November 2005 - Development - lists.drupal.org

Bug#319735: marked as done (drupal: Problem with postgresql)
by owner＠bugs.debian.org 11 Nov '05

11 Nov '05

Your message dated Thu, 10 Nov 2005 16:32:07 -0800 with message-id <E1EaMpr-0006fr-Sn(a)spohr.debian.org> and subject line Bug#312202: fixed in drupal 4.5.5-3 has caused the attached Bug report to be marked as done. This means that you claim that the problem has been dealt with. If this is not the case it is now your responsibility to reopen the Bug report if necessary, and/or fix the problem forthwith. (NB: If you are a system administrator and have no idea what I am talking about this indicates a serious mail system misconfiguration somewhere. Please contact me immediately.) Debian bug tracking system administrator (administrator, Debian Bugs database) -------------------------------------- Received: (at submit) by bugs.debian.org; 24 Jul 2005 12:25:35 +0000 >From mage(a)mordor.ath.cx Sun Jul 24 05:25:35 2005 Return-path: <mage(a)mordor.ath.cx> Received: from 81-188-71-21.adsl.easynet.be (mordor.ath.cx) [81.188.71.21] (postfix) by spohr.debian.org with esmtp (Exim 3.36 1 (Debian)) id 1DwfXz-0004Rj-00; Sun, 24 Jul 2005 05:25:35 -0700 Received: from localhost (localhost [127.0.0.1]) by mordor.ath.cx (Postfix) with ESMTP id 289E78DC019; Sun, 24 Jul 2005 14:28:30 +0200 (CEST) Received: from mordor.ath.cx ([127.0.0.1]) by localhost (mordor [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 00403-07; Sun, 24 Jul 2005 14:28:30 +0200 (CEST) Received: by mordor.ath.cx (Postfix, from userid 1000) id EE8138DC018; Sun, 24 Jul 2005 14:28:29 +0200 (CEST) Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit From: Julien Cigar <mage(a)mordor.ath.cx> To: Debian Bug Tracking System <submit(a)bugs.debian.org> Subject: drupal: Problem with postgresql X-Mailer: reportbug 3.15 Date: Sun, 24 Jul 2005 14:28:29 +0200 Message-Id: <20050724122829.EE8138DC018(a)mordor.ath.cx> X-Virus-Scanned: by amavisd-new-20030616-p10 (Debian) at mordor.ath.cx Delivered-To: submit(a)bugs.debian.org X-Spam-Checker-Version: SpamAssassin 2.60-bugs.debian.org_2005_01_02 (1.212-2003-09-23-exp) on spohr.debian.org X-Spam-Level: X-Spam-Status: No, hits=-8.0 required=4.0 tests=BAYES_00,HAS_PACKAGE autolearn=no version=2.60-bugs.debian.org_2005_01_02 Package: drupal Version: 4.5.4-1 Severity: important Hello, I think there is a bug in the database script for postgresql. After installing drupal, I try to display the site (http://my.host.name/drupal) and I get the following error : Warning: pg_query(): Query failed: ERROR: null value in column "uid" violates not-null constraint in /usr/share/drupal/includes/database.pgsql.inc on line 104 Fatal error: ERROR: null value in column "uid" violates not-null constraint query: INSERT INTO sessions (sid, hostname, timestamp) values('5635f3f3dced1cc0cb1d9bafe77ce234', '192.168.0.10', 1122207318) in /usr/share/drupal/includes/database.pgsql.inc on line 121 I looked at the structure of the "sessions" table and the column uid is marked as not null. An "ALTER TABLE sessions ALTER COLUMN uid DROP NOT NULL;" seems to resolve the problem ... Thanks -- System Information: Debian Release: testing/unstable APT prefers testing APT policy: (500, 'testing') Architecture: i386 (i686) Shell: /bin/sh linked to /bin/bash Kernel: Linux 2.4.27 Locale: LANG=en_US, LC_CTYPE=en_US (charmap=ISO-8859-1) Versions of packages drupal depends on: ii apache2 2.0.54-4 next generation, scalable, extenda ii apache2-mpm-prefork [apach 2.0.54-4 traditional model for Apache2 ii debconf 1.4.52 Debian configuration management sy ii makepasswd 1.10-2 