March 2005 - Development - lists.drupal.org

[drupal-devel] I/O exception occurred: Connection refused: I HATE YOU
by Robert Douglass 21 Mar '05

21 Mar '05

I suppose I'm not supposed to take this personally, but one really could think of a nicer message to send when refusing a connection. This appears when I try to access cvs.drupal.org. Yesterday I updated my cvs paths from drupal.org to cvs.drupal.org and everything was once again groovy, but today I can't access cvs.drupal.org. Is it just me and my lack of CVS skills? -Robert

4 3

[drupal-devel] [feature] Have taxonomy_select_nodes() Return node.title
by CodeMonkeyX 20 Mar '05

20 Mar '05

Issue status update for http://drupal.org/node/19193 Project: Drupal Version: cvs Component: taxonomy.module Category: feature requests Priority: minor Assigned to: CodeMonkeyX Reported by: CodeMonkeyX Updated by: CodeMonkeyX Status: patch Attachment: http://drupal.org/files/issues/taxonomy.module_6.patch (1.7 KB) Currently taxonomy_select_nodes() only queries the database for n.nid, n.sticky, n.created. This is fine when you only need to call node_load on each of the results, But it will be much more useful if you the function also queried the database for n.title aswell. Then the results could be past directly to node_title_list. Adding n.title to the database query will have no effect on the existing compatability of the function, and will simply make the function a more useful. Currently only my Article module will benifit from this change (it will remove the need for me to duplicate the function in my module), but I think after this change more developers may find this method useful for easily listing node titles from a group of taxonmoies. CodeMonkeyX

1 0

[drupal-devel] [bug] Problem with recent form_item / form_select change
by wiz 20 Mar '05

20 Mar '05

Issue status update for http://drupal.org/node/19011 Project: Drupal Version: cvs Component: taxonomy.module Category: bug reports Priority: normal Assigned to: Anonymous Reported by: wiz Updated by: wiz Status: patch Attachment: http://drupal.org/files/issues/taxonomy-multiple.patch (517 bytes) _taxonomy_term_select has been changed to use form_select instead of form_item: return form_select($title, $name .'][', $value, $options, $description, $multiple ? 'size="'. min(12, count($options)) .'"' : 0, $multiple); This breaks when $multiple is TRUE, as form_select will add "[]" to $name again! wiz

3 3

[drupal-devel] [task] Make book navigation links themable
by TDobes 20 Mar '05

20 Mar '05

Issue status update for http://drupal.org/node/19169 Project: Drupal Version: cvs Component: book.module Category: tasks Priority: normal Assigned to: TDobes Reported by: TDobes Updated by: TDobes Status: patch Attachment: http://drupal.org/files/issues/theme_book_nav_links.patch (1017 bytes) At the moment, book navigation links are not themable. This is a problem for sites that wish to change where these links are displayed. (i.e. if they want to display them above the node body rather than below) The simple attached patch renames book_navigation to theme_book_navigation and replaces the sole call to this function with an appropriate theme call. TDobes

3 2

[drupal-devel] Unpublished nodes still viewable?
by K B 20 Mar '05

20 Mar '05

Hi. If you read this thread http://drupal.org/node/19131 you will see that there is a different behavior of unpublished nodes from 4.5.x to 4.6. Basically, what they have seen is that the unpublished node does not appear in node lists, but typing its URL directly makes it viewable. Is this a by design behavior or a side effect or a bug? If it is a bug, should an issue be sumbitted for this?

2 3

[drupal-devel] Clean URL test causing problems
by Tim Altman 20 Mar '05

20 Mar '05

Greetings, The new clean URL test[1] in 4.6 causes problems for sites using HTTP auth. The call to /system/test through drupal_http_request() fails because the username/password is unknown to Drupal. Can anyone think of something that can be done to make the test work behind HTTP auth? [1] http://drupal.org/node/12384 -- Tim Altman

