SA-CONTRIB-2016-060 - there's a security issue for Workbench Moderation at https://www.drupal.org/node/2824455

We need to update to https://www.drupal.org/project/workbench_moderation/releases/7.x-3.0 in a 2.7-rc2

Comments

bdeclerc created an issue. See original summary.

  • rmarques committed 714cf15 on 7.x-2.x 
    Issue #2824563: Module upgrade: Workbench Moderation.
rutiolma’s picture

rutiolma
Location 🇵🇹
commented
Status: Active » Needs review

A release was created with workbench_moderation-7.x-3.0
After a small test, this patch doesn't seem to be necessary anymore, so no port needed.

bdeclerc’s picture

bdeclerc commented

Unfortunately, the "fix" for the security issue introduces a lot of headaches due to limitations in D7 (basically, the changes are an integral part of the security fix) which makes the behaviour of the "fixed" workbench rather strange and hard to explain to customers. See https://www.drupal.org/node/2824607 for more.

Considering the relatively limited risk of the issue and the significant impact of the change on UX, we need to roll back to Workbench Moderation 1.x, I don't want to move Openfed to this until someone figures out a better solution :-/

pianomansam’s picture

pianomansam commented

I've created a request in Workbench Moderation to apply the security fix to the 7.x-1.x branch instead of requiring the upgrade to 7.x-3.x

#2826154: [META] 7.x-1.x branch fix to SA-CONTRIB-2016-060

We'll see what comes of this.

  • rmarques committed 714cf15 on 8.x-1.x 
    Issue #2824563: Module upgrade: Workbench Moderation.

  • rmarques committed 714cf15 on 8.x-1.x 
    Issue #2824563: Module upgrade: Workbench Moderation.
joseph.olstad’s picture

joseph.olstad
Primary language French
commented

ya 3.x is making it impossible for our publishers to publish correctly from the /admin/content page due to the revision scheme of creating new revisions for older still published content (makes no sense and causes a regression with /admin/content ), it seems fundamentally flawed.
see
#2824607: Fundamental change in how revision works between 1.x and 3.x?

joseph.olstad’s picture

joseph.olstad
Primary language French
commented

I'm working on a 3.x patch to allow publishing new draft of an already published node from /admin/content patch will check path, make assumption that you want to publish most recent draft.

Here's the upstream issue:
#2910310: drafty allow publishing current draft from /admin/content page when node already published when Workbench Moderation 7.x-3.x is enabled