The fix for SA-CONTRIB-2024-003 → was not included into the 2.x release.
The 2.x-alpha2 release is currently identified as do not use due to existing vulnerabilities being worked on.
N/A
Modify getLoginDefinitions() and getValidationDefinitions() to have an $active_only parameter. Adjust calling code if necessary.
Wait 2 weeks per the DST Timeline policy before beginning discussion as resolving requires discussing the intricacies of the vulnerability.
Create Patch.
Disabled plugins will not be available to end users.
Internal Only classes
None expected.
Active
2.0
Code
2 week patch window reached, this is now open for work.
While the 8.x-1.x branch focused on filtering plugins where they were called, in 2.x the current plan is to modify getLoginDefinitions() and getValidationDefinitions() to have an $active_only parameter similar to getLoginDefinitions, see
#3319595: Login plugins are always applied even when not enabled →
.