3 4

[drupal-devel] [bug] Bypass access via comments
by Anonymous 20 Mar '05

20 Mar '05

Issue status update for http://drupal.org/node/19009 Project: Drupal Version: cvs Component: comment.module Category: bug reports Priority: critical Assigned to: chx Reported by: nazadus Updated by: Anonymous Status: patch The patch looks good now. I agree that centralizing the node_access checking should be another task. This patch is needed now and should also be backported to the 4.5 branch. Gerhard Anonymous Previous comments: ------------------------------------------------------------------------ March 16, 2005 - 19:39 : nazadus I believe I have found a bug. If you goto http://www.etherpunk.com/comment/reply/180 (possibly NSFW) it allows you to view the posting (while you don't have permission to actually post, it still allows the page to get displayed). I found this out by using awstats on my box and found that a hidden page was getting hit fairly common that I really don't want getting shown (well, it's on the web, I know... but... I'd rather have more controlled access). Does this belong in the comment section for not obeying TAC? Can anyone confirm this on their site? Kenny ------------------------------------------------------------------------ March 16, 2005 - 20:02 : pyromanfo That's definitely something you need to take up with the comment module guys. It's not just taxonomy access control either, it's the core node_access hooks in Drupal. If they'll just check that before displaying a node for reply, that'd fix it no problem. ------------------------------------------------------------------------ March 16, 2005 - 20:20 : moshe weitzman filed under comment.module ... note that my big comment patch gets rid of this page entirely (consolidates under comment/edit) so it might make sense to apply my patch instead of fixing this. ------------------------------------------------------------------------ March 20, 2005 - 02:14 : chx Attachment: http://drupal.org/files/issues/comment_reply_access.patch (1.36 KB) moshe , http://drupal.org/node/18656 this does not seem to affect the permissions of the comment/reply path. I think the approach I have taken is blatantly simple: literally check for access. ------------------------------------------------------------------------ March 20, 2005 - 02:24 : chx Attachment: http://drupal.org/files/issues/comment_reply_access_0.patch (1.51 KB) ------------------------------------------------------------------------ March 20, 2005 - 02:37 : chx Attachment: http://drupal.org/files/issues/comment_reply_access_1.patch (1.56 KB) ------------------------------------------------------------------------ March 20, 2005 - 02:38 : chx Attachment: http://drupal.org/files/issues/comment_reply_access_2.patch (1.56 KB) ------------------------------------------------------------------------ March 20, 2005 - 08:48 : Anonymous The discovery of this patch makes me wonder, whether we shouldn't centralize the access controll a bit more. If a core module can show this kind of bug, contrib modules will almost certainly. I propose to do a node_access() check inside node_load. Gerhard ------------------------------------------------------------------------ March 20, 2005 - 09:03 : Anonymous I also don't think that the patch is working. node_access(arg(2)) should probably be node_access('view', $node) and the node needs loading before. Gerhard ------------------------------------------------------------------------ March 20, 2005 - 09:28 : chx Attachment: http://drupal.org/files/issues/comment_reply_access_3.patch (1.61 KB) OK, patch corrected. I think adding node_access to node_load would break havoc 'cos there are some routines (even in core) which do not check whether the node_load was successful or not. This is a whole another topic, please make another issue. What we need, IMHO is to patch this quickly... ------------------------------------------------------------------------ March 20, 2005 - 09:31 : chx Attachment: http://drupal.org/files/issues/comment_reply_access_4.patch (1.65 KB) I also forgot to check whether node_load was successful or not... ------------------------------------------------------------------------ March 20, 2005 - 09:31 : chx Attachment: http://drupal.org/files/issues/comment_reply_access_5.patch (1.65 KB)

