December 2006 - Development - lists.drupal.org

Re: [development] Seems I need to take sandbox in my own hands
by Chad Phillips -- Apartment Lines 05 Jan '07

05 Jan '07

i'm just going to toss this out there as a general proposal: 1. move the sandbox completely out of the contrib repo, and make a new one -- this has the dual benefit of moving our 'messy' space away from our 'clean' space, and making the checkouts of the contrib repo faster/cleaner. you can then checkout the mess if you choose to. :) 2. in the new 'sandbox' repo, put a limit on how much each user can have in their active folder -- maybe 1 or 2 MB, which should be plenty for an experimental code home. i think this would be a pretty easy thing to implement. this would allay any bandwidth/space concerns about our chaotic space. i love the idea of having a more clear policy of what goes where, and setting up systems that encourage collaboration. i feel that a community place for chaos belongs in that map somewhere...

7 6

how to watch for modules/themes being enabled
by Gabor Hojtsy 04 Jan '07

04 Jan '07

Hi, I am in the process of implementing autolocale module, as you might already know (by reading the development list). This module now nicely imports PO files in install time and can import PO files later for all enabled components (modules/themes) with an optional database cleanup. The next (and for basic operation the last) step is to automatically import PO files for modules/themes enabled on the admin interface. I have tried to look into Drupal HEAD source to quickly solve this issue, but there was no immediate help. The drupal_install_modules() function seemed to be an inviting place, since it knows what modules are being installed the first time. Also drupal_enable() is called for modules previously disabled but being enabled again. None of these "call out" with a hook to inform possible evesdropping modules that a new module is installed or a previously disabled module is being enabled again. My autolocale would however would love to get informed. I also looked into themes, and found that the logic enabling themes is in system_themes_submit(). Interesting fact that the block initialization is wired in, because block module cannot watch for a theme being enabled (lines 1198-1201): "If theme status is being set to 1 from 0, initialize block data for this theme if necessary." After all it seems that my only option is to look for the module/theme list form appearing on the admin screen and alter the form to hook my module to the submit action. When the form is submitted, do the same checks the system.module does to identify installed/enabled/disabled modules/themes, so I know what autolocale should do. Maybe it is not too late to stuff a few module_invoke_all() calls to the proper places so module/theme changes are advertised for modules to watch for. If it is too late, I would be very interested if others faced the same problem and how did they solved it. Gabor

