This assumes your codebase was on Drupal 7.59 and you're currently in Drupal's root directory. If you're currently on a different version, adjust the numbers in the patch URL accordingly. Don't forget to still run database updates via /update.php or drush updatedb! Drupal Drupal version 7.59: Security vulnerabilities, exploits, vulnerability statistics, CVSS scores and references (e.g.: CVE-2009-1234 or 2010-1234 or 20101234) Log In Register.
It’s no secret: upgrading Drupal 7 to 8 is riddled with new challenges unique to this particular version to version update. And while there is plenty of preparation to do in your steps to upgrade Drupal 7 to Drupal 8, most organizations will experience the bulk of their difficulties during the actual site to site migration. If you wish to continue using Drupal in the future, there is no possible way to avoid or bypass the Drupal 8 upgrade since Drupal 9 and every subsequent version of Drupal will use the new Symfony PHP framework in which Drupal 8 was rebuilt upon.
Luckily, Drupal 8 is more than three years old (as of this writing) and a whole community of Drupal developers and users have already documented most of the expected issues you could face throughout the upgrade process, including migration. Below is an overview of the migration process and some tips to reduce some of the common problems that occur.
STEPS TO UPGRADE DRUPAL 7 TO DRUPAL 8
The steps to upgrade Drupal 7 to Drupal 8 starts with understanding how your current Drupal site(s) is built through extensive preparation. Only after you are prepared, can you then begin migrating configurations, modules, and content.
Prepare Before the Migration
Of course, you should first ensure your organization is prepared for the upcoming Drupal migration, which includes (but is not limited to) the following preparatory initiatives:
- Setting up a staging environment for the new Drupal 8 site
- Identifying your Drupal 7 core modules in use and taking a detailed inventory
- Keeping an eye on known issues
- Updating your current Drupal site to the latest pre-8 version
- Ensuring your new Drupal 8 site has appropriate access to private source files
- Installing a clean and separate Drupal 8 site
- Enabling core and contributing modules in your new Drupal 8 site
- Avoiding configuration and content editing on Drupal 8 until after the migration
- Estimating, budgeting and resourcing for the migration
Drupal also recommends using the Drupal pre-upgrade analysis tool to estimate how much time and effort your team will ultimately need to complete the entire upgrade. In general, the upgrade implications will likely have the biggest impact on specific modules (which should be addressed during preparation), and your Drupal developers should be on-hand to offer insights into some of the more technical Drupal 8 module development your site might require during the migration.
Nonetheless, once you’ve adequately prepared, the migration activities can officially start. And depending on the complexity of your site structure, the amount of content, whether or not the migration is coupled with any re-design, and your general experience within the Drupal CMS, the migration can take many different forms.
Configuration & Content Migration
With previous Drupal versioning updates, most developers simply migrated the structure directly and little hands-on involvement was needed to ensure everything continued functioning properly. The upgrade process updated the source site in-place. Site content and site configuration settings, for the most part, remained completely intact and most users barely noticed any changes.
Fast forward to Drupal 8, and things are much much different. As such, a multi-level migration approach is needed.
- Migrate the site configuration - This includes node content types and field definitions used in editing content. You shouldn’t need to recreate these manually unless of course, your Drupal upgrade coincides with web design update as well. If that is the case, then you should work closely with your web development team to ensure the editing functions that you are used to can be replicated in the new version of the re-designed site.
- Migrate the site content - If you’re one of the lucky enough to make it through all the prep work and site configuration with minimal issues, then you’ll now migrate the content to Drupal 8. The actual nodes (or pages), users and taxonomy terms are all migratable, for example. You shouldn’t need to copy paste every piece of content or page.
TYPES OF DRUPAL MIGRATIONS
For brave and experienced Drupal users, it is possible to perform (carefully) most of the Drupal upgrade and migratory activities using the browser user interface, or you can also run the upgrade via Drush, though this will require a bit more technical expertise.
You’ll still want to perform all of the aforementioned prep work, but barring any big technical issues with module functionalities, it is certainly possible to complete most of the upgrade with minimal developer input. Before fully using the web browser, though, you’ll first migrate the modules.
To avoid issues will module migration, your migration project team should become familiar with all of the Drupal upgrade migration modules available for this process. Some are built into the core and ready to use after enabling them, others are contributed modules that you should only need to download if you anticipate any specific issues.
