http://localhost:8080/trac/query?component=Drupal+modules+%26+settings&milestone=Maintenance&group=status&desc=1&order=id Support and issues tracking for the Transition Network Web Project. en-US /trac/chrome/site/TransitionNetwork-Logo-Web-Small.jpg http://localhost:8080/trac/query?component=Drupal+modules+%26+settings&milestone=Maintenance&group=status&desc=1&order=id Trac 0.12.5 http://localhost:8080/trac/ticket/655 http://localhost:8080/trac/ticket/655 Thu, 12 Dec 2013 13:03:11 GMT ed <p> Investigate with Rob how to add Social media icons with counters into the /blogs listings views and individual node views. </p> <p> I suggest starting with just Rob's blogs (/rob-hopkins), separate context for 'Transition Culture section' and then roll it out over other blogs and maybe news content type once the /rob-hopkins has been trialled </p> <p> Sam to talk with Rob </p> <p> Also cc-ing Ben as design - theme guy </p> Results http://localhost:8080/trac/ticket/655#changelog http://localhost:8080/trac/ticket/772 http://localhost:8080/trac/ticket/772 Tue, 05 Aug 2014 09:26:32 GMT annesley <p> i added a new Mulling transition initiative on staging in Afghanistan and it did not appear on the map... i flushed caches and then it started appearing on the main initiatives map. is this intended? is it a known? </p> Results http://localhost:8080/trac/ticket/772#changelog http://localhost:8080/trac/ticket/758 http://localhost:8080/trac/ticket/758 Wed, 16 Jul 2014 21:55:29 GMT paul <p> View online: <a class="ext-link" href="https://www.drupal.org/SA-CORE-2014-003"><span class="icon">​</span>https://www.drupal.org/SA-CORE-2014-003</a> </p> <ul><li>Advisory ID: DRUPAL-SA-CORE-2014-003 </li><li>Project: Drupal core <a class="missing changeset" title="No default repository defined">[1]</a> </li><li>Version: 6.x, 7.x </li><li>Date: 2014-July-16 </li><li>Security risk: Critical <a class="missing changeset" title="No default repository defined">[2]</a> </li><li>Exploitable from: Remote </li><li>Vulnerability: Multiple vulnerabilities </li></ul><hr /> <hr /> <p> Multiple vulnerabilities were fixed in the supported Drupal core versions 6 and 7. </p> <p> .... Denial of service with malicious HTTP Host header (Base system - Drupal 6 and 7 - Critical) </p> <p> Drupal core's multisite feature dynamically determines which configuration file to use based on the HTTP Host header. </p> <p> The HTTP Host header validation does not sufficiently check maliciously-crafted header values, thereby exposing a denial of service vulnerability. </p> <p> .... Access bypass (File module - Drupal 7 - Critical) </p> <p> The File module included in Drupal 7 core allows attaching files to pieces of content. The module doesn't sufficiently check permission to view the attached file when attaching a file that was previously uploaded. This could allow attackers to gain access to private files. </p> <p> This vulnerability is mitigated by the fact that the attacker must have permission to create or edit content with a file field. </p> <p> Note: The Drupal 6 <a class="missing wiki">FileField?</a> <a class="missing changeset" title="No default repository defined">[3]</a> module is affected by a similar issue (see SA-CONTRIB-2014-071 - <a class="missing wiki">FileField?</a> - Access bypass <a class="missing changeset" title="No default repository defined">[4]</a>) and requires an update to the current security release of Drupal 6 core in order for the fix released there to work correctly. However, Drupal 6 core itself is not directly affected. </p> <p> .... Cross-site scripting (Form API option groups - Drupal 6 and 7 - Moderately critical) </p> <p> A cross-site scripting vulnerability was found due to Drupal's form API failing to sanitize option group labels in select elements. This vulnerability affects Drupal 6 core directly, and likely affects Drupal 7 forms provided by contributed or custom modules. </p> <p> This vulnerability is mitigated by the fact that it requires the "administer taxonomy" permission to exploit in Drupal 6 core, and there is no known exploit within Drupal 7 core itself. </p> <p> .... Cross-site scripting (Ajax system - Drupal 7 - Moderately critical) </p> <p> A reflected cross-site scripting vulnerability was found in certain forms containing a combination of an Ajax-enabled textfield (for example, an autocomplete field) and a file field. </p> <p> This vulnerability is mitigated by the fact that an attacker can only trigger the attack in a limited set of circumstances, usually requiring custom or contributed modules. </p> <hr /> <hr /> <ul><li>/A CVE identifier <a class="missing changeset" title="No default repository defined">[5]</a> will be requested, and added upon issuance, in </li></ul><p> accordance with Drupal Security Team processes./ </p> <hr /> <hr /> <ul><li>Drupal core 6.x versions prior to 6.32. </li><li>Drupal core 7.x versions prior to 7.29. </li></ul><hr /> <hr /> <p> Install the latest version: </p> <ul><li>If you use Drupal 6.x, upgrade to Drupal core 6.32. <a class="missing changeset" title="No default repository defined">[6]</a> </li><li>If you use Drupal 7.x, upgrade to Drupal core 7.29. <a class="missing changeset" title="No default repository defined">[7]</a> </li></ul><p> Also see the Drupal core <a class="missing changeset" title="No default repository defined">[8]</a> project page. </p> <hr /> <hr /> <ul><li>The denial of service vulnerability using malicious HTTP Host headers was </li></ul><p> reported by Régis Leroy <a class="missing changeset" title="No default repository defined">[9]</a>. </p> <ul><li>The access bypass vulnerability in the File module was reported by Ivan </li></ul><p> Ch <a class="missing changeset" title="No default repository defined">[10]</a>. </p> <ul><li>The cross-site scripting vulnerability with Form API option groups was </li></ul><p> reported by Károly Négyesi <a class="missing changeset" title="No default repository defined">[11]</a>. </p> <ul><li>The cross-site scripting vulnerability in the Ajax system was reported by </li></ul><p> mani22test <a class="missing changeset" title="No default repository defined">[12]</a>. </p> <hr /> <hr /> <ul><li>The denial of service vulnerability using malicious HTTP Host headers was </li></ul><p> fixed by Régis Leroy <a class="missing changeset" title="No default repository defined">[13]</a>, and by Klaus Purer <a class="missing changeset" title="No default repository defined">[14]</a> of the Drupal Security Team. </p> <ul><li>The access bypass vulnerability in the File module was fixed by Nate Haug </li></ul><p> <a class="missing changeset" title="No default repository defined">[15]</a> and Ivan Ch <a class="missing changeset" title="No default repository defined">[16]</a>, and by Drupal Security Team members David Rothstein <a class="missing changeset" title="No default repository defined">[17]</a>, Heine Deelstra <a class="missing changeset" title="No default repository defined">[18]</a> and David Snopek <a class="missing changeset" title="No default repository defined">[19]</a>. </p> <ul><li>The cross-site scripting vulnerability with Form API option groups was </li></ul><p> fixed by Greg Knaddison <a class="missing changeset" title="No default repository defined">[20]</a> of the Drupal Security Team. </p> <ul><li>The cross-site scripting vulnerability in the Ajax system was fixed by </li></ul><p> Neil Drumm <a class="missing changeset" title="No default repository defined">[21]</a> of the Drupal Security Team. </p> <hr /> <hr /> <ul><li>The Drupal Security Team <a class="missing changeset" title="No default repository defined">[22]</a> </li></ul><hr /> <hr /> <p> The Drupal security team can be reached at security at drupal.org or via the contact form at <a class="ext-link" href="http://drupal.org/contact"><span class="icon">​</span>http://drupal.org/contact</a> <a class="missing changeset" title="No default repository defined">[23]</a>. </p> <p> Learn more about the Drupal Security team and their policies <a class="missing changeset" title="No default repository defined">[24]</a>, writing secure code for Drupal <a class="missing changeset" title="No default repository defined">[25]</a>, and securing your site <a class="missing changeset" title="No default repository defined">[26]</a>. </p> <p> Follow the Drupal Security Team on Twitter at <a class="ext-link" href="https://twitter.com/drupalsecurity"><span class="icon">​</span>https://twitter.com/drupalsecurity</a> <a class="missing changeset" title="No default repository defined">[27]</a> </p> <p> <a class="missing changeset" title="No default repository defined">[1]</a> <a class="ext-link" href="http://drupal.org/project/drupal"><span class="icon">​</span>http://drupal.org/project/drupal</a> <a class="missing changeset" title="No default repository defined">[2]</a> <a class="ext-link" href="http://drupal.org/security-team/risk-levels"><span class="icon">​</span>http://drupal.org/security-team/risk-levels</a> <a class="missing changeset" title="No default repository defined">[3]</a> <a class="ext-link" href="https://www.drupal.org/project/filefield"><span class="icon">​</span>https://www.drupal.org/project/filefield</a> <a class="missing changeset" title="No default repository defined">[4]</a> <a class="ext-link" href="https://www.drupal.org/node/2304561"><span class="icon">​</span>https://www.drupal.org/node/2304561</a> <a class="missing changeset" title="No default repository defined">[5]</a> <a class="ext-link" href="http://cve.mitre.org/"><span class="icon">​</span>http://cve.mitre.org/</a> <a class="missing changeset" title="No default repository defined">[6]</a> <a class="ext-link" href="https://www.drupal.org/drupal-6.32-release-notes"><span class="icon">​</span>https://www.drupal.org/drupal-6.32-release-notes</a> <a class="missing changeset" title="No default repository defined">[7]</a> <a class="ext-link" href="https://www.drupal.org/drupal-7.29-release-notes"><span class="icon">​</span>https://www.drupal.org/drupal-7.29-release-notes</a> <a class="missing changeset" title="No default repository defined">[8]</a> <a class="ext-link" href="http://drupal.org/project/drupal"><span class="icon">​</span>http://drupal.org/project/drupal</a> <a class="missing changeset" title="No default repository defined">[9]</a> <a class="ext-link" href="https://www.drupal.org/user/1367862"><span class="icon">​</span>https://www.drupal.org/user/1367862</a> <a class="missing changeset" title="No default repository defined">[10]</a> <a class="ext-link" href="https://www.drupal.org/user/556138"><span class="icon">​</span>https://www.drupal.org/user/556138</a> <a class="missing changeset" title="No default repository defined">[11]</a> <a class="ext-link" href="https://www.drupal.org/u/chx"><span class="icon">​</span>https://www.drupal.org/u/chx</a> <a class="missing changeset" title="No default repository defined">[12]</a> <a class="ext-link" href="https://www.drupal.org/user/2844779"><span class="icon">​</span>https://www.drupal.org/user/2844779</a> <a class="missing changeset" title="No default repository defined">[13]</a> <a class="ext-link" href="https://www.drupal.org/user/1367862"><span class="icon">​</span>https://www.drupal.org/user/1367862</a> <a class="missing changeset" title="No default repository defined">[14]</a> <a class="ext-link" href="https://www.drupal.org/user/262198"><span class="icon">​</span>https://www.drupal.org/user/262198</a> <a class="missing changeset" title="No default repository defined">[15]</a> <a class="ext-link" href="https://www.drupal.org/user/35821"><span class="icon">​</span>https://www.drupal.org/user/35821</a> <a class="missing changeset" title="No default repository defined">[16]</a> <a class="ext-link" href="https://www.drupal.org/user/556138"><span class="icon">​</span>https://www.drupal.org/user/556138</a> <a class="missing changeset" title="No default repository defined">[17]</a> <a class="ext-link" href="https://www.drupal.org/user/124982"><span class="icon">​</span>https://www.drupal.org/user/124982</a> <a class="missing changeset" title="No default repository defined">[18]</a> <a class="ext-link" href="https://www.drupal.org/user/17943"><span class="icon">​</span>https://www.drupal.org/user/17943</a> <a class="missing changeset" title="No default repository defined">[19]</a> <a class="ext-link" href="https://www.drupal.org/user/266527"><span class="icon">​</span>https://www.drupal.org/user/266527</a> <a class="missing changeset" title="No default repository defined">[20]</a> <a