Project: Drupal coreDate: 2023-March-15Security risk: Moderately critical 14∕25 AC:None/A:None/CI:Some/II:None/E:Theoretical/TD:DefaultVulnerability: Information DisclosureAffected versions: >=8.0.0 <9.4.12 || >=9.5.0 <9.5.5 || >=10.0.0 <10.0.5Description: 

The Media module does not properly check entity access in some circumstances. This may result in users seeing thumbnails of media items they do not have access to, including for private files.

This release was coordinated with SA-CONTRIB-2023-010.

This advisory is not covered by Drupal Steward.

Solution: 

Install the latest version:

• If you are using Drupal 10.0, update to Drupal 10.0.5.
• If you are using Drupal 9.5, update to Drupal 9.5.5.
• If you are using Drupal 9.4, update to Drupal 9.4.12.

All versions of Drupal 9 prior to 9.4.x are end-of-life and do not receive security coverage. Note that Drupal 8 has reached its end of life.

Drupal 7 core does not include the Media Library module and therefore is not affected.

Reported By: 

• James Williams
• Dan Flanagan

Fixed By: 

• Lee Rowlands of the Drupal Security Team
• James Williams
• Jess of the Drupal Security Team
• Dave Long of the Drupal Security Team
• Dan Flanagan
• Jen Lampton Provisional Member of the Drupal Security Team
• Joseph Zhao Provisional Member of the Drupal Security Team
• Benji Fisher of the Drupal Security Team

Introduction

Join us on Thursday, March 16 at 1pm ET / 10am PT, for our regularly scheduled call to chat about all things Drupal and nonprofits. (Convert to your local time zone.)

No pre-defined topics on the agenda this month, so join us for an informal chat about anything at the intersection of Drupal and nonprofits.  Got something specific on your mind? Feel free to share ahead of time in our collaborative Google doc: https://nten.org/drupal/notes!

All nonprofit Drupal devs and users, regardless of experience level, are always welcome on this call.

This free call is sponsored by NTEN.org and open to everyone. 

• Join the call: https://us02web.zoom.us/j/81817469653

  • Meeting ID: 818 1746 9653
    Passcode: 551681

  • One tap mobile:
    +16699006833,,81817469653# US (San Jose)
    +13462487799,,81817469653# US (Houston)

  • Dial by your location:
    +1 669 900 6833 US (San Jose)
    +1 346 248 7799 US (Houston)
    +1 253 215 8782 US (Tacoma)
    +1 929 205 6099 US (New York)
    +1 301 715 8592 US (Washington DC)
    +1 312 626 6799 US (Chicago)

  • Find your local number: https://us02web.zoom.us/u/kpV1o65N

• Follow along on Google Docs: https://nten.org/drupal/notes

View notes of previous months' calls.

The Drupal Community Working Group started the Aaron Winborn Awards in 2015 with the support of the Drupal Association, in honor of long-time Drupal contributor Aaron Winborn (see his Community Spotlight), who lost his battle with Amyotrophic lateral sclerosis (ALS (also referred to as Lou Gehrig's Disease in the US and Motor Neuron Disease in the UK) in early 2015.

A few years ago, during our preparations for the 2018 Aaron Winborn Award, we had the idea that the award would be created by a community member. Rachel Lawson, a former member of the Drupal Community Working Group's conflict resolution team, created hand-blown glass awards for both the 2018 and 2019 winners, Kevin Thull and Leslie Glynn. 

In 2020 and 2021, Bo Shipley hand-crafted the award from leather for Baddý Breidert and AmyJune Hineline. 

Last year in 2022, the award was crafted for Angie Byron by Caroline Achee and her husband, Louis Achee. Both Caroline and Louis are woodworkers, and often donate their time and skills to community-focused organizations in their local area.

We are looking for community members to volunteer their time and show off their skills for the 2023 Aaron Winborn Award.
We would like to have a design idea or commitment by March 31st (or sooner). 
The deadline for this year’s award to be ready by May 22, 2023.

If you are interested in crafting this year’s award (or any following year), please reach out to the Drupal Community Working Group.
 

The Drupal Community Working Group is pleased to announce that nominations for the 2023 Aaron Winborn Award are now open. 

This annual award recognizes an individual who demonstrates personal integrity, kindness, and above-and-beyond commitment to the Drupal community. It includes a scholarship and travel stipend for the winner to attend DrupalCon North America and recognition in a plenary session at the event.

Nominations are open to all Drupal community members*, including but not limited to people who have made a big impact in their local or regional community. If you know of someone who has made a big difference to any number of people in our community, we want to hear about it. 

