The Panels module has a critical access bypass vulnerability. This SA which covers D7 was just released:

https://www.drupal.org/node/2785631

Attached is a backport of those changes to the D6 version of Panels

CommentFileSizeAuthor
SA-CONTRIB-2016-047.patch26.06 KBdsnopek

Comments

dsnopek created an issue. See original summary.

dsnopek’s picture

dsnopek
he/him
Primary language English
Location USA
commented
Status: Active » Fixed

Committed!

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.

shawn.kwang’s picture

shawn.kwang commented

@dsnopek,

The Panels patch here breaks Panels admin interface in the same way as the Issue 2785915. I believe your patch from comment #18 fixes the bug here too. You may want to consider including it here as well.

What I did:

  1. Applied the patch for this issue.
  2. Ran drush updatedb.
  3. Downloaded the patch from (https://www.drupal.org/files/issues/panels-storage-backcompat-2785915-18.patch) and applied it too.