Problem/Motivation

The intent of this issue is to help the maintainer(s) coordinate community efforts in the creation of a stable release. Community involvement is only intended as a suggestion; it is up to maintainers to ultimately decide the creation of, and what goes into, a stable release. If you are not interested in using this issue, please mark the issue as Fixed or Closed (works as designed).

As of the creation of this issue, this project presently does not have a stable release compatible with Drupal 8+. There are many benefits to publishing a stable release for a module.

Release-blocker issues

Good-to-fix issues

  • issues tbd

Above and beyond tasks

  • Create issue fix list for stable release using the grn tool.

Remaining tasks

  • Establish a list of release-blockers and 'good-to-fix' issues for a stable release.
  • Resolve above issues blocking the release of a stable release.
  • Craft changelog for new release.
  • Create new release.

Do you have resources you'd like to contribute to this template? Have feedback on the stable release request issue template? We want your feedback: #3239062: 'Stable Release Request' Issue Template

Original issue

Checked https://www.drupal.org/drupal-security-team/security-advisory-process-an...

That means no security advisories for development releases (-dev), ALPHAs, BETAs or RCs.

So we need a stable release before application
IMO main blocker are
- #3042321: Last access by a user should not change after masquerade as that user (D8)
- #2923845: Avoid adding masquerade as field to compact
- #2962970: Provide a foolproof way to unmasquerade
- #3181882: "Masquerade as ROLE" does not grant access when user does not also have "masquerade as authenticated user" permission
- #2900413: Allow UnMasquerade link in the "Masquerade" block

Done
- #2688499: Negate role permissions
- #2695779: Unmasquerade link appears for users with the permission: 'link to any page', regardless of masquerade status.
- #2975124: Masquarade Saml compatibility issue

Comments

koosvdkolk created an issue. See original summary.

plato1123’s picture

plato1123 commented

I'm in the same boat, feel uneasy putting a module that doesn't pass security muster on a production site. Can we get this last hoop jumped through?

andypost’s picture

andypost
he/him
Primary language Russian
commented

good point! will apply for coverage

andypost’s picture

andypost
he/him
Primary language Russian
commented

Checked https://www.drupal.org/drupal-security-team/security-advisory-process-an...

That means no security advisories for development releases (-dev), ALPHAs, BETAs or RCs.

So we need a stable release before application
IMO main blocker are
- #2688499: Negate role permissions
- #2923845: Avoid adding masquerade as field to compact
- #2695779: Unmasquerade link appears for users with the permission: 'link to any page', regardless of masquerade status.
- #2975124: Masquarade Saml compatibility issue

andypost’s picture

andypost
he/him
Primary language Russian
commented
Title: Why isn't this module covered by the Security advisory policy » Roadmap to release and coverage by the Security advisory policy
Priority: Critical » Major
Issue summary: View changes
andypost’s picture

andypost
he/him
Primary language Russian
commented
Issue summary: View changes
Issue tags: +ContributionWeekend2020

Added #3042321: Last access by a user should not change after masquerade as that user (D8) as it affects like flag stored also needs to check config schema for block

wells’s picture

wells
he/him/his
Primary language English
Location Seattle, WA
commented
Issue summary: View changes

Adding #3181882: "Masquerade as ROLE" does not grant access when user does not also have "masquerade as authenticated user" permission and #2900413: Allow UnMasquerade link in the "Masquerade" block (which may replace #2962970: Provide a foolproof way to unmasquerade?).

Webbeh’s picture

Webbeh
he/him/his
Location Georgia, USA
commented
Issue summary: View changes

Updated issue summary.

Webbeh’s picture

Webbeh
he/him/his
Location Georgia, USA
commented
Title: Roadmap to release and coverage by the Security advisory policy » Masquerade 8.x-2.0 stable release plan
Webbeh’s picture

Webbeh
he/him/his
Location Georgia, USA
commented
Issue summary: View changes
adamevertsson’s picture

adamevertsson commented

Any progress on this? It seems like the main blockers are either completed or hasn't had any work done to them for several years. Perhaps a stable version can be released now?

andypost’s picture

andypost
he/him
Primary language Russian
commented

I think only #3042321: Last access by a user should not change after masquerade as that user (D8) is a strong requirement for stable release as I said in #6

liquidcms’s picture

liquidcms commented

Was going to raise an issue about 2.0-rc1 not working; but perhaps that is what this issue is for?

Anyway, -rc1 does not work. Code in validateForm is incorrect.

The latest -dev does work; although the patch from here: #2900413: Allow UnMasquerade link in the "Masquerade" block, although it still applies, it now breaks functionality.

hmm, although now have reverted back to last working version (2.0-beta4) and it still fails with same error:

TypeError: Argument 1 passed to masquerade_switch_user_validate() must implement interface Drupal\user\UserInterface, null given, called in E:\www\myssc\html\modules\contrib\masquerade\src\Form\MasqueradeForm.php on line 101 in masquerade_switch_user_validate() (line 223 of modules\contrib\masquerade\masquerade.module).

finn lewis’s picture

finn lewis
Location Oxford
commented

Any update on a likely stable release soon?

We're having to use the module less and less as it is not covered by security advisories.

andypost’s picture

andypost
he/him
Primary language Russian
commented

Few days ago I created another RC5 so if no issues with Drupal 11 the stable release can be created, let's get a 3 weeks round

andypost’s picture

andypost
he/him
Primary language Russian
commented
Related issues: +#3425260: Automated Drupal 11 compatibility fixes for masquerade

  • andypost committed 30cd321e on 8.x-2.x 
    Issue #2982514 by andypost: Prepare stable release, pass CI
andypost’s picture

andypost
he/him
Primary language Russian
commented
Title: Masquerade 8.x-2.0 stable release plan » Masquerade 8.x-2.1 stable release plan
Issue tags: -ContributionWeekend2020

I fixed pipelines and released 8.x-2.0