Luckily, the Drupal 8 web user interface does show a summary of which modules are automatically upgradable, and which ones are not.
Upgrading Drupal from Web Browser
Upgrading Drupal from the web browser involves the following steps:
- Define the Source Site - Start by visiting the /upgrade path of your Drupal 8 site. If you get a 404 error, or page not found, check to make sure you have enabled the Migrate Drupal UI module. This upgrade step is all about defining how and where your new Drupal 8 site will access the files it needs. If all files directories are public, then things are a bit easier here. For private file directories, however, you should verify that you have the right paths set up from the start. A back-end developer here can be very helpful in evaluating whether or not you’ll need development assistance and/or special server access.
- Review the Pre-upgrade Analysis - The nice thing about upgrading to Drupal 8 this late in the game is that the tools for migrating have been fully fleshed out and are more helpful than ever as features are added to address common migration issues and scenarios that might not have been known 3+ years ago when Drupal 8 launched.
- ID Conflict Warnings - Remain cognizant of any ID Conflict Warnings, which occurs when you’ve already migrated any content or “nodes”. Since you are essentially recreating your Drupal site separately, ID conflict warnings are a safeguard against having duplicative nodes or content that can cause a bit of trouble.
- Perform the Upgrade - Once you hit the button to run the upgrade, there is no turning back. If you followed all of the steps up til this point, you should be ok. Regardless, you should at the very least have made a recent backup of your site so that if the upgrade goes haywire, you can roll back to that backed up copy of your site.
- Check for any migration errors - Once the web browser upgrade has officially concluded, the system will alert you of any errors via the “migration logs”. If there are errors logged, then you can check the issues queue to get to the bottom of it, or you might be a situation where your site is too large to migrate via the web browser, and you must instead migrate via Drush.
Upgrading with Drush
Drupal 7.77 Download
Upgrading with Drush is more technical than the web browser version and you should consult with your Drupal developers or Drupal agency or simply have them run the upgrade entirely. The nice thing about Drush is that it allows you to do one-to-one migrations and rollbacks as needed. For additional information on all the steps and various ways to upgrade using Drush, you can reference Drupal’s helpful upgrade guide.
Ready to leverage the power of your CMS? Learn more about the benefits of upgrading to Drupal 8 here - and also find out why it will give you a unique advantage when it comes time to upgrade to Drupal 9![Note] Open Atrium (a Drupal distribution) and CiviCRM (CMS integration with Drupal) are also affected by this vulnerability. Make sure that your deployment is updated to the latest version.
Drupal has released a new version that fixes a highly critical security vulnerability. We strongly recommend upgrading your existing Drupal 7 and 8 sites.
A remote code execution vulnerability exists within multiple subsystems of Drupal 7.x and 8.x. This potentially allows attackers to exploit multiple attack vectors on a Drupal site, which could result in the site being completely compromised. This vulnerability is related to Drupal core - Highly critical - Remote Code Execution - SA-CORE-2018-002. Both SA-CORE-2018-002 and this vulnerability are being exploited in the wild.
It is recommended that you upgrade your Drupal application to Drupal 7.59 or later and Drupal 8.5.3 or later. We highly recommend creating a backup before proceeding. You can follow our documentation to learn how to upgrade your application and ensure its security.
If you are unable to update immediately and have advanced Drupal administration skills, you may opt to patch your systems until such time as you are able to completely update. The Drupal community has provided patches which can be applied using the following procedure:
1. Move to Drupal directory (assuming /opt/bitnami/ as installdir):
Drupal 7.59 Vulnerabilities
2. Download the correct patch for your system based on the version of Drupal in use.
- For Drupal 7.x:
wget -O drupal.patch 'https://cgit.drupalcode.org/drupal/rawdiff/?h=7.x&id=080daa38f265ea28444c540832509a48861587d0'
wget -O drupal.patch 'https://cgit.drupalcode.org/drupal/rawdiff/?h=8.5.x&id=bb6d396609600d1169da29456ba3db59abae4b7e'
For new application deployments, including the Bitnami Launchpad, we are releasing Drupal 7.59 and 8.5.3 containers, installers, virtual machines and cloud images that include the fix to address this vulnerability. If you deploy Bitnami Drupal and it is not yet updated to its latest version, you will need to upgrade by following our documentation.
If you have further questions about Bitnami Drupal or this security issue, please post to our community forum, where we will be happy to help.