Generate and encrypt passwords ii php4-cli 4:4.3.10-15 command-line interpreter for the p ii php4-pgsql 3:4.3.10-5 PostgreSQL module for php4 ii postfix [mail-transport-ag 2.2.4-1 A high-performance mail transport ii postgresql-client 7.4.7-6sarge1 front-end programs for PostgreSQL ii wwwconfig-common 0.0.43 Debian web auto configuration Versions of packages drupal recommends: pn apache <none> (no description available) ii libapache2-mod-php4 4:4.3.10-15 server-side, HTML-embedded scripti ii php4 4:4.3.10-15 server-side, HTML-embedded scripti ii postgresql 7.4.7-6sarge1 object-relational SQL database man -- debconf information excluded --------------------------------------- Received: (at 312202-close) by bugs.debian.org; 11 Nov 2005 00:41:46 +0000 >From katie(a)ftp-master.debian.org Thu Nov 10 16:41:46 2005 Return-path: <katie(a)ftp-master.debian.org> Received: from katie by spohr.debian.org with local (Exim 4.50) id 1EaMpr-0006fr-Sn; Thu, 10 Nov 2005 16:32:07 -0800 From: Hilko Bengen <bengen(a)debian.org> To: 312202-close(a)bugs.debian.org X-Katie: $Revision: 1.56 $ Subject: Bug#312202: fixed in drupal 4.5.5-3 Message-Id: <E1EaMpr-0006fr-Sn(a)spohr.debian.org> Sender: Archive Administrator <katie(a)ftp-master.debian.org> Date: Thu, 10 Nov 2005 16:32:07 -0800 Delivered-To: 312202-close(a)bugs.debian.org X-Spam-Checker-Version: SpamAssassin 2.60-bugs.debian.org_2005_01_02 (1.212-2003-09-23-exp) on spohr.debian.org X-Spam-Level: X-Spam-Status: No, hits=-6.0 required=4.0 tests=BAYES_00,HAS_BUG_NUMBER autolearn=no version=2.60-bugs.debian.org_2005_01_02 Source: drupal Source-Version: 4.5.5-3 We believe that the bug you reported is fixed in the latest version of drupal, which is due to be installed in the Debian FTP archive: drupal_4.5.5-3.diff.gz to pool/main/d/drupal/drupal_4.5.5-3.diff.gz drupal_4.5.5-3.dsc to pool/main/d/drupal/drupal_4.5.5-3.dsc drupal_4.5.5-3_all.deb to pool/main/d/drupal/drupal_4.5.5-3_all.deb A summary of the changes between this version and the previous one is attached. Thank you for reporting the bug, which will now be closed. If you have further comments please address them to 312202(a)bugs.debian.org, and the maintainer will reopen the bug report if appropriate. Debian distribution maintenance software pp. Hilko Bengen <bengen(a)debian.org> (supplier of updated drupal package) (This message was generated automatically at their request; if you believe that there is a problem with it please contact the archive administrators by mailing ftpmaster(a)debian.org) -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Format: 1.7 Date: Fri, 11 Nov 2005 00:13:54 +0100 Source: drupal Binary: drupal Architecture: source all Version: 4.5.5-3 Distribution: unstable Urgency: low Maintainer: Hilko Bengen <bengen(a)debian.org> Changed-By: Hilko Bengen <bengen(a)debian.org> Description: drupal - fully-featured content management/discussion engine Closes: 312202 312230 319735 336719 Changes: drupal (4.5.5-3) unstable; urgency=low . * Pulled in includes/session.inc from upstream's 4.5 branch, updated database/database.pgsql. - Fixes "Users unable to log out" issue (Closes: #336719) - Fixes "uid default missing" issue (Closes: #312230, #312202, #319735) Files: 1e67c12d6f766f9ff2d930a5b4ebf4cb 609 web extra drupal_4.5.5-3.dsc 77dade82d81243815ebe99dc7c27037c 43990 web extra drupal_4.5.5-3.diff.gz ca260e977b91ebab1983894da4964108 483486 web extra drupal_4.5.5-3_all.deb -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.2 (GNU/Linux) iD8DBQFDc9hZUCgnLz/SlGgRAkZsAKCPnUSHWcXF/lj6XwLI4bN5ol70bQCfSREH KOHYW3u/nMrMUOWjmM7NoZA= =DJMN -----END PGP SIGNATURE-----