1 0

[drupal-devel] [bug] Bypass access via comments
by chx 20 Mar '05

20 Mar '05

Issue status update for http://drupal.org/node/19009 Project: Drupal Version: cvs Component: comment.module Category: bug reports Priority: critical Assigned to: chx Reported by: nazadus Updated by: chx Status: patch Attachment: http://drupal.org/files/issues/comment_reply_access_5.patch (1.65 KB) chx Previous comments: ------------------------------------------------------------------------ March 16, 2005 - 20:39 : nazadus I believe I have found a bug. If you goto http://www.etherpunk.com/comment/reply/180 (possibly NSFW) it allows you to view the posting (while you don't have permission to actually post, it still allows the page to get displayed). I found this out by using awstats on my box and found that a hidden page was getting hit fairly common that I really don't want getting shown (well, it's on the web, I know... but... I'd rather have more controlled access). Does this belong in the comment section for not obeying TAC? Can anyone confirm this on their site? Kenny ------------------------------------------------------------------------ March 16, 2005 - 21:02 : pyromanfo That's definitely something you need to take up with the comment module guys. It's not just taxonomy access control either, it's the core node_access hooks in Drupal. If they'll just check that before displaying a node for reply, that'd fix it no problem. ------------------------------------------------------------------------ March 16, 2005 - 21:20 : moshe weitzman filed under comment.module ... note that my big comment patch gets rid of this page entirely (consolidates under comment/edit) so it might make sense to apply my patch instead of fixing this. ------------------------------------------------------------------------ March 20, 2005 - 03:14 : chx Attachment: http://drupal.org/files/issues/comment_reply_access.patch (1.36 KB) moshe , http://drupal.org/node/18656 this does not seem to affect the permissions of the comment/reply path. I think the approach I have taken is blatantly simple: literally check for access. ------------------------------------------------------------------------ March 20, 2005 - 03:24 : chx Attachment: http://drupal.org/files/issues/comment_reply_access_0.patch (1.51 KB) ------------------------------------------------------------------------ March 20, 2005 - 03:37 : chx Attachment: http://drupal.org/files/issues/comment_reply_access_1.patch (1.56 KB) ------------------------------------------------------------------------ March 20, 2005 - 03:38 : chx Attachment: http://drupal.org/files/issues/comment_reply_access_2.patch (1.56 KB) ------------------------------------------------------------------------ March 20, 2005 - 09:48 : Anonymous The discovery of this patch makes me wonder, whether we shouldn't centralize the access controll a bit more. If a core module can show this kind of bug, contrib modules will almost certainly. I propose to do a node_access() check inside node_load. Gerhard ------------------------------------------------------------------------ March 20, 2005 - 10:03 : Anonymous I also don't think that the patch is working. node_access(arg(2)) should probably be node_access('view', $node) and the node needs loading before. Gerhard ------------------------------------------------------------------------ March 20, 2005 - 10:28 : chx Attachment: http://drupal.org/files/issues/comment_reply_access_3.patch (1.61 KB) OK, patch corrected. I think adding node_access to node_load would break havoc 'cos there are some routines (even in core) which do not check whether the node_load was successful or not. This is a whole another topic, please make another issue. What we need, IMHO is to patch this quickly... ------------------------------------------------------------------------ March 20, 2005 - 10:31 : chx Attachment: http://drupal.org/files/issues/comment_reply_access_4.patch (1.65 KB) I also forgot to check whether node_load was successful or not...

1 0

[drupal-devel] [bug] Bypass access via comments
by chx 20 Mar '05

20 Mar '05

Issue status update for http://drupal.org/node/19009 Project: Drupal Version: cvs Component: comment.module Category: bug reports Priority: critical Assigned to: chx Reported by: nazadus Updated by: chx Status: patch Attachment: http://drupal.org/files/issues/comment_reply_access_4.patch (1.65 KB) I also forgot to check whether node_load was successful or not... chx Previous comments: ------------------------------------------------------------------------ March 16, 2005 - 20:39 : nazadus I believe I have found a bug. If you goto http://www.etherpunk.com/comment/reply/180 (possibly NSFW) it allows you to view the posting (while you don't have permission to actually post, it still allows the page to get displayed). I found this out by using awstats on my box and found that a hidden page was getting hit fairly common that I really don't want getting shown (well, it's on the web, I know... but... I'd rather have more controlled access). Does this belong in the comment section for not obeying TAC? Can anyone confirm this on their site? Kenny ------------------------------------------------------------------------ March 16, 2005 - 21:02 : pyromanfo That's definitely something you need to take up with the comment module guys. It's not just taxonomy access control either, it's the core node_access hooks in Drupal. If they'll just check that before displaying a node for reply, that'd fix it no problem. ------------------------------------------------------------------------ March 16, 2005 - 21:20 : moshe weitzman filed under comment.module ... note that my big comment patch gets rid of this page entirely (consolidates under comment/edit) so it might make sense to apply my patch instead of fixing this. ------------------------------------------------------------------------ March 20, 2005 - 03:14 : chx Attachment: http://drupal.org/files/issues/comment_reply_access.patch (1.36 KB) moshe , http://drupal.org/node/18656 this does not seem to affect the permissions of the comment/reply path. I think the approach I have taken is blatantly simple: literally check for access. ------------------------------------------------------------------------ March 20, 2005 - 03:24 : chx Attachment: http://drupal.org/files/issues/comment_reply_access_0.patch (1.51 KB) ------------------------------------------------------------------------ March 20, 2005 - 03:37 : chx Attachment: http://drupal.org/files/issues/comment_reply_access_1.patch (1.56 KB) ------------------------------------------------------------------------ March 20, 2005 - 03:38 : chx Attachment: http://drupal.org/files/issues/comment_reply_access_2.patch (1.56 KB) ------------------------------------------------------------------------ March 20, 2005 - 09:48 : Anonymous The discovery of this patch makes me wonder, whether we shouldn't centralize the access controll a bit more. If a core module can show this kind of bug, contrib modules will almost certainly. I propose to do a node_access() check inside node_load. Gerhard ------------------------------------------------------------------------ March 20, 2005 - 10:03 : Anonymous I also don't think that the patch is working. node_access(arg(2)) should probably be node_access('view', $node) and the node needs loading before. Gerhard ------------------------------------------------------------------------ March 20, 2005 - 10:28 : chx Attachment: http://drupal.org/files/issues/comment_reply_access_3.patch (1.61 KB) OK, patch corrected. I think adding node_access to node_load would break havoc 'cos there are some routines (even in core) which do not check whether the node_load was successful or not. This is a whole another topic, please make another issue. What we need, IMHO is to patch this quickly...

