This release contains a security fix (see the advisory). An upgrade is recommended to all users of webform 7.x-3.x
Besides the backport of the security fix this release also includes a backport of the webform4 webform_get_submissions(). This allows other modules (ie. webform_submission_uuid) to extend the webform submission data more easily.
7.x-4.14 is a primarily bug fix release. Updating is recommended for all users of the 7.x-4.x branch.
The majority of the issues addressed in this release arose from community-written patches. A few received community review while the bulk were maintainer-reviewed. The best path to having your pet issues resolved is to write clear issue summaries, provide patches, and then review other patches with a request to receive reciprocal community review.
Recent releases represent 100's of hours of development. As of this writing, the 7.x issue queue is nearly empty. When Dan start maintaining Webform almost two years ago, there were 330 open issues and 130 open bug reports.
Recent releases represent 100's of hours of development. As of this writing, there are almost no open bugs, one open support request, and only a few open feature requests. When Dan start maintaining Webform over a year ago, there were 330 open issues and 130 open bug reports.
Recent releases represent 100's of hours of development. As of this writing, there are no open bugs, no open support requests, and only a few open feature requests. When Dan start maintaining Webform over a year ago, there were 330 open issues and 130 open bug reports.
Recent releases represent 100's of hours of development. As of this writing, there are no open bugs, no open support requests, and only a few open feature requests. When Dan start maintaining Webform over a year ago, there were 330 open issues and 130 open bug reports.
This release represents 150 hours of development. As of this writing, there a no open bugs, no open support requests, and only a few open feature requests. When Dan start maintaining webform about a year ago, there were 330 open issues and 130 open bug reports.
This release of 7.x-4.x fixes a number of bugs. Updating is recommended for all users of the 7.x-4.x branch.
If your update procedure does not clear the caches and you skipped updating to 7.x-4.6, you will need to manually clear at least the class registry. This release includes a new class, WebformConditionals, which may not be recognized by Drupal otherwise. The easiest way to clear your class registry is to clear all caches.
This release of 7.x-4.x fixes a number of bugs. Updating is recommended for all users of the 7.x-4.x branch.
If your update procedure does not clear the caches, you will need to manually clear at least the class registry. This release includes a new class, WebformConditionals, which may not be recognized by Drupal otherwise.
When a webform component is used as the "To" address or addresses for sending an e-mail, the name of the component is not sufficiently sanitized when it is displayed in the list of e-mail settings, leading to a Cross Site Scripting (XSS) vulnerability.
When a webform component is used as the "To" address or addresses for sending an e-mail, the name of the component is not sufficiently sanitized when it is displayed in the list of e-mail settings, leading to a Cross Site Scripting (XSS) vulnerability.
This release of 7.x-4.x fixes two security issues, a number of bugs, and introduces new features. Immediate updating is strongly recommended for all users of the 7.x-4.x branch. See SA-CONTRIB-2015-063 - Webform - Cross Site Scripting (XSS) for details.
When a webform is made available as a block, the node's title is used as the default block title. This title is not sufficiently sanitized, leading to a Cross Site Scripting (XSS) vulnerability.
When a webform is made available as a block, the node's title is used as the default block title. This title is not sufficiently sanitized, leading to a Cross Site Scripting (XSS) vulnerability.
This is a minor bug-fix update. Updating is recommended for all 7.x-4.x branch users.
Upgrading from Webform 3.x to 4.0
If you're upgrading from Webform 3.x, please make a database backup prior to upgrading and check that all modules that extend Webform on your site are Webform 4.x compatible. Slight differences in the class names and IDs may result in updates being needed to your site's CSS. See the API changes between 3.x and 4.x documentation for more information.
This is the first stable release of the 7.x-4.x branch. This is a major upgrade from the 7.x-3.x branch, and contains numerous bug fixes and feature enhancements.
This release of Webform 4.x fixes several issues discovered shortly after the release of 4.0-beta2 (which included a security update). Please read the release notes for 4.0-beta2 for a list of recent changes if upgrading from a previous beta or alpha version.
SA-CONTRIB-2014-018 - Webform - Cross Site Scripting (XSS)
This release of Webform 4.x fixes a large number of bugs and addresses an XSS security vulnerability. Beta2 introduces a new feature to preview submissions before submitting them in multipage forms. Upgrading is recommended for all users of Webform 4.x.
This version of Webform moves Webform closer to a stable release. It should also contain the last significant API changes before the release of Webform 4.0. This version adds flexibility around the provided data used to provide analysis, enabling charting of data using the existing hooks. This version also makes some changes to the themed output, if you're overriding theme_webform_element() you may need to update your implementation to ensure conditional functionality continues working.
This release of Webform includes several new features. Including an Excel-native exporter that generates true XLSX files for better compatibility with Excel, Google Docs, OpenOffice and LibreOffice, which can all read and write this file format.
This release also increased PHP requirement to PHP 5.3. Make sure you have it available before upgrading. The new Excel exporter depends on this version of PHP, as well as the ZipArchive PHP extension (which is enabled by default in PHP installations).
This release fixes a major problem when sending e-mails to a custom e-mail value. This release also adds batch-based exporting of results, allowing for large exports of tens of thousands of rows (or more).
These notes are the same as webform 7.x-4.0-alpha7, which was released for a short time but had a critical access control bug. This release is identical to alpha7 with that bug fixed. Thanks @pjcdawkins for reporting the problem.
This release of Webform adds several new pieces of functionality and fixes many bugs in the 4.x branch of the module. New features include HTML5 placeholder support, custom CSS classes for components, better e-mail support, and several other long-requested features.
This release of Webform fixes a security vulnerability where unsanitized labels could be displayed to users creating or configuring Webform content. This problem only exists in the Drupal 6 version of Webform. For more information see SA-CONTRIB-2013-050 - Webform - Cross Site Scripting (XSS).
In addition to the security fix, this maintenance release includes several bug fixes as listed below. Upgrading is recommended for all users of Webform 3.x.
This release fixes a critical issue in alpha5 that would prevent the creation of new forms, causing an error when the first component was added to any node.
This release also adds a significant expansion to our Views integration, enabling full access to all user-submitted data through Views. w00t! Thanks to all the contributors on that feature.
This version of Webform 4.x fixes a few bugs and adds full token support in the confirmation message, both as a message and as a full page (extra thanks to Liam Morland for his work on this feature).
