July 2005 - Development - lists.drupal.org

[drupal-devel] [bug] settings.php change to prevent PHPSESSID in URL
by kbahey 01 Aug '05

01 Aug '05

Issue status update for http://drupal.org/node/21170 Project: Drupal Version: 4.6.0 Component: other Category: bug reports Priority: normal Assigned to: kbahey Reported by: kbahey Updated by: kbahey Status: patch Attachment: http://drupal.org/files/issues/settings_0.patch (576 bytes) As per the workaround mentioned in discussion [1], the default settings.php file that is shipped does not always prevent PHP from adding the PHPSESSID in the URL. Although this is a hosting setting issue, a workaround exists for it: A patch is attached, and it just adds the following line to settings.php ini_set('url_rewriter.tags', ''); [1] http://drupal.org/node/17947#comment-36339 kbahey

3 3

[drupal-devel] [feature] Bind IP to session
by chx 01 Aug '05

01 Aug '05

Issue status update for http://drupal.org/node/19845 Project: Drupal Version: cvs Component: base system Category: feature requests Priority: critical Assigned to: chx Reported by: chx Updated by: chx Status: patch Attachment: http://drupal.org/files/issues/bindip.patch (896 bytes) This would make session hijacking more than a bit harder. The code can be compacted even more, but I did not dare. chx

7 17

[drupal-devel] [feature] Search Watchdog Log
by pyromanfo 01 Aug '05

01 Aug '05

Issue status update for http://drupal.org/node/24957 Project: Drupal Version: 4.6.0 Component: watchdog.module Category: feature requests Priority: normal Assigned to: Anonymous Reported by: pyromanfo Updated by: pyromanfo Status: patch Attachment: http://drupal.org/files/issues/watchdog_search.patch (2.75 KB) This patch allows you to search the watchdog log for some text in the hostname, user or the message itself. Also if you enter a severity, 'error','warning','notice' it'll filter by that. Works in tandem with the dropdown filter box. pyromanfo

3 4

[drupal-devel] [feature] Flexiforum modifications
by pyromanfo 01 Aug '05

01 Aug '05

Issue status update for http://drupal.org/node/20295 Project: Drupal Version: cvs Component: forum.module Category: feature requests Priority: normal Assigned to: Anonymous Reported by: pyromanfo Updated by: pyromanfo Status: patch Attachment: http://drupal.org/files/issues/flexiforum.patch (10.01 KB) When I saw what was planned for the 4.6.0 forum improvements I was intrigued and a little disappointed. On the one hand, it really did make things easier. On the other hand, it was moving the forum module further away from what I wanted to use it for, making it a little less useful for me. The main thing I wanted the forums for Drupal to do was allow me to use any node type in the forums, following the generic node-based design of Drupal itself. This actually pushed it further away from that goal, having a specific walled-off section of the site that only forum posts are allowed in, and now it's seperate from the other categories as well. So I got to looking at the forum.module code and realized how easy it would be to modify it to use any node type. That, combined with my Quickpost project would allow me the node-generic forum posting I wanted for my site. Enough rambling, here's the goods. Patch Description This patch takes the CVS forum.module and allows users to see any node types in the forums, such as stories, images, book pages, blog entries and flexinode types. It's a suprisingly simple little patch, and if you're like me wanted the forums to be a little more flexible, this patch helps in that regard. It's fairly simple, and I only did preliminary testing so let me know what you think. I don't think this'll get accepted into core, but I didn't know where else to put it. It's too simple to be it's own module and I don't know where else I'd put a patch. If this should be in the forums or something, I'll put it there. pyromanfo

6 8

[drupal-devel] [feature] make format_name themable
by killes 31 Jul '05

31 Jul '05

Issue status update for http://drupal.org/node/27737 Post a follow up: http://drupal.org/project/comments/add/27737 Project: Drupal Version: cvs Component: theme system Category: feature requests Priority: normal Assigned to: killes(a)www.drop.org Reported by: killes(a)www.drop.org Updated by: killes(a)www.drop.org Status: patch Attachment: http://drupal.org/files/issues/theme_format_name.patch (20.39 KB) I've always disliked that I cannot chose which user information is displayed to the outside world. I often prefer to show "Firstname Lastname" rather than a often cryptic username. I could of course change this display in the node and comment functions of my theme, but then it would be confusing if the same user essentially has another name in the user search or the admin interface. Therefore I propse to make format_name a themabel function. Patch attached. killes(a)www.drop.org

5 9

[drupal-devel] [bug] 4.6.2 node.module incorrectly assumes 404 when access denied
by willmoy 31 Jul '05

