Drupal 12 Tightens Filename Handling as New Recipe, Workflow and Hosting Tools Arrive

Recent Drupal changes affect different stages of site work, from upload handling and recipe translation to workflow editing, template evaluation and hosting access. Their readiness states differ sharply: one change is committed to Drupal 12 but not yet included in a packaged release, one project is in alpha, one is a stable contributed update, and two capabilities are already deployed and available to use.

That distinction determines the practical response. Some changes warrant testing, Workflow Modeler gives users of affected functionality a conventional update path, and the service-level additions can be evaluated immediately. None creates a blanket update requirement across Drupal sites.

Drupal 12 will change how new file uploads handle characters considered dangerous in filenames. According to the core change record, Drupal will replace a set of characters, including shell metacharacters, with underscores. Accents, spaces and most safe Unicode characters remain permitted by default, while existing filenames are not changed.

The change is defensive hardening rather than a response to a Drupal core security advisory. The change record says core itself handles filenames safely, but leaving dangerous characters intact increases the risk that contributed or custom code could pass them to another system without equivalent safeguards. Examples given by Drupal include a;b|c&d.txt becoming a_b_c_d.txt and Love&War.pdf becoming Love_War.pdf.

The filename change was published for Drupal 12.0.0 on 19 September 2026, after Drupal 12.0.0-alpha1 was released on 2 September, so alpha1 does not contain the new behaviour. As of 24 September, Drupal.org still lists alpha1 as the available packaged Drupal 12 release, although the core release schedule had targeted 12.0.0-beta1 for the week of 14 September. Drupal 12 testers should therefore test the behaviour against the development branch rather than assume it is present in alpha1, particularly where upload workflows or downstream integrations depend on exact filenames.

The Recipe Interface Translation Integration project addresses translation handling for configuration supplied by Drupal recipes. The module keeps a list of recipes applied to a site and a copy of the translatable configuration they shipped, allowing that information to remain available for interface translation after the recipe has been applied.

Version 1.0.0-alpha1 was released on 19 September and supports Drupal 11.4 and Drupal 12. The release notes identify it as the project's first alpha, so multilingual teams working with recipes have a testing target rather than a routine production update. As an alpha project without a supported stable release, it should not be treated as carrying the same production readiness as a stable contributed module.

Workflow Modeler 1.0.9, also released on 19 September, provides the conventional stable update in this group. Its changelog fixes exports involving internal condition configuration and preserves text and caret positions in token fields. It also carries a model's recipe metadata in Workflow Modeler, simplifies the review panel, adds a mode-toggle shortcut and extends the plugin API with multi-selection getters.

Workflow Modeler 1.0.9 supports Drupal 11.3 and Drupal 12, and the project is covered by Drupal's security advisory policy. This release is a maintenance and feature update rather than a security advisory. Teams using Workflow Modeler should particularly assess the update where exported models contain internal conditions or editors rely on token-field behaviour affected by the fixes.

The recommendation applies to Workflow Modeler rather than automatically to every ECA installation. The project documentation states that Workflow Modeler can work with any module implementing the Modeler API, with ECA being its most common model owner rather than a hard dependency.

You May Like

Interview

Matthew Saunders Makes Community Trust a Focus of Board Candidacy

Interview

Matthew Saunders Makes Community Trust a Focus of Board Candidacy

simplytest.me now lets visitors launch Drupal CMS site templates directly in disposable sandboxes. The capability is a shipped follow-up to earlier coverage by The DropTimes, when template launching was still planned.

Matt Glaman reported that the service reads from the same curated template list used by the Drupal CMS installer. Template launches use a shared Drupal CMS base rather than maintaining a separate prebuilt environment for every template, with the selected template's recipe and dependencies applied during launch.

The practical change is lower setup friction for evaluation. Teams can inspect Drupal CMS site templates without first assembling a local Composer project and its template dependencies, while simplytest.me continues to rebuild the shared base separately from template-specific recipe application.

BOA has introduced a Site operator role intended to separate routine control-panel work from access to database copies, administrator login links and destructive site operations. In Omega8's description of the role, a Site operator can verify, clone and migrate sites, flush caches, run database updates, change settings and aliases, disable or re-enable sites, and inspect task logs.

The restrictions are substantial but do not make the role read-only. Site operators cannot create or restore backups, export database copies, delete backups, generate one-time administrator login links or delete sites. Omega8 also notes that the permissions are enforced server-side rather than merely by hiding control-panel buttons.

The access boundary depends on shell permissions as well as the panel role. Omega8 says a Drush-enabled platform developer login provides database access and can generate administrator login links, so pairing that shell access with a Site operator account would restore capabilities the restricted panel role was designed to withhold. A Site operator who needs file or theme access can instead use BOA's more limited files login.

The five changes therefore sit at different points in their lifecycle. Drupal 12 filename hardening is committed but not yet present in the available alpha package; Recipe Interface Translation Integration remains an alpha testing release; Workflow Modeler 1.0.9 is a stable update; and the simplytest.me template launcher and BOA Site operator role are already deployed capabilities. The relevant action depends on the workflow and release state, not on treating the items as one coordinated Drupal update.