1 0

[drupal-devel] [bug] Bypass access via comments
by chx 20 Mar '05

20 Mar '05

Issue status update for http://drupal.org/node/19009 Project: Drupal Version: cvs Component: comment.module Category: bug reports Priority: critical Assigned to: chx Reported by: nazadus Updated by: chx -Status: active +Status: patch Attachment: http://drupal.org/files/issues/comment_reply_access_3.patch (1.61 KB) OK, patch corrected. I think adding node_access to node_load would break havoc 'cos there are some routines (even in core) which do not check whether the node_load was successful or not. This is a whole another topic, please make another issue. What we need, IMHO is to patch this quickly... chx Previous comments: ------------------------------------------------------------------------ March 16, 2005 - 20:39 : nazadus I believe I have found a bug. If you goto http://www.etherpunk.com/comment/reply/180 (possibly NSFW) it allows you to view the posting (while you don't have permission to actually post, it still allows the page to get displayed). I found this out by using awstats on my box and found that a hidden page was getting hit fairly common that I really don't want getting shown (well, it's on the web, I know... but... I'd rather have more controlled access). Does this belong in the comment section for not obeying TAC? Can anyone confirm this on their site? Kenny ------------------------------------------------------------------------ March 16, 2005 - 21:02 : pyromanfo That's definitely something you need to take up with the comment module guys. It's not just taxonomy access control either, it's the core node_access hooks in Drupal. If they'll just check that before displaying a node for reply, that'd fix it no problem. ------------------------------------------------------------------------ March 16, 2005 - 21:20 : moshe weitzman filed under comment.module ... note that my big comment patch gets rid of this page entirely (consolidates under comment/edit) so it might make sense to apply my patch instead of fixing this. ------------------------------------------------------------------------ March 20, 2005 - 03:14 : chx Attachment: http://drupal.org/files/issues/comment_reply_access.patch (1.36 KB) moshe , http://drupal.org/node/18656 this does not seem to affect the permissions of the comment/reply path. I think the approach I have taken is blatantly simple: literally check for access. ------------------------------------------------------------------------ March 20, 2005 - 03:24 : chx Attachment: http://drupal.org/files/issues/comment_reply_access_0.patch (1.51 KB) ------------------------------------------------------------------------ March 20, 2005 - 03:37 : chx Attachment: http://drupal.org/files/issues/comment_reply_access_1.patch (1.56 KB) ------------------------------------------------------------------------ March 20, 2005 - 03:38 : chx Attachment: http://drupal.org/files/issues/comment_reply_access_2.patch (1.56 KB) ------------------------------------------------------------------------ March 20, 2005 - 09:48 : Anonymous The discovery of this patch makes me wonder, whether we shouldn't centralize the access controll a bit more. If a core module can show this kind of bug, contrib modules will almost certainly. I propose to do a node_access() check inside node_load. Gerhard ------------------------------------------------------------------------ March 20, 2005 - 10:03 : Anonymous I also don't think that the patch is working. node_access(arg(2)) should probably be node_access('view', $node) and the node needs loading before. Gerhard

1 0