- Issue created by @joachim
This module provides two routes for fixing links in nodes and block content. These routes have controllers which immediate start a batch process.
This makes them vulnerable to CSRF attacks.
redirects_fixer.fix_node_links:
path: '/admin/config/system/fix_node_links'
defaults:
_controller: '\Drupal\redirects_fixer\Controller\FixLinksController::fixInNodes'
requirements:
_permission: 'administer site configuration'
redirects_fixer.fix_block_links:
path: '/admin/config/system/fix_block_links'
defaults:
_controller: '\Drupal\redirects_fixer\Controller\FixLinksController::fixInBlocks'
requirements:
_permission: 'administer site configuration'
Install the module, and go to admin/config/system/fix_node_links
Change the links to be form submit buttons.
Active
1.0
Code
It is used for security vulnerabilities which do not need a security advisory. For example, security issues in projects which do not have security advisory coverage, or forward-porting a change already disclosed in a security advisory. See Drupal’s security advisory policy for details. Be careful publicly disclosing security vulnerabilities! Use the “Report a security vulnerability” link in the project page’s sidebar. See how to report a security issue for details.