- Development - lists.drupal.org

CVS Account Activation
by Ahmed Al-Obaidy 11 Feb '06

11 Feb '06

Hi guys, A few days before, I wrote the session timeout module and I had requested an cvs account to commit my module to the cvs, but the request did not get approved yet. So, could anyone please tell me how can I get it active ASAP. Thank you,

2 1

Possible DDoS attack on Drupal user creation
by Syscrusher 10 Feb '06

10 Feb '06

Good morning! I'm sorry if this is the wrong venue for this, but I am not sure where else to post it. As of this morning, I have good reason to suspect that one of my Drupal sites is the victim of a zombie-based DDoS attack, and I felt I should warn the Drupal development community that a new Drupal-specific bot may be out there in the wild. The site allows anyone to create a user account, with no approval needed but of course with no special privileges (all it really gains them is the ability to queue comments for approval, subscribe to node comments, and to customize their timezone). What happened is that last night a large number of new user accounts were all created with garbage-looking and undeliverable Yahoo! addresses as the email target, e.g., sdfuhgfdhghu(a)yahoo.com. My site is a rather narrowly- focused site related to historical reenactment, and we typically average only 1 or 2 new users per day, and there have been 57 since midnight last night. That's not a huge number, but it's *way* outside our normal statistical range. I initially thought this might be one script kiddie with a Perl bot, but I checked my logs, and there were 57 requests since midnight spread over 21 different IPs. Only one of the IP addresses has a valid reverse DNS, and it points to a dialup pool. In the Apache logs, all of the browser ID strings are identical: "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)" which suggests either a bot emulating this browser, or a coordinated attack by a couple dozen individuals. I consider the latter to be unlikely, as the site is neither politically controversial nor commercial in nature, so I doubt anyone would have enough motive to work hard enough to do an attack by manual means. I post this message here for three reasons: 1. I wanted to warn others that if there is a bot to attack my site, they may attack other Drupal sites in the near future, and 2. I wanted to see if anyone has a suggestion of a module -- including one that I might create -- that could block bogus user account requests like this but not legitimate ones. Will the "Captcha" module do what I need? 3. I wanted to find out if anyone else has seen similar behavior, to see if this is part of a larger pattern that may need to be addressed in user.module. For example, if this is commonplace, should "Captcha" become part of core? The attacks aren't doing any real harm -- my server can easily cope with the load, and I'll eventually just purge the accounts that are never activated. They're a nuisance, but I still want to make this go away if I can. I'll be glad to share more details upon request -- my site is not business- related, so I have no reason to conceal logs or other pertinent data that could help the Drupal development community guard against things like this. Scott -- ------------------------------------------------------------------------------- Syscrusher (Scott Courtney) Drupal page: http://drupal.org/user/9184 syscrusher at 4th dot com Home page: http://4th.com/

4 6

including file-based caching in 4.7
by Jeremy Andrews 10 Feb '06

10 Feb '06

Hello, Following the recent Drupal roadmap talks in Vancouver, I'd like to propose the inclusion of file-based caching in Drupal 4.7. By making it possible to move cached data from the database into the filesystem, the patch offers increased reliability and performance. Find a patch against CVS HEAD with more details as to how it works and some benchmarking results here: http://drupal.org/node/45414 A quick summary from my most recent benchmarking, under a heavy siege load: Database cache: 1,000 pages in 34.1 seconds. That's an average of 29.38 pages per second, with each page loading in 34.12 ms. Under this load, 7.7% of the page requests failed. File cache: 1,000 pages in 28.7 seconds. That's an average of 36.1 pages per second, with each page loading in 28.54 ms. 0 page requests failed. File cache with FastPath: 1,000 pages in 5.23 seconds. That's an average of 191.12 pages per second, with each page loading in 5.233 ms. 0 page requests failed. (FastPath is a new bootstrap phase that allows the display of file-cached pages for anonymous users without bootstraping the database or sessions) Please feel free to test out the patch, running your own benchmarks and making any suggestions. Discussion as to whether or not this should be included in 4.7 is also encouraged. Thanks, -Jeremy

2 1

Re: [development] Form field maxlengths vs. database field sizes
by Pat Collins 09 Feb '06

09 Feb '06

On Thu, 9 Feb 2006 11:23:07 -0800, Adrian Rossouw <adrian(a)bryght.com> wrote : > > On 08 Feb 2006, at 8:28 PM, Chris Johnson wrote: > > It does not presently, but Drupal could know the field sizes in the > > database tables. However, is that worth doing? (I'm presently > > developing a database abstraction layer for my employer where the > > db layer figures out the metadata, like field sizes, on the fly so > > that the applications need not know anything at all about it.) > > I want to do this for 4.8. > > it simplifies the install files (which are in core now), and allows > us to possibly automate some of the _update_x function creation. > > essentially > db_create_table('name', array('field' => 'type', 'field' => 'type'); > etc. > > keeping track of all the columns in the database is important for > stuff like views and relationships too. > It would also make supporting other database engines easier. Imagine optimized sql for each db. Wouldn't that be great. Pat

1 0

Drupal Con report back: Drupal usability issues
by Kieran Lal 09 Feb '06

09 Feb '06

1) Review the administration module code-Led by Earl Miles http:// drupal.org/node/48578 2) Improve taxonomy documentation, order and organize content - Led by Kieran Lal http://drupal.org/node/48581 3) Card sort the projects into categories, patch the project module for project submissions.-Angela Byron http://drupal.org/node/48575 4) Drupal terminology-review other CMS to improve the glossary- Kim Werker http://drupal.org/node/48576 5) Blocks for Roles- Djun Kim http://drupal.org/node/12988 6) Compare Drupal files, app casting with the Drupal module-Nedjo Rogers http://drupal.org/node/48580-serverside, http://drupal.org/ node/48582 client side 7) Drupal navigation: Global, local, contextual, and situation navigation -Trae McCombs http://drupal.org/node/48574 Cheers, Kieran

