January 2008 - Development - lists.drupal.org

Ignore this email
by Steve Dondley 25 Jan '08

25 Jan '08

Trying to figure out why my last email didn't hit the list. Ignore this if you see it. -- Prometheus Labor Communications, Inc. http://prometheuslabor.com 413-572-1300 Communicate or Die: American Labor Unions and the Internet http://communicateordie.com

1 0

Strange behavior with the menu API
by Jacob Singh 25 Jan '08

25 Jan '08

Hi folks, I was messing with the menu API while writing an update routine and stumbled across this: $item = menu_get_item(null,'mypath'); $item['path'] = 'mynewpath'; $ret = menu_save_item($item); $ret == SAVED_NEW I dug into the code and found out that menu_save_item requires the mid, and menu_get_item doesn't return it, although it is totally available... This seems like a major API usability bug, but I imagine there is some reason for it being this way. I guess in 6 this is moot because the whole structure is different in this regard, but is there something I'm missing here? Is this something worth patching (adding the mid to the returned value of menu_get_item() ) in 5? All the best, Jacob

1 0

writing a module to count the nodes and format them
by Alex Moreno 25 Jan '08

25 Jan '08

Hi all, first of all, thanks a lot everybody for your help in my module dev process learning. I´ve find all your answers very very helpfull. I´d like to share my learnings, maybe, with two or three modules of my own. For example, i´ve patched drupal to be able of show the first post/node in the first row in the frontpage, and the rest in two columns bellow. ¿Should it be possible to write this short css code in a module? The code now uses a counter that detects the first node, it format as we need and continues with the rest. Is it possible to make this hack in a module? Which functions should i search for or which one in the api could help me to make this. Or This is only possible hacking directly the core of drupal, as i´ve done? As you suppose, my sollution sucks because i can´t share anything with the community in an easy way and every time i upgrade drupal, i have to hack it again. ¿Some ideas or i´m only telling stupidities? Bloody gossips and ideas are wellcome ;-).

3 2

Think there's a security problem in your module? Here's what to do.
by Derek Wright 24 Jan '08

24 Jan '08

Perhaps the docs are too detailed, confusing, hard to find, or obscure. I'd like to try in short, plain english to explain what to do when you think you've found a security problem in your module: a) Either you think you find a potential security problem in your module or a user reports a vulnerability to you. b) You *immediately* send email to security(a)drupal.org about it to let us know. c) You try to analyze the vulnerability to the best of your abilities, and if possible produce a patch that fixes it. d) DO NOT COMMIT YOUR PATCH YET. e) DO NOT MAKE A RELEASE YET. f) DO NOT MARK YOUR RELEASE AS A "SECURITY UPDATE" YET. g) Send your patch to security(a)drupal.org. h) Wait for the security team to reply. i) Do what the security team advises you to do. j) If/when the security team thinks your vulnerability is real, the fix is complete, and a security announcement (SA) is ready to go out, we'll tell you. k) Only once an SA is ready for your vulnerability and the security team is ready to coordinate a release, THEN (and only then) do you commit your patch to all relevant branches, tag new releases, create release nodes, and mark them as "Security update" releases. l) The security team can then publish your release nodes (which doesn't happen automatically if they're flagged as a "Security update") and send out the SA, at which point your users will know they need to upgrade (both via the security announcement email lists and RSS feeds, and via the update_status module). Make sense? Do you really understand the process? Should I explain why any of these steps are like this? What else could be done, either via docs or project* UI, to make this clear? Relevant issue: http://drupal.org/node/210497 "add extra validation to release node form for security update releases" Relevant handbook docs: http://drupal.org/security-team Thanks, -Derek (dww)

21 65

developing a Working Groups module
by Lluís 24 Jan '08

24 Jan '08

I need to create a module similar to Organic Groups, but with some major differences: - the idea behind the groups isn't to make users work together; it is to have users with different roles inside a group (it is intended to add a module for a treasurer, a teacher, a secretary ...), each one having its own content for the group, the users will leave/join different groups yearly, but content will remain in the group. - my groups will be hierarchical, so a user with access to a group, "may" have access to lower groups. - a user will be able to "activate" the group which is working on, so only information of the active group is listed (mixing information of lower groups will depend on "activation mode") - users will have different access levels (some can see content, some can modify, some can see lower groups information and some not, etc....) - with time I have to be able to add more "user types" who will have their own funcionalities, roles, etc... Since now I am sure I will have to: - Create a new nodetype acting as a group with information of which group refers to - a special table to store which group a user belongs to, which type of user he is and which permissions does he have. - I will need to add a table to store if a node belongs to a working group or it is "group free" and avaliable to everybody. - every "user type" module will have to had something similar to hooks to allow my module to work with them. I am studying Organic groups in order to learn how to achieve all this, but any hint is welcome, a better planification can save me a lot of work. Thanks for any help (and for reading) PD: It will be my second module with drupal, so I don't have much experience, specially with permissions, search engine. -- *La paciència és un arbre d'arrels amargues però fruit dolç. *Hi han dues paraules que t'obriran totes les portes del món: "estira" i "empeny". *Quan fa 6x9? 42!!! (funciona en base 13) *Abans d'imprimir aquest missatge, pensa en el medi ambient.

