Last updated: February 20, 2013 - 20:54
Last updated: February 20, 2013 - 20:54
Release notes
Maintenance and security release of the Drupal 7 series.
This release fixes security vulnerabilities. Sites are urged to upgrade immediately after reading the security announcement:
No other fixes are included.
No changes have been made to the .htaccess, robots.txt or settings.php files in this release, so upgrading custom versions of those files is not necessary.
Important update notes (and known issues):
The security fixes in this release change all image derivative URLs generated by Drupal to append a token as a query string. ("Image derivatives" are copies of images which the Drupal Image module automatically creates based on configured image styles; for example, thumbnail, medium, large, etc.)
As an example, links that previously pointed to a URL like http://example.com/sites/default/files/styles/thumbnail/public/field/image/example.png will now point to a URL like http://example.com/sites/default/files/styles/thumbnail/public/field/image/example.png?itok=zD_VaCaD.
In addition, any code which programmatically generates a link to an image derivative without using the standard image_style_url() API function will no longer work correctly if the image does not already exist in the file system, since the necessary token will not be present in the URL.
Due to the nature of this security fix, some sites will require extra testing and care when deploying this release of Drupal core, and several contributed modules require code changes in order to continue working correctly. A summary of issues follows.
Issues involving Drupal core
- #1923814: Existing hardcoded images can break after updating to Drupal 7.20 if image styles have been re-saved
If your site has existing, hardcoded references to image derivatives embedded in text content (for example, as may have been inserted via the Insert module) in most cases these references will continue to work after upgrading to Drupal 7.20. However, if you re-save the associated image style (for example, by going to "Administration » Configuration » Media » Image styles" on your site and re-saving the items listed there), the images will be flushed on disk and your embedded links may stop working after that because they are missing the token. This may also occur if you re-saved the image style recently (before upgrading to Drupal 7.20) and some of the images have not yet been regenerated.
Solution: There is no robust solution for this problem yet. The best solution is to avoid re-saving image styles for the time being.
- #1923554: New anti-DoS measure breaks for some file URIs
If any images are erroneously stored in the database with an extra slash in the URI (for example, public:///path/to/image rather than public://path/to/image), new derivatives for those images will fail to be generated after upgrading to Drupal 7.20. So far, the only confirmed examples of this involve images created with the Devel generate module, which are unlikely to be an issue on production websites.
Solution: There is a patch for Drupal core in the above issue which should fix the problem.
Issues involving Drupal custom or contributed modules
Several contributed modules do not work correctly with Drupal 7.20, although there are candidate patches or fixes available for most of them:
- #1923336: Insert module doesn't work with Drupal 7.20
Sites using versions 7.x-1.2 or earlier of the Insert module will experience problems inserting new images into textareas after upgrading to Drupal 7.20 if the inserted image is set to display using an image derivative. The image will be inserted but will fail to display.
Solution: Upgrade to Insert 7.x-1.3.
- #1925298: File (Field) Paths does not work with Drupal 7.20 when images are inserted with the Insert module
When using the File (Field) Paths module along with the Insert module, the fix to the Insert module itself is not sufficient, and new images will still not be correctly inserted into textareas.
Solution: There is a patch in the above issue which needs testing but should fix the problem and allow new images to be inserted going forward.
- #1923936: Responsive images and styles module doesn't work with Drupal 7.20
The Responsive images and styles module does not work correctly after upgrading to Drupal 7.20.
Solution: There is a patch in the above issue which needs testing but should fix the problem.
- #1930698: Drupal 7.20 update broke IMCE's feature for generating previews via image styles
A feature of the IMCE module which allows preview images to be generated on-the-fly based on image styles does not work correctly after upgrading to Drupal 7.20.
Solution: No solution is available yet.
Issues involving HTTP caches and CDNs
In rare cases, the addition of the token to image style URLs may alter the way HTTP caches or CDNs handle the images. Sites using HTTP caches or CDNs should examine their configuration and test this release carefully before deploying it to a production site.
The Drupal CDN module is also incompatible with Drupal 7.20. See #1926884: CDN module is not compatible with security fix in Drupal core update 7.20 for further details. (No fix is available yet.)
Overall mitigation steps
Sites which require the ability to generate new image derivatives without a token can set the 'image_allow_insecure_derivatives' variable to TRUE, for example in settings.php:
$conf['image_allow_insecure_derivatives'] = TRUE;
This will cause Drupal to bypass the token check when generating image derivatives.
However, it will also completely remove the security fix introduced in this release and will therefore increase the site's vulnerability to denial-of-service attacks.
It is intended primarily as temporary measure (or for sites that are hosted in an environment where denial-of-service attacks are unlikely, such as a private intranet that is inaccessible from the outside).