October 2007 - Development - lists.drupal.org

Please be careful marking release nodes "Security update"
by Derek Wright 29 Oct '07

29 Oct '07

Dear Drupal developers who manage contributions on drupal.org... As you've probably noticed, when you create a release node for your contribution(s), there's a "Release type" vocabulary where you can select from a few terms: Security update Bug fixes New features You're supposed to use this to indicate what kind of release your node represents, to give users of your contribution a sense of if they want to install it or not. For example, if you're adding new features, you should say so, since some users might not want to upgrade something that's potentially unstable and might break their sites, etc. However, if you mark a release node a "Security update", that has a bunch of other side effects and implications, so please only do so if your release is actually fixing a security problem: 1) The release node will not be published once the packaging script creates the tarball. This is so that the security team can verify the release does in fact address a security problem, that the draft of the security announcement (SA) is ready to be published, etc. See this issue for more info: http://drupal.org/node/153973 2) Once a "Security update" release node is published, the Update status module (now in D6 core) will freak out on every site running your module, with big nasty red warnings and emails (if so configured) about the fact that the site is insecure and needs to be updated immediately. 3) Everyone subscribed to the "Security updates" RSS feed will get pinged that there's another security release. ... Therefore, a "Security update" release is a *BIG DEAL*. You need to coordinate with the security team to make sure an SA goes out with your release, all of your users are going to get nasty warnings and scare tactics to try to get them to update ASAP, etc. So, if you don't mean it, please do *NOT* use this taxonomy term. If you do, you use up the precious resources of the security team (and/or d.o infrastructure team) to investigate your release node, clear the bogus term, manually publish it for you, etc, etc. Thanks, -Derek (dww)

8 11

Re: [development] Generate Drupal code from (textfile) specs
by Matt Farina 29 Oct '07

29 Oct '07

2 1

CK-ERP (Open Source ERP / CRM / MRP) v.0.25.1 released (with Drupal 5.3 connector)
by C K Wu 29 Oct '07

29 Oct '07

Hi, folks, I have posted a new release, v.0.25.1, of CK-ERP, at SourceForge.Net, http://sourceforge.net/projects/ck-erp . New features include, five new templates, fy2t – for use by factory-like businesses operating within a dual (Canadian) tax environment fy1t – for use by factory-like businesses operating within a single (Australian) tax environment so2t – for use by service organizations operating within a dual (Canadian) tax environment so1t – for use by service organizations operating within a single (Australian) tax environment simp – for use by small simplistic businesses operating within a single (Australian) tax environment a connector for IRM (Information Resource Manager), a sample chart of accounts for use by internet based businesses, addition of ZhongGuo VAT tax rate. CK-ERP is an open source accounting/MRP/ERP/CRM system that runs on top of multiple middlewares. It comprises 22 modules - Administration, i18n, Contact Management, Customer Relationship, Customer Self Service, Vendor Relationship, Ledger, Bank Reconciliation, MRP, Warehouse, Inventory, Service, AP, AR, PO, SO, Quotation, POS for Cashier, POS for Manager, HR, Staff Self Service and Payroll. It provides accounting and back office functionalities to SMEs and utilizes the underlying middleware to administer accounts/groups. Please report error and suggestion to the discussion group / mailing list, CK-ERP-en(at)googlegroups.com or CK-ERP-zh_CN(at)googlegroups.com . General history and expected development is available at the discussion group's Archive. Supported MiddleWares: IRM, LegalCase, MirrorMed, ClearHealth, OpenEMR, eGroupWare, Horde-GroupWare; Zencart, CRELoaded, osCMax, osCommerce; Drupal, Joomla, Mambo, e107, XOOPS, Xaraya; Moodle, Atutor; vTiger, XRMS; WordPress, b2evolution; TikiWiki; phpBB. Information/Demo Websites: http://ck-erp.org http://ck-erp.net http://ck-erp.com Download is available from, http://sourceforge.net/projects/ck-erp http://gforge.oss.org.cn/projects/ck-erp http://gf.cs.hit.edu.cn/projects/ck-erp http://www.cnforge.org/modules/xfmod/project/?ck-erp http://gforge.lupaworld.com/projects/ck-erp http://gro.clinux.org/projects/ck-ledger Cheers, Wu Chiu Kay, aka CK Wu, aka CK (CK is the preferred alias) Hong Kong

1 0

Re: [development] code proposal: localization of currency, ...
by Hans Salvisberg 28 Oct '07

