September 2008 - Development - lists.drupal.org

Better validation for CVS tags now deployed on cvs.drupal.org
by Derek Wright 03 Oct '08

03 Oct '08

The CVS repository used to be very forgiving in what it considered a valid release tag, especially in the 'extra' portion of the tag name. This lead to all sorts of wonky tags that creative developers came up with. My least favorite are the official release tags that end in "-dev", utterly blurring the distinction between official releases and development snapshots. Now, your official release tags must match the format documented here: http://drupal.org/node/93999 For the regexp-enabled, your tag must match this: @^DRUPAL-[567]--(\d+)-(\d+)(-(ALPHA|BETA|RC)[0-9]+)?$@ For the non-regexp-enabled, that basically means that the optional part after the drupal core branch name (e.g. "DRUPAL-6") and the required two digits for your version string (e.g. "--1-0") must be either "ALPHA", "BETA" or "RC" followed by 1 or more numbers. This will also prevent people from abusing the "extra" portion of the tag name as if it was another digit in the version string. 5.x-1.2-1 or 5.x-1.2.1 is no longer allowed. This was never supported, never intended, never documented, and update_status doesn't know what to do with it. Now, you can no longer create tags like this. The next release after 5.x-1.2 should be 5.x-1.3... For history and discussion of this change, see this issue: http://drupal.org/node/252473 Apologies I never locked down this regexp earlier. ;) Cheers, -Derek (dww) p.s. Please don't reply here. If you'd like to discuss this change, reply to issue #252473. Thanks. p.p.s. Nothing changed about the format of valid branch names. Those never had much flexibility in the first place, so there's no problem there. p.p.p.s. Before you write a nastygram about what a tyrant I am, please be aware that webchick, killes, merlinofchaos and pwolanin (among others) all support this change. ;)

4 4

Certify Drupal for use in Government (US) Projects
by Jon Saints 01 Oct '08

01 Oct '08

On a recent project for the US government, half way through the development process, our work was stopped by a government security review which said that Drupal (and open source software in general) is not suitable for use in government projects that house personal information due to security concerns. Because our project had been approved by higher ups within the department, we were paid for our work up to that point and asked to stop. Now, its up to the tax payers to foot a much larger bill for other developers to implement a proprietary and more "secure" (or secretive) solution. The "transparency" of the Drupal project was one of the government's big objections. In their eyes, disclosing and fixing securit holes in a timely manner, is not the same thing as security. They pointed out the 100+ security disclosures since drupal 4.0 as a reason that the system could not be used. We noted that all these disclosures where quickly addressed, but that did not seem to matter. I notice other governments around the world are using Drupal with great success and savings to citizens: http://buytaert.net/new-zealand-government-using-drupal The standards we would need to meet with drupal are: http://csrc.nist.gov/groups/SMA/fisma/index.html My questions are the following: - Have any other developers run into this cerfication problem before? - Is anyone in the drupal community currently working to get Drupal certified for use in US Government projects? - Does anyone know exactly what cerfication would require from a development standpoint? If there is interest in investigating this type of certification further, let me know. NIST, the department that certifies software, is just down the road from me. I could go investigate further. Thanks Jon

23 41

Re: [development] Certify Drupal for use in Government (US) Projects
by Piermaria Maraziti 01 Oct '08

01 Oct '08

At 17.14 30/09/2008, you wrote: >The "transparency" of the Drupal project was one of the government's >big objections. Just as a quick note by a lurker: various organs of the Italian government (Finance Ministery but not only) judged the "open" is OS projects to be a very good element for the usual reasons addressed by OS evangelists, also about security issues. It's a priority, to them, also the active participation in community: giving help when they can to receive help when they need (yep: most utilitary, not so idealistic - but pragmatic and correct). Ciao! --8<-----------------------------------fnord----- Piermaria Maraziti piermaria(a)maraziti.it KALLISTI ICQ744473 MSN:kallisti@hotmail.it +3934735GILDA www.gilda.it www.eridia.it www.hovistocose.it