class="ext-link" href="https://www.drupal.org/u/greggles"><span class="icon">​</span>https://www.drupal.org/u/greggles</a> <a class="missing changeset" title="No default repository defined">[21]</a> <a class="ext-link" href="https://www.drupal.org/u/drumm"><span class="icon">​</span>https://www.drupal.org/u/drumm</a> <a class="missing changeset" title="No default repository defined">[22]</a> <a class="ext-link" href="http://drupal.org/security-team"><span class="icon">​</span>http://drupal.org/security-team</a> <a class="missing changeset" title="No default repository defined">[23]</a> <a class="ext-link" href="http://drupal.org/contact"><span class="icon">​</span>http://drupal.org/contact</a> <a class="missing changeset" title="No default repository defined">[24]</a> <a class="ext-link" href="http://drupal.org/security-team"><span class="icon">​</span>http://drupal.org/security-team</a> <a class="missing changeset" title="No default repository defined">[25]</a> <a class="ext-link" href="http://drupal.org/writing-secure-code"><span class="icon">​</span>http://drupal.org/writing-secure-code</a> <a class="missing changeset" title="No default repository defined">[26]</a> <a class="ext-link" href="http://drupal.org/security/secure-configuration"><span class="icon">​</span>http://drupal.org/security/secure-configuration</a> <a class="missing changeset" title="No default repository defined">[27]</a> <a class="ext-link" href="https://twitter.com/drupalsecurity"><span class="icon">​</span>https://twitter.com/drupalsecurity</a> </p> <p> <span class="underline"></span><span class="underline"></span><span class="underline"></span><span class="underline"></span><span class="underline"></span><span class="underline"></span><span class="underline"></span><span class="underline"></span><span class="underline"></span><span class="underline"></span><span class="underline"></span><span class="underline">_ Security-news mailing list Security-news@… Unsubscribe at <a class="ext-link" href="https://lists.drupal.org/mailman/listinfo/security-news"><span class="icon">​</span>https://lists.drupal.org/mailman/listinfo/security-news</a> </span></p> Results http://localhost:8080/trac/ticket/758#changelog http://localhost:8080/trac/ticket/701 http://localhost:8080/trac/ticket/701 Tue, 18 Mar 2014 09:38:24 GMT paul Results http://localhost:8080/trac/ticket/701#changelog http://localhost:8080/trac/ticket/662 http://localhost:8080/trac/ticket/662 Tue, 17 Dec 2013 15:37:13 GMT ed <p> for January - to get Sam and Jim talking - in January </p> <p> The subs sent out to subscribers: are fine in html but the text version is broken and unsatisfactory. I know we've been through this and it's a known bug etc. etc. but I'm wondering if we can switch all subs to html, or if there are any patches to this problem? </p> <p> Adding as Jim's ticket with Sam cc-ed </p> Results http://localhost:8080/trac/ticket/662#changelog http://localhost:8080/trac/ticket/636 http://localhost:8080/trac/ticket/636 Wed, 27 Nov 2013 17:30:19 GMT ed <p> Space currently does not give users who aren't already registered a way in. Anon users can see some of the spaces but when they try to apply for membership, they hit a login page, which they can't complete as they are not registered. </p> <ol><li>RTFM for OA as to OA best practice - this is billable time. Then leave notes about it in wiki for later developers. </li></ol><ol start="2"><li>The homepage needs editing to sort this out. Here are some first changes: </li></ol><p> 2.1. Remove the 'Need the pros' pane (RHS) 2.2 Remove the 'Just getting started' pane (LHS) 2.3 Add a 'Request membership' pane which is basically a user registration form. Make registration 'approval only' for now, approval to be by a site admin (webproject@…) </p> <p> The /spaces listings view shows the spaces that are publicly viewable, and there is a 'request group membership' button for each of them. </p> <ol start="3"><li>Can you make this into a registration form as well? </li></ol> Results http://localhost:8080/trac/ticket/636#changelog http://localhost:8080/trac/ticket/590 http://localhost:8080/trac/ticket/590 Fri, 06 Sep 2013 10:27:27 GMT jim <p> This ticket is to track the work and changes done within the Drupal sphere in relation to performance enhancements done since <a class="closed ticket" href="http://localhost:8080/trac/ticket/585" title="maintenance: TTech Meeting 5th September 2013 (closed: fixed)">#585</a>. </p> <p> More information is needed and will come when <a class="closed ticket" href="http://localhost:8080/trac/ticket/586" title="maintenance: New Relic Monitoring for BOA (closed: fixed)">ticket:586</a> New Relic Monitoring for BOA is completed. </p> <p> I also note that many of these cleanup operations will also help make the move to D7 smoother and better. </p> <h1 id="Summaryofactionsandstatus">Summary of actions and status</h1> <h2 id="TODO">TODO</h2> <p> <strong>O) Stop making so many URL aliases for non-relevant pages, clean up url_alias table</strong> -- 1/4-1/2 hour, medium reward, only risk is that some already broken links might break... Per chat with Ed, only these will be removed (plus releated tweaks to Pathauto settings): </p> <ul><li>3,579 entries where src = node/%/feed </li><li>1,856 entries where src = user/%/contact </li><li>= 5,435 or ~11% of entries in url_alias </li></ul><p> <strong>L) Review slow query log, explain queries, tweak as necessary/flag poorly behaving modules.</strong> 2-4 hours, high reward, low risk... Keep looking at the slow query log and adjust Drupal or find patches as necessary. ALSO related <a class="ext-link" href="http://2bits.com/articles/reduce-your-servers-resource-usage-moving-mysql-temporary-directory-ram-disk.html"><span class="icon">​</span>Reduce your server's resource usage by moving MySQL temporary directory to tmpfs</a>... Have opened ticket for this: <a class="closed ticket" href="http://localhost:8080/trac/ticket/591" title="maintenance: Move MySQL temporary directory to tmpfs (closed: fixed)">#591</a> for Chris. </p> <h3 id="Done">Done</h3> <p> <strong>A) Remove spam taxonomy entries</strong> <del>1/2 hour, Low risk, low reward -- See item 8 below. A simple delete from taxo term table where length &gt; 50 is worth doing IMHO, and nothing I saw that would be clobbered is not spam.</del> </p> <p> <strong>B) Try a Taxonomy Cleanup</strong>: <del>3 hours, Medium risk, medium reward -- style module to try to merge terms with the same names and clean up the link tables back to nodes. Further, we can remove any taxonomies or relations to certain CTs that don't really add value.</del> </p> <p> <strong>D) Review Views caching</strong> <del>1 hour, low risk, high reward -- Utilise Views Content Cache this was done a while back but I think -- done (task 12) in comment 21.</del> </p> <p> <strong>F) Force blocks caches to cached appropriately (and be rendered/included only as needed)</strong> <del>1-2 hours, medium reward, low risk -- BOA packages the <a class="ext-link" href="https://drupal.org/project/blockcache_alter"><span class="icon">​</span>Block Cache Alter</a>, which makes sure Drupal only renders blocks when needed. Potential small but nice boost quickly in whole site. -- per comment 22, block caching is disabled by other modules so this will have to go on hold for now.</del> </p> <p> <strong>H) Remove <a class="missing wiki">CustomError?</a> module all together</strong> <del>1/2 hour, low risk, low reward -- We should take out the PHP code from the 403 section of <a class="missing wiki">CustomError?</a> and put it into a simple page entry. See comment 6 below as this has happened for 404s (which need no PHP). We can then remove the <a class="missing wiki">CustomError?</a> module all together, saving lots of sessions. I would go ahead and do this but since the 403 page has various displays depending on user type, I wanted to raise it here as it *may* have side effects. Or not...</del> </p> <p> <strong>I) Re-enable block caching.</strong> <del>2-6 hours, high risk, high reward -- Per comment 24, a module (probably Content Access) is stopping Drupal caching blocks, which for some of them means a fair amount of pointless overhead. We need to somehow get around this and get blocks cached if possible. R&amp;D mainly, perhaps with some hacking/patching - but I'd stop short of doing this if so.</del> </p> <p> <strong>K) Add &amp; enable Views Lite Pager on big views.</strong> <del>1 hour, low risk, low reward -- Using this module stops a heavy count query on views with pagers -- recommended for large sites.</del> </p> <p> <strong>M) Take control of Cron, and maximise time pages are cached for.</strong> <del>.25h, high reward, low risk -- Cron is wiping the page cache, so we need to install <a class="ext-link" href="https://drupal.org/project/elysia_cron"><span class="icon">​</span>https://drupal.org/project/elysia_cron</a> so we can clear the page less often, and run other things when we want and the site is quieter. Now need per minute resolution set to get the best, see comment 33 and 34 for more...</del> </p> <p> <strong>N) Replace Admin Menu 1.x with 3.x</strong> -- will happen when <a class="assigned ticket" href="http://localhost:8080/trac/ticket/590" title="defect: Drupal performance improvements (assigned)">#590</a> occurs, marking complete here -- <del>5 mins, high reward, low risk -- done when <a class="assigned ticket" href="http://localhost:8080/trac/ticket/582" title="maintenance: TN.org platform and sites (assigned)">#582</a> happens, could be the cause of some load spikes as it occasionally goes made and does 2000-5000 queries~~ </del></p> Results http://localhost:8080/trac/ticket/590#changelog http://localhost:8080/trac/ticket/582 http://localhost:8080/trac/ticket/582 Mon, 02 Sep 2013 09:30:02 GMT jim <p> The TN.org platform and Drupal site updates are to be tracked in this ticket. </p> <p> Current PROD platform build = <strong>P009</strong> Current STG platform build = <strong>S010</strong> </p> <p> Updates pending: </p> <ul><li>SECURITY UPDATE - NO RISK: Pressflow core 6.30 is due, but the security holes fixed do not affect us, low priority. Platforms: present in S010, but not in P009. </li></ul> Results http://localhost:8080/trac/ticket/582#changelog http://localhost:8080/trac/ticket/908 http://localhost:8080/trac/ticket/908 Thu, 10 Mar 2016 15:43:56 GMT sam <p> Hi all </p> <p> The web project board has decided to move from Piwik to Google Analytics. </p> <p> I realise this has significant privacy implications, these were discussed, but it was decided that the move would go ahead. </p> <p> I have discussed with Ainslie adding an opt out in the form of a link to EFF's Privacy badger: <a class="ext-link" href="https://www.eff.org/privacybadger"><span class="icon">​</span>https://www.eff.org/privacybadger</a> This will be added to the cookie pop up bar in the new website. </p> <p> Could we enable the Google Analytics module on the existing site so I can add in the tracking code. </p> <p> Thanks </p> <p> Sam </p> Results http://localhost:8080/trac/ticket/908#changelog http://localhost:8080/trac/ticket/906 http://localhost:8080/trac/ticket/906 Tue, 01 Mar 2016 22:27:10 GMT sam <p> Hi Chris </p> <p> I recklessly tried to enable a module on the site that enabled sending articles to friends by email, this seems to have been one of my less-good ideas. </p> <p> It tried to enable a print-friendly page and this seems to have brought the whole crumbling edifice down </p> <p> Sorry about that. Can you fix it? </p> Results http://localhost:8080/trac/ticket/906#changelog http://localhost:8080/trac/ticket/888 http://localhost:8080/trac/ticket/888 Sun, 06 Dec 2015 12:25:49 GMT chris <p> It it intentional or accidental that adverts from <a class="ext-link" href="https://secureads.bitbillions.com/"><span class="icon">​</span>https://secureads.bitbillions.com/</a> are being loaded on the front page of <a class="ext-link" href="https://www.transitionnetwork.org/"><span class="icon">​</span>https://www.transitionnetwork.org/</a> via the embedded content from flickrit.com? </p> Results http://localhost:8080/trac/ticket/888#changelog http://localhost:8080/trac/ticket/798 http://localhost:8080/trac/ticket/798 Thu, 16 Oct 2014 12:40:58 GMT chris <p> The <a class="ext-link" href="https://raw.githubusercontent.com/omega8cc/boa/master/CHANGELOG.txt"><span class="icon">​</span>changelog</a>: </p> <pre class="wiki">### Stable BOA-2.3.5 Release - Full Edition ### Date: Wed Oct 15 16:28:25 PDT 2014 ### Includes Aegir 2.1 with improvements ### Latest hotfix added on: Wed Oct 15 20:09:52 PDT 2014 # Release Notes: This new BOA release includes important updates and bug fixes. * All new Drupal 7 platforms received Drupal core security upgrade. For details please read: https://www.drupal.org/SA-CORE-2014-005 * All existing Drupal 7 built-in platforms will receive a hot-fix for this known vulnerability: https://www.drupal.org/SA-CORE-2014-005 once you will run 'barracuda up-stable' command on your server. This procedure is automated on hosted and managed Aegir at Omega8.cc * Your custom D7 platforms created in the ~/static directory tree will be checked in the next 12 hours after the upgrade, and if you have not applied this patch yet, it will be applied automatically for you - but only if there is at least one active site present in the given custom D7 platform. Note that while this procedure is automated on hosted and managed Aegir at Omega8.cc, on self-hosted BOA systems it will work only if you will set _PERMISSIONS_FIX=YES in /root/.barracuda.cnf (default is NO) We recommend that you upgrade your D7 sites using safe workflow: https://omega8.cc/your-drupal-site-upgrade-safe-workflow-298 # Updated Octopus platforms: aGov 1.5 --------------------- https://drupal.org/project/agov Commerce 1.31 ---------------- https://drupal.org/project/commerce_kickstart Commerce 2.19 ---------------- https://drupal.org/project/commerce_kickstart Guardr 1.14 ------------------ https://drupal.org/project/guardr Open Atrium 2.22 ------------- https://drupal.org/project/openatrium Open Outreach 1.12 ----------- https://drupal.org/project/openoutreach OpenPublic 1.2 --------------- https://drupal.org/project/openpublic Panopoly 1.12 ---------------- https://drupal.org/project/panopoly # New features and enhancements in this release: * Explain that Solr self-provisioning works only if _MODULES_FIX=YES is set. * Reverify all sites daily if /root/.force.sites.verify.cnf ctrl file exists and _PERMISSIONS_FIX=YES is set in /root/.barracuda.cnf (default is NO) # Changes in this release: * Security: Remove support for SSLv3 due to POODLE vulnerability. * Disable Redis in Hostmaster until we will fix the Views based pages/blocks. * Disable site_readonly for non-dev sites by default. * Drush: Upgrade command line version 6 to mini-6-04-10-2014 * Enable AllowUserFXP in Pure-FTPd config by default. * Remove support for already deprecated non-LTS Ubuntu versions. * Run manage_ip_auth_access only once per minute. * The INI variable redis_flush_forced_mode is enabled by default (again). * Use sysklogd instead of rsyslog on Ubuntu. # System upgrades in this release: * MariaDB 5.5.40 * Nginx 1.7.6 * OpenSSH 6.7p1 (if installed from sources) * OpenSSL 1.0.1j (if installed from sources) - security upgrade. * PHPRedis: master-03-10-2014 # Fixes in this release: * Add auto-detection of Legacy Ruby patch level update on old systems. * Add cleanup for ghost/broken sites dirs leftovers. * Add missing cleanup for backup_migrate leftovers. * Always cleanup pid files on exit/abort. * Apply patch for SA-CORE-2014-005 in all shared D7 cores/built-in platforms. * Compass Tools: Install 1.9.3 ffi expected by older themes. * Fix db_port entry in all vhosts hourly. * Fix for broken erpal-7.x-2.0-7.31.1 * Fix for broken site level drushrc.php file. * Fix for false alarm caused by ghost sites leftovers. * Fix for incorrect hash filtering on systems with OpenSSL built from sources. * Fix locales: Numerous fixes and improvements -- thanks ar-jan! * Fix typo in REVISIONS. * Force site Verify via frontend if drushrc.php has been fixed. * Issue #435 - SQL: Remove deprecated table_cache +update table_open_cache * Issue #440 - Improve innodb_buffer_pool_size calculation and add 10% * Issue #441 - New Relic is not disabled after removing newrelic.info file. * Issue #442 - Skip locked/fpmcheck if /root/.high_traffic.cnf exists. * Issue #444 - PHP: Remove useless sed replacement in pool.d/www{*}.conf * Issue #445 - Remote Import: update 6.x-2.x branch for Aegir 2.x and Drush 6 * Issue #447 - Export LANG, LANGUAGE and all LC_ environment variables. * Issue #447 - Improve locales consistency. * Issue #447 - Set default LC_CTYPE and LC_COLLATE environment variables. * Issue #447 - Simplify locales configuration on Ubuntu. * Issue #448 - Enforce locale settings by configuring defaults. * Issue #452 - PHP build is broken with latest MariaDB 5.5.40 * Make sure that db_port is never empty and defaults to 3306. * Make sure that firewall monitoring scripts never run simultaneously. * Make sure that standard caching is enabled in hostmaster. * Pause hostmaster tasks when RVM install for any user is running. * PHP: Do not run rebuilds if not needed. * PHP: Fix for broken upgrade logic on libcurl or libssl packages upgrade. * Remove acquia_connector from latest Commons to avoid broken installs. * Remove all legacy gems and re-install RVM/Ruby for root from scratch. * Remove legacy replacement to avoid converting symlinked includes into files. * SQL: Use correct defaults if MySQLTuner test failed. * Workaround for Drupal flood using 127.0.0.1 for all requests behind proxy. ### Stable BOA-2.3.4 Release - Full Edition ### Date: Wed Oct 15 09:51:08 PDT 2014 ### Includes Aegir 2.1 with improvements Release Notes and changelog for BOA-2.3.4 has been merged into BOA-2.3.5 above after security upgrades related to OpenSSL and SSLv3 have been added shortly after 2.3.4 release. </pre><p> I'm going to run this update tonight. </p> Results http://localhost:8080/trac/ticket/798#changelog http://localhost:8080/trac/ticket/785 http://localhost:8080/trac/ticket/785 Thu, 11 Sep 2014 15:54:35 GMT paul <p> @Ed Would you check my choice of component; I was looking for maintenance? Should I assign this to me as I create the ticket? </p> <p> View online: <a class="ext-link" href="https://www.drupal.org/node/2336263"><span class="icon">​</span>https://www.drupal.org/node/2336263</a> </p> <ul><li>Advisory ID: DRUPAL-SA-CONTRIB-2014-086 </li><li>Project: Custom Breadcrumbs <a class="missing changeset" title="No default repository defined">[1]</a> (third-party module) </li><li>Version: 6.x, 7.x </li><li>Date: 2014-September-10 </li><li>Security risk: 16/25 ( Critical) </li></ul><p> AC:None/A:User/CI:Some/II:Some/E:Theoretical/TD:All <a class="missing changeset" title="No default repository defined">[2]</a> </p> <ul><li>Vulnerability: Cross Site Scripting </li></ul><hr /> <hr /> <p> Custom Breadcrumbs allows administrators to set up parametrized breadcrumb trails for different content types, views, panels, taxonomy vocabularies and terms, paths, and a simple API that allows contributed modules to enable custom breadcrumbs for module pages and theme templates. </p> <p> User input is not properly sanitized in all use cases, opening a Cross Site Scripting (XSS) vulnerability. </p> <p> The vulnerability is only present when the custom breadcrumb is configured with the special identifier so that some of the breadcrumb items are not links. Typical example is that the last breadcrumb element is showing the current page title but is not a link. The XSS vulnerability is not triggered if all items of the breadcrumb are links and special identifier is not used. </p> <hr /> <hr /> <ul><li>/A CVE identifier <a class="missing changeset" title="No default repository defined">[3]</a> will be requested, and added upon issuance, in </li></ul><p> accordance with Drupal Security Team processes./ </p> <hr /> <hr /> <ul><li>Custom Breadcrumbs 6.x-1.x versions prior to 6.x-1.6 </li><li>Custom Breadcrumbs 6.x-2.x versions are NOT affected </li><li>Custom Breadcrumbs 7.x-2.x versions prior to 7.x-2.0-beta1 </li></ul><p> Drupal core is not affected. If you do not use the contributed Custom Breadcrumbs <a class="missing changeset" title="No default repository defined">[4]</a> module, there is nothing you need to do. </p> <hr /> <hr /> <p> Install the latest version: </p> <ul><li>If you use the Custom Breadcrumbs module version 1.x for Drupal 6.x, </li></ul><p> upgrade to Custom Breadcrumbs 6.x-1.6 <a class="missing changeset" title="No default repository defined">[5]</a>. </p> <ul><li>If you use the Custom Breadcrumbs module version 2.x for Drupal 7.x, </li></ul><p> upgrade to Custom Breadcrumbs 7.x-2.0-beta1 <a class="missing changeset" title="No default repository defined">[6]</a>. </p> <p> Also see the Custom Breadcrumbs <a class="missing changeset" title="No default repository defined">[7]</a> project page. </p> <hr /> <hr /> <ul><li>Markus Sipilä <a class="missing changeset" title="No default repository defined">[8]</a> </li></ul><hr /> <hr /> <ul><li>Markus Sipilä <a class="missing changeset" title="No default repository defined">[9]</a> </li><li>Colan Schwartz <a class="missing changeset" title="No default repository defined">[10]</a> the module maintainer </li></ul><hr /> <hr /> <ul><li>Greg Knaddison <a class="missing changeset" title="No default repository defined">[11]</a> of the Drupal Security Team </li></ul><hr /> <hr /> <p> The Drupal security team can be reached at security at drupal.org or via the contact form at <a class="ext-link" href="https://www.drupal.org/contact"><span class="icon">​</span>https://www.drupal.org/contact</a> <a class="missing changeset" title="No default repository defined">[12]</a>. </p> <p> Learn more about the Drupal Security team and their policies <a class="missing changeset" title="No default repository defined">[13]</a>, writing secure code for Drupal <a class="missing changeset" title="No default repository defined">[14]</a>, and securing your site <a class="missing changeset" title="No default repository defined">[15]</a>. </p> <p> <a class="missing changeset" title="No default repository defined">[1]</a> <a class="ext-link" href="https://www.drupal.org/project/custom_breadcrumbs"><span class="icon">​</span>https://www.drupal.org/project/custom_breadcrumbs</a> <a class="missing changeset" title="No default repository defined">[2]</a> <a class="ext-link" href="https://www.drupal.org/security-team/risk-levels"><span class="icon">​</span>https://www.drupal.org/security-team/risk-levels</a> <a class="missing changeset" title="No default repository defined">[3]</a> <a class="ext-link" href="http://cve.mitre.org/"><span class="icon">​</span>http://cve.mitre.org/</a> <a class="missing changeset" title="No default repository defined">[4]</a> <a class="ext-link" href="https://www.drupal.org/project/custom_breadcrumbs"><span class="icon">​</span>https://www.drupal.org/project/custom_breadcrumbs</a> <a class="missing changeset" title="No default repository defined">[5]</a> <a class="ext-link" href="https://www.drupal.org/node/2335705"><span class="icon">​</span>https://www.drupal.org/node/2335705</a> <a class="missing changeset" title="No default repository defined">[6]</a> <a class="ext-link" href="https://www.drupal.org/node/2335721"><span class="icon">​</span>https://www.drupal.org/node/2335721</a> <a class="missing changeset" title="No default repository defined">[7]</a> <a class="ext-link" href="https://www.drupal.org/project/custom_breadcrumbs"><span class="icon">​</span>https://www.drupal.org/project/custom_breadcrumbs</a> <a class="missing changeset" title="No default repository defined">[8]</a> <a class="ext-link" href="https://www.drupal.org/user/109674"><span class="icon">​</span>https://www.drupal.org/user/109674</a> <a class="missing changeset" title="No default repository defined">[9]</a> <a class="ext-link" href="https://www.drupal.org/user/109674"><span class="icon">​</span>https://www.drupal.org/user/109674</a> <a class="missing changeset" title="No default repository defined">[10]</a> <a class="ext-link" href="https://www.drupal.org/user/58704"><span class="icon">​</span>https://www.drupal.org/user/58704</a> <a class="missing changeset" title="No default repository defined">[11]</a> <a class="ext-link" href="https://www.drupal.org/user/36762"><span class="icon">​</span>https://www.drupal.org/user/36762</a> <a class="missing changeset" title="No default repository defined">[12]</a> <a class="ext-link" href="https://www.drupal.org/contact"><span class="icon">​</span>https://www.drupal.org/contact</a> <a class="missing changeset" title="No default repository defined">[13]</a> <a class="ext-link" href="https://www.drupal.org/security-team"><span class="icon">​</span>https://www.drupal.org/security-team</a> <a class="missing changeset" title="No default repository defined">[14]</a> <a