[meta] Priorities for 2023-06-07 release of Drupal 7

Open on Drupal.org →

Created on 7 December 2022, over 1 year ago

Updated 12 June 2023, about 1 year ago

Assorted todo lists carried over from #3292217: [meta] Priorities for 2022-12-07 release of Drupal 7 → .

These are not necessarily in priority order.

Top priorities

Simple fixes

🐛 list_allowed_values_setting_validate dies with PHP Fatal error on PHP 8.1 Fixed
🐛 hook_comment_publish() docs are completely wrong Fixed
📌 [D7] Update CommonXssUnitTest::testBadProtocolStripping() to check other allowed / dangerous protocols Fixed
🐛 drupal_goto short circuits and doesn't set things to cache Needs review
🐛 Crypt::randomBytes()/drupal_random_bytes() doesn't actually return cryptographically secure random bytes Fixed
🐛 The description for the value returned from form_type_token_value() is wrong Fixed
✨ Change link for language code identifier when creating custom languages Fixed
🐛 taxonomy_overview_terms undefined index (repeatable) Fixed
🐛 Undefined variables in system.tar.inc Fixed
🐛 Array flip error when a taxonomy term field has a NULL value Fixed
🐛 Fatal error when taxonomy_options_list() tries to call an undefined callback function Closed: won't fix
🐛 Performance tune text_field_load() Fixed
🐛 Getting a PDOException when adding new image style named thumbnail, medium and large Fixed
🐛 Cron.php does not check for maintenance mode correctly Fixed
🐛 Notice: Undefined property: stdClass::$forum_tid in forum_node_view() Fixed
🐛 Selecting 'Disabled' does not move the block to the disabled region when there are no disabled blocks Fixed
🐛 drupal_write_record() throws PHP notices if any fields use DB-specific data types Fixed

Important fixes

📌 [D7] Add phtml files to the list of potentially malicious extensions Fixed Security improvement - already in D8/9/10
📌 Make phpinfo on the admin status report configurable [D7] Fixed
📌 Improve security of session ID against DB exposure or SQL injection Fixed Security improvement - already in D8/9/10
🐛 [D7] Username enumeration via one time login route Fixed Security improvement - username disclosure
🐛 Double click prevention on form submission Fixed Important to prevent double submission of forms, creating duplicate nodes, etc. Must clear browser cache to take effect.
#2539478: Allow image fields to use any extensions the current image toolkit supports (instead of hard-coding jpg, png and gif only) → Remove hardcoded image files extensions.
🐛 Make SSL options configurable in drupal_http_request() Fixed Verifies SSL certificates in OpenSSL connections (Critical)
#2749007: Autocomplete broken for servers enforcing clean URLs → Security Regression
📌 Add backtrace to all errors RTBC
🐛 [D7] Login fails and no warning is issued if cookies are not enabled Needs review This is a D7 backport of 🐛 Login fails and no warning is issued if cookies are not enabled Fixed , an 18 year old issue that was marked as major and committed to drupal 9.3.x in June 2021.
🐛 [D7] file_unmanaged_move() should issue rename() where possible instead of copy() & unlink() RTBC Important fix. Mcdruid urging commit. @joseph.olstad: "D8 has this already. It is a good idea."
🐛 Using entity_get_info in a hook_hook_info results in an incomplete module_implements cache. Needs review
#1209226: Avoid slow query for path alias whitelists →
#1978176: Build menu_tree without loading so many objects → @joseph.olstad: "... the performance improvement is huge! .. After several years I see no credible reports of an issue with this patch"
🐛 Postgres insert queries that fail in a transaction break the entire transaction Fixed
📌 [D7] Convert drupalSettings from JavaScript to JSON, to allow for CSP in the future Needs review FabianX said it looks good, has updated tests
🐛 [D7] Support X-Forwarded-* HTTP headers alternates RTBC Important backport for reverse proxies and load balance.
🐛 [D7] Add wrappers to fix permission checks Postponed Required for POSIX filesystem. Fixed in D8? @orlitzky: "I'm just going to keep updating the patch for drupal-7.x for the rest of my life." "I'll keep posting patches until I don't have to any more."
✨ Path alias filter by system path Needs work (D10 patch, still Needs review) includes 6 year old patch for D7 in comment #1 that has been RTBC and without the patch "it's very hard to find alias which contains few slashes in path."
#3210388: Potential dataloss when opting in to "Avoid field storage write when field content did not change" and changing the bundle type of an existing entity →
🐛 [D7] node_access filters out accessible nodes when node is left joined Postponed Issue identified as major. D8/9 fix pending.