This award was created in honor of long-time Drupal contributor Aaron Winborn, whose battle with Amyotrophic lateral sclerosis, or  ALS (also referred to as Lou Gehrig's Disease) came to an end on March 24, 2015. Based on a suggestion by Hans Riemenschneider, the Community Working Group, with the support of the Drupal Association, launched the Aaron Winborn Award.

Nominations are open until Friday, March 25, 2022. A committee consisting of the Community Working Group members (Conflict Resolution Team) as well as past award winners will select a winner from the nominations. 
* Current members of the CWG Conflict Resolution Team and previous winners are not eligible for winning the award.

Previous winners of the award are:

2015: Cathy Theys https://www.drupal.org/u/yesct 
2016: Gábor Hojtsy https://www.drupal.org/u/gábor-hojtsy
2017: Nikki Stevens https://www.drupal.org/u/drnikki 
2018: Kevin Thull https://www.drupal.org/u/kthull 
2019: Leslie Glynn https://www.drupal.org/u/leslieg 
2020: Baddý Breidert https://www.drupal.org/u/baddysonja
2021: AmyJune Hineline https://www.drupal.org/u/volkswagenchick
2022: Angie Byron  https://www.drupal.org/u/webchick 

Now is your chance to show, support and recognize an amazing community member!

If you know someone amazing who should benefit from this award please submit a nomination.

Also, if you are a creator and would like to help craft one of our future Aaron Winborn Awards, please reach out to the Drupal Community Working group.

Chris is the founder of Redfin Solutions and a co-lead of Project Browser Initiative. TDT brings to you yet another interview that highlights the Drupal Journey of the presenters at the 2023 DrupalCamp NJ. Read into our conversation with Chris Wells

The PHPStan 1.10.3 release shipped with a new @not-deprecated annotation! This is a great utility, and I am very thankful to stof for contributing this to PHPStan. This annotation fixes an issue I reported in June 2022 during our massive Drupal 10 readiness initiative.

Drupal core deprecated assertion methods in PHPUnit test classes. A handful of modules decided to replace the method under the same name. PHPStan would find the method, detect the original method was deprecated, and report errors on that method's usage. There was no way to say: "Wait, trust me, this isn't deprecated. I know what I'm doing!" The only approach was to use an inline comment or add the error message to the ignored error setting.

If you scan the Address module, you'll get an error like the following:

Mastering Drupal 9 Layout Builder: A Comprehensive Guide to Effortlessly Customize Your Website's Design Mustakim Farooqui 14 Mar, 2023 Subscribe to our Newsletter Now Subscribe Leave this field blank

When it comes to page building, site builders, content authors, and content editors are constantly on the lookout for a smooth, user-friendly experience. When they wish to design and construct pages, they expect to use drag-and-drop and CKEditor technologies. This identical experience is provided by Drupal Layout Builder's simple page construction functionality in the Drupal core. 

The distinctive Drupal Layout Builder offers a potent visual design tool to let content authors alter how content is presented. Layout Builder, which was added to Drupal core in its most recent version, Drupal 9 enables you to add/remove sections to show the content using various layouts and customize your pages according to what you need. With Drupal 9's Layout Builder Module, you can mix these sections to make a completely unique page.

There are two different ways to use the Drupal 9 Layout Builder: Layout Defaults (to design a layout for all the content of the content type) and Layout Overrides (to design a layout for the specific content item). You may learn more about and get started using the Drupal 9 Layout Builder module with the help of this blog.

Watch out for our next article on this series where we dive into using the layout builder and Ctools module to apply view mode patterns!

Introducing the Layout Builder

You can change how entities like content types, taxonomies, users, and more look by using the Drupal 9 Layout Builder module. Site builders may easily drag and drop blocks, fields, and other elements into place using this feature.

By providing a preview of the changes made as you design your layouts, the layout builder module in Drupal 9 facilitates the layout-building process. The layout builder in Drupal 9 enables previews of the changes made for a smooth layout creation experience rather than requiring users to save every tiny modification they make to the layout and then look it up on the front end.

The layout builder has two modules:

Layout Discovery - Gives modules or themes a means to register layouts.

Layout Builder - Enables users to directly add and organize blocks and content fields on the content.

When designing a layout, Layout Builder uses two key ideas:

Sections - Columns or containers where blocks can be placed. For example, it could be a 2-column layout or a 3-column layout, etc.

Blocks - Content elements that can be placed in sections.

Layout Builder module installation and configuration

Go to Extend and activate the Layout Builder and Layout Discovery modules to install and configure the Drupal 9 layout builder module.

