January 2006 - Development - lists.drupal.org

security: people can no longer "administer" blocks.
by Bèr Kessels 06 Jan '06

06 Jan '06

Hi, I can no longer allow anyone on my network (nor would I advice anyone to do so) to "administer" blocks. The result is "no sorry Mr Client, you cannot change that link in that block, only I can". The reason is simple: PHP input. It is too late, sorry for that, but I only realize this now[1]. allowing users to paste PHP is a security issue, a severe one. I see a few solutions. And I think we should consider adding them to drupal before 4.7. A patch is not too hard, the consensus is. I think. * Add a new permission: moderate blocks (people can only change the content of the blocks) * Remove the "show it here and there" alltoghether and leave it to the themes (my favorite) to choose where, when and how to display blocks. * Limit the allowed PHP. this, i fear is a very, very hard one. One that will render php mode unusable too. * Only show (and save!!) the phpmode option for uid 1. I dislike this, because I prefer to do nothing with uid1. I for one, will certainly not -ever- allow my users to add php, (wich allows them to hack the complete server, with some creativity) Bèr [1] http://www.webschuur.com/node/409

5 4

Drupal Hosting
by "Schultz Consult - [René Madsen]" 06 Jan '06

06 Jan '06

Hi Drupal development team, Our company host and develop for drupal. We would like to have a link on http://drupal.org/services/hosting <text for http://drupal.org/services/hosting > Schultz Consult is a Danish company developing for and hosting Drupal sites. Within the drupal site you would get the following: For only 149,- Danish Kroner you would get the following: 149,- Dansih Kroner is approximately 19.96 € - Latest Drupal installation - Unlimited use of webspace - 10 e-mail accounts - 1 database - 5Gb of transfer pr. month. - And loads of more... At the moment our site with information about our Drupal hosting is in Danish, but it will soon be translated into English. You may look at http://www.schultzconsult.dk/node/28 for more information about our Drupal products. Danish version: Schultz Consult er en dansk virksomhed som udvikler til og hoster Drupal. Du vil for kun 149,- pr./md. få følgende: - Seneste Drupal installation - Ubegrænset forbrug af harddiskplads - 10 e-mail konti - 1 database - 5Gb trafik pr./md. - Og meget mere... Du vil kunne læse mere om vores produkt på http://www.schultzconsult.dk/node/28 </end of text> Best Regards René Madsen Schultz Consult phone +45 28 34 36 85 Glanshatten 54b, DK-5220 Odense South East Denmark

3 3

kudos to Steven, and how to get rid of the resizing JS.
by Bèr Kessels 05 Jan '06

05 Jan '06

Hello there. I do not mean this mail as a rant. So if it sounds like that, just reread this first sentence :) Steven has made really cool ajaxy stuff, and javascript features for Drupal. His last addition for Drupal was a cool form-field resizer. but ehh. I *personally* don't want it. My client got (a little) angry because it broke his (development) site; its due to a theme/CSS issue, but still. I have to bill him for a fixing a feature he never asked for. Also, I certainly don't want it on none-admin areas like the feedback form. That is again, a personal decision. But I think end-users (those filling in their address in a feeback for, for example) should not get all that JS shazam, but a properly pre-sized textfield. I have, personally filed the term AJAX next to Flash and DHTML. Under usefull, but too often misused and overhyped. Too often it is used just because "everyone does it". Used for the sake of using it. Not that I am saying Drupal is going that way, but we must certainly be aware of it. And certainly start sticking dubious JS stuff in contrib (or even core) modules. Anyway. the form resizer broke on my theme. It broke my quicktags and it broke one version+theme of tinyMCE. All of wich I think are not bugs in core but in my theme, module and that version of mce with the specific theme. I was told before to make a patch to switch off the JS globally. But IMO that is not the correct route. Switching on and off development stuff on a user interface is not a good option, IMO. So, anyone here who knows how I can not have js in Drupal? Do I really need to develop a no_js.module that uses alter hooks for the forms? Or does anyone know a better route? Sorry to start about RoR again. But RoR is amoungst the forefighters of AJAX. It offers a lot of ajax apis in "core". Yet it is up to the developer to implement it or not. I think that this might be a route worth looking at: provide modules, and apis to use in themes and modules for AJAX stuff. Instead of deploying it by default. Though that is for a future, not for now. :) Now I just want to know if there's an easy way of switching off AJAX and JS stuff so that i can fix up themes and modules that break. then slowly deploy it where i like to deploy it ;) Bèr