1 0

Bug#312230: marked as done (Fw: drupal: uid default missing)
by owner＠bugs.debian.org 11 Nov '05

11 Nov '05

Your message dated Thu, 10 Nov 2005 16:32:07 -0800 with message-id <E1EaMpr-0006fr-Sn(a)spohr.debian.org> and subject line Bug#312202: fixed in drupal 4.5.5-3 has caused the attached Bug report to be marked as done. This means that you claim that the problem has been dealt with. If this is not the case it is now your responsibility to reopen the Bug report if necessary, and/or fix the problem forthwith. (NB: If you are a system administrator and have no idea what I am talking about this indicates a serious mail system misconfiguration somewhere. Please contact me immediately.) Debian bug tracking system administrator (administrator, Debian Bugs database) -------------------------------------- Received: (at submit) by bugs.debian.org; 6 Jun 2005 13:02:58 +0000 >From ivan.s.b(a)gmail.com Mon Jun 06 06:02:57 2005 Return-path: <ivan.s.b(a)gmail.com> Received: from vsmtp14.tin.it [212.216.176.118] by spohr.debian.org with esmtp (Exim 3.35 1 (Debian)) id 1DfHFp-0004j8-00; Mon, 06 Jun 2005 06:02:57 -0700 Received: from caronte.webthatworks.it (82.56.87.219) by vsmtp14.tin.it (7.0.027) id 429D6F26001D65D9 for submit(a)bugs.debian.org; Mon, 6 Jun 2005 15:02:25 +0200 Received: from stige.webthatworks.it (stige.webthatworks.it [192.168.1.5]) by caronte.webthatworks.it (Postfix) with ESMTP id 33FA123049F for <submit(a)bugs.debian.org>; Mon, 6 Jun 2005 15:02:25 +0200 (CEST) Received: from stige.webthatworks.it (localhost [127.0.0.1]) by stige.webthatworks.it (Postfix) with SMTP id D9B6C294053 for <submit(a)bugs.debian.org>; Mon, 6 Jun 2005 15:02:24 +0200 (CEST) Date: Mon, 6 Jun 2005 15:02:24 +0200 From: Ivan Sergio Borgonovo <ivan.s.b(a)gmail.com> To: submit(a)bugs.debian.org Subject: Fw: drupal: uid default missing Message-Id: <20050606150224.141a7ddf(a)stige.webthatworks.it> Organization: WebThatWorks.it X-Mailer: Sylpheed-Claws 0.9.12 (GTK+ 1.2.10; i686-suse-linux) Mime-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit Delivered-To: submit(a)bugs.debian.org X-Spam-Checker-Version: SpamAssassin 2.60-bugs.debian.org_2005_01_02 (1.212-2003-09-23-exp) on spohr.debian.org X-Spam-Status: No, hits=-7.0 required=4.0 tests=BAYES_00,FW,HAS_PACKAGE autolearn=no version=2.60-bugs.debian.org_2005_01_02 X-Spam-Level: Package: drupal Version: 4.5.3-2 since: Unfortunately it's currently impossible to use the Debian mailing lists with a e-mail address that matches procmail's check for mail coming from a daemon. resending with different account. Sorry if duplicate ### Begin forwarded message: Date: Mon, 6 Jun 2005 10:56:26 +0200 From: Ivan Sergio Borgonovo <mail(a)webthatworks.it> To: submit(a)bugs.debian.org Subject: drupal: uid default missing Package: drupal Version: 4.5.3-2 Sarge DB used pgsql After last drupal update: 1) I had to reconfigure the drupal:drupal db password manually alter user drupal with password '*********'; [1] 2) after fixing 1) I had problem with sql complaining Warning: pg_query(): Query failed: ERROR: null value in column "uid" violates not-null constraint in /usr/share/drupal/includes/database.pgsql.inc on line 104 Fatal error: ERROR: null value in column "uid" violates not-null constraint query: INSERT INTO sessions (sid, hostname, timestamp) values('69437a8e168e57547ae7ac57036ae951', '82.56.87.219', 1118046481) in /usr/share/drupal/includes/database.pgsql.inc on line 121 (probably) fixed with: alter table sessions alter column uid set default 