July 2006 - Development - lists.drupal.org

RE: [development] the past, present and future of drupal admin
by Steven Peck 29 Jul '06

29 Jul '06

> -----Original Message----- > From: development-bounces(a)drupal.org > [mailto:development-bounces@drupal.org] On Behalf Of Jeremy Epstein > > Just a quick example from another piece of software (and yes, people > can complain that Microsoft is evil and that it produces buggy > software, but they can't complain that its software is terribly hard > to use). In Windows XP, the 'control panel' groups administrative > tasks logically. There is no 'settings' icon within the Windows > control panel. However, within the 'Display' area, there is a > 'settings' tab (for 'global' settings, such as your screen > resolution), along with 'sets-of-data' things, such as colour schemes > and screen savers. Same with the 'User Accounts' area: the management > of individual user accounts is right in there with the 'general user > settings'. Certainly something to consider. > > Cheers, > Jaza. I feel the need to mention something here. While I realize the example provided is an example and I am the guy that definitly uses MS the example above is not complete as I have a very different experience with it. The Windows XP control panel offers multiple views. A classic and category. These views are can also be controlled by policy settings locally or from a domain level, etc. Frankly, I find the the 'category view to be hard to understand and find things consistently. Part of this is training and experience and part of this is that some of the categorizations do not make sense to me. Also, in your Display example. There exists Video drivers that extend the options available and many times these options are not presented in a manner that makes sense. (nVidia drivers for instance). This gives an effect not unlike some contrib modules. The user accounts button example is also incomplete. If you have a more complex envirnoment, it is not in fact something you use. You use a different tool to manage user accounts in a domain environment including local accounts so never learn about these settings in a domain environment. So, what's my point of dragging in the different and advanced options of this example? (Well, someone used an example from my field. :D ) Well not that, but this .... It really doesn't matter what interface we eventually go with because people are going to have to learn it. That it takes lessons from the current GUI 'norms' (assuming such exist) is good. What does matter is that we decide on rules and guidelines for it. Then we publish those rules and guidelines for contrib. AND we try to be consistent about the logic for placement. Any interface will need to be learned no matter what. As long as we are consistent about it, it will less of a curve. Drupal is still not a 'simple' thing to use and despite the fact that it is getting easier it doesn't mean easy. :D. The Drupal admin interface has been evolving. I think Earl's admin interface patch is a step in the right direction. It's been worked on and gotten a lot of good feedback to refine it. I think that it can be fine-tuned over time from this starting point, but it's pretty darn good now. -sp

2 1

RE: [development] the past, present and future of drupal admin
by Steven Peck 29 Jul '06

29 Jul '06

http://drupal.org/node/63601 <quote> There are two configuration screens that deal with these links: On admin >> settings >> menu you choose which menu is used for the primary links and which for the secondary links. If you have added items to the default "Primary Links" menu and they are not showing up, check to make sure the option on this page hasn't been changed to "No Primary Links". </quote> The verbage is assumed there. Probably could benefit from having words added to effect. Feel free to send them to me offlist and I will edit it. > -----Original Message----- > From: development-bounces(a)drupal.org > [mailto:development-bounces@drupal.org] On Behalf Of Chris Johnson > Sent: Friday, July 28, 2006 6:36 PM > To: development(a)drupal.org > Subject: Re: [development] the past, present and future of > drupal admin > > Neither of which say anything about getting rid of the "Edit > Primary Links" > link, which seems to be somehow tied to the themes, because > deleting the > primary links menu item does not make it go away. > > Steven Peck wrote: > > Handbook > > http://drupal.org/node/63601 > > http://drupal.org/node/59467 > > > >> -----Original Message----- > >> From: development-bounces(a)drupal.org > >> [mailto:development-bounces@drupal.org] On Behalf Of Neil Drumm > >> Sent: Thursday, July 27, 2006 2:28 PM > >> To: development(a)drupal.org > >> Subject: Re: [development] the past, present and future of > >> drupal admin > >> > >> Earl Miles wrote: > >>> Talk about a common question on #drupal-support, too. > 'Edit Primary > >>> Links' takes you to admin/menu but if you want to just get > >> rid of the > >>> link, you actually have to go to admin/settings/menu ... > >> I actually didn't know that setting could be used to get rid of the > >> links until now. I've been deleting the call from themes. > >> > >> -- > >> Neil Drumm > >> http://delocalizedham.com/ > >> > >> > > > > > > >