28 Oct '07

Ivan Sergio Borgonovo wrote: > The site will be displayed in Spanish, with Spanish format of > currency. If "Spanish" means some of the Latin American countries > that may have a different format for currencies... let it be... Why won't you understand that this is not good enough? By releasing something that works only some of the time, and only for your favorite countries, you'd do more harm than good, because a lot of less-educated people might start using it, thinking that it acually works. Drupal's "localization" is nothing more than a language selection. It's acceptable as far as language selection goes, but it's much too coarse to really be called "localization," and certainly not suited as a base for something as complex as currency formatting. > Anyway the format functions will support a "language" parameter that > will override the current user language. IT'S NOT A QUESTION OF LANGUAGE!!! > I'm not proposing a catch them all solution and I think this facility > won't get into the way of people. Yes, it will. Once module writers start to use it, site administrators will not only have to deal with one (possibly sub-optimal) currency format, but with one per language, which is clearly worse. > People writing modules will know what will happen to their > currency/float if they wrap them with the formatting functions. No, they won't! They'll just (wrongly!) assume that it'll do the right thing for most users, which shifts the plague over to the site administrators! What might be useful for many sites is an API with an options page that lets the site administrator freely define THE currency format for the site (completely independent of lanugage!). He'd still only have one, but at least he'd have the one he selected. That would be a big step forward. Don't try to be smart. Software that tries to be smart and to guess the user's wishes (based on the author's less than perfect view of the world) is absolutely maddening! Hans

4 8

[Fwd: a nasty Java applet case]
by Tomas J. Fulopp 27 Oct '07

27 Oct '07

Hi, Anybody has any ideas about this case? I put really all details in my mail, hoping to spark quick clues from Drupal gurus on the list. It took me weeks to pinpoint the problem, but now I am totally stuck, wondering what is special in Drupal that breaks the applet data loading functionality... Even the faintest clue might help. Please. Tomáš / Vacilando -------- Original Message -------- Subject: a nasty Java applet case Date: Tue, 23 Oct 2007 21:08:55 +0200 From: Tomas J. Fulopp <tomi(a)vacilando.org> Reply-To: tomi(a)vacilando.org Organization: Vacilando To: development(a)drupal.org Lads and lassies, I wonder who can explain this one... I've been working on this nasty problem for several weeks... and I am really close to a solution now, but not quite there. Hope you can help. It is really an interesting problem! I maintain the "hypergraph" (HG) module, which currently takes the current-user-visible menu and turns it into a visual map using an open source Java applet -- see http://drupal.org/project/hypergraph or the files in CVS here http://cvs.drupal.org/viewvc.py/drupal/contributions/modules/hypergraph/ I have a multisite install of D5.2, the HG module sits in http://quidne.vacilando.org/sites/all/modules/hypergraph/ folder, and there is also the .jar file of the Java applet. Now, when the page that contains the HG tag loads, the Java applet appears, but it needs to call data from the server. This data is provided by a file that resides in a folder of hypergraph, namely http://quidne.vacilando.org/sites/all/modules/hypergraph/graphs/hg.php (+ some arguments). Note: in the same folder there is a .dtd file that is necessary for the XML data. Quite simple, really. Worked fine on other (non Drupal) sites where I implemented it - e.g. http://www.vacilando.org frontpage But on Drupal, and not only on my multisite install (several users reported it), there is a silly bug: After you open the browser (FF and IE; tested on WinXP) for the first time (with or without clearing cache, I found), the Java applet would throw a cache-related error. When reloaded page, and on all subsequent loads, the Java would display correct data, without any problem. So I looked everywhere and tried to avoid this Java error, finding that JRE 6 has a bug related to cache, etc. Many days after I realized that this error (after fresh opening of the browser) did not occur in other websites I had made that feature the same applet. So I changed focus to the generated XML data, tweaking it to perfection.. But I could not get rid of the bug! I then thought that perhaps I am not properly initializing Drupal. This is in the data provider file hg.php : drupalize(); function drupalize() { while (!@stat('./includes/bootstrap.inc')) { chdir ('..'); } require_once './includes/bootstrap.inc'; drupal_bootstrap(DRUPAL_BOOTSTRAP_FULL); } That should be fine, no? Just to be sure, I tried to put just plain XML file here - not dynamically generated, for a test. Still the same problem!! Then I put both files (the static test XML and the DTD file) elsewhere, on a different subdomain ( in http://www.vacilando.org/temp/tst/ ). Wow -- surprise -- no bug!!!!!! Why??? Why does it not work when XML and DTD are in http://quidne.vacilando.org/sites/all/modules/hypergraph/graphs/ and it works when XML and DTD are in http://www.vacilando.org/temp/tst/ ? No idea! I have a hunch - but I need your thoughts here... the XML file definitely needs its DTD file. Could it be that something - either some consequences of multisite, or the .htaccess rules in the root of Drupal, or something else (what?) cause that the XML does not "see" its DTD even though it is in the same folder..? I tried to put an empty .htaccess file in the folder http://quidne.vacilando.org/sites/all/modules/hypergraph/graphs/ trying to override the basic Drupal's .htaccess - no change. Another suspicion - the Java applet seems to be loading before the page loads, or at least sometimes (when cache has been emptied from the browser before it was closed). Could it be that Drupal somehow forbids anything accessing module directories before session/cookies are set or something? Also tried to put the two files into a folder in the files folder ( in http://quidne.vacilando.org/sites/quidne.vacilando.org/files/tst/ ) - same bug. Any idea? Anybody has experience with a similar problem? If any of you want to test the problem in action, don't go to my website (too many on-going dev changes), just get v1.2 from http://drupal.org/project/hypergraph and install it ( then go to /hypergraph ). Or contact me and I'll quickly set up a demo of the problem on my site. Cheers, Tomáš / Vacilando

