The 2026 Drupal Business Survey is open. Your response will help shape the future of the Drupal business ecosystem.Issue for fixing SA-CONTRIB-2015-066 - Tracking Code - Cross Site Request Forgery (CSRF) - Unsupported :
Problem
"The module doesn't sufficiently protect some URLs against CSRF. A malicious user can cause an administrator to disable tracking codes by getting their browser to make a request to a specially-crafted URL."
| Comment | File | Size | Author |
|---|---|---|---|
| #2 | tracking_code-SA-CONTRIB-2015-066-2450135-2.patch | 6.12 KB | fathershawn |
Comments
Comment #1
fathershawnWe have a client willing to sponsor fixing this issue. If you have specific concerns about the vulnerability, please contact me via my contact form rather than discuss a vulnerability here.
If you have questions about the process, or non-technical concerns about the Security status, please do post them here.
Comment #2
fathershawnHere's the patch
Comment #3
silkogelman commentedtested:
the patch applies perfectly on latest dev
tested with both a fresh Drupal install and an existing install:
all module functionality seems to work fine after the patch.
(managing snippets from UI, the snippets appearing in the source code of the desired pages)
I have NOT tested if it solves the security issue. (I'll leave that for the security team as I don't have that skill set)
Comment #4
grendzy commentedOn behalf of the Drupal Security Team, I've confirmed this patch resolves the CSRF issue. Thanks!
Comment #5
silkogelman commentedAwesome! Thanks guys!
Comment #7
pere orgaUpdated advisory and published the release
Thanks!
Comment #8
pere orgaComment #9
fathershawn