I use Content Access extensively for access control on production sites, and want to see it better maintained.
My concerns are as follows:
- The project has not opted into security advisory coverage.
- There is no stable release.
- The latest recommended Drupal 7 release is from 2013-Apr-15 (more than 7 years old).
- The latest recommended Drupal 8 release is from 2017-Nov-7 (more than 2 years old).
- There are currently 6 patches with status RTBC in the issue queue.
- The issue queue seems to not be monitored as there are a lot of patches in the issue queue that has not been reviewed or removed as obsolete (oldest 8 years old).
- There are public security issues (see #1170206: Private files downloadable when node access is denied and #2837840: Users without 'Grant content access' permission can edit content access.).
- The project currently has 55 767 reported installs, and hence a huge impact on the health of our ecosystem.
- The project page says "Seeking new maintainer". There are several issues offering helping with maintaining, or expressing concerns about maintenance status, but they all seem to go ignored, e.g.:
- #3091929: Is this module still maintained in D7 & D8 ?
- #3083768: Offering to co-maintain Drupal 8/9 project (module) version
- #2881346: Request to become co-maintainer
- #2719923: Request to become co-maintainer of Content Access module
- #2200417: Encouraging co-maintainers
The project owner (Wolfgang Ziegler (fago)) is still active in the Drupal community (last post 2020-05-05), but it looks like he no longer monitors this project's issue queue or wants to maintain this project. He has indicated as much by setting Maintenance status to "Seeking new maintaner" on the project page. I therefore think this can be considered an abandoned project as described in Dealing with unsupported (abandoned) projects.
However, if the project is still being maintained, please consider this an offer to step in and help out maintaining the project. If it is not being maintained, please consider this an offer to take over project ownership with all responsibilities.
If there is no response to this offer in two weeks I plan to escalate this to an ownership request and follow through with the procedures for Dealing with unsupported (abandoned) projects.
I have permission to opt the projects I own into security coverage, and intend to review and if necessary fix the outstanding security issues, make a full release, and opt the project into security oversight.
A copy of this notice has been sent the current owner/maintainer (Wolfgang Ziegler (fago)) via the contact tab on the Drupal.org user profile page. The project has two co-maintainers, but fago is only one that has permission to administer maintainers.
Comments
Comment #2
gisleCorrected typos in the issue summary.
Comment #3
gisleComment #4
websiteworkspace commented@gisle
Thank you for offering to take over this important module, especially with the upcoming Drupal 9 release.
Comment #5
gisleComment #6
gisleTransferring issue to Drupal.org project ownership issue queue and requesting ownership.
As stated in the issue summary, the project is already marked "Seeking new maintainer".
In addition to posting this ownership request, I've tried to PM the owner. There has been no response in two weeks, and hence I transfer it here to have a webmaster do the ownership transfer.
I am already active in the project's issue queue - e.g.: #1873612: Automated tests fail.
Comment #7
gisleComment #8
gisleComment #9
avpadernoI changed ownership as requested.
Comment #10
gisleThanks for the rapid response!