Planet Drupal
Google Friendconnect Drupal module not recommended (yet)
Heine —Tue, 2010/01/12 - 16:01
The Friendconnect module on code.google.com is not suitable for use on production sites. My message to the 36 people who've already downloaded the module:
Test on a local site only!
I'd rather have posted this as a comments on Bertboerland's Friendconnect story, but his server ran out of steam.
The OpenID 2.0 Compliance Crusade - Part I
Heine —Mon, 2010/01/11 - 22:50
We released Drupal 6.14 because of a number of vulnerabilities in the OpenID core module. One of those vulnerabilities was caused by not obeying the OpenID 2.0 Authentication specification.
A number of other spec violations was discovered while working on the security issue. This might not be that be surprising, after all, our OpenID implementation was written against a draft, not the final 2.0 specification.
In addition, the issue queue on the OpenID core module hints that the OpenID module is going the way of BlogAPI (another Drupal dodo).
Rather than trying to fix each violation, I decided to correct the immediate issue and then start a belated OpenID 2.0 Compliance Crusade in public, to get our OpenID implementation fully compliant.
Wanna join in? Great! The rest of this post is meant to provide a slightly easier introdcution into the first part of OpenID than the official specs. To prevent disappointment: It's basically a partial retelling of the spec. With this introduction, you should be able to investigate spec violations, and file and review patches for OpenID.
Using <embed> for XSS
Heine —Fri, 2009/10/30 - 18:38
I see a lot less stray <script> tags in the "Allowed HTML tags:" of the HTML filter these days. The <embed> tag is something I still see a lot in misconfigured formats.
It's rather easy to exploit such formats to execute JavaScript with a little bit of ActionScript:
Bugfix woes for Drupal 6
Heine —Sun, 2009/09/13 - 10:55
The bugfixing procedure for Drupal 6 is, to say the least, "suboptimal".
Witness Issue #261258, that's been with us since Drupal 6.0. Thirteen releases later and the bug is still present.
Why, you ask? Because bugs should be fixed in HEAD (future release of Drupal) first, before being backported to 6.x-dev.
The #drupal consultant
Heine —Thu, 2009/08/06 - 10:22
A gem on the Drupal consulting mailinglist (emphasis added):
[...] when she's come up with the particular (and often peculiar) requirements, I haven't charged for the time I spend [...] chatting about it on #drupal
Well, we didn't charge you for the chat either, did we?
Menu access, a new pitfall when going back to Drupal 5
Heine —Mon, 2009/05/25 - 13:56
If you spend a lot of time exclusively in one Drupal version, you develop muscle memory for its API. This can be pretty dangerous as I caught myself writing the following menu item while backporting a Drupal 6 module.
Drupal 6: $base_path doesn't always point to the frontpage
Heine —Sun, 2009/05/17 - 20:13
Dear themers,
.... in page.tpl.php breaks Home functionality on many multilingual sites.
A new form element in Drupal core
Heine —Wed, 2009/01/28 - 09:48
This post was written for a development version of Drupal between 6 and 7. The queries and pager need conversion to DBTNG.
With Commit #167487, a new form element has been added to Drupal core (7.x) to provide an alternative means of selecting items. Now, next to 'select' (combobox, list), checkboxes and radios, core carries the 'tableselect' element. This element allows developers to easily create tables with selectable rows. Ideal for those situations where you have to provide a lot of data on the items to the user.
The backstabbing March-Hare
Heine —Thu, 2009/01/22 - 01:19
If you use the CVSNT free/open source edition to commit to Drupal.org, drop to the command line and check your version with:
CVSNT version 2.5.04 or later inserts advertising in every commit message. Please, either buy a license for the CVSNT Suite, download an older version, or switch to another client.