31 Jul '05

Issue status update for http://drupal.org/node/27864 Post a follow up: http://drupal.org/project/comments/add/27864 Project: Drupal Version: 4.6.2 Component: node.module Category: bug reports Priority: normal Assigned to: willmoy Reported by: willmoy Updated by: willmoy Status: patch (code needs review) Attachment: http://drupal.org/files/issues/27864-node.module-4.6.2_0.patch (682 bytes) Thanks very much killes, that was dumb of me. New patch attached. willmoy Previous comments: ------------------------------------------------------------------------ Sat, 30 Jul 2005 19:58:15 +0000 : willmoy To reproduce: - Take a page which is denied to anonymous users by node_privacy_byrole - Go to it as an anonymous user - Receive 404 error Note: this bug did not exist in 4.5.x ------------------------------------------------------------------------ Sat, 30 Jul 2005 20:23:02 +0000 : willmoy Attachment: http://drupal.org/files/issues/27864-user.module-4.6.2.patch (686 bytes) Tested patch against 4.6.2 branch attached. ------------------------------------------------------------------------ Sun, 31 Jul 2005 01:01:08 +0000 : willmoy Attachment: http://drupal.org/files/issues/27864-node.module-4.6.2.patch (682 bytes) New patch. Correctly handles both 403s and 404s. Adds an extra query to verify which is happening. ------------------------------------------------------------------------ Sun, 31 Jul 2005 10:18:30 +0000 : Dries That code is insecure and may lead to SQL injection attacks. ------------------------------------------------------------------------ Sun, 31 Jul 2005 19:09:15 +0000 : willmoy The patch doesn't include enough context to show that the query is subject to a check of is_numeric(arg(1)). I don't think this is vulnerable to SQL injection, but I'd be grateful if someone else would check and I apologise if I'm missing something. The patched code in context: case 'view': if (is_numeric(arg(1))) { $node = node_load(array('nid' => arg(1)), $_GET['revision']); if ($node->nid) { drupal_set_title(check_plain($node->title)); print theme('page', node_show($node, arg(2))); } else if (db_fetch_object(db_query('SELECT nid FROM {node} WHERE nid=%s', arg(1)))) { drupal_access_denied(); } else { drupal_not_found(); } } break; The cvs version of this patch http://drupal.org/node/27873 has the same context. ------------------------------------------------------------------------ Sun, 31 Jul 2005 19:42:45 +0000 : killes(a)www.drop.org I think the problem is this: WHERE nid=%s', arg(1) It should be WHERE nid = '%s'", arg(1) if arg(1) were indeed a string, but since it isn't it should be WHERE nid = %d', arg(1)

1 0

[drupal-devel] [bug] 4.6.2 node.module incorrectly assumes 404 when access denied
by killes 31 Jul '05

31 Jul '05

Issue status update for http://drupal.org/node/27864 Post a follow up: http://drupal.org/project/comments/add/27864 Project: Drupal Version: 4.6.2 Component: node.module Category: bug reports Priority: normal Assigned to: willmoy Reported by: willmoy Updated by: killes(a)www.drop.org Status: patch (code needs review) I think the problem is this: WHERE nid=%s', arg(1) It should be WHERE nid = '%s'", arg(1) if arg(1) were indeed a string, but since it isn't it should be WHERE nid = %d', arg(1) killes(a)www.drop.org Previous comments: ------------------------------------------------------------------------ Sat, 30 Jul 2005 19:58:15 +0000 : willmoy To reproduce: - Take a page which is denied to anonymous users by node_privacy_byrole - Go to it as an anonymous user - Receive 404 error Note: this bug did not exist in 4.5.x ------------------------------------------------------------------------ Sat, 30 Jul 2005 20:23:02 +0000 : willmoy Attachment: http://drupal.org/files/issues/27864-user.module-4.6.2.patch (686 bytes) Tested patch against 4.6.2 branch attached. ------------------------------------------------------------------------ Sun, 31 Jul 2005 01:01:08 +0000 : willmoy Attachment: http://drupal.org/files/issues/27864-node.module-4.6.2.patch (682 bytes) New patch. Correctly handles both 403s and 404s. Adds an extra query to verify which is happening. ------------------------------------------------------------------------ Sun, 31 Jul 2005 10:18:30 +0000 : Dries That code is insecure and may lead to SQL injection attacks. ------------------------------------------------------------------------ Sun, 31 Jul 2005 19:09:15 +0000 : willmoy The patch doesn't include enough context to show that the query is subject to a check of is_numeric(arg(1)). I don't think this is vulnerable to SQL injection, but I'd be grateful if someone else would check and I apologise if I'm missing something. The patched code in context: case 'view': if (is_numeric(arg(1))) { $node = node_load(array('nid' => arg(1)), $_GET['revision']); if ($node->nid) { drupal_set_title(check_plain($node->title)); print theme('page', node_show($node, arg(2))); } else if (db_fetch_object(db_query('SELECT nid FROM {node} WHERE nid=%s', arg(1)))) { drupal_access_denied(); } else { drupal_not_found(); } } break; The cvs version of this patch http://drupal.org/node/27873 has the same context.