1 0

CK-ERP (Open Source ERP / CRM / MRP) v.0.26.1 released (with Drupal 5.5 connector)
by C K Wu 24 Jan '08

24 Jan '08

Hi, folks, I have posted a new release, v.0.26.1, of CK-ERP, at SourceForge.Net, http://sourceforge.net/projects/ck-erp . New features include, connector for FreeRealty connector for LandShop connector for OpenAds connector for FreightFleetManagementSystem connector for PHPJB connector for MyHandyRestaurant connector for phpMySport enhanced contact lists enhanced user interface Special thank is due to Vidar Vestnes of phpmyborder.com for producing an excellent screen bordering script. CK-ERP is an open source accounting/MRP/ERP/CRM system that runs on top of multiple middlewares. It comprises 22 modules - Administration, i18n, Contact Management, Customer Relationship, Customer Self Service, Vendor Relationship, Ledger, Bank Reconciliation, MRP, Warehouse, Inventory, Service, AP, AR, PO, SO, Quotation, POS for Cashier, POS for Manager, HR, Staff Self Service and Payroll. It provides accounting and back office functionalities to SMEs and utilizes the underlying middleware to administer accounts/groups. Please report error and suggestion to the discussion group / mailing list, CK-ERP-en(at)googlegroups.com or CK-ERP-zh_CN(at)googlegroups.com . General history and expected development is available at the discussion group's Archive. Supported MiddleWares: phpMySport; MyHandyRestaurant; PHPJB; FreightFleetManagementSystem; OpenAds, LandShop, FreeRealty; IRM; LegalCase; MirrorMed, ClearHealth, OpenEMR; eGroupWare, Horde-GroupWare; Zencart, CRELoaded, osCMax, osCommerce; Drupal, Joomla, Mambo, e107, XOOPS, Xaraya; Moodle, Atutor; vTiger, XRMS; WordPress, b2evolution; TikiWiki; phpBB. Information/Demo Websites: http://ck-erp.org http://ck-erp.net http://ck-erp.info Download is available from, http://sourceforge.net/projects/ck-erp http://gforge.oss.org.cn/projects/ck-erp http://gforge.lupaworld.com/projects/ck-erp http://gro.clinux.org/projects/ck-ledger Cheers, Wu Chiu Kay, aka CK Wu, aka CK (CK is the preferred alias) Hong Kong

1 0

Aussie Drupal devs - free MySQL training, mini conference.
by Simon Hobbs 24 Jan '08

24 Jan '08

Aussie Drupal devs As you might know, the Melbourne Drupal Mini-conference is in 10 days. (Sun 3rd Feb) http://emspace.com.au/fee *News break!* Lonely Planet are offering *1 week of certified MySQL training* as a lucky door prize. That's about a 1 in 40 chance. Discussions here: http://groups.drupal.org/node/6934 Please help Drupal in Australia by spreading the news. Thanks! /spam off Simon

1 0

Eliminating the html coder ?
by Philippe Jadin 24 Jan '08

24 Jan '08

Just read that http://www.roxer.com/ launched It allows one to create webpages with a very simple UI. One day Drupal themes and pages could be built like this... Insert usual complains about wysiwyg / ugly html / fixed layouts, but it still looks interesting /me hopes it's ok for the development list Philippe

6 6

Re: [development] Hook_elements?
by Karen Stevenson 23 Jan '08

23 Jan '08

For a diagram of the FAPI workflow in D5 and D6, try http://drupal.org/node/165104. For instructions about how to create a custom element in D6, try http://drupal.org/node/169815. Karen ----- Original Message ---- From: Richard Morse <REMORSE(a)PARTNERS.ORG> To: development(a)drupal.org Sent: Wednesday, January 23, 2008 10:03:24 AM Subject: [development] Hook_elements? Hi! Is there any good documentation about how to implement your own elements through hook_elements()? I must confess that the example file provided on api.drupal.org doesn't seem entirely clear to me -- why do I want or not want '#input' to be true, when does '#process' get called (I tried to create my own element, but '#process' never got called), do I have to register the theme function via hook_theme (), what internal keys to the formapi should I be messing with, what are the standards for themeable elements -- is there any place I can go to find out these kinds of things? Thanks, Ricky The information transmitted in this electronic communication is intended only for the person or entity to whom it is addressed and may contain confidential and/or privileged material. Any review, retransmission, dissemination or other use of or taking of any action in reliance upon this information by persons or entities other than the intended recipient is prohibited. If you received this information in error, please contact the Compliance HelpLine at 800-856-1983 and properly dispose of this information.

