Problem/Motivation

Follow up to #3041885: Display relevant Security Advisories data for Drupal
That issue had functionality to send emails about security advisories that are displayed in Drupal
When the functionality for showing the advisories got moved from the Update to the System module we no longer had an existing email setting we could use to send the email

Still pending #3196368: [policy, no patch] Determine to which module the new security advisory functionality should be added

The email functionality in #3041885 was removed in this commit which can be used as a starting point.

Proposed resolution

  1. Add a new setting on the site info form for email addresses to send security advisory emails to.
  2. If the update module is currently installed copy the emails from the Update setting to the new System module setting
  3. Determine if the separate setting in the Update module should be deprecated

Remaining tasks

User interface changes

No email setting on site information form

API changes

Data model changes

Release notes snippet

Issue fork drupal-3197333

Command icon Show commands

Start within a Git clone of the project using the version control instructions.

Or, if you do not have SSH keys set up on git.drupalcode.org:

About issue forks

Comments

tedbow created an issue. See original summary.

tedbow’s picture

tedbow
he/him
Primary language English
Location Ithaca, NY, USA
commented
Issue summary: View changes
tedbow’s picture

tedbow
he/him
Primary language English
Location Ithaca, NY, USA
commented

Just copying a question we addressed in #3041885: Display relevant Security Advisories data for Drupal so it doesn't get lost. This will be a little different not that it is not in the Update module

Do we really need a separate psa.notify setting to control if we send emails?
NO emails will be sent to email addresses in the current setting in the Update module. No extra setting will be provided.

Could we just send emails to the email addresses in the existing notification.emails setting?

This setting is described in the UI now as
"Whenever your site checks for available updates and finds new releases, it can notify a list of users via email."

Would sending emails now for PSAs also to these same emails be a good idea?

If we have a separate check box for "Send email notifications for Public service announcements." then you could set up to send emails for new Updates but not send for PSA's but you could not set up your site to send emails for PSA's but not Updates.

Because the PSA feed is currently being used for only highly critical items it's hard to imagine that you would want emails for Updates and not highly critical PSAs.

Email changes

Changing to Update settings form. Change is highlighted

Email text

SUBJECT: An urgent security announcement requires your attention for Drupal

An important security announcement is available for your Drupal site. You should
read the announcement immediately and follow its instructions.

Public service announcements:

* Critical Release - SA-2019-02-19 [1]

To see all public service announcements, visit
https://www.drupal.org/security/psa [2].

[1] https://www.drupal.org/sa-2019-02-19
[2] https://www.drupal.org/security/psa

tedbow’s picture

tedbow
he/him
Primary language English
Location Ithaca, NY, USA
commented
Title: Email site admins for security advisories displayed in Drupal » [PP-1] Email site admins for security advisories displayed in Drupal
Status: Active » Postponed

Postponing #3041885: Display relevant Security Advisories data for Drupal for now

larowlan’s picture

larowlan
Location 🇦🇺🏝.au GMT+10
commented

FYI when this is brought back to life, I noticed an issue in the earlier patch on #3041885: Display relevant Security Advisories data for Drupal

It was assuming that the notify emails map 1:1 to user accounts.

There is no such restriction, so in this scenario we're missing any notify emails that aren't associated with user accounts.

Version: 9.2.x-dev » 9.3.x-dev

Drupal 9.2.0-alpha1 will be released the week of May 3, 2021, which means new developments and disruptive changes should now be targeted for the 9.3.x-dev branch. For more information see the Drupal core minor version schedule and the Allowed changes during the Drupal core release cycle.

larowlan’s picture

larowlan
Location 🇦🇺🏝.au GMT+10
commented
Title: [PP-1] Email site admins for security advisories displayed in Drupal » Email site admins for security advisories displayed in Drupal
Status: Postponed » Active

Blocker is in

tedbow’s picture

tedbow
he/him
Primary language English
Location Ithaca, NY, USA
commented
Assigned: Unassigned » tedbow

@larowlan thanks for reopening and point out #5! I think #5 was fixed later but I will check

Assigning to myself. I am converting the commit where we removed this from the other issue to a merge request

tedbow opened merge request !661

tedbow’s picture

tedbow
he/him
Primary language English
Location Ithaca, NY, USA
commented
Assigned: tedbow » Unassigned

Unassigning from myself as we have a merge request now. The tests were passing for me locally.

Version: 9.3.x-dev » 9.4.x-dev

Drupal 9.3.0-rc1 was released on November 26, 2021, which means new developments and disruptive changes should now be targeted for the 9.4.x-dev branch. For more information see the Drupal core minor version schedule and the Allowed changes during the Drupal core release cycle.

Version: 9.4.x-dev » 9.5.x-dev

Drupal 9.4.0-alpha1 was released on May 6, 2022, which means new developments and disruptive changes should now be targeted for the 9.5.x-dev branch. For more information see the Drupal core minor version schedule and the Allowed changes during the Drupal core release cycle.

Version: 9.5.x-dev » 10.1.x-dev

Drupal 9.5.0-beta2 and Drupal 10.0.0-beta2 were released on September 29, 2022, which means new developments and disruptive changes should now be targeted for the 10.1.x-dev branch. For more information see the Drupal core minor version schedule and the Allowed changes during the Drupal core release cycle.

Version: 10.1.x-dev » 11.x-dev

Drupal core is moving towards using a “main” branch. As an interim step, a new 11.x branch has been opened, as Drupal.org infrastructure cannot currently fully support a branch named main. New developments and disruptive changes should now be targeted for the 11.x branch, which currently accepts only minor-version allowed changes. For more information, see the Drupal core minor version schedule and the Allowed changes during the Drupal core release cycle.

mstrelan’s picture

mstrelan commented
Status: Active » Needs work

There is a MR but it needs to be rebased and has unresolved threads.

Version: 11.x-dev » main

Drupal core is now using the main branch as the primary development branch. New developments and disruptive changes should now be targeted to the main branch.

Read more in the announcement.