0; problems seems to be in: ./scripts/debian-update.php: $ret[] = update_sql("CREATE TABLE sessions (uid int(10) unsigned NOT NULL, sid varchar(32) NOT NULL default '', hostname varchar(128) NOT NULL default '' .... [1] it may not be a bug... maybe I just pressed enter too fast during update and I noticed it was asking for a password... but for the postgres user, and I typed enter with no password... thanks -- Ivan Sergio Borgonovo http://www.webthatworks.it ### end forwarded message: -- Ivan Sergio Borgonovo http://www.webthatworks.it --------------------------------------- Received: (at 312202-close) by bugs.debian.org; 11 Nov 2005 00:41:46 +0000 >From katie(a)ftp-master.debian.org Thu Nov 10 16:41:46 2005 Return-path: <katie(a)ftp-master.debian.org> Received: from katie by spohr.debian.org with local (Exim 4.50) id 1EaMpr-0006fr-Sn; Thu, 10 Nov 2005 16:32:07 -0800 From: Hilko Bengen <bengen(a)debian.org> To: 312202-close(a)bugs.debian.org X-Katie: $Revision: 1.56 $ Subject: Bug#312202: fixed in drupal 4.5.5-3 Message-Id: <E1EaMpr-0006fr-Sn(a)spohr.debian.org> Sender: Archive Administrator <katie(a)ftp-master.debian.org> Date: Thu, 10 Nov 2005 16:32:07 -0800 Delivered-To: 312202-close(a)bugs.debian.org X-Spam-Checker-Version: SpamAssassin 2.60-bugs.debian.org_2005_01_02 (1.212-2003-09-23-exp) on spohr.debian.org X-Spam-Level: X-Spam-Status: No, hits=-6.0 required=4.0 tests=BAYES_00,HAS_BUG_NUMBER autolearn=no version=2.60-bugs.debian.org_2005_01_02 Source: drupal Source-Version: 4.5.5-3 We believe that the bug you reported is fixed in the latest version of drupal, which is due to be installed in the Debian FTP archive: drupal_4.5.5-3.diff.gz to pool/main/d/drupal/drupal_4.5.5-3.diff.gz drupal_4.5.5-3.dsc to pool/main/d/drupal/drupal_4.5.5-3.dsc drupal_4.5.5-3_all.deb to pool/main/d/drupal/drupal_4.5.5-3_all.deb A summary of the changes between this version and the previous one is attached. Thank you for reporting the bug, which will now be closed. If you have further comments please address them to 312202(a)bugs.debian.org, and the maintainer will reopen the bug report if appropriate. Debian distribution maintenance software pp. Hilko Bengen <bengen(a)debian.org> (supplier of updated drupal package) (This message was generated automatically at their request; if you believe that there is a problem with it please contact the archive administrators by mailing ftpmaster(a)debian.org) -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Format: 1.7 Date: Fri, 11 Nov 2005 00:13:54 +0100 Source: drupal Binary: drupal Architecture: source all Version: 4.5.5-3 Distribution: unstable Urgency: low Maintainer: Hilko Bengen <bengen(a)debian.org> Changed-By: Hilko Bengen <bengen(a)debian.org> Description: drupal - fully-featured content management/discussion engine Closes: 312202 312230 319735 336719 Changes: drupal (4.5.5-3) unstable; urgency=low . * Pulled in includes/session.inc from upstream's 4.5 branch, updated database/database.pgsql. - Fixes "Users unable to log out" issue (Closes: #336719) - Fixes "uid default missing" issue (Closes: #312230, #312202, #319735) Files: 1e67c12d6f766f9ff2d930a5b4ebf4cb 609 web extra drupal_4.5.5-3.dsc 77dade82d81243815ebe99dc7c27037c 43990 web extra drupal_4.5.5-3.diff.gz ca260e977b91ebab1983894da4964108 483486 web extra drupal_4.5.5-3_all.deb -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.2 (GNU/Linux) iD8DBQFDc9hZUCgnLz/SlGgRAkZsAKCPnUSHWcXF/lj6XwLI4bN5ol70bQCfSREH KOHYW3u/nMrMUOWjmM7NoZA= =DJMN -----END PGP SIGNATURE-----

