January 2009 - Development - lists.drupal.org

Writing a test for book_get_books()
by Andrew Berry 21 Jan '09

21 Jan '09

Hi, This is in relation to http://drupal.org/node/360377. What I'm doing is building multiple $form_state arrays and using them to build an entire structure of a book automatically. In essence, the code looks like this (mostly from the comments above drupal_execute(), and yes, I want to create a book of articles - node type doesn't seem to matter): $parent_node = array('type' => 'article'); $form_state = array(); $form_state['values'] = array(); $form_state['values']['title'] = $number . ' - SimpleTest test node ' . $this->randomName(10); $form_state['values']['body'] = 'SimpleTest test body ' . $this- >randomName(32) . ' ' . $this->randomName(32); $form_state['values']['book'] = _book_link_defaults('new'); $form_state['values']['book']['bid'] = 'new'; $form_state['values']['op'] = t('Save'); drupal_execute($parent_node['type'] . '_node_form', $form_state, (object)$parent_node); And repeat for the various subpages setting the various book properties so that child pages have the right parents. According to lyricnz2 on IRC (thanks!), the problem is that drupal_execute() doesn't work as expected in SimpleTest environments, as it runs against the normal database, and not the simpletest copy. Two questions then: 1) Is the original issue actually a bug, or am I abusing FAPI incorrectly? 2) Since the issue requires multiple book nodes to be inserted in one request, meaning I can't use drupalPost(), how can I write a proper test for it? It was suggested that I could create a block and run PHP in it, but I would think there has to be a better way. Thanks, --Andrew

2 2

Upgrade to 6.8/6.9 breaks all taxonomy listings
by M. Fioretti 16 Jan '09

16 Jan '09

Greetings, I *do* know that is list is for development, not for support, sorry. But I have already tried two times, both on the support list and in the drupal forums, to get some answer, any answer to something which probably requires top drupal expertise to solve. I got a serious problem which I explained in detail here: http://drupal.org/node/356394 http://drupal.org/node/358739 (for the record, I just upgraded to 6.9 and nothing changed). I'm a bit worried that in one week there was no reaction whatever to something like this. Didn't I provide enough information? How can I find out what went wrong and how to fix it? I have no problem to study documentation or do command line work myself. I also have ssh and phpmyadmin access to that server, but honestly I need some pointer to get started in the right direction (assuming this is a problem in my site and not a bug in Drupal). What's the problem? Why did those listing disappear? Please let me know and don't hesitate to ask for more info, tests to run on the server, whatever. TIA, Marco -- Help *everybody* love Free Standards and Software: http://digifreedom.net

3 4

Info needed to add content to Drupal via shell/curl script
by M. Fioretti 16 Jan '09

16 Jan '09

Greetings, I would like to ask all Drupal developers where to find the info to do what I describe below. I have already found almost identical questions asked both on the support list and in the forums at drupal.org, but they did not receive complete answers, so here I am. I want to write a shell script which takes as input an HTML file and other parameters (title, category, etc...) and then, using curl and the POST method, logs into a Drupal website, adds a node with that text and parameters, logs off and returns the complete URL assigned by drupal to that page. The information I need is: - what is the exact sequence of pages (relative URLs) that drupal presents to users who login and then want to add a node? - what is the complete list of POST parameters (assuming there is only one custom category CAT_1) that drupal wants to see POSTed to each of those pages? - how much the two answers above depend on drupal version, or will change in the future? Important: I know I can look at all the http headers going back and forth between browser and drupal, and using this approach I have *already* written a working draft of the script myself, but I'm looking for a better, more reliable way to do this. I found that the script won't work consistantly, meaning that I'd have to tweak it every time if Drupal version changes or (usign it on other sites) depending on which modules are installed. So, is there any official documentation which contains complete, reliable answers to the questions above? In other words, is there a better, more reliable and future-proof way to get those answers than studying source code or raw http sessions by trial and error? Thank you in advance for any feedback and happy 2009! Marco -- Help *everybody* love Free Standards and Software: http://digifreedom.net