class="ext-link" href="https://www.drupal.org/writing-secure-code"><span class="icon">​</span>https://www.drupal.org/writing-secure-code</a> <a class="missing changeset" title="No default repository defined">[15]</a> <a class="ext-link" href="https://www.drupal.org/security/secure-configuration"><span class="icon">​</span>https://www.drupal.org/security/secure-configuration</a> </p> <p> <span class="underline"></span><span class="underline"></span><span class="underline"></span><span class="underline"></span><span class="underline"></span><span class="underline"></span><span class="underline"></span><span class="underline"></span><span class="underline"></span><span class="underline"></span><span class="underline"></span><span class="underline">_ Security-news mailing list Security-news@… Unsubscribe at <a class="ext-link" href="https://lists.drupal.org/mailman/listinfo/security-news"><span class="icon">​</span>https://lists.drupal.org/mailman/listinfo/security-news</a> </span></p> Results http://localhost:8080/trac/ticket/785#changelog http://localhost:8080/trac/ticket/777 http://localhost:8080/trac/ticket/777 Mon, 25 Aug 2014 09:18:39 GMT ed <p> Most of the comments to this blog post are only showing up when you are logged in: <a class="ext-link" href="https://www.transitionnetwork.org/blogs/rob-hopkins/2014-07/fiona-ward-learning-celebrate-10000-failure#comment-17492"><span class="icon">​</span>https://www.transitionnetwork.org/blogs/rob-hopkins/2014-07/fiona-ward-learning-celebrate-10000-failure#comment-17492</a> </p> <p> Logged in: 5 comments Not logged in: 1 comment </p> <p> Handing this to Sam but happy for it to escalate. Presumably this issue won't be on this one post only - and it is important. </p> Results http://localhost:8080/trac/ticket/777#changelog http://localhost:8080/trac/ticket/774 http://localhost:8080/trac/ticket/774 Wed, 06 Aug 2014 19:52:54 GMT paul <p> View online: <a class="ext-link" href="https://www.drupal.org/SA-CORE-2014-004"><span class="icon">​</span>https://www.drupal.org/SA-CORE-2014-004</a> </p> <ul><li>Advisory ID: DRUPAL-SA-CORE-2014-004 </li><li>Project: Drupal core <a class="missing changeset" title="No default repository defined">[1]</a> </li><li>Version: 6.x, 7.x </li><li>Date: 2014-August-06 </li><li>Security risk: 13/25 ( Moderately Critical) </li></ul><p> AC:None/A:None/CI:None/II:None/E:Proof/TD:100 <a class="missing changeset" title="No default repository defined">[2]</a> </p> <ul><li>Exploitable from: Remote </li><li>Vulnerability: Denial of service </li></ul><hr /> <hr /> <p> Drupal 6 and Drupal 7 include an XML-RPC endpoint which is publicly available (xmlrpc.php). The PHP XML parser used by this XML-RPC endpoint is vulnerable to an XML entity expansion attack and other related XML payload attacks which can cause CPU and memory exhaustion and the site's database to reach the maximum number of open connections. Any of these may lead to the site becoming unavailable or unresponsive (denial of service). </p> <p> All Drupal sites are vulnerable to this attack whether XML-RPC is used or not. </p> <p> In addition, a similar vulnerability exists in the core OpenID module (for sites that have this module enabled). </p> <p> This is a joint release as the XML-RPC vulnerability also affects <a class="wiki" href="http://localhost:8080/trac/wiki/WordPress">WordPress</a> (see the announcement <a class="missing changeset" title="No default repository defined">[3]</a>). </p> <hr /> <hr /> <ul><li>/A CVE identifier <a class="missing changeset" title="No default repository defined">[4]</a> will be requested, and added upon issuance, in </li></ul><p> accordance with Drupal Security Team processes./ </p> <hr /> <hr /> <ul><li>Drupal core 7.x versions prior to 7.31. </li><li>Drupal core 6.x versions prior to 6.33. </li></ul><hr /> <hr /> <p> Install the latest version: </p> <ul><li>If you use Drupal 7.x, upgrade to Drupal core 7.31 <a class="missing changeset" title="No default repository defined">[5]</a>. </li><li>If you use Drupal 6.x, upgrade to Drupal core 6.33 <a class="missing changeset" title="No default repository defined">[6]</a>. </li></ul><p> If you are unable to install the latest version of Drupal immediately, you can alternatively remove the xmlrpc.php file from the root of Drupal core (or add a rule to .htaccess to prevent access to xmlrpc.php) and disable the OpenID module. These steps are sufficient to mitigate the vulnerability in Drupal core if your site does not require the use of XML-RPC or OpenID functionality. However, this mitigation will not be effective if you are using a contributed module that exposes Drupal's XML-RPC API at a different URL (for example, the Services module); updating Drupal core is therefore strongly recommended. </p> <p> Also see the Drupal core <a class="missing changeset" title="No default repository defined">[7]</a> project page. </p> <hr /> <hr /> <ul><li>Willis Vandevanter <a class="missing changeset" title="No default repository defined">[8]</a> </li><li>Nir Goldshlager <a class="missing changeset" title="No default repository defined">[9]</a> </li></ul><hr /> <hr /> <ul><li>Andrew Nacin <a class="missing changeset" title="No default repository defined">[10]</a> of the <a class="wiki" href="http://localhost:8080/trac/wiki/WordPress">WordPress</a> Security Team </li><li>Michael Adams <a class="missing changeset" title="No default repository defined">[11]</a> of the <a class="wiki" href="http://localhost:8080/trac/wiki/WordPress">WordPress</a> Security Team </li><li>Frédéric Marand <a class="missing changeset" title="No default repository defined">[12]</a> </li><li>David Rothstein <a class="missing changeset" title="No default repository defined">[13]</a> of the Drupal Security Team </li><li>Damien Tournoud <a class="missing changeset" title="No default repository defined">[14]</a> of the Drupal Security Team </li><li>Greg Knaddison <a class="missing changeset" title="No default repository defined">[15]</a> of the Drupal Security Team </li><li>Stéphane Corlosquet <a class="missing changeset" title="No default repository defined">[16]</a> of the Drupal Security Team </li><li>Dave Reid <a class="missing changeset" title="No default repository defined">[17]</a> of the Drupal Security Team </li></ul><hr /> <hr /> <ul><li>The Drupal Security Team <a class="missing changeset" title="No default repository defined">[18]</a> and the <a class="wiki" href="http://localhost:8080/trac/wiki/WordPress">WordPress</a> <a class="missing changeset" title="No default repository defined">[19]</a> Security Team </li></ul><hr /> <hr /> <p> The Drupal security team can be reached at security at drupal.org or via the contact form at <a class="ext-link" href="http://drupal.org/contact"><span class="icon">​</span>http://drupal.org/contact</a> <a class="missing changeset" title="No default repository defined">[20]</a>. </p> <p> Learn more about the Drupal Security team and their policies <a class="missing changeset" title="No default repository defined">[21]</a>, writing secure code for Drupal <a class="missing changeset" title="No default repository defined">[22]</a>, and securing your site <a class="missing changeset" title="No default repository defined">[23]</a>. </p> <p> <a class="missing changeset" title="No default repository defined">[1]</a> <a class="ext-link" href="http://drupal.org/project/drupal"><span class="icon">​</span>http://drupal.org/project/drupal</a> <a class="missing changeset" title="No default repository defined">[2]</a> <a class="ext-link" href="http://drupal.org/security-team/risk-levels"><span class="icon">​</span>http://drupal.org/security-team/risk-levels</a> <a class="missing changeset" title="No default repository defined">[3]</a> <a class="ext-link" href="https://wordpress.org/news/2014/08/wordpress-3-9-2/"><span class="icon">​</span>https://wordpress.org/news/2014/08/wordpress-3-9-2/</a> <a class="missing changeset" title="No default repository defined">[4]</a> <a class="ext-link" href="http://cve.mitre.org/"><span class="icon">​</span>http://cve.mitre.org/</a> <a class="missing changeset" title="No default repository defined">[5]</a> <a class="ext-link" href="http://drupal.org/drupal-7.31-release-notes"><span class="icon">​</span>http://drupal.org/drupal-7.31-release-notes</a> <a class="missing changeset" title="No default repository defined">[6]</a> <a class="ext-link" href="http://drupal.org/drupal-6.33-release-notes"><span class="icon">​</span>http://drupal.org/drupal-6.33-release-notes</a> <a class="missing changeset" title="No default repository defined">[7]</a> <a class="ext-link" href="http://drupal.org/project/drupal"><span class="icon">​</span>http://drupal.org/project/drupal</a> <a class="missing changeset" title="No default repository defined">[8]</a> <a class="ext-link" href="https://www.drupal.org/user/1867894"><span class="icon">​</span>https://www.drupal.org/user/1867894</a> <a class="missing changeset" title="No default repository defined">[9]</a> <a class="ext-link" href="https://www.drupal.org/user/2891345"><span class="icon">​</span>https://www.drupal.org/user/2891345</a> <a class="missing changeset" title="No default repository defined">[10]</a> <a class="ext-link" href="http://profiles.wordpress.org/nacin"><span class="icon">​</span>http://profiles.wordpress.org/nacin</a> <a class="missing changeset" title="No default repository defined">[11]</a> <a class="ext-link" href="http://profiles.wordpress.org/mdawaffe"><span class="icon">​</span>http://profiles.wordpress.org/mdawaffe</a> <a class="missing changeset" title="No default repository defined">[12]</a> <a class="ext-link" href="https://www.drupal.org/user/27985"><span class="icon">​</span>https://www.drupal.org/user/27985</a> <a class="missing changeset" title="No default repository defined">[13]</a> <a class="ext-link" href="https://www.drupal.org/user/124982"><span class="icon">​</span>https://www.drupal.org/user/124982</a> <a class="missing changeset" title="No default repository defined">[14]</a> <a class="ext-link" href="https://www.drupal.org/user/22211"><span class="icon">​</span>https://www.drupal.org/user/22211</a> <a class="missing changeset" title="No default repository defined">[15]</a> <a class="ext-link" href="https://www.drupal.org/u/greggles"><span class="icon">​</span>https://www.drupal.org/u/greggles</a> <a class="missing changeset" title="No default repository defined">[16]</a> <a class="ext-link" href="https://www.drupal.org/user/52142"><span class="icon">​</span>https://www.drupal.org/user/52142</a> <a class="missing changeset" title="No default repository defined">[17]</a> <a class="ext-link" href="https://www.drupal.org/user/53892"><span class="icon">​</span>https://www.drupal.org/user/53892</a> <a class="missing changeset" title="No default repository defined">[18]</a> <a class="ext-link" href="http://drupal.org/security-team"><span class="icon">​</span>http://drupal.org/security-team</a> <a class="missing changeset" title="No default repository defined">[19]</a> <a class="ext-link" href="http://wordpress.org"><span class="icon">​</span>http://wordpress.org</a> <a class="missing changeset" title="No default repository defined">[20]</a> <a class="ext-link" href="http://drupal.org/contact"><span class="icon">​</span>http://drupal.org/contact</a> <a class="missing changeset" title="No default repository defined">[21]</a> <a class="ext-link" href="http://drupal.org/security-team"><span class="icon">​</span>http://drupal.org/security-team</a> <a class="missing changeset" title="No default repository defined">[22]</a> <a class="ext-link" href="http://drupal.org/writing-secure-code"><span class="icon">​</span>http://drupal.org/writing-secure-code</a> <a class="missing changeset" title="No default repository defined">[23]</a> <a class="ext-link" href="http://drupal.org/security/secure-configuration"><span class="icon">​</span>http://drupal.org/security/secure-configuration</a> </p> <p> <span class="underline"></span><span class="underline"></span><span class="underline"></span><span class="underline"></span><span class="underline"></span><span class="underline"></span><span class="underline"></span><span class="underline"></span><span class="underline"></span><span class="underline"></span><span class="underline"></span><span class="underline">_ Security-news mailing list Security-news@… Unsubscribe at <a class="ext-link" href="https://lists.drupal.org/mailman/listinfo/security-news"><span class="icon">​</span>https://lists.drupal.org/mailman/listinfo/security-news</a> </span></p> Results