8 21

Porting - Quick security reminders
by Heine Deelstra 04 Jan '07

04 Jan '07

Dear all, Porting a module is an excellent opportunity to keep an eye out for security problems (evidence: <http://drupal.org/node/103943>). Here's a quick security reminder regarding input (user-supplied data). Code samples are only included to make a point, do not hold them against me. Escape or filter text before display ==================================== If you do not escape or filter text before display, you enable a user to insert arbitrary HTML and scripts into pages. This type of attack is know as cross site scripting aka XSS. For more information, see: <http://drupal.org/node/28984> Escape / filter: - check_plain or theme('placeholder') for plain text - check_markup or filter_xss for markup containing text Drupal 5 brought a (brilliant IMO) change to t(): Depending on the placeholder's sigil, it is passed through theme('placeholder') (%) or check_plain (@) automatically. t('I escape %user_data', '%user_data'); // I escape <em>user_data</em> (safe) t('I escape @user_data', '@user_data'); // I escape user_data (safe) t('I don't escape !user_data', '!user_data'); // XSS vulnerability Sometimes the difficult part is to know whether a function requires escaped text or does the escaping itself: * Automatically escapes: l() - Escapes text and attributes unless you pass TRUE for the $html parameter. In that case only attributes are check_plained. - menu items & breadcrumbs - block descriptions (*not* titles) - theme('username') * Common pitfalls: watchdog - you have to provide a safe $message drupal_set_title - you have to provide a safe $title Form elements - #description and #title of form_elements need to be safe Form elements - #value of #type markup and item need to be safe. Note that the default form element #type is markup! Examples: drupal_set_title($node->title); // XSS vulnerability drupal_set_title(check_plain($node->title)); watchdog(content', t("Deleted !title", array('!title' => $node->title)); // XSS watchdog(content', t("Deleted %title", array('%title' => $node->title)); // or @ $form['unsafe'] = array('#value' => $user->name); //XSS $form['safe'] = array('#value' => check_plain($user->name)); or $form['safe'] = array('#value' => theme('username', $user)); $form['bad'] = array( '#type' => 'textfield'; '#default_value' => check_plain($u_supplied), // bad: escaped twice '#description' => t("Old data: !data", array('!data' => $u_supplied)), // XSS ); $form['good'] = array( '#type' => 'textfield'; '#default_value' => $u_supplied, '#description' => t("Old data: @data", array('@data' => $u_supplied)), ); Database (ab)use ==================================== See also <http://drupal.org/node/101496> Summary: Whatever you do, *never* use user supplied data directly in a query. Use db_query as it was meant to be used: data goes in arguments. And make sure to enclose %s in single quotes: '%s'. BAD, BAD, BAAAD: 1.db_query("SELECT t.s FROM {table} t WHERE t.field = $from_user"); 2.db_query("SELECT t.s FROM {table} t WHERE t.field = %s", $from_user); Good: db_query("SELECT t.s FROM {table} t WHERE t.field = '%s'", $from_user); BAD ($from_user is an array of numbers): db_query("SELECT t.s FROM {table} t WHERE t.field IN (%s)", $from_user); Good: $placeholders = implode(',', array_fill(0, count($from_user), "%d")); db_query("SELECT t.s FROM {table} t WHERE t.field IN ($placeholders)", $from_user); Anything else: bad. Why is this bad? Suppose you check the data that you stuff in to a query (e.g. 'all numeric'). Or, you know a user name is validated to contain only certain 'safe' characters. The problem is that you open the possibility that a code path develops where unfiltered content ends up at your query. In that case you're toast. This code path can arise because you 1) accidentally remove validation in future development, 2) a user adds a module that is more lenient in the data it accepts or 3) you add a bunch of code that skips validation (recent xTracker problem). Writing secure code ==================================== If you want to read more about security, I suggest that you start at "Input the root of all evil" <http://drupal.org/node/101495> in the "Writing secure code" <http://drupal.org/node/62304> pages. I hope to expand and improve those pages in the future, but some of them are already useful. You found a vulnerability? ==================================== What to do when you find a vulnerability in your module? Simple; write us at security(a)drupal.org. Thank you for listening, Heine Deelstra

5 7

Subscriptions module for Drupal.org (was Re: You know what would be really cool for d.o?)
by Boris Mann 02 Jan '07

02 Jan '07

On 12/27/06, Johan Forngren <johan(a)forngren.com> wrote: > > > On 12/27/06, Earnie Boyd <earnie(a)users.sourceforge.net> wrote: > > I know this really should be a feature request but I'm not sure which > > issue tracker to put it in. If someone could point I'll be happy to. > > > > 1) I would like to see a Subscribe button on a particular issue so that > > I can easily subscribe to an issue. This is a long requested feature in much more general terms -- i.e. subscribing to forum threads, etc. Generally, notification via email / RSS is desired. The meta issue is that we need someone to write a robust, lightweight, highly scaleable subscription framework capable of handling the volume on Drupal.org. There is the existing subscriptions module (http://drupal.org/project/subscriptions) that doesn't quite meet all of those needs yet. -- Boris

5 5

Appeal for Help – Creating an Online Network Module
by Aaron Kreider 31 Dec '06

31 Dec '06

I'm looking for help! *Statement of Purpose* General: Online network module that includes people, groups, events, resources (a.k.a. files), schools – and several less useful things (email lists, campaigns). Users submit information and then control it. Features include: geocoding (both US and international), mapping, total syndication using web-services (the software is separated into server and client parts), international language support, interconnections (people can be connected to groups, that can be connected to issues, that can be connected to resources and so on), an automated email newsletter, and more. Specific: Targets the needs of activists (including people new to activism, part-time activists, and full-time organizers). Particularly useful for grassroots organizations with limited resources. *Demo* The original software whose functions I want to port to Drupal is running on CampusActivism.org and ActivismNetwork.org with 3700 people, 1500 groups, 430 resources and 1400 events. Developer Site: www.activismnetwork.org/developers/ *Ways to Help* I'm looking for 1) People willing to give me guidance relating to integration with Drupal. On questions like best practices for module development, how to use existing Drupal modules, how to combine my system with Drupal, etc. 2) Developers 3) Users who want to give feedback on features *My Experience* -5 years PHP/MySQL development, 10 years doing activism. -Installed a couple Drupal sites, and have studied online documentation. But am new to module/theme development. -I'm working on this project full-time. *Possible Timeline* Start off by integrating with the Drupal user system and for the most functions just port existing code. In the long run, integrate with more existing Drupal modules or split my code into smaller parts that can be turned into Drupal modules. One of the problems with integrating with Drupal is that my software uses web services to do a lot of its work. If you are interested, please contact me: aaron(a)campusactivism.org -- ---------------------------------------------------------------- Tools for Grassroots Activists +www.CampusActivism.org +www.ActivismNetwork.org Help Build the Platform - www.ActivismNetwork.org/developers/ ----------------------------------------------------------------

