March 2006 - Development - lists.drupal.org

Module grouping or dependencies for 4.7.0?
by Derek Wright 14 Mar '06

14 Mar '06

since my last request for new functionality in 4.7.0 went over so well, i thought i'd try again. ;) (just kidding). seriously, this is a pain in the ass for CCK usability: http://drupal.org/node/49690 all of CCK's field types are implemented as separate modules. they currently have names like "text.module" or "date.module", etc. however, that means they show up all over the place in the admin/modules page, which makes it hard for admins to enable all the required modules for CCK. apparently, there are a couple of possible solutions: http://drupal.org/node/18447 "Simple dependency system" this one has a patch by chx waiting to be committed. http://drupal.org/node/19477 "Module Grouping by Folder in Admin/Modules" this is just in the "it'd-be-nice-if..." phase, so there's basically no hope for this one in 4.7.x. if neither of these issues gets fixed for 4.7, CCK is going to have to rename all its files (and therefore function names), to avoid user confusion, and make CCK easier to administer and use. people have mentioned a few other modules (ecommerce, etc) where this is a problem. i'd love to avoid the pain of renaming things in cvs (no one say "svn" or "bzr", or i'll scream), but we're going to have to do that before 4.7.0 really goes live if neither of these issues (or something very similar) get fixed for 4.7.0. should i give up hope and start working on renaming the CCK field modules to "cck_field_text", "cck_field_date", etc (or something)? i don't want to spend time writing a patch for core to group modules from the same subdirectory together on the admin/modules page, if there's no chance it would get committed in time for 4.7.0. please let me know. thanks, -derek

7 8

Re: [Security announcements] Security bypass in menu.module
by piotr＠mallorn.ii.uj.edu.pl 14 Mar '06

14 Mar '06

Hello, On Mon, Mar 13, 2006 at 11:46:43PM +0000, Drupal Security Team wrote: > <h2>Security bypass in menu.module</h2> Hmm HTML? I remember talks about switching to HTML format (from plain text format), but I don't remember any conclusion about it... I do remember strong opposition to using HTML format (as I was part of that opposition). I write this mail to express my dissatisfaction with the HTML format of security announcments and to ask to switch back to plain text format. I'm sure there are more who share my point of view, and frankly I don't understand how the change happened "just like that"... -- Piotrek irc: #debian.pl Mors Drosophilis melanogastribus!

2 2

Re: [development] Re: [support] Drupal 4.6.6/4.5.8 security releases
by Kobus Myburgh 14 Mar '06

14 Mar '06

> In short, if you can't deal with security issues being disclosed > publicly (and the time gaps inherent to that), Free and Open Source > Software (FOSS) might not be for you. You need a Service Level > Agreement (SLA). Well said, Dries! Without a remarkable leader like you, Drupal would not be as efficient. Once again, thanks to all for the hard work. Regards, Kobus

2 1

Re: [development] Re: [support] Drupal 4.6.6/4.5.8 security releases
by Kobus Myburgh 14 Mar '06

14 Mar '06

> Oh, so if you don't like one or two things in Drupal, you will start your own > CMS? :) I tried to make a valid point in one concrete area, because this is If I don't like one or two things in a system, I try to get it resolved in a manner without making the community feel they owe me something. That is the key - they owe you nothing! In fact, I'd say that since you use this software for free, you'd probably be more accurate if you felt that YOU owed something. I am not sure about your involvement with Drupal, but my hunch is that the only time we'd hear from people like you is when you need something - not when you want to give something back. Now - if you want to continue this argument further, please contact me off the list. Thank you. Kobus

1 0

Re: [development] Re: [support] Drupal 4.6.6/4.5.8 security releases
by Kobus Myburgh 14 Mar '06

