May 2009 - Development - lists.drupal.org

5.x to 6.x migration timeline, best practices, tips
by T L 19 May '09

19 May '09

Hello All, I've inherited a 5.x (5.05 I think) site with about 20 contributed modules and one monster custom module (~ 7000 lines), and I'm looking at migrating to 6.x sometime in the next few months. I've looked over the handbook pages and done a little bit of googling with some good success. But I haven't found much info on planning or common pitfalls. So I was wondering if anyone had any suggestions on things to look out for or a generalized timeline? My guess was at least 100 hours to upgrade to 5.18, migrate to 6.12, test the system, and then adjust the theme and api calls. Does this seem reasonable at all? Any thoughts, suggestions, or redirects to resources would be much appreciated. Thanks so much, Tim -- Tim Loudon t: 781.686.6096 e: tloud365(a)gmail.com

10 19

Re: [development] need a standard for contrib node build_mode constants
by Chris Johnson 19 May '09

19 May '09

Maybe I'm missing something here, but it's just as possible to accidentally re-use a string constant as a numeric constant. How does using a string help things at all? Either the developer reads and enumerates a list of all existing uses and avoids collision -- or does not -- regardless of whether they are integers, strings, or ice cream flavors. Please educate me! ..chris On Tue, May 19, 2009 at 12:12 PM, John VanDyk <jvandyk(a)iastate.edu> wrote: >> To the contrary, Peter's proposition makes a very good standard to >> avoid collisions, it's actually better than strings IMO. > > To really make it unique, you'd want to prepend your drupal.org uid and > append your shoe size. >

4 3

DB Column Format
by Nancy Wichmann 15 May '09

15 May '09

I have a module for which users seem to run the updates more than once, so I try to make the update code sensitive to this. In my latest change, I am converting from unix time to DATETIME. I dont see a function in the APIs that allows me to check what type the column is. I can easily use SHOW COLUMNS, but I suspect that MySql and PgSql return different results. Any ideas on how to make this database independent? Nancy E. Wichmann, PMP Injustice anywhere is a threat to justice everywhere. - Martin L. King, Jr. No virus found in this outgoing message. Checked by AVG - http://www.avg.com Version: 8.0.176 / Virus Database: 270.12.29/2114 - Release Date: 5/14/2009 6:28 AM

6 9

Lost CVS access
by Earl Dunovant 15 May '09

15 May '09

I have a couple of modules kicking around that are pretty stable. I was just asked to modify one in particular, the Week module, to create a monthly archive and block for selected node types (one block and archive for multiple node types AND individual block and archives for selected node types). I wound up with much better code and decided to upgrade the week module along the same lines. Problem is, I haven't had to touch CVS since 6x dropped, I've switched a couple of machines around and lost track of my CVS access stuff. Who can I ask for help?

2 2

D7 $page and global objects
by Ivan Sergio Borgonovo 14 May '09

14 May '09

I needed somewhere where to store <head> in a more structured way so that modules can modify head easier. Jeff Eaton suggested to put it in $page. I tried to get an idea about what $page is but I'm not sure I got it. eg. block uses _page_alter to fill $page elements. node doesn't. Finally everything is somehow "serialized" in template_preprocess_page But most of the things that end up in the $page (theme.inc template_preprocess_page) arrive there from functions that don't take any parameter eg. drupal_get_breadcrumb(), menu_main_menu(), drupal_add_css() etc... Currently very few things reach $page directly or through _alter_page. I definitively don't like the idea of adding one more global object but I can't see any way to fill $page in the same context in which content is created. $page doesn't look as a global object but still doesn't get passed to modules hook. Let's stick to the initial itch (structured head) and see how things may work. Still you can extend the problem to other page "sections" and you'll have the same hook vs. global problem. Currently anything that need to "modify" head... is actually modifying a global object through drupal_add_html_head. So when I'm preparing a page content, no matter if it is a node or just something pushed to a page I can access head. Now if I plan to use _page_alter... I won't be able to access head content in the same context in which I'm creating the page content. On the other side if I add one more global object, wrapped up in a function with a static variable (that should be declared in core so that everything can access it) as the many already used in template_preprocess_page I can't see the real advantage of having head in $page. I remember I've read something about handlers... by Larry Garfield... Is there any shift in policy about "objects" in Drupal? http://api.drupal.org/api/file/developer/topics/oop.html/7 mainly for a namespace reason at the moment. -- Ivan Sergio Borgonovo http://www.webthatworks.it