1 0

Release critical bugs for December 31, 2006
by drupal-devel＠drupal.org 31 Dec '06

31 Dec '06

Article / bug reports 4.7 Beta/ CVS Errors assigned: msameer age: 40 weeks 2 days url: http://drupal.org/node/55533 CVS management/tracker / feature requests provide admin UI to set a release node's CVS tag to '' age: 2 weeks 2 days url: http://drupal.org/node/103427 enforce sequential release tags in xcvs-taginfo assigned: dww age: 9 weeks 5 days url: http://drupal.org/node/90968 Event / bug reports Multiple-day event does not show in block after start date age: 6 weeks 2 days url: http://drupal.org/node/98119 [php5, clone] end-start-ongoing attribute does not ripple through age: 13 weeks 5 days url: http://drupal.org/node/85972 Major timezone bug in event module age: 19 weeks 6 days url: http://drupal.org/node/78572 event_start not being set age: 31 weeks 2 days url: http://drupal.org/node/65609 Fatal Error After activating "Browse Scheduled Events" in modules age: 34 weeks 2 days url: http://drupal.org/node/61920 INSTALL.txt incorrect age: 36 weeks 6 days url: http://drupal.org/node/59019 event calendars off by day/not respecting timezones - fix? age: 39 weeks 5 days url: http://drupal.org/node/56189 Flexinode generates an error age: 40 weeks 4 days url: http://drupal.org/node/55135 Calendar subscribing not working age: 41 weeks 4 days url: http://drupal.org/node/54036 Problem Selecting Event by Type age: 42 weeks 4 days url: http://drupal.org/node/52883 Event start and end times not getting saved in database age: 1 year 2 weeks url: http://drupal.org/node/41300 Issues with list view for events age: 1 year 3 weeks url: http://drupal.org/node/39943 Database error keeps popping up age: 1 year 4 weeks url: http://drupal.org/node/39396 Date problem on calendar, off by GMT offset age: 1 year 4 weeks url: http://drupal.org/node/39193 Events module bugs adding and changeing events age: 1 year 4 weeks url: http://drupal.org/node/39016 gmdate() warnings on windows install assigned: Omar Abdel-Wahab age: 1 year 26 weeks url: http://drupal.org/node/26140 Event / support requests Blank Page After Submit age: 37 weeks 19 hours url: http://drupal.org/node/58918 Can't Administer Event Module age: 51 weeks 2 days url: http://drupal.org/node/43509 displaying event start info in flexinode tabular view? age: 1 year 12 weeks url: http://drupal.org/node/33019 Event block missing content of many fields age: 1 year 14 weeks url: http://drupal.org/node/31532 Feature / bug reports 5.x - broken 'detailed information' and 'screenshot' links age: 1 week 10 hours url: http://drupal.org/node/105022 Filebrowser / bug reports ArrayMerge Errors with PHP5 age: 44 weeks 1 day url: http://drupal.org/node/51174 Filebrowser / support requests File paths generated by new filebrowser are not leading to the file age: 18 weeks 10 hours url: http://drupal.org/node/80903 Gallery / bug reports IE error using embed not error with none-embed... when navigation block on right age: 34 weeks 1 day url: http://drupal.org/node/62119 Gallery / support requests import existing gallery2 user account age: 1 year 8 weeks url: http://drupal.org/node/35920 Glossary / feature requests po files and other language support age: 48 weeks 4 days url: http://drupal.org/node/46313 Goofy / feature requests Goofy Forum UI age: 1 year 13 weeks url: http://drupal.org/node/32294 Htmlarea / bug reports Module does not work age: 3 days 18 hours url: http://drupal.org/node/105475 if Clean URLs is Enabled, upload_image in htmlarea not working age: 23 weeks 6 days url: http://drupal.org/node/74119 htmlArea/xinha firefox freezes (multiple textareas) age: 30 weeks 2 days url: http://drupal.org/node/66746 Layout is quirky age: 42 weeks 5 days url: http://drupal.org/node/52741 Toolbar won't display correct in IE 6 with Pushbutton Theme age: 1 year 16 weeks url: http://drupal.org/node/30696 Htmlarea / support requests Problem with size of button assigned: khayman age: 35 weeks 5 days url: http://drupal.org/node/60255 Listhandler / bug reports user lookup on name only assigned: zeroj age: 39 weeks 6 hours url: http://drupal.org/node/56936 Link to mailhandler does not use l() function age: 50 weeks 1 day url: http://drupal.org/node/44599 Listhandler caused error in "comment.module on line 996" ? age: 1 year 8 weeks url: http://drupal.org/node/36244 Listhandler 4.6.0 fails to send emails at all age: 1 year 23 weeks url: http://drupal.org/node/27095 Listhandler / tasks Correct/Complete Documentation age: 1 year 9 weeks url: http://drupal.org/node/34909 Mailhandler / support requests Creating a page using mailhandler age: 28 weeks 4 days url: http://drupal.org/node/68947 Mail Body not downloaded age: 51 weeks 3 days url: http://drupal.org/node/43374 Members / bug reports Update: beta5 and possible problem with php 4 age: 43 weeks 3 days url: http://drupal.org/node/52004 Patch for member.module to bring it up to 4.7 age: 47 weeks 1 day url: http://drupal.org/node/47829 foreach() assigned: neablo age: 1 year 5 days url: http://drupal.org/node/42350 Node (key)words / bug reports Error on delete node age: 18 weeks 2 days url: http://drupal.org/node/80505 can't use php functions in body of nodes assigned: Robrecht Jacques age: 19 weeks 2 days url: http://drupal.org/node/79315 Node (key)words / feature requests Can't Put Keywords in Categories age: 10 weeks 2 days url: http://drupal.org/node/90199 Enable nodewords for node type? age: 46 weeks 1 day url: http://drupal.org/node/48869 Node Aggregator / bug reports nodes are being created with no body age: 1 year 3 weeks url: http://drupal.org/node/40373 missing promote column assigned: Bèr Kessels age: 1 year 5 weeks url: http://drupal.org/node/38836 Naming issues with files and DB tables age: 1 year 10 weeks url: http://drupal.org/node/34298 RSS "no element found at line 1" age: 1 year 26 weeks url: http://drupal.org/node/26185 Outdated help texts age: 2 years 21 weeks url: http://drupal.org/node/9692 Import doesn't like XML/RSS feeds with no Title element age: 2 years 30 weeks url: http://drupal.org/node/8128 Node Aggregator / tasks move XML-parser into an inclde file. age: 1 year 27 weeks url: http://drupal.org/node/25439 Notify / bug reports A specific entry age: 7 weeks 4 days url: http://drupal.org/node/93616 Path / bug reports Login as an alias gets cached age: 1 year 14 weeks url: http://drupal.org/node/31699 Poormanscron / support requests Poormanscron not doing what it says on the tin age: 16 weeks 1 day url: http://drupal.org/node/83252 Privatemsg / bug reports contacts not found age: 4 weeks 6 days url: http://drupal.org/node/99789 When enableing the module, Drupal tries to update instead of install age: 13 weeks 19 hours url: http://drupal.org/node/86830 privatemsg module: - database error - incompatibility with relationship module age: 46 weeks 1 day url: http://drupal.org/node/48866 Remindme / bug reports Argument #1 is not an array age: 28 weeks 2 days url: http://drupal.org/node/69286 Cron job creates SQL error age: 30 weeks 5 days url: http://drupal.org/node/66202 Subscriptions / bug reports Creating nodes resets OG e-mail subscription settings age: 10 weeks 5 days url: http://drupal.org/node/89506 Subscriptions remain active when access control maintain subscriptions is disabled age: 12 weeks 3 days url: http://drupal.org/node/87625 Taxonomy dhtml / bug reports IE 7 javascript errors on the page that display the categories age: 4 weeks 46 min url: http://drupal.org/node/101100 Disabling Teasers (Trimmed Posts) Not working when set to Unlimited assigned: samdeskin age: 9 weeks 3 days url: http://drupal.org/node/91299 doesn't work with taxonomy_access? age: 14 weeks 2 days url: http://drupal.org/node/85355 Error on Page with Internet Explorer 6 age: 28 weeks 4 days url: http://drupal.org/node/68906 Taxonomy DHTML's cache ignores user privileges age: 32 weeks 1 day url: http://drupal.org/node/64532 Does not work correctly in Internet Explorer age: 1 year 12 weeks url: http://drupal.org/node/33354 javascrip downloads square.gif for every category age: 1 year 45 weeks url: http://drupal.org/node/17366 Taxonomy dhtml / feature requests A unique page for each category group? age: 1 year 10 weeks url: http://drupal.org/node/34610 Taxonomy navigation / bug reports Taxonomy links only work for the first line of links assigned: PierreFWalter age: 44 weeks 2 days url: http://drupal.org/node/51149 TrackBack / bug reports install script does not put curly braces around table name age: 4 weeks 3 days url: http://drupal.org/node/100634 Sends trackbacks for unpublished nodes assigned: ankur age: 1 year 48 weeks url: http://drupal.org/node/16239 User experience / bug reports Verification Active assigned: maverickvarun age: 3 weeks 5 days url: http://drupal.org/node/101384 mail() has been disabled for security reasons assigned: pilotos age: 13 weeks 23 hours url: http://drupal.org/node/86798 Webserver Auth / bug reports Logging out error age: 39 weeks 2 days url: http://drupal.org/node/56663 Wiki / bug reports the wiki module can't work with HTML age: 47 weeks 5 days url: http://drupal.org/node/47124