1 0

Bug#312202: marked as done (drupal: uid default missing)
by owner＠bugs.debian.org 11 Nov '05

11 Nov '05

Your message dated Thu, 10 Nov 2005 16:32:07 -0800 with message-id <E1EaMpr-0006fr-Sn(a)spohr.debian.org> and subject line Bug#312202: fixed in drupal 4.5.5-3 has caused the attached Bug report to be marked as done. This means that you claim that the problem has been dealt with. If this is not the case it is now your responsibility to reopen the Bug report if necessary, and/or fix the problem forthwith. (NB: If you are a system administrator and have no idea what I am talking about this indicates a serious mail system misconfiguration somewhere. Please contact me immediately.) Debian bug tracking system administrator (administrator, Debian Bugs database) -------------------------------------- Received: (at submit) by bugs.debian.org; 6 Jun 2005 08:56:59 +0000 >From mail(a)webthatworks.it Mon Jun 06 01:56:59 2005 Return-path: <mail(a)webthatworks.it> Received: from vsmtp14.tin.it [212.216.176.118] by spohr.debian.org with esmtp (Exim 3.35 1 (Debian)) id 1DfDPn-0001mT-00; Mon, 06 Jun 2005 01:56:59 -0700 Received: from caronte.webthatworks.it (82.56.87.219) by vsmtp14.tin.it (7.0.027) id 429D6F26001BE278 for submit(a)bugs.debian.org; Mon, 6 Jun 2005 10:56:27 +0200 Received: from stige.webthatworks.it (stige.webthatworks.it [192.168.1.5]) by caronte.webthatworks.it (Postfix) with ESMTP id 44C3A23049F for <submit(a)bugs.debian.org>; Mon, 6 Jun 2005 10:56:27 +0200 (CEST) Received: from stige.webthatworks.it (localhost [127.0.0.1]) by stige.webthatworks.it (Postfix) with SMTP id 20A12294053 for <submit(a)bugs.debian.org>; Mon, 6 Jun 2005 10:56:27 +0200 (CEST) Date: Mon, 6 Jun 2005 10:56:26 +0200 From: Ivan Sergio Borgonovo <mail(a)webthatworks.it> To: submit(a)bugs.debian.org Subject: drupal: uid default missing Message-Id: <20050606105626.66fcf905(a)stige.webthatworks.it> Organization: WebThatWorks.it X-Mailer: Sylpheed-Claws 0.9.12 (GTK+ 1.2.10; i686-suse-linux) Mime-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit Delivered-To: submit(a)bugs.debian.org X-Spam-Checker-Version: SpamAssassin 2.60-bugs.debian.org_2005_01_02 (1.212-2003-09-23-exp) on spohr.debian.org X-Spam-Status: No, hits=-6.5 required=4.0 tests=BAYES_10,HAS_PACKAGE autolearn=no version=2.60-bugs.debian.org_2005_01_02 X-Spam-Level: Package: drupal Version: 4.5.3-2 Sarge DB used pgsql After last drupal update: 1) I had to reconfigure the drupal:drupal db password manually alter user drupal with password '*********'; [1] 2) after fixing 1) I had problem with sql complaining Warning: pg_query(): Query failed: ERROR: null value in column "uid" violates not-null constraint in /usr/share/drupal/includes/database.pgsql.inc on line 104 Fatal error: ERROR: null value in column "uid" violates not-null constraint query: INSERT INTO sessions (sid, hostname, timestamp) values('69437a8e168e57547ae7ac57036ae951', '82.56.87.219', 1118046481) in /usr/share/drupal/includes/database.pgsql.inc on line 121 (probably) fixed with: alter table sessions alter column uid set default 0; problems seems to be in: ./scripts/debian-update.php: $ret[] = update_sql("CREATE TABLE sessions (uid int(10) unsigned NOT NULL, sid varchar(32) NOT NULL default '', hostname