The 2026 Drupal Business Survey is open. Your response will help shape the future of the Drupal business ecosystem.Yesterday's security update causes regressions.
I bumps the php version requirement to 5.4+ (without notifying about that). OK, that one's for sure less dramatic. The new requirement for the php-intl extension has its own issue.
It breaks aliases for user account urls when pathauto is in use.
Steps to reproduce
- Make sure pathauto is installed, an alias pattern for user is set and aliases exist
- Make sure "Rename user path" setting is enabled
- Update rename_admin_paths
- Try to access any of the aliases to user pages
Proposed resolution
The odd thing is that it's attempted to sanitize $original_path, but in fact, the code acts on $path.
https://git.drupalcode.org/project/rename_admin_paths/-/commit/dc30870b2...
Is that just an oversight, or something fancy I simply don't understand?
| Comment | File | Size | Author |
|---|---|---|---|
| #11 | rename_admin_path_issue_3275205.patch | 787 bytes | abferris |
Issue fork rename_admin_paths-3275205
Show commands
Start within a Git clone of the project using the version control instructions.
Or, if you do not have SSH keys set up on git.drupalcode.org:
- 7.x-2.x
changes, plain diff MR !8 - 3275205-regressions-in-7.x-2.4 changes, plain diff MR !7
Comments
Comment #2
indigoxela commentedComment #3
indigoxela commentedComment #4
laborouge commented+1
Comment #5
katebron commentedI thought this was the error i had, but i actually can't get this far. Because the update crashes my sites, this is more applicable: https://www.drupal.org/project/rename_admin_paths/issues/3275140. Would delete this comment if i could!
Comment #6
othermachines commentedThe extension requirement should be in the release notes.
(Edited out info explaining fix since this is a security issue.)
Comment #7
indigoxela commentedThe problem described here (not the intl requirement, but the inaccessible user page aliases) could easily get fixed by transliterating the right variable:
$normalized_path = $transliterator->transliterate($original_path);Comment #8
saxmeisterSame exact issue here.
- Extension requirement needs to be in notes
- PHP 5.4+ requirement change needs to be in notes
Comment #9
gabrlknght commented@indigoxela many thanks for that quick fix! Two doozies from a single module update is enough 😅
Comment #10
jon pollard commented@indigoxela many thanks, just want to flag this up again - line 108(ish) in rename_admin_paths.module
replace this
$normalized_path = $transliterator->transliterate($path);with this
$normalized_path = $transliterator->transliterate($original_path);Comment #11
abferris commentedThis is my first time trying to give back a patch file to the community.
I tested the change suggested by IndigoLexa in comment #7. This has also been pointed out by Jon Pollard
Please let me know what changes I should make for the file or any posting goofs I made.
Comment #12
leducdubleuet commentedThe patch in #11 does the job to fix this major issue.
Thank you very much!
Comment #13
kliker commentedThank you, patch fixes the issue with inaccessible /users/* pages.
Comment #14
webengr commentedI can confirm that on a drupal7 website with php 7.3, move to a server with php 8.0 with core at latest and many of the modules pushing dev to support php 8.0 that the problem persisted.
I edited line 108ish as recommended by Pollard and indigoxela, and it is FIXED !!!
TRULY this needs to be fixed. It has been broken a long time, I was ignoring it being broken but it was messing up users also.
Comment #21
raphael apard commentedThanks for you work !
Comment #23
raphael apard commented