1 0

Irresponsible security researcher
by Karoly Negyesi 14 May '09

14 May '09

Hi, This guy believes in full disclosure so much he discloses everything he finds instead letting us fix and disclose. This happened more than once. So surely he wont mind if I disclose his mail sent to the security list. According to whois, he is Justin Klein Keane 1122 Green Street Philadelphia, PA 19123 US Phone: 1-215-2320909 Email: jkeane(a)madirish.net I will let the creative members of the Drupal community figure out ways to express their displeasure with his practice. Mail follows: Hello, First let me state that I love Drupal and evangelize it openly. I run a Drupal users group at my place of employment and have given presentations on the advantages of Drupal at several conferences. I frequently recommend adoption of Drupal and defend its security track record. However, as I said before, I think we've been round the philosophical differences between Drupal security and myself before, and we simply disagree. The first thing I do when I discover a vuln is warn all my colleagues who have Drupal installed. It only makes sense that I warn everyone. I'm not under any illusions that I'm the best at what I do. The "bad guys" get paid to find these vulns, and they don't disclose them. If I've found a vuln, unless you somehow accept that I'm the best at doing this, then you must know that the "bad guys" already know about the vuln. Full disclosure informs end users so they can make an informed decision about whether or not to continue running the system, or whether they need to modify the app or their deployment. I have discovered vulnerabilities before for which Drupal team has not given me credit. Drupal security and I have also disagreed over the severity of security issues which has resulted in patches not being developed (http://drupal.org/node/372836) This combined with the sarcastic replies I often get from the security team, makes me leery of their commitment to credit my discoveries. Furthermore, I've inquired as to contributions I could make to Drupal security team but was rebuffed. So, here's what I have in conclusion: 1) I believe people using Drupal deserve to know about vulnerabilities as soon as possible because "bad guys" already know about them. 2) I don't trust that Drupal security would actually credit me, especially now that relations have sufficiently soured 3) Drupal security seems cliquish and hasn't given me any incentive to work within their framework. I think that leaves us at pretty good loggerheads. I understand you have a tough, and probably thankless job. I laud the contributions you are making to a wonderful open source product. I will be the first to stand up and say you all do a great job at keeping Drupal secure. I will continue to inform Drupal security directly when I discover vulnerabilities, but I would appreciate it if you could respect my motivation for refusing to withhold public disclosure. All the best and keep up the good work, Justin C. Klein Keane http://www.MadIrish.net http://www.LAMPSecurity.org

9 10

Re: [development] Irresponsible security researcher
by Joshua Rogers 14 May '09

14 May '09

I'm not quite sure that giving out his personal information to a group of annoyed developers is a good idea. Something about inciting a riot just seems wrong. We can't force him to play by our rules and see things our way (even though his is wrong. ;) I can say that personally it does cause me to wonder about this "ethical hacker." (It says so on his resume. Really.) Personally, by endangering those who use the software that he exams, I see him more as a passive- aggressive black-hat. And maybe a little over jealous at that. http://drupal.org/node/372836 (which apparently he wasn't credited with) amounts to "if you let someone administer nodes they can change things."... Yes. Better though was http://justin.madirish.net/drupal6-cck-vulnerability. It boils down to 'people with "Use PHP input field settings" permissions can run PHP'... So... I guess that makes this a un-bug report? (Maybe an "Everything is working like it is supposed to." report?) At least now I know one less person that I have to take seriously (on a professional level.) J Rogers On Tuesday 12 May 2009 8:22:08 pm Karoly Negyesi wrote: > Hi, > > This guy believes in full disclosure so much he discloses everything > he finds instead letting us fix and disclose. This happened more than > once. So surely he wont mind if I disclose his mail sent to the > security list. According to whois, he is > > Justin Klein Keane > 1122 Green Street > Philadelphia, PA 19123 > US > Phone: 1-215-2320909 > Email: jkeane(a)madirish.net > > I will let the creative members of the Drupal community figure out > ways to express their displeasure with his practice.

