- Development - lists.drupal.org

Re: development Digest, Vol 39, Issue 45
by David K Norman 14 Mar '06

14 Mar '06

That's not fair. The files have to be available first, then posting to development@ is quick, then security@. It's not like it was days apart. development-request(a)drupal.org wrote: > Date: Tue, 14 Mar 2006 00:24:40 +0100 > From: Alejandro Exojo <suy(a)kurly.org> > Subject: [development] Re: [support] Drupal 4.6.6/4.5.8 security > releases > > El Martes, 14 de Marzo de 2006 01:03, Gerhard Killesreiter escribió: >> are now available. See drupal.org/node/53524 > > I'm really very disappointed about how the Drupal project is handling releases > and security advisories. IMHO, it's the worst "big" free software project in > this regard. >

2 1

Re: [development] Re: [support] Drupal 4.6.6/4.5.8 security releases
by Kobus Myburgh 14 Mar '06

14 Mar '06

> The security team can certainly need some help. One would think that the > people who as of recently are Drupal's saviours when it comes to > enterprise solutions would be eager to spend some ressources on this. Gerhard, I am not an expert, so I can't do the actual bug finding and the fixing thereof, but I *can* do the legwork. If there is something I can do, please let me know. Kobus

1 0

Re: [development] Re: [support] Drupal 4.6.6/4.5.8 security releases
by Alex Markley 14 Mar '06

14 Mar '06

Hey all. I've noticed some negative noise on the list here, and I thought I'd mention that the upgrade to 4.6.6 went smooth as silk for me. http://MalexMedia.Net/ I've got a bajillion custom modules and things, and the only thing that broke was (unsurprisingly) my custom patches to node.module, which were merged in very easily. All in all, I maybe spent 30 minutes, and I feel very safe knowing that my Drupal remains secure. :-D Thanks for your hard work! ttyl -- Alex (Malex) Markley http://MalexMedia.Net/ "Son, you come down from there right this minute! You're too little to play with wild animals!" Useless Info: Listening to: mAleX - Project2 - Behold System kernel: Linux 2.6.14-1.1653_FC4 Reliability: 23:00:01 up 33 days, 12:11, 5 users, load average: 0.98, 0.47, 0.30

1 0

Can someone confirm -- Minimum MySQL Privileges?
by Angie Byron 14 Mar '06

14 Mar '06

I was glancing through the install instructions today, and noticed that we tell people to GRANT ALL privileges which seems a bit... excessive. I searched through core and came up with the following list of required privileges: Data ==== SELECT INSERT UPDATE DELETE Structure ========= CREATE ALTER INDEX DROP CREATE TEMPORARY Admin ===== LOCK TABLES Could someone take a look and let me know... Am I missing any? Are there things here that shouldn't be? -Angie P.S. I know we're only supposed to work on 4.7 RC stuff, but this is for some training stuff I'm doing to hopefully get more developers to work on Drupal, including testing and reviewing patches to help the 4.7 RC! ;)

8 15

4.6.6 tarball missing theme engines
by Laura Scott 14 Mar '06

14 Mar '06

The /themes/engines folder is there, so for most people it will replace their existing themes/engines folder ... except that there is nothing in the new folder except an empty phptemplate folder. I posted this in the forums, but thought I'd mention it here, especially as xtemplate is one of the patched upgrades. Laura Laura Scott President laura(a)pingv.com pingVision, LLC 4450 Arapahoe Ave, Suite 100 Boulder, CO 80303 www.pingv.com 303.415.2559

1 1

RE: [development] Re: [support] Drupal 4.6.6/4.5.8 security releases
by Steven Peck 14 Mar '06

14 Mar '06

I got both at the same time because I checked email and Drupal.org about the same time. Simplenews sends email for x time per cron run. The Security list is sent via Simplenews to allow for integration. In reality, there is no secure method to ensure that 'legitamte' site admins get notifications before hackers do. It's a shame you are disappointed. Please coordinate OFF LIST with the security team for a model you think would be more better faster stronger. ________________________________ From: development-bounces(a)drupal.org on behalf of Darrel O'Pry Sent: Mon 3/13/2006 3:45 PM To: development(a)drupal.org Subject: Re: [development] Re: [support] Drupal 4.6.6/4.5.8 security releases On Tue, 2006-03-14 at 00:24 +0100, Alejandro Exojo wrote: > El Martes, 14 de Marzo de 2006 01:03, Gerhard Killesreiter escribió: > > are now available. See drupal.org/node/53524 > > It's a problem only here, or the list where the security advisories are > supposed to be sent, is completely useless? > > By pure luck, I've checked my news aggregator, and I've found the new release > which fixes 4 security bugs, but I haven't received _anything_ from the > mailing list yet (which I check a lot more often). > > I'm really very disappointed about how the Drupal project is handling releases > and security advisories. IMHO, it's the worst "big" free software project in > this regard. > Wow, that whole lag between notifiction channels... I can see the script kiddies firing up their bots trying to exploit sites between when the notifications are sent on the dev list, posted to drupal.org, and sent to the security list... .darrel. --I think I'm in a slightly sarcastic mood today.

1 0

Re: New Commenting System at DailyKos
by Raven Brooks 13 Mar '06

13 Mar '06

As promised here is the forum thread for off-list discussion: http://drupal.org/node/53786 Raven Brooks President and Chair, BuyBlue.org Http://www.buyblue.org Vote with your wallet!