3 2

Release Candidate 1 of Drupal 5
by Heine Deelstra 31 Dec '06

31 Dec '06

Yesterday, we ran out of critical bugs. That means that the first release candidate of Drupal 5 is ready! You can see the announcement at <http://drupal.org/drupal-5.0-rc1>. About 122 bugs and performance improvements, big and small have been fixed since beta 2 <http://drupal.org/node/103420>. As you can read in the announcement, now is the time to start updating and releasing your modules. I've appended a list of important modules. The listed modules were downloaded more then 1000 times in the month October. Whether a module is available for Drupal 5.x was solely indicated by its presence on the 5.x download page. Remember: adoption of Drupal 5 depends for a large part on the available modules. Regards, Heine Available on download page: Adsense Audio BBCode Buddylist CCK Date Devel FCKEditor Frontpage Gallery IMCE Organic groups Panels Pathauto Views Views bonus pack VotingAPI Not available on download page: Accents Acidfree Administration Advuser Article Attachment Backup Banner Blogger Captcha Category Chatbox Chatroom Controlpanel Ecommerce Email page Event Feedback Filemanager Flexinode Gmap Google analytics Gsitemap Guestbook Image Image assist Internationalization Logintoboggan Nice menus Nifty corners Nodewords Poormanscron Print Simplenews Taxonomy Access control Theme editor TinyMCE Video Webform Wordfilter

5 4

Re: [development] Connecting to multiple databases in 5.x
by Steven Peck 30 Dec '06

30 Dec '06

Chris submitted a patch to mention this change of behavior during the install. I spent about 5 minutes being very confused last week when I came across this as well. -sp > -----Original Message----- > From: development-bounces(a)drupal.org [mailto:development- > bounces(a)drupal.org] On Behalf Of Karen Stevenson > Sent: Friday, December 29, 2006 12:54 PM > To: development(a)drupal.org > Subject: Re: [development] Connecting to multiple databases in 5.x > > In windows at least, the file is actually made read-only and I never saw > any status message telling me that. That's OK and makes sense, but was a > surprise when I tried to edit the file and couldn't. My concern was that > if I temporarily removed the read-only access and made my changes that I > was going to do something that would create big problems for me down the > road (i.e. that it was write-protected partly so that nothing on it would > get altered in any way, even by me). So at the very least, any documention > that talks about making changes to the settings.php file from 5.x on > should mention that the file may be write-protected but it is OK to remove > the protection, make the changes, and re-protect it, since the fact that > it is read-only is going to scare others away from changing it. > > This came up because I have a module that needs a connection to an > external database to work and my previous instructions to users were to > make that change in their settings file, but the fact that it is now > write-protected might frighten them unnecessarily. I did it that way > instead of asking them to input the database connection info on the > settings page because I really don't like storing info like that in the > database. > > Anyway, if I don't have to worry about breaking something by making that > change, I can go back to doing it this way and document this in my > INSTALL.txt file. > > Thanks! > > Karen > > ----- Original Message ---- > From: Chris Kennedy <chrisken(a)mail.utexas.edu> > To: development(a)drupal.org > Sent: Friday, December 29, 2006 12:29:54 PM > Subject: Re: [development] Connecting to multiple databases in 5.x > > Settings.php is made read-only on install if possible (using > drupal_verify_install_file). See http://drupal.org/node/105368 which > adds a status message to clarify this (and needs a review). Or maybe it > would be better to have the read-only change be a checkbox on the > install page that is enabled by default but can be disabled. > > Also keep in mind that Drupal gives incorrect error messages in some > cases when settings.php is unreadable or doesn't exist. This might make > you think your database settings are wrong, when it is really a > permissions issue. http://drupal.org/node/100476 fixes some of these > cases (and needs a review). > > So, theoretically http://drupal.org/node/18429 should still work. > > Morbus Iff wrote: > >> Now that the settings.php file is write protected, the instructions > >> at http://drupal.org/node/18429 no longer work to connect to multiple > >> databases. I searched around but wasn't able to find anything on a > >> recommended way to do this in 5.x. And, of course, the documentation > >> on that page needs to be updated, too. > > > > settings.php is not write-protected. More than likely: > > > > * your webserver is a user and group that you don't have access to. > > * when the install.php wrote your settings.php for you, it was > > unable to give you proper permissions to write to the file. > > > > Drupal does not enforce write protection on the settings.php. > > The above is still the right way of doing multiple databases. > > > > The installer should be creating the file as writable. Could you tell > > us more about the permissions and ownership it created for that file? > > > > > > > >

