Drupal : vulnérabilité — corrigée en 4.0.7

1. Vérifier si vous êtes concerné

   Versions ou systèmes touchés :

   <4.0.7

   drush status --field=drupal-version
   composer show drupal/core

2. Corriger

   Versions corrigées : 4.0.7.

   Mettre à jour le cœur ou le module concerné avec Composer, appliquer les mises à jour de base, vider les caches, sur chaque site.

   composer update "drupal/core-*" --with-all-dependencies
   composer update drupal/<module> --with-all-dependencies
   drush updatedb -y && drush cache:rebuild

3. En attendant le correctif

   Désactiver le module concerné (drush pm:uninstall <module>) si le correctif ne peut pas passer tout de suite, ou retirer la permission vulnérable aux rôles non administrateurs.

4. Contrôler

   drush status --field=drupal-version et composer show drupal/<module> doivent afficher la version corrigée.

   Rapport de statut Drupal (/admin/reports/status) sans alerte de sécurité.

Commandes indicatives (Debian ou Ubuntu) : à adapter à chaque serveur, après sauvegarde.

The Examples for Developers project aims to provide high-quality, well-documented API examples for a broad range of Drupal core functionality. The "Email Example" feature implemented by the email_example submodule can be used to send illegitimate emails to arbitrary email addresses. Therefore, the email_example sub-module is being removed from Examples for Developers until a version demonstrating security best practices can be added back in the future. Developers who based a new module on this example should review their code. Solution : Any site with the email_example submodule installed should uninstall it immediately. Then, install the latest version of Examples for Developers: - If you are using Examples for Developers 4.0.x, upgrade to Examples for Developers 4.0.7 . Developers who based a new module or custom code on this example should review their code.