Releases for RESTful Web Services

This resolves issues described in SA-CORE-2019-003 for this module.

Not all configurations are vulnerable. See SA-CORE-2019-003 for details.

Changes since 7.x-2.5:

• See RESTWS - Highly critical - Remote code execution - DRUPAL-SA-CONTRIB-2016-040

Issue #2484829 by mariano.barcia, mallezie, Koen.Pasman, dgtlmoon, joseph.olstad, lokapujya, kurkuma, bangpound, jaskaran.nagra, iamEAP: Specifying the resource format via a URL extension (like "node/1.json") no longer works in Drupal 7.37

Changes since 7.x-1.5:

• Disable XML entity loading which is not needed.

Security update, not other changes. See SA-CONTRIB-2015-052 - RESTful Web Services - Access Bypass

See SA-CONTRIB-2013-062

This release adds field level access to entity write operations, such as POST and PUT requests. Make sure that your service consumers have sufficient permissions to write fields they want to insert or update.

This release fixes a critical SQL injection vulnerability. It is mitigated by the fact that an attacker must have the permission to access a resource (example: Access the resource node) in order to exploit this.

Since development of this module has slowed down significantly over the last months this release also marks the first stable release, in order to get proper security advisories for any future security issues.

See SA-CONTRIB-2013-042

Consumers should not issue GET requests to /@entity_type/@id with HTTP Accept headers set to the expected format aynmore, since that could interfere with Drupal's page cache. HTML might be returned from that URLs that could break clients.

Example of URLs that are deprecated and should not be used anymore:

See also SA-CONTRIB-2013-003

This release comes with a major API change for clients. A security token has been introduced to guard against CSRF attacks. This change only affects you if

* your client uses cookie-based user authentication and
* your client performs write operations (POST, PUT or DELETE).

Clients that only read data (GET requests) still work the same. Clients that use other authentication mechanisms (like restws_basic_auth) remain unaffected as well.

Fixes a CSRF security issue. SA-CONTRIB-2012-162 - RESTful Web Services - Cross site request forgery (CSRF)

API change: The format extension in URL paths only works for GET requests now.
Example that still works:

GET http://example.com/node/123.json

Examples that do not work anymore:

Changes since 7.x-1.0-beta2:

• #1506190 by sepgil: Fixed Don't allow to create Entities without Bundles.

Nightly development snapshot.

First beta release of RESTWS. See README.txt for usage instructions. Please report any problems in the issue queue.