November 2005 - Development - lists.drupal.org

Re: [development] Securing Login: MD5 password hashing using javascript
by Pat Collins 09 Nov '05

09 Nov '05

On Wed, 9 Nov 2005 10:53:29 -0500, Syscrusher <scott(a)4th.com> wrote : > > This nonce or one-time-pad technique is very common in authentication schemes. > It won't stop a playback or man-in-the-middle attack, but it *does* keep the > actual MD5 of the password from being exposed. The only cleartext sent is > the nonce, and the only MD5 sent is one that included the nonce in its > creation. > This doesn't even begin to address spyware/keyloggers. The the only solution is ssl/tls since you are still sending the data in clear text over an unsecured network. But even in that case a locally installed keylogger will get your passwords no matter what. My previous email message about keeping track of where the user is logged in from, by IP or ISP assigned IP block, would be a much better solution if you don't have or can't use ssl/tls. Kind of like smtp-auth for the web. Pat

2 1

interesting idea for a forms module
by Adrian Rossouw 09 Nov '05

09 Nov '05

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 It should be possible to write a module with a hook_form_execute implementation, that saves the data submitted for each form id, including the previous defaults. meaning you can have revision history on your admin / user settings (well, apart from between upgrades. - -- Adrian Rossouw Drupal developer and Bryght Guy http://drupal.org | http://bryght.com -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.4 (Darwin) iD8DBQFDciHMgegMqdGlkasRAgdSAKDUS1T7tuQgkQLAJPZBFnP/SaowygCg1LrD lykdXED2VC+mU0mZDn40Lec= =Hl9Y -----END PGP SIGNATURE-----

2 1

Re: [drupal-devel] new CVS accounts
by Kobus Myburgh 09 Nov '05

09 Nov '05

> However, we have a third custom module which I'm not sure yet whether > I'm going to try to contribute to the community. It's called > "school_directory", and it provides a browseable, searchable directory > of a school's parents, students and staff, including photos for > parents and staff. I'm not sure it's in a contributable state because This would be very useful to me :-) Even in it's "rough around the edges" state. I am maintaining 2 schools' sites and at the moment we use the plain ole members module to give us some idea of the users on the site. I would love to see this! Welcome to Drupal! Kobus

3 2

Leafish: Drupal Services
by Paul Byrne 09 Nov '05

09 Nov '05

Hi, We were wondering if there's a possibility of including Leafish [1] on the Drupal list of services [2]. There's a fair bit of information on us and our services on our site, but to summarize: * We are a North Wales (UK) based web design, development and hosting company. Dylan Sides and myself are the founders and main developers/designers. * We provide Linux based hosting, with all the necessary features required to run any kind of Drupal site, from simple static sites, through blogs and community forums, right up to e-commerce sites. We can also provide e-commerce sites with osCommerce. Our hosting comes with POP3, IMAP, SSH, PHP, MySQL, Majordomo mailing lists etc etc. * We have had several years experience in using Drupal and many contributed modules. We have made small contributions to core code, and have written several custom-built modules and themes for our clients. * We can also provide Drupal consultancy for existing sites and projects. For example, custom themes, additional custom modules and administration of Drupal sites. [1] http://www.leafish.co.uk [2] http://drupal.org/services Cheers. Feel free to get in touch if you need more information! Paul -- paul byrne e-mail: paul(a)leafish.co.uk web: http://paul.leafish.co.uk http://www.leafish.co.uk

2 1

[drupal-devel] Menu otf settings
by Richard Archer 09 Nov '05

09 Nov '05

I have created a patch which I think greatly enhances the Menu settings options on edit node forms. It allows the menu weight and description to be entered. And the admin can restrict the options that show up in the Parent items drop-down. This is especially useful in combo with the Primary links feature. I'd appreciate it if someone could review this patch and leave me some feedback on usability and usefulness. ...Richard.

3 3

[drupal-devel] module and theme names
by Karoly Negyesi 08 Nov '05

08 Nov '05

Fellow developers, for the second time in three months I named my module the same as the theme. Do not do this. :) Should we put a safety belt somewhere in system to protect stupid developers like me from the effects? (like theme_comment going to an awfully wrong place...) Regards NK

4 4

Re: [drupal-devel] Securing Login: MD5 password hashing using javascript
by Pat Collins 08 Nov '05

08 Nov '05

On Tue, 8 Nov 2005 19:45:53 +0200, Adrian Rossouw <adrian(a)bryght.com> wrote : > > True, but not everybody can use ssl/tls. What about some kind of > > authentication checking where the site would keep track of where > > you have > > logged in from and upon detection of a change would prompt you with a > > question that only you would know or send you an email that you > > would have > > to respond to before you could gain access? > Like certain ISP's that change the ip of the user with ever request ? > > 'where you have logged in from' is mostly impossible to determine. > They may change their IP, but that IP can be tied to who owns that block. Pat

1 0

[drupal-devel] If you are not running at least 4.6.2/4.5.4...
by Karoly Negyesi 08 Nov '05

08 Nov '05

Welcome, There is now a malware in the wild which randomly and massively attacks hosts that has a specific XML-RPC bug. We fixed this bug back in June, but if you are still running an old version, then UPGRADE NOW! Latest versions of 4.6 and 4.5 are available at http://drupal.org/drupal-4.6.3 Best regards Karoly Negyesi Security team leader

2 1

[drupal-devel] [OTAnn] Feedback
by shenanigans 07 Nov '05

07 Nov '05

I was interested in getting feedback from current mail group users. We have mirrored your mail list in a new application that provides a more aggregated and safe environment which utilizes the power of broadband. Roomity.com v 1.5 is a web 2.01 community webapp. Our newest version adds broadcast video and social networking such as favorite authors and an html editor. It?s free to join and any feedback would be appreciated. S. ---------------------------------------------------------------------------------------------------------------------------------------- Broadband interface (RIA) + mail box saftey = <a href="http://Drupal_Developers_List.roomity.com">Drupal_Developers_List.roomity.com</a> *Your* clubs, no sign up to read, ad supported; try broadband internet. ~~1131397871389~~ ----------------------------------------------------------------------------------------------------------------------------------------

1 0

[drupal-devel] Imagemagick
by Adrian Rossouw 07 Nov '05

07 Nov '05

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Anyone here with a solid understanding of ImageMagick? I am going to be working on my next generation style.module, which allows you to customize the colour schemes of your site, and I want to use imagemagick to allow you to re-composite the images (like for instance changing the colour of the gradient overlay in pushbutton to the new colour you have chosen, or changing the colour of the backgrounds of rounded corners) Now, I could learn to do all this myself, but I thought I would ask to find out if someone has already done the work of learning how to use imagemagick properly, which would allow us to get the module off the ground much quicker. - -- Adrian Rossouw Drupal developer and Bryght Guy http://drupal.org | http://bryght.com -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.4 (Darwin) iD8DBQFDb5FXgegMqdGlkasRAjmPAKDeWHLr/6bWZss2SoruImsCUTs8dACfb1do 7ysi4MbcavXQqqYeobje+IY= =hwMX -----END PGP SIGNATURE-----

2 1