6 12

Asking for donations in contrib
by Arancaytar Ilyaran 16 Jan '09

16 Jan '09

Hello Drupal, I've heard the name ChipIn (http://www.chipin.com/) tossed around a few times in relation to developing on a donation basis, and I'm wondering how it works out for developers, users and the community. Specifically, I'm reaching a point in DHTML Menu (http://drupal.org/project/dhtml_menu) where beside bug reports I often see requests for some pretty substantial features, which admittedly would be very cool, but would also take a lot of development time. I currently develop and maintain this module in my free time. It would be great if I could fix bugs for free but use donation drives to sponsor new features. That would probably be better than selling customizations directly, because it is less expensive to individual customers. Do you have any suggestions or criticism on this idea? :) Cheers, -Arancaytar -- Arancaytar ---------------------- Nothing beside remains: Round the decay Of that colossal wreck, boundless and bare The lone and level sands stretch far away... ---------------------- PGP: http://ermarian.net/downloads/0x27CA5C74 XMPP: arancaytar.ilyaran(a)gmail.com AOL: 282026638 @icq / RealArancaytar @aim URL: http://ermarian.net

9 12

load node globally
by Ashraf Amayreh 15 Jan '09

15 Jan '09

Hello All, Since I see so many node loads in block visibility and in modules that do $node manipulations and so forth, which would make me think that sometimes many node loads might occur on some pages and tens perhaps when you add contributed modules on that, I was wondering why not just load $node globally on node/<num>/* pages like we do with $user to avoid any extra node_loads? Developers would only need to global $node and it would either be null or populated and ready. Before creating a patch for a *possibly* terrible idea, I thought I'd raise a stick and see if it gets shot :D -- Ashraf Amayreh http://aamayreh.org

7 6

Re: [development] Split module into two?
by Pratul Kalia 15 Jan '09

15 Jan '09

Dmitri, I have already talked to Josh about UpDown and we had decided to keep Vote Up/Down and instead provide an upgrade path from UpDown. Vote Up/Down is an older module, is used much more widely and has more features. Of course, there are some points to note in the UpDown implementation (like the hash value at the end to prevent false votes) that I need to incorporate in Vote Up/Down. There's more on my to-do list as well. I hope you will help us out with that as well :-) Andrew, I do think Storylink would be better off as a separate project since it's not really a voting related module after all. It was a part of the original goal Vote Up/Down had in mind (a Digg/Reddit type clone) but I have decided to focus on purely on voting for Vote Up/Down now. cheers pratul -- Incoming! - OSScamp Pantnagar, 30 Jan - 1 Feb, 2009 - Freed.in, 20 - 21 February, 2009 dum vivimus, vivamus. http://pratul.in

1 0

Development and Production environments
by cooper Quintin 15 Jan '09

15 Jan '09

Hello All, I am trying to set up an already live drupal site with a development, testing and production (live) environment. I started by checking all the code and a mysqldump into a subversion repository. I then began to set up a development environment on the same server that the live site was running on. I got everything set up (development database, vhost, etc.) and went to the development site, it worked fine but after running for about 1 or 2 minutes it crashed the server. I restarted the server and left it running just fine for a while, then I tried visiting the development site again with the same results. (Spectacular crash). I tried setting up a dev environment on my local computer and the same exact thing happened. I find this to be incredibly strange since the live site runs perfect on the same exact server, with the same exact settings. Has anyone else run into this problem or have any ideas what could be causing it? I was pondering that it could be memcached but then that shouldn't have caused a problem running solo on my box. I have included some pertinent information below. Thanks, -- Cooper Quintin Freelance Programmer, Indymedia Journalist http://CooperQ.com (510) 827-5382 P.S. Here is the pertinent info for the server: Server OS: CentOS 5 Drupal Version: 5.15 php 5.2.8 apache 2.2.3 mysql 5.0.45 memcached 1.2.5

