August 2005 - Development - lists.drupal.org

[drupal-devel] [bug] Users with 'maintain books' or 'edit own book pages' permission cannot delete book pages
by noid 30 Aug '05

30 Aug '05

Issue status update for http://drupal.org/node/21559 Post a follow up: http://drupal.org/project/comments/add/21559 Project: Drupal Version: cvs Component: book.module Category: bug reports Priority: normal Assigned to: Anonymous Reported by: clydefrog Updated by: noid Status: patch (code needs review) My bad. *"Maintain books" works after all.* Tested the permission again and found out that a user with the aforementioned access can edit some of the nodes after all, and these nodes were created after a certain date. So I looked into the modules I installed after that date, and, to cut to the chase, found out that the culprit was TinyMCE. Well, indirectly, that is. :) Turned out I was using a new customized input format -- per advice of TinyMCE install instructions -- and the older nodes that were created with the default filtered HTML format couldn't be edited. So all I have to do now is change the input format of these older nodes to the new input format I set for TinyMCE. :) At any rate, perhaps someone can figure out why the new format made the book module act that way. :) noid Previous comments: ------------------------------------------------------------------------ Fri, 29 Apr 2005 04:32:19 +0000 : clydefrog Attachment: http://drupal.org/files/issues/delete_own_book_pages.patch (626 bytes) AFAICT, only 'administer nodes' permission allows deletion of book pages. This patch allows users with 'maintain books' or 'edit own book pages' permission to delete book pages. The logic doesn't check if the node has updates pending. Should it? ------------------------------------------------------------------------ Fri, 29 Apr 2005 14:10:22 +0000 : clydefrog It's a patch, duh. ------------------------------------------------------------------------ Fri, 29 Apr 2005 14:21:27 +0000 : rivena If maintain books is a permission that overlaps other permissions, it should say so. For example, /maintain books (create, edit, and delete all book pages)/. While I agree that someone who has been given maintainer status should be able to delete pages, I wonder if 'delete own pages' should be made into a seperate permission. I could see a situation where I would not want someone to be able to delete their own pages. Do these permissions affect things that are not book pages but have been put into books? Anisa. It's /Golden Week/! ------------------------------------------------------------------------ Sat, 30 Apr 2005 03:43:17 +0000 : clydefrog I think it's clear that "maintain books" implies the ability to edit and delete book pages. No other node module provides a "delete own " permission, so it would be inconsistent for book.module to provide it. Can you provide some examples to justify the inconsistency? These permissions do not affect nodes which aren't book pages but are in a book. Those nodes are controlled by their respective type-specific permissions, but only users with "maintain books" permission can add or remove those nodes from books. I believe this is the correct behavior. ------------------------------------------------------------------------ Sat, 30 Apr 2005 11:03:47 +0000 : rivena Hmm... But, you just said that until this patch, it *didn't* include the delete pages permission. Right? So, now you are changing it's behavior, but leaving the wording the same. How will people know? Or does it not matter, because you presume they didn't really know it didn't include delete in the first place? I don't know that I can defend my idea of having a seperate delete own pages permission against a standard of consistency. If all the other edit own permissions include the delete pages permission, then I have no quibbles. :) Except it would be more userfriendly if I knew what the permissions meant before I granted them to someone, without having to look at the code. But I do realize that is completely out of the scope of the patch. :) Where do all these little changes *go*, anyway? The changelog just says things like... refractored the search module. Anisa. ------------------------------------------------------------------------ Sat, 30 Apr 2005 16:04:14 +0000 : clydefrog I believe that "maintain books" permission implies the ability to delete book pages, so this patch fixes that bug. Other node modules include deletion in the "edit own" permission. For example, page.module: <?php if ($op == 'update' || $op == 'delete') { if (user_access('edit own pages') && ($user->uid == $node->uid)) { return TRUE; } } ?