1 0

RE: [development] the past, present and future of drupal admin
by Steven Peck 29 Jul '06

29 Jul '06

Handbook http://drupal.org/node/63601 http://drupal.org/node/59467 > -----Original Message----- > From: development-bounces(a)drupal.org > [mailto:development-bounces@drupal.org] On Behalf Of Neil Drumm > Sent: Thursday, July 27, 2006 2:28 PM > To: development(a)drupal.org > Subject: Re: [development] the past, present and future of > drupal admin > > Earl Miles wrote: > > Talk about a common question on #drupal-support, too. 'Edit Primary > > Links' takes you to admin/menu but if you want to just get > rid of the > > link, you actually have to go to admin/settings/menu ... > > I actually didn't know that setting could be used to get rid of the > links until now. I've been deleting the call from themes. > > -- > Neil Drumm > http://delocalizedham.com/ > >

2 1

Developing modules for a photo agency
by Hannes Lilljequist 28 Jul '06

28 Jul '06

Hi! (Sorry if this is was already posted - but I don't think it was.) I am (slowly) developing a site for a small independent photo agency. I feel that a lot of the functionality that I need is already in Drupal core and contrib, but there are certain points that I need to address, probably through developing a few new modules. (Theming is obviously an important part of it too, but that's another story.) I have a few ideas on how to implement the functionality that I need and some choices to make, so I'm hoping for some comments and wisdom from the community. Also, if someone else is already doing or has done anything like this, that would be good to know. Hopefully this could turn into a solution that other picture agencies can use, or even better, a set of general modules that can be used in many different contexts. In short, I need too look at: 1) the handling of large image files and the quality of resized images, 2) a specific image search function, and 3) ecommerce integration. To keep this message short I'm saving the details, but I made a post in the forums describing my thoughts so far. If your'e interested or have experience in any of these areas - please take a look! http://drupal.org/node/75282 Thanks! /Hannes - zoo33

3 6

Fwd: [SECURITY] [DSA 1125-1] New drupal packages fix execution of arbitrary web script code
by Bèr Kessels 28 Jul '06

