2

I am using the ShareThis module on my website. Unfortunately, recent release 2.3 is flagged as a security update, but it is has a major bug (settings can't be saved). I have reverted to release 2.2.

The consequence is that 'security updates available' warnings are displayed all the time in administration screens. Is it possible to get rid of them? I tried to find an option, but could not find any.

5

I had a similar problem recently (see How do I avoid checking for updates for a specific module?) and managed to get around it using hook_update_projects_alter(). You can use it to easily remove any module that you don't want to be part of the update process:

function MYMODULE_update_projects_alter(&$projects) {
  $blacklist = array(
    'sharethis',
    // Any others you might want
  );

  foreach ($blacklist as $module) {
    unset($projects[$module]);
  }
}

As Drupal no longer considers any module you put in the $blacklist array as one that needs to be updated, you should stop getting the security warning.

It would probably be a good idea to keep an eye on the progress of the bug in the ShareThis module so that you can remove this restriction when possible.

  • 1
    I believe your linked question had a pretty awesome answer too ;-) +1 for the hook! – Chapabu Apr 8 '12 at 9:50
  • As I say in my answer, this hides the problem. The update system is valuable - if there's a bug in the module we should spend time writing code to fix the bug rather than hiding an important update. – greggles Apr 13 '12 at 15:56
  • 1
    @greggles Yes that's true, I should have mentioned that; fixing/patching the vulnerability is obviously the most desirable solution. – Clive Apr 13 '12 at 16:30
4

I'd say the right way to get rid of it is to fix the bug (e.g. by reviewing the patch in that issue) and deploying that patch on your server.

The vulnerability in the module is pretty serious. It would allow an attacker to take over your site. You don't want to be running an outdated version of the module if at all possible.

  • I wonder if it'd be suitable instead to add an if ($user->uid != 1){}, to the hook_update_projects_alter...or to only show the warnings to certain user roles? I understand you know a bit about Drupal security Greggles ;-) – Chapabu Apr 10 '12 at 22:51
  • I'm not going to be happy with any solution that involves staying on the older version of the module. CSRF that lets you inject XSS is a great way to have your site taken over. The patch to fix the module was just committed and a new release is on its way "soon". People can get the code from git or the dev release when it's rebuilt later today and be safe AND functional. – greggles Apr 13 '12 at 14:29
  • 1
    A new version with the fix is released. Please upgrade ASAP drupal.org/project/sharethis – greggles Apr 19 '12 at 13:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.