> I agree that it would be better if permissions were clearer about what they implied. There was a discussion started by killes [1] a while ago: "One problem with Drupal is the way it handles user permissions. The permissions are attached to the user object but nobody really knows what they do. To find out what a particular permission allows you to do, you often need to have a look at the code. " I don't know if it ever lead to any code. I think the changelog is meant to list the changes since the previous version without too much technical detail. If you want to see every last change, take a look at the cvs messages [2]. [1] http://lists.drupal.org/archives/drupal-devel/2005-04/msg00704.html [2] http://drupal.org/project/cvs/3060 ------------------------------------------------------------------------ Mon, 23 May 2005 17:33:18 +0000 : rivena I've been looking at the book module permissions recently, and did a bit of testing. I wanted to know what was the minimum permissions needed to create a new book. I assumed based on this discussion, and a similar discussion on the drupal support list that this was 'maintain books' and 'administer nodes'. I ran into a problem, then added 'access nodes' to this. So now my user has no other permissions other than 'maintain books', 'administer nodes' and 'access nodes'. You'd think this is more than sufficient to do something simple like create a new book, but in fact, with just these permissions, you do not have access to create a book page. You can edit other pages, and move them into a new book. Once you have create pages permission, you appear to finally have all the permissions needed, edit own pages is not needed. So, since, the point of this patch was that not having delete permission was odd, might I suggest adding create permission to maintain books? ;p Anisa. ------------------------------------------------------------------------ Mon, 08 Aug 2005 10:37:49 +0000 : Bèr Kessels I would say this is a "by design". Maybe we need to rename the two book permissions into: "create books" and "edit own book pages". None of the other nodes can be deleted by the roles with "edit own Foo" permissions, nor should the books. ------------------------------------------------------------------------ Mon, 08 Aug 2005 16:59:30 +0000 : clydefrog Thanks for your review, Ber. story.module [3] allows users with "edit own stories" permission to delete stories. <?php if ($op == 'update' || $op == 'delete') { if (user_access('edit own stories') && ($user->uid == $node->uid)) { return TRUE; } } ?> Therefore it is not inconsistent for the same behavior to apply to book nodes. If "maintain books" really means "create books", then the name should be changed and existing code in book.module needs to be updated. However, I think "maintain books" should allow more than just that. In my situation, I want to be able to give someone the permissions to create books and to create, edit, and delete all book pages. With my patch, "maintain books" and "create book pages" does that. [3] http://cvs.drupal.org/viewcvs/drupal/drupal/modules/story.module?rev=1.167&… ------------------------------------------------------------------------ Mon, 08 Aug 2005 19:16:35 +0000 : Bèr Kessels What i see from story, that is specific to story.module too. We should really settle for a consistent behaviour for *all* nodes, one that is "enforced" from node.module. These things should really not be decided per node-type and per-module. Thats a recipe for a mess. ------------------------------------------------------------------------ Mon, 08 Aug 2005 19:25:27 +0000 : Eric Scouten I agree that the current system is a mess. I disagree that there should be one consistent policy enforced by node.module. Sites may have quite legitimate reasons to have different policies for different node types. ------------------------------------------------------------------------ Mon, 08 Aug 2005 20:35:59 +0000 : Bèr Kessels What i was aiming at is to let node module take care of the following: * edit $node_type * administer $node_type * delete $node_type (but would that not better be in 'administer';: users who can administer can delete) * create $node_type That way the modules need not cre about this. ut they /can/ take care of it, if they wish, and add more rules and permissions. ------------------------------------------------------------------------ Mon, 08 Aug 2005 20:36:32 +0000 : Bèr Kessels oh, and -forgot- : * view $node_type ------------------------------------------------------------------------ Mon, 08 Aug 2005 20:49:31 +0000 : Eric Scouten Thanks for the clarification, Bèr. I was afraid that you meant that there would be a single policy applied to *all* node types, not a policy *per* node type. Now I think we're in complete agreement on this subject. ------------------------------------------------------------------------ Mon, 08 Aug 2005 20:51:13 +0000 : puregin I think it's important to keep a clean separation between content and structure (e.g., what's inside of the node, versus how the node is associated with other nodes) I think that there will likely be other explicit structures in Drupal over time, so