2 1

Data APIs for Drupal 7
by Nedjo Rogers 26 Oct '07

26 Oct '07

Hi all, A heads up and request for reviews and comments. How can we renew our core data APIs to be consistent and even more elegant and efficient, to facilitate fully transactional web services, and to take full advantage of PHP 5? Sponsored by CivicSpace, Henrique Recidive and I have tried to move the discussion forward with a paper and sketched in implementation of Active Records for Drupal (as one of many possible approaches). Please, wade in and offer your critique and ideas by posting comments on these two posts at groups.drupal.org: "Data APIs for Drupal 7 and web services support", http://groups.drupal.org/node/6767 with the paper at http://groups.drupal.org/files/drupal_dataapi.pdf "Active Records, a possible approach for consistent Data APIs", http://groups.drupal.org/node/6772 with the paper at http://groups.drupal.org/files/drupal_active_records.pdf Thanks, Nedjo Rogers

1 0

drupal.org scheduled downtime, Fri Nov 2nd, 17:00-21:00 UTC
by Chad Phillips -- Apartment Lines 26 Oct '07

26 Oct '07

drupal.org will be down for a scheduled upgrade, starting Fri Nov. 2nd at approx. 17:00 UTC. we'll do our best to get it back up and running as quickly as possible, but expect the upgrade to last until approx. 21:00 UTC -- it's a big one. when the dust finally clears, we'll have issue followups as comments running on drupal.org :) hunmonk

3 2

Fwd: [Press inquiry] KDE 4.0 Release Event Invitation
by Dries Buytaert 26 Oct '07

