November 2006 - Development - lists.drupal.org

ENOUGH!
by Karoly Negyesi 23 Nov '06

23 Nov '06

You guys write dozens of stupid letters about RFC: letting modules phone home to check for new releases which leads to nowhere aside from the usual "RoR does this better but aside from this I have nothing substantial to add" totally derailing the issue any hand. Who reviews patches? Who fixes bugs? We have a release at hand! Let's consider this as a new rule: before writing to devel during the code freeze, you should link to an issue followup where you actually added something. Consider this as a karma. /me steps down from his soapbox and goes off with steam coming from both ears

6 8

Re: [development] Newbie with Drupal and Modules Development
by Reynier Perez Mira 23 Nov '06

23 Nov '06

Hi Larry and thanks for your response: Let me explain a little more. As I said before we want to develop a module for upload files using FTP. What this module do? (in theory). 1) Upload a file using via HTML form 2) Put the file inside a temporary folder 3) When the admin login then they can check using "Directory" functions the content of the file 4) Even to the upload the file data as, for example, Title, Author, Date, File Path and some other stuff will be store in a temporary DB table 5) The admin agree with the documentation file or it can delete. Understand now? What I'm not know: How to develop the module? From where start? How I can build the menu and the admin access? Anyway if this is not the correct list, then what is the subscribe address for the right list? Thanks again PS: Soury for my poor English -- ReynierPM 5to Ing. Informática Maestro de poco, aprendiz de mucho -----Mensaje original----- De: development-bounces(a)drupal.org [mailto:development-bounces@drupal.org] En nombre de Larry Garfield Enviado el: jueves, 23 de noviembre de 2006 1:08 pm Para: support(a)drupal.org CC: development(a)drupal.org Asunto: Re: [development] Newbie with Drupal and Modules Development On Thursday 23 November 2006 12:11, Reynier Perez Mira wrote: > Hi to every in the Community: > First of all let me tell to every that I'm newbie using Drupal and > developing modules for it. In my University me and a groups of student > start to using Drupal for a Web Portal but we need some additional > functionalities like documentation management. This special module > have in the first version this: * Allow users to upload every kind of > files, maybe we need filter the .doc, .pdf, .zip and .tar.gz files * > This files need to be upload to a FTP Server > * Allow administrators admin (approve, edit info, delete) the files > from the FTP So, because I'm the Team Manager I need some information > about how to develop modules (if is in Spanish better). I read some > tutorials in the Drupal site but some stuff are not clear for me like > permissions, access, menu, integrate admin and users and some others. > Cheers, thanks in advance and waiting for your reply Drupal can't track files uploaded via FTP independently of Drupal. It has no way of knowing they're there. However, if web-based upload is OK for you, then there are, I believe, at least 2 "files as nodes" modules availabe in contrib. Simply set the default publishing state for the node to "in moderation queue, not published", and then you can use the usual node moderation options to allow admins to approve or delete pending nodes. This is more of a support question than a devel question, though, so I'm copying this over to the support list. Please reply there. Thanks. -- Larry Garfield AIM: LOLG42 larry(a)garfieldtech.com ICQ: 6817012 "If nature has made any one thing less susceptible than all others of exclusive property, it is the action of the thinking power called an idea, which an individual may exclusively possess as long as he keeps it to himself; but the moment it is divulged, it forces itself into the possession of every one, and the receiver cannot dispossess himself of it." -- Thomas Jefferson

2 1

Newbie with Drupal and Modules Development
by Reynier Perez Mira 23 Nov '06

23 Nov '06

Hi to every in the Community: First of all let me tell to every that I'm newbie using Drupal and developing modules for it. In my University me and a groups of student start to using Drupal for a Web Portal but we need some additional functionalities like documentation management. This special module have in the first version this: * Allow users to upload every kind of files, maybe we need filter the .doc, .pdf, .zip and .tar.gz files * This files need to be upload to a FTP Server * Allow administrators admin (approve, edit info, delete) the files from the FTP So, because I'm the Team Manager I need some information about how to develop modules (if is in Spanish better). I read some tutorials in the Drupal site but some stuff are not clear for me like permissions, access, menu, integrate admin and users and some others. Cheers, thanks in advance and waiting for your reply -- ReynierPM 5to Ing. Informática Maestro de poco, aprendiz de mucho

