- Development - lists.drupal.org

Block user deletion
by Nabil Alsharif 16 Apr '09

16 Apr '09

The issue is I need some users to be able to edit other users info but not delete them. There is no permission that I can see that allows editing of users profiles but not deleting them. My second guess was to write a module but I don't see anything in the API that will let me control user access the way I need. Neither could I find a way to block the deletion (I know hackish). Any pointers in the right direction are greatly appreciated.

4 5

err...Views DataSource resuming service
by Allister Beharry 14 Apr '09

14 Apr '09

This is a general apology to people who filed issues for my module - apparently I am not subscribed to my own module's issues list. This is pretty embarrassing...but anyway yes the the module is alive and I'll be working on the issue queue for the rest of the evening. I think it should be the default behaviour when creating a project on d.o to be auto-subscribed to the issue queue. Allister -- Muppet Show > Monty Python

3 2

Using multiple databases for drupal?
by Raja Sekharan 09 Apr '09

09 Apr '09

Hi, Is it possible to use multiple databases to power a drupal site without editing the drupal core? Raj

3 3

The router and links tables split - what caused it?
by robert crowther 09 Apr '09

09 Apr '09

Yes, I know they split (Drupal 6, was it?). I seem to remember reading somewhere in code, or near code, documentation that this was not simply for clarity or encapsulation, but performance. If I recall the comment alright, does anyone know what that performance issue was? Were people running, say, college sites, or auction sites, and finding they were bloating the links tables? A more general question - what was the scale of the bloating that caused a database to slow down? Answers to these questions may have a direct impact on the development of my module, http://drupal.org/project/taxonomy_treemenu In response to user discussion I'm considering a complete re-write of the links code. Rob

1 0

Menu Tree Access Control?
by Josh Koenig 03 Apr '09

03 Apr '09

Hey all, I'm about to launch into yet another custom module build, and I wanted to see if I'm missing the obvious and this thing already exists (or has been somewhat built). The use case is to allow access to nodes (node_access) based on their placement within a drupal menu tree. Seems obvious, but keyword searching through available modules didn't turn up anything that seemed to match. I did locate the "Menu Subtree" module which seems to provide some complimentary functionality in terms of restricting the areas of a menu tree into which new nodes can be placed: http://drupal.org/project/menu_stp For access, it points to fago's menu_per_role module, but this is about access to menu links, not node permissions. In the other node-access modules, I didn't find one that seeks to allow/deny access based on menu position. So that's what I'll begin working on. Implementation seems fairly straightforward based on hook_node_access_records() and hook_node_grants(). Assuming I'm right, the next fun thing would be looking at integrating this with menutrails.module so it can work for broader classes of nodes and not just those placed directly into the menu tree. Please let me know if I'm missing something obvious. :) cheers -josh -- -------------------- Josh Koenig, Partner & CTO http://www.chapterthree.com

9 11

Re: [development] remove or give priority to hook_node_grants
by Scott Reynolds 01 Apr '09

01 Apr '09

Was actually thinking about this the other day. I feel its a lil silly to have modules provide the priority for access control. I would really love to develop a drag and drop weight interface for the priority settings. Essentially, develop a node_access interface that assigns the priority for all node_access modules exposed currently. Wondering if theres any traction in that idea, and if so I can start hashing it out. > You no longer need to fiddle with priorities when overriding OG > records - > http://cvs.drupal.org/viewvc.py/drupal/contributions/modules/og/modules/og_… > . > > There is currently no hook for adjusting grants. > > On Tue, Mar 31, 2009 at 7:26 AM, Llu?s <enboig(a)gmail.com> wrote: > > I am developing a module to create "sub user types" inside OG. > > I have been able to modify hook_node_access_records using the > > "priority" so in certain cases I override OG access system. > > > > Now I need to "override" the hook_node_grants so In certain cases a > > user who should be able to see certain nodes don't see them; how can I > > achieve this? > > > > Thanks > > > > -- > > *La vida ?s com una taronja, que esperes a exprimir-la? > > *Si creus que l'educaci? ?s cara, prova la ignor?ncia. > > *La vida ?s com una moneda, la pots gastar en el que vulguis per? > > nom?s una vegada. > > *Abans d'imprimir aquest missatge, pensa en el medi ambient. > > > > -- Scott Reynolds Cell: 630-254-2474 http://www.scottreynolds.us