1 0

[drupal-devel] [bug] 4.6.2 node.module incorrectly assumes 404 when access denied
by willmoy 31 Jul '05

31 Jul '05

Issue status update for http://drupal.org/node/27864 Post a follow up: http://drupal.org/project/comments/add/27864 Project: Drupal Version: 4.6.2 Component: node.module Category: bug reports Priority: normal Assigned to: willmoy Reported by: willmoy Updated by: willmoy -Status: patch (code needs work) +Status: patch (code needs review) The patch doesn't include enough context to show that the query is subject to a check of is_numeric(arg(1)). I don't think this is vulnerable to SQL injection, but I'd be grateful if someone else would check and I apologise if I'm missing something. The patched code in context: case 'view': if (is_numeric(arg(1))) { $node = node_load(array('nid' => arg(1)), $_GET['revision']); if ($node->nid) { drupal_set_title(check_plain($node->title)); print theme('page', node_show($node, arg(2))); } else if (db_fetch_object(db_query('SELECT nid FROM {node} WHERE nid=%s', arg(1)))) { drupal_access_denied(); } else { drupal_not_found(); } } break; The cvs version of this patch http://drupal.org/node/27873 has the same context. willmoy Previous comments: ------------------------------------------------------------------------ Sat, 30 Jul 2005 19:58:15 +0000 : willmoy To reproduce: - Take a page which is denied to anonymous users by node_privacy_byrole - Go to it as an anonymous user - Receive 404 error Note: this bug did not exist in 4.5.x ------------------------------------------------------------------------ Sat, 30 Jul 2005 20:23:02 +0000 : willmoy Attachment: http://drupal.org/files/issues/27864-user.module-4.6.2.patch (686 bytes) Tested patch against 4.6.2 branch attached. ------------------------------------------------------------------------ Sun, 31 Jul 2005 01:01:08 +0000 : willmoy Attachment: http://drupal.org/files/issues/27864-node.module-4.6.2.patch (682 bytes) New patch. Correctly handles both 403s and 404s. Adds an extra query to verify which is happening. ------------------------------------------------------------------------ Sun, 31 Jul 2005 10:18:30 +0000 : Dries That code is insecure and may lead to SQL injection attacks.

1 0

[drupal-devel] [feature] Prefill 'path' field on new node form
by jakeg 31 Jul '05

31 Jul '05

Issue status update for http://drupal.org/node/27155 Post a follow up: http://drupal.org/project/comments/add/27155 Project: Drupal Version: 4.6.0 Component: path.module Category: feature requests Priority: normal Assigned to: Anonymous Reported by: jakeg Updated by: jakeg Status: patch I'm creating wiki-like features on my site so that if someone with the permission to create new pages goes to a 'page not found' page then it gives them an option to create a page at that address (i.e. at that path, so if they goto /somepath they can easily create a page with path /somepath). To do this its very handy for the 'path alias' field on the new node page to be pre-filled with a value using e.g. node/add/page?edit[path]=somepath in the same way that you can prefill the title field using node/add/page?edit[title]=sometitle I've got this to work by adding the following line to path.module at line 211 as thus: case 'form pre': if(!$node->path AND isset($_GET['edit']['path'])) $node->path = $_GET['edit']['path']; $output = ... ... my line is the 'if' line in the middle above. Could this be added to core? I'm sure others could find it handy and it would save me from having to rewrite the line on every upgrade. If it can't be added to core, is there anyway for me to put this line into my own custom module somehow so that I don't have to rewrite it every time I upgrade? jakeg

6 15

[drupal-devel] [feature] Brazilian Portuguese support
by mikeryan 31 Jul '05

31 Jul '05

Issue status update for http://drupal.org/node/27906 Post a follow up: http://drupal.org/project/comments/add/27906 Project: Drupal Version: cvs Component: locale.module Category: feature requests Priority: normal Assigned to: Anonymous Reported by: mikeryan Updated by: mikeryan Status: patch (code needs work) Attachment: http://drupal.org/files/issues/locale.inc_0.patch (691 bytes) Please add support for Brazilian Portuguese to locale.inc. Both Portugal and Brazil Portuguese translations have been contributed, but there's only one Portuguese slot available to load them. A sample patch is attached, but of course the Portuguese strings should be updated by someone who actually knows Portuguese... mikeryan

1 0