28 Jul '06

Just a FYI. Also to let you people know that 4.5* is not as dead as we might want/think. ---------- Doorgestuurd bericht ---------- Subject: [SECURITY] [DSA 1125-1] New drupal packages fix execution of arbitrary web script code Date: woensdag 26 juli 2006 23:20 From: Moritz Muehlenhoff <jmm(a)debian.org> To: debian-security-announce(a)lists.debian.org -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -------------------------------------------------------------------------- Debian Security Advisory DSA 1125-1 security(a)debian.org http://www.debian.org/security/ Moritz Muehlenhoff July 26th, 2006 http://www.debian.org/security/faq - -------------------------------------------------------------------------- Package : drupal Vulnerability : several Problem-Type : remote Debian-specific: no CVE ID : CVE-2006-2742 CVE-2006-2743 CVE-2006-2831 CVE-2006-2832 CVE-2006-2833 Debian Bug : 368835 Several remote vulnerabilities have been discovered in the Drupal web site platform, which may lead to the execution of arbitrary web script. The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2006-2742 A SQL injection vulnerability has been discovered in the "count" and "from" variables of the database interface. CVE-2006-2743 Multiple file extensions were handled incorrectly if Drupal ran on Apache with mod_mime enabled. CVE-2006-2831 A variation of CVE-2006-2743 was adressed as well. CVE-2006-2832 A Cross-Site-Scripting vulnerability in the upload module has been discovered. CVE-2006-2833 A Cross-Site-Scripting vulnerability in the taxonomy module has been discovered. For the stable distribution (sarge) these problems have been fixed in version 4.5.3-6.1sarge1. For the unstable distribution (sid) these problems have been fixed in version 4.5.8-1.1. We recommend that you upgrade your drupal packages. Upgrade Instructions - -------------------- wget url will fetch the file for you dpkg -i file.deb will install the referenced file. If you are using the apt-get package manager, use the line for sources.list as given below: apt-get update will update the internal database apt-get upgrade will install corrected packages You may use an automated update by adding the resources from the footer to the proper configuration. Debian GNU/Linux 3.1 alias sarge - -------------------------------- Source archives: http://security.debian.org/pool/updates/main/d/drupal/drupal_4.5.3-6.1sarge1 .dsc Size/MD5 checksum: 625 8323ad6164c5beb6e9c7631272fbaee8 http://security.debian.org/pool/updates/main/d/drupal/drupal_4.5.3-6.1sarge1 .diff.gz Size/MD5 checksum: 83802 35863480a9da96adbe6731b014d204c8 http://security.debian.org/pool/updates/main/d/drupal/drupal_4.5.3.orig.tar. gz Size/MD5 checksum: 471540 bf093c4c8aca7bba62833ea1df35702f Architecture independent components: http://security.debian.org/pool/updates/main/d/drupal/drupal_4.5.3-6.1sarge1 _all.deb Size/MD5 checksum: 506884 e4cdba2730662752d8f83fc101ab58a5 These files will probably be moved into the stable distribution on its next update. - ---------------------------------------------------------------------------- ----- For apt-get: deb http://security.debian.org/ stable/updates main For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main Mailing list: debian-security-announce(a)lists.debian.org Package info: `apt-cache show <pkg>' and http://packages.debian.org/<pkg> -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.3 (GNU/Linux) iD8DBQFEx9wrXm3vHE4uyloRAsWtAKDoQf4DhL4eqpPLmDuifZ/Rh4h61gCggvrQ zwceOEHQ/r/GyRU2L5X9vd8= =V7nw -----END PGP SIGNATURE----- -- To UNSUBSCRIBE, email to debian-security-announce-REQUEST(a)lists.debian.org with a subject of "unsubscribe". Trouble? Contact listmaster(a)lists.debian.org ------------------------------------------------------- -- | Bèr Kessels | webschuur.com | Drupal, Joomla and Ruby on Rails web development | | Jabber & Google Talk: ber(a)jabber.webschuur.com | | http://bler.webschuur.com | http://www.webschuur.com |

16 22

Re: [development] Database queries on drupal.org
by Peter Wolanin 28 Jul '06

28 Jul '06

----- >Date: Fri, 28 Jul 2006 10:49:07 -0500 (CDT) >From: "Larry Garfield" <larry(a)garfieldtech.com> >Subject: Re: [development] Database queries on drupal.org >- Someone needs to get that query out of the forum module's theme >code. :-) In reponse to the above, I was rather astounded to see these SQL queries in the theme function a while back when I was figuring out how to theme the forum pages. I opened an issue, but haven't had any any input. Maybe it needs a better title? Please follow-up there if you're interested. http://drupal.org/node/70578 Right now there is a lot of work done every time a forum page is viewed to generate the links to the previous and next forums. As a start, I'd like to suggest moving to a system more like the book module. The forum table should get two more entries, for the node.nid values for the previous and next node, and I'd add these into the $node object in forum_load(). This would make it easy to generate links to next/prev links without the titles, but getting the titles would still require a query (unless the titles are also duplicated in the forum table). The real trick is to figure out how and how often to update these values. Some schemes order the forum topics by the number of comments.

