In 2.0 release notes
https://www.drupal.org/project/media/releases/7.x-2.0
it is suggested that users of 1.x who want to delay the update to 2.x branch should at list check their permission restricting media browser usage to trusted roles.

If you plan on delaying upgrading then please follow the security recommendations below:
Prevent anonymous or untrusted users from accessing the media browser through permissions configuration.
go to /admin/people/permissions and restrict access to "Use the media browser" to only trusted roles. Otherwise it is recommended you upgrade to 7.x-2.0 as soon as possible.

The problem is that AFAIK there not seems to be exactly a "Use the media browser" permission in 1.x branch.
Permissions seem the following:

  • Administer media
  • Import media files from the local filesystem
  • View media
  • Edit media

I think that this important security recommendation should be made clearer, specifying better which role to restrict.

Comments

gabrimonfa created an issue. See original summary.

amaisano’s picture

amaisano commented

Yes, I'm not quite sure what the reason for deprecating 1.x is and what the exactly temporary fix (permission recommendations) are...

joseph.olstad’s picture

joseph.olstad
Primary language French
commented

If you want to keep using 1.x , feel free to backport these security enhancements made in 2.0
http://cgit.drupalcode.org/media/commit/?id=4479a380dc9fd9ca46c55835e62d...

Or, upgrade to 7.x-2.0

amaisano’s picture

amaisano commented

Joseph - thanks for sharing the above details. I'm used to seeing specific vulnerabilities listed in the security announcements, so this was an ambiguous announcement in comparison. I usually need to explain to our clients why an upgrade is necessary. So you're saying 1.x is not necessarily vulnerable, it just lacks some newer security hardening the 2.x branch has?

nwehner’s picture

nwehner commented

Second that! Knowing what exactly the security issue is would be really nice, particularly since there's no announcement from the Drupal Security Team accompanying this release. My site is currently dependent on the Vimeo and YouTube extension modules to Media. Neither of those appear to work with the 2x branch at this time. Upgrading to 2x simply isn't an option at this time because of that.

joseph.olstad’s picture

joseph.olstad
Primary language French
commented

Media - Critical - 1.x branch unsupported - SA-CONTRIB-2017-042

amaisano’s picture

amaisano commented

Joseph, if I had to tell a client something, would it be "the 1.x branch is no longer going to receive security updates and should be upgraded." Is that accurate?

joseph.olstad’s picture

joseph.olstad
Primary language French
commented

That is correct, there is a known vulnerability with releases prior to 2.0. First Please test the upgrade path on a dev copy of your site. If there are issues you cannot resolve with the release notes and linked docs then please open a support request if it is a new issue.
Thanks

joseph.olstad’s picture

joseph.olstad
Primary language French
commented
Status: Active » Fixed

Changes were made to documentation, thanks

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.