September 26-29th, 2017. If you're going to join us in Europe you can book your hotel now, or submit a session. Registration for the event will be opening soon!

DrupalCon Nashville Announced with new DrupalCon Brand

DrupalCon Nashville logo Apr 9-13 2018

Each year at DrupalCon the location of the next conference is held as closely guarded secret; the topic of speculation, friendly bets, and web crawlers looking for 403 pages. Per tradition, at the closing session we unveiled the next location for DrupalCon North America - Nashville, TN taking place from April 9-13th in 2018. But this year there was an extra surprise.

We've unveiled the new brand for DrupalCon, which you will begin to see as the new consistent identity for the event from city to city and year to year. You'll still see the unique character of the city highlighted for each regional event, but with an overarching brand that creates a consistent voice for the event.

Starring Projects

Users on Drupal.org may now star their favorite projects - making it easier to find favorite modules and themes for future projects, and giving maintainers a new dimension of feedback to judge their project's popularity. Users can find a list of the projects they've starred on the user profile. Over time we'll begin to factor the number of star's into a project's ranking in search results.

Starring Projects

At the same time that we made this change, we've also added a quick configuration for managing notification settings on a per-project basis. Users can opt to be notified of all issues for a project, only issues they've followed, or no issues. While these notification options have existed for some time, this new UI makes it easier than ever to control issue notifications in your inbox.

Project Browsing Improvements

One of the important functions of Drupal.org is to help Drupal site builders find the distributions, modules, and themes, that are the best fit for their needs. In April, we spent some time improving project browsing and discovery.

Search is now weighted by project usage so the most widely used modules for a given search phrase will be more likely to be the top result.

We've also added a filter to the project browsing pages to allow you to filter results by the presence of a supported, stable release. This should make it easier for site builders to sort out mature modules from those still in initial development.

Better visual separation of Documentation Guide description and contents

Better Documentation Guide Display

In response to user feedback, we've updated the visual display of Documentation Guides, to create a clearer distinction between the guide description text and the teaser text for the content within the guides.

Promoting hosting listings on the Download & Extend page

To leverage Drupal to the fullest requires a good hosting partner, and so we've begun promoting our hosting listings on the Download and Extend page. We want Drupal.org to provide every Drupal evaluator with all of the tools they need to achieve success—from the code itself, to professional services, to hosting, and more.

Composer Sub-tree splits of Drupal are now available

Composer Façade

For developers using Composer to manage their projects, sub-tree splits of Drupal Core and Components are now available. This allows php developers to use components of Drupal in their projects, without having to depend on Drupal in its entirety.

DrupalCI Automatic Requeuing of Tests in the event of a CI Error

DrupalCI logo

In the past, if the DrupalCI system encountered an error when attempting to run a test, the test would simply return a "CI error" message, and the user who submitted the test had to manually submit a new test. These errors would also cause the issues to be marked as 'Needs work' - potentially resetting the status of an otherwise RTBC issue.

We have updated Drupal.org's integration with DrupalCI so that instead of marking issues as needs work in the event of a CI Error, Drupal.org will instead automatically queue a retest.

Bugfix: Only retest one environment when running automatic RTBC retests

Finally, we've fixed a bug with the DrupalCI's automatic RTBC retest system. When Drupal HEAD changes, any RTBC patches are automatically retested to ensure that they still apply. It is only necessary to retest against the default or last-used test environment to ensure that the patch will work, but the automatic retests were being tested against every configured environment. We've fixed this issue, shortening queue times during a string of automatic retests and saving testing resources for the project.

———

As always, we’d like to say thanks to all the volunteers who work with us, and to the Drupal Association Supporters, who made it possible for us to work on these projects. In particular we want to thank:

If you would like to support our work as an individual or an organization, consider becoming a member of the Drupal Association.

Follow us on Twitter for regular updates: @drupal_org, @drupal_infra

Categories: Development News, Drupal

Custom Landing Page Builder - Unsupported - SA-CONTRIB-2017-050

Drupal Contributed Security - Wed, 05/24/2017 - 09:59
  • Advisory ID: DRUPAL-SA-CONTRIB-2017-050
  • Project: landing_page (third-party module)
  • Date: 24-May-2017
Description

The Custom Landing Page Builder module allows webmasters to build custom landing pages using a WYSIWYG editor while still having full control over the full layout of the page including the header, navigation, page content, footer, forms etc.

