govCMS / GovCMS7

Current stable release of the main Drupal 7 GovCMS distribution, with releases mirrored at https://www.drupal.org/project/govcms
https://www.govcms.gov.au/
GNU General Public License v2.0
112 stars 76 forks source link

[SA-CONTRIB-2018-077] Update password_policy to 7.x-1.16 (from 7.x-1.14) #758

Closed tobybellwood closed 5 years ago

tobybellwood commented 5 years ago

https://www.drupal.org/sa-contrib-2018-077

This vulnerability is mitigated by the fact that GovCMS does not enforce the "digit placement" constraint.

https://www.drupal.org/project/password_policy/releases/7.x-1.16

Release notes Fixes password length DoS: https://www.drupal.org/sa-contrib-2018-077

Other changes since 7.x-1.15:

2896150 by AohRveTPV: Fatal error: Cannot redeclare password_policy_features_export_options()

2942407 by AohRveTPV: Add validation for expiration warning

2984616 by NancyDru, AohRveTPV: Increase number of lines per page on Expired Users list

2982383 by scottatdrake, AohRveTPV, djdevin: Query for authmaps by uid instead of authname

2957343 by AohRveTPV: Admin changing passwords removes roles when Change Password Tab is used

2954862 by ritzz, lagartixa: Schema warning: password_policy_excluded_authentication_modules.module is type varchar but its default 0 is PHP type integer

2954325 by AohRveTPV: Missing hook_help() implementations

2954317 by AohRveTPV: Missing required README.txt sections

Improve key name in hook_features_api() implementation. Remove @author tags per Drupal best practices.

https://www.drupal.org/project/password_policy/releases/7.x-1.15

Release notes Changes since 7.x-1.14:

2252541 by Sebastien @Actualys: Improve memory usage of expiration cron

2895670 by lliss: Errors re invalid number on PHP7+

2562481 by AohRveTPV, Oleksiy: Apply password policies to account password elements on custom forms

2872688 by AohRveTPV: Password Policy should optionally ignore authmap users

2833455 by AohRveTPV: Admin user creation, policies not enforced for specific role

2444387 by AohRveTPV, nicrodgers: password expiration mail not translatable

2876719 by AohRveTPV: PHP and JavaScript constraint validation differs

pandaskii commented 5 years ago

Ready for release, thanks