Modify the Content Type and Taxonomy

Once the module has been installed, go to Structure, Content types, and select "Manage display" for any content type. For this example, we'll use the "article" content type.

Click the Layout options drop-down menu at the bottom to select "Use Layout Builder," then click Save.

 

Field formatters are replaced with a "Manage layout" option after Layout Builder is activated in the view mode. Each of the available view modes can be used with Layout Builder.

 

You will be taken to the article content type layout when you click "Manage layout."

Insert Sections into the Layout

Remove the default section before adding any more ones to the layout builder. Select the "close" button (as depicted in the below screenshot). Also, a button to remove the default section will be available to you on the right side of your screen. Then select "Remove."

 

By selecting the "Add Section" option, let's add a few sections to our layout. On the right side of the screen, options will also be offered to you so that you can select a layout for your section. For now, let's pick the "Two Column Section."

 

You will be given the option to select the "Two Column Layout” width. For now, let's choose a "67%/33%". Next, select "Add section."

 

After being added, each section region should display an "Add Block" link.

Insert Blocks into the Section Regions

You can add blocks to your area after selecting it for the layout. Simply click "Add Block" and the "Choose a block" option will slide out from the right when you want to add a block.

Selecting a block

Just clicking on the blocks in the right column will choose them. Using the "Filter by block name" text field, you can even locate blocks by filtering out the search based on their names.
For now, we'll choose the "Body" content field.

 

The field formatter will allow you to make changes when you click on the block you want to add. Click "Add Block" after configuring the formatter.

 

On the left side of the block, there will be a "Body" content area.

 

The "Body" field has been added; now save your changes. By selecting "Save Layout" from the menu at the top of the Drupal 9 layout page, you can save all the changes you've made to your section.

 

To further personalize our layout builder, let's try adding a few more fields to our design.

 

When you visit a page with article content type after saving this layout, you will be able to see a preview of the layout you just created.

Layout Overrides:

The layout we just created will work for all of the articles. Drupal has a number of settings that must be enabled in order to create a custom layout for a certain article. To do this, select "Allow each content item to have its layout customized".

 

If you visit an article after activating this option, a Layout tab button will be visible.

 

With the same interface, the layout may now be changed. This, however, will only alter the design of this one piece of content.

Now let's add a block to this page. Create a new one-column section and click the "Add Block" button. Consider the case when we wish to show recently edited content from other users on this page, Filter off the "Recent content" block when adding a new block, then customize it to your needs before saving the layout.

 

Eventually, when we've included the most recent article block, our page will appear like this.

 

Important: If you've changed the layout of a single entity, you won't be able to disable the Layout Builder.

You can only update the layout options once you've reset all altered layouts to their original settings.

Layout Builder from Code

When it comes to GUI management, Drupal Layout Builder is undoubtedly amazing. The programming problems you deal with while using the tool on a regular basis, nevertheless, might be a little more difficult. Now, you might ask how to use Layout Builder using code. 

It turns out that it's rather simple to enable and disable templates for a single entity.

Simply load the display using the following code:

$entityViewDisplay = \Drupal::entityTypeManager- >getStorage('entity_view_display')- >load('ENTITY_TYPE.ENTITY_BUNDLE.VIEW_MODE');

It will then return an object of the type LayoutBuilderEntityViewDisplay, which you must then change as follows:

$entityViewDisplay->enableLayoutBuilder();

If you wish to additionally set the flag or activate the Layout Builder for a specific view mode:

$entityViewDisplay->setOverridable(TRUE);

to enable the creation of unique layouts for a single entity.

After that, you must save everything.

$entityViewDisplay->save();

What actually occurs in the background is that the Layout Builder module adds the layout_builder_key to the third_party_settings of a certain entity type, with values for the parameters described above (enabled, allow custom), and then stores the default layout for this type of entity under sections.

A new entity field named layout_builder__layout is created and used to hold the updated layout for this specific entity if the setOverridable option is set to TRUE.

Contrarily, it takes a little more work to create a section using code and populate it with relevant content.

Starting off, let's add a new section. The layout_id parameter, which serves as a layout identifier, must be included when creating a new instance of the \Drupal\layout_builder\Section class in order to accomplish this.

Protip: The layout discovery module contains the default templates. Layouts are defined in *.layouts.yml files. For more detailed information, please check out the following article on how to create custom layouts in drupal.

Then, adding a new element directly to the section would be the simplest course of action. To do this, use the appendComponent method, which accepts an instance of the \Drupal\layout_builder\SectionComponent class as an argument. Nevertheless, before you can develop such a section component, you must first arrange a few things. To start, you will require:

• the uuid of the embedded element,
• the name of the region in the section,
• plugin configuration.