1 0

Seeking Drupal Consultant / Individual Developer
by Davin Hutchins 29 Sep '08

29 Sep '08

Dear Drupalers, We have hired a firm with little Drupal experience to build a Drupal 5.x site for us. They have found Drupal to be challenging and need to phase out their development. We are seeking a Drupal developer local to the Washington D.C. area to consult for us in three ways: 1.) Third-party audit of the site to see what has been installed incorrectly, built incorrectly, etc. with recommendations for fixing it 2.) We have some content and theme alterations (and a mockup) to add a simple blog and other items we would like implement by Nov. 15th 3.) On going consultation (on retainer) to modify the site, install and test relevant modules, make strategic recommendations We are a well-funded non-profit staffed by video producers and journalists have worked with CNN, National Geographic, BBC, PBS. The site can be viewed at www.americannewsproject.com Please e-mail here info(a)newsproject.org with: Drupal Consultant in the subject line. NO PHONE CALLS PLEASE. -- Davin Hutchins Managing Producer American News Project (http://www.americannewsproject.com) 1050 17th Street NW, Suite 550 Washington, D.C. 20036 Video Reel: http://link.brightcove.com/services/player/bcpid1726689966 LinkedIn CV: http://www.linkedin.com/in/nomadsland

1 0

Patch Spotlight 2.0
by Angela Byron 28 Sep '08

28 Sep '08

Back during the Drupal 6.x release, a bunch of us in #drupal pioneered an idea called "Patch Spotlight" (http://drupal.org/patch/spotlight) The idea was to pick the single most critical issue in the queue, put it "bubble it up" to give it more attention, so we could hammer *all* development efforts at it until it was resolved. The page includes information for those new to patch reviewing on how to get started, as well as an overview of what the patch does to help save people from reading 100+ replies. This actually worked pretty well towards the end of 6.x release, and helped us hammer through some critical bugs pretty quickly. However, it does have some drawbacks: 1. Only one patch is featured at a time. There might be many highly critical issues at any given time, but we can only pick one. Since there are over 5,000 issues in the queue, this mechanism is unsustainable for plowing through the patch queue. 2. Said issue might be very complex (such as the current one) or only be reviewable by only a very small number of people with a particular area of expertise (such as the current one) and as such, may stagnate for months on end (such as the current one ;)). This causes the spotlight to be less effective, because people start to ignore it. 3. People have domain expertise in different areas, and it's been challenging finding enough themers, people with JS knowledge, translators, etc. to test relevant patches in the queue. Patch spotlight doesn't reach those people; only the active core developer community. So, here comes... Patch Spotlight 2.0! http://groups.drupal.org/node/5647/patch-spotlight This is a collection of wiki pages in the "Improvements to Core" group (http://groups.drupal.org/improvements-core) cross-posted to the relevant working groups, that contains a "short-list" of core issues in a variety of areas that need code written, or patches reviewed. The issues are categorized in the following way, each with its own wiki page, editable by any members of the group: * Killer feature-enablers: Issues in the critical path for enabling us to meet Dries's Drupal 7 hit list. * OMG WTF BBQ: *Seriously* critical bugs that *need* to get fixed. * DX patches: API tweaks and such that help improve the developer experience. Also, patches that affect: * Performance: Cross-posted to the High Performance group. * Usability: Cross-posted to Usability group. * Theme system: Cross-posted to the Theme Development group. * Documentation: Cross-posted to the Documentation Team group. * JavaScript: Cross-posted to the JavaScript working group. * Translations: Cross-posted to the Translations group. * Quality Assurance: Cross-posted to the Testing/QA group This list is a result of brainstorming tonight on #drupal, so might have some glaring holes. I've added a couple of starter issues to each, but feel free to take over and add additional ones to self-organize. Obviously, the fewer issues in each page, the quicker they can be moved through, so avoid using this as a personal soapbox for all your pet patches unless they really are of wider interest to folks in a particular area. So now we have: 1. A way to "spotlight" several dozen patches rather than just one. 2. A way to alert people in working groups of core issues that affect them, so that they can give input on them well before Drupal 7 is released. 3. A way for working groups to self-select important patches in their area, and prioritize and focus on them. 4. Panels! With curvy borders, even! ;) Downside is this list needs to be maintained manually, which is kind of a pain, but if enough people help out, it should go pretty slick. Looking forward to reviewing and committing your RTBC patches! :) -Angie