The security team is marking this module unsupported. There is a known
security issue with the module that has not been fixed by the maintainer.
If you would like to maintain this module, please read:
https://www.drupal.org/node/251466

Versions affected
  • All versions

Drupal core is not affected. If you do not use the contributed landing_page module,
there is nothing you need to do.

Solution

If you use the landing_page module for Drupal you should uninstall it.

Also see the landing_page project
page.

Reported by Fixed by

Not applicable

Contact and More Information

The Drupal security team can be reached at security at drupal.org or via
the contact form at https://www.drupal.org/contact.

Learn more about the Drupal Security team and their policies, writing secure code for Drupal, and securing your site.

Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity

The 5th Annual China PHP Conference

PHP Announcements - Mon, 05/22/2017 - 07:50
The 5th Annual China PHP Conference – June 17 to 18, Shanghai We will be hosting a 2-days event filled with high quality, technical sessions about PHP Core, PHP High Performance, PHP Engineering, and MySQL 5.7/8.0 more. Don’t miss out on 2-great days sessions, delicious food, fantastic shows and countless networking opportunities to engage with speakers and delegates. Go to www.phpconchina.com for tickets and more information.
Categories: Development News, PHP, PHP News

Display Suite - Moderately Critical - Cross Site Scripting - SA-CONTRIB-2017-049

Drupal Contributed Security - Wed, 05/17/2017 - 12:37
Description

Display Suite allows you to take full control over how your content is displayed using a drag and drop interface.

In certain situations, Display Suite does not properly sanitize some of the output, allowing a malicious user to embed scripts within a page, resulting in a Cross-site Scripting (XSS) vulnerability.

Versions affected
  • Display Suite 8.x-2.x versions prior to 8.x-2.7.
  • Display Suite 8.x-3.x versions prior to 8.x-3.0.

Drupal core is not affected. If you do not use the contributed Display Suite module, there is nothing you need to do.

Solution

Install the latest version:

Also see the Display Suite project page.

Reported by Fixed by Coordinated by Contact and More Information

The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact.

Learn more about the Drupal Security team and their policies, writing secure code for Drupal, and securing your site.

Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity

Bootstrap - Critical - Information Disclosure - SA-CONTRIB-2017-048

Drupal Contributed Security - Wed, 05/17/2017 - 12:32
Description

This theme enables you to bridge the gap between the Bootstrap Framework and Drupal.

The theme does not sufficiently exclude the submitted password value when an incorrect value has been submitted

Versions affected
  • bootstrap 8.x-3.x versions prior to 8.x-3.5.

Drupal core is not affected. If you do not use the contributed Bootstrap module, there is nothing you need to do.

Solution

Install the latest version:

Also see the Bootstrap project page.

Reported by Fixed by Coordinated by Contact and More Information

The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact.

Learn more about the Drupal Security team and their policies, writing secure code for Drupal, and securing your site.

Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity

php[world] 2017: Call for Speakers

PHP Announcements - Tue, 05/16/2017 - 18:08
The teams at php[architect] and One for All Events are excited to announce we have opened up our Call for Speakers for the 4th annual edition of php[world]. This year we are refactoring php[world] into a more focused PHP conference concentrating on providing our attendees deep-dive content which teach core lessons about PHP. We also want talks covering advanced topics in applications and frameworks built in PHP (such as Drupal, WordPress, Laravel, Symfony, and Magento). We encourage submissions on technologies crucial to modern Web development such as HTML5, JavaScript, and emerging technologies. Ideas surrounding the entire software life cycle are often big hits for our attendees. Finally, we do welcome non-technical proposals that will appeal to a developer audience. This year it will be a 2-day conference with concurrent workshops, preceded by two days of training classes. We've also updated our comprehensive speaker's package this year to simplify it; we will be offering: A free conference ticket Round-trip economy airfare booked by us Accommodations at the conference hotel: 3 nights for speakers & workshop presenters 5 nights for training class teachers Don't hesitate, the Call for Speakers is only open until June 23rd, 2017. So get those submissions in soon, we look forward to hearing from you!
Categories: Development News, PHP, PHP News

PHP 7.1.5 Released

PHP Announcements - Thu, 05/11/2017 - 13:44
The PHP development team announces the immediate availability of PHP 7.1.5. Several bugs have been fixed. All PHP 7.1 users are encouraged to upgrade to this version. For source downloads of PHP 7.1.5 please visit our downloads page, Windows source and binaries can be found on windows.php.net/download/. The list of changes is recorded in the ChangeLog.
Categories: Development News, PHP, PHP News