Unsorted fixes

🐛 pg_attribute.attrelid error Needs review
🐛 After upgrade to 7.63, 8.5.10, 8.6.7, 9.4.0 get TYPO3 phar error for drush Fixed
#1982810: Core entity_get_controller gets a NULL controller class →
🐛 Users are able to upload 0-byte images Fixed
#3304385: [D7] node/add page misses content types when menu links are moved or disabled →
#2456193: Menu links - not possible to create numeric paths →
🐛 Set fixed "from:" and add "Reply-to:" to comply with DMARC RTBC
#2962374: [D7] Path alias validation should test for relative path, no trailing slash requirements →
🐛 [D7] Automatically shorten cid's in DrupalDatabaseCache RTBC
🐛 Reverting to revisions prior to addition of field translations is broken RTBC Issue is 9 years old, marked as critical and has patch that is RTBC and passes automated tests. Are tests sufficient?
#1328696: Problem with _drupal_wrap_mail_line and attachment files → Attachment of docx file or files with long names results in email that is not correct. Fixed in D8, backport for D7 has patch.
🐛 Support boolean attributes in drupal_attributes() RTBC
✨ Add hook_field_schema_alter() RTBC
🐛 Deleting a comment author while the Comment module is disabled leads to an EntityMalformedException error after it's reenabled Fixed
✨ Add "delete" link on node Translate tab Operations Fixed
#3035571: [D7] ImageStyle::transformDimensions unable to deal with all effects. →
#1565892: node_type_delete() doesn't check the value returned from node_type_get_type() →
#965078: HTTP request checking is unreliable and should be removed in favor of watchdog() calls → Needs work and needs CR
#139015: breadcrumbs wrong on dblog event detail pages → Issue seems in good shape, needs a bit of work as of Aug-4
#1951408: Core Update manager doesn't correctly handle "status" UPDATE_NOT_CHECKED → Includes D7 core patch in comment #16 that passes tests and is RTBC. Required for update_advanced module that is used by 2,700 sites. Does not appear to be relevant to D8/D9.
#498752: Partial word search for Drupal 7 → Includes working patch from 5 yrs ago. Was closed as won't fix feature request. Now that a similar feature is proposed for D9 core ✨ Partial Search in Drupal Core Needs work maybe it's worth considering.

📌 Task

Status

Fixed

Version

7.0 ⚰️

Component

Last updated about 2 hours ago

Created by

🇬🇧United Kingdom mcdruid 🇬🇧🇪🇺

Live updates comments and jobs are added and updated live.

Incomplete comments

Sign in to follow issues

Comments & Activities

Not all content is available!

It's likely this issue predates Contrib.social: some issue and comment data are missing.

Comment over 1 year ago →
🇬🇧United Kingdom mcdruid 🇬🇧🇪🇺
Comment about 1 year ago →
🇸🇰Slovakia poker10
Comment about 1 year ago →
🇸🇰Slovakia poker10
Comment about 1 year ago →
🇸🇰Slovakia poker10
Comment about 1 year ago →
🇸🇰Slovakia poker10
Updating issues.
Comment about 1 year ago →
🇸🇰Slovakia poker10
Added two other security improvements/follow-ups.
Comment about 1 year ago →
🇬🇧United Kingdom MustangGB Coventry, United Kingdom
Any maintainers able to chime in on ✨ Add hook_field_schema_alter() RTBC ?
Status changed to Fixed about 1 year ago5:35pm 12 June 2023
Comment about 1 year ago →
🇸🇰Slovakia poker10
Drupal 7.98 was released last week as planned: https://www.drupal.org/project/drupal/releases/7.98 →

As always, thanks everyone that contributed!

I have created a new meta issue for the next release scheduled for 2023-12-06 and carried over all open issues from this meta issue: 📌 [meta] Priorities for 2023-12-06 release of Drupal 7 Active .
Comment 12 months ago →
System Message
Automatically closed - issue fixed for 2 weeks with no activity.

contrib.social Blog FAQ Discussions

Production build 0.69.0 2024