October 2026 - Security-news - lists.drupal.org

Fasttoggle - Moderately critical - Access bypass - SA-CONTRIB-2026-282
by security-news＠drupal.org 28 Oct '26

28 Oct '26

View online: https://www.drupal.org/sa-contrib-2026-282 Project: Fasttoggle [1] Project machine name: fasttoggle Date: 2026-October-28 Security risk: *Moderately critical* 13 ∕ 25 AC:None/A:User/CI:None/II:Some/E:Theoretical/TD:All [2] Vulnerability: Access bypass Affected versions: <4.1.1 CVE IDs: CVE-2026-118569 Description: This module enables you to quickly toggle the publication status, promotion and stickiness of nodes, and the publication status of comments, from links on the page. The module doesn't sufficiently check access to the entity being toggled, under the scenario where a user with the "Use Fasttoggle" permission submits a request to the toggle URL for any node or comment regardless of their permission to update that entity. For example, such a user could publish an unpublished draft they are not allowed to view. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "Use Fasttoggle". Solution: Install the latest version: * If you use the Fasttoggle module, upgrade to Fasttoggle 4.1.1 [3] Reported By: * Nam Nguyen Le Thanh (yuwkaa) [4] Fixed By: * Andrei Ivnitskii (ivnish) [5] Coordinated By: * Swan Kalata (akalata) [6] of the Drupal Security Team * Bram Driesen (bramdriesen) [7] of the Drupal Security Team * Greg Knaddison (greggles) [8] of the Drupal Security Team * Juraj Nemec (poker10) [9] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [10] [1] https://www.drupal.org/project/fasttoggle [2] https://www.drupal.org/drupal-security-team/security-risk-levels-defined [3] https://www.drupal.org/project/fasttoggle/releases/4.1.1 [4] https://www.drupal.org/u/yuwkaa [5] https://www.drupal.org/u/ivnish [6] https://www.drupal.org/u/akalata [7] https://www.drupal.org/u/bramdriesen [8] https://www.drupal.org/u/greggles [9] https://www.drupal.org/u/poker10 [10] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

CAPTCHA - Moderately critical - Session Replay (CAPTCHA bypass) - SA-CONTRIB-2026-281
by security-news＠drupal.org 28 Oct '26

28 Oct '26

View online: https://www.drupal.org/sa-contrib-2026-281 Project: CAPTCHA [1] Project machine name: captcha Date: 2026-October-28 Security risk: *Moderately critical* 13 ∕ 25 AC:Basic/A:None/CI:None/II:None/E:Exploit/TD:All [2] Vulnerability: Session Replay (CAPTCHA bypass) Affected versions: <1.18.0 || >=2.0.0 <2.0.11 CVE IDs: CVE-2026-118582 Description: The CAPTCHA module places a configurable challenge on forms to block automated submissions. To skip the challenge on later steps of the same multi-step form, the module remembers that a CAPTCHA session has been solved. The module does not fully invalidate a solved CAPTCHA session. As a result, a protected form that was already submitted once can be submitted again without solving a new CAPTCHA. This weakens the protection the module provides against automated submissions such as spam registrations, comment spam, and login brute-forcing. This is a follow-up to the earlier CAPTCHA replay fix (SA-CONTRIB-2026-015 [3] / CVE-2026-3214), which closed one replay path but left this one open. Solution: Install the latest version: * If you use the Captcha module 2.0.x, upgrade to Captcha 2.0.11 [4]. * If you use the Captcha module 8.x-1.x, upgrade to Captcha 8.x-1.18 [5]. Reported By: * James Gilliland (neclimdul) [6] of the Drupal Security Team * Rodrigo Cabo (rodrigo-cabo) [7] Fixed By: * Jakob P (japerry) [8] * James Gilliland (neclimdul) [9] of the Drupal Security Team * Rob Loach (robloach) [10] Coordinated By: * Bram Driesen (bramdriesen) [11] of the Drupal Security Team * Damien McKenna (damienmckenna) [12] of the Drupal Security Team * Michael Hess (mlhess) [13] of the Drupal Security Team * Juraj Nemec (poker10) [14] of the Drupal Security Team * Pierre Rudloff (prudloff) [15] of the Drupal Security Team * Stella Power (stella) [16] of the Drupal Security Team * Jess (xjm) [17] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [18] [1] https://www.drupal.org/project/captcha [2] https://www.drupal.org/drupal-security-team/security-risk-levels-defined [3] https://www.drupal.org/sa-contrib-2026-015 [4] https://www.drupal.org/project/captcha/releases/2.0.11 [5] https://www.drupal.org/project/captcha/releases/8.x-1.18 [6] https://www.drupal.org/u/neclimdul [7] https://www.drupal.org/u/rodrigo-cabo [8] https://www.drupal.org/u/japerry [9] https://www.drupal.org/u/neclimdul [10] https://www.drupal.org/u/robloach [11] https://www.drupal.org/u/bramdriesen [12] https://www.drupal.org/u/damienmckenna [13] https://www.drupal.org/u/mlhess [14] https://www.drupal.org/u/poker10 [15] https://www.drupal.org/u/prudloff [16] https://www.drupal.org/u/stella [17] https://www.drupal.org/u/xjm [18] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Bulk Update User Roles - Moderately critical - Incorrect authorization - SA-CONTRIB-2026-280
by security-news＠drupal.org 28 Oct '26

