looking for new maintainer

If no one else show up - I'll take that responsibility.
(I'm not best candidate because of may poor coding skills but I appreciate this module very much)

soma115,

What did you decide to do here? In light of the new security issue I am interested in helping, however I too am not a pro at this (I've only offered contributions here and there, such as https://www.drupal.org/node/423346#comment-5481526, https://www.drupal.org/node/728550#comment-6943204, https://www.drupal.org/node/2043585...). I've also contributed to this Decisions module as well, see https://www.drupal.org/node/840628, https://www.drupal.org/node/1240080, https://www.drupal.org/node/1368682...

I've mostly been doing pure node-based PHP coding, leveraging Drupal for our in-house store needs (via the Ubercart module). I have a few other modules that need updating from the recent Security Issue related to https://www.drupal.org/node/2459349 so if I see a pattern that can be applied to the Decisions module then I will report back with a security fix.

Regards,
BigMike

Do we know how this "specially-crafted URL" looks like? How this vulnerability exactly works?

Do we know how this "specially-crafted URL" looks like? How this vulnerability exactly works?

IMO, a new maintainer should be able to figure it out.

There is no new maintainer so we have to proceed with what we got.

Description is not clear:
"A malicious user can cause another user to remove individual voters"
It sound impossible to remove 'voters'. Shouldn't it be 'votes'?

Vote cancel is send by post/get and there is a cookie involved. And that is all I know...
Any hints?

It sound impossible to remove 'voters'. Shouldn't it be 'votes'?

No, It's correct. This is about removing users who can vote.

Vote cancel is send by post/get and there is a cookie involved. And that is all I know...

See https://en.wikipedia.org/wiki/Cross-site_request_forgery

Nothing really to report other than I looked at some other modules with XSS vulnerability and their maintainer(s) fixed them as follows...

Petition module, reported by Pere Orga, Changed...
$output = '<h2>'. $node->title .'</h2>';
To...
$output = '<h2>'. check_plain($node->title) .'</h2>';
Added check_plain().

Crumbs module, reported by Colleen Blaho, Changed...
return variable_get('crumbs_separator', ' » ');
To...
return filter_xss_admin(variable_get('crumbs_separator', ' » '));
...as well as adding a new function called "_crumbs_validate_separator_xss()" that contains...

  $string = $element['#value'];
  $filtered = filter_xss_admin($string);
  if ($string !== $filtered) {
    form_error(......

Added filter_xss_admin().

Another module, Linear Case, was also reported by Pere but in comparing the versions I cannot see any thing relating to XSS. All that was added was a function designed to "Implements CqQuestionAbstract::getAllText()", but nothing in there appears to be user or log-in related?

  public function getAllText() {
    $retval = '';
    $retval .= closedquestion_make_fieldset(t('Body'), $this->node->body);
    return $retval;
  }

Webform Multifile module, also reported by Pere, Changed...

    if (!empty($_FILES['files']['orig_name'][$form_key][$key])) {
      $_FILES['files']['name'][$newkey] = $_FILES['files']['orig_name'][$form_key][$key];
    }
    else {
      $_FILES['files']['name'][$newkey] = $_FILES['files']['name'][$form_key];
    }

To...

    if (!empty($_FILES['files']['orig_name'][$form_key][$key])) {
      $_FILES['files']['name'][$newkey] = transliteration_clean_filename(_webform_multifile_get_files_array_value($_FILES['files']['orig_name'][$form_key][$key], $form_key));
    }
    else {
      $_FILES['files']['name'][$newkey] = transliteration_clean_filename(_webform_multifile_get_files_array_value($_FILES['files']['name'][$form_key][$key], $form_key));
    }

Added transliteration_clean_filename() in two locations.

Also I received an email from Drupal notifying me of a new private message via my contact form here, but when I try to access my own contact form, https://www.drupal.org/user/395392/contact, I get a "403 - Access denied", "Unfortunately, you don’t have permission to enter this area of the site." error. I looked all around in my profile edit options and I see "Contact settings --> Personal contact form" is enabled, as someone was able to send me a contact message, but I don't know how to check my messages here on Drupal. Any ideas?

Thanks
Mike

I am closing this issue, since the project has been marked unsupported because of security issues.