Active
Project:
Drupal core
Version:
main
Component:
update.module
Priority:
Normal
Category:
Feature request
Assigned:
Unassigned
Reporter:
Created:
16 Mar 2011 at 00:02 UTC
Updated:
29 Jan 2024 at 22:22 UTC
Jump to comment: Most recent
Problem/Motivation
Security update notifications within a site appear in the administrative error styling and make a generalized statement about security updates without specifics on level of risk or relevancy to the site.
As one method of #1890678: [meta] Improve security release update rate this issue is about discussing possible technical solutions to improving the relevancy and actionability of security notifications with update.module.
Proposed resolution
(coming soon)
Original report by Tuck
In my experience, most security updates are unnecessary if a web site's registered users are trusted users (admins, editors, blogists etc.). Every time a module has to be updated, there is a risk that a web site starts malfunctioning, so an admin must be very careful when updating installed modules. AND, if the admin has made his own modifications to the module, he must update them and do some tests too.
So it would be great if there were two sorts of security update notifications. Like "Level 1" and "Level 2" security notifications. Level 1 would mean there is a security update available for sites who's users are non-trusted. Level 2 would mean there is an update for severe security hole which should be fixed on all sites.
Or, there could be a checkbox for each module on the available updates page (admin/reports/updates) so an admin could disable new update notifications for that module until the module's next security update becomes available.
Comments
Comment #1
coltraneFocusing the title on a goal. Will update issue summary to follow the template and discuss proposed solutions.
Comment #2
coltranehttp://drupal.org/project/update_advanced provides for the ability to ignore updates for specific modules. But as a contrib project, and based on usage, it's not very popular.
Comment #3
ezra commentedI wrote a post awhile ago about my idea for linking security notifications with information about what permissions are needed to exploit them and which roles have those permissions:
http://groups.drupal.org/node/223639#comment-876913
Unfortunately I haven't gotten a chance to actually get coding on this issue, but I could potentially return to it at some point. I'd be happy to collaborate with anyone else interested in that kind of solution. Thanks Coltrane for pointing me to this thread.
Comment #4
xenophyle commentedOne thing that would be necessary for @ezra's idea is to be able to check what permissions are needed to exploit the security flaws. Right now it looks like this is just described in the text of the security notice. It would be helpful if it were a field or something, but I'm not sure if this information is stored in a database or what. Does anyone have any idea?
Comment #5
coltraneSAs sometimes record what permissions are required to exploit. That could become a more "official" field on the SA node so that it's easier to be machine-read. However, that information would also have to be exposed by the update project xml feed and connecting the SA to the release node/update xml does not currently happen.
Comment #5.0
coltraneUpdated issue summary.
Comment #18
smustgrave commentedWonder if this is a duplicate of #2990476: If the site is on an insecure version of an old minor and there is a secure version of that old minor available, the update status report should link that release
Comment #19
dwwHrm, no, I don't think so. That issue is about handling edge cases for folks that are on older releases, and what specific release the Available Updates report recommends.
This issue is about the fact that not all security releases are created equally - many require you're already an admin on the site, etc. Very few are actually "holy crap, drop everything and upgrade NOW!". This issue aims to get updates.d.o and update manager to somehow convey the severity of the security issues. Something along the lines of at least reporting the "threat level" info from the SA directly in the Update Manager UI. TBD. But it's not a duplicate request AFAICT.
Thanks,
-Derek
Comment #20
dwwSorry, it's called "Security risk" on the SAs. E.g. if it was warning you about the 10.2.2 core release and https://www.drupal.org/sa-core-2024-001, it'd say something like "Security risk: Moderately critical 11∕25 AC:None/A:None/CI:None/II:None/E:Theoretical/TD:Default". Or however we decided to put that in the UI.