In this tutorial, we'll embed a sample node in a single-column section using the plugin supplied by Entity Blocks:

$section = new Section('layout_onecol'); $uuid = $node->uuid(); $region = 'content'; $pluginConfiguration = [   'id' => 'entity_block:node',   'provider' => 'entity_block',   'label_display' => FALSE,   'view_mode' => 'default',   'entity' => $node->id(), ]; $component = new SectionComponent($uuid, $region, $pluginConfiguration); $section->appendComponent($component);

Always keep in mind that layouts are saved in third-party settings or a field; therefore, in order to save the section, you must do so in one of these locations.

In our case, a field is being used, so:

$entity->layout_builder__layout->setValue($section); $entity->save();

You have now added a single column section to an entity and shown an example node in it by following all of these steps.

You may also be interested in Improving Drupal's Layout Builder Experience.

Layout Builder Pros and Cons

We've compiled a brief list of some advantages and disadvantages of Layout Builder below:

Pros:

• Deployment is simple because there is no need to add new entity types because the module is already included in the core.
• User-friendly UI with drag-and-drop capabilities.
• Choices for individual entity customization.
• A simple method for combining fields with other entities without the need to add more reference fields.
• A simple method of leveraging entity blocks to embed existing entities.

Cons:

• New entity types and embeddable elements add to the website's size, which significantly lengthens the time it takes for all items to load.
• The module is UI-focused, so creating new layouts might be simpler. Right now, we have to write code to generate.yml files and templates.
• Dragging elements between sections can be a little challenging when there are many parts in the layout.
• Twig's names are suffixed with uuid, making it challenging to render a specified section and restricting access to sections.

Final Thoughts

The Drupal Layout Builder opens us to a wide range of intriguing possibilities for managing layouts through both user interface and code. Will it replace all current solutions?
It is the ideal tool, in my opinion, for dealing with the layout issue on a large scale. It seems like the best course of action would be to use widely used modules like Paragraphs and Field Group to create closed components, and then Layout Builder to create pre-made layouts composed of these components.

Layout Builder has a unique purpose, much like every other Drupal module. As a result, it will always perform better in some situations while performing substantially worse in others. Check it out for yourself!

If you’re looking for experts to help you out with anything Drupal, we’re just an email away!

Author: Mustakim Farooqui

Meet Mustakim Farooqui, Drupal Developer, and our own Chess master. He dreams of visiting Europe and enjoys reading novels and tech articles. When not working, you can find him with a game of chess, solving puzzles, or checking out new Linux distros. Give him a strong cup of coffee and he’ll set sail for anything!

Email Address Subscribe Leave this field blank Drupal 9 Drupal Module Drupal 9 Module Web Development Drupal Development Drupal Planet

Leave us a Comment

 

Recent Blogs

Image

Mastering Drupal 9 Layout Builder: A Comprehensive Guide to Effortlessly Customize Your Website's Design

Image

How to Efficiently Fetch Drupal Reference Entities in Custom Modules

Image

Finding Balance - Santhosh Kumar's Parallel Worlds

Want to extract the maximum out of Drupal? TALK TO US

Featured Case Studies

Upgrading the web presence of IEEE Information Theory Society, the most trusted voice for advanced technology

Explore

A Drupal powered multi-site, multi-lingual platform to enable a unified user experience at SEMI

Explore

Great Southern Homes, one of the fastest growing home builders in the US, sees greater results with Drupal

Explore View all Case Studies

Today we are talking about Employee Owned Companies with Seth Brown.

For show notes visit: www.talkingDrupal.com/390

Topics

• What is employee ownership
• Why did Lullabot choose this path
• What is the process
• Other examples
• Has it improved the culture
• Are employees more engaged
• Retirement
• Why don’t more companies do this
• Favorite part of working at an employee owned company
• Least favorite part of working at an employee owned company
• Favorite part as CEO
• Does it reduce pressure
• Tugboat / Drupalize.me
• How to get started

Resources

• Lullabot.com
  • https://www.lullabot.com/articles/employee-owners-us
  • https://www.lullabot.com/news/lullabot-officially-becomes-employee-owned-company
• Planted game
• Employ owned companies
  • https://en.wikipedia.org/wiki/List_of_employee-owned_companies
  • https://nceo.org
• Stake in the outcome by Jack Stack

Guests

Seth Brown - https://www.lullabot.com/about/seth-brown

Hosts

Nic Laflin - www.nLighteneddevelopment.com @nicxvan John Picozzi - www.epam.com @johnpicozzi Jacob Rockowitz - www.jrockowitz.com @jrockowitz

MOTW Correspondent

Martin Anderson-Clutz - @mandclu Entity Registration Allows users on your Drupal site to register for events as an example, but really anything that’s an entity.