http://localhost:8080/trac/ticket/774#changelog http://localhost:8080/trac/ticket/773 http://localhost:8080/trac/ticket/773 Wed, 06 Aug 2014 09:58:14 GMT annesley <p> hi, am trying to get a copy of the current TN.org D6 database and filesystem down to my laptop to develop against. i had pulled from GIT, backed up from Backup&amp;Migrate and got everything working but there are things missing. </p> <p> so i want to do a file copy. i started a tar operation but the tar size went over 1.3GB and i stopped it because it shouldn't be that big. as always BOA has restricted use of the "du" command so i can't really tell why the tar was so big. and i can't "df" to see if it's a problem </p> <p> should i let it continue? why is it so big? </p> Results http://localhost:8080/trac/ticket/773#changelog http://localhost:8080/trac/ticket/755 http://localhost:8080/trac/ticket/755 Tue, 08 Jul 2014 09:21:16 GMT ed <p> Rob Hopkins reached the limit for file uploads and could not upload any more images (not good for him as he writes posts with lots of pictures daily). </p> <p> Sam raised the limit. This change in the limit does not seem to have affected Rob's situation - he still can't upload any images. </p> <p> Looking at these settings: <a class="ext-link" href="https://www.transitionnetwork.org/admin/settings/uploads"><span class="icon">​</span>https://www.transitionnetwork.org/admin/settings/uploads</a> </p> <p> Rob should be able to upload more - he is a site editor and admin - but he can't. </p> <p> Please investigate </p> Results http://localhost:8080/trac/ticket/755#changelog http://localhost:8080/trac/ticket/751 http://localhost:8080/trac/ticket/751 Tue, 01 Jul 2014 11:14:42 GMT ed <ol><li>Change the email alert template for news items to include the term 'news item' so it is: </li></ol><p> "New news item: [title]" </p> <ol start="2"><li>When users click on the subs links at the bottom of their email alerts, and they are not logged in they get the ‘access denied’ screen. This is not good. Please investigate </li></ol><p> (a) can this be changed (with small time investment) (b) can we change the access denied blurb to include something human encouraging the user to login to continue the journey: </p> <p> "We are sorry for the inconvenience, but if you are seeing this screen having followed a link, you will probably need to login to continue with your request" (NB if they are coming from an email link with their id in it, how do we keep that journey so they get to the destinateion they wanted?) </p> <ol start="3"><li>When user clicks on the general subs link at the bottom of an email alert (and is not logged in), they get a 403 forbidden page. Not good - pls investigage </li></ol> Results http://localhost:8080/trac/ticket/751#changelog http://localhost:8080/trac/ticket/724 http://localhost:8080/trac/ticket/724 Tue, 29 Apr 2014 09:21:12 GMT sam <p> A user has got in touch to let us know he is not getting Rob's updates by email. He's still subscribed. </p> <p> I just checked my mail and the last one I received was on the 11/4. I'll have a look and see if I can work it out. </p> Results http://localhost:8080/trac/ticket/724#changelog http://localhost:8080/trac/ticket/708 http://localhost:8080/trac/ticket/708 Thu, 27 Mar 2014 13:44:29 GMT sam <p> <a class="ext-link" href="https://www.transitionnetwork.org/initiatives/heal-soil-csa-community-supported-agriculture"><span class="icon">​</span>https://www.transitionnetwork.org/initiatives/heal-soil-csa-community-supported-agriculture</a> Address is correct, but doesn’t appear. The person who put it there doesn’t appear on the people map either, so wondering what’s afoot. </p> Results http://localhost:8080/trac/ticket/708#changelog http://localhost:8080/trac/ticket/704 http://localhost:8080/trac/ticket/704 Wed, 26 Mar 2014 13:51:48 GMT ed <p> The REconomy logo is not scaling and being re-presented well on the project page: <a class="ext-link" href="https://www.transitionnetwork.org/projects/reconomy"><span class="icon">​</span>https://www.transitionnetwork.org/projects/reconomy</a> </p> <p> Is this a theme/design issue or a problem with image re-sizing? </p> <p> What can we do about it? </p> Results http://localhost:8080/trac/ticket/704#changelog http://localhost:8080/trac/ticket/703 http://localhost:8080/trac/ticket/703 Wed, 26 Mar 2014 13:06:15 GMT ed <p> The REconomy logo is not scaling and being re-presented well on the project page: <a class="ext-link" href="https://www.transitionnetwork.org/projects/reconomy"><span class="icon">​</span>https://www.transitionnetwork.org/projects/reconomy</a> </p> <p> Is this a theme/design issue or a problem with image re-sizing? </p> <p> What can we do about it? </p> Results http://localhost:8080/trac/ticket/703#changelog http://localhost:8080/trac/ticket/702 http://localhost:8080/trac/ticket/702 Fri, 21 Mar 2014 17:11:14 GMT ed <p> I can't remove the attachments from the Trustees page: <a class="ext-link" href="https://www.transitionnetwork.org/about/people/trustees"><span class="icon">​</span>https://www.transitionnetwork.org/about/people/trustees</a> </p> <p> please investigate and sort if you can. We need to remove all the attachments apart from those in 2013. </p> Results http://localhost:8080/trac/ticket/702#changelog http://localhost:8080/trac/ticket/693 http://localhost:8080/trac/ticket/693 Thu, 27 Feb 2014 16:18:04 GMT sam <p> Hi Paul </p> <p> You'll see from this ticket; <a class="ext-link" href="https://trac.transitionnetwork.org/trac/ticket/582"><span class="icon">​</span>https://trac.transitionnetwork.org/trac/ticket/582</a> </p> <p> That the 6.29 &gt; 6.30 core update patches bugs that don't affect us. </p> <p> However some recent security updates for modules have been released recently; <a class="ext-link" href="https://www.transitionnetwork.org/admin/reports/updates"><span class="icon">​</span>https://www.transitionnetwork.org/admin/reports/updates</a> </p> <p> Affected modules are; </p> <p> ctools; <a class="ext-link" href="https://drupal.org/node/2194547"><span class="icon">​</span>https://drupal.org/node/2194547</a> </p> <p> filefield <a class="ext-link" href="https://drupal.org/node/2194103"><span class="icon">​</span>https://drupal.org/node/2194103</a> </p> <p> image resizer <a class="ext-link" href="https://drupal.org/node/2194063"><span class="icon">​</span>https://drupal.org/node/2194063</a> </p> <p> mimemail <a class="ext-link" href="https://drupal.org/node/2205939"><span class="icon">​</span>https://drupal.org/node/2205939</a> </p> <p> webform <a class="ext-link" href="https://drupal.org/node/2194181"><span class="icon">​</span>https://drupal.org/node/2194181</a> </p> <p> The ctools &amp; webform ones look like ones we should get on top of soonish, the mimemail one looks like it could be a pain. </p> <p> Are you up for testing the updates on your local box? We can then figure out how to roll them out to the live site. </p> <p> Thanks </p> <p> Sam </p> Results http://localhost:8080/trac/ticket/693#changelog http://localhost:8080/trac/ticket/680 http://localhost:8080/trac/ticket/680 Mon, 20 Jan 2014 12:28:18 GMT chris <p> The <a class="ext-link" href="https://www.transitionnetwork.org/"><span class="icon">​</span>front page of the site</a> contains the following elements using HTTP when accessing the site using HTTPS: </p> <pre class="wiki"> &lt;div class="views-field-field-slide-image-fid"&gt; &lt;span class="field-content"&gt;&lt;img src="http://www.transitionnetwork.org/sites/www.transitionnetwork.org/files/imagecache/slideshow_660/images/slides/capture1.jpg" alt="" title="" width="700" height="306" class="imagecache imagecache-slideshow_660 imagecache-default imagecache-slideshow_660_default"/&gt;&lt;/span&gt; &lt;/div&gt; </pre><pre class="wiki"> &lt;div class="views-field-field-slide-destination-link-url"&gt; &lt;span class="field-content"&gt;&lt;a href="http://www.transitionnetwork.org/about" 0="a:0:{}" class="learn"&gt;Learn more about Transition Network »&lt;/a&gt;&lt;/span&gt; &lt;/div&gt; </pre><pre class="wiki"> &lt;div class="views-field-field-slide-image-fid"&gt; &lt;span class="field-content"&gt;&lt;img src="http://www.transitionnetwork.org/sites/www.transitionnetwork.org/files/imagecache/slideshow_660/images/slides/clay.jpg" alt="" title="" width="700" height="306" class="imagecache imagecache-slideshow_660 imagecache-default imagecache-slideshow_660_default"/&gt;&lt;/span&gt; &lt;/div&gt; </pre><pre class="wiki"> &lt;div class="views-field-field-slide-destination-link-url"&gt; &lt;span class="field-content"&gt;&lt;a href="http://www.transitionnetwork.org/blogs/rob-hopkins/2014-01/can-earth-building-scale-mainstream-1-clayworks-and-clay-plasters" 0="a:0:{}" class="learn"&gt;Read more here »&lt;/a&gt;&lt;/span&gt; &lt;/div&gt; </pre><pre class="wiki"> &lt;div class="views-field-field-slide-image-fid"&gt; &lt;span class="field-content"&gt;&lt;img src="http://www.transitionnetwork.org/sites/www.transitionnetwork.org/files/imagecache/slideshow_660/images/slides/frack3.jpg" alt="" title="" width="700" height="306" class="imagecache imagecache-slideshow_660 imagecache-default imagecache-slideshow_660_default"/&gt;&lt;/span&gt; &lt;/div&gt; </pre><pre class="wiki"> &lt;div class="views-field-field-slide-destination-link-url"&gt; &lt;span class="field-content"&gt;&lt;a href="http://www.transitionnetwork.org/blogs/rob-hopkins/2014-01/6-reasons-why-theres-no-community-fracking" 0="a:0:{}" class="learn"&gt;Read more here »&lt;/a&gt;&lt;/span&gt; &lt;/div&gt; </pre><pre class="wiki"> &lt;div class="views-field-field-slide-image-fid"&gt; &lt;span class="field-content"&gt;&lt;img src="http://www.transitionnetwork.org/sites/www.transitionnetwork.org/files/imagecache/slideshow_660/images/slides/pc1.jpg" alt="" title="" width="700" height="306" class="imagecache imagecache-slideshow_660 imagecache-default imagecache-slideshow_660_default"/&gt;&lt;/span&gt; &lt;/div&gt; </pre><pre class="wiki"> &lt;div class="views-field-field-featured-image-fid"&gt; &lt;span class="field-content"&gt;&lt;a href="/news/2013-12-17/november-and-december-round-what-s-happening-out-world-transition" class="imagecache imagecache-featured_image_thumb imagecache-linked imagecache-featured_image_thumb_linked"&gt;&lt;img src="http://www.transitionnetwork.org/sites/www.transitionnetwork.org/files/imagecache/featured_image_thumb/chilesml.jpg" alt="Chile Transition Training" title="Chile Transition Training" width="150" height="101" class="imagecache imagecache-featured_image_thumb"/&gt;&lt;/a&gt;&lt;/span&gt; &lt;/div&gt; </pre><p> Would it be possible to embed content from the site using URLS like <tt>/sites/www.transitionnetwork.org/files/imagecache/featured_image_thumb/chilesml.jpg</tt> rather than <tt>http://www.transitionnetwork.org/sites/www.transitionnetwork.org/files/imagecache/featured_image_thumb/chilesml.jpg</tt> ? </p> <p> Changing these links would result in the mixed content warnings in browsers going away. </p> <p> By default Firefox doesn't block HTTP content over HTTPS connections, however you can enable this by entering <tt>about:config</tt> in the URL bar are searching for <tt>mixed_content</tt> and then changing <tt>security.mixed_content.block_display_content</tt> to <strong>true</strong> if you want to see how the site looks when only secure content is loaded. </p> <p> I have checked that the site does set the <strong>secure</strong> flag on the authentication cookie, so the mixed content shouldn't result in the authentication cookie being sent with unencrypted requests. </p> <p> Further information: </p> <ul><li><a class="ext-link" href="https://blog.mozilla.org/tanvi/2013/04/10/mixed-content-blocking-enabled-in-firefox-23"><span class="icon">​</span>https://blog.mozilla.org/tanvi/2013/04/10/mixed-content-blocking-enabled-in-firefox-23</a> </li></ul> Results http://localhost:8080/trac/ticket/680#changelog http://localhost:8080/trac/ticket/679 http://localhost:8080/trac/ticket/679 Fri, 17 Jan 2014 17:15:58 GMT sam <p> Filtering the initiatives by country is not working </p> <p> <a class="ext-link" href="https://www.transitionnetwork.org/initiatives?themes=All&amp;community_type=All&amp;status_value=All&amp;country=at&amp;field_title_search="><span class="icon">​</span>https://www.transitionnetwork.org/initiatives?themes=All&amp;community_type=All&amp;status_value=All&amp;country=at&amp;field_title_search=</a> </p> <p> I had a play with the view on stg2.transitionnetwork.org but I couldn't get it working. </p> <p> It