3
So it turned out that the "Contact edit" capability was turned on for the "Authenticated User" role. One needs to remember that Drupal "ORs" the permissions for logged in users in any custom role with the permissions in the "Authenticated User" role.
Always check the defaults before blaming the software!
2
You can create a folder somewhere outside the main tree, so that when you upgrade core you don't overwrite your extensions, and then in civi under Admin - System Settings - Directories, you put the file path to that folder where it says "Extensions Directory".
If you already have some other extensions installed, they might have gone under sites/...
1
I use the following for Drupal 7 which I find a straightforward process:
(I do this on a development copy of the site first to check for issues)
cd public_html/sites/all/modules // go to modules folder for site
wget https://download.civicrm.org/latest/civicrm-STABLE-drupal.tar.gz //get latest
drush vset maintenance_mode 1 //put site into maintenance_mode
...
Only top voted, non community-wiki answers of a minimum length are eligible