14 Mar '06

Valid point or not, Boris, the way it was said was totally uncalled for. Alex, yes, it was perhaps not handled perfectly, but if you don't like Drupal, "in this regard" why don't you just create your own content management system that works better "in this regard"? Or go find one that handles it better "in this regard"? Chances are that you will not be successful. Karoly and the rest of the security team: better luck this time, and thanks for all your hard work over the months. I may just be another voice on this highly active mailing list, but please be sure that there are other people like me who appreciate your efforts a lot. Kobus >>> boris(a)bryght.com 3/14/2006 1:47:59 AM >>> On 13-Mar-06, at 3:33 PM, Karoly Negyesi wrote: > On Tue, 14 Mar 2006 00:24:40 +0100, Alejandro Exojo <suy(a)kurly.org> > wrote: > >> El Martes, 14 de Marzo de 2006 01:03, Gerhard Killesreiter escribió: >>> are now available. See drupal.org/node/53524 >> >> I'm really very disappointed about how the Drupal project is >> handling releases >> and security advisories. IMHO, it's the worst "big" free software >> project in >> this regard. >> > > Thanks for the appreciation of our hard work and your discreet > letter to them security team that the sending security newsletters > were forgotten. They were written just waited for sending. Karoly: this is still a valid point. The security advisories *must* go out first, privately, before the public announcement. Do you need help with this next time? I'll volunteer to help manage this. -- Boris Mann Vancouver 778-896-2747 San Francisco 415-367-3595 SKYPE borismann http://www.bryght.com

2 1

Re: development Digest, Vol 39, Issue 45
by David K Norman 14 Mar '06

14 Mar '06

That's not fair. The files have to be available first, then posting to development@ is quick, then security@. It's not like it was days apart. development-request(a)drupal.org wrote: > Date: Tue, 14 Mar 2006 00:24:40 +0100 > From: Alejandro Exojo <suy(a)kurly.org> > Subject: [development] Re: [support] Drupal 4.6.6/4.5.8 security > releases > > El Martes, 14 de Marzo de 2006 01:03, Gerhard Killesreiter escribió: >> are now available. See drupal.org/node/53524 > > I'm really very disappointed about how the Drupal project is handling releases > and security advisories. IMHO, it's the worst "big" free software project in > this regard. >

2 1

Re: [development] Re: [support] Drupal 4.6.6/4.5.8 security releases
by Kobus Myburgh 14 Mar '06

14 Mar '06

> The security team can certainly need some help. One would think that the > people who as of recently are Drupal's saviours when it comes to > enterprise solutions would be eager to spend some ressources on this. Gerhard, I am not an expert, so I can't do the actual bug finding and the fixing thereof, but I *can* do the legwork. If there is something I can do, please let me know. Kobus

1 0

Re: [development] Re: [support] Drupal 4.6.6/4.5.8 security releases
by Alex Markley 14 Mar '06

14 Mar '06

Hey all. I've noticed some negative noise on the list here, and I thought I'd mention that the upgrade to 4.6.6 went smooth as silk for me. http://MalexMedia.Net/ I've got a bajillion custom modules and things, and the only thing that broke was (unsurprisingly) my custom patches to node.module, which were merged in very easily. All in all, I maybe spent 30 minutes, and I feel very safe knowing that my Drupal remains secure. :-D Thanks for your hard work! ttyl -- Alex (Malex) Markley http://MalexMedia.Net/ "Son, you come down from there right this minute! You're too little to play with wild animals!" Useless Info: Listening to: mAleX - Project2 - Behold System kernel: Linux 2.6.14-1.1653_FC4 Reliability: 23:00:01 up 33 days, 12:11, 5 users, load average: 0.98, 0.47, 0.30

1 0

Can someone confirm -- Minimum MySQL Privileges?
by Angie Byron 14 Mar '06

14 Mar '06

I was glancing through the install instructions today, and noticed that we tell people to GRANT ALL privileges which seems a bit... excessive. I searched through core and came up with the following list of required privileges: Data ==== SELECT INSERT UPDATE DELETE Structure ========= CREATE ALTER INDEX DROP CREATE TEMPORARY Admin ===== LOCK TABLES Could someone take a look and let me know... Am I missing any? Are there things here that shouldn't be? -Angie P.S. I know we're only supposed to work on 4.7 RC stuff, but this is for some training stuff I'm doing to hopefully get more developers to work on Drupal, including testing and reviewing patches to help the 4.7 RC! ;)

8 15

4.6.6 tarball missing theme engines
by Laura Scott 14 Mar '06

14 Mar '06

The /themes/engines folder is there, so for most people it will replace their existing themes/engines folder ... except that there is nothing in the new folder except an empty phptemplate folder. I posted this in the forums, but thought I'd mention it here, especially as xtemplate is one of the patched upgrades. Laura Laura Scott President laura(a)pingv.com pingVision, LLC 4450 Arapahoe Ave, Suite 100 Boulder, CO 80303 www.pingv.com 303.415.2559

1 1