- Development - lists.drupal.org

Drupal 4.7.8, 5.3 released
by Heine Deelstra 17 Oct '07

17 Oct '07

Dear Drupal developers, We have just released Drupal 4.7.8 and 5.3. These are maintenance releases that fix problems reported using the bug tracking system and a number of security vulnerabilities. The release announcement can be found on http://drupal.org/drupal-5.3 The following security announcements were issued: http://drupal.org/node/184315 HTTP response splitting (4.7.x, 5.x) http://drupal.org/node/184316 Arbitrary code execution (5.x) http://drupal.org/node/184320 XSS via uploads (4.7.x, 5.x) http://drupal.org/node/184348 User deletion CSRF (5.x) http://drupal.org/node/184354 Comment status handling (4.7.x, 5.x) I want to thank the members of the security team and the branch maintainers for their hard work on these issues. Special thanks go to Jeff Eaton for a last minute review of the installer patch, Robert Douglass for release coordination, and die Zeit Online for sharing the results of a code audit with us. Gábor Hojtsy no doubt has something to say about 6 beta 2 later, but he also acted as the 4.7.8 branch maintainer substitute. Thanks. Regards, Heine Deelstra on behalf of the Drupal security team.

1 0

Re: [development] Taking over a module
by andy＠spiders-lair.com 17 Oct '07

17 Oct '07

Jeff, Thanks for pointing out #22572, I just updated it for your reference :) regards, -- Andy (AjK) ----- Original Message ---- From: Jeff Beeman <doogieb(a)gmail.com> To: development(a)drupal.org Sent: Wednesday, October 17, 2007 10:29:56 AM Subject: Re: [development] Taking over a module I knew I would find the answer immediately after sending the email :-p For anyone who is curious, it's under "Orphaned Projects" in the "Contributing to Development" Drupal handbook, at http://drupal.org/node/22572 // Jeff Beeman On 10/17/07, Jeff Beeman <doogieb(a)gmail.com> wrote: I would like to take over a module that's currently in contrib, in this case profile_pages. I've contacted the maintainer, PyromanFO, and he's happy to let me do so, but neither of us know what to do next. I did some searching, because I'm sure this process is documented somewhere, but I couldn't find anything. So, does anyone know how this is done? // Jeff Beeman

1 0

Re: [development] Taking over a module
by andy＠spiders-lair.com 17 Oct '07

17 Oct '07

> I would like to take over a module that's currently in contrib, in this case profile_pages. > I've contacted the maintainer, PyromanFO, and he's happy to let me do so, but neither > of us know what to do next. I did some searching, because I'm sure this process is > documented somewhere, but I couldn't find anything. So, does anyone know how this is done? see http://drupal.org/node/59

1 0

Taking over a module
by Jeff Beeman 17 Oct '07

17 Oct '07

I would like to take over a module that's currently in contrib, in this case profile_pages. I've contacted the maintainer, PyromanFO, and he's happy to let me do so, but neither of us know what to do next. I did some searching, because I'm sure this process is documented somewhere, but I couldn't find anything. So, does anyone know how this is done? // Jeff Beeman

1 1

code proposal: localization of currency, float, dates accordingly to language chosen
by Ivan Sergio Borgonovo 16 Oct '07

16 Oct '07

Hi, I'm in the process to really develop something that could be useful and I'd like it integrates well in i18n and core. Code is definitively trivial. Putting it in the right place with the placet of core and i18n developers may not be. General idea is - add some field in $conf['i18n_variables'] (core dev don't run away... more later) $conf['i18n_variables'] = array( 'date_format_short', 'date_format_medium', 'date_format_long', 'date_first_day', // 'number_format_dec_point', // 'number_format_thousands_sep', // 'currency_format', // 'currency_decimal', ); - push some more fields in admin/settings/date-time to provide currency and float (and maybe other format localisation). Page title is not appropriate but it looks as the best place. This may require some coordination with drupal core (why shouldn't a non multilingual website miss custom float format?[1]) Anyway if stuff comes into the way this variable may have their separate place in a new admin page. - write functions like: i18n_number_format($number,$decimal=0) { return number_format($number,$decimal, variable_get('numeric_format_dec_point','.'), variable_get('numeric_format_thousands_sep',',')); } i18n_currency_format($number, $symbol='') { $tmp=i18n_number_format(abs($number), variable_get('currency_decimal',2) ); if($number<0) { $sign="-"; } $tmp=str_replace('d',$tmp, variable_get('currency_format','sd c'): $tmp=str_replace('c',$simbol,$tmp); $tmp=str_replace('s',$sign,$tmp); return $tmp; ); } I know some countries don't group thousands but hundreds. Writing a more complex function shouldn't be a problem. Any other variations? I wouldn't put $symbol in i18n_variables since you may output different currencies in the same site/table... format_date is already there in core...[1] [1] style would suggest to cut the i18n prefix and put general helper function in the same place as format_date I used the *_format just to mimic the php functions but if they get into core format_* looks a natural choice. If this stuff has a chance to get into system.inc (or anywhere else into core) it will work even without the i18n module as it does with format_date. If i18n is installed, it will work better. Just reaching an agreement on functions names and signatures would help to add the features smoothly, step by step... format_date can be chosen on a per user base. This makes everything a bit more foggy... but I wouldn't see as mandatory to have the same feature for currency_format etc... What was the rationale of having format_date on a per user base? comments? suggestions? RTFM? RTSL? thanks -- Ivan Sergio Borgonovo http://www.webthatworks.it