PHP 7.0.19 Released

PHP Announcements - Thu, 05/11/2017 - 08:00
The PHP development team announces the immediate availability of PHP 7.0.19. Several bugs have been fixed. All PHP 7.0 users are encouraged to upgrade to this version. For source downloads of PHP 7.0.19 please visit our downloads page, Windows source and binaries can be found on windows.php.net/download/. The list of changes is recorded in the ChangeLog.
Categories: Development News, PHP, PHP News

DRD Agent - Critical - Multiple vulnerabilities - SA-CONTRIB-2017-047

Drupal Contributed Security - Wed, 05/10/2017 - 11:48
Description

The Drupal Remote Dashboard (DRD) module enables you to manage and monitor any remote Drupal site and, this module, the DRD Agent is the remote module which responds to requests from authorised DRD sites.

The module doesn't sufficiently protect the URL used to configure itself from CSRF attacks, which could allow a malicious user to craft a special URL that would reconfigure the DRD Agent and redirect to any URL if visited by an admin user.

CVE identifier(s) issued
  • A CVE identifier will be requested, and added upon issuance, in accordance with Drupal Security Team processes.
Versions affected
  • DRD Agent 7.x-3.x versions prior to 7.x-3.1.
  • DRD Agent 8.x-3.x versions prior to 8.x-3.1.

Drupal core is not affected. If you do not use the contributed DRD agent module, there is nothing you need to do.

Solution

Install the latest version:

Also see the DRD agent project page.

Reported by Fixed by Coordinated by Contact and More Information

The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact.

Learn more about the Drupal Security team and their policies, writing secure code for Drupal, and securing your site.

Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity

Drupal Remote Dashboard - Critical - Weak encryption keys - SA-CONTRIB-2017-046

Drupal Contributed Security - Wed, 05/10/2017 - 11:39
Description

This module enables you to remotely access remote Drupal sites to monitor and manage them all from one central place.

The module doesn't sufficiently ensure that the system administrator uses a strong enough encryption key per the requirements of the encryption type, which leads to weak encryption for the communication between the management dashboard and the remote site which could be decrypted by an adequately equipped attacker.

CVE identifier(s) issued
  • A CVE identifier will be requested, and added upon issuance, in accordance with Drupal Security Team processes.
Versions affected
  • DRD 8.x-3.x versions prior to 8.x-3.2.

Drupal core is not affected. If you do not use the contributed Drupal Remote Dashboard module, there is nothing you need to do.

Solution

Install the latest version:

  • If you use the DRD module for Drupal 8.x, upgrade to DRD 8.x-3.2

Also see the Drupal Remote Dashboard project page.

Reported by Fixed by Coordinated by Contact and More Information

The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact.

Learn more about the Drupal Security team and their policies, writing secure code for Drupal, and securing your site.

Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity

Drupal version: 

Webform Multiple file upload - Moderately Critical - Access bypass - SA-CONTRIB-2017-045

Drupal Contributed Security - Wed, 05/10/2017 - 10:19
Description

This module enables you to upload multiple files at once in a webform.
The module doesn't sufficiently check access to file deletion urls.
This vulnerability is mitigated by the fact that an attacker must have a role with the permission to edit all or their own webform submissions.

CVE identifier(s) issued
  • A CVE identifier will be requested, and added upon issuance, in accordance with Drupal Security Team processes.
Versions affected
  • webform_multifile 7.x-1.x versions prior to 7.x-1.6.

Drupal core is not affected. If you do not use the contributed Webform Multiple File Upload module, there is nothing you need to do.

Solution

Install the latest version:

Also see the Webform Multiple File Upload project page.

Reported by Fixed by Coordinated by Contact and More Information

The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact.

Learn more about the Drupal Security team and their policies, writing secure code for Drupal, and securing your site.

Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity

Media - Moderately Critical - Multiple vulnerabilities - SA-CONTRIB-2017-044

Drupal Contributed Security - Wed, 05/10/2017 - 08:52
Description

This module provides intuitive ways to manage large libraries of media, insert or display or import various types of media either through fields or a wysiwyg interface.

Versions of this module prior to 7.x-2.1 or 7.x-3.0-alpha5 did not sufficiently whitelist input parameters for the media browser.

This vulnerability in the versions of media prior to those aforementioned is mitigated by the fact that an attacker must have a role with the permission upload files and view media browser.

Versions affected
  • Media 7.x-2.x versions prior to 7.x-2.1.
  • Media 7.x-3.x versions prior to 7.x-3.0-alpha4.