these concerns affect more than just book module. Deleting a node from a book is potentially a problem, since this operation affects the structure of a book. We also need to think about other interactions with structure - for example, what happens if someone unpublished a node in a book? Should all children also be unpublished? Should the node contents be hidden, while children remain available in navigation? ------------------------------------------------------------------------ Mon, 08 Aug 2005 21:08:01 +0000 : Bèr Kessels puregrin. I think you are gettnig OT here, Thought it is a very valid (and problematic) issue, It really belongs in a new thread. ------------------------------------------------------------------------ Mon, 08 Aug 2005 22:57:34 +0000 : puregin What I was saying is that whether a user should be able to delete a node from a structure should really be enforced by the module which is responsible for the structure. For example, imagining a simple linear list structure - let's say for a "wish list" - composed of nodes owned by a bunch of different users. In this example, a user could delete his own node with no problem. For the book module, a users node may have children authored by other users. Letting an arbitrary user delete his own node would be, I think, a mistake, since the children would then be orphaned. I suppose one could imagine other modules which rely on a hierarchy, which might have a different policy (e.g., automatically attach children to the parent of the deleted node, if such a node exists). Perhaps eventually two 'tree-based' structure modules might inherit from a tree structure module, each enforcing separate policies regarding node operations. The point is, that one should not have to modify node module when a new structure is defined. Node module should not have to know about how composites of nodes work. ------------------------------------------------------------------------ Tue, 09 Aug 2005 00:45:07 +0000 : Boris Mann puregin: I was talking about this today, so I created a task [4] to remind us to build a generalized node relationship module/schema. [4] http://drupal.org/node/28480 ------------------------------------------------------------------------ Fri, 12 Aug 2005 00:42:58 +0000 : Crell /I think it's clear that "maintain books" implies the ability to edit and delete book pages./ I'm afraid I have to disagree with clydefrog on this one. The words "administer" and "maintain" and "manage" don't give any firm indication of what they mean, in and of themselves. They could vary depending on the context. Some nodes are deleteable in the fist place, some aren't. In that case, "maintain" means two different things, as would anything else you put in there unqualified. This isn't just a problem with the books module, but in general. It is not intuitively obvious what "administer nodes" or "administer X" means. That's a problem, especially when, as I said, it can vary from one node type to another. I see, generally, the following types of operations on nodes: - Create - Change Ownership - View Anyone's - View Own - Edit Anyone's - Edit Own - Delete Anyone's - Delete Own Which of those is covered by "administer" or "maintain"? And what if I want to allow someone to, say, edit their own nodes, but not delete them? Or allow a given class of administrator to edit anyone's nodes but not delete any but their own? I'd actually be much in favor of more fine-grained control over nodes access rights, both for the greater power it offers and for the clearer UI, system-wide. Whether that's best done via a central node API system or via a "recommended permission breakdown" I don't know, and will leave that to those who have spent more time with core than I have. :-) I do believe it's a good idea, however, both for greater flexibility and greater learnability. ------------------------------------------------------------------------ Fri, 26 Aug 2005 21:23:27 +0000 : noid Just to clarify things -- based on tests I did with the book module -- (the following hold true for regular users with no "administer nodes" permission) *1) the "edit own book pages" does not give the user the option to delete his own pages.* and *2) "maintain books" doesn't do anything. * This is the state of things right now, right? If this is so, may I suggest that the initial fix be simple in the meantime which should include: *1) "edit own book pages" means the user /can also delete his own pages./* *2) "maintain books" means the user /can edit (but not delete) pages created by other users./* ******************** I've also noticed that "create book pages" (or "edit own book pages" and "maintain books" for that matter) doesn't allow the user to create a top-level page -- there's no option for it in the pulldown. Can this be fixed so that * "create book pages" allow the user to create a top-level page (that is start his own book)?*

