I happen to have an FTP client too. Maybe interesting as it's driven by an external state machine and can conduct batch operations with progress displays. It's not a module, though, but designed for PHP-GTK. But it might prove useful. ----- Original Message ----- From: "arthur" <arthur@civicactions.com> To: <development@drupal.org> Sent: Wednesday, June 11, 2008 6:10 PM Subject: Re: [development] What to do with Drupal FTP? I did an implementation of FTP for media_mover to harvest files from a server. I didn't didn't even realize that there was an ftp module (damn my lazy search habits). I actually think it'd be nice to have a abstract ftp module that other modules could implement. Yes, it has huge potential security issues, which does require implementations to be responsible as well as alert admins that they are opening up possible exploits. On the other hand, it gives huge functionality benefits- in my case, being able to move 100mb files without having users needing to deal with uploading via http is a big deal. I guess I'd rather see one module which does the implementation that tries to deal with the security issues rather than a dozen (like myself) going it alone... I'd be willing to lend a hand in submitting patches and what not if you want to keep the module going. arthur On Jun 11, 2008, at 11:07 AM, Aaron Winborn wrote:
Regarding Drupal FTP at http://drupal.org/project/drupal_ftp
I just had a conversation with chx in irc about the status of Drupal FTP, and its possible uses (if completed) for malware, and possible security holes. Particularly in light of the SoC project Plugin Manager, and that I stopped work on the project a year ago, I'm happy to drop the module.
However, the concept itself does have some merit, and there are many other uses I can think of other than what's planned for the Plugin Manager. Additionally, I've had a few queries over the months that indicate some developers are actually using the module, although I imagine they're in the minority. The project itself came partly out of the poor file handling that Drupal has had in the past (but will hopefully be fixed with http://drupal.org/node/142995 hint hint...)
So my question is what is the best course of action at this point? Currently, the module works, although is incomplete from its original goals. It does currently store the u/p of its designated FTP server, which is a weakness, although it would have to be developed beyond how it is to exploit that weakness.
I have no intention in the near term of continuing development of the project, don't plan to upgrade it to Drupal 6, and believe a better approach for remote file handling will emerge for Drupal 7.
Should I entirely remove the project? Officially abandon it? Amend or replace the project page with a warning, in case people are actually using it? Ask for a security team audit if we decide to keep it?
Thanks, Aaron Winborn
--------------------------------------------------- arthur@civicactions.com