March 2005 - Development - lists.drupal.org

[drupal-devel] [bug] Image handling block on settings page provides no information if no toolkits are installed
by Mad Maks 20 Mar '05

20 Mar '05

Issue status update for http://drupal.org/node/18093 Project: Drupal Version: cvs Component: system.module Category: bug reports Priority: normal Assigned to: Anonymous Reported by: Mad Maks Updated by: Mad Maks Status: patch thanks Mad Maks Previous comments: ------------------------------------------------------------------------ February 28, 2005 - 10:28 : Mad Maks i have installed the cvs version yesterday (upgrade from 4.5.2) and now i see at administration => settings a block with the titel image handeling. But in that block there is nothing except a "1" . Is this a now bug or did i do something wrong? greetings MM ------------------------------------------------------------------------ March 1, 2005 - 09:24 : Mad Maks nobody? ------------------------------------------------------------------------ March 9, 2005 - 11:41 : Mad Maks BrianH has posted a screenshot in http://drupal.org/node/18588 ------------------------------------------------------------------------ March 19, 2005 - 21:25 : Junyor Attachment: http://drupal.org/files/issues/system_5.patch (976 bytes) I think the problem is that no image toolkits are installed at your host. Here's a patch that should clean up things a bit by adding information if no toolkits are available.

1 0

[drupal-devel] [bug] Bypass access via comments
by Anonymous 20 Mar '05

20 Mar '05

Issue status update for http://drupal.org/node/19009 Project: Drupal Version: cvs Component: comment.module Category: bug reports Priority: critical Assigned to: chx Reported by: nazadus Updated by: Anonymous Status: patch The discovery of this patch makes me wonder, whether we shouldn't centralize the access controll a bit more. If a core module can show this kind of bug, contrib modules will almost certainly. I propose to do a node_access() check inside node_load. Gerhard Anonymous Previous comments: ------------------------------------------------------------------------ March 16, 2005 - 19:39 : nazadus I believe I have found a bug. If you goto http://www.etherpunk.com/comment/reply/180 (possibly NSFW) it allows you to view the posting (while you don't have permission to actually post, it still allows the page to get displayed). I found this out by using awstats on my box and found that a hidden page was getting hit fairly common that I really don't want getting shown (well, it's on the web, I know... but... I'd rather have more controlled access). Does this belong in the comment section for not obeying TAC? Can anyone confirm this on their site? Kenny ------------------------------------------------------------------------ March 16, 2005 - 20:02 : pyromanfo That's definitely something you need to take up with the comment module guys. It's not just taxonomy access control either, it's the core node_access hooks in Drupal. If they'll just check that before displaying a node for reply, that'd fix it no problem. ------------------------------------------------------------------------ March 16, 2005 - 20:20 : moshe weitzman filed under comment.module ... note that my big comment patch gets rid of this page entirely (consolidates under comment/edit) so it might make sense to apply my patch instead of fixing this. ------------------------------------------------------------------------ March 20, 2005 - 02:14 : chx Attachment: http://drupal.org/files/issues/comment_reply_access.patch (1.36 KB) moshe , http://drupal.org/node/18656 this does not seem to affect the permissions of the comment/reply path. I think the approach I have taken is blatantly simple: literally check for access. ------------------------------------------------------------------------ March 20, 2005 - 02:24 : chx Attachment: http://drupal.org/files/issues/comment_reply_access_0.patch (1.51 KB) ------------------------------------------------------------------------ March 20, 2005 - 02:37 : chx Attachment: http://drupal.org/files/issues/comment_reply_access_1.patch (1.56 KB) ------------------------------------------------------------------------ March 20, 2005 - 02:38 : chx Attachment: http://drupal.org/files/issues/comment_reply_access_2.patch (1.56 KB)