1 0

[drupal-devel] Processed: drupal security bugs
by owner＠bugs.debian.org 30 Aug '05

30 Aug '05

Processing commands for control(a)bugs.debian.org: > close 323347 4.5.5-1 Bug#323347: Another XMLRPC issue in drupal 'close' is deprecated; see http://www.debian.org/Bugs/Developer#closing. Bug marked as fixed in version 4.5.5-1, send any further explanations to Moritz Muehlenhoff <jmm(a)inutil.org> > close 323578 4.5.5-1 Bug#323578: drupal: DRUPAL-SA-2005-004 'close' is deprecated; see http://www.debian.org/Bugs/Developer#closing. Bug marked as fixed in version 4.5.5-1, send any further explanations to serrador(a)hispafuentes.com > -- Stopping processing here. Please contact me if you need assistance. Debian bug tracking system administrator (administrator, Debian Bugs database)

1 0

[drupal-devel] [feature] Display comments on own tab like wikipedia (patch attached)
by chx 30 Aug '05

30 Aug '05

Issue status update for http://drupal.org/node/24804 Post a follow up: http://drupal.org/project/comments/add/24804 Project: Drupal Version: cvs Component: comment.module Category: feature requests Priority: normal Assigned to: chx Reported by: moshe weitzman Updated by: chx Status: patch (code needs review) No, not tabs only. I know the drupal_gotos are giving you this impression, but will fix in the evening. Also, there is only a variable_get for node/nid pages and then again, variable_get is double cached, it's very fast. chx Previous comments: ------------------------------------------------------------------------ Sat, 11 Jun 2005 20:57:10 +0000 : moshe weitzman Attached please find a demonstration patch which moves comment display to its own tab on the node view page. Admin may choose this new view or old view. The patch needs work still: - comment control form redirects to the node page after submit. Should be comment page - same for comment posting form - probably more I hope someone gets inspired to finish this patch. I won't revisit this for a while. ------------------------------------------------------------------------ Sat, 11 Jun 2005 21:00:56 +0000 : moshe weitzman Attachment: http://drupal.org/files/issues/discuss.patch (3.87 KB) with attachment this time ------------------------------------------------------------------------ Sat, 11 Jun 2005 23:24:12 +0000 : moshe weitzman oh yeah - also on the TODO list is to comment URLs to always point to comment.module and never to node/x#comment-cid or node/x#comment-new and so on. then comment.module can work out whether to show you the discuss tab or the traditional view. ------------------------------------------------------------------------ Sun, 12 Jun 2005 00:56:02 +0000 : Boris Mann I like the concept. Would want this to be part of workflow settings, so that comment-tab could be enabled/disabled per content type. ------------------------------------------------------------------------ Sun, 12 Jun 2005 02:20:42 +0000 : Jaza I like the idea - big +1. This is a must for sites that have long articles and/or many comments - viewing the node is enough bandwidth as it is, without all the comments getting displayed as well. Also improves usability, IMO. Would also like to see pagination of the comments tab (I'm sure you've thought of this already, Moshe). Something similar to A List Apart [1]'s system, e.g. node/x/discuss/2 (page 2 of that node's comments). Or, if the existing pager system demands it, node/x/discuss?page=2. [1] http://www.alistapart.com/ ------------------------------------------------------------------------ Tue, 30 Aug 2005 00:41:42 +0000 : chx Attachment: http://drupal.org/files/issues/discuss_0.patch (3.87 KB) Let's discuss! Like do we want to have a reply form on the node display even if the comments are on the discuss page? ------------------------------------------------------------------------ Tue, 30 Aug 2005 00:50:13 +0000 : chx Attachment: http://drupal.org/files/issues/discuss_1.patch (3.58 KB) I have uploaded moshe's patch. Let's try again. ------------------------------------------------------------------------ Tue, 30 Aug 2005 11:22:18 +0000 : Bèr Kessels I like this approach a lot. However, as i use drupal also for blogging, would dislike my bog to behave the same. Thus there must be some -easy- way to get around this. µ The problem lies mainly in the fact that tabs are not administratable in Drupals menu admin. And I think it is a very bad idea to add a config option where to place the comments. We should go for one way, teh default way, and offer a menu-admin of some sort to change this, for bloggers and slashdot alikes. How to achieve this? I see two options, but I really hope people see more then one.: - make local-tasks appear in the menu admin (gets a huge +1 from me) It's a separate issue, though. - add a config option to the comment admin to allow comments either as tab or as thread under the post. IMO that config option should not set a variable, that gets checked every hook_menu call, but it should alter the menu-entry in the database for the tabs Its possible, I did that before. But, as said, I hope others have better ideas. for I really would love this feature to get in. But I am afraid a huge lot of people will move away from drupal if we allow tabs only.

1 0

[drupal-devel] Processed: your mail
by owner＠bugs.debian.org 30 Aug '05

30 Aug '05

Processing commands for control(a)bugs.debian.org: > tag 323578 +sarge Bug#323578: drupal: DRUPAL-SA-2005-004 There were no tags set. Tags added: sarge > tag 323347 +sarge Bug#323347: Another XMLRPC issue in drupal Tags were: security Tags added: sarge > thank you Stopping processing here. Please contact me if you need assistance. Debian bug tracking system administrator (administrator, Debian Bugs database)

1 0

[drupal-devel] [bug] conf_init should strip out port numbers in bootstrap.inc
by Morbus Iff 30 Aug '05