28 Oct '26

View online: https://www.drupal.org/sa-contrib-2026-280 Project: Bulk Update User Roles [1] Project machine name: bulk_update_user_roles Date: 2026-October-28 Security risk: *Moderately critical* 12 ∕ 25 AC:Basic/A:Admin/CI:Some/II:Some/E:Theoretical/TD:Default [2] Vulnerability: Incorrect authorization Affected versions: <1.0.5 CVE IDs: CVE-2026-118567 Description: This module provides a bulk form for assigning or removing roles on multiple user accounts at once. The bulk update form does not prevent access to users who do not have permission to assign roles. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "administer users". Solution: Install the latest version: * If you use the Bulk Update User Roles module for Drupal 11, upgrade to Bulk Update User Roles 1.0.5 [3] Reported By: * Marcus Johansson (marcus_johansson) [4] Fixed By: * Marcus Johansson (marcus_johansson) [5] * Zeeshaan khann (zeeshan_khan) [6] Coordinated By: * Swan Kalata (akalata) [7] of the Drupal Security Team * Bram Driesen (bramdriesen) [8] of the Drupal Security Team * Greg Knaddison (greggles) [9] of the Drupal Security Team * Ivo Van Geertruyen (mr.baileys) [10] of the Drupal Security Team * Juraj Nemec (poker10) [11] of the Drupal Security Team * Jess (xjm) [12] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [13] [1] https://www.drupal.org/project/bulk_update_user_roles [2] https://www.drupal.org/drupal-security-team/security-risk-levels-defined [3] https://www.drupal.org/project/bulk_update_user_roles/releases/1.0.5 [4] https://www.drupal.org/u/marcus_johansson [5] https://www.drupal.org/u/marcus_johansson [6] https://www.drupal.org/u/zeeshan_khan [7] https://www.drupal.org/u/akalata [8] https://www.drupal.org/u/bramdriesen [9] https://www.drupal.org/u/greggles [10] https://www.drupal.org/u/mrbaileys [11] https://www.drupal.org/u/poker10 [12] https://www.drupal.org/u/xjm [13] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

S3 File System - Moderately critical - Access bypass - SA-CONTRIB-2026-279
by security-news＠drupal.org 28 Oct '26

