security_review 2.0.1

Changelog

Issues: 23 issues resolved.

Changes since 2.0.0:

Bug

• Fix issue 2797371
• Fix issue 3028264
• #2797371: false positive when restrict access is explicitly false
• #3028264: Unnecessary check for is_dir('..')
• #3325599: Compatibility with external_entities
• #3179937: False positive for the file permissions check on multisite setup
• #3224996: Only check default view access if it is used
• #3221065: Field check out of memory
• Resolve #3008957 "Refactor host"

Feature

• #2897949: Log the beginning of a check (in addition to end) to help identify which check is causing problems
• #1244238: Check that cron has been run recently - in the last 72 hours
• #2535944: patch Details for file permissions security review report
• #2592609: Recommend to drupal 8 to move /vendor/ outside of the webroot
• #2678112: Make fields check more useful with risky content (allowlist of content?)
• #1244226: Check that uid 1 account is blocked
• #830970: test password strength by comparing the password to the username

Misc

• Revert back to 2.0.0 tag
• Update README.txt
• Checks\PrivateFiles: More robust check, uses Symfony Filesystem.
• FilePermissions: Added support for core 10.1 configurable asset paths.

Task

• Fix issue 3079918
• #3079918: File permission test returns false positives when symbolic links are involved
• #3321107: Fix Coding Standard Issue
• #2914467: Notice: Security Review now integrated in DRD
• #3331646: Fix test cases
• #2581071: Remove checking base_url in TrustedHosts check
• #3335005: PHPCS Fix