30 Aug '05

Issue status update for http://drupal.org/node/19934 Post a follow up: http://drupal.org/project/comments/add/19934 Project: Drupal Version: cvs Component: base system Category: bug reports Priority: normal Assigned to: chx Reported by: bwooster47 Updated by: Morbus Iff -Status: patch (code needs review) +Status: patch (ready to be committed) Confirmed the updated patch. Morbus Iff Previous comments: ------------------------------------------------------------------------ Sun, 03 Apr 2005 23:07:58 +0000 : bwooster47 The latest Drupal from CVS (4.6.0) offers multisite configuration files, but currently the conf_init function in includes/bootstrap.inc will also include the :portnum URL specification in the directory name, which does not seem right (and the colon character may cause problems on Mac/Windows). Snippet from bootstrap.inc: * Example for a fictitious site installed at * http://www.drupal.org/mysite/test/ the 'settings.php' is * searched in the following directories: ..... If the site is: http://www.drupal.org:8080/mysite/test/ the same list of directories should be searched as listed in the example in the file, and the :8080 should not be added to the directory name (I think...) I don't know enough PHP to submit a patch, but this is probably easy for those who know this stuff :-) ------------------------------------------------------------------------ Fri, 08 Apr 2005 07:08:53 +0000 : chx Attachment: http://drupal.org/files/issues/conf_init_ports.patch (768 bytes) Here you are. ------------------------------------------------------------------------ Fri, 08 Apr 2005 11:16:52 +0000 : Dries Won't commit. Removing the port seems like a bad idea (I could have two drupal sites at two different ports but otherwise identical URLs) and adding regex' all over the map isn't advised. If ":" is an invalid character, then there might be more such characters. I suggest we replace them with '.' and that we document this behavior much like we do with $db_url. ------------------------------------------------------------------------ Mon, 11 Apr 2005 23:25:51 +0000 : chx Attachment: http://drupal.org/files/issues/conf_init_ports_0.patch (1.35 KB) ------------------------------------------------------------------------ Tue, 19 Apr 2005 17:03:46 +0000 : bwooster47 Regarding update #3 - does this mean the code has made it in, and will be available in the next release? Secondly: I follow the logic for the update, and it makes sense for non-standard HTTP port numbers, but not sure if the logic is valid when port 80 is used. For example, http://yourdomain.com/ and http://yourdomain.com:80/ both will go to the exact same page, but looks like the search for the conf.php will be different. Not sure if this matters... ------------------------------------------------------------------------ Mon, 01 Aug 2005 01:23:28 +0000 : killes(a)www.drop.org patch still applies, my testsite kept working (is not on a non-standard port, though). ------------------------------------------------------------------------ Mon, 01 Aug 2005 05:31:56 +0000 : Dries I think the PHPdoc is confusing. The second example URL is non-existing/invalid. Did you meant showing a configuration file? I agree with bwooster that this gets tricky with the default port '80'. Do we need to discuss this some more? ------------------------------------------------------------------------ Sat, 06 Aug 2005 07:20:03 +0000 : Boris Mann I like the period (".") character as the delimiter for ports. If people really do tack on :80, then site admins can symlink domain.com.80 to domain.com (much as you would need to symlink www.domain.com to domain.com as well). I think this is largely a documentation issue. ------------------------------------------------------------------------ Fri, 19 Aug 2005 01:27:39 +0000 : Morbus Iff Attachment: http://drupal.org/files/issues/_ports.patch (2.25 KB) +1. This patch is absolutely required for my home development, which is behind an ISP that doesn't like webservers on port 80. I've attached a new patch that fixes the doc mistake from the last patch, as well as adds a note to the INSTALL.txt too. I'm with Boris on the :80 issue - if a developer is using it knowingly, he should be smart enough to put 2 and 2 together. ------------------------------------------------------------------------ Fri, 19 Aug 2005 01:32:10 +0000 : Morbus Iff Attachment: http://drupal.org/files/issues/_ports_0.patch (2.25 KB) Grr. Parens in the wrong place. Right patch attached. ------------------------------------------------------------------------ Sun, 28 Aug 2005 00:16:46 +0000 : Uwe Hermann Attachment: http://drupal.org/files/issues/ports.patch (2.14 KB) Patch didn't apply anymore. Updated. I didn't test it, but +1 for the idea.

1 0

[drupal-devel] [bug] Error with file api and open_basedir restriction
by Jose A Reyero 30 Aug '05