28 Oct '26

View online: https://www.drupal.org/sa-contrib-2026-279 Project: S3 File System [1] Project machine name: s3fs Date: 2026-October-28 Security risk: *Moderately critical* 14 ∕ 25 AC:Complex/A:None/CI:Some/II:Some/E:Theoretical/TD:Default [2] Vulnerability: Access bypass Affected versions: <3.12.0 CVE IDs: CVE-2026-118574 Description: S3 File System (s3fs) provides an additional file system to your Drupal site that stores files in Amazon's Simple Storage Service (S3) storage. The module doesn't sufficiently isolate upload context between separate object(file) operations in the same request resulting in the potential for objects to be uploaded with incorrect access control list (ACL) entries or corruption through incorrect operation metadata. This vulnerability is mitigated by the fact that an attacker must be able to trigger multiple file operations on S3FS. Some vectors are mitigated by: * Not enabling private:// takeover ($settings['s3fs.use_s3_for_private'] = TRUE;) or only enabled with $settings['s3fs.upload_as_private'] = TRUE; * The deployment does not utilize hook_s3fs_stream_open_params_alter(), hook_s3fs_upload_params_alter(), hook_s3fs_copy_params_alter(), or hook_s3fs_command_params_alter() If both points above have always been true, all currently known vectors are mitigated. Solution: Install the latest version: * If you use the S3 File System module for Drupal 8.x, upgrade to s3fs 8.x-3.12 [3] If private:// takeover is enabled without $settings['s3fs.upload_as_private'] = TRUE; audit all private object ACL's to ensure no objects include a public read ACL entry. If private objects with public read ACL are discovered, audit S3 Bucket Access logs (if enabled). If using S3FS hooks, audit all objects to ensure any applied customization is reflected only on the intended objects. While auditing objects, site owners may disable ACLs and utilize a Bucket Access Policy to block public access to private:// files. See the s3fs 8.x-3.12 README.txt [4] for a sample policy. $settings['s3fs.use_s3_for_private'] = TRUE; must be configured prior to disabling ACLs. Note: With ACLs disabled, the S3 getObjectAcl call will not report ACL entries. If this feature is enabled, consider utilizing an AWS S3 Inventory report [5] to obtain object metadata. Reported By: * Justin Keiser (keiserjb) [6] Fixed By: * Conrad Lara (cmlara) [7] * Justin Keiser (keiserjb) [8] Coordinated By: * Swan Kalata (akalata) [9] of the Drupal Security Team * Greg Knaddison (greggles) [10] of the Drupal Security Team * Juraj Nemec (poker10) [11] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [12] [1] https://www.drupal.org/project/s3fs [2] https://www.drupal.org/drupal-security-team/security-risk-levels-defined [3] https://www.drupal.org/project/s3fs/releases/8.x-3.12 [4] https://git.drupalcode.org/project/s3fs/-/blob/8.x-3.12/README.txt?ref_type… [5] https://docs.aws.amazon.com/AmazonS3/latest/userguide/storage-inventory.html [6] https://www.drupal.org/u/keiserjb [7] https://www.drupal.org/u/cmlara [8] https://www.drupal.org/u/keiserjb [9] https://www.drupal.org/u/akalata [10] https://www.drupal.org/u/greggles [11] https://www.drupal.org/u/poker10 [12] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

GroupEx PRO ( Daxko ) integration - Critical - Unsupported - SA-CONTRIB-2026-278
by security-news＠drupal.org 28 Oct '26

