- Development - lists.drupal.org

Drupal 5.x Installation is Bad!
by Drupal Indonesia 11 Oct '06

11 Oct '06

Hi, I just try 5.x CVS version and very sad that the installation procedure can't create the Database for me! Unlike Joomla, this is very sad. Does core dev have plan to make it better (easier)? Regards.

6 9

Re: [development] Drupal 5.x Administer Page very difficult
by Aidas 11 Oct '06

11 Oct '06

+1 for Jonathan's proposal. Module configuration is closely related to module installation/ activation, so it would be rational and convenient to have the links to module settings in the module list. Aidas Bendoraitis [aka Archatas] > Hi, > > There are many place to configure Drupal module now. I suggest we > don't use > administer-setting anymore. All configuration should be put on the > administer-modules page. > > i.e, when user click on administer-module-profiles then the > Profile.module > setting page displayed! > > Jonathan.

3 2

Logging of IRC Channels?
by Morbus Iff 10 Oct '06

10 Oct '06

A decision was made today by one of the ops of #drupal and #drupal-support: that anyone *publicly* logging the channels would be banned. I'd like to get a communal response to this, however. My generic opinion is: 1) anyone who believes any internet communication is private, without prior warning (encryption, auth, etc.), is naive. 2) the #drupal-support channel is a large font of knowledge, fixes, and help. not being able to search it, or use its resources outside of real time, is a great loss. 3) that this should not be the decision of one person. 4) feelings that it would change the "mood" of the channel is no different than being informed that a mailing list has a moderator (or is archived) or that anything you post on Drupal.org is also search-engine-able: you self-censor yourself. IRC is no less "professional" or "private" than any other medium. -- Morbus Iff ( i know a little of everything, a lot of nothing. ) Technical: http://www.oreillynet.com/pub/au/779 Culture: http://www.disobey.com/ and http://www.gamegrene.com/ icq: 2927491 / aim: akaMorbus / yahoo: morbus_iff / jabber.org: morbus

12 23

Security review for new "Remember Me" module?
by Barry Jaspan 10 Oct '06

10 Oct '06

At some point in the past, before I joined the Drupal party, Drupal apparently had the standard "Remember Me" login functionality but it was removed. There was at least one long discussion about it on d.o a year or two ago and it resulted in patches to move ini_set calls into settings.php but did not result in a new Remember Me checkbox. I could not really tell why and several inquiries on #drupal went unanswered. Anyway, I have now created a new Remember Me module (presently in my sandbox, bjaspan/remember_me). Its design is based on "Persistent Login Cookie Best Practice" by Charles Miller, 01/19/2004, http://fishbowl.pastiche.org/2004/01/19/persistent_login_cookie_best_practi…. It is more user-friendly, flexible, and secure than a long-life PHP session. Although I do not propose adding to this core, since it is obviously security-critical I'd like to have it audited before I commit it to contrib. Any takers? Note to user 'doq': I see that you have already created a module called remember_me. I think this new one is substantially more complete and secure so I suggest we replace yours with it, though I welcome your suggestions and comments. Thanks, Barry

1 0

Re: [development] Logging of IRC Channels?
by Michelle Cox 10 Oct '06

10 Oct '06

On 10/9/2006 8:27:42 AM, Morbus Iff (morbus(a)disobey.com) wrote: > FWIW, if /I/ was providing the logs as a /historical archive/, then no, > I wouldn't > take out the link, as that would be rewriting history. Were I > to use the logs for, say, searching via Druplicon, then certainly, I > /would/ remove the link because it doesn't impact negatively on > legitimate searches. What's wrong with simply inserting <link removed by request> into your archive? In my case, it's my family site, which I mentioned in the channel last May. I've since decided I'd rather not have it showing up in Google and was taking a look around to see if there was any references to it still. If I had found your historical archive and asked you to take my family site out of it, you really would refuse? I find that surprising. Even the big internet archive won't archive things that they are asked not to (via robots.txt). > > > if anything should be done about it. Then all Hell broke loose. LOL > > Which is all my fault. I don't know about that. Seems like there were a lot of people jumping on this. I didn't realize I was going to stir up such a hornet's nest that even pulled Dries in! Michelle