2 2

Split module into two?
by Pratul Kalia 15 Jan '09

15 Jan '09

Hello everyone I maintain a set of modules called Vote Up/Down Package - http://drupal.org/project/vote_up_down It's essentially 2 modules (which is why its 'package'). One module provides the voting interface. The other module is called Storylink, and it provides a Digg-submission-like content type that has a title, some small info and a link to the actual story. It also has other stuff like a JS bookmarklet. Since this module has been in existence, these both modules were packaged together. I feel now that it would be beneficial for people to have these as separate modules since they perform 2 separate tasks. Initially, these were together to give a Digg-like package. I don't really see people using the package for that purpose now. I'd like to know what other developers think about this issue. Should I separate Storylink and develop it as a separate module? cheers pratul -- Incoming! - OSScamp Pantnagar, 30 Jan - 1 Feb, 2009 - Freed.in, 20 - 21 February, 2009 dum vivimus, vivamus. http://pratul.in

3 2

Announcing DRUPAL-7-0-UNSTABLE-4
by Angela Byron 15 Jan '09

15 Jan '09

Greetings, devel list! Due to holidays, conferences, illnesses, and such, it's been about two months since our last unstable release. So, upon mysteriously finding myself some time tonight, I figured now was as good a time as any to roll the next one. :) Here's a summary of some of the changes that seemed to stick out while reading the UNSTABLE-3 => UNSTABLE-4 changelog. I've attached the output of /contributions/tricks/cvs-release-notes.php to this mail (hopefully it makes it through to the list). See http://drupal.org/node/224333#UNSTABLE-4 for the full list of API changes this release. Once again, I encourage contributors to usehttp://groups.drupal.org/patch-spotlight as a place to organize, prioritize, and coordinate on patches they'd like to see in Drupal 7. Keep up the great work, folks! For developers: =============== - RDF goodness! An RDF namespace registry (and core now is XHTML 1.1 compliant as a result). I don't really know what an RDF namespace registry means, but Dries is excited about it. ;) - All of our hook documentation is now embedded in Drupal core files. This means it is easily searchable without access to api.drupal.org, You can enter "hook_something_something" in an IDE and have it auto- fill, AND it means that we will no longer have any hook introduced into Drupal without corresponding documentation. Hooray! - There were several patches committed that are bringing consistency to our table naming conventions: blocks -> block, filters -> filter, etc. This is an enabler for interesting Data API things. - Speaking of the database, HOOK_DB_REWRITE_SQL() IS DEAD. Long live hook_query_alter(), which gives you an actual *query object* instead of a fricking *string* that you have to parse with regex! :P Hooray! - Various "plumbing" improvements to systems like SimpleTest (which got way faster and also had some bug fixes), DBTNG (which got bug fixes, subquery support, improved test coverage, various conversion patches, etc.), File API (tests, tests, and more tests, all of which fixed underlying bugs), and so on. - Node links and comments were moved into $node->content['links'] and $node->content['comments'], respectively. This will make them a lot easier to theme. - Performance improvements to the module system, bootstrap, etc. and the addition of functions such as node_load_multiple() and file_load_multiple() which allow you to save approximately oodles of queries by retrieving all of the objects you need at once rather than one at a time. For users: ========== - Users can now (if given permissions) cancel their own accounts. So endeth the oldest issue in the issue queue. Sniff. ;) - Permissions page now displays human-readable names, in addition to descriptions. - Improvements have been made to Aggregator module which allow pluggable feed fetchers, parsers, and processors. - SQLite database support, which, among other things, opens up interesting possibilities for a "LiveCD"-like distribution of Drupal that requires no installer. - A PostgreSQL "surge" has brought us pretty close to "true" PostgreSQL database support (for real this time - we even have two maintainers!). - The "Display post information" options have been moved from the theme settings (where no one on earth ever thinks to look) to the content type settings (where they do). - A new "Clear all logs" button which lets you delete all watchdog data without having to dork around in the database. - A new module dependency system which magically figures out what order to enable modules when you check off a bunch of them that are inter-dependent so you don't get ugly "function does not exist" fatal errors. Yay, math! -Angie