2 1

Core committer
by Dries Buytaert 23 Nov '06

23 Nov '06

Hello world, as some of you might have guessed, I plan to elect another core maintainer. Just like Gerhard is a dedicated Drupal 4.7 maintainer, and Neil is a dedicated Drupal 5 maintainer, I'm looking for a dedicated Drupal 6 maintainer. This maintainer is only allowed to commit to the Drupal 6 branch (and to CVS HEAD until the Drupal 6 branch is created). Remind that only Steven and myself can commit to all branches. If you think you have what it takes to be a Drupal 6 maintainer, I'd like to hear from you. Send me your application in _private_ and we can talk more. Note that I don't just pick anyone -- I only pick those who I have successfully worked with in the past, that bring a certain talent to the table (see http://buytaert.net/neil-drumm for why I picked Neil), and whose vision aligns with my own. Like it or not. Being a core maintainer is a significant commitment; it takes a lot of time/effort and this for a period of at least two major release cycles (i.e. 1-2 years). I'm sure that Neil and Gerhard can assert this so don't take this lightly. Reviewing patches is not always the most exciting job in the world either, however, defining the future of Drupal is. Part of your job will be to lead and guide other developers in this awesome adventure. I don't want to discuss applications in public, so make sure to send them to me in private. Thanks! -- Dries Buytaert :: http://www.buytaert.net/

1 0

no cookies = "access denied" ?!
by sime 23 Nov '06

23 Nov '06

Dear dev-list I have an issue that I feel is important but hard to categorize. I have a Drupal 4.7 site with a generally non-web-savvy audience. In fact, I believe some of my visitors don't use the internet for anything else. After trawling through drupal.org, the general concensus seems to be : "people who disable cookies get what they deserve". However, since I have users who don't know any better, their first impression of Drupal is "Access Denied". They don't get any indication of what they are doing wrong, so I see in the log sometimes they reset their password 3 times in a row, and then email my client with a complaint. I think this issue is quite important, because it effects a soon-to-be-tapped audience. I've emailed this list to get an idea of how to proceed: 1. File this as a core documentation issue, there should be a warning on the login page. 2. File this as a bug, well put my eggs into this basket: http://drupal.org/node/58019 3. Develop a module or something that uses php or javascript to warn the user (or redirect or something logical) Thanks Simon

3 3

Re: [development] RFC: letting modules phone home to check for newreleases
by Nathaniel Catchpole 23 Nov '06

23 Nov '06

Re the command line php idea. I've been using one host for a couple of months which does chrooted ssh, and absolutely won't allow wget at all. I could see that kind of command line php update being useful in that situation (not sure how common it is though), but if wget is available then it really doesn't take long to do it that way. The awkward thing is shared hosting with no ssh, but apart from the permissions/security issues, IMO taking the need to ftp up and down from people would just end up deskilling, leading to more problems long term. Nat -- Confidentiality: This email and its attachments are intended for the addressee only and may be confidential or the subject of legal privilege. If this email and its attachments have come to you in error you must take no action based on them, nor must you copy them, distribute them or show them to anyone. Please contact the sender to notify them of the error. Security: Security Warning: Please note that this e-mail has been created in the knowledge that e-mail is not a 100% secure communications medium. We advise that you understand and observe this lack of security when e-mailing us. Viruses: This email and any attached files have been scanned for the presence of computer viruses. However, you are advised that you open any attachments at your own risk. Please note that electronic mail may be monitored in accordance with the Telecommunications (Lawful Business Practices) (Interception of Communications) Regulations 2000. Disclaimer: Any views or opinions presented are solely those of the author and do not necessarily represent those of B6 Sixth Form unless explicitly stated otherwise ----------------------------------------------------------------------- This message has been inspected by DynaComm i:mail -----------------------------------------------------------------------