1 0

[drupal-devel] [bug] Bypass access via comments
by chx 20 Mar '05

20 Mar '05

Issue status update for http://drupal.org/node/19009 Project: Drupal Version: cvs Component: comment.module Category: bug reports Priority: critical Assigned to: chx Reported by: nazadus Updated by: chx Status: patch Attachment: http://drupal.org/files/issues/comment_reply_access_2.patch (1.56 KB) chx Previous comments: ------------------------------------------------------------------------ March 16, 2005 - 20:39 : nazadus I believe I have found a bug. If you goto http://www.etherpunk.com/comment/reply/180 (possibly NSFW) it allows you to view the posting (while you don't have permission to actually post, it still allows the page to get displayed). I found this out by using awstats on my box and found that a hidden page was getting hit fairly common that I really don't want getting shown (well, it's on the web, I know... but... I'd rather have more controlled access). Does this belong in the comment section for not obeying TAC? Can anyone confirm this on their site? Kenny ------------------------------------------------------------------------ March 16, 2005 - 21:02 : pyromanfo That's definitely something you need to take up with the comment module guys. It's not just taxonomy access control either, it's the core node_access hooks in Drupal. If they'll just check that before displaying a node for reply, that'd fix it no problem. ------------------------------------------------------------------------ March 16, 2005 - 21:20 : moshe weitzman filed under comment.module ... note that my big comment patch gets rid of this page entirely (consolidates under comment/edit) so it might make sense to apply my patch instead of fixing this. ------------------------------------------------------------------------ March 20, 2005 - 03:14 : chx Attachment: http://drupal.org/files/issues/comment_reply_access.patch (1.36 KB) moshe , http://drupal.org/node/18656 this does not seem to affect the permissions of the comment/reply path. I think the approach I have taken is blatantly simple: literally check for access. ------------------------------------------------------------------------ March 20, 2005 - 03:24 : chx Attachment: http://drupal.org/files/issues/comment_reply_access_0.patch (1.51 KB) ------------------------------------------------------------------------ March 20, 2005 - 03:37 : chx Attachment: http://drupal.org/files/issues/comment_reply_access_1.patch (1.56 KB)

1 0

[drupal-devel] [bug] Bypass access via comments
by chx 20 Mar '05

20 Mar '05

Issue status update for http://drupal.org/node/19009 Project: Drupal Version: cvs Component: comment.module Category: bug reports Priority: critical Assigned to: chx Reported by: nazadus Updated by: chx Status: patch Attachment: http://drupal.org/files/issues/comment_reply_access_1.patch (1.56 KB) chx Previous comments: ------------------------------------------------------------------------ March 16, 2005 - 20:39 : nazadus I believe I have found a bug. If you goto http://www.etherpunk.com/comment/reply/180 (possibly NSFW) it allows you to view the posting (while you don't have permission to actually post, it still allows the page to get displayed). I found this out by using awstats on my box and found that a hidden page was getting hit fairly common that I really don't want getting shown (well, it's on the web, I know... but... I'd rather have more controlled access). Does this belong in the comment section for not obeying TAC? Can anyone confirm this on their site? Kenny ------------------------------------------------------------------------ March 16, 2005 - 21:02 : pyromanfo That's definitely something you need to take up with the comment module guys. It's not just taxonomy access control either, it's the core node_access hooks in Drupal. If they'll just check that before displaying a node for reply, that'd fix it no problem. ------------------------------------------------------------------------ March 16, 2005 - 21:20 : moshe weitzman filed under comment.module ... note that my big comment patch gets rid of this page entirely (consolidates under comment/edit) so it might make sense to apply my patch instead of fixing this. ------------------------------------------------------------------------ March 20, 2005 - 03:14 : chx Attachment: http://drupal.org/files/issues/comment_reply_access.patch (1.36 KB) moshe , http://drupal.org/node/18656 this does not seem to affect the permissions of the comment/reply path. I think the approach I have taken is blatantly simple: literally check for access. ------------------------------------------------------------------------ March 20, 2005 - 03:24 : chx Attachment: http://drupal.org/files/issues/comment_reply_access_0.patch (1.51 KB)

1 0

[drupal-devel] [bug] Bypass access via comments
by chx 20 Mar '05

20 Mar '05

Issue status update for http://drupal.org/node/19009 Project: Drupal -Version: cvs +Version: 4.5.2 Component: comment.module Category: bug reports Priority: critical Assigned to: chx Reported by: nazadus Updated by: chx Status: patch Attachment: http://drupal.org/files/issues/comment_reply_access_0.patch (1.51 KB) chx Previous comments: ------------------------------------------------------------------------ March 16, 2005 - 20:39 : nazadus I believe I have found a bug. If you goto http://www.etherpunk.com/comment/reply/180 (possibly NSFW) it allows you to view the posting (while you don't have permission to actually post, it still allows the page to get displayed). I found this out by using awstats on my box and found that a hidden page was getting hit fairly common that I really don't want getting shown (well, it's on the web, I know... but... I'd rather have more controlled access). Does this belong in the comment section for not obeying TAC? Can anyone confirm this on their site? Kenny ------------------------------------------------------------------------ March 16, 2005 - 21:02 : pyromanfo That's definitely something you need to take up with the comment module guys. It's not just taxonomy access control either, it's the core node_access hooks in Drupal. If they'll just check that before displaying a node for reply, that'd fix it no problem. ------------------------------------------------------------------------ March 16, 2005 - 21:20 : moshe weitzman filed under comment.module ... note that my big comment patch gets rid of this page entirely (consolidates under comment/edit) so it might make sense to apply my patch instead of fixing this. ------------------------------------------------------------------------ March 20, 2005 - 03:14 : chx Attachment: http://drupal.org/files/issues/comment_reply_access.patch (1.36 KB) moshe , http://drupal.org/node/18656 this does not seem to affect the permissions of the comment/reply path. I think the approach I have taken is blatantly simple: literally check for access.

