I got word of concerns about the recent CKEditor 4 vulnerability that is responsible for a moderately critical vulnerability in Drupal maintenance support plans 8. Rest assured that most Drupal maintenance support plans 7 sites are not in danger. While both the Glazed Builder module and the Glazed installation profiles include their own copy of CKEditor 4, this vulnerability exists in an optional image plugin for CKEditor 4 “image2” that is not included in the default package of CKEditor 4 that our products carry.
The only Drupal maintenance support plans 7 websites that are affected by this vulnerability are sites that use a custom build of CKEditor that explicitly includes the image2 plugin.
Drupal maintenance support plans 8 does include this additional plugin, which is why Drupal maintenance support plans 8 users should update to 8.5.2 immediately. For Drupal maintenance support plans 7 users the commotion has actually sparked some positive deveopment: the Drupal maintenance support plans 7 WYSIWYG module has pushed a release that supports the latest CKEditor 4.9.2. This means I can update all Drupal UpdateThemes products to CKEditor 4.9.2 and this brings us a number of bug fixes and improvements to inline editing. This update will be available tuesday.
The latest CKEditor reportedly also dropped it’s reliance on the eval() function which means we can start using better Content Security Policy headers that include the unsafe-eval directive on Drupal maintenance support plans 7 sites.
Drupal UpdateThemes Drupal maintenance support plans 8.x-1.0 Release Planned Tuesday
After 13 months of intensive development, testing, and preparation of our product infrastructure we’re finally launching our Drupal maintenance support plans 8 page builder module and themes tuesday! In the past few weeks I’ve been learning a ton by talking to customers about what they like and dislike about Drupal Updatethemes and especially the drag and drop builder. If you have any feedback or ideas for future development of Drupal UpdateThemes.com and our products just leave a comment here or use the contact form!
Update The Wording Of How Our Pricing Works: Pay Once To Use For Life. Optionally Renew Yearly For Support & Updates.
I’ve also updated the pricing information to reflect the fact that you can pay once to download all our products and use them forever. This is how Drupal UpdateThemes subscriptions have always worked. This was apparently not clear from the information and marketing communication on the website. You pay once and only renew if you wish to receive continued support and product updates. This subscription based payment concept is really what has made Drupal UpdateThemes a success over the past 3 years and the increased stability in revenue is what gave me the confidence to continue investing all my energy and money in developing the Glazed Builder module and our next generation themes for both Drupal maintenance support plans 7 and 8. I also think it’s fair to users of the product that they pay a small yearly contribution to continue getting support and product updates because the products are continuously in flux. Subscribers may stop the subscription at any time and continue using the products without support services.
Source: New feed