2 1

Re: [development] How to report a security issue
by Khalid Baheyeldin 23 Jan '08

23 Jan '08

(Changing the subject, so we do not pollute the original thread) On Jan 23, 2008 9:33 AM, Ivan Sergio Borgonovo <mail(a)webthatworks.it> wrote: > On Wed, 23 Jan 2008 11:47:34 +0000 > "Stephane Corlosquet" <scorlosquet(a)gmail.com> wrote: > > > As some pointed out, the one who reports a security issue and the > > module maintainer(s) should be more involved in the fixing process: > > 1- better communication and transparency between reporters, > > maintainers and sec team > > This sentence got my attention. > > Recently I had to deal with the sec team and the experience was not > that satisfying. > > I'm very sorry to be missing the time for superior diplomacy because > I'm very short on time so I'll go straight to the point. > > I'm referring to http://drupal.org/node/198162 > > My experience... > There may be a bit difference in details to what actually happened, > without changing the substance of the experience, I've no time to go > through email and IRC logs to make a precise chronological report. > > - I tried to intercept people on IRC asking what to do. > - nobody was able to point me to guideline to how to report a > security issue, I had the impression no one was responsible for sec > issues. It is here http://drupal.org/node/101494 > > - people even laughed at me when I said the problem may be deep into > core > - when I said that I thought that SQL injection could be exploited > just on Postgresql, I received even more laugh. Later Heine[1] > found a way to do privilege escalation with MySQL too. > - even if I submitted a quick patch nearly contextually to the sec > report there was a long lag between the public SA > - security(a)drupal.org doesn't even send an automatic reply. That's > terrible... I had to go to IRC to ask if the message was received. We get a lot of spam on that mailing list, so it is moderated. > > - after the sec team was informed I didn't get any news back, I had > to insist to get an idea about when a SA was going to be issued, how > they were planning to deal with the vulnerability etc... The team is entirely volunteer driven, and the amount of work is very large for it to handle. We recently asked for more volunteers and got maybe 3 responses total. > - missing transparency, having a patch ready it was really > uncomfortable to decide if it was the right moment to disclose the > problem autonomously or wait for an official response > The process mentioned above spells it out. You should coordinate with security and only commit when the SA is ready. > I tend to be forgiving in things related to personal character of > people. I don't mind people to be opinionated or even rude, just as > things get done the proper way. > > I tried to play nice even when I had to deal with these issues and > behave the best I could considering the information I had. Insisting > that the vulnerability was important (several high profile sites > exposed) and trying to sync with sec team even if there was no > official response. I even did some further autonomous research to see > if other module could be involved. > Some of the people I had to deal with absolutely didn't deal with the > issue in a way that promoted responsible disclosure. > > I may had behaved like an asshole (I don't think so) but still, as I > calmed down and manage the stuff at my best passing over "personal" > opinions so I'd expect the same from the people on the other side. > > Transparency and a honest communication channel are vital to this kind > of issues. > > It may had been a chance, bad luck, I don't want to point fingers to > anyone. I'd just like to point to problems so that things may get > better... and this should also say something about serious Postgresql > support and DB knowledge. > > > As a side note I think that due to the success of Drupal and its > larger community of developers this policy is not anymore suitable > for the project: > The Drupal philosophy - Escape or filter when appropriate > http://drupal.org/node/101495 > on a larger and larger code base, with many newcomers "when > appropriate" is a slimy concept and relying on db_query didn't show > to be a "catch all" solution (not to mention XSS and other kind of > niceness. > Drupal API is its most valuable asset. Encapsulation makes an API > more valuable. If people have to discover "when it is appropriate" > the API becomes less valuable. If people can't understand when it is > appropriate, it is risky [2]. > > > [1] Heine did a great job and I hope he understood I really didn't > enjoy to put pressure on him, but he was the only reasonable > communication point I had with sec, and I had to communicate through > his personal email address since nothing ever came back from security@ > I couldn't even think if he was replying in the name of the sec team > or not. > > [2] waiting for prepared statement since I love to pass nulls to the > DB > > -- > Ivan Sergio Borgonovo > http://www.webthatworks.it > > -- Khalid M. Baheyeldin 2bits.com, Inc. http://2bits.com Drupal optimization, development, customization and consulting.

4 4