- Development - lists.drupal.org

backporting sec patches
by Ivan Sergio Borgonovo 30 Apr '08

30 Apr '08

Since I will need a longer life cycle... I know I'll have to support security patches for at least one more older release starting from 5.X. I know that patching your own 3, 4 web sites that lag behind is one thing, providing patches for a whole community is another thing. Providing security support for older modules it is even a larger task. Making proactive security assessment for older versions is absolutely out of my reach. As a minimum I could provide svn patches for security problems that have been discovered in newer versions and that apply to older versions. To make this effective I'd be informed in advance of the security problems that have been signaled to the sec team before they get public. I could start to take care of this in a *very* informal way. That means that I'll make aware people that they CAN'T relay on this service and see how it goes. Depending on how things go, it could be worth to learn something about the Drupal release mechanism, see if other people can help... etc... I don't know. What I think I can handle is: - getting informed in advance of DN and D(N-1) security problems in core - see if they need to be fixed in D(N-2) and publish a svn diff somewhere concurrently to the DN/D(N-1) public security announcement. - try my best to see if a module security problem can be fixed in older core and provide a patch What I know I won't be able to handle is assisting in fixing security problems in older modules or providing a full tar of an older patched version or manage DB update path. That in the hope that: - I could gain access to early warnings - someone will reach me in the task so that if one is busy/ill/etc... the other can still provide some support to the community, me included. If anyone is willing I could reach the sec team to get used to the way they operate now, make some enemies, call some names, help a bit fixing 5.X sec problems till 5.X will be obsoleted and evaluate in the light of my new experience if and how I can sustain what I proposed. -- Ivan Sergio Borgonovo http://www.webthatworks.it

2 2

Re: [development] RFC: drupal as a moving target
by Victor Kane 28 Apr '08

28 Apr '08

On Mon, Apr 28, 2008 at 11:19 AM, John VanDyk <jvandyk(a)iastate.edu> wrote: > At 1:29 PM +0200 4/28/08, Ivan Sergio Borgonovo wrote: > > > Drupal is now a mature project and people start to rely on it for > > projects that have a longer life span than the release process of > > Drupal. > > > > My understanding is that these kind of people are the target market for > Acquia's commercially supported Carbon distribution. > John's comment goes to the heart of the question. I think the security is admirable in Drupal. I want to remove that entirely from the discussion, because moving target or not, we have the best security we could possibly have. But I think the central policy point worth discussing is: in order to obtain a Drupal capable of actually being used in the real world for production sites, must one be forced to opt for commerical products / versions because the real cost is enormous? I use Ubuntu, the free, open source, off-the-shelf release, and I am not forced to pay for a "Red Hat" version to rely upon it. The question being raised is this: Is Drupal being driven to be such a fast moving target that real time-to-market costs can only be afforded by large shops? If the answer were yes, then we are forced to examine whether economic/financial/corporate interests are at work pushing it in that direction. Instead of sweeping the issue under the carpet. Victor Kane http://awebfactory.com.ar

8 9

Unsubscribe Out of office reply Fw: 来自lxdff@sina.com的自动回复
by Ivan Sergio Borgonovo 28 Apr '08

28 Apr '08

I'm posting this to the list since I couldn't see any admin contact in the ml headers. My daughter said it is an out of office reply. I think it is someone subscribed to the dev list. Could someone unsubscribe this address? thanks Begin forwarded message: Date: Tue, 29 Apr 2008 01:49:29 +0800 (CST) From: <lxdff(a)sina.com> To: <mail(a)webthatworks.it> Subject: 来自lxdff(a)sina.xn--com-0x2eo6q3udsr5e8bt 已经收到您发来的邮件，我会尽快给你回复！ -- Ivan Sergio Borgonovo http://www.webthatworks.it

2 2

Re: [development] RFC: drupal as a moving target
by Jens Moewes 28 Apr '08

28 Apr '08

exactly - but there are a bit more companies outside there which can provide corporate solutions, though ;-) . . . you don´t need carbon to provide service level agreements 2008/4/28 John VanDyk <jvandyk(a)iastate.edu>: > At 1:29 PM +0200 4/28/08, Ivan Sergio Borgonovo wrote: > > > Drupal is now a mature project and people start to rely on it for > > projects that have a longer life span than the release process of > > Drupal. > > > > My understanding is that these kind of people are the target market for > Acquia's commercially supported Carbon distribution. >