28 Oct '26

View online: https://www.drupal.org/sa-contrib-2026-278 Project: GroupEx PRO ( Daxko ) integration [1] Project machine name: groupexpro Date: 2026-October-28 Security risk: *Critical* 16 ∕ 25 AC:Complex/A:Admin/CI:All/II:All/E:Theoretical/TD:All [2] Vulnerability: Unsupported Affected versions: * CVE IDs: CVE-2026-118565 Description: The Drupal Security Team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, read the documentation on becoming the maintainer of a project that is unsupported for security reasons [3]. Solution: If you use this project, you should uninstall it. To take over maintainership, read Becoming the maintainer of a project that is unsupported for security reasons [4]. Reported By: * Drew Webber (mcdruid) [5] of the Drupal Security Team Coordinated By: * Swan Kalata (akalata) [6] of the Drupal Security Team * Greg Knaddison (greggles) [7] of the Drupal Security Team * Drew Webber (mcdruid) [8] of the Drupal Security Team * Juraj Nemec (poker10) [9] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [10] [1] https://www.drupal.org/project/groupexpro [2] https://www.drupal.org/drupal-security-team/security-risk-levels-defined [3] https://www.drupal.org/drupal-security-team/becoming-primary-maintainer-of-… [4] https://www.drupal.org/drupal-security-team/becoming-primary-maintainer-of-… [5] https://www.drupal.org/u/mcdruid [6] https://www.drupal.org/u/akalata [7] https://www.drupal.org/u/greggles [8] https://www.drupal.org/u/mcdruid [9] https://www.drupal.org/u/poker10 [10] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

PayUmoney for Drupal Commerce - Critical - Unsupported - SA-CONTRIB-2026-277
by security-news＠drupal.org 28 Oct '26

28 Oct '26

View online: https://www.drupal.org/sa-contrib-2026-277 Project: PayUmoney for Drupal Commerce [1] Project machine name: commerce_payumoney Date: 2026-October-28 Security risk: *Critical* 16 ∕ 25 AC:Complex/A:Admin/CI:All/II:All/E:Theoretical/TD:All [2] Vulnerability: Unsupported Affected versions: * CVE IDs: CVE-2026-118564 Description: The Drupal Security Team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, read the documentation on becoming the maintainer of a project that is unsupported for security reasons [3]. Solution: If you use this project, you should uninstall it. To take over maintainership, read Becoming the maintainer of a project that is unsupported for security reasons [4]. Reported By: * Drew Webber (mcdruid) [5] of the Drupal Security Team Coordinated By: * Swan Kalata (akalata) [6] of the Drupal Security Team * Drew Webber (mcdruid) [7] of the Drupal Security Team * Juraj Nemec (poker10) [8] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [9] [1] https://www.drupal.org/project/commerce_payumoney [2] https://www.drupal.org/drupal-security-team/security-risk-levels-defined [3] https://www.drupal.org/drupal-security-team/becoming-primary-maintainer-of-… [4] https://www.drupal.org/drupal-security-team/becoming-primary-maintainer-of-… [5] https://www.drupal.org/u/mcdruid [6] https://www.drupal.org/u/akalata [7] https://www.drupal.org/u/mcdruid [8] https://www.drupal.org/u/poker10 [9] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

CacheFlush - Critical - Unsupported - SA-CONTRIB-2026-276
by security-news＠drupal.org 28 Oct '26

28 Oct '26

View online: https://www.drupal.org/sa-contrib-2026-276 Project: CacheFlush [1] Project machine name: cacheflush Date: 2026-October-28 Security risk: *Critical* 16 ∕ 25 AC:Complex/A:Admin/CI:All/II:All/E:Theoretical/TD:All [2] Vulnerability: Unsupported Affected versions: * CVE IDs: CVE-2026-118563 Description: The Drupal Security Team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, read the documentation on becoming the maintainer of a project that is unsupported for security reasons [3]. Solution: If you use this project, you should uninstall it. To take over maintainership, read Becoming the maintainer of a project that is unsupported for security reasons [4]. Reported By: * Ivo Van Geertruyen (mr.baileys) [5] of the Drupal Security Team Coordinated By: * Swan Kalata (akalata) [6] of the Drupal Security Team * Greg Knaddison (greggles) [7] of the Drupal Security Team * Ivo Van Geertruyen (mr.baileys) [8] of the Drupal Security Team * Juraj Nemec (poker10) [9] of the Drupal Security Team * Pierre Rudloff (prudloff) [10] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [11] [1] https://www.drupal.org/project/cacheflush [2] https://www.drupal.org/drupal-security-team/security-risk-levels-defined [3] https://www.drupal.org/drupal-security-team/becoming-primary-maintainer-of-… [4] https://www.drupal.org/drupal-security-team/becoming-primary-maintainer-of-… [5] https://www.drupal.org/u/mrbaileys [6] https://www.drupal.org/u/akalata [7] https://www.drupal.org/u/greggles [8] https://www.drupal.org/u/mrbaileys [9] https://www.drupal.org/u/poker10 [10] https://www.drupal.org/u/prudloff [11] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Single Content Sync - Critical - Remote code execution - SA-CONTRIB-2026-275
by security-news＠drupal.org 28 Oct '26

