The Drupal project has released version 4.6.2 of its open-source content management platform. Drupal 4.6.2 is a maintenance release that provides corrections of problems reported using the bug tracking system. Drupal 4.6.2 also fixes two security vulnerabilities: one related to the use of Drupal's input filters and one in the XML-RPC library that Drupal ships with. Upgrading your existing Drupal sites is highly recommended. As the same bugs are also present in the Drupal 4.5 series, Drupal 4.5.4 is released as well.

There are no new features in these installments. For more information about the Drupal 4.6.x release series, please consult the Drupal 4.6.0 release announcement.

Download

• Drupal 4.6.2 can be downloaded from http://drupal.org/files/projects/drupal-4.6.2.tar.gz.
• Drupal 4.5.4 can be downloaded from http://drupal.org/files/projects/drupal-4.5.4.tar.gz.

Upgrading

To fix this problem, you can (1) upgrade Drupal or (2) patch Drupal.

1. To upgrade Drupal, follow the instructions in INSTALL.txt and consult the information below.
2. To patch Drupal, use the patches below:
   • For Drupal 4.6.1:
     • http://drupal.org/files/sa-2005-002/filter-4.6.1.patch
     • http://drupal.org/files/sa-2005-003/xmlrpc.patch
   • For Drupal 4.5.3:
     • http://drupal.org/files/sa-2005-002/filter-4.5.3.patch
     • http://drupal.org/files/sa-2005-003/xmlrpc.patch

Official security advisories can be found at http://drupal.org/sa-2005-002/advisory.txt and http://drupal.org/sa-2005-003/advisory.txt.

Drupal 4.6.2
Bugs fixed

The most important bug fixes since Drupal 4.6.1 include:

• Patch #25504: fixed problem with the weights of book pages not being remembered.
• Patch #24157: fixed problems with modules using the image toolkit.
• Patch #21918: fixed form icons being broken when you change the forum icon path.
• Patch #24003: fixed blogapi module problems not using the correct attributes.
• Patch #22416: fixed problem that prevented menu item descriptions from showing up.
• Patch #24141: fixed XML UTF-8 bom issue with PHP5.
• Fixed a security bug due to incorrect checking of input format privileges.
• Fixed a security bug in Drupal's XML-RPC library.

A complete list of all bug fixes in the stable DRUPAL-4-6 branch can be found at http://drupal.org/cvs/drupal/?branch=DRUPAL-4-6.

Upgrading from Drupal 4.5.x and earlier

For the most trouble free transition from an existing installation, it is recommended that you first upgrade to Drupal 4.6.1. If you are upgrading from Drupal 4.5.x or below, please consult the Drupal 4.6.0 release announcement and the Drupal 4.6.1 release announcement for more information. To upgrade from Drupal 4.6.1, upload all of the files and directories in the Drupal 4.6.2 package to your webserver, replacing older copies of the files. As with any upgrade, it is a good idea to backup of your site and database first. No API or database changes have been made since Drupal 4.6.1 so all contributed themes and modules that work for 4.6.0 and 4.6.1 will work with 4.6.2.

Bug reports

The Drupal 4.6 branch is still being maintained so given enough bug fixes (not just bug reports) more maintenance releases will be made available.