30 Aug '05

Issue status update for http://drupal.org/node/5961 Post a follow up: http://drupal.org/project/comments/add/5961 Project: Drupal Version: cvs Component: node system Category: bug reports Priority: normal Assigned to: Anonymous Reported by: Jose A Reyero Updated by: Jose A Reyero Status: patch (code needs review) I wanted to forget about this but the patch bingo keeps bringing me here :-( , so... I've enabled open_basedir, tested nedjo's revised patch, which still applies and it actually fixes the problem. Sure there can be other solutions -like reworking the whole file api- but this one works and is simple enough and it only does something when the error conditions are met. On top of that, the current file api fails to produce an error when this problem occurs, it just doesnt work without any clue of what is happening, which is really bad. So please apply this one. + 1 Jose A Reyero Previous comments: ------------------------------------------------------------------------ Fri, 20 Feb 2004 19:45:36 +0000 : Jose A Reyero Attachment: http://drupal.org/files/issues/file-open-basedir.patch (1018 bytes) I get this error when uploading a file through the file api, and the upload fails: warning: open_basedir restriction in effect. File is in wrong directory in... This happens when open_basedir restriction is activated and the temporary directory is not in the allowed directories. There's a related bug in the profile.module: http://drupal.org/node/view/2648 [1] FIX: The solution is to upload files using php's 'move_uploaded_file' -which works even when open_basedir restriction is in effect. This patch checks for the error conditions in 'file.inc::file_check_upload', and then uses move_uploaded_file to upload the file to the temporary folder with a random name. Otherwise -if the error conditions are not met-, does nothing. RESTRICTIONS: This patch introduces one additional restriction for the file api: Once you have called 'file_check_upload', you have to use the returned object when calling later 'file.api::file_save_upload'. This shouldn't be a problem, as the right way to upload files should be -I think, please correct me if I'm wrong-: - $file=file_check_upload(); - (Perform validations with $file) - file_save_upload($file,.....) I will post also a very simple patch for profile.module to work with this one. Anyway, as mentioned above, if the error conditions are not met, the patch does nothing, so I think it should be applied first and then check for other modules (profile.module) to use the file api the right way and then be able to upload files when open_basedir restriction in effect. [1] http://drupal.org/node/view/2648 ------------------------------------------------------------------------ Sun, 28 Nov 2004 17:38:25 +0000 : Goba This seems to be an interesting alternate fix to my dump patch for locale.module [2], which is the very same issue... Moving the file out of the upload folder right away to the Drupal temp folder seems to be a good idea to me. The only caveat is that files in the upload folder get removed automatically, while one needs to remove the file from the Drupal temp folder, once it is not needed anymore! [2] http://drupal.org/node/13285 ------------------------------------------------------------------------ Wed, 08 Dec 2004 19:26:18 +0000 : Goba Please look at this stuff. We need to solve open_basedir problems at least in core before the next point release. There are quite a few users trying to use Drupal on shared hosting here, where open_basedir is in effect. ------------------------------------------------------------------------ Fri, 18 Feb 2005 01:55:21 +0000 : clydefrog This functionality gets a +1 from me, the user. We solved this problem by changing upload_tmp_dir in the server config, but a fix in Drupal would be more elegant. ------------------------------------------------------------------------ Sun, 13 Mar 2005 19:41:56 +0000 : killes(a)www.drop.org Doesn't apply anymore. ------------------------------------------------------------------------ Mon, 14 Mar 2005 11:05:08 +0000 : Jose A Reyero Attachment: http://drupal.org/files/issues/file-open-basedir_02.patch (810 bytes) Just resubmitted the patch. The problem is, from the time I sent the first patch , I've moved all my sites, no shared webhosting anymore, so I don't have that upload trouble anymore, and also cannot test it myself. That's also why I'm unassigning this issue to me. So please, somebody else test it. ------------------------------------------------------------------------ Fri, 15 Apr 2005 20:49:50 +0000 : mpd Attachment: http://drupal.org/files/issues/file.inc-file_relocate.patch (3.87 KB) I gave your patch a try. It applies fine but doesn't address several issues, particularily with the image module. The attached patch makes attachments work, along with image (from cvs). I haven't seen any ill effects yet, but I believe that file_delete must be used to avoid getting a build-up of dead files in the local temporary directory (set to getcwd().'/tmp'). This isn't a problem with my install, but it might be a problem with other modules. In order for the patched code to work, $drupal/tmp must exist and be writable by the web server. ------------------------------------------------------------------------ Thu, 05 May 2005 17:33:15 +0000 : nedjo Attachment: http://drupal.org/files/issues/file_open_basedir_03.patch (817 bytes) +1 for Jose's patch (I've attached an updated version, which I've tested successfully. The new version uses $file->filepath rather than $file->path and cleans up the code a bit.) While the larger patch suggested may have merit, I don't fully follow it (not knowing what the image module issues are). I'd like to see the identified problem fixed first, and quickly. Later cleanup and further patches can follow. This is a significant issue, meaning many in hosted environments can't use Drupal's file uploading. This has come up at least twice in the help forums. Jose's solution is simple. Let's apply it! This same changes work for 4.6. ------------------------------------------------------------------------ Thu, 05 May 2005 19:07:35 +0000 : mpd I'll describe the issue that I found with file.inc concerning image.module. >From what I've seen, image.module calls file_copy() directly from _image_insert(). file_copy() doesn't call file_check_upload(), so the open_basedir problem remains because file_copy() attempts to access the file while it's still in the restricted directory. I'm sure that there's a cleaner way to do it, but the patch that I submitted does the trick for my purposes by addressing problems with both file_copy() and file_check_upload(). I'll have a go at making a smaller patch that only addresses the issue with file_copy(), since Nedjo's patch neatly fixes file_check_upload(). ------------------------------------------------------------------------ Thu, 05 May 2005 20:41:19 +0000 : nedjo It seems likely that the image module issue - with using file_copy() directly - can be addressed by adding a file_check_upload() call in the file_copy() function by changing <?php // Process a file upload object. if (is_object($source)) { $file = $source; ?> to <?php // Process a file upload object. if (is_object($source)) { $file = file_check_upload($source); ?> I can't immediately test this. Do you want to, mpd?