28 Oct '26

View online: https://www.drupal.org/sa-contrib-2026-275 Project: Single Content Sync [1] Project machine name: single_content_sync Date: 2026-October-28 Security risk: *Critical* 17 ∕ 25 AC:Basic/A:Admin/CI:All/II:All/E:Theoretical/TD:All [2] Vulnerability: Remote code execution Affected versions: <1.4.19 CVE IDs: CVE-2026-118562 Description: Single Content Sync enables exporting and importing content, referenced entities, and files between Drupal sites. A maliciously crafted import file can cause untrusted data to be deserialized, potentially leading to remote code execution. This vulnerability is mitigated by the fact that an attacker must have a role with the "import single content" permission. Solution: Install the latest version: * Upgrade to Single Content Sync 1.4.19 [3]. Reported By: * Drew Webber (mcdruid) [4] of the Drupal Security Team Fixed By: * Drew Webber (mcdruid) [5] of the Drupal Security Team * Oleksandr Kuzava (nginex) [6] Coordinated By: * Swan Kalata (akalata) [7] of the Drupal Security Team * Greg Knaddison (greggles) [8] of the Drupal Security Team * Lee Rowlands (larowlan) [9] of the Drupal Security Team * Drew Webber (mcdruid) [10] of the Drupal Security Team * Juraj Nemec (poker10) [11] of the Drupal Security Team * Jess (xjm) [12] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [13] [1] https://www.drupal.org/project/single_content_sync [2] https://www.drupal.org/drupal-security-team/security-risk-levels-defined [3] https://www.drupal.org/project/single_content_sync/releases/1.4.19 [4] https://www.drupal.org/u/mcdruid [5] https://www.drupal.org/u/mcdruid [6] https://www.drupal.org/u/nginex [7] https://www.drupal.org/u/akalata [8] https://www.drupal.org/u/greggles [9] https://www.drupal.org/u/larowlan [10] https://www.drupal.org/u/mcdruid [11] https://www.drupal.org/u/poker10 [12] https://www.drupal.org/u/xjm [13] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

Single Content Sync - Critical - External control of file name or path - SA-CONTRIB-2026-274
by security-news＠drupal.org 28 Oct '26

28 Oct '26

View online: https://www.drupal.org/sa-contrib-2026-274 Project: Single Content Sync [1] Project machine name: single_content_sync Date: 2026-October-28 Security risk: *Critical* 17 ∕ 25 AC:Basic/A:Admin/CI:All/II:All/E:Theoretical/TD:All [2] Vulnerability: External control of file name or path Affected versions: <1.4.19 CVE IDs: CVE-2026-118561 Description: Single Content Sync enables exporting and importing content, referenced entities, and files between Drupal sites. The module does not sufficiently validate file sources and destinations during content imports. An attacker can write arbitrary files, disclose sensitive local files accessible to the web server, or cause the server to make requests to internal or external resources. Depending on the server configuration, this may lead to remote code execution. Exploitation requires the /import single content/ permission. This permission is marked as restricted starting with version 1.4.18. Remote code execution additionally depends on the server permitting execution of attacker-controlled files. Solution: Install the latest version: * If you use the Single Content Sync module, upgrade to Single Content Sync 1.4.19 [3]. Run database updates and rebuild caches after upgrading. Review the module permissions and ensure only highly trusted roles have the "import single content" permission. Remote file downloads during imports are disabled by default. Sites that require this functionality must configure trusted file hosts in the module settings. Alternatively, import ZIP files containing the required assets. Reported By: * jvdkolk [4] * killianacc [5] * Kévin Le lostec (klelostec) [6] * nicocha30 [7] Fixed By: * killianacc [8] * Oleksandr Kuzava (nginex) [9] Coordinated By: * Swan Kalata (akalata) [10] of the Drupal Security Team * Greg Knaddison (greggles) [11] of the Drupal Security Team * Juraj Nemec (poker10) [12] of the Drupal Security Team * Jess (xjm) [13] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [14] [1] https://www.drupal.org/project/single_content_sync [2] https://www.drupal.org/drupal-security-team/security-risk-levels-defined [3] https://www.drupal.org/project/single_content_sync/releases/1.4.19 [4] https://www.drupal.org/u/jvdkolk [5] https://www.drupal.org/u/killianacc [6] https://www.drupal.org/u/klelostec [7] https://www.drupal.org/u/nicocha30 [8] https://www.drupal.org/u/killianacc [9] https://www.drupal.org/u/nginex [10] https://www.drupal.org/u/akalata [11] https://www.drupal.org/u/greggles [12] https://www.drupal.org/u/poker10 [13] https://www.drupal.org/u/xjm [14] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0