26 Oct '07

Begin forwarded message: > From: release-event(a)kde.org > Date: Mon 22 Oct 2007 23:42:43 GMT+02:00 > Reply-To: release-event(a)kde.org, droppies(a)drupal.org > > jefferai sent a message using the contact form at > http://drupal.org/contact. > > (Note: We send this to you because, well, we like Drupal. > Hopefully you > like us too :-) ) > > This is an official invitation to the KDE 4.0 Release Event at > Mountain > View, California. This event is being held to celebrate the > release of > KDE's latest computing environment, KDE 4.0. Alongside numerous KDE > community members, this event has been opened to our industry > partners, and > members of the press. This is an opportunity to take a closer look > at the > KDE 4.0 release, and mingle with the KDE community at large. > Presentations > will be held on the architecture of KDE 4.0, prominent KDE > applications, > KDE's various communities and plans for the future. This event > provides an > invaluable opportunity for members of the press, I.T. industry and > the KDE > community to meet in person and discuss the free software movement. > > > > Where: The Google Headquarters, Mountain View, California > > Hotel: The Wild Palms Hotel, Mountain View, California > > When: January 17th to 19th, 2008. > > > > Hotel rooms have been kindly sponsored by Google for those with > official > invitations, and all event meals will be catered. The only thing > you need > to do is get there! > > > > Some travel sponsorship is available for those with expressed > financial > need through the KDE e.V. (KDE's non-profit facilitation body), > although > funding is limited. Contact us if you need financial help. The nearest > airports are San Jose and San Francisco. Details on getting from the > airport to the Googleplex and a detailed agenda will be made available > online at a later date, with details being mailed to those who have > confirmed their attendance. For those that require a visitor's > visa to > enter the United States to attend this conference, we strongly > suggest that > you start to make arrangements now. KDE and Google can provide > assistance > and a formal invitation to support your visa application. > > > > Preliminary event schedule - items (except keynote) are still > subject to > change: > > > > Arrival: January 17th > > > > * Informal KDE community BoF (Birds of a Feather) topical meetings > > * Evening mixer (informal) for all attendees at the Wild Palms Hotel > > > > Main Event: January 18th > > > > * AM: Project talks for KDE projects/applications > > * 2PM (local time): Keynote by Aaron Seigo, President of the KDE e.V. > > * 3PM-6PM: Primary speeches > > * 6PM: Dinner and party event > > > > Departing: January 19th > > > > * Additional KDE community BoF topical meetings > > * Smaller speeches in conference rooms > > > > Sponsored hotel rooms are limited; please reply to release- > event(a)kde.org > at your earliest convenience and let us know whether or not you > will be > able to attend so that we know if we can give your spot to members > of the > public that have requested to join us. Also, in many cases we will > have > room for multiple members of your organization; just let us know > how many > people want to attend! > > > > NOTE: If you will be unable to attend the event, please pass this > invite > along to any community members or members of your organization that > would > benefit from attending. > > > > We hope to see you there. > > > > Wade Olson and Troy Unrau > > Release Event Organizers, KDE Marketing Working Group > > Reply: release-event(a)kde.org -- Dries Buytaert :: http://www.buytaert.net/

3 2

Crossing information between content types
by Yuval Hager 25 Oct '07

25 Oct '07

Hi all, Let's say I have two content types - a person and a bank account. A person can have several bank accounts, and a person also has an address. Now I need to present a listing if all the people who live in New Jersey and have more than $100k in their bank account. In any database application it would be dead easy - just use a SELECT.. JOIN on these two tables and you're done. However, on Drupal, I am not sure what is the best way to accomplish that. First thing I did was to define these two content types in CCK, install the relativity.module and declare parent-child relationships between the person and her bank account. Then I hit the wall.. I can't combine information in a view from these two content types, and I can't use views fusion module, as it doesn't know about relativity (only nodefamily). My dream solution would be to expose relativity.module into the views admin screens, and just add/filter the fields of the related content types. But since relativity is generic and views uses a flat view of all fields, I really can't think of a way to accomplish that cleanly. Of course I can write the query myself, but since these are CCK nodes, I can't use a direct SELECT, and have to iterate through the nodes manually. It is also not maintainable through the UI being strictly in code (and can't use views plugins etc.). Another option could be to use views hooks (pre_view, query_alter..) to load the parent node, check the condition and manipulate the view accordingly. This doesn't feel right neither. I ended up going back to my dream solution and face it with reality. Since I know my CCK structure and the queries I need, I can go specific. I created a module and added the 'location' table, but not connected to the 'node' table, rather to 'relativity' table, through the 'parent_nid'. This way I can add the parent-city as a field, filter and an argument to the view. As a bonus, I even reused the original location.module city argument handler. The downside is that it's quite a lot of code (although once written can be managed through the views administration). Does this make any sense? Isn't there a simpler solution? Cheers, -- Yuval Hager

4 7

Re: [development] Please be careful marking release nodes "Securityupdate"
by FGM 25 Oct '07

25 Oct '07

I think that this stance tends to generate too many branches and ensures confusion will arise even more. Even for drupal core, even major branches sometimes include incompatible API changes which (IIRC, 4.7.4 did, and broke some sites). More generally, I'd rather say API changes in a branch MUST maintain backwards compatibility for the branch, but they MAY include new upwards-compatible features (addition paths, APIs, tables), as long as these don't remove existing features for the branch. This keeps the number of branches reasonable while maintaining stability. ---- Original Message ---- From: karoly(a)negyesi.net To: development(a)drupal.org Subject: Re: [development] Please be careful marking release nodes "Securityupdate" Date: Thu, 25 Oct 2007 10:52:37 +0200 (CEST) [...] >DB and API changes must happen in a new branch. Any given branch >should not contain anything else but bugfixes just like Drupal core.

1 0