varchar(128) NOT NULL default '' .... [1] it may not be a bug... maybe I just pressed enter too fast during update and I noticed it was asking for a password... but for the postgres user, and I typed enter with no password... thanks -- Ivan Sergio Borgonovo http://www.webthatworks.it --------------------------------------- Received: (at 312202-close) by bugs.debian.org; 11 Nov 2005 00:41:46 +0000 >From katie(a)ftp-master.debian.org Thu Nov 10 16:41:46 2005 Return-path: <katie(a)ftp-master.debian.org> Received: from katie by spohr.debian.org with local (Exim 4.50) id 1EaMpr-0006fr-Sn; Thu, 10 Nov 2005 16:32:07 -0800 From: Hilko Bengen <bengen(a)debian.org> To: 312202-close(a)bugs.debian.org X-Katie: $Revision: 1.56 $ Subject: Bug#312202: fixed in drupal 4.5.5-3 Message-Id: <E1EaMpr-0006fr-Sn(a)spohr.debian.org> Sender: Archive Administrator <katie(a)ftp-master.debian.org> Date: Thu, 10 Nov 2005 16:32:07 -0800 Delivered-To: 312202-close(a)bugs.debian.org X-Spam-Checker-Version: SpamAssassin 2.60-bugs.debian.org_2005_01_02 (1.212-2003-09-23-exp) on spohr.debian.org X-Spam-Level: X-Spam-Status: No, hits=-6.0 required=4.0 tests=BAYES_00,HAS_BUG_NUMBER autolearn=no version=2.60-bugs.debian.org_2005_01_02 Source: drupal Source-Version: 4.5.5-3 We believe that the bug you reported is fixed in the latest version of drupal, which is due to be installed in the Debian FTP archive: drupal_4.5.5-3.diff.gz to pool/main/d/drupal/drupal_4.5.5-3.diff.gz drupal_4.5.5-3.dsc to pool/main/d/drupal/drupal_4.5.5-3.dsc drupal_4.5.5-3_all.deb to pool/main/d/drupal/drupal_4.5.5-3_all.deb A summary of the changes between this version and the previous one is attached. Thank you for reporting the bug, which will now be closed. If you have further comments please address them to 312202(a)bugs.debian.org, and the maintainer will reopen the bug report if appropriate. Debian distribution maintenance software pp. Hilko Bengen <bengen(a)debian.org> (supplier of updated drupal package) (This message was generated automatically at their request; if you believe that there is a problem with it please contact the archive administrators by mailing ftpmaster(a)debian.org) -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Format: 1.7 Date: Fri, 11 Nov 2005 00:13:54 +0100 Source: drupal Binary: drupal Architecture: source all Version: 4.5.5-3 Distribution: unstable Urgency: low Maintainer: Hilko Bengen <bengen(a)debian.org> Changed-By: Hilko Bengen <bengen(a)debian.org> Description: drupal - fully-featured content management/discussion engine Closes: 312202 312230 319735 336719 Changes: drupal (4.5.5-3) unstable; urgency=low . * Pulled in includes/session.inc from upstream's 4.5 branch, updated database/database.pgsql. - Fixes "Users unable to log out" issue (Closes: #336719) - Fixes "uid default missing" issue (Closes: #312230, #312202, #319735) Files: 1e67c12d6f766f9ff2d930a5b4ebf4cb 609 web extra drupal_4.5.5-3.dsc 77dade82d81243815ebe99dc7c27037c 43990 web extra drupal_4.5.5-3.diff.gz ca260e977b91ebab1983894da4964108 483486 web extra drupal_4.5.5-3_all.deb -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.2 (GNU/Linux) iD8DBQFDc9hZUCgnLz/SlGgRAkZsAKCPnUSHWcXF/lj6XwLI4bN5ol70bQCfSREH KOHYW3u/nMrMUOWjmM7NoZA= =DJMN -----END PGP SIGNATURE-----