AI (Artificial Intelligence) - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-273
by security-news＠drupal.org 28 Oct '26

28 Oct '26

View online: https://www.drupal.org/sa-contrib-2026-273 Project: AI (Artificial Intelligence) [1] Project machine name: ai Date: 2026-October-28 Security risk: *Moderately critical* 11 ∕ 25 AC:Complex/A:User/CI:Some/II:Some/E:Theoretical/TD:Uncommon [2] Vulnerability: Cross-site scripting Affected versions: <1.4.11 || >=1.5.0 <1.5.2 CVE IDs: CVE-2026-118553 Description: The AI module includes a submodule, AI Automator. This submodule allows you to automatically fill out fields using AI, based on other fields. The module doesn't sufficiently check access to text formats, allowing users to author field data in text formats they should not have access to. Solution: Install the latest version: * If you use the AI module 1.5.x, upgrade to AI 1.5.2 [3]. * If you use the AI module 1.4.x, upgrade to AI 1.4.11 [4]. * If you use the AI module 1.3.x, upgrade to AI 1.5.2 [5] or AI 1.4.11 [6] as the 1.3.x branch is now unsupported. Reported By: * Marcus Johansson (marcus_johansson) [7] Fixed By: * Artem Dmitriiev (a.dmitriiev) [8] * Abhisek Mazumdar (abhisekmazumdar) [9] * Ahmad Khader (ahmad khader) [10] * Marcus Johansson (marcus_johansson) [11] Coordinated By: * Swan Kalata (akalata) [12] of the Drupal Security Team * Bram Driesen (bramdriesen) [13] of the Drupal Security Team * Greg Knaddison (greggles) [14] of the Drupal Security Team * Juraj Nemec (poker10) [15] of the Drupal Security Team * Jess (xjm) [16] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [17] [1] https://www.drupal.org/project/ai [2] https://www.drupal.org/drupal-security-team/security-risk-levels-defined [3] https://www.drupal.org/project/ai/releases/1.5.2 [4] https://www.drupal.org/project/ai/releases/1.4.11 [5] https://www.drupal.org/project/ai/releases/1.5.2 [6] https://www.drupal.org/project/ai/releases/1.4.11 [7] https://www.drupal.org/u/marcus_johansson [8] https://www.drupal.org/u/admitriiev [9] https://www.drupal.org/u/abhisekmazumdar [10] https://www.drupal.org/u/ahmad-khader [11] https://www.drupal.org/u/marcus_johansson [12] https://www.drupal.org/u/akalata [13] https://www.drupal.org/u/bramdriesen [14] https://www.drupal.org/u/greggles [15] https://www.drupal.org/u/poker10 [16] https://www.drupal.org/u/xjm [17] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal…

1 0