1 0

svn 1.5 supports -p
by Karoly Negyesi 28 Apr '08

28 Apr '08

Hello world, The first public release candidate of subversion 1.5.0 (RC4) is out there. There are several good things there but * 'svn diff -x' now takes '-p' extension option (issue #2995) cures a long standing nuisance for us. Thanks to the subversion team for adding this feature. Regards Karoly Negyesi

7 7

Seeking help internationalizing Views (and Panels and maybe other modules for D6)
by Earl Miles 27 Apr '08

27 Apr '08

Okay, so I have this idea for a module that will allow contrib modules to have their objects translated. I just did a scan of the modules available for Drupal 6.x involving translation, and #translateable seems close but not quite what I'm looking for, but it might be possible to turn it into what I'm looking for. Here's what I'm thinking: Many modules work with objects of some sort; particularly my modules. Because of the complexity of my objects, I've gone a long way to disengage them from the form. It is not possible to use duplicate, related objects to do translation, as is often done with nodes, because a view object does a LOT of stuff and it's very important not to have duplicates that try to do the same thing. This is also true of Panels. One thing I can do, is pretty easily identify any string I store as translateable. This is my proposed API: Views loads a view. Upon rendering, if the global $language->language is not the default language, and this module is enabled, Views will call MODULENAME_translate_object('views', 'view', $view->name) and do an inline replacement of all strings on the object itself. Views will also provide a 'translate' link which will lead to a URL provided by this module to translate that view. It may be possible to do some fapi integration with ajax translation but that's a 'bonus' feature. Could be cool, as long as it's not too hard to implement in my already crazy UI. /** * Return an array of translated strings, or NULL if there are no * translated strings for this object. * * @param $module * The name of the module that owns the object. * @param $type * The type of object being translated. Example: 'node', 'view', etc. * @param $id * The unique identifier of the object. May be a string! * @param $language * The language to translate to. If not specified, use the current * langauge from global $language. */ function MODULENAME_translate_object($module, $type, $id, $language) /** * Tell MODULENAME what objects your module has available for * translation. * * @return * An array of object identifiers. Each one must be unique. */ function hook_translateable_objects() { // example return array('view'); } /** * Tell MODULENAME what strings a particular object has available. * Because some objects may be dynamic, this is called for every * unique object id when translation is actively occurring. * * @param $type * The object identifier that corresponds to that used by * hook_translateable objects * @param $id * The unique object ID being translated. * * @return * An array of strings; the key is the string identifier, and * each value is an array that contains the following: * - title: The title of the field. * - description: The description of the field. * - value: The current value of the field. */ function hook_translateable_strings($type, $id) { // example return array('view'); } From the API perspective, that's about all I have to do. I have to do some extra work to make sure each component of the view provides the strings properly, but that's not hard. The translation interface will need to record state information on the strings, so that it can tell the user if the string has changed since the last time it was translated, making it easy to highlight what needs to be updated. It might be nice to provide a way to browse, but I think it's better to let the module provide that and require the module to provide a link to the translator; that's less work for this module and is likely to be much less clumsy. If someone implements this, I promise Views will use it and will use it very quickly. If a module like #translateable wants to use something like this, so much the better; I would really prefer it if an existing translation module can take on these features, so that we get more widespread usage. That said, my belief is that any module that Views uses for translation will see widespread use in the localization community, and thus, if well maintained, will become a de facto standard and we can convince other module developers to use it too. I'm willing to be flexible, too, but Views has special needs; you'll need to cater to it to get this working, and translating Views is a very important thing for a truly multi-lingual site. But also, with this API any of my modules will be easily translateable.

6 11

Arquitectura Drupal
by Pedro Enrique Castiñeiras Sanchez 24 Apr '08

24 Apr '08

Hola: Alguien me podría explicar si Drupal usa arquitectura Modelo Vista Controlador o Presentación Abstracción Control ? Agradecido de antemano. Saludos. _____________ NOD32 EMON 3048 (20080423) information _____________ This message was checked by NOD32 antivirus system http://www.eset.com

5 7

Very important testing update
by Karoly Negyesi 24 Apr '08

24 Apr '08

Hi, Yesterday we had quite a discussion on IRC which is summed up http://groups.drupal.org/node/10957 . Basically, mock functions were voted down as tests based on them takes too much developer resources to write and maintain. Instead, we are writing functional testing on an API level as described on http://drupal.org/node/30008 , for example: $this->assertEqual(l('Some page', 'node/34', array('class' => 'foobar')), '<a href="/node/34" class="foobar">some page</a>'); This test presumes and verifies somewhat that every function l calls is working correctly. Whether this still can be called unit testing or not is a pointless academic debate :) I expect that a number of tasks will be placed in the Drupal issue queue telling the community which tests are to be written. When this happens, I guess another email will land here and also I guess at various other places... I also plan to hold a 'testing hour' every single day starting probably next week. Stay tuned! Karoly Negyesi