2 1

New Commenting System at DailyKos
by Raven Brooks 13 Mar '06

13 Mar '06

I know we are in 4.7 lockdown mode but it is worth everyone checking out the new commenting system that just got put in place at DailyKos. They aren't using Drupal of course but it may spur some nifty ideas to improve comments in 4.8 and beyond. The diary describing all of it is here: http://www.dailykos.com/story/2006/3/13/25058/9474 Even without the nifty Ajax stuff it would be nice to see some of that stuff like comment ratings, auto-hide troll comments, etc make it into the core comments module. I'll crosspost in the forums shortly for further discussion but the site seems to be down right now. Raven Brooks President and Chair, BuyBlue.org Http://www.buyblue.org Vote with your wallet!

2 1

A little pgsql help
by Dan Ziemecki 13 Mar '06

13 Mar '06

Can I get one of you postgre aficionados to translate this SQL statement into whatever works on postgre for me? DROP TABLE IF EXISTS subscriptions_holding; CREATE TABLE subscriptions_holding ( rid int(11) NOT NULL auto_increment COMMENT 'Unique row ID', content blob NOT NULL COMMENT 'The node array', type tinytext NOT NULL COMMENT 'New node or comment', op tinytext NOT NULL COMMENT 'The operation on the node', uid int(11) NOT NULL default '0' COMMENT 'The person performing the operation', PRIMARY KEY ('rid') ); I'm implementing cron initiated mailings for the Subscriptions module. Thanks, -- Dan Ziemecki

4 9

Re: [bug] autocomplete broken by Prototype library
by Nick Lewis 13 Mar '06

13 Mar '06

Just wanted to throw my support in for yched's fix. I think its essential that Drupal fully support popular libraries like prototype. As is we've lost a lot of brilliant minds to frameworks like rails. From the standpoint of bringing in more experienced developers to work on drupal, offering full support of libraries like phototype is a high priority. Thanks for figuring this out wched... I hadn't realized the problem had been prototype and autocomplete bumping heads. -Nick Lewis http://nicklewis.smartcampaigns.com yched wrote: > Issue status update for http://drupal.org/node/47557 > Post a follow up: http://drupal.org/project/comments/add/47557 > > Project: Drupal > Version: cvs > Component: forms system > Category: bug reports > Priority: normal > Assigned to: Anonymous > Reported by: yched > Updated by: yched > Status: patch (code needs review) > > Well, the issue I'm dealing with did affect Firefox (1.5/win) - I didn't > check for IE or other browsers. > > > The patch has been tested to work on both FF and IE6. > > > As it is outlined in the posts you link to, we're not talking about a > drupal bug, but rather about allowing the use of a very useful yet > quite intrusive external lib. > > I'm aware that a 'won't fix' would be tempting for core devs here, Then > again, the workaround is so simple... > > > > > yched > > > > Previous comments: > ------------------------------------------------------------------------ > > Thu, 02 Feb 2006 11:40:05 +0000 : yched > > Example : go to a node submission / edition form and type a new author > for the node. > > > According to the FireBug extension for Firefox, an error is raised on > line 259 of autocomplete.js : > > > matches[i].split is not a function > (seen on Firefox 1.5, btw. Untested on other browsers) > > > > > ------------------------------------------------------------------------ > > Thu, 02 Feb 2006 12:34:44 +0000 : jjeff > > Interesting. I will look into this. > > > -Jeff > > > > > ------------------------------------------------------------------------ > > Sun, 12 Mar 2006 20:00:16 +0000 : yched > > Changing title and project : In fact, the bug is not related to the s/p > ajax module itself, but to the presence of the Prototype library > itself. > > > I'll try to use the JS debugger to see what's happening really... > > > > > ------------------------------------------------------------------------ > > Sun, 12 Mar 2006 21:39:59 +0000 : yched > > Attachment: http://drupal.org/files/issues/autocomplete.js_2.patch > (1010 bytes) > > Okay, here's what I (sort of) understood : > > > Prototype adds a lot of methods (iterators, helper functions...) to a > lot of objects (including arrays) > > > A side effect is that when you walk an array with a loop like : > for (i in myArray) { > aalert(i +' : '+ myArray[i]); > } > you first catch the "regular' elements of the array, and then you catch > these Prototype-added methods. > > > So the (simplified) code in autocomplete.js : > for (i in matches) { > matches[i] = matches[i].split('|'); > } > raises an error when it calls the (non existing) 'split' method of > these extra elements (which are functions and not strings) > > > I just replaced > for (i in matches) { > with > for (i=0; i<matches.length; i++) { > > > I'm no JS expert, so there might be more elegant workarounds, but this > does the trick. > > > (It seems to me that no other drupal js code is impacted, but that > might need double-checking) > > > > > ------------------------------------------------------------------------ > > Sun, 12 Mar 2006 21:42:46 +0000 : yched > > forgot to update the status > > > > > ------------------------------------------------------------------------ > > Sun, 12 Mar 2006 22:20:25 +0000 : markus_petrux > > I was also a "victim" of prototype.js' method of overriding javascript > core objects (Array in this case) with one of my phpBB MODs: > http://forums.phpmix.org/viewtopic.php?t=1014 > > > As far as we saw in that topic, the problem seems to affect MSIE only > (a browser bug maybe). > > > I do not use prototype.js myself, but I believe yched's fix would > workaround the problem. > > > > >

1 0