Security update

Maintenance and security release of the Drupal 7 series.

This release fixes security vulnerabilities. Sites are urged to upgrade immediately after reading the security announcement:

• SA-CORE-2013-001 - Drupal core - Multiple vulnerabilities

No other fixes are included.

No changes have been made to the .htaccess, robots.txt or settings.php files in this release, so upgrading custom versions of those files is not necessary.

Maintenance and security release of the Drupal 6 series.

This release fixes security vulnerabilities. Sites are urged to upgrade immediately after reading the security announcement:

• SA-CORE-2013-001 - Drupal core - Multiple vulnerabilities

No other fixes are included.

No changes have been made to the .htaccess, robots.txt or settings.php files in this release, so upgrading custom versions of those files is not necessary.

CSRF fixes and permission tweaks.

SA-CONTRIB-2013-005 - Mark Complete Module - Cross Site Request Forgery (CSRF)

See also SA-CONTRIB-2013-003

This release comes with a major API change for clients. A security token has been introduced to guard against CSRF attacks. This change only affects you if

* your client uses cookie-based user authentication and
* your client performs write operations (POST, PUT or DELETE).

Clients that only read data (GET requests) still work the same. Clients that use other authentication mechanisms (like restws_basic_auth) remain unaffected as well.

See also SA-CONTRIB-2013-003

This release comes with a major API change for clients. A security token has been introduced to guard against CSRF attacks. This change only affects you if

* your client uses cookie-based user authentication and
* your client performs write operations (POST, PUT or DELETE).

Clients that only read data (GET requests) still work the same. Clients that use other authentication mechanisms (like restws_basic_auth) remain unaffected as well.

This is a security release, it fixes SA-CONTRIB-2013-001 You are advised to update your version of Search API as soon as possible, especially if you're using the database backend along with Views.

The release also contains a small amount of other bugfixes and adds support for date popups in Views exposed filters.