Drupal core is not affected. If you do not use the contributed Media module, there is nothing you need to do.

Solution

Install the latest version:

  • If you use the media module, it is recommended to upgrade to media version 7.x-2.1 (stable) or to 7.x-3.0-alpha5 (cutting edge) or newer.

Also see the Media project page.

Reported by Fixed by Coordinated by Contact and More Information

The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact.

Learn more about the Drupal Security team and their policies, writing secure code for Drupal, and securing your site.

Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity

The Process for Evolving Community Governance

Drupal News - Fri, 05/05/2017 - 14:59
Discover > Plan > Build > Iterate

There comes a time when we must all recognize that what got us here won't get us there. Now is that time for Drupal. The governance models that were put in place to support the needs of the community years ago are no longer working as well as they should. The Drupal community has reached a level of maturity that requires greater clarity, integrity, and resilience.

An effort is underway to evolve Drupal’s community governance. The Drupal community is in the driver’s seat. The Drupal Association is helping navigate and get the community where it wants to go by providing the structure, support, and resources that are desperately needed to make progress. I, Whitney Hess, have been engaged to be a neutral facilitator of this process.

We are proposing a multi-phase approach to redesign Drupal’s community governance models, management, and decision-making practices: Discover > Plan > Build > Iterate. In this first phase, our goal is to gain a deeper understanding of the needs of the Drupal community. We are conducting this research through a variety of methods: one-on-one interviews with select individuals; mediated group discussions; surveys and feedback forms.

We held seven hour-long Community Discussions over three days of DrupalCon. There were 6-10 participants per session. Though every session had its own energy and topics varied, all discussions were fruitful and impactful. Many participants said they left feeling better than when they arrived.

While there was some discussion about recent events in the sessions, the focus quickly shifted to brainstorming ideas for how to improve Drupal’s community governance. As mediator, it is my role to help people articulate their needs, and to support the community in devising strategies to better get those needs met. Please read the meeting summaries if you would like to get a sense of what was discussed.

There are currently seven online sessions scheduled over the next two weeks at a variety of times for the global community to participate in these facilitated discussions, and more will be scheduled if needed. If you want your voice heard, I strongly encourage you to join us. If you have questions or concerns about the sessions, you’re welcome to contact me directly at whitney@whitneyhess.com.

Once these sessions are completed, we will be conducting a short survey and other types of feedback forms to have the widest possible reach. We want to ensure that people have a variety of ways to constructively contribute to making Drupal the best it can be. We expect to launch these in late-May.

At the conclusion of the Discovery phase, we will move into Planning. We are at the earliest stages of conceiving a Governance Summit over 1-2 days in June to take all of the learnings from Discovery, and craft a strategy for specifically how to change Drupal’s community management and governance. As of today, we do not yet have dates, location, or participant information. We are waiting to see what comes out of Discovery before we devise any framework for how this can be achieved effectively and equitably. Again, the Drupal Association’s role here is to be a support, and to create space for the community to decide how it wants its governance to change.

I have very clearly heard a need for greater transparency into this process and how decisions are being made. I take that responsibility seriously, and will continue to share our progress along the way. Next up, please look out for a summary of our Discovery findings, to be shared in late-May/early-June.

With gratitude,

Whitney

Categories: Development News, Drupal

MySQL InnoDB Cluster: MySQL High Availability Made Easy! A Shell and AdminAPI Tour (25 May 2017)

MySQL Web Seminars - Fri, 05/05/2017 - 14:06

MySQL InnoDB Cluster provides a built-in High Availability solution for MySQL. It tightly integrates MySQL Server, Group Replication, MySQL Router and MySQL Shell providing an easy-to-use solution for High Availability.

MySQL Shell is an interactive JavaScript, Python and SQL command-line interface, supporting development and administration for MySQL Server and InnoDB cluster through a scriptable API – the AdminAPI. This API hides the complexity associated with configuring, provisioning and managing everything without sacrificing power, flexibility or security.

Join this webinar for an in-depth tour of the MySQL InnoDB cluster, focusing on the MySQL Shell and its AdminAPI.



Date and Time: Thursday, 25 May 2017, 09:00 US/Pacific
Categories: Development News, MySQL

MySQL Enterprise Monitor 3.4: Group Replication, Table Statistics and Better Performance (18 May 2017)

MySQL Web Seminars - Thu, 05/04/2017 - 15:03

Group Replication was released within MySQL 5.7.17, adding a strongly consistent clustering solution to MySQL's classic asynchronous Replication. With this addition, how one depicts and monitors the status of replication has to change significantly.