should display only initiatives from the country selected in the filter. It is displaying initiatives from all countries &amp; not respecting the filter. </p> <p> This view is used a lot by international initiatives. </p> Results http://localhost:8080/trac/ticket/679#changelog http://localhost:8080/trac/ticket/667 http://localhost:8080/trac/ticket/667 Wed, 08 Jan 2014 16:40:47 GMT ed <p> Work by the Ttech team to share Jim's knowledge and tasks around the team before he leaves in early February 2014. Please use this ticket to log your time spent on this. </p> Results http://localhost:8080/trac/ticket/667#changelog http://localhost:8080/trac/ticket/663 http://localhost:8080/trac/ticket/663 Wed, 18 Dec 2013 17:44:43 GMT ed <p> We are wrapping up the PSE to simplify our web traffic, codebase and support requirements before we move to TNv3. </p> <p> Ed has informed all the PSE alpha triallists twice and asked them to remove their widgets. About half have. Others say they will. So we can remove the service any time from now on. </p> <p> Ed has UNpublished the following pages: </p> <ul><li>/pse/create </li><li>/pse/about </li><li>/pse/faq </li></ul><p> Jim - time to de-commission the service in a suitable way. Wrap this puppy up and turn it off. Please outline what you are going to do on this ticket and then do it. </p> <p> Ed suggests this is work for January 2014. </p> <p> Sam, Chris, fyi and any other changes needed? </p> Results http://localhost:8080/trac/ticket/663#changelog http://localhost:8080/trac/ticket/659 http://localhost:8080/trac/ticket/659 Mon, 16 Dec 2013 17:03:41 GMT ed <p> Rob cleared the nodequeue for the featured story on the homepage about three hours ago, removed all but one story. No change has been observed. Please investigate: </p> <p> Nodequeue: <a class="ext-link" href="https://www.transitionnetwork.org/admin/content/nodequeue/6/view/5"><span class="icon">​</span>https://www.transitionnetwork.org/admin/content/nodequeue/6/view/5</a> </p> <p> This view: <a class="ext-link" href="https://www.transitionnetwork.org/admin/build/views/edit/featured_content?destination=newhome#views-tab-panel_pane_1"><span class="icon">​</span>https://www.transitionnetwork.org/admin/build/views/edit/featured_content?destination=newhome#views-tab-panel_pane_1</a> </p> <p> This is using content cache </p> Results http://localhost:8080/trac/ticket/659#changelog http://localhost:8080/trac/ticket/658 http://localhost:8080/trac/ticket/658 Mon, 16 Dec 2013 14:59:38 GMT ed <p> The SRs are reporting very slow site updates - is this to do with not switching them over to the new views content caching? please check: </p> <p> <a class="ext-link" href="https://www.transitionnetwork.org/admin/build/views/edit/blogs?destination=stories#views-tab-panel_pane_2"><span class="icon">​</span>https://www.transitionnetwork.org/admin/build/views/edit/blogs?destination=stories#views-tab-panel_pane_2</a> </p> <p> <a class="ext-link" href="https://www.transitionnetwork.org/admin/build/block/configure/views/blogs-block_1?destination=newhome"><span class="icon">​</span>https://www.transitionnetwork.org/admin/build/block/configure/views/blogs-block_1?destination=newhome</a> </p> <p> And elsewhere there may be SR latest views? </p> Results http://localhost:8080/trac/ticket/658#changelog http://localhost:8080/trac/ticket/657 http://localhost:8080/trac/ticket/657 Mon, 16 Dec 2013 14:30:49 GMT ed <p> Big picture slideshow on TN homepage: Rob can't get it to go in the order he wants - please investigate: </p> <p> It is this nodequeue: <a class="ext-link" href="https://www.transitionnetwork.org/admin/content/nodequeue/9/view/8"><span class="icon">​</span>https://www.transitionnetwork.org/admin/content/nodequeue/9/view/8</a> </p> <p> Made up with these CTs: <a class="ext-link" href="https://www.transitionnetwork.org/admin/content/node-type/slide"><span class="icon">​</span>https://www.transitionnetwork.org/admin/content/node-type/slide</a> </p> Results http://localhost:8080/trac/ticket/657#changelog http://localhost:8080/trac/ticket/654 http://localhost:8080/trac/ticket/654 Thu, 12 Dec 2013 12:43:12 GMT ed <p> Some TIs are appearing in the 'Initiatives by number' view - but don't have numbers: </p> <p> <a class="ext-link" href="https://www.transitionnetwork.org/initiatives/by-number"><span class="icon">​</span>https://www.transitionnetwork.org/initiatives/by-number</a> </p> <p> for Sam to invesitage and solve or put to techs in January </p> Results http://localhost:8080/trac/ticket/654#changelog http://localhost:8080/trac/ticket/653 http://localhost:8080/trac/ticket/653 Thu, 12 Dec 2013 11:36:53 GMT ed <p> For January: set up a report for ingredients content type: </p> <ul><li>downloadable in .xls </li><li>ingredient title </li><li>URL (must be a hyperlink generated in .csv) </li><li>node reference </li></ul><p> No ingredients report exists yet - but lots of others here: ​<a class="ext-link" href="https://www.transitionnetwork.org/admin/reports"><span class="icon">​</span>https://www.transitionnetwork.org/admin/reports</a> </p> Results http://localhost:8080/trac/ticket/653#changelog http://localhost:8080/trac/ticket/652 http://localhost:8080/trac/ticket/652 Thu, 12 Dec 2013 11:34:49 GMT ed <p> For January: set up a report for tools content type: </p> <ul><li>downloadable in .xls </li><li>resource title </li><li>URL (must be a hyperlink generated in .csv) </li><li>node reference </li></ul><p> you will be able to work from this report: <a class="ext-link" href="https://www.transitionnetwork.org/admin/reports/resources"><span class="icon">​</span>https://www.transitionnetwork.org/admin/reports/resources</a> </p> Results http://localhost:8080/trac/ticket/652#changelog http://localhost:8080/trac/ticket/651 http://localhost:8080/trac/ticket/651 Thu, 12 Dec 2013 11:33:22 GMT ed <p> For January: set up a report for tools content type: </p> <ul><li>downloadable in .xls </li><li>tool title </li><li>URL (must be a hyperlink generated in .csv) </li><li>node reference </li></ul><p> No tools report exists yet - but lots of others here: <a class="ext-link" href="https://www.transitionnetwork.org/admin/reports"><span class="icon">​</span>https://www.transitionnetwork.org/admin/reports</a> </p> Results http://localhost:8080/trac/ticket/651#changelog http://localhost:8080/trac/ticket/650 http://localhost:8080/trac/ticket/650 Thu, 12 Dec 2013 11:00:08 GMT ed <p> Sarah will be working on the TN strategy and this is about the content and comms tactics therein. The guiding principle is to use TN.org as the most suitable place for this material and conversations, and social media and direct mailshots for marketing and communicating it (because Sarah/TN cannot manage multiple conversations in multiple locations atm). </p> <p> This is work for Sam to do from January onwards </p> <ol><li>set up a landing page ".../TN-strategy-consultation" with its own RHS block with manual links to different documents and interviews </li></ol><p> SAM this can be a normal page with anchor links etc. </p> <ol start="2"><li>Use of blogs </li><li>Rob's for outreach - it's got the momentum - for updates/alerts/subscriptions </li><li>Sarah's for continuity (and looking back at it) - using tag "fn-strategy-consultation" </li></ol><ol start="3"><li>other places for comms/engagement </li><li>Forums not good; too open to trolls and spam; better in blog comments </li><li>webinar? Possibly if suitable </li><li>FB, twitter, other marketing channels - for marketing only </li><li>online meeting with national hubs - quite possibly </li></ol><ol start="4"><li>Direct Mail shot to PPOCs </li><li>Sarah Let Sam know if this is happening; Sam you'll need to do an export of PPOCs (<a class="ext-link" href="https://www.transitionnetwork.org/admin/reports/initiatives/primary-contacts"><span class="icon">​</span>https://www.transitionnetwork.org/admin/reports/initiatives/primary-contacts</a>), tidy and dump into mail chimp using the standard template </li></ol> Results http://localhost:8080/trac/ticket/650#changelog http://localhost:8080/trac/ticket/649 http://localhost:8080/trac/ticket/649 Thu, 12 Dec 2013 10:53:16 GMT ed <p> seen here: </p> <p> <a class="ext-link" href="https://www.transitionnetwork.org/admin/content/node-type/films"><span class="icon">​</span>https://www.transitionnetwork.org/admin/content/node-type/films</a> </p> <p> <a class="ext-link" href="https://www.transitionnetwork.org/films"><span class="icon">​</span>https://www.transitionnetwork.org/films</a> <a class="ext-link" href="https://www.transitionnetwork.org/films/occupy-love"><span class="icon">​</span>https://www.transitionnetwork.org/films/occupy-love</a> </p> Results http://localhost:8080/trac/ticket/649#changelog http://localhost:8080/trac/ticket/648 http://localhost:8080/trac/ticket/648 Thu, 12 Dec 2013 10:49:39 GMT ed <p> Ed has edited the contact form replies for webproject@… on the contact form for TN.org which will now reply to users saying this: </p> <p> "Thank you for getting in touch. Please note that the website support is part time; and between mid-December 2013 and mid-January 2014 we are handing over the website support work as Ed goes on Paternity leave and Sam comes onboard, so please be patient - your replies are likely to take more time than usual. " </p> <p> <a class="ext-link" href="https://www.transitionnetwork.org/admin/build/contact"><span class="icon">​</span>https://www.transitionnetwork.org/admin/build/contact</a> </p> <p> SAM - when you are ready - probably mid-Jan - you will want to edit this back to something more suitable like: </p> <p> Thank you for getting in touch. Please note that the website support is part time, so while we will get back to you as soon as we can, that may be a few days </p> Results http://localhost:8080/trac/ticket/648#changelog http://localhost:8080/trac/ticket/637 http://localhost:8080/trac/ticket/637 Thu, 28 Nov 2013 09:40:48 GMT ed <p> <a class="ext-link" href="http://www.transitionnetwork.org/news"><span class="icon">​</span>http://www.transitionnetwork.org/news</a> <a class="ext-link" href="http://www.transitionnetwork.org/blogs/rob-hopkins"><span class="icon">​</span>http://www.transitionnetwork.org/blogs/rob-hopkins</a> </p> <p> what is the teaser length - ie the first paragraph of a news or blog item that is published in the listings views? </p> <p> rob wants to know how many words he has for his introductions... </p> Results http://localhost:8080/trac/ticket/637#changelog http://localhost:8080/trac/ticket/634 http://localhost:8080/trac/ticket/634 Wed, 27 Nov 2013 11:50:23 GMT ed <p> I couldn't embed a 'paper.li' embed into a page recently and forgot about it. Now I can't embed a slideshare embed either adn wonder if I am seeing a pattern. </p> <p> Please look and advise: <a class="ext-link" href="https://www.transitionnetwork.org/blogs/ed-mitchell/2013-11/web-strategy-update"><span class="icon">​</span>https://www.transitionnetwork.org/blogs/ed-mitchell/2013-11/web-strategy-update</a> </p> Results http://localhost:8080/trac/ticket/634#changelog http://localhost:8080/trac/ticket/633 http://localhost:8080/trac/ticket/633 Mon, 25 Nov 2013 15:27:15 GMT ed <p> Re-arrange/add/edit the RHS blocks to appear the order below </p> <ol><li>Why/how etc. : NO change </li><li>newsletter promo: NO change </li><li>POJDS book button: much smaller - can you set book image to lhs and buy button to rhs within block? might need a special .png to have both in it </li><li>Transition nearby button: NO change </li><li>New iT2 film promo button: needs a graphic </li><li>New TFP button: NEW: Trucie providing a graphic to fit in </li><li>Training button: NEW: Ed asking for training graphic to fit in </li><li>Social media promo button: NEW: needs some very modest SM logos to link to SM outposts FB and twitter </li></ol><p> NB: Rob is only thinking of the homepage; Ed is not sure of the implications elsewhere on site... please advise on how/if this affects things elsewhere... </p> Results http://localhost:8080/trac/ticket/633#changelog http://localhost:8080/trac/ticket/628 http://localhost:8080/trac/ticket/628 Thu, 21 Nov 2013 16:50:37 GMT ed <p> The space notifications are coming from "space.transitionnetwork.org" &lt;jim@…&gt; </p> <p> can you make them from "space.transitionnetwork.org" and a suitable TN address? </p> <p> Do I need to set up a suitable TN address? Perhaps </p> <p> space@…? </p> <p> Or is there a standard drupal system one in place already? </p> Results http://localhost:8080/trac/ticket/628#changelog