social 12.4.9

Open Social - Moderately critical - Access bypass - SA-CONTRIB-2024-076

Few notes to take into account:

• This release contains an update hook that can possibly create new folders. Make sure to run the hook as the correct user or via update.php so it has the correct owner.
• The update hook does not take unmanaged/unorphaned files into account. In usual cases these should be cleaned up automatically by cron when they are not set temporary. To verify this there are a few option to take:
1. Use the files overview to identify and remove affected files.
2. Temporary enable the contrib module https://www.drupal.org/project/fancy_file_delete which provides an additional view and bulk operations.
3. Run database queries.