1 0

[drupal-devel] [feature] Display comments on own tab like wikipedia (patch attached)
by Bèr Kessels 30 Aug '05

30 Aug '05

Issue status update for http://drupal.org/node/24804 Post a follow up: http://drupal.org/project/comments/add/24804 Project: Drupal Version: cvs Component: comment.module Category: feature requests Priority: normal Assigned to: chx Reported by: moshe weitzman Updated by: Bèr Kessels Status: patch (code needs review) I like this approach a lot. However, as i use drupal also for blogging, would dislike my bog to behave the same. Thus there must be some -easy- way to get around this. µ The problem lies mainly in the fact that tabs are not administratable in Drupals menu admin. And I think it is a very bad idea to add a config option where to place the comments. We should go for one way, teh default way, and offer a menu-admin of some sort to change this, for bloggers and slashdot alikes. How to achieve this? I see two options, but I really hope people see more then one.: - make local-tasks appear in the menu admin (gets a huge +1 from me) It's a separate issue, though. - add a config option to the comment admin to allow comments either as tab or as thread under the post. IMO that config option should not set a variable, that gets checked every hook_menu call, but it should alter the menu-entry in the database for the tabs Its possible, I did that before. But, as said, I hope others have better ideas. for I really would love this feature to get in. But I am afraid a huge lot of people will move away from drupal if we allow tabs only. Bèr Kessels Previous comments: ------------------------------------------------------------------------ Sat, 11 Jun 2005 20:57:10 +0000 : moshe weitzman Attached please find a demonstration patch which moves comment display to its own tab on the node view page. Admin may choose this new view or old view. The patch needs work still: - comment control form redirects to the node page after submit. Should be comment page - same for comment posting form - probably more I hope someone gets inspired to finish this patch. I won't revisit this for a while. ------------------------------------------------------------------------ Sat, 11 Jun 2005 21:00:56 +0000 : moshe weitzman Attachment: http://drupal.org/files/issues/discuss.patch (3.87 KB) with attachment this time ------------------------------------------------------------------------ Sat, 11 Jun 2005 23:24:12 +0000 : moshe weitzman oh yeah - also on the TODO list is to comment URLs to always point to comment.module and never to node/x#comment-cid or node/x#comment-new and so on. then comment.module can work out whether to show you the discuss tab or the traditional view. ------------------------------------------------------------------------ Sun, 12 Jun 2005 00:56:02 +0000 : Boris Mann I like the concept. Would want this to be part of workflow settings, so that comment-tab could be enabled/disabled per content type. ------------------------------------------------------------------------ Sun, 12 Jun 2005 02:20:42 +0000 : Jaza I like the idea - big +1. This is a must for sites that have long articles and/or many comments - viewing the node is enough bandwidth as it is, without all the comments getting displayed as well. Also improves usability, IMO. Would also like to see pagination of the comments tab (I'm sure you've thought of this already, Moshe). Something similar to A List Apart [1]'s system, e.g. node/x/discuss/2 (page 2 of that node's comments). Or, if the existing pager system demands it, node/x/discuss?page=2. [1] http://www.alistapart.com/ ------------------------------------------------------------------------ Tue, 30 Aug 2005 00:41:42 +0000 : chx Attachment: http://drupal.org/files/issues/discuss_0.patch (3.87 KB) Let's discuss! Like do we want to have a reply form on the node display even if the comments are on the discuss page? ------------------------------------------------------------------------ Tue, 30 Aug 2005 00:50:13 +0000 : chx Attachment: http://drupal.org/files/issues/discuss_1.patch (3.58 KB) I have uploaded moshe's patch. Let's try again.

1 0

[drupal-devel] [feature] Bittorrent node type
by mathiaz 30 Aug '05

30 Aug '05

Issue status update for http://drupal.org/node/29985 Post a follow up: http://drupal.org/project/comments/add/29985 Project: Drupal Version: 4.6.3 Component: other Category: feature requests Priority: normal Assigned to: Anonymous Reported by: mathiaz Updated by: mathiaz Status: patch (code needs review) Attachment: http://drupal.org/files/issues/bittorrent.module (7.17 KB) This is simple node type that handles bittorrent files. Users can upload bittorrent files (created via btmaketorrent.py for example). The module stores the uploaded file and the original filename into the drupal database. The bittorrent file can then be published and downloaded by users. The module needs its own table to store the filename and the file (as a blob) : CREATE TABLE `bittorrent_metainfo` ( `nid` int(10) unsigned NOT NULL default '0', `filename` varchar(255) NOT NULL, `metainfo_info` MEDIUMBLOB NOT NULL, PRIMARY KEY (`nid`) ) Let me know what you think about this simple module. mathiaz

5 4

[drupal-devel] [feature] Display comments on own tab like wikipedia (patch attached)
by chx 30 Aug '05

