Chris Kelly Warns of Security Flaw in Proposed Drupal Project Browser Approach

Drupal contributor Chris Kelly raises a red flag over a proposed Project Browser change allowing web servers to write to code directories. He argues this reverses a core Drupal security principle—preventing executable files from being uploaded via the browser.

Kelly warns the feature, though likely to include setup warnings, risks adoption on public servers by non-technical users. He sees this as opening a serious attack vector, especially if exploited through flawed modules. The potential for mass site compromises, he suggests, outweighs any convenience gains.

His tone is sharply critical, emphasizing the risk to Drupal’s reputation and security model. While he notes potential cleanup business opportunities, his core message is clear: this approach is dangerous and the community should reject it outright. Read his critique published on LinkedIn Pulse from the Source Reference below.