Modal Frame API had a recent security release following this SA: https://drupal.org/node/2189751. We need to update hostmaster.make to point to the new version.

Note that this does not constitute a security threat to Aegir by default, as we perform sufficient xss filtering already. However, some other contrib modules that depend on modalframe may still be vulnerable. Any users who have installed such contrib modules should probably download the latest version of modalframe to the sites/all/modules directory and visit the modules admin page. This will override the version currently installed in the hostmaster profile with the new secure release.

Should we rush a 2.1 (and 1.12?) release to fix this?

Comments

helmo’s picture

helmo commented

No "rush" as it's not actually a threat for us. But soonish would be nice, including some more bugfixes.

@Jon Pugh also noticed this and has a makefile patch in #2193065: Modalframe deleted all releases but 1.9.
Updating modalframe seems to also requires a jquery update :(

jon pugh’s picture

jon pugh
he/him
Primary language English
Location Newburgh, NY
commented

It's breaking fresh installs of Aegir (and devshop) because the makefile builds from drupal.org, so I'd say this is critical or high priority at least.

And yes, it does require an update to jquery ui (module and library) which I included in the patches over at #2193065: Modalframe deleted all releases but 1.9

jon pugh’s picture

jon pugh
he/him
Primary language English
Location Newburgh, NY
commented
Priority: Normal » Critical
helmo’s picture

helmo commented

I just committed the patch from #2193065-4: Modalframe deleted all releases but 1.9 to the 6.x-2.x branch

ergonlogic’s picture

ergonlogic
he/him
Primary language English
Location Montréal, Québec 🇨🇦
commented

In our 2.x .debs, I believe we install the distribution tarball as core, rather than building from the makefiles on every install. As such, I believe 2.x .debs should still be ok. This should be tested though. 1.x won't install, since make will fail.

anarcat’s picture

anarcat commented
Version: 6.x-2.x-dev » 6.x-1.11

I confirm the 2.x install procedure is still okay, thanks to the new makefile which uses a bundled tarball. so this affects only the 1.x branch.

adarkling’s picture

adarkling commented

+1 on updating the makefile and releasing 1.12

The Aegir upgrading docs were silent on this problem and I ended up filing unnecessary issues because my searches didn't reveal this one until after I'd diagnosed and patched the problem myself. My search parameters seem woefully inadequate now that I understand how the update script & Drush makefiles work, but people shouldn't have to go through that hassle.

pomliane’s picture

pomliane commented

@aDarkling on your off-topic question:

References to project issues in the form of #1234: "Mark all as read" in forums. (or #1234: "Mark all as read" in forums. for comments) turn into links automatically, with the title of the issue appended. The status of the issue is shown on hover. If '@' is appended (e.g. #1234: "Mark all as read" in forums.), the user the issue is assigned to will also be printed.

- https://drupal.org/filter/tips

adarkling’s picture

adarkling commented

Thanks @Pomliane !

anarcat’s picture

anarcat commented

I won't be able to do this before thursday at least, so if anyone wants to push this out before that, it would be great.

A patch would be a good start.

anarcat’s picture

anarcat commented

So the main problem here is that modalframe > 1.6 depends on jquery 1.7, and updating from jquery 1.6 to 1.7 breaks the signup form and site add forms. This was discussed previously in #818900: Modal Frame and jQuery UI upgrade.

Now it may be a problem in jquery_ui that is resolved, but it's not as simple as just rolling out a new makefile.

anarcat’s picture

anarcat commented
Status: Active » Needs review
Related issues: +#2193065: Modalframe deleted all releases but 1.9, +#818900: Modal Frame and jQuery UI upgrade

I committed the patch from [#8468755] in 1.x, but this needs testing.

anarcat’s picture

anarcat commented
Status: Needs review » Needs work

Patch failed here:

Unable to download jquery_ui from http://jquery-ui.googlecode.com/files/jquery.ui-1.7.3.zip.                [error]
Could not download platform using drush make. No platform present                                           [error]

I can't make that shit up:

anarcat@marcos:provision[6.x-1.x]*$ curl -I https://jquery-ui.googlecode.com/files/jquery-ui-1.7.3.zip
HTTP/1.1 404 Not Found
[... try again with wget, it works! then... ]
anarcat@marcos:provision[6.x-1.x]*$ curl -I https://jquery-ui.googlecode.com/files/jquery-ui-1.7.3.zip
HTTP/1.1 200 OK

wtf?

anarcat’s picture

anarcat commented
Title: Update modalframe (and new release?) » Update modalframe + jquery*
Status: Needs work » Fixed

I fixed this in 1.x, from what i can tell with casual testing most of the stuff works.

anarcat’s picture

anarcat commented
Status: Fixed » Needs work

Actually no, this is broken - the modal frame pops up then disappears. It degenerates well, however (it redirects to the task view, for example), so I am not sure we want to go crazy into this.

We need to test 2.x as well.

anarcat’s picture

anarcat commented
Status: Needs work » Fixed

I would argue that modalframe breaks in 1.x, but it degenerates well: you get to the task log page instead of loading it in an iframe, for example.

So we fix 1.x, which is uninstallable, but create a minor regression, which I think is a good compromise.

This seems to work fine in 2.x.

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.