1 0

Object caching
by Ken Rickard 28 Jul '06

28 Jul '06

This is a fork from the Caching, caching, caching thread. I have opened an issue to start testing the gains for using an object cache on commonly-loaded objects ($user, $node, $block, $profile, $comment, $term) at http://drupal.org/node/74020 The patches apply against HEAD. (Be gentle, they are my first CVS patches.) I'm currently using this approach in 4.6 to run the (very large) SavannahNow.com site and reduce database overhead. I'm currently testing a stripped-down HEAD install on a Mac PowerBook G4, so the testing numbers listed there may be misleading. I toyed with the idea of creating some new functions for cache.inc to make retrieving objects easier, but for the time being am just using cache_set, cache_get, and cache_clear_all. One question: has file-based caching made it into HEAD yet? -- Ken Rickard drupal: agentrickard gmail: agentrickard

18 36

Allow/Disallow path aliasing by settings
by Ken Rickard 28 Jul '06

28 Jul '06

After much discussion on the list, I actually wrote some code that takes a pass at reducing the number of drupal_get_path requests, http://drupal.org/node/75976 I talked some with Moshe on IRC (thanks!) and this patch is not intended to do anything but let developers test whether this approach gives us any real performance gains. In this first pass, all I did was put in the structure that would allow an administrator to remove certain paths from ever being looked up. This approach required a modification of url() and a new function to handle lookup requests. This function is drupal_alias_allowed($path). In the current patch, all paths are still allowed, as the default array is null. To be honest, I tried to do more, but Forms API and admin settings gave me some problems. I'd like to do a textarea for entering 'allowed' paths one per line, but couldn't make the code behave properly. Without an admin, the way to test is to alter the variable_get within drupal_alias_allowed(), I would suggest making that value: array('node', 'user'), which would allow the creation of aliases only for paths the start with 'node' or 'user.' Feedback welcome. - Ken Rickard agentrickard

1 0

displaying phptemplate hooks as HTML to assist theme design
by Farsheed 28 Jul '06

28 Jul '06

Hi, I am interested in developing a diagnostic theme or method to display phptemplate hooks called in a CSS hover over that element. So when you hover over the breadcrumb HTML output on your website it displays: phptemplate: theme_breadcrumb() called in a CSS hover. and that way the designer knows if he/she wants to modify the breadcrumb they will have to look at the $breadcrumb variable or override theme_breadcrumb. It's kind of like how devel.module helps write modules, except for themes. So far the only idea I have is to intercept _phptemplate_callback [1] but wondering if anybody has any better methods. Farsheed [1] http://api.drupal.org/api/4.7/function/_phptemplate_callback __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

2 1

Design Flaws in Drupal Caching System
by Alex Markley 26 Jul '06

26 Jul '06

Hey all! I'm sure most of you are busy with other stuff, but I thought I'd make some noise about this issue because it represents a potentially serious design flaw in the caching system. My original, scatter-brained report is here: http://drupal.org/node/75186 I'm not terribly familiar with the caching system as it is, and I know there are other discussions going on about improving it. Thus, I'm not interested in trying to "tell people like it is" or stepping on anybody's toes. I'm just trying to bring up an issue that I know exists and have confirmed to be a problem in 4.7.2. Specifically, while Drupal does a really great job of caching all pages generated by anonymous requests, it does a really, really crappy job of clearing them. Unless I'm mistaken, I don't see any maximum lifetime for cache entries, which I believe to be design flaw number one. Even if that maximum lifetime is over a month, it still protects Drupal-powered sites from serving year-old stale/invalid content to anonymous users. Design flaw number two is that many content updates don't clear any cache entries, resulting in bad/stale content being served to anonymous users: ==> Example: At the moment, admin/node operations immediately result in stale content because they don't trigger any cache deletions. ==> Example: User profile updates immediately result in stale content because they don't trigger any cache deletions. Design flaw number three (my favorite one) has to be the complete and utter lack of an intelligent cache clearing mechanism. For example, why in the name of heaven does node_save do a cache_clear_all(); ?! It should be calling a hook that allows interested modules to clear cache entries that they created! That would prevent good cache entries from being deleted and ensure that old cache entries are deleted on the spot. I guess my beef is that irresponsible modules are failing to clear cache entries when they are rendered invalid, and hacks like calling cache_clear_all(); from node_save() are short-sighted at best. This problem is bad enough to make me seriously consider the sanity of enabling the cache on my site at all, since anonymous users are my primary audience. Feel free to disagree. ttyl --Alex Markley (Malex) http://MalexMedia.Net/

3 2