http://localhost:8080/trac/ticket/627 http://localhost:8080/trac/ticket/627 Wed, 20 Nov 2013 16:08:43 GMT ed <p> Can users delete their own accounts? I've looked at user settings and can't find any clues? Can you point me to a user account setting which would enable them to delete their own accounts (and their profiles by proxy)? </p> Results http://localhost:8080/trac/ticket/627#changelog http://localhost:8080/trac/ticket/624 http://localhost:8080/trac/ticket/624 Tue, 19 Nov 2013 11:16:02 GMT ed <p> Rob is doing an austerity special over 8 days, with a different clip from an interview with NEF every day. I've set up a page here: /austerity-basics </p> <p> Question: </p> <p> I know we can handle comments on pages, and I know that I don't get notifications of them. Can we arrange comment notifications for a page - asap - so that commenters get updates? </p> <p> If not, no problem. I heard about this plan *today* so am not expecting any massive tech leaps. </p> Results http://localhost:8080/trac/ticket/624#changelog http://localhost:8080/trac/ticket/623 http://localhost:8080/trac/ticket/623 Mon, 18 Nov 2013 17:21:46 GMT ed <p> do we keep any revisions of content? we had this conversation years ago, it came up in a recent social reporters webinar, I can't see any evidence of revisions activity... </p> Results http://localhost:8080/trac/ticket/623#changelog http://localhost:8080/trac/ticket/622 http://localhost:8080/trac/ticket/622 Mon, 18 Nov 2013 17:06:59 GMT ed <p> <a class="ext-link" href="https://www.transitionnetwork.org/initiatives/map"><span class="icon">​</span>https://www.transitionnetwork.org/initiatives/map</a> <a class="ext-link" href="https://www.transitionnetwork.org/initiatives/exeter-nh-transition-town"><span class="icon">​</span>https://www.transitionnetwork.org/initiatives/exeter-nh-transition-town</a> </p> <p> please attend </p> Results http://localhost:8080/trac/ticket/622#changelog http://localhost:8080/trac/ticket/621 http://localhost:8080/trac/ticket/621 Mon, 18 Nov 2013 09:22:59 GMT ed <p> Two bits of the homepage are taking ages to update once Rob has made the changes and it's driving him spare. He's waiting up to 30 mins for them to update. </p> <p> Please speed up the times that it takes the system to update these two parts of the homepage to *instant* if possible: </p> <ol><li>Slideshow on homepage (AKA: <a class="ext-link" href="https://www.transitionnetwork.org/admin/build/views/edit/slideshows?destination=newhome#views-tab-panel_pane_1"><span class="icon">​</span>https://www.transitionnetwork.org/admin/build/views/edit/slideshows?destination=newhome#views-tab-panel_pane_1</a>). </li></ol><ol start="2"><li>Latest Transition Culture Blog pane on Homepage (AKA <a class="ext-link" href="https://www.transitionnetwork.org/admin/build/views/edit/tc_latest_blog?destination=newhome#views-tab-block_1"><span class="icon">​</span>https://www.transitionnetwork.org/admin/build/views/edit/tc_latest_blog?destination=newhome#views-tab-block_1</a>) </li></ol> Results http://localhost:8080/trac/ticket/621#changelog http://localhost:8080/trac/ticket/617 http://localhost:8080/trac/ticket/617 Mon, 11 Nov 2013 17:16:37 GMT ed <p> I want to add a link to the email a user receives following their creation of an account. </p> <p> this one: Subject: Account details for [user] at Transition Network </p> <p> Can I do this myself? I've looked in subs, notifications, logintoboggan etc. and can't find the place </p> <p> is it do-able? </p> Results http://localhost:8080/trac/ticket/617#changelog http://localhost:8080/trac/ticket/616 http://localhost:8080/trac/ticket/616 Mon, 11 Nov 2013 09:56:14 GMT ed <p> Initiatives Map not showing on http </p> <p> here error message: This web site needs a different Google Maps API key. A new key can be generated at <a class="ext-link" href="http://code.google.com/apis/maps/documentation/javascript/v2/introduction.html#Obtaining_Key"><span class="icon">​</span>http://code.google.com/apis/maps/documentation/javascript/v2/introduction.html#Obtaining_Key</a>. </p> <p> is this related to <a class="closed ticket" href="http://localhost:8080/trac/ticket/615" title="task: Move to GMap 6.x-2.x-dev as and get clusterer to work (closed: fixed)">#615</a>? </p> Results http://localhost:8080/trac/ticket/616#changelog http://localhost:8080/trac/ticket/615 http://localhost:8080/trac/ticket/615 Sun, 10 Nov 2013 18:14:51 GMT jim <p> This is largely done, but the only tasks left are: </p> <ol><li>Make a patch and add to our makefile so our custom markers appear ok. </li><li>Get the clusterer to work per the comments &amp; issues in <a href="http://localhost:8080/trac/ticket/615#comment:1" title="Comment 1 for Ticket #615">comment:1</a> below. </li></ol><p> Per an email I got from Google: </p> <blockquote class="citation"> <p> As you may be aware, <a class="missing wiki">JavaScript?</a> Maps API v2 was scheduled for shutdown on May 19, 2013. After listening to feedback from developers we decided to extend the deprecation timeline by six months, to November 19, 2013 to allow more time for migration to v3 of the API. </p> </blockquote> <blockquote class="citation"> <p> On November 19, 2013 we will deploy a <a class="missing wiki">JavaScript?</a> wrapper that attempts to automagically turn remaining v2 maps into v3 maps. Though we expect this wrapper to work for most simple maps, we cannot guarantee that your maps will continue to function. We therefore highly recommend that you migrate to v3 before November 19. The good news is that Google Maps <a class="missing wiki">JavaScript?</a> API v3 is more robust and feature rich than v2, and we’ve written a guide to assist the migration. </p> </blockquote> <p> So this ticket is to do the update to the GMap module, testing and tweaking. </p> <p> Critical as we only have until 19 November for this... </p> Results http://localhost:8080/trac/ticket/615#changelog http://localhost:8080/trac/ticket/614 http://localhost:8080/trac/ticket/614 Wed, 06 Nov 2013 16:49:49 GMT ed <p> We want a button on the Social Reporters section that enables users to easily subscribe to the Social Reporters' blog posts CT. Offers the option to all types of user: </p> <ol class="loweralpha"><li>Users may not be logged in </li><li>Users may not be registered </li></ol><ol><li>This is a bit like the sub button on Transition Culture section </li><li>I can't find it in TRAC but have this memory of enabling email-only subscriptions to not-registered-users from olden days - can you enlighten me about that? I'm not sure it's the answer - we probably want them to register so they can add comments - but this request has brought up that old function </li></ol><p> .. </p> Results http://localhost:8080/trac/ticket/614#changelog http://localhost:8080/trac/ticket/608 http://localhost:8080/trac/ticket/608 Mon, 14 Oct 2013 08:37:38 GMT ed <p> The user profile pictures on the user profile nodes are too big. </p> <p> e.g. <a class="ext-link" href="https://transitionnetwork.org/people/tina-clarke"><span class="icon">​</span>https://transitionnetwork.org/people/tina-clarke</a> </p> <p> Please investigate and restrain them into a suitable maximum size </p> <p> NB: Ed is keeping a number of small UI-ish tickets back for Ben to do in a lump when we've built up enough so don't do anything yet. </p> Results http://localhost:8080/trac/ticket/608#changelog http://localhost:8080/trac/ticket/605 http://localhost:8080/trac/ticket/605 Thu, 03 Oct 2013 13:35:17 GMT ed <p> I use this view when I need to find subscriptions for users who are receiving email alerts to old accounts: <a class="ext-link" href="https://www.transitionnetwork.org/admin/messaging/subscriptions"><span class="icon">​</span>https://www.transitionnetwork.org/admin/messaging/subscriptions</a> </p> <p> I am finding that if a user changes their email address in their user account, it does not update that email address in the subscriptions settings, so they continue to receive alerts to their old address. So I go to this view, dig out the incorrect sub, and kill it. </p> <p> Which is a PITA. </p> <p> Can we make it possible to make the 'users' column clickable so I could re-order it alphabetically? That would be really cool. </p> Results http://localhost:8080/trac/ticket/605#changelog http://localhost:8080/trac/ticket/602 http://localhost:8080/trac/ticket/602 Thu, 03 Oct 2013 09:14:43 GMT ed <ol><li>Blogs feed not working: </li></ol><p> <a class="ext-link" href="https://www.transitionnetwork.org/blogs/feed/"><span class="icon">​</span>https://www.transitionnetwork.org/blogs/feed/</a> </p> <ol start="2"><li>Rob's blog not working: </li></ol><p> <a class="ext-link" href="https://www.transitionnetwork.org/blogs/feed/rob-hopkins"><span class="icon">​</span>https://www.transitionnetwork.org/blogs/feed/rob-hopkins</a> </p> <ol start="3"><li>Getting complaints from users who are getting multiple copies of each blog post. Can't check this as the feed is down, but I've got 2 or 3 complaints in my inbox. </li></ol> Results http://localhost:8080/trac/ticket/602#changelog http://localhost:8080/trac/ticket/584 http://localhost:8080/trac/ticket/584 Wed, 04 Sep 2013 08:33:12 GMT ed <p> The news CT has a featured image, but it doesn't seem to be handling it as expected (succesfully on the blogs). See this news item: </p> <p> <a class="ext-link" href="https://www.transitionnetwork.org/news/2013-09-03/new-economy-20-enterprises-report-released"><span class="icon">​</span>https://www.transitionnetwork.org/news/2013-09-03/new-economy-20-enterprises-report-released</a> </p> <p> The featured image isn't visible anywhere - either: </p> <ol class="loweralpha"><li>in the news item itself </li><li>in the /news view </li></ol><p> Please investigate and resolve </p> Results http://localhost:8080/trac/ticket/584#changelog http://localhost:8080/trac/ticket/581 http://localhost:8080/trac/ticket/581 Mon, 26 Aug 2013 13:24:17 GMT ed <p> Please remove the option for site editors/admins to 'add this to the newsletter' (which would send it to the newsletter nodequeue). Please also for now make the newsletter nodequeue non-active. </p> <p> It's been confusing for staff members, and was for the simmplemail service really, so we're going to trial using a google doc for staff to add their stories to the newsletter instead. </p> Results http://localhost:8080/trac/ticket/581#changelog http://localhost:8080/trac/ticket/578 http://localhost:8080/trac/ticket/578 Mon, 12 Aug 2013 13:33:58 GMT ed <p> Can we set the email alerts to auto-subscribe users to comments threads that they have made comments on? ie I make a comment to blog post x, then I get email alerts of the new comments made to blog post x. </p> Results http://localhost:8080/trac/ticket/578#changelog http://localhost:8080/trac/ticket/575 http://localhost:8080/trac/ticket/575 Wed, 31 Jul 2013 14:39:11 GMT ed <p> Everyone who registers for the last two weeks is being blocked - check user list and see screengrab. Needs fixing promptly. </p> Results http://localhost:8080/trac/ticket/575#changelog http://localhost:8080/trac/ticket/571 http://localhost:8080/trac/ticket/571 Tue, 16 Jul 2013 11:59:54 GMT jim <p> To further reduce load and leverage the caching I've changed the Session 443 settings to force anon users to HTTP and logged in to HTTPS. The benefit of allowing a handful of users to choose is tiny compared the downsides of outages, 503s and higher load. </p> <p> The <a class="ext-link" href="https://www.transitionnetwork.org/admin/settings/session443"><span class="icon">​</span>"User state" setting on the config page</a> is now " Redirect authenticated users to HTTPS and redirect anonymous users to HTTP (with the exception of login/registration pages).", was "Redirect authenticated users to HTTPS and redirect anonymous users on login/registration pages to HTTPS. Anonymous users visiting other pages may use HTTP or HTTPS." </p> <p> I've also set user and site-wide contact forms, plus the mailchimp subs page force secure-only per the "Additional pages to make secure" setting. </p> <p> We can see if this makes a difference, and this ticket is to track comments and see if it results in any improvement in performance/stability. </p> Results http://localhost:8080/trac/ticket/571#changelog http://localhost:8080/trac/ticket/570 http://localhost:8080/trac/ticket/570 Tue, 09 Jul 2013 13:19:57 GMT ed <p> Notification for blog post does not include full URL. </p> <p> URL in notification is: </p> <blockquote> <p> <a