For SA-CONTRIB-2019-034
SA-CONTRIB-2019-035
SA-CONTRIB-2019-036
we need to update views to the latest version.

CommentFileSizeAuthor
#3 update-views-3040077-3.patch786 bytesjoshahubbers
#2 update-views-3040077-2.patch663 bytesjoshahubbers

Comments

JoshaHubbers created an issue. See original summary.

joshahubbers’s picture

joshahubbers commented
StatusFileSize
new update-views-3040077-2.patch663 bytes

I am not sure if we still need this patch:
https://www.drupal.org/node/1771140
https://www.drupal.org/files/issues/views_access_arguments-1771140-17.patch
If we do this patch applies to 7.21:
https://www.drupal.org/files/issues/2018-07-25/views_access_arguments-17...

Something seems to be comitted, in #35, but not sure if it is sufficient.

joshahubbers’s picture

joshahubbers commented
StatusFileSize
new update-views-3040077-3.patch786 bytes

This patch is the same as #2, but with the views_access patch from #43, which applies to .21 also.

paulvandenburg’s picture

paulvandenburg commented
Status: Needs review » Reviewed & tested by the community

Confirmed patches are correctly updated/kept in #3.
Looks like what was committed in #1771140: view_menu_alter() adding to existing "access arguments" causes user_access() error was not the solution of the patch we used. Indeed #43 solves the issue we had the patch for.

Beyond that quite a jump in views versions, but we need it anyway for security so I'm marking this RTBC. Any resulting bugs should be in a new issue.

  • paulvandenburg committed 6225ac4 on 7.x-1.x 
    Issue #3040077 by JoshaHubbers: Update views for SA-CONTRIB-2019-034 SA-...
paulvandenburg’s picture

paulvandenburg commented
Status: Reviewed & tested by the community » Fixed

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.