Support for Drupal 7 is ending on 5 January 2025—it’s time to migrate to Drupal 10! Learn about the many benefits of Drupal 10 and find migration tools in our resource center.
By Drupal Security Team on
- Advisory ID: DRUPAL-SA-CONTRIB-2011-017
- Project: Save Draft (third-party module)
- Version: 6.x, 7.x
- Date: 2011-April-27
- Security risk: Moderately critical
- Exploitable from: Remote
- Vulnerability: Validation bypass
Description
The Save Draft module adds a "Save as draft" button to the node form, letting content creators easily save a post in unpublished draft form.
The module adds validation to individual form actions, thereby bypassing any form-wide validation that is normally performed before saving content. This is a security vulnerability for sites where other modules are using node validation for security purposes.
Versions affected
- Save Draft module for Drupal 6.x versions prior to 6.x-1.8
- Save Draft module for Drupal 7.x versions prior to 7.x-1.4
Drupal core is not affected. If you do not use the contributed Save Draft module, there is nothing you need to do.
Solution
Install the latest version:
- If you use the Save Draft module for Drupal 6.x, upgrade to Save Draft 6.x-1.8. (Note that the 6.x-2.x branch of the module is not affected. If you use that, you do not need to upgrade.)
- If you use the Save Draft module for Drupal 7.x, upgrade to Save Draft 7.x-1.4.
See also the Save Draft project page.
Reported by
- David Rothstein of the Drupal Security Team
Fixed by
- David Rothstein of the Drupal Security Team
- Katherine Senzee (ksenzee), module co-maintainer
Contact and More Information
The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact.
Learn more about the team and their policies, writing secure code for Drupal, and secure configuration of your site.
