Drupal security SA-CORE-2019-003:
- Update Link to 1.6

Additional update to stay up to date:
- Core to 7.64

CommentFileSizeAuthor
#8 SA-CORE-2019-003-3034551-8.patch1.17 KBjoshahubbers
#4 interdiff-2-4.txt1.35 KBpaulvandenburg
#4 dvg-SA-CORE-2019-003_and_core_update-3034551-4.patch1.22 KBpaulvandenburg
#2 SA-CORE-2019-003-3034551-2.patch1.06 KBjoshahubbers

Comments

JoshaHubbers created an issue. See original summary.

joshahubbers’s picture

joshahubbers commented
StatusFileSize
new SA-CORE-2019-003-3034551-2.patch1.06 KB

Have to check if
projects[link][patch][] = "https://www.drupal.org/files/issues/link-allow-tel-links-1993920-12.patch"
is applied to the link module.

Verified and the patch is applied.

paulvandenburg’s picture

paulvandenburg commented
Title: SA-CORE-2019-003 update » SA-CORE-2019-003 update + Core 7.64 update
Issue summary: View changes
Status: Needs review » Needs work

You've removed the following patch from the link module, however it has not (yet) been added to version 1.6:
#1993920: Allow tel: links
It will probably be added in a future version of Link.

And while you've removed path #2361283: Link 7.x-1.3 removes Query string when using "Image Link Formatter" module which is not added to Link 1.6, it has been fixed by the similar issue #2367069: Link 1.3 removes the query string from field tokens which is included in Link 1.6.

So I'm marking this needs work to restore that one patch.

I see you've also updated core to 7.64, which is not a security update but mostly a php 7.3 compatibility update.
However I'm not against updating core.

paulvandenburg’s picture

paulvandenburg commented
Status: Needs work » Needs review
StatusFileSize
new dvg-SA-CORE-2019-003_and_core_update-3034551-4.patch1.22 KB
new interdiff-2-4.txt1.35 KB

Restored the lost Link patch, also updated the used version of that patch so it applied again.
Rerolled the patch so it applies to dvg.

joshahubbers’s picture

joshahubbers commented
Status: Needs review » Reviewed & tested by the community

  • paulvandenburg committed 4bd05a3 on 7.x-1.x 
    Issue #3034551 by paulvandenburg, JoshaHubbers: SA-CORE-2019-003 update...
paulvandenburg’s picture

paulvandenburg commented
Status: Reviewed & tested by the community » Fixed
joshahubbers’s picture

joshahubbers commented
StatusFileSize
new SA-CORE-2019-003-3034551-8.patch1.17 KB

Patch that applies to a 1.8 install.

  • paulvandenburg committed 3b7f73b on 7.x-1.x 
    Issue #3034551 by paulvandenburg, JoshaHubbers: SA-CORE-2019-003 update...

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.