By halfer on

Folks

I am a relatively new Drupal user with two installations on 4.7.6. At least one will be upgraded to 5.0 to combat the latest round of security issues. I am however concerned at the slew of of security problems affecting Drupal and popular modules, as this is creating a support overhead I don't have time for.

Is there a general feeling amongst Drupal developers that the security issues in the base product are going to get less frequent? Does all core and supplied module database functionality go through a filter to combat undiscovered SQL injection opportunities?

Thanks in advance to all respondents.

⋅ Categories: Drupal 4.7.x

Comments

styro’s picture

styro commented

Why would you need to upgrade to 5.0 due to security issues? Is it because of issues in a contrib module that isn't providing 4.7 fixes anymore?

If modules use the documented Drupal database API, they are protected from SQL injection attacks. There is nothing stopping a badly written module bypassing this though.

I actually think Drupal has a pretty good track record in this area of addressing problems quickly. And as far as I can tell for the most part these patches are proactive fixes that get fixed before becoming problems for the community. The last time vulnerabilities caused widespread problems was a couple of years ago in the old 3rd party XML-RPC library. And that now seems a thing of the past after Drupal wrote it's own more secure library for that.

If you were using a (hypothetical) different platform that didn't release any security updates, is your feeling of security based on real security or just ignorance? Without doing your own audit, how would you know how secure it is?

The security of Drupal has increased a lot since those XML-RPC problems - after that a security team was created and these things handled more proactively. Paradoxically to the uninitiated, the increase in the security of Drupal has meant an increase in patches as more problems are now fixed before they get exploited.

--
Anton
New to Drupal? | Forum posting tips | Troubleshooting FAQ

halfer’s picture

halfer commented

Thanks for your reply. However, I'd be pleased if you avoided suggesting that forum participants are ignorant, whether the term is applied to me or anyone else here. There are several synonyms that are much more in keeping with civil conversation and you are clearly literate enough to word your response diplomatically. I fully understand that long-term Drupal users are keen to defend and evangelise the platform - this is commendable - but some constructive questions can't be bad for it either.

Why would you need to upgrade to 5.0 due to security issues? Is it because of issues in a contrib module that isn't providing 4.7 fixes anymore?

I guess I don't need to - I could just patch. But the documentation recommends, I believe, that a new install is made every time, rather than patching an already patched system. If this is the case, it would make sense to upgrade to the new release, as this is involves about the same amount of hassle as installing an old one from scratch. I don't use much in the way of non-standard modules, as far as I remember.

I actually think Drupal has a pretty good track record in this area of addressing problems quickly.

I agree completely, the speed of response is excellent. My concern is that issues are still being discovered in core/standard functionality, like comments, which one would have thought would have had its security issues ironed out a long time ago. (NB for you and other long term users - I think Drupal is an excellent platform regardless ;-).

styro’s picture

styro commented

However, I'd be pleased if you avoided suggesting that forum participants are ignorant, whether the term is applied to me or anyone else here.

That was totally not what I was suggesting at all - in fact just the opposite. The very fact that you and the other participants here use Drupal means that you/them aren't ignorant of security issues. They get plastered over the sites front page.

My point was that if some other hypothetical application isn't releasing regular patches the users of that application will be unaware (ie ignorant) of that state of that applications security unless they've audited it. The absence of evidence (ie patches) isn't evidence of absence (of vulnerabilities).

Being that at least 99.9% of us (myself included) don't have the time, inclination or ability to do that auditing we don't necessarily know why there aren't patches. It could be that the app isn't very popular, it could be that the app doesn't have a proactive security team, it could be that things are swept under the carpet, or it could be that the app is the paragon of security. If you were a paranoid site maintainer would you just go on faith that it is the last option?

The projects with proactive and visible security teams are at least giving you evidence you can judge things by.

I guess I don't need to - I could just patch. But the documentation recommends, I believe, that a new install is made every time, rather than patching an already patched system. If this is the case, it would make sense to upgrade to the new release, as this is involves about the same amount of hassle as installing an old one from scratch. I don't use much in the way of non-standard modules, as far as I remember.

I think you've slightly misunderstood the docs. There are two ways of upgrading a) patching and b) overwriting the core files. Patching is only really for those that have customised the core files and need to slip the changes into their own customisations. As it isn't recommended to customise core if you can possibly avoid it, generally overwriting is the best option. Overwriting will also get you fixes to other bugs fixed since the last point release, while the patches are only for security issues.

As for overwriting with the next point release of 4.7 or upgrading to 5 - staying with 4.7 is much less hassle. You don't need to upgrade your database schema (well there was one update recently that did) or hunt down compatible modules or upgrade your theme etc and you don't need to worry about functionality changes etc.

For those that don't customise core files, you can just unzip the new version of 4.7 over the top and go. Unless of course the database changes, but that is rare.

--
Anton
New to Drupal? | Forum posting tips | Troubleshooting FAQ

halfer’s picture

halfer commented

That was totally not what I was suggesting at all - in fact just the opposite. The very fact that you and the other participants here use Drupal means that you/them aren't ignorant of security issues. They get plastered over the sites front page.

I apologise for misunderstanding your post... I have reread it in the context of your new reply, and I see what you mean now.

You are right about the visibility of security - if new security issues are being published, then it means that at least someone is checking them. But my topic was slightly different - I was expressing surprise that functionality which (I imagine) is as old as Drupal itself should still have bugs in it.

I am very interested in what you say about upgrading though - I've never been brave enough to unzip the new version over the top of the old one! More to the point I've not read in the various Drupal docs that one can do this - I guess it should have occured to me (with a prior back-up, of course). I do use one tweaked module - TinyMCE - but since it does not form part of the standard release, I should imagine that installing the new 4.7.x release would not overwrite this.

I think I will give this a go asap!