Come to this webinar to learn about how MySQL Enterprise Monitor 3.4 has been enhanced to monitor and show the status of MySQL's Group Replication. 3.4's Topology View draws and annotates MySQL InnoDB Clusters; new Group Replication Advisors keep watch on various issues such as network partitions, split brain conditions, and problematic configuration.

Also learn firsthand about other enhancements in MySQL Enterprise Monitor 3.4, including the new Table Statistics report and improvements made around general application and graphing performance.



Date and Time: Thursday, 18 May 2017, 09:00 US/Pacific
Categories: Development News, MySQL

shib_auth Moderately Critical - Multiple vulnerabilities - SA-CONTRIB-2017-043

Drupal Contributed Security - Wed, 05/03/2017 - 11:35
Description

This module enables you to login via Shibboleth.

The module doesn't sufficiently logout the user when the shib session expires, which depending on the caching mechanism makes private data public.

This vulnerability is mitigated by the fact that shib_auth would have to be used in combination with a caching mechanism which caches content for authenticated users.

Versions affected
  • 7.x-4.x versions prior to 7.x-4.4.

Drupal core is not affected. If you do not use the contributed Shibboleth authentication module, there is nothing you need to do.

Solution

Install the latest version:

Also see the Shibboleth authentication project page.

Reported by Fixed by Coordinated by Contact and More Information

The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact.

Learn more about the Drupal Security team and their policies, writing secure code for Drupal, and securing your site.

Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity

Supporting the next evolution of Drupal's Community Governance

Drupal News - Thu, 04/20/2017 - 23:19

TL;DR: Both the community and Dries Buytaert, Project Lead, see a need to evolve Drupal community governance. The Drupal Association can help in a support role. We will start by hosting mediated community discussions so everyone around the world can participate, be heard and understood, and share their ideas. Creating a new governance model will take many months and will require an agile approach as we all feel our way through the proper steps. The Drupal Association will continue to find ways to support this process as we all move through it together.

-------------

Over the last several weeks, the Drupal Association has been in listening mode — and we still are. We’re hearing community members say they need clarity and understanding, and that our community governance needs to change. As we process what we’re hearing, we want to find the best way to help the community address the issues being raised, within the boundaries of the Drupal Association charter.

The Drupal Association’s mission is to unite the global community to help build and promote the software. We do that in two very specific ways: DrupalCon and Drupal.org. We’re determining how best to meet the community’s needs as it relates to these two key community homes. In the near future, I will publish blogs with ideas on how we might address the various needs we are hearing.

Evolving Community Governance

There is one need that we hear loud and clear that we can address today: The community needs support to evolve community governance structures and processes. Both the community at large, and Dries Buytaert, Project Lead, have expressed this need, and we are glad to see this alignment.  

It’s important to note that the Drupal Association has a very limited role in community governance. Our only role in governance stems directly from our charter to manage DrupalCon and Drupal.org.

It’s not within our charter to oversee community governance or drive its evolution. The last thing the Drupal Association wants is to step outside of our charter or accidentally take away the community’s agency in self-organizing to create the new community governance model. However, we do want to facilitate forward movement. And so, we can take a support role.

We hear that many in the community want to come together to talk. We can support this by providing a meeting place (both in person and online), and a mediator for community discussions.

We have asked Whitney Hess, a coach who has worked with the Drupal community before, to facilitate and mediate community discussions, where people can come together to talk about current community issues and explore ideas for improved governance. These discussions will start at DrupalCon Baltimore and continue in a series of online meetings, scheduled at different times so members around the world can participate. [see more details below]

To provide transparency for those who cannot attend the discussion sessions, we will post meeting minutes and summaries from each community discussion here: https://drupal.org/community/discussions.

As facilitator of these community discussions, Whitney Hess will provide a summary to give us a broad perspective on the “voice of the community.” We hope these conversations will ground the community as it begins architecting its new governance model.

Once we have had these discussions we can decide together on the appropriate next steps, and how the Association can help the community continue to move forward, together.

Join Community Discussions

We hope you'll join the conversation as these discussions begin. Again, our overarching aim is to support the community so it can be healthy and continue to thrive. We believe that open conversation is essential to the wellbeing of any community and we look forward to hosting Community Discussions mediated by Whitney Hess. Please join fellow community members to talk through recent community issues and to be part of co-creating Drupal’s new governance model.

