Install

Works with Drupal: 7.x

Using Composer to manage Drupal site dependencies

Downloads

Download tar.gz 92.8 KB
MD5: 2a6f0aba7c042e35f5a8dcf73249db89
SHA-1: 556b47571627a88c23d4e336a4c0d56ac27cf58e
SHA-256: b1b0a92b928d18d5367a48567cf1c1a34e11bf3ddc0f2e39e7d084c09dbb791f
Download zip 141.33 KB
MD5: 931dd94d34fad8c1a2b57f9c33a9d0e5
SHA-1: 6626ed017b55555724d620c93ee23606a94aa640
SHA-256: 3d7343b4c2a2e58125adb7fb4c666db0e057ad374b02692db794c7869a6bc459

Release notes

Bug fixes:

  • Issue #2350125 by virusakos: SQLServer does not support boolean statement in SELECT.
  • Issue #2350985 by littlegreenviper, donquixote: Avoid PHP warning if $info['plural label'] is not set in entity info.
  • Issue #2364203 by lpeabody, yingtho: Find the correct parent menu by language

Security:

  • Validate and sanitize the breadcrumb separator.
    See Crumbs - Moderately Critical - Cross Site Scripting (XSS) - SA-CONTRIB-2015-082
    In prior versions (7.x-2.x branch), users with the "Administer Crumbs" permission could use the custom breadcrumb separator for XSS attacks.
    The permission was never intended for random users, but is also not explicitly marked as "trusted roles only". Therefore this counts as a vulnerability.
    In the new version of the module, the separator is validated in the form at admin/structure/crumbs/display, *and* sanitized on output, with filter_xss_admin(). The sanitization is for security, the validation is to make it more visible what is allowed and what isn't.
Created by: donquixote
Created on: 24 Mar 2015 at 19:36 UTC
Last updated: 30 Mar 2016 at 18:28 UTC
Security update
Bug fixes
Unsupported

Other releases