1 0

[drupal-devel] [bug] Bypass access via comments
by chx 20 Mar '05

20 Mar '05

Issue status update for http://drupal.org/node/19009 Project: Drupal -Version: 4.5.2 +Version: cvs Component: comment.module Category: bug reports Priority: critical -Assigned to: Anonymous +Assigned to: chx Reported by: nazadus Updated by: chx -Status: active +Status: patch Attachment: http://drupal.org/files/issues/comment_reply_access.patch (1.36 KB) moshe , http://drupal.org/node/18656 this does not seem to affect the permissions of the comment/reply path. I think the approach I have taken is blatantly simple: literally check for access. chx Previous comments: ------------------------------------------------------------------------ March 16, 2005 - 20:39 : nazadus I believe I have found a bug. If you goto http://www.etherpunk.com/comment/reply/180 (possibly NSFW) it allows you to view the posting (while you don't have permission to actually post, it still allows the page to get displayed). I found this out by using awstats on my box and found that a hidden page was getting hit fairly common that I really don't want getting shown (well, it's on the web, I know... but... I'd rather have more controlled access). Does this belong in the comment section for not obeying TAC? Can anyone confirm this on their site? Kenny ------------------------------------------------------------------------ March 16, 2005 - 21:02 : pyromanfo That's definitely something you need to take up with the comment module guys. It's not just taxonomy access control either, it's the core node_access hooks in Drupal. If they'll just check that before displaying a node for reply, that'd fix it no problem. ------------------------------------------------------------------------ March 16, 2005 - 21:20 : moshe weitzman filed under comment.module ... note that my big comment patch gets rid of this page entirely (consolidates under comment/edit) so it might make sense to apply my patch instead of fixing this.

1 0

[drupal-devel] ann: any node can be blog : remove type "blog".
by Bèr Kessels 19 Mar '05

19 Mar '05

Hi all. I rewrote blog.module to become a container, something like book outlines. In these files, there no longer is a blog type node. With a checkbox (see screenshot) users with the correct permissions can add any node to their blog. Feel free to try, also feel free to improve these files, just mail me if you commit changes. http://cvs.drupal.org/viewcvs/drupal/contributions/sandbox/ber/blog/ Some notes, and maybe todos: I decided to remove the "blog this" funtionality completely. If we do blogs like this any-node-idea, the blog this should be handled by either node_aggregegator, or by a simpler feed_to_node.module. I have been thinking of a nicer way to track the nids that are in a blog. Now I introduce a new table with only one column! That is not very nice IMO, so if anyone knows better options, please let me know. FWIW: if CCK hits core, this problem will be solved, I guess. If a sql Guru would be so friendly to look at my LEFT JOINS and other queries, that would be great. They are as good as i can get them, but I figure someone with more knowledge in this might be able to improve the queries a little. I tried not to introduce any new functionality, nor remove any (unless for the blog this). The module is about as big as it was (~2 more or less), and will perform the same, afaiks. But benchmarks are welcome, I do not know how to do that. Regards, Bèr -- [ Bèr Kessels | Drupal services www.webschuur.com ]

6 8

[drupal-devel] [bug] Image handling block on settings page provides no information if no toolkits are installed
by Junyor 19 Mar '05

19 Mar '05

Issue status update for http://drupal.org/node/18093 Project: Drupal Version: cvs -Component: base system +Component: system.module Category: bug reports Priority: normal Assigned to: Anonymous Reported by: Mad Maks Updated by: Junyor -Status: active +Status: patch Attachment: http://drupal.org/files/issues/system_5.patch (976 bytes) I think the problem is that no image toolkits are installed at your host. Here's a patch that should clean up things a bit by adding information if no toolkits are available. Junyor Previous comments: ------------------------------------------------------------------------ February 28, 2005 - 10:28 : Mad Maks i have installed the cvs version yesterday (upgrade from 4.5.2) and now i see at administration => settings a block with the titel image handeling. But in that block there is nothing except a "1" . Is this a now bug or did i do something wrong? greetings MM ------------------------------------------------------------------------ March 1, 2005 - 09:24 : Mad Maks nobody? ------------------------------------------------------------------------ March 9, 2005 - 11:41 : Mad Maks BrianH has posted a screenshot in http://drupal.org/node/18588

