The issue described in Views - Less Critical - Access Bypass - SA-CONTRIB-2016-036 also affects Drupal 6! A series of patches are attached for different versions of views.

CommentFileSizeAuthor
SA-CONTRIB-2016-036-6.x-3.x.patch3.04 KBdsnopek
SA-CONTRIB-2016-036-6.x-2.x.patch3.04 KBdsnopek

Comments

dsnopek created an issue. See original summary.

dsnopek’s picture

dsnopek
he/him
Primary language English
Location USA
commented
Status: Active » Fixed

Committed patches to repo

roball’s picture

roball commented

Thank you!

MattBrigade’s picture

MattBrigade commented

Sorry if this is a dumb question, but does these patch apply to the "standard" releases (e.g. "6.x-3.2") or the "development" releases (e.g. "6.x-3.x-dev")? Thanks!

dsnopek’s picture

dsnopek
he/him
Primary language English
Location USA
commented

Personally, I only tested them against the development releases because we roll new releases for our customers, ex:

https://github.com/d6lts/views/releases/tag/6.x-3.4
https://github.com/d6lts/views/releases/tag/6.x-2.20

I'd say try it (locally - not on production) and let us know what you find!

MattBrigade’s picture

MattBrigade commented

Thanks for the reply! I didn't know that github project existed, haha (doesn't mention it on the drupal.org D6LTS page. So all the Drupal 6 LTS modules are being maintained at https://github.com/d6lts/ (meaning those modules have all the LTS patches applied)? Thanks for you time.

roball’s picture

roball commented

@MattBrigade, I highly recommend to disable core's Update status module, and instead enable the myDropWizard module. Then, you see at your sites' "Available updates" page all modules that are supported by the Drupal 6 LTS vendors, and those which aren't.

MattBrigade’s picture

MattBrigade commented

Awesome! Thanks so much. Installing that now.

dsnopek’s picture

dsnopek
he/him
Primary language English
Location USA
commented

@MattBridge: The forked modules at https://github.com/d6lts exist to support the myDropWizard module which @roball linked to. We need to have versioned releases in order to do update status, and provide the ability to update via Drush. It's not on the d6lts project page because this mainly an initiative by one of the vendors (myDropWizard, which I work for), although, Acquia expressed interest in helping with this as well

MattBrigade’s picture

MattBrigade commented

You guys seriously rock. My life just got so much easier.

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.