13 21

Bridging PHP to Java or C++?
by Mark Fredrickson 05 Jan '06

05 Jan '06

Hi all, For my Machine Learning toolkit, I'm looking to draw on the work of either the Java Weka ML system or the MLC++ library. My question to the Drupal community is: which is easier to bridge (Java or C++) to PHP (and specifically to Drupal)? My vote is for Java, as I can distribute the (GPL'd) bytecode more easily than pre-compiled C++ binaries. Let's take performance off the table for this discussion. My design calls for the ML algorithms to be pluggable via an API to the interaction code, so high perf classifiers could be written later if my selected method proves slow. On a more general note, do any modules currently require php extensions that are not in PEAR? If so, how do they handle getting the module compiled and installed. Thanks, Mark Fredrickson

7 10

cvs tags for core/betas
by Darrel O'Pry 05 Jan '06

05 Jan '06

Is there any change of gettings cvs tags for beta releases? I'd like to be able to take a quick look at what all has changed between beta release and head via cvs... .darrel.

1 0

Recent mail problems
by Dries Buytaert 05 Jan '06

05 Jan '06

FYI. Begin forwarded message: > From: Matt Rae <raema(a)osuosl.org> > Date: Thu 5 Jan 2006 01:29:28 GMT+01:00 > To: infrastructure(a)drupal.org > Subject: [infrastructure] mail queue > Reply-To: "A list for Drupal infrastructure maintainers (eg. > drupal.org, CVS, mailing lists)" <infrastructure(a)drupal.org> > > Just letting everybody know there was a email in the mail queue > that was > crashing the mailserver and clogging up the queue. If your list emails > were getting lost, that should be fixed now hopefully. -- Dries Buytaert :: http://www.buytaert.net/

1 0

the new standard RSS icon
by Theodore Serbinski 05 Jan '06

05 Jan '06

Ok guys, with all of the improvements to the feed system in 4.7, I have one more suggestion to really wrap things up and help Drupal to be forward thinking in this area. There is a new push to standardize the RSS icon, and if you haven't heard, Microsoft, has adopted the *same* icon as Mozilla, that little orange icon. Yes, it's true, something *both* browsers will share in common. Wow, progress, at last! Read more about that here: http://mattbrett.com/archives/2005/12/the-new-standard-feed-icon/ So I motion that we do this for the final release of 4.7, that we include this new icon by default and get rid of the crummy XML icon. If you read that above article, it makes a lot of sense, does the term "XML" mean anything but to developers? We could certainly adopt either an orange or blue icon (could be theme specific, I'll leave that up to guys) but here is the link for icons: http://feedicons.com/ This is not so much a patch but a change in icons so I wanted to throw this out there. If everyone agrees, we can create an issue and get this committed. It should be trivial to implement, but as Drupal 4.7 sites are widely deployed next year, the affects of this icon will be much more impressive. And speaking of which, to go along with this, I think we should throw in a patch that puts this icon in a promiment place, instead of merely at the bottom of the page. Perhaps we can throw this at the top of feed pages (top of the node page for example). Still leave it themeable but change the default a bit. Just my 2 cents. Happy Holidays all! ted (aka m3avrck)

10 12

[liz0@bsdmail.com: Drupal all versiyon xss cehennem.org]
by piotr＠mallorn.ii.uj.edu.pl 05 Jan '06

05 Jan '06

This is from bugtraq... -- Piotrek irc: #debian.pl Mors Drosophilis melanogastribus!

3 2

fixed vs closed
by David K Norman 05 Jan '06

05 Jan '06

I think I do not understand the difference between fixed and closed when committing a patch to CVS. When I fix a bug for a module, I mark it fixed, but then fixed still shows up in the default view of all the open bugs. Does "fixed" not mean the problem is solved and to move on or should I be campaigning to remove fixed from default bug views?

2 1

Drupal 4.7.0 release schedule
by Dries Buytaert 03 Jan '06

03 Jan '06

Hello world, I think I might release a third beta release this week. - If someone wants to help with the release announcement (like merlinofchaos did last time), drop me an e-mail in private. - We fixed about 50 bugs the past 2 weeks. - There are more than 500 patches that need to be reviewed (status: patch needs review). - There are more than 1000 issues against HEAD/4.7 that need attention. - There are 200 critical bugs/patches that need attention. Please focus on the critical issues first: http://drupal.org/project/ issues?projects=3060&priorities=1&states=1,8,13,14 -- Dries Buytaert :: http://www.buytaert.net/

1 1