1 0

Songbird website running Drupal
by Anders 09 Feb '06

09 Feb '06

Looks like the slashdotted website of Songbird (http://www.songbirdnest.com/) the new open-source media player based on Firefox, is running Drupal. They've put up a new server at http://69.90.210.150/ and it's definitely Drupal under the hood. Most visiters ever on the same time on a Drupal site (boingboing, digg, slashdot...)? Might be interesting if they could shared some statistics with the community... /Anders

1 0

Re: [support] Node Form Mod . . .
by Jason Flatt 09 Feb '06

09 Feb '06

I'm moving this to the dev list as suggested by Karthik. On Wednesday 08 February 2006 11:45 am, Karthik wrote: > > Is it possible to override the default form when creating or editing a > > node? I want to change the name of the Title field for a specific node > > type, not all node types. It looks like, based on node.module's > > node_form function that it is not possible, and in scanning > > http://drupaldocs.org, nothing is jumping out at me. I am hoping, > > however, that I am overlooking something. > > I believe this is what you are after: > http://drupaldocs.org/api/head/function/hook_form_alter That does look like it might do for me what I want. However, it is a 4.7 function, and I'm doing this work in 4.6. I probably should have mentioned that, since I suspect your ESP, like mine, is on the fritz. I did look for it or something similar in the 4.6 apis, but found nothing that looked like it. > You might want to ask these questions on the dev list :) > > -K -- Jason Flatt http://www.oadae.net/ Father of Six: http://www.flattfamily.com/ (Joseph, 13; Cramer, 11; Travis, 9; Angela; Harry, 5; and William, 12:04 am, 12-29-2005) Linux User: http://www.sourcemage.org/ Drupal Fanatic: http://drupal.org/

1 0

RE: [development] Issue status
by Steven Peck 08 Feb '06

08 Feb '06

It's automated.... after being fixed for a few days, it is closed. This lets poeple find them and see what happened while it's fresh and get it out of the way when it's closed. ________________________________ From: development-bounces(a)drupal.org on behalf of Karthik Sent: Fri 1/20/2006 12:39 AM To: development(a)drupal.org Subject: [development] Issue status I've noticed that a number of issues are being changed from "fixed" status to "closed" status by (an) Anonymous User(s). E.g. http://drupal.org/node/43498 Is this automated? Recommended procedure? or something else? Cheers -K

3 2

Re: [development] Session timeout module
by Kobus Myburgh 07 Feb '06

07 Feb '06

Hi, Ahmad, My coding skills aren't that good, so I won't add anything ;-) But I will wait for your addition of my suggestion before implementing it :-) Regards, Kobus >>> ahmad(a)hitech-iraq.com 2/7/2006 2:51:17 PM >>> Hi Kobus, Thanks for your feedback, I welcome any suggestions about the module. I agree with you, adding such a counterdown clock is easy to implement and yet very useful... I hope i would find time for it later this week. meanwhile, you are welcomed to add anything you want as far as you share it with us ;).. Ahmad Kobus Myburgh <ITBJDM(a)puknet.puk.ac.za> wrote: Hi, Ahmad, This sounds like a great module - I've needed that on a previous site that I created. Would be good if you can add a countdown timer to warn the user if it will time-out before it actually times out. If I am, for example, on the site, and the phone rings, and currently busy filling out a huge form, I'd be mightily peeved off if the thing times out without warning. I personally would be able to use a module like that (using JavaScript for the countdown timer), that is why I make the suggestion. I figure that: 1. If it is configurable 2. It is safe nobody would object to the JS code in the module, and I think it would be simple to implement, perhaps just reset the session time-out counter every time activity is recorded on the site? This would be a GREAT addition for someone who uses the e-Commerce module. What do you think? Regards, Kobus >>> ahmad(a)hitech-iraq.com 2/7/2006 1:27:37 PM >>> hi guys, I wrote a module to allow administrators to specify a certain session timeout for each role in drupal site. If the user stop interacting with site for the specified time or longer... the site will ask the user for his/here user name and password.... If any one is interested i can send the module to the list or otherwise upload it to cvs. Ahmad

2 1

Re: [development] Session timeout module
by Ahmed Al-Obaidy 07 Feb '06

07 Feb '06

Hi Kobus, Thanks for your feedback, I welcome any suggestions about the module. I agree with you, adding such a counterdown clock is easy to implement and yet very useful... I hope i would find time for it later this week. meanwhile, you are welcomed to add anything you want as far as you share it with us ;).. Ahmad Kobus Myburgh <ITBJDM(a)puknet.puk.ac.za> wrote: Hi, Ahmad, This sounds like a great module - I've needed that on a previous site that I created. Would be good if you can add a countdown timer to warn the user if it will time-out before it actually times out. If I am, for example, on the site, and the phone rings, and currently busy filling out a huge form, I'd be mightily peeved off if the thing times out without warning. I personally would be able to use a module like that (using JavaScript for the countdown timer), that is why I make the suggestion. I figure that: 1. If it is configurable 2. It is safe nobody would object to the JS code in the module, and I think it would be simple to implement, perhaps just reset the session time-out counter every time activity is recorded on the site? This would be a GREAT addition for someone who uses the e-Commerce module. What do you think? Regards, Kobus >>> ahmad(a)hitech-iraq.com 2/7/2006 1:27:37 PM >>> hi guys, I wrote a module to allow administrators to specify a certain session timeout for each role in drupal site. If the user stop interacting with site for the specified time or longer... the site will ask the user for his/here user name and password.... If any one is interested i can send the module to the list or otherwise upload it to cvs. Ahmad

1 0