5 5

rebuilding permissions stuck at node 35
by Lluís 13 May '09

13 May '09

I have coded a module to modify access to nodes; but when I rebuild permissions, it starts at node 1, goes counting, and then when it reaches 49 it starts rebuilding permission for node 35. My custom function to write permissions is: function wu_node_access_records($node) { $extra_strings=module_invoke_all('wu_node_access_records', $node); //this allow other modules to add strings sort($extra_strings); // idem $res=db_query("SELECT * FROM {wu_nodes} WHERE nid=%d",$node->nid); while ($row=db_fetch_object($res)) $grants[] = array( 'realm' => 'wu_'.$row->wu_realm.(!empty($extra_strings) ? " <###> ".implode(" <###> ", $extra_strings): ""), 'gid' => $row->wu_nid, 'grant_view' => 1, 'grant_update' => 1, 'grant_delete' => 1, 'priority' => 0, //maybe should be increased ); drupal_set_message("rebuilding node: ".$node->nid."-".$node->vid); //debug return isset($grants) ? $grants : NULL; } and it returns: * rebuilding node: 1-1 * rebuilding node: 23-23 * rebuilding node: 24-24 * rebuilding node: 27-27 * rebuilding node: 28-28 * rebuilding node: 29-29 * rebuilding node: 30-30 * rebuilding node: 31-31 * rebuilding node: 32-32 * rebuilding node: 33-33 * rebuilding node: 34-34 * rebuilding node: 35-35 * rebuilding node: 36-36 * rebuilding node: 40-40 * rebuilding node: 42-42 * rebuilding node: 43-43 * rebuilding node: 44-44 * rebuilding node: 45-45 * rebuilding node: 35-35 * rebuilding node: 47-47 * rebuilding node: 48-48 * rebuilding node: 49-49 * rebuilding node: 35-35 * rebuilding node: 35-35 * The content access permissions have been rebuilt. Any hint is wellcome -- *La vida és com una taronja, què esperes a exprimir-la? *Si creus que l'educació és cara, prova la ignorància. *La vida és com una moneda, la pots gastar en el que vulguis però només una vegada. *Abans d'imprimir aquest missatge, pensa en el medi ambient.

1 1

3rd party sites/all/plugins
by Simon Hobbs 13 May '09

13 May '09

Hiya Is there best practice for 3rd party plugins? Recently a tiny site was upgraded, the fckeditor module was updated but the dev didn't re-add fckeditor. The owner didn't notice for ages and eventually I have to work backwards through backups to make sure I get the right (possibly customized) package. So I've started creating a sites/all/plugins folder for all the fckeditors / swfobject / jqueryplugins / pdfwriters / etc that I need for a job. I then use symlinks, so in the scramble the fix is simple. It's nice too I can put different versions of tools side by side, and the symlink just points to the desired one. In theory it would be great if modules expected a plugin folder. For non-professionals we put them under duress with install instructions that tell them to clutter their modules with plugins, making upgrades harder for them, and I think we send the message that altering modules is ok. Thoughts or guidance? Thanks Simon Hobbs / sime

4 7

Just a note...
by Karoly Negyesi 12 May '09

12 May '09

I just spent about 7 minutes reviewing two Drupal 7 issues before sleep, posted this to twitter and used #ireviewdrupal as a tag. If you so happen to review too (am I already dreaming?) then maybe twitter about it too. I hope we can make the tag reach trending status one day (ok now I am definitely dreaming but lofty dreams are good).

2 1