Do you manage a Drupal site? You are likely to have heard about today's highly critical security update: https://www.drupal.org/sa-core-2018-004
There's no time to spare - what now?
Note: in the below examples, the patches are tested when 'x' in the version number is the highest available number. It is likely to work at slightly lower versions as well, but that is not guaranteed. That's why updating to the latest version is important, and why we will back up our sites as part of these steps before updating.
Here's the quick & dirty way to patch your site:
- If your site is running Drupal 8.x
- SSH into your website
- Git add and commit all files
- Create a database backup with drush:
- drush sql-dump > ../../2018-04-25-pre-sa-core-2018-004.sql
- Download this patch file: https://cgit.drupalcode.org/drupal/rawdiff/?h=8.5.x&id=bb6d396609600d1169da29456ba3db59abae4b7e
- Name it sa-core-2018-004-8.patch
- Place it in your website's root (often named docroot or web in Drupal 8 websites)
- Run this command:
- patch -p1 < sa-core-2018-004-8.patch
- If your site is running Drupal 7.x
- SSH into your website
- Git add and commit all files
- Create a database backup with drush:
- drush sql-dump > ../../2018-04-25-pre-sa-core-2018-004.sql
- Download this patch file: https://cgit.drupalcode.org/drupal/rawdiff/?h=7.x&id=080daa38f265ea28444c540832509a48861587d0
- Name it sa-core-2018-004-7.patch
- Place it in your website's root folder
- Run this command:
- patch -p1 < sa-core-2018-004-7.patch
- If your site is 6.x
- Coming soon..
This comes with no warranty, implied or otherwise.
Those steps will allow you to patch your site, not fully update it. Once the patches are in, you can rest assured that your site should now be secure. Take 24 hours off, then schedule fully updating your website to the latest version very soon. Future patches are not guaranteed to be applicable to earlier versions.