1 0

Returning OR with hook_db_rewrite_sql
by Ron Parker 23 Apr '08

23 Apr '08

Hi. My module requires additional sql to return the correct content on taxonomy queries. I've used hook_db_rewrite_sql() to construct the sql I need, and it returns what I need. The problem is that my hook is AND'd with the taxonomy_access_db_rewrite_sql hook, and therefore voided. Example: In function taxonomy_term_page(): $result = db_query(db_rewrite_sql('SELECT t.tid, t.name FROM {term_data} t WHERE t.tid IN (%s)', 't', 'tid'), implode(',', $terms['tids'])); Once ran through the TAC hook and my hook, this query becomes: SELECT t.tid, t.name FROM term_data t WHERE (t.tid IN ('1')) AND (t.tid IN ('1','3')) AND ( t.tid IN (3)) TAC hook_db_rewrite_sql returns: (t.tid IN ('1')) My hook_db_rewrite_sql is returning: (t.tid IN ('1','3')) (correct) What I need is for my clause to be returned as OR rather than AND: SELECT t.tid, t.name FROM term_data t WHERE (t.tid IN ('1')) OR (t.tid IN ('1','3')) AND ( t.tid IN (3)) That would do the trick. Question is, how to do it? I've included my rewrite of the TAC db_rewrite_sql so you can see what I'm working with, but I'm hoping you might have some way for me to accomplish this short of hacking TAC. Thanks! -ron <?php /** * Implementation of hook_db_rewrite_sql() * * Used to include OGR roles in taxonomy/term * */ function og_user_roles_db_rewrite_sql($query, $table, $field) { if (!user_access('administer taxonomy') && ($field =='vid' || $field =='tid')) { global $user; $op = (arg(0) == 'node' && (arg(1) == 'add' || arg(2) == 'edit')) ? 'create' : 'list'; // let's cache static $taxonomy_access_sql_clause; $clause = array(); if (!isset($taxonomy_access_sql_clause)) { $taxonomy_access_sql_clause = array(); } if (!isset($taxonomy_access_sql_clause[$op][$field])) { if (isset($user) && is_array($user->roles)) { $rids = array_keys($user->roles); } else { $rids[] = 1; } if (isset($user)) { $query = db_query('SELECT ogr_id FROM {og_users_roles} where uid = %d', $user->uid); while($row = db_fetch_array($query)){ $ogr[] = $row['ogr_id']; } } else { $ogr[] = 0; } $sql = db_query("SELECT t.tid, d.vid, BIT_OR(t.grant_$op) AS grant_$op FROM {term_access} t INNER JOIN {term_data} d ON t.tid = d.tid LEFT OUTER JOIN {og_users_roles} ogr ON ogr.rid = t.rid WHERE (t.rid IN ('".implode("','",$rids)."') OR ogr.uid = ".$user->uid.") AND grant_$op = 1 GROUP BY t.tid, d.vid"); while ($result = db_fetch_object($sql)) { $tids[]= $result->tid; $vids[$result->vid]= $result->vid; } $clause[$op]['tid'] = isset($tids) ? implode("','",$tids) : ''; $clause[$op]['vid']= isset($vids) ? implode("','",$vids) : ''; $taxonomy_access_sql_clause = $clause; } else { $clause[$op][$field] = $taxonomy_access_sql_clause[$op][$field]; } $return['where'] = ($clause[$op][$field]) ? "$table.$field IN ('".$clause[$op][$field]."')" : "$table.$field IS NULL"; return $return; } else { return array(); } } ?> -- Ron Parker Software Creations http://www.scbbs.com Self-Administration Web Site http://saw.scbbs.com SDSS Subscription Mgmt Service http://sdss.scbbs.com Central Ave Dance Ensemble http://www.centralavedance.com R & B Salsa http://www.randbsalsa.com

1 0

Druplicon: Satiated
by Morbus Iff 23 Apr '08

23 Apr '08

<IslandUsurper> hey <Druplicon> hello <mozillamonks> botsnack <Druplicon> thanks, but no drink? I suppose I'll get by. <psynaptic> botsnack + drink <Druplicon> thanks psynaptic; can you pass the mayo? <psynaptic> mayo <mozillamonks> botsnack + drink + mayo <Druplicon> this is why I love #drupal <mozillamonks> lol <psynaptic> lol <MorbusIff> hahah

2 1