1 0

2009 CWE/SANS Top 25 Most Dangerous Programming Errors
by Darly Coupet 12 Jan '09

12 Jan '09

2009 CWE/SANS Top 25 Most Dangerous Programming Errors http://cwe.mitre.org/top25/#CWE-20 Insecure Interaction Between Components These weaknesses are related to insecure ways in which data is sent and received between separate components, modules, programs, processes, threads, or systems. - CWE-20 <http://cwe.mitre.org/top25/#CWE-20>: Improper Input Validation - CWE-116 <http://cwe.mitre.org/top25/#CWE-116>: Improper Encoding or Escaping of Output - CWE-89 <http://cwe.mitre.org/top25/#CWE-89>: Failure to Preserve SQL Query Structure (aka 'SQL Injection') - CWE-79 <http://cwe.mitre.org/top25/#CWE-79>: Failure to Preserve Web Page Structure (aka 'Cross-site Scripting') - CWE-78 <http://cwe.mitre.org/top25/#CWE-78>: Failure to Preserve OS Command Structure (aka 'OS Command Injection') - CWE-319 <http://cwe.mitre.org/top25/#CWE-319>: Cleartext Transmission of Sensitive Information - CWE-352 <http://cwe.mitre.org/top25/#CWE-352>: Cross-Site Request Forgery (CSRF) - CWE-362 <http://cwe.mitre.org/top25/#CWE-362>: Race Condition - CWE-209 <http://cwe.mitre.org/top25/#CWE-209>: Error Message Information Leak Risky Resource Management The weaknesses in this category are related to ways in which software does not properly manage the creation, usage, transfer, or destruction of important system resources. - CWE-119 <http://cwe.mitre.org/top25/#CWE-119>: Failure to Constrain Operations within the Bounds of a Memory Buffer - CWE-642 <http://cwe.mitre.org/top25/#CWE-642>: External Control of Critical State Data - CWE-73 <http://cwe.mitre.org/top25/#CWE-73>: External Control of File Name or Path - CWE-426 <http://cwe.mitre.org/top25/#CWE-426>: Untrusted Search Path - CWE-94 <http://cwe.mitre.org/top25/#CWE-94>: Failure to Control Generation of Code (aka 'Code Injection') - CWE-494 <http://cwe.mitre.org/top25/#CWE-494>: Download of Code Without Integrity Check - CWE-404 <http://cwe.mitre.org/top25/#CWE-404>: Improper Resource Shutdown or Release - CWE-665 <http://cwe.mitre.org/top25/#CWE-665>: Improper Initialization - CWE-682 <http://cwe.mitre.org/top25/#CWE-682>: Incorrect Calculation Porous Defenses The weaknesses in this category are related to defensive techniques that are often misused, abused, or just plain ignored. - CWE-285 <http://cwe.mitre.org/top25/#CWE-285>: Improper Access Control (Authorization) - CWE-327 <http://cwe.mitre.org/top25/#CWE-327>: Use of a Broken or Risky Cryptographic Algorithm - CWE-259 <http://cwe.mitre.org/top25/#CWE-259>: Hard-Coded Password - CWE-732 <http://cwe.mitre.org/top25/#CWE-732>: Insecure Permission Assignment for Critical Resource - CWE-330 <http://cwe.mitre.org/top25/#CWE-330>: Use of Insufficiently Random Values - CWE-250 <http://cwe.mitre.org/top25/#CWE-250>: Execution with Unnecessary Privileges - CWE-602 <http://cwe.mitre.org/top25/#CWE-602>: Client-Side Enforcement of Server-Side Security Darly

1 0