1 0

[drupal-devel] Securing Login: MD5 password hashing using javascript
by Fabio Varesano 10 Nov '05

10 Nov '05

NOTE: This is a copy of http://drupal.org/node/36793 where you can find the patch i'm talking about Hello everybody. Drupal sends login password using plain text wich makes really easy password sniffing. (ever tried ethereal in an hub connected lan???) It is possible to secure sending of password using md5 hashes on the client side using javascript. A good example and explaination of this could be found at http://pajhome.org.uk/crypt/md5/auth.html here some demo: http://pajhome.org.uk/crypt/md5/chaplogin.html The patch attached is a first attempt in changing login procedure to let user browser do the md5 password hasing before send it. While an attacker can still use it for logging in to the drupal site this prevents to reuse the password on other sistems where the user has an account. A more advanced usage of this technique is implementing a "challenge response" system as described in http://pajhome.org.uk/crypt/md5/auth.html Yahoo! Mail Italia use this. Also Yahoo! Mail International seems use it. This patch is only for demostration. Fabio Varesano

6 5

Re: development Digest, Vol 35, Issue 28
by David K Norman 10 Nov '05

10 Nov '05

But if someone can sniff the password, there's a reasonable chance they can also do a man in the middle attack to insert malicious javascript to send the password in the clear anyway. It really seems like all you're doing is confusing novice admins as to whether they'll need SSL or not to protect communications. > Message: 4 > Date: Wed, 9 Nov 2005 22:49:34 -0500 > From: Moshe Weitzman <weitzman(a)tejasa.com> > Subject: Re: [development] Re: [drupal-devel] Securing Login: MD5 > password hashing using javascript > getting back to the topic, i'd love to see javascript hashing of > password. this is used in phpmyadmin and many other projects. > > keyloggers have nothing to do with this. do folks think they are > being smart when they post 'but this won't stop a keylogger'? no > shit. that sort of post only serves to derail an otherwise useful > conversation. please resist the temptation.

1 0

Re: [drupal-devel] Securing Login: MD5 password hashing using javascript
by Pat Collins 10 Nov '05

10 Nov '05

On Tue, 8 Nov 2005 18:14:58 +0100, =?ISO-8859-1?Q?Konstantin_K=E4fer?= <kkaefer(a)gmail.com> wrote : > Hello, > > Why should sending the password hashed increase security? Just get the > hashed password and provide that to the script (of course not by > entering it in the password field but by "faking" the HTTP POST > values). > > The only way to protect the password is using SSL or TLS. > True, but not everybody can use ssl/tls. What about some kind of authentication checking where the site would keep track of where you have logged in from and upon detection of a change would prompt you with a question that only you would know or send you an email that you would have to respond to before you could gain access? Pat

12 27

crazy api idea #19423
by Adrian Rossouw 10 Nov '05

10 Nov '05

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 So, i was having to disable tinymce in my user profile because it didn't like my browser.. and i realized we have the same variable in two places. 1) system wide 2) per user. And then I realized we had the same thing in several places (themes for instance), and I thought, why not just codify this. Add an 'id' and a 'region' < bad word> to the variable table, and then allow the same function to set variables on whichever region (system, theme, style, user .. etc?) we need. You could have a default preference (ie: 'defaults', 'system', 'section', 'user') [ i'll explain about the section later ] Each new 'region' that gets added to the stack would just need to be initialized .. ie : variable_initialize('user', $user->uid); variable_initialize('section', $GLOBALS['section']); - -- Adrian Rossouw Drupal developer and Bryght Guy http://drupal.org | http://bryght.com -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.4 (Darwin) iD8DBQFDc2IsgegMqdGlkasRAnvEAKDgNwKgJ4AT5vLPluF1Oy7rj6VcKACcDFUc 138msUYWoGUgXMBe0GwrDDc= =97/J -----END PGP SIGNATURE-----

1 0

Does someone assign incoming issues?
by Jonathan Kamens 10 Nov '05

10 Nov '05

Once I've contributed a module to drupal.org and that module has been published, I assume that people will start submitting issues against it. How do those issues get assigned to me? Are there people monitoring the issues queue and assigning issues to the owners of their modules? Do I need to manually check the queue on a regular basis to find out if issues have been submitted against my modules? Thanks, jik

6 5

Re: [development] Securing Login: MD5 password hashing using javascript
by Pat Collins 09 Nov '05

09 Nov '05

On Wed, 9 Nov 2005 11:40:11 -0500, Khalid B <kb(a)2bits.com> wrote : > > This doesn't even begin to address spyware/keyloggers. The the only > > solution is ssl/tls since you are still sending the data in clear text over > > an unsecured network. But even in that case a locally installed keylogger > > will get your passwords no matter what. > > Spyware keyloggers will still compromise passwords even if SSL is > used, since they are a local thing on the PC that captures keystroke. > > SSL is no solution to that. > Didn't I just say that? If not I meant too. :) So here is my vote no vote for MD5 via javascript. Pat

3 2

Important mailing list change
by Dries Buytaert 09 Nov '05

09 Nov '05

Hello world, this mailing list changed name: instead of drupal-devel(a)drupal.org, the mailing list is now called development(a)drupal.org. The 'drupal-' prefix was a left-over from the drop.org era. Note that the old e- mail address will continue to work. Nonetheless, it's a good idea to update your address book and filters. Thanks, -- Dries Buytaert :: http://www.buytaert.net/

7 10