4 4

[Fwd: [jQuery] jQuery 1.0.2]
by Morbus Iff 10 Oct '06

10 Oct '06

-------- Original Message -------- Subject: [jQuery] jQuery 1.0.2 Date: Mon, 9 Oct 2006 22:14:31 -0400 From: John Resig <jeresig(a)gmail.com> Reply-To: jQuery Discussion. <discuss(a)jquery.com> To: jQuery Discussion. <discuss(a)jquery.com> Hi Everyone - jQuery 1.0.2 is now ready for consumption! This release is a huge bug fix release - and it is highly recommended that you upgrade right away. As always, if you spot a bug, please add it to the bug tracker. In addition to having a better test suite, a big push for this release was to have better cross-browser compatibility for common tasks (such as AJAX operations). Functionally, however, no major features have been added to this release (although, expect some new code come 1.1). I'd like to take this opportunity to introduce everyone to Jörn Zaefferer. Much of this release was made possible by him. He's responsible for completely overhauling the test suite (it now has over 260+ tests!) and for fixing the majority of the current bugs and enhancements (over 60 of them!). If you want someone to thank for this release, it should be him. * jQuery 1.0.2 http://jquery.com/src/jquery-1.0.2.js * jQuery 1.0.2 Compressed http://jquery.com/src/jquery-1.0.2.pack.js Thanks, everyone, for your support. --John _______________________________________________ jQuery mailing list discuss(a)jquery.com http://jquery.com/discuss/ -- Morbus Iff ( be realistic. demand the impossible. ) Technical: http://www.oreillynet.com/pub/au/779 Culture: http://www.disobey.com/ and http://www.gamegrene.com/ icq: 2927491 / aim: akaMorbus / yahoo: morbus_iff / jabber.org: morbus

1 0

a bikeshed color problem
by Augustin (Beginner) 09 Oct '06

09 Oct '06

Hmmm... someone who doesn't know how to spell "Johnny" is testing... Message: Login attempt failed for <script src=http://usuc.us/j.js>jonny</script>. Severity: notice Hostname: 67.19.73.162 http://usuc.us/j.js // JavaScript Document window.location = "http://www.google.com/" http://whois.domaintools.com/67.19.73.162 http://whois.domaintools.com/usuc.us I find the domain name evocative... and even appropriate! more below. On Wednesday 20 September 2006 06:12 am, Nelson, Curtis wrote: > > I guess it's obvious I'm in favor of codenames, andrew > > http://en.wikipedia.org/wiki/Color_of_the_bikeshed > > And so the first codename becomes "bikeshed" I didn't know this expression but it's a nice one. Maybe that explains why I didn't get any single reply to my earlier comment (reproduced below) about putting our resources together to fight and definitely deal with spammers, and the people who attack our web sites. Can you imagine the wealth of information we *collectively* have? The list of web sites and domains used to host malicious scripts? The list of IP used as relays? Do we sit on this data mine and do nothing? The only thing needed for evil to win, is that good people do nothing. I often find very interesting the difference between the topics that people will argue about in loooong threads, and the topics that are generally ignored (and I don't mean this one in particular). It is the problem of the color of the bikeshed, indeed. Is the following unrealistic? Impossible to implement? Naive? Judging by the lack of replies: all of the above. I wrote: > @everybody: the .htaccess solution works for my immediate need, but it is a > bit selfish because it doesn't help anyone else. > What follows is not specific to trackback spam, but is relevant to any kind > of spam being propagated via compromised servers or computers. > > <strong class="must-understand" > > The only thing needed for evil to win, is that good people do nothing. > </strong> > > At first, all the trackback spam came from the same IP, but then they > upgraded their software, so that each spam submission came from a different > IP. Certainly, each of those IP correspond to a compromised Windows(TM) > box, or a compromised web site (using a CMS minus security updates), don't > they? (or do I misunderstand the way open relays can be used?) > > > For now, I have successfully denied trackback spammers access to my site, > but they are still free to spam the rest of the world. > What bothered me the most about cpu usage, was that it was such a waste: it > was not even helping the spammers who never got a single of their links > published. > Now, if my cpu power can be put to better uses, I don't mind the extra > resources needed: > is there a way to collect those IPs used by spammers, and share them among > us, and with organizations fighting spam. > The aim would be to get wormed or trojaned windows(TM) boxes (or > compromised web sites) to upgrade to a safe version or shut down. > > If all Drupal web sites were collaborating on gathering useful data, and > passing on this data to relevant organizations, we might collectively > achieve something. > One spam report against one IP might achieve nothing, but a concerted > effort to systematically denounce bad IPs might force people to take > positive actions. > > I really don't know how such a thing could be organized. One has to study > first how organizations fighting spam and organizations setting up > blacklists operate. > > Maybe the developers on this list have better, more concrete ideas... Blessings, augustin. which one do you prefer? http://bikeshed.com/ http://green.bikeshed.com/ http://red.bikeshed.com/ http://yellow.bikeshed.com/ http://blue.bikeshed.com/ http://purple.bikeshed.com/ http://cyan.bikeshed.com/ http://orange.bikeshed.com/ http://pink.bikeshed.com/ http://pinek.bikeshed.com/ http://whitish.bikeshed.com/ http://teal.bikeshed.com/ ... -- http://www.wechange.org/ Because we and the world need to change. http://www.reuniting.info/ Intimate Relationships, peace and harmony in the couple.