Today, a Telugu-language movie got the Academy Award for best original song at the Oscars. While accepting the award, music composer M. M. Keeravani mentioned that he grew up listening to the Carpenters. Although he meant Karen and Richard Carpenter, the American music sensation of the '70s, three major media houses in Malayalam, another south Indian language, translated it as woodworkers.

It should be a classic example of shoddy journalism. But such mistakes are not so uncommon in vernacular media. The phrase 'prima facie,' was once misconstrued as a lady's name. One hundred eighty-six people sleeping in the railway station had washed off in a flash flood in an old story when in reality, it was sleepers on which the rails were paved. The word magazines got mistranslated as the literal monthly magazine in a story about the seizure of arms from the Sri Lankan Tamil militia. However, the editor saved the grace by finding it out before printing. While reporting a death after a 'hot dog' eating competition, a newspaper thought the man had eaten raging canines. If this is how journalists write, a techy said he would be in danger if he told Python is his bread and butter.

Now excuse me. It is the new normal. Our media houses have lost editorial prowess. Speed before accuracy is the new-age motto. In such a speed-crazy world, having your editorial arm halved would be a significant loss.

We at TDT have witnessed such a loss. As mentioned in the last newsletter, NERD Summit, and DrupalCamp NJ will happen this week. As media partners for the two camps, we had many plans to execute. And a significant part of the plans revolved around a young journalist we had just hired, S. Jayesh. 

S. Jayesh is a name heard in both Malayalam and Tamil literary circles. He is a poet and short story writer who translated a few novels from Tamil to Malayalam. I knew him from his previous stints, where he was a workaholic and punctual, more productive than most, but would never do overtime as was the common practice in this part of the world. A polyglot having years of experience in online media, we hired him by the end of December.

On February 13, he fell on his back, involuntarily wounding his head. He was rushed to the hospital, had to undergo two neuro surgeries as his blood clot in his head, and was in a coma stage for more than two weeks. Fortunately, he has regained consciousness but must remain in the hospital. As he lacks medical insurance, his mother has taken to alms to fund his hospitalization expenses. She is seeking around $18,300 in USD or ₹1,500,000 in INR. Until now, she could collect only 32% of the same. Even if he gets discharged, it will probably take months for him to rejoin work. So we urge the Drupal community to pour your hearts in small amounts to help him in need.

The crowdfunding request is placed on Milaap.org, a fundraising platform for medical emergencies and social causes. The platform charges no intermediary fees, and every penny donated to Jayesh will go into his mother's account for the treatment of her son.

Coming back to the past week's stories. On March 08, Wednesday, we published an Interview with Rick Hood as a primer to the NERD Summit 2023. In this exciting interview, he not only discusses Drupal but also goes into his music production interests and his past boat business.

Evolving Web has announced a training on Drupal Site Building in April. On March 15, Acquia will host a webinar on Securing The Modern Digital Landscape, and on March 16, another webinar on CDP. Tomorrow, Design4Drupal Boston will host AmyJune Hineline for an accessibility webinar.

All but three sessions of DrupalCamp Florida are online on their YouTube channel. MidCamp 2023 has announced its sessions and speakers. DrupalCamp Finland started accepting papers. NERD Summit was still accepting training session submissions as a backup. They have also pushed out a call for volunteers. DrupalCamp Poland has put early bird tickets on sale. DrupalCon Pittsburgh is seeking sponsors to support Women In Tech. The last day to apply for a volunteering opportunity in DrupalCon Lille is tomorrow.

Project Browser Initiative collects feedback via google forms about what information is most valuable to you when "browsing" for modules on drupal.org. In celebration of Women's history month, Drupal Association highlighted the work of Nichole Addeo, the Managing Director and Co-founder of Mythic Digital. ICFOSS and Zyxware Technologies joined hands to impart Drupal training for women as part of the' Back to Work for Women' campaign. 

On blogs and training materials, visit Kevin Funk's article in Acquia Developer Portal about utilizing developer workspaces with Acquia Code Studio. Alejandro Moreno Lopez, the Developer Advocate at Pantheon Platform, shared an educational video about the benefits of using Drupal for a Decoupled project.

That is for the week. Thank you,

Sincerely,
Sebin A. Jacob
Editor-in-Chief