30 Aug '05

Issue status update for http://drupal.org/node/24804 Post a follow up: http://drupal.org/project/comments/add/24804 Project: Drupal Version: cvs Component: comment.module Category: feature requests Priority: normal Assigned to: chx Reported by: moshe weitzman Updated by: chx Status: patch (code needs review) Attachment: http://drupal.org/files/issues/discuss_1.patch (3.58 KB) I have uploaded moshe's patch. Let's try again. chx Previous comments: ------------------------------------------------------------------------ Sat, 11 Jun 2005 20:57:10 +0000 : moshe weitzman Attached please find a demonstration patch which moves comment display to its own tab on the node view page. Admin may choose this new view or old view. The patch needs work still: - comment control form redirects to the node page after submit. Should be comment page - same for comment posting form - probably more I hope someone gets inspired to finish this patch. I won't revisit this for a while. ------------------------------------------------------------------------ Sat, 11 Jun 2005 21:00:56 +0000 : moshe weitzman Attachment: http://drupal.org/files/issues/discuss.patch (3.87 KB) with attachment this time ------------------------------------------------------------------------ Sat, 11 Jun 2005 23:24:12 +0000 : moshe weitzman oh yeah - also on the TODO list is to comment URLs to always point to comment.module and never to node/x#comment-cid or node/x#comment-new and so on. then comment.module can work out whether to show you the discuss tab or the traditional view. ------------------------------------------------------------------------ Sun, 12 Jun 2005 00:56:02 +0000 : Boris Mann I like the concept. Would want this to be part of workflow settings, so that comment-tab could be enabled/disabled per content type. ------------------------------------------------------------------------ Sun, 12 Jun 2005 02:20:42 +0000 : Jaza I like the idea - big +1. This is a must for sites that have long articles and/or many comments - viewing the node is enough bandwidth as it is, without all the comments getting displayed as well. Also improves usability, IMO. Would also like to see pagination of the comments tab (I'm sure you've thought of this already, Moshe). Something similar to A List Apart [1]'s system, e.g. node/x/discuss/2 (page 2 of that node's comments). Or, if the existing pager system demands it, node/x/discuss?page=2. [1] http://www.alistapart.com/ ------------------------------------------------------------------------ Tue, 30 Aug 2005 00:41:42 +0000 : chx Attachment: http://drupal.org/files/issues/discuss_0.patch (3.87 KB) Let's discuss! Like do we want to have a reply form on the node display even if the comments are on the discuss page?

1 0

[drupal-devel] [feature] Display comments on own tab like wikipedia (patch attached)
by chx 30 Aug '05

30 Aug '05

Issue status update for http://drupal.org/node/24804 Post a follow up: http://drupal.org/project/comments/add/24804 Project: Drupal Version: cvs Component: comment.module Category: feature requests Priority: normal -Assigned to: moshe weitzman +Assigned to: chx Reported by: moshe weitzman Updated by: chx -Status: active +Status: patch (code needs review) Attachment: http://drupal.org/files/issues/discuss_0.patch (3.87 KB) Let's discuss! Like do we want to have a reply form on the node display even if the comments are on the discuss page? chx Previous comments: ------------------------------------------------------------------------ Sat, 11 Jun 2005 20:57:10 +0000 : moshe weitzman Attached please find a demonstration patch which moves comment display to its own tab on the node view page. Admin may choose this new view or old view. The patch needs work still: - comment control form redirects to the node page after submit. Should be comment page - same for comment posting form - probably more I hope someone gets inspired to finish this patch. I won't revisit this for a while. ------------------------------------------------------------------------ Sat, 11 Jun 2005 21:00:56 +0000 : moshe weitzman Attachment: http://drupal.org/files/issues/discuss.patch (3.87 KB) with attachment this time ------------------------------------------------------------------------ Sat, 11 Jun 2005 23:24:12 +0000 : moshe weitzman oh yeah - also on the TODO list is to comment URLs to always point to comment.module and never to node/x#comment-cid or node/x#comment-new and so on. then comment.module can work out whether to show you the discuss tab or the traditional view. ------------------------------------------------------------------------ Sun, 12 Jun 2005 00:56:02 +0000 : Boris Mann I like the concept. Would want this to be part of workflow settings, so that comment-tab could be enabled/disabled per content type. ------------------------------------------------------------------------ Sun, 12 Jun 2005 02:20:42 +0000 : Jaza I like the idea - big +1. This is a must for sites that have long articles and/or many comments - viewing the node is enough bandwidth as it is, without all the comments getting displayed as well. Also improves usability, IMO. Would also like to see pagination of the comments tab (I'm sure you've thought of this already, Moshe). Something similar to A List Apart [1]'s system, e.g. node/x/discuss/2 (page 2 of that node's comments). Or, if the existing pager system demands it, node/x/discuss?page=2. [1] http://www.alistapart.com/

1 0