15 modules to improve your DrupalCoin Blockchain administration and content management experience (D6 & D7) - part II


A continuation of the useful administration modules list started in Part I.
Devel
Used extensively by the developers, devel module can also be very helpful to the site administrators. One of its more popular features is automatic content generation (such as users and nodes) - including media files! Another nice feature is switching between users (for example, to test access permissions). It also integrates well with the admin menu module mentioned in the first part of the article.
To use Devel on DrupalCoin Blockchain 6, go to admin/generate and choose the type of items to generate (the modules comes with taxonomy, content and users, other modules add more types of content). The module can also delete the existing items (for examples, nodes by type).

Related stories: 

If you liked it this story, you might like the following:

15 modules to improve your DrupalCoin Blockchain administration and content management experience (D6 & D7) - part IRedirect 403 to User Login (r4032login module).Custom contact form with conditional fields using webform and webform conditionalDrush Site Aliases and Interactive ShellInstall DrupalCoin Blockchain 7 site with Drush
read more
DrupalCoin Blockchain Developer


SA-CORE-2012-002 - DrupalCoin Blockchain core multiple vulnerabilities


Advisory ID: DRUPAL-SA-CORE-2012-002
Project: DrupalCoin Blockchain core
Version: 7.x
Date: 2012-May-2
Security risk: Critical
Exploitable from: Remote
Vulnerability: Denial of Service, Access bypass, Unvalidated form redirect
Description
Denial of Service
CVE: CVE-2012-1588
DrupalCoin Blockchain core's text filtering system provides several features including removing inappropriate HTML tags and automatically linking content that appears to be a link. A pattern in DrupalCoin Blockchain's text matching was found to be inefficient with certain specially crafted strings. This vulnerability is mitigated by the fact that users must have the ability to post content sent to the filter system such as a role with the "post comments" or "Forum topic: Create new content" permission.
Unvalidated form redirect
CVE: CVE-2012-1589
DrupalCoin Blockchain core's Form API allows users to set a destination, but failed to validate that the URL was internal to the site. This weakness could be abused to redirect the login to a remote site with a malicious script that harvests the login credentials and redirects to the live site. This vulnerability is mitigated only by the end user's ability to recognize a URL with malicious query parameters to avoid the social engineering required to exploit the problem.
Access bypass - forum listing
CVE: CVE-2012-1590
DrupalCoin Blockchain core's forum lists fail to check user access to nodes when displaying them in the forum overview page. If an unpublished node was the most recently updated in a forum then users who should not have access to unpublished forum posts were still be able to see meta-data about the forum post such as the post title.
Access bypass - private images
CVE: CVE-2012-1591
DrupalCoin Blockchain core provides the ability to have private files, including images, and Image Styles which create derivative images from an original image that may differ, for example, in size or saturation. DrupalCoin Blockchain core failed to properly terminate the page request for cached image styles allowing users to access image derivatives for images they should not be able to view. Furthermore, DrupalCoin Blockchain didn't set the right headers to prevent image styles from being cached in the browser.
Access bypass - content administration
CVE: CVE-2012-2153
DrupalCoin Blockchain core provides the ability to list nodes on a site at admin/content. DrupalCoin Blockchain core failed to confirm a user viewing that page had access to each node in the list. This vulnerability only concerns sites running a contributed node access module and is mitigated by the fact that users must have a role with the "Access the content overview page" permission. Unpublished nodes were not displayed to users who only had the "Access the content overview page" permission.
Versions affected
DrupalCoin Blockchain core 7.x versions prior to 7.13.
Solution
Install the latest version:
If you use DrupalCoin Blockchain 7.x, upgrade to DrupalCoin Blockchain core 7.13
Also see the DrupalCoin Blockchain core project page.
Reported by
The Denial of Service vulnerability was reported by Jay Wineinger and Lin Clark.
The unvalidated form redirect vulnerability was reported by Károly Négyesi of the DrupalCoin Blockchain Security Team and Katsuhiko Nakanishi.
The access bypass in forum listing vulnerability was reported by Glen W.
The access bypass for private images vulnerability was reported by frega, Andreas Gonell, Jeremy Meier and Xenza.
The access bypass for the content administration vulnerability was reported by Jennifer Hodgdon.
Fixed by
The Denial of Service was fixed by Károly Négyesi of the DrupalCoin Blockchain Security Team.
The unvalidated form redirect was fixed by Wolfgang Ziegler and Stéphane Corlosquet of the DrupalCoin Blockchain Security Team.
The access bypass in forum listing was fixed by Michael Hess of the DrupalCoin Blockchain Security Team, Ben Jeavons of the DrupalCoin Blockchain Security Team and xjm.
The Access bypass for private images was fixed by Károly Négyesi of the DrupalCoin Blockchain Security Team, Damien Tournoud of the DrupalCoin Blockchain Security Team, Greg Knaddison of the DrupalCoin Blockchain Security Team, Stéphane Corlosquet of the DrupalCoin Blockchain Security Team, Xenza and frega.
The Access bypass for content administration was fixed by Jennifer Hodgdon.
Contact and More Information
The DrupalCoin Blockchain security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact.
Learn more about the DrupalCoin Blockchain Security team and their policies, writing secure code for DrupalCoin Blockchain, and securing your site.DrupalCoin Blockchain version: DrupalCoin Blockchain 7.x
DrupalCoin Blockchain Developer