Here are the discussions you can join. Please note the ground rules below:

At DrupalCon Baltimore         

Location: Pratt Street Show Office

Details: https://events.drupal.org/baltimore2017/community-discussion

  • Tuesday, 12-1pm, max 45 participants

  • Tuesday, 2:15-3:15pm, max 15

  • Tuesday, 5-6pm, max 15

  • Wednesday, 2:15-3:15pm, max 15

  • Wednesday, 3:45-4:45pm, max 15

  • Thursday, 10:45-11:45am, max 15

  • Thursday, 1-2pm, max 45

Virtual Meetings after DrupalCon

Sign Up Here: https://events.drupal.org/virtual/community-discussions
        

  • Tuesday, May 9: 4pm EDT / 1pm PDT / 9pm BST / 10pm CEST / 6am +1 AEST

  • Wednesday, May 10: 8am EDT / 1pm BST / 2pm CEST / 5:30pm IST / 10pm AEST

  • Thursday, May 11: 9:30am EDT / 2:30pm BST / 3:30pm CEST / 7pm IST / 11:30pm AEST

  • Friday, May 12: 2pm EDT / 11am PDT / 7pm BST / 8pm CEST / 11:30pm IST

  • Tuesday, May 16: 8pm EDT / 5pm PDT / 10am AEST

  • Wednesday, May 17: 12pm EDT / 9am PDT / 5pm BST / 6pm CEST / 9:30pm IST

  • Thursday, May 18: 3pm EDT / 12pm PDT / 8pm BST / 9pm CEST

Ground Rules for Community Discussions

Key Principles of Nonviolent Communication

  • Responsibility for Our Feelings: We aim to move away from blame, shame, judgment, and criticism by connecting our feelings to our own needs. This recognition empowers us to take action to meet our needs instead of waiting for others to change.

  • Responsibility for Our Actions: We aim to recognize our choice in each moment, and take action based on seeing how it would meet our needs to do so; we aim to move away from taking action based on fear, guilt, shame, the desire for reward, or any “should” or “have to.”

  • Prioritizing Connection: We aim to focus on connection instead of immediate solutions, and to trust that connecting with our own and others’ needs is more likely to lead to creating solutions that meet everyone’s needs.

  • Equal Care for Everyone’s Needs: We aim to make requests and not demands; when hearing disagreement with our request, or when disagreeing with another’s request, we aim to work towards solutions that meet everyone’s needs, not just our own, and not just the other person’s.

  • Self-Expression: When expressing ourselves, we aim to speak from the heart, expressing our feelings and needs, and making specific, doable requests rather than demands.

  • Empathic Hearing: When we hear others, we aim to hear the feelings and needs behind the expressions, even when they express judgments or demands.

  • Protective Use of Force: We aim to use force only to protect, not to punish others or get our way without the other’s agreement, and only in situations where the principles above were not sufficient to meet immediate needs for safety. We aim to return to dialogue as soon as safety is re-established

How These Ground Rules Work

  • Ground rules will be stated at the beginning of each session.

  • If you are not in agreement with the ground rules, please do not participate in the session.

  • If a participant is repeatedly disruptive of respectful, productive discussion, they will be asked to leave; if they do not leave, the session will be terminated immediately.
Categories: Development News, Drupal

Drupal Core - Critical - Access Bypass - SA-CORE-2017-002

Drupal News - Wed, 04/19/2017 - 13:13
Description

This is a critical access bypass vulnerability. A site is only affected by this if all of the following conditions are met:

  • The site has the RESTful Web Services (rest) module enabled.
  • The site allows PATCH requests.
  • An attacker can get or register a user account on the site.

While we don't normally provide security releases for unsupported minor releases, given the potential severity of this issue, we have also provided an 8.2.x release to ensure that sites that have not had a chance to update to 8.3.0 can update safely.

CVE identifier(s) issued
  • CVE-2017-6919
Versions affected
  • Drupal 8 prior to 8.2.8 and 8.3.1.
  • Drupal 7.x is not affected.
Solution
  • If the site is running Drupal 8.2.7 or earlier, upgrade to 8.2.8.
  • If the site is running Drupal 8.3.0, upgrade to 8.3.1.

Also see the Drupal core project page.

Reported by Fixed by Coordinated by
  • The Drupal Security team
Contact and More Information

The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact.

Learn more about the Drupal Security team and their policies, writing secure code for Drupal, and securing your site.

Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity

Categories: Development News, Drupal
Syndicate content