If you are using jQuery's AJAX API for user-provided URLs in a contrib or custom module, you should review your code and set "jsonp: false" where this is appropriate.ĭrupal 7 sites should also pass such URLs through the new Drupal.sanitizeAjaxUrl() function. Important update informationĪny site that relies on Drupal's AJAX API to perform trusted JSONP requests will need to either override the AJAX options to set "jsonp: true" or use the jQuery AJAX API directly. Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2020-007.Sites are urged to upgrade immediately after reading the notes below and the security announcement: This release fixes security vulnerabilities.
Maintenance and security release of the Drupal 7 series.
0 kommentar(er)