1 0

Intercept menu calls
by Fernando Silva 15 Oct '07

15 Oct '07

Hi, I want to add some code to the menu system, in a way that I can add new menu items with a special format: 1. the path will allow to accept regular expressions 2. the items have the option to be saved or not inside the database This is something that has to do with issue http://drupal.org/node/120521 but that I'm trying to implement in D5 (I really need them). So, what I need? Just a way to intercept menu.inc inside functions, in a way that will allow me to execute my validations, menu builds and routing. Feasible? Any idea? Regards, Fernando

1 0

how to identify "root" modules?
by Gábor Hojtsy 15 Oct '07

15 Oct '07

Hey, A few years ago, most module projects hosted on drupal.org had one module in them, but nowadays more and more projects pop up with more modules in there. Examples include ubercart, ecommerce, views, ad.module and so on. Because module naming and placement guidelines are missing (as far as I know), we have various naming conventions. These projects have multiple modules, but their "root" module (ie. the module required by all or close to all submodules) is put in different places: - views/views.module (all other modules in the same folder (1)) - ad/ad.module (submodules in subfolders (2)) - ubercart/uc_cart/uc_cart.module (other modules up one folder (3)) - ecommerce/ec_common/ec_common.module (other modules up one folder (3)) These are at least three different methods to do it: - (1) all modules it he same folder - (2) root module in root folder, submodules in subfolders - (3) root module in some subfolder, other modules alike As the complexity of a package increases, module organization goes down this route. For a few files, the same directory works, when the root module only has a few files, it could still stay in the root directory, while submodules go to subfolders, and at the end the root module gets complex (images, include files, CSS files) and it goes down to it's own folder. While all modules might not go through this route, you get the idea. In any case, there is also no guarantee that the "root module" is named after the project. Why I investigated this is that I would need a stable solution to indentify these "root" modules in each project. We know this is system module in Drupal itself, but collecting a wired in list of "root" modules for each module suite seems like a bad idea. My use case is when we generate translation templates or export translations for Drupal 6, the system looks under the module directories 'translations' subfolder to import .po files automatically. So common strings (shared by the submodules) should be saved in one .po file under the module you would surely enable in all cases. So we need to export the common strings to the translations subdirectory of the "root" module. We need to know about the root module. The (1) organization also has a few unwanted side effects, but they are not as pressing as not knowing about the "root" module at all. Frankly I have no cool idea to go about this, but it should be done for sure. A new .info file key might be in order to mark base modules or required modules. Or we can go in and compute a dependency tree with the requirements and identify the root module ourselfs. This obviously only works if the dependencies are properly marked, and is definitely not how it works with Drupal itself, where modules just does not depend on system module. At the end *for my use case* the ideal world would look like (2) with the root module always named after the project name, but this is probably not going to happen, so let's think about other solutions. Gabor

8 12

forms without session
by Dave Cohen 15 Oct '07

15 Oct '07

I have a situation in which I can't preserve any session information for my users. No cookies are available. I'm able to present pages OK, but all form submissions fail. They fail because each form includes a token, and on submit the token is tested by drupal_valid_token(). The test always fails because the session_id() is never the same between when the form was generated and when submitted. Now, I notice that drupal_valid_token takes a parameter $skip_anonymous, which does almost what I want, it skips the test when the user is anonymous (why only for anonymous users, I have no idea). So it looks like someone had in mind a situation like mine. But as far as I can tell $skip_anonymous is never used. There's no way to configure FAPI to use it. So my questions are these: can anyone explain to me better what's going on here and what $skip_anonymous is for? And if I submit a patch that makes FAPI configurable to skip this check, is there any chance it would make it into the next 5.x and/or 6.x release? For the curious, my situation is a Facebook Application using Drupal for Facebook <http://drupal.org/project/fb>. When presenting a facebook "canvas page", the requests come from facebook, not the user's browser. And if the facebook user is not "logged in" to the app, there is no session information whatsoever available. I'm interested in other approaches to solve this problem. For example, if I could somehow alter all local urls to include a ?mysession=nnnnn, which stays the same through all links and form submits, that would be amazing. Any ideas are welcome. Thanks, -Dave

4 3

localization of currency, float, dates accordingly to language chosen
by Ivan Sergio Borgonovo 11 Oct '07

11 Oct '07

Is there a site-wide facility (core or module 5.2) to output formatted currency, float and dates accordingly to the language chosen by the user? Anything that could be integrated with i18n or localizer[1]? If I had to provide site-wide functions that just read user or session cfg for language and apply proper formatting where is the best place to put them? [1] any other choice? thx -- Ivan Sergio Borgonovo http://www.webthatworks.it

4 12

Core drupal.module moved to contrib site_network.module
by Gábor Hojtsy 10 Oct '07

10 Oct '07

Hello World, After discussions about the state of Drupal module, it turned out that: - drupal module does two things: phone home to a central server and distributed authentication - drupal.org does not collect any information submitted with drupal.module, so the phone home has no reason to live in Drupal itself - Drupal 6 is going to ship with OpenID which is much more secure, so there is no requirement to keep shipping Drupal module with Drupal (but it should be made available for users looking for an upgrade path) - Drupal module was misnamed, its namespace collides with built-in system level functions So after looking at all this, it was decided that Drupal module needs to go out of core. At http://drupal.org/node/178768 we discussed the future and suggested names. Because all features are kept for now, the new name is site_network. Anyone looking for this functionality will find the project at http://drupal.org/project/site_network from now. Andy Kirkham (aka AjK) volunteered to maintain the module and moved the existing drupal.module issues to the new project. All-in-all I hope this improves the privacy (no useless phone-home feature to explain) and security (no password tunneling) of Drupal 6. Gabor

16 26