3 2

If you want to alter taxonomy select
by Karoly Negyesi 29 Dec '06

29 Dec '06

Hi, If your module was ported to 5.0 already and it works, you have not got anything new to do. But what happens when it does not work because it wants to alter the taxonomy select box on a node form? Taxonomy select #options is nothing like they were in 4.7 and the new format is harder to manipulate. In this case you need to read http://drupal.org/node/64279#options -- sorry for adding a helper this very late but it is a helper, it is needed very rarely (that's why noone realized the need until now but thanks to Derek it still made it to 5.0) and it's very useful. Regards NK

2 1

Re: [development] Connecting to multiple databases in 5.x
by Karen Stevenson 29 Dec '06

29 Dec '06

In windows at least, the file is actually made read-only and I never saw any status message telling me that. That's OK and makes sense, but was a surprise when I tried to edit the file and couldn't. My concern was that if I temporarily removed the read-only access and made my changes that I was going to do something that would create big problems for me down the road (i.e. that it was write-protected partly so that nothing on it would get altered in any way, even by me). So at the very least, any documention that talks about making changes to the settings.php file from 5.x on should mention that the file may be write-protected but it is OK to remove the protection, make the changes, and re-protect it, since the fact that it is read-only is going to scare others away from changing it. This came up because I have a module that needs a connection to an external database to work and my previous instructions to users were to make that change in their settings file, but the fact that it is now write-protected might frighten them unnecessarily. I did it that way instead of asking them to input the database connection info on the settings page because I really don't like storing info like that in the database. Anyway, if I don't have to worry about breaking something by making that change, I can go back to doing it this way and document this in my INSTALL.txt file. Thanks! Karen ----- Original Message ---- From: Chris Kennedy <chrisken(a)mail.utexas.edu> To: development(a)drupal.org Sent: Friday, December 29, 2006 12:29:54 PM Subject: Re: [development] Connecting to multiple databases in 5.x Settings.php is made read-only on install if possible (using drupal_verify_install_file). See http://drupal.org/node/105368 which adds a status message to clarify this (and needs a review). Or maybe it would be better to have the read-only change be a checkbox on the install page that is enabled by default but can be disabled. Also keep in mind that Drupal gives incorrect error messages in some cases when settings.php is unreadable or doesn't exist. This might make you think your database settings are wrong, when it is really a permissions issue. http://drupal.org/node/100476 fixes some of these cases (and needs a review). So, theoretically http://drupal.org/node/18429 should still work. Morbus Iff wrote: >> Now that the settings.php file is write protected, the instructions >> at http://drupal.org/node/18429 no longer work to connect to multiple >> databases. I searched around but wasn't able to find anything on a >> recommended way to do this in 5.x. And, of course, the documentation >> on that page needs to be updated, too. > > settings.php is not write-protected. More than likely: > > * your webserver is a user and group that you don't have access to. > * when the install.php wrote your settings.php for you, it was > unable to give you proper permissions to write to the file. > > Drupal does not enforce write protection on the settings.php. > The above is still the right way of doing multiple databases. > > The installer should be creating the file as writable. Could you tell > us more about the permissions and ownership it created for that file? >

1 0