1 0

Module updater module
by Angela Byron 23 Nov '06

23 Nov '06

I set out to port my 3rd or 4th module to 5.x today, and started doing calculations about time/effort spent per module, and also started musing about the fact that I needed some way to flex my regex muscles, so I came up with this: http://cvs.drupal.org/viewcvs/drupal/contributions/sandbox/webchick/ module_updater/ it's in my sandbox rather than an actual project, because about 10 hours into it when I only had a couple functions written, it started to get really daunting and I wasn't sure if I really wanted to continue working on it or not. ;P I'll see again in the morning. ;) In the meantime: - It generates an .info file and removes the description from hook_help (or hook_help altogether if that's all that was in it) - It adds a menu item for any hook_settings() and changes the return $form to return system_settings_form($form) - It replaces user_mail with drupal_mail() and generates a unique $mailkey for each instance. - It replaces module_exist with module_exists() ;) - It replaces user_mail_wrapper with drupal_mail_wrapper. :P - It also provides documentation for certain changes so that people can alter the "guess" behaviour that the script has to do (ex: dependencies in .info files) - It drupal_set_message()s any changes that it made so that you can go back and correct the work if necessary. It is also probably horribly buggy and has a very long way to go before all of the items at http://drupal.org/node/64279 are covered (I've created skeleton functions in the .inc file for all transition issues). The next ones I'll probably focus on are the t() changes, the hook_view changes, and the hook_link changes, as those have all bit me before. But anyway, if someone wants to take a look, it's there. Or, if someone wants to work on it with me for some reason, let me know! Thanks to eaton, merlinofchaos, dopry and whoever else was in #drupal at the time who helped me brainstorm about this. :) -Angie

3 4

The last critical (I hope) before the next beta
by Karoly Negyesi 23 Nov '06

23 Nov '06

Hi, Someone with appropriate CSS knowledge should attack http://drupal.org/node/92849 . Steven asked for some stuff. I can lend my browsercam account for testing , contact me in private. The other patches are progressing nicely. Regards NK

1 0

Let's kill $user->data
by Karoly Negyesi 23 Nov '06

23 Nov '06

Hi, Two steps a) We remove $user->data handling code from D6 core. No save, no load. New installs won't have this column. b) D7 will drop the $user->data if it exists. (SELECT * FROM user, $account = db_fetch_array, if(isset($account['data'])) -- no need for DDL to check for a column). This way D6 contribs can clean up $user->data and migrate to their own tables. Regards NK

7 6

Re: [development] RFC: letting modules phone home to check fornew releases
by Metzler, David 23 Nov '06

23 Nov '06

I know that this is a sensitive issue, and I'm certainly interested in security so, I though that I'd point out that there is already some drupal functionality, if memory serves, for creating the settings.php file from the web interface at install time, which would seem to require that you make your sites directory writeable by the www user. Because in the end its all code that gets executed within drupal, I think there's not much difference between being able to write to settings.php and being able to write to the modules directory (IMHO). So from a security perspective, it seems to me we've already crossed this bridge. I could put just as damaging code in the settings.php file as I could in any module directory the way drupal is architected. I agree that command line tools would be a really nice feature, but I thought that the discussion of being creeped out regarding the modules directory was promoting a false sense of security. Dave -----Original Message----- From: development-bounces(a)drupal.org [mailto:development-bounces@drupal.org] On Behalf Of Darrel O'Pry Sent: Wednesday, November 22, 2006 2:05 PM To: development(a)drupal.org Subject: Re: [development] RFC: letting modules phone home to check fornew releases write perms to modules directory from drupal as web server user is really hard for me to swallow.... any package managers like script should be run from the command line as a privileged user. should do it's set job and be bullet proof. On Wed, 2006-11-22 at 11:21 +0100, Oswald Jaskolla wrote: > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > > Wow, > > Oswald Jaskolla wrote: > > I am currently working on a system to automatically install modules. > > looks like I really hit a nerve there. So let me clarify a few things: > > - - Downloading and installing is only done on explicit request of the > administrator. I am not Microsoft. > - - Downloaded files are not less safe because they are downloaded via > PHP. There is currently no checksumming available and apart from > developers nobody looks into the code to see if it was tampered with. > - - There are a lot of drupal installations for development and testing, > that do not have the same security needs as production sites have. > - - Typo3 does it. > > The only security issue remaining is having write access to the > modules directory. If the actual downloading and unpacking is done via > a one time cron job, this cron job could temporarily alter the access > mode of the target directory, minimizing the time that the directory is writable. > > Greetings, > - -- > Oswald Jaskolla > Ingenieurbüro Richard Schieferdecker > Kreuzherrenstraße 2 > 52062 Aachen > > Tel.: 02 41 / 409 54 43 > Fax: 02 41 / 477 05 199 > mobil: 01 64 / 941 06 75 > eMail: oswald.jaskolla(a)schieferdecker.com > -----BEGIN PGP SIGNATURE----- > Version: GnuPG v1.4.5 (MingW32) > Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org > > iD8DBQFFZCSquinSHQ/4/T4RAsUmAJ4sTVuIs5eKpQgOCn9sZ6QvOub7YwCeN39w > pnLSOei74O+fQkwTaHF1sho= > =aIUQ > -----END PGP SIGNATURE----- >

1 0