Security update

See Mollom - Critical - Access bypass - SA-CONTRIB-2015-168

See Values - Critical - Arbitrary PHP code execution - SA-CONTRIB-2015-172
Use ctools permission 'Use CTools importer' for values set imports

This release contains only a security update (see The eXtensible Catalog (XC) Drupal Toolkit - Critical - Cross Site Request Forgery (CSRF) - SA-CONTRIB-2015-121 for details).

Issues fixed in this version

• #2507619 The eXtensible Catalog (XC) Drupal Toolkit - Critical - Cross Site Request Forgery (CSRF) - SA-CONTRIB-2015-121

This release contains only a security update (see The eXtensible Catalog (XC) Drupal Toolkit - Critical - Cross Site Request Forgery (CSRF) - SA-CONTRIB-2015-121 for details).

Issues fixed in this version

• #2507619 The eXtensible Catalog (XC) Drupal Toolkit - Critical - Cross Site Request Forgery (CSRF) - SA-CONTRIB-2015-121

Encrypt - Moderately Critical - Weak Encryption - SA-CONTRIB-2015-166

This release makes the following changes to encryption methods and key providers that are included in the project:

Removed the "Basic" (default) encryption method
This method has been deprecated and removed from the list of available methods, though it remains available for decrypting existing data.

Fixes Flag clear - Moderately Critical - Cross Site Request Forgery (CSRF) - SA-CONTRIB-2017-017

All flag clearing links now require tokens for authentication purposes.