1 0

[drupal-devel] Bug#293804: marked as done (drupal: manual upgrade not documented)
by owner＠bugs.debian.org 19 Mar '05

19 Mar '05

Your message dated Sat, 19 Mar 2005 13:32:43 -0500 with message-id <E1DCikd-0003VG-00(a)newraff.debian.org> and subject line Bug#293804: fixed in drupal 4.5.2-2 has caused the attached Bug report to be marked as done. This means that you claim that the problem has been dealt with. If this is not the case it is now your responsibility to reopen the Bug report if necessary, and/or fix the problem forthwith. (NB: If you are a system administrator and have no idea what I am talking about this indicates a serious mail system misconfiguration somewhere. Please contact me immediately.) Debian bug tracking system administrator (administrator, Debian Bugs database) -------------------------------------- Received: (at submit) by bugs.debian.org; 5 Feb 2005 21:51:38 +0000 >From jcollins(a)asgardsrealm.net Sat Feb 05 13:51:38 2005 Return-path: <jcollins(a)asgardsrealm.net> Received: from h-67-101-186-172.dnvtco56.covad.net (forseti.asgardsrealm.net) [67.101.186.172] by spohr.debian.org with esmtp (Exim 3.35 1 (Debian)) id 1CxXq6-0003q1-00; Sat, 05 Feb 2005 13:51:38 -0800 Received: from mimir.asgardsrealm.net ([192.168.10.4] helo=mimir ident=mail) by forseti.asgardsrealm.net with esmtp (Exim 4.34) id 1CxXpw-0003Tm-Ar; Sat, 05 Feb 2005 14:51:28 -0700 Received: from jcollins by mimir with local (Exim 3.36 #1 (Debian)) id 1CxXpv-0002bx-00; Sat, 05 Feb 2005 14:51:27 -0700 Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit From: "Jamin W. Collins" <jcollins(a)asgardsrealm.net> To: Debian Bug Tracking System <submit(a)bugs.debian.org> Subject: drupal: manual upgrade not documented X-Mailer: reportbug 3.2 Date: Sat, 05 Feb 2005 14:51:27 -0700 Message-Id: <E1CxXpv-0002bx-00@mimir> Sender: "Jamin W. Collins" <jcollins@mimir> Delivered-To: submit(a)bugs.debian.org X-Spam-Checker-Version: SpamAssassin 2.60-bugs.debian.org_2005_01_02 (1.212-2003-09-23-exp) on spohr.debian.org X-Spam-Status: No, hits=-8.0 required=4.0 tests=BAYES_00,HAS_PACKAGE autolearn=no version=2.60-bugs.debian.org_2005_01_02 X-Spam-Level: Package: drupal Version: 4.5.2-1 Severity: normal The manual upgrade procedure does not appear to be documented. A simple pointer to the update.php would be nice. It's nice that the package attempts to perform the upgrade itself, but in my case this would not have worked as the package looks for a previous installation version and this is a new install on this box with a prexisting DB. -- System Information: Debian Release: 3.1 APT prefers testing APT policy: (990, 'testing'), (500, 'unstable') Architecture: i386 (i586) Kernel: Linux 2.4.18-bf2.4 Locale: LANG=C, LC_CTYPE=C (charmap=ANSI_X3.4-1968) Versions of packages drupal depends on: ii apache2-mpm-prefork [apache2] 2.0.52-3 Traditional model for Apache2 ii debconf 1.4.30.11 Debian configuration management sy ii exim [mail-transport-agent] 3.36-11 An MTA (Mail Transport Agent) ii makepasswd 1.10-2 Generate and encrypt passwords ii mysql-client [virtual-mysql-c 4.0.23-1 mysql database client binaries ii php4-cli 4:4.3.10-2 command-line interpreter for the p ii php4-mysql 4:4.3.10-2 MySQL module for php4 ii wwwconfig-common 0.0.42 Debian web auto configuration -- debconf information: * drupal/remove_backups: false drupal/createuser_failed: * drupal/db_auto_update: false drupal/dropdb_failed: drupal/upgradedb_impossible: * drupal/dbgeneration: false drupal/dbtype: MySQL drupal/database_doremove: false drupal/createdb_failed: drupal/dbserver: localhost * drupal/webserver: apache2 drupal/upgradedb_failed: drupal/dbname: drupal drupal/dbuser: drupal drupal/dbadmin: root drupal/initdb_failed: drupal/conffile_failed: --------------------------------------- Received: (at 293804-close) by bugs.debian.org; 19 Mar 2005 18:50:36 +0000 >From katie(a)ftp-master.debian.org Sat Mar 19 