May I know if backdrop vulnerable to the Log4shell/Log4j (CVE-2021-44228) in any stage or version or third party plugin found vulnerable to this ? Is there any official statement from backdrop on this ? I need a firm answer on this. Thanks.
Backdrop is definitely not vulnerable because of Log4j. Log4j is a Java component; Backdrop doesn't directly use Java, it's written in PHP, HTML, and JavaScript, with a smattering of scripting languages and configurations.
Note: I don't speak officially for Backdrop, but I'm pretty confident about this.
Hi, so working through Amilenkov's useful suggestions in turn
unpublished? - I can see the page itself when not logged in. I did then edit and added a menu link from the page...
Amilenkov's suggestions are spot on. As for the greyed out Menu module, that's because there must be another module that depends on Menu. Core will gray out modules that cannot be disabled (e.g...
Posted13 hours 4 min ago by Alejandro Cremaschi (argiepiano) on:
Welcome to the Backdrop community!
My first suspicion would be access to the destination page. Backdrop checks access when building the menu, so a link can be enabled but still be hidden...
Posted21 hours 11 min ago by Antony Milenkov (amilenkov) on:
Comments
Backdrop is definitely not vulnerable because of Log4j. Log4j is a Java component; Backdrop doesn't directly use Java, it's written in PHP, HTML, and JavaScript, with a smattering of scripting languages and configurations.
Note: I don't speak officially for Backdrop, but I'm pretty confident about this.
I'm glad to hear this. Thanks for your affirmation.