5 7

should I alter the sessions table?
by David Cohen 31 Mar '09

31 Mar '09

I have a special need, in the Drupal for Facebook modules, to honor a session key that comes from Facebook, instead of the key Drupal normally uses. So far the way I've approached this is to have Drupal use the passed-in session_key, so the sid column of the sessions table is that value. My problem is the the length of these session keys is sometimes longer than the 64 character limit of the sid column. According to Facebook these keys could be 128 characters or even longer. (http://forum.developers.facebook.com/viewtopic.php?id=21931) My first thought is to alter Drupal's sessions table. That is, in my module's .install file I would alter sessions so that the sid column is varchar(256) instead of varchar(64). Is there a performance drawback to this? Is it bad form to alter the table this way? My other options include finding some way to compress the session_key down to 64 chars. Or, create a table that maps longer session_keys to Drupal's sids. Is there any reason to go with one of these options as opposed to altering the table? Thanks in advance, -Dave

6 7

remove or give priority to hook_node_grants
by Lluís 31 Mar '09

31 Mar '09

I am developing a module to create "sub user types" inside OG. I have been able to modify hook_node_access_records using the "priority" so in certain cases I override OG access system. Now I need to "override" the hook_node_grants so In certain cases a user who should be able to see certain nodes don't see them; how can I achieve this? Thanks -- *La vida és com una taronja, que esperes a exprimir-la? *Si creus que l'educació és cara, prova la ignorància. *La vida és com una moneda, la pots gastar en el que vulguis però només una vegada. *Abans d'imprimir aquest missatge, pensa en el medi ambient.

2 2

Process and technology questionnaire
by Florian Thiel 31 Mar '09

31 Mar '09

Hello drupal developers, I'm in the process of writing my diploma thesis on the prevention of web application security vulnerabilities and I'd like to know a bit about your fine project from the developer's view. It would be great if you could take a couple of minutes and think about the questions below. The questions are mostly open-ended. Not all may apply to all developers, but I've chosen to not only address project leads. Elaborate and skip questions at will. Thank you very much in advance. I will provide you with the results of my thesis when it's done it you want. There will probably be some findings about what can be done to prevent security vulnerabilities, in particular XSS and SQL injections in open source web applications. Florian The questions: About technical aspects: - Are you using a web application framework? Which one? - Do you use explicit data modeling for all business objects in the application? - Do you have a specific layers for input/output validation/filtering? (If applicable) What does the input/output layer do (respectively)? How? Are you using external libraries? Why? Why not? (for HTML sanitation. object-relational mappers, database abstractions with prepared statements)? - (If applicable) What responsibilities do the input/output layers have, respectively? - How do you ensure that all input passed through validation/ filtering? Do you have an API that must be used? - Do you provide services to independently developed modules/ components? Is there a defined API? - Which other external libraries do you use? About the development process: - Is there public documentation about the responsibilities of the input/output layers? - Is there public documentation about *when* input/output validation/ filtering should happen? (Like: "output filtering must always happen in the method that renders the data") - Do you have automatic tests for the whole system? Bonus question: - Do you do manual code review?

3 2

Search
by Ámon Tamás 30 Mar '09

30 Mar '09

Hello, I like to add some search result from a different site to drupal. I like to show the search results mixed in the other and drupal site. I try to use mnogosearch to index the other site, but I can not insert the results to the drupal results. How can I make it? Ámon Tamás Sitefejlesztő és programozó -- 5NET Informatikai Kft. 1062 Budapest, Aradi utca 38. A 3/11 telefon: (1) 461-0205 | fax: (1) 461-0206 e-mail: amont(a)5net.hu | web: http://www.5net.hu

3 6