Drupal Planet

"Anemone": The brief tale of a Drupal core security advisory

xjm — Sat, 28 Jun 2025 20:03:10 +0000

"Anemone": The brief tale of a Drupal core security advisory xjm Sat, 06/28/2025 - 15:03

A long while back, security researcher Sam Mortenson reported a cross-site scripting vulnerability in Drupal core's Link module. Essentially, the options property on link fields was not being properly sanitized. This meant cross-site scripting was possible under some circumstances -- and, as always for cross-site scripting, we were concerned that the XSS could be combined with other attacks and escalated to more serious exploits.

New core committer sponsors: HeroDevs, Salsa Digital, and... maybe you?

xjm — Fri, 13 Oct 2023 21:43:15 +0000

New core committer sponsors: HeroDevs, Salsa Digital, and... maybe you? xjm Fri, 10/13/2023 - 16:43

Great news: After a three-month search, I'm now contracting with two sponsors who are funding a total of 60% of my time for Drupal core release management. Let me introduce you!

Why sponsor a core committer?

xjm — Thu, 22 Dec 2022 01:40:05 +0000

Why sponsor a core committer? xjm Wed, 12/21/2022 - 19:40

This post was collaboratively authored with other Drupal core committers including quietone, pameeela, catch, effulgentsia, larowlan, lauriii, and Dries.

Fund xjm as a Drupal core release manager

xjm — Mon, 05 Dec 2022 18:44:09 +0000

Fund xjm as a Drupal core release manager xjm Mon, 12/05/2022 - 12:44

Hi, I'm xjm. I'm a Drupal core committer, one of eighteen people who are trusted to accept (merge) code changes to the Drupal project for the hundreds of thousands of sites that rely on it.

My role on the committer team is that of a release manager. We're the folks who actually create the Drupal core releases that you can install on your site.

Security, Drupal 9, and Navigating the Changing Web Landscape (DrupalSouth 2019 keynote)

xjm — Mon, 23 Dec 2019 01:28:42 +0000

Security, Drupal 9, and Navigating the Changing Web Landscape (DrupalSouth 2019 keynote) xjm Sun, 12/22/2019 - 19:28

Back in 2013, I led the core contribution mentoring day at DrupalCon Sydney. I'd already flown from the US to Europe three times at that point (first for Drupal Developer Days Barcelona, then for DrupalCon Munich and the Paris VDC sprint, and finally for a whirlwind 72 hours in London to sprint on VDC and CMI). None of that prior international travel prepared me in the slightest for the over 24 hours of nonstop air travel/physical torture that it takes to get from Wisconsin to Australia.

Help triage major bugs at the Florida DrupalCamp or your local camp (yes, you!)

xjm — Wed, 15 Feb 2017 04:35:22 +0000

Help triage major bugs at the Florida DrupalCamp or your local camp (yes, you!) xjm Tue, 02/14/2017 - 22:35

Florida Drupalcamp 2017 is less than a week away, February 17-19, in vibrant Orlando. Not only is the camp schedule packed with great sessions and trainings, but there's also a contribution sprint that both helps Drupal 8 core maintainers, and gives you a chance to contribute and learn about Drupal 8.

To join the sprint, you should already be familiar with Drupal... and that's it! You don't need to be an expert. You don't need to be a coder. You don't even need to know much about Drupal 8, although a little knowledge helps. This particular sprint is a great fit for:

Join the Drupal 8 major triage at DrupalCon New Orleans

xjm — Wed, 27 Apr 2016 03:57:08 +0000

Join the Drupal 8 major triage at DrupalCon New Orleans xjm Tue, 04/26/2016 - 22:57

On April 20, five months after the launch of Drupal 8.0.0, we released Drupal 8.1.0, the first scheduled minor update. Drupal 8.1.0 comes with both new features and bug fixes that were not eligible for monthly patch releases. Now is a great time to try Drupal 8 if you haven't yet!

Drupal 8.1.0 is production-ready, but (like most software) still has known bugs that can cause issues for some modules or sites. Although we fixed hundreds of critical bugs during Drupal 8's development, and although only a handful of critical issues have been discovered since Drupal 8.0.0, there are still hundreds of less severe bug reports marked with "major" priority.

Emacs keybindings, PhpStorm, Mac OS, and the random characters I almost add to Drupal

xjm — Mon, 01 Feb 2016 20:41:39 +0000

Emacs keybindings, PhpStorm, Mac OS, and the random characters I almost add to Drupal xjm Mon, 02/01/2016 - 14:41

Drupal 8 developers, as a whole, are a bit gushy about PhpStorm. I use it; it's useful. But a decade and a half of my programmer muscle memory is Emacs keybindings, so when I use a different tool than Emacs, I feel like I'm trying to cut vegetables with a mallet, or write with a wad of chewed gum. And yes, PhpStorm ships with an Emacs keymap, but it's just not the same. It's not only a matter of the PhpStorm Emacs keymap being less cared for than its Vim cousin. It's that PhpStorm does not support M-x butterfly.

Getting Drupal 8 done: DrupalCon Los Angeles sprints

xjm — Fri, 08 May 2015 04:51:19 +0000

Getting Drupal 8 done: DrupalCon Los Angeles sprints xjm Thu, 05/07/2015 - 23:51

The DrupalCon Los Angeles extended sprints start this Saturday, May 9, and the main sprint day on Friday, May 15 is just a little over a week away. I'll be leading a Drupal 8 Critical Burndown sprint to help get D8 done, and kgoel and cilefen will be leading a sprint to triage Drupal 8 majors. And we need your help! Sign up for the sprints now, or read on for more information on what we'll be doing and why.

Contribution, Influence, and Drupal 8

xjm — Tue, 10 Mar 2015 03:11:53 +0000

Contribution, Influence, and Drupal 8 xjm Mon, 03/09/2015 - 22:11

The most recent issue of Drupal Watchdog includes an article on software freedom and social change in Drupal. While this article raises a number of thoughtful questions about the social implications of the Drupal community's evolution, it includes some misinformation (both because it misrepresents the data that are easily available and because it lacks data that are not easily available). In the first part of this post, I look at the specific information presented in the article and provide some more depth, including some first-hand information about Acquia, since I work in Acquia's Office of the CTO. In the second part, I explore how we can mitigate some of the concerns the article raises.