10:50:35 2005 Return-path: <katie(a)ftp-master.debian.org> Received: from newraff.debian.org [208.185.25.31] (mail) by spohr.debian.org with esmtp (Exim 3.35 1 (Debian)) id 1DCj1v-0001nL-00; Sat, 19 Mar 2005 10:50:35 -0800 Received: from katie by newraff.debian.org with local (Exim 3.35 1 (Debian)) id 1DCikd-0003VG-00; Sat, 19 Mar 2005 13:32:43 -0500 From: Hilko Bengen <bengen(a)debian.org> To: 293804-close(a)bugs.debian.org X-Katie: $Revision: 1.55 $ Subject: Bug#293804: fixed in drupal 4.5.2-2 Message-Id: <E1DCikd-0003VG-00(a)newraff.debian.org> Sender: Archive Administrator <katie(a)ftp-master.debian.org> Date: Sat, 19 Mar 2005 13:32:43 -0500 Delivered-To: 293804-close(a)bugs.debian.org X-Spam-Checker-Version: SpamAssassin 2.60-bugs.debian.org_2005_01_02 (1.212-2003-09-23-exp) on spohr.debian.org X-Spam-Status: No, hits=-6.0 required=4.0 tests=BAYES_00,HAS_BUG_NUMBER autolearn=no version=2.60-bugs.debian.org_2005_01_02 X-Spam-Level: Source: drupal Source-Version: 4.5.2-2 We believe that the bug you reported is fixed in the latest version of drupal, which is due to be installed in the Debian FTP archive: drupal_4.5.2-2.diff.gz to pool/main/d/drupal/drupal_4.5.2-2.diff.gz drupal_4.5.2-2.dsc to pool/main/d/drupal/drupal_4.5.2-2.dsc drupal_4.5.2-2_all.deb to pool/main/d/drupal/drupal_4.5.2-2_all.deb A summary of the changes between this version and the previous one is attached. Thank you for reporting the bug, which will now be closed. If you have further comments please address them to 293804(a)bugs.debian.org, and the maintainer will reopen the bug report if appropriate. Debian distribution maintenance software pp. Hilko Bengen <bengen(a)debian.org> (supplier of updated drupal package) (This message was generated automatically at their request; if you believe that there is a problem with it please contact the archive administrators by mailing ftpmaster(a)debian.org) -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Format: 1.7 Date: Tue, 15 Mar 2005 15:16:26 +0100 Source: drupal Binary: drupal Architecture: source all Version: 4.5.2-2 Distribution: unstable Urgency: low Maintainer: Hilko Bengen <bengen(a)debian.org> Changed-By: Hilko Bengen <bengen(a)debian.org> Description: drupal - fully-featured content management/discussion engine Closes: 293804 Changes: drupal (4.5.2-2) unstable; urgency=low . * Changed includes/bootstrap.inc: conf.php (or $site.php) is loaded from /etc/drupal directly, without the need for any link. * Removed indentations from sed script which is used to edit the configuration file. * Rolled back session.inc to version found in 4.5.1; fixes bug documented in http://drupal.org/node/15666 * Added documentation about manual update procedure in README.Debian and Debconf templates (Closes: #293804) * Added documentation about adding modules and themes that are not part of the package. * NEWS.Debian mentions where to get Marvin and UnConeD themes that used to be part of the Drupal distribution. Files: e4d67083f6a93c62c9a5ccd2694f076d 609 web extra drupal_4.5.2-2.dsc 350b28f0e70815d7abb2a1fff6f43d3d 34095 web extra drupal_4.5.2-2.diff.gz 49ad395e430d0d8739fa23b95a4441b8 482708 web extra drupal_4.5.2-2_all.deb -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.0 (GNU/Linux) iD8DBQFCPGwSUCgnLz/SlGgRAsa8AKDgaywiXpWvPcpCt2QsvgZ9cl1HcQCg4ciP J6xgdLgWW3V8PyG5R3+UYkU= =wVHI -----END PGP SIGNATURE-----

1 0

[drupal-devel] [task] Minor cosmetic changes to .htaccess.
by Uwe Hermann 19 Mar '05

19 Mar '05

Issue status update for http://drupal.org/node/19126 Project: Drupal Version: cvs Component: base system Category: tasks Priority: minor Assigned to: Anonymous Reported by: Uwe Hermann Updated by: Uwe Hermann Status: patch Attachment: http://drupal.org/files/issues/htaccess_2.patch (1.41 KB) Here's a tiny patch which removes some whitespace for more consistency with the rest of the file and makes an S lowercase. Uwe Hermann

2 1