Security update

Security

• Fixes Translations directory is not protected from executing scripts. See Localization update - Not critical - Insecure server configuration - SA-CONTRIB-2019-072.

Bugs

• Issue #2591673 by hass: Schema inconsistencies
• Issue #2594455 by Sutharsan: Backport translation download fallback
• Backport from 7.x-2.x of issue #2559367: Issue with modules long names
• By Sutharsan: PHP notice when project has no name in the info file.

Security release to fix Ubercart - Moderately critical - Cross-site-scripting

Ubercart - Moderately critical - Cross site scripting - SA-CONTRIB-2019-070

Two minor compatibility fixes for PHP 7.1 and above are also included.

No other significant changes have been made since the 7.x-3.12 release.

Add access permission to block controller routes and other routes.

Gutenberg - Critical - Access bypass - SA-CONTRIB-2019-069.

• Added a test to check if unpublished nodes remain inaccessible to anonymous users
• Before deciding on access permissions, check if an entity is even using restricted terms, otherwise just return neutral

Permissions by Term - Moderately critical - Access bypass - SA-CONTRIB-2019-068

Fixes an issue where the module would prevent the setting "Who can register accounts? Visitors, but administrator approval is required try to register an account" to have an effect.

Fixes SA-CONTRIB-2019-066.

This is a security update for tablefield.

Fixes SA-CONTRIB-2019-067.