2 2

Threading problems?
by Dan Robinson 27 Sep '08

27 Sep '08

Hi, I'm seeing a difficult to understand error that looks like a threading issue. My application 1. Takes data from an anonymous user (node add). 2. Creates a filename based on an md5 of a secret, the endusers email, and time() 3. Saves data to the file 4. Sends an email to user with a link to the file created 5. Displays a "complete" page that has the link to the file. Operations 2 and 3 happen within a single procedure The filename is determined thusly: $filename = md5($conf['myapp_secret_salt'] + $form_state['values']['Qualifyers']['Email'] + time()); Then I prepare data and write the file, then stash the filename in $_SESSION (for use later) $_SESSION['myapp']['filename'] = $filename; $_SESSION['myapp']['UserRegFormUrl'] = $params['filenameurl']; setcookie('myapp:filename', $filename); // this is somewhat of a hack to trap errors - see below. drupal_mail('myapp', 'notify', $form_state['values']['AdditionalQs']['Email'], NULL, $params, NULL, TRUE); myapp_mail receives the filename from $params above, prepares and sends an email with a link to the file to the end-user. In step 1 above in the form I: $form['#redirect'] = 'registration/complete'; The node at registration/complete has some php in it that fetches the global variables (with the filename) and outputs a link to the file in the browser. So that is the whole process. The problem I'm having is that some users are being pointed to files that belong to other users. I believe this is happening both in the email as well as on the registration/complete form. Some people have reported receiving links to files that were for another user. Also I put some trap code in the registration/complete form. The form fetches the filename from $_SESSION and compares it to the filename in the cookie - if they don't match it errors. That code is being tripped. I looked at recent occurrence of the error and the two nodes involved (one for each of the users) had exactly the same time created timestamp. My assumptions have been: - Anonymous sessions are tied to a particular connection and data in $_SESSION is not shared. - PHP procedures are threadsafe I'm running PHP 5 on Red Hat. What am I doing wrong? Thanks, Dan

4 5

Handling optional parameters
by Nancy Wichmann 25 Sep '08

25 Sep '08

I have a module that may accept several optional parameters from the user. The "standard" way of doing this is something like "my-module/action/123/0/3/list/xyz" where everything after "123" is optional, so doesn't show up in the menu entry. I'm not crazy about this technique, although the menu system does make it easy to use. A) The user has to remember, or look up, the order of those parameters (I have to look them up because I can't remember them, and I wrote it). B) If the user is happy with an intermediate value (e.g. the "3" above), they still have to specify it in order to use "list." C) There is no flexibility. I was playing around and realized that $_GET makes getting input parameters from the query string pretty easy. It also gives me more flexibility in adding (or removing) the optional parameters, means the user doesn't have to remember the order, and means only values that are desired have to be entered. Will I be tarred and feathered for going the $_GET route? Nancy E. Wichmann, PMP No virus found in this outgoing message. Checked by AVG - http://www.avg.com Version: 8.0.169 / Virus Database: 270.7.0/1685 - Release Date: 9/22/2008 4:08 PM

6 6

Desperately seeking speaker: Danish Open Source Days conference - Copenhagen Oct. 3
by Robert Douglass 24 Sep '08

24 Sep '08

Hi everyone, I had signed up to be a speaker at the Danish Open Source Days conference in Copenhagen, Oct. 3. I'm not able to be there and the conference organizers are looking for a replacement that can thrill the crowd with some Drupal goodness. Which Drupal ambassador can step up to the plate and deliver a mouth watering demo? I believe they will pay for your hotel and travel (need to confirm that). Please contact me off list if you're interested. Tell me what you'd be presenting so I can present them with the right info. Thanks! http://opensourcedays.org/2008/about/ Robert Douglass Senior Drupal Advisor, Acquia +1 978 289 4250 (US) +49 228 4097 197 (Germany)

1 0

nodeapi data flow
by Eric-Alexander Schaefer 22 Sep '08

22 Sep '08

Hi list, are there any docs describing the data flow for creating/editing/previewing nodes (hook_nodeapi)? Thanks, Eric

7 9

Active select(?)
by Ámon Tamás 22 Sep '08

22 Sep '08

Hello, I have a table with 10000+ record (id, name). I like to make a field like autocomplete but I like to get back the id not the name. Now I make this: function autocomplete_athlete($string = '') { $matches = array(); if ($string) { $result = db_query_range("SELECT a.item_id, a.name FROM names as a WHERE a.name LIKE LOWER('%s%%')", $string, 0, 10); while ($user = db_fetch_object($result)) { $matches[$user->name. '#'.$user->item_id] = $user->name; } } drupal_json($matches); } And on the onblur javascript event I change the field to the id with a split. But I think this is not a very nice solution. How can I make it to nice? Ámon Tamás Sitefejlesztő és programozó -- 5NET Informatikai Kft. 1062 Budapest, Aradi utca 38. A 3/11 telefon: (1) 461-0205 | fax: (1) 461-0206 e-mail: amont(a)5net.hu | web: http://www.5net.hu

2 1