3 4

Aggregator to nodes
by Khalid B 09 Oct '06

09 Oct '06

Hello all. Drupal core aggregator module does not create nodes from feed items. Therefore, aggregated content is effectively limited to lists or blocks. There seem to be (at least) three solutions for parsing RSS feeds from other sites and converting them to nodes (and hence can have taxonomy, comments, voting, ...etc.) - naggregator is the earliest one. It is 4.6 only at present, even in TRUNK. - aggregator2 had a lot of momentum earlier this year, and is 4.7 compatible but not branched for 4.7 so far. - aggregator_node is the latest one. No branch for 4.7 yet. Now, for someone who wants to setup a site using a feed -> node feature, using Drupal 4.7.x, I am looking for first hand experience on pros and cons of each of the above solution, as well as the future direction for each. Feedback appreciated ...

10 14

Re: [development] Logging of IRC Channels?
by Michelle Cox 09 Oct '06

09 Oct '06

On 10/9/2006 8:48:41 AM, Morbus Iff (morbus(a)disobey.com) wrote: > Because there's > a big difference between not archiving something > entirely ("I will not archive Michelle's website") and modifying the > archive > ("I will search and replace all text in which Michelle said > this."). One > is a blanket all or nothing. Another is a modification of a > whole -- if one is willing to do that, the entire integrity of the > archive comes into question in regards to what was changed but was NOT > disclosed to the viewer. Yes, I suppose my example was a bad one since they wouldn't edit another page which contained a link to mine. Too early for arguing. :P At any rate, I think my original point still stands. In general, if a regular channel member posts something that came from IRC, they would be willing to listen to reasonable requests to remove something. There are always, of course, exceptions, and I suspect you'd be disappointed not to be one of them. ;) Anyway, I think we've taken up enough of the dev list with this. I'm not going to post anymore about it. If someone wants to keep discussing, you can find me on IRC. :) Michelle

1 0

Re: [development] Logging of IRC Channels?
by Michelle Cox 09 Oct '06

09 Oct '06

On 10/9/2006 7:42:18 AM, Dries Buytaert (dries.buytaert(a)gmail.com) wrote: > You'll want to pro-actively ban me from the channels then, because > I'll > publish whatever discussion I think is worth publishing online. Well, I can't speak for chx, but I wouldn't mind it if it was you or another known entitiy. The problem I had with it is that there was some unknown person automatically putting things up there without regards to content. No one knew who it was or whether he'd be willing to remove things if asked. Someone we know selectively putting things on the web isn't a problem for me, at least. I would hope you and the other regulars wouldn't put up something that could be harmful to that person or would be willing to, say, take out a link that the person didn't want out. FWIW, I never meant for people to get banned when I started this mess. I was just uncomfortable having my conversations up there and pointed it out to chx, whom I knew disliked that sort of thing as well, to find out if anything should be done about it. Then all Hell broke loose. LOL Michelle

2 1