Articles
Security
Drupal security support is getting shorter
From 2027 each Drupal minor version only gets 8 months of security support, down from 12. Read article →Why we moved computerminds.co.uk to Astro and Sanity
This week's PHP2Shell flaws hit every PHP server on the web, but not ours. Here's how we rebuilt our site with Astro and Sanity, and which sites suit the same approach.Read article →Congratulations Andrei on your Cyber Security MSc!
We’re big believers in supporting our team’s growth, because when our people develop, our clients benefit too. Whether that’s through industry certifications, new technologies, or further study, we’re always proud to see our team expanding their skills.Read article →The new Autocreate Access module
When a client has a need or idea that other people might benefit from, it's a great opportunity to contribute a module back to the community. I recently created the new Autocreate Access module to solve a problem on a project where Drupal's autocomplete tagging widget for…Read article →Cyber essentials and MAMP Pro
We recently went through the process of applying for Cyber Essentials. Cyber Essentials is a program created by the UK government to help businesses get on top of their Cyber security. It was an interesting process for us to go through, and certainly helped us to formalise and…Read article →Allow editors to use HTML attributes by default
Drupal provides an excellent sanitisation system to filter the HTML content that editors might create. Think of it like a series of traffic cops that filter different vehicles into different lanes. Some content is allowed through to its destination, some has to be transformed…Read article →Apply Drupal 9 compatibility patches with Composer
Update! Since this article was written, a new 'lenient' composer endpoint has been created on Drupal.org to support using modules with Drupal 9 that haven't been marked as compatible with it yet. See the documentation, which boils down to adding a new common entry under…Read article →Customise scaffold files the right way
There are some key files like robots.txt and .htaccess which are often tweaked for Drupal websites. These can be considered part of the 'scaffolding' of a site - they control the way the site works, rather than its content or design. Any new release of Drupal core that includes…Read article →Notifying our clients about security updates for Drupal Core
Drupal receives security updates several times a year, and we always apply them as soon as possible. Since Drupal security issues can make the headlines, it's important that site owners know that their site is secure and up to date - it provides for peace of mind and for pride…Read article →Let's say NO to unsanitised inputs
Last night saw the popular EU Cookie Compliance module fall from grace, as the Drupal community discovered that numerous inputs in the admin form were not being sanitised.Read article →Security risks as Drupal matures
After reading this from Ars Technica, which describes how a developer offered to 'help' the maintainer of an NPM module - and then slowly introduced malicious code to it - I can't help but wonder if the Drupal community is vulnerable to the exact same issue. Let's discuss!Read article →Beware File::getFileUri()!
I'll keep this short and sweet, but we thought this would be a useful tip to share with the world as a potential security issue with the combined use of File::getFileUri() and FileSystem::realpath().Read article →SA-CORE-2018-004
As with every other Drupal agency on the planet, it was another fun evening of frantic patching of client sites last night due to the release of the highly critical SA-CORE-2018-004 security update for Drupal, released on 25/04/2018.Read article →Fixing Drupal, really quickly
Drupalgeddon2 happened! We got all but two of our projects updated within an hour, with those remaining trickier two fully patched another hour later. The key was planning the right process using the right tools. We actually use these tools for regular deployments every day,…Read article →Patching Drupal without server access
If you don't have access to the file system on the server for a Drupal site, when a security issue like Drupalgeddon2 comes along, you are entitled to panic! Many sites are run by a combination of teams, so sometimes you really don't have control over the server... but that…Read article →Good practice pays off for Drupal site security
Much has been said about last month's highly critical Drupal security issue 'SA-CORE-2014-005', otherwise known as 'Drupalgeddon'. It was covered by mainstream international media, even if the reaction needs addressing. Drupal's security team take a responsible approach to…Read article →Let's talk
Got a project in mind?
You'll talk to a developer, not a salesperson.