class="ext-link" href="http://www.transitionnetwork.org/blogs/rob-hopkins/2013-07/transition-th"><span class="icon">​</span>http://www.transitionnetwork.org/blogs/rob-hopkins/2013-07/transition-th</a>... </p> </blockquote> <p> URL should be: <a class="ext-link" href="http://www.transitionnetwork.org/blogs/rob-hopkins/2013-07/transition-thursdays-three-down-three-go"><span class="icon">​</span>http://www.transitionnetwork.org/blogs/rob-hopkins/2013-07/transition-thursdays-three-down-three-go</a> </p> Results http://localhost:8080/trac/ticket/570#changelog http://localhost:8080/trac/ticket/568 http://localhost:8080/trac/ticket/568 Mon, 08 Jul 2013 10:20:16 GMT ed <p> I can't see how to do a node edit and *not* send a notification - here seen on the Transition Culture blog: </p> <p> <a class="ext-link" href="https://www.transitionnetwork.org/node/32863/edit"><span class="icon">​</span>https://www.transitionnetwork.org/node/32863/edit</a> </p> <p> please advise - there's been some kerfuffle about the TC blog move so swift resolution much appreciated </p> Results http://localhost:8080/trac/ticket/568#changelog http://localhost:8080/trac/ticket/548 http://localhost:8080/trac/ticket/548 Tue, 14 May 2013 07:50:15 GMT ed <p> Admins, editors, social reporters cannot create content on TN.org. Choosing to create content leads to homepage. Can't do anything on the admin menu. </p> <p> Emergency. </p> Results http://localhost:8080/trac/ticket/548#changelog http://localhost:8080/trac/ticket/208 http://localhost:8080/trac/ticket/208 Fri, 17 Dec 2010 14:53:29 GMT chris <blockquote> <p> "The dblog module monitors your website, capturing system events in a log to be reviewed by an authorized individual at a later time. The dblog log is simply a list of recorded events containing usage data, performance data, errors, warnings and operational information. It is vital to check the dblog report on a regular basis as it is often the only way to tell what is going on." </p> </blockquote> <p> <a class="ext-link" href="https://www.transitionnetwork.org/admin/reports/dblog"><span class="icon">​</span>https://www.transitionnetwork.org/admin/reports/dblog</a> </p> <p> This is a ticket to be used to flag up issues that are not going to take up enough time that they justify their own ticket -- if an issue is raised in a comment on this ticket that does look like it's going to take some significant time then best start a new ticket for it. </p> Results http://localhost:8080/trac/ticket/208#changelog http://localhost:8080/trac/ticket/207 http://localhost:8080/trac/ticket/207 Fri, 17 Dec 2010 14:19:50 GMT chris <p> This is a ticket to track items that show up in the logwatch emails to root and often just take a few mins of reading time and response. </p> <p> Any issues that look like they might take longer than a few mins should have their own tickets opened. </p> Results http://localhost:8080/trac/ticket/207#changelog http://localhost:8080/trac/ticket/919 http://localhost:8080/trac/ticket/919 Thu, 14 Jul 2016 18:17:26 GMT chris <p> The <a class="ext-link" href="https://www.transitionnetwork.org/"><span class="icon">​</span>https://www.transitionnetwork.org/</a> site has been "off-line" since about 7pm, I see that Paul is logged on via <tt>ssh</tt> -- is this something that we should worry about or is this intentional? </p> Results http://localhost:8080/trac/ticket/919#changelog http://localhost:8080/trac/ticket/907 http://localhost:8080/trac/ticket/907 Wed, 02 Mar 2016 10:20:10 GMT chris <p> 6 weeks ago the datadase dump was 447M, see <a class="ext-link" href="http://trac.edgewall.org/intertrac/ticket/896%23comment%3A3" title="ticket/896#comment:3 in Trac project trac"><span class="icon">​</span>trac:ticket/896#comment:3</a> but now it is 1.8G: </p> <pre class="wiki">ls -lah /var/backups/mysql/sqldump/transitionnetw_0.sql -rw------- 1 root root 1.8G Mar 2 01:23 /var/backups/mysql/sqldump/transitionnetw_0.sql </pre><p> Anyone have any idea what happened to cause this? Are we keeping too many log entries? </p> Results http://localhost:8080/trac/ticket/907#changelog http://localhost:8080/trac/ticket/874 http://localhost:8080/trac/ticket/874 Tue, 29 Sep 2015 13:31:02 GMT sam <p> Hi Paul </p> <p> We'd like to play around with generating Georss from our current site. </p> <p> Could you have a glance at the code /test <a class="ext-link" href="https://www.drupal.org/project/georss"><span class="icon">​</span>https://www.drupal.org/project/georss</a> </p> <p> If it seems like it's going to be unproblematic then please install it on the live site. </p> <p> Thanks </p> <p> Sam </p> Results http://localhost:8080/trac/ticket/874#changelog http://localhost:8080/trac/ticket/821 http://localhost:8080/trac/ticket/821 Wed, 07 Jan 2015 09:53:33 GMT ed <p> Projects forms being hammered by spammers. I got 24 in the last 45 minutes. </p> <blockquote> <p> What to do? </p> </blockquote> <ol><li>Lock off to a certain type of user? </li><li> </li></ol><p> ? </p> <p> Adding Sam as owner to follow this up </p> Results http://localhost:8080/trac/ticket/821#changelog http://localhost:8080/trac/ticket/809 http://localhost:8080/trac/ticket/809 Wed, 19 Nov 2014 21:35:25 GMT paul <p> View online: <a class="ext-link" href="https://www.drupal.org/SA-CORE-2014-006"><span class="icon">​</span>https://www.drupal.org/SA-CORE-2014-006</a> </p> <ul><li>Advisory ID: DRUPAL-SA-CORE-2014-006 </li><li>Project: Drupal core <a class="missing changeset" title="No default repository defined">[1]</a> </li><li>Version: 6.x, 7.x </li><li>Date: 2014-November-19 </li><li>Security risk: 14/25 ( Moderately Critical) AC:Basic/A:None/CI:Some/II:Some/E:Theoretical/TD:Uncommon <a class="missing changeset" title="No default repository defined">[2]</a> </li><li>Vulnerability: Multiple vulnerabilities </li></ul><hr /> <hr /> <p> .... Session hijacking (Drupal 6 and 7) </p> <p> A specially crafted request can give a user access to another user's session, allowing an attacker to hijack a random session. </p> <p> This attack is known to be possible on certain Drupal 7 sites which serve both HTTP and HTTPS content ("mixed-mode" <a class="missing changeset" title="No default repository defined">[3]</a>), but it is possible there are other attack vectors for both Drupal 6 and Drupal 7. </p> <p> .... Denial of service (Drupal 7 only) </p> <p> Drupal 7 includes a password hashing API to ensure that user supplied passwords are not stored in plain text. </p> <p> A vulnerability in this API allows an attacker to send specially crafted requests resulting in CPU and memory exhaustion. This may lead to the site becoming unavailable or unresponsive (denial of service). </p> <p> This vulnerability can be exploited by anonymous users. </p> <hr /> <hr /> <ul><li>/A CVE identifier <a class="missing changeset" title="No default repository defined">[4]</a> will be requested, and added upon issuance, in accordance </li></ul><blockquote> <blockquote> <p> with Drupal Security Team processes./ </p> </blockquote> </blockquote> <hr /> <hr /> <ul><li>Drupal core 6.x versions prior to 6.34. </li><li>Drupal core 7.x versions prior to 7.34. </li></ul><hr /> <hr /> <p> Install the latest version: </p> <ul><li>If you use Drupal 6.x, upgrade to Drupal core 6.34. <a class="missing changeset" title="No default repository defined">[5]</a> </li><li>If you use Drupal 7.x, upgrade to Drupal core 7.34. <a class="missing changeset" title="No default repository defined">[6]</a> </li></ul><p> If you have configured a custom password.inc file for your Drupal 7 site you also need to make sure that it is not prone to the same denial of service vulnerability. See also the similar security advisory for the Drupal 6 contributed Secure Password Hashes module: SA-CONTRIB-2014-113 <a class="missing changeset" title="No default repository defined">[7]</a> </p> <p> Also see the Drupal core <a class="missing changeset" title="No default repository defined">[8]</a> project page. </p> <hr /> <hr /> <p> Session hijacking: </p> <ul><li>Aaron Averill <a class="missing changeset" title="No default repository defined">[9]</a> </li></ul><p> Denial of service: </p> <ul><li>Michael Cullum <a class="missing changeset" title="No default repository defined">[10]</a> </li><li>Javier Nieto <a class="missing changeset" title="No default repository defined">[11]</a> </li><li>Andrés Rojas Guerrero <a class="missing changeset" title="No default repository defined">[12]</a> </li></ul><hr /> <hr /> <p> Session hijacking: </p> <ul><li>Klaus Purer <a class="missing changeset" title="No default repository defined">[13]</a> of the Drupal Security Team </li><li>David Rothstein <a class="missing changeset" title="No default repository defined">[14]</a> of the Drupal Security Team </li><li>Peter Wolanin <a class="missing changeset" title="No default repository defined">[15]</a> of the Drupal Security Team </li></ul><p> Denial of service: </p> <ul><li>Klaus Purer <a class="missing changeset" title="No default repository defined">[16]</a> of the Drupal Security Team </li><li>Peter Wolanin <a class="missing changeset" title="No default repository defined">[17]</a> of the Drupal Security Team </li><li>Heine Deelstra <a class="missing changeset" title="No default repository defined">[18]</a> of the Drupal Security Team </li><li>Tom Phethean <a class="missing changeset" title="No default repository defined">[19]</a> </li></ul><hr /> <hr /> <ul><li>The Drupal Security Team </li></ul><hr /> <hr /> <p> The Drupal security team can be reached at security at drupal.org or via the contact form at <a class="ext-link" href="https://www.drupal.org/contact"><span class="icon">​</span>https://www.drupal.org/contact</a> <a class="missing changeset" title="No default repository defined">[20]</a>. </p> <p> Learn more about the Drupal Security team and their policies <a class="missing changeset" title="No default repository defined">[21]</a>, writing secure code for Drupal <a class="missing changeset" title="No default repository defined">[22]</a>, and securing your site <a class="missing changeset" title="No default repository defined">[23]</a>. </p> <p> Follow the Drupal Security Team on Twitter at <a class="ext-link" href="https://twitter.com/drupalsecurity"><span class="icon">​</span>https://twitter.com/drupalsecurity</a> <a class="missing changeset" title="No default repository defined">[24]</a> </p> <p> <a class="missing changeset" title="No default repository defined">[1]</a> <a class="ext-link" href="https://www.drupal.org/project/drupal"><span class="icon">​</span>https://www.drupal.org/project/drupal</a> <a class="missing changeset" title="No default repository defined">[2]</a> <a class="ext-link" href="https://www.drupal.org/security-team/risk-levels"><span class="icon">​</span>https://www.drupal.org/security-team/risk-levels</a> <a class="missing changeset" title="No default repository defined">[3]</a> <a class="ext-link" href="https://www.drupal.org/https-information"><span class="icon">​</span>https://www.drupal.org/https-information</a> <a class="missing changeset" title="No default repository defined">[4]</a> <a class="ext-link" href="http://cve.mitre.org/"><span class="icon">​</span>http://cve.mitre.org/</a> <a class="missing changeset" title="No default repository defined">[5]</a> <a class="ext-link" href="https://www.drupal.org/drupal-6.34-release-notes"><span class="icon">​</span>https://www.drupal.org/drupal-6.34-release-notes</a> <a class="missing changeset" title="No default repository defined">[6]</a> <a class="ext-link" href="https://www.drupal.org/drupal-7.34-release-notes"><span class="icon">​</span>https://www.drupal.org/drupal-7.34-release-notes</a> <a class="missing changeset" title="No default repository defined">[7]</a> <a class="ext-link" href="https://www.drupal.org/node/2378367"><span class="icon">​</span>https://www.drupal.org/node/2378367</a> <a class="missing changeset" title="No default repository defined">[8]</a> <a class="ext-link" href="https://www.drupal.org/project/drupal"><span class="icon">​</span>https://www.drupal.org/project/drupal</a> <a class="missing changeset" title="No default repository defined">[9]</a> <a class="ext-link" href="https://www.drupal.org/user/1317732"><span class="icon">​</span>https://www.drupal.org/user/1317732</a> <a class="missing changeset" title="No default repository defined">[10]</a> <a class="ext-link" href="https://www.drupal.org/u/MichaelCu"><span class="icon">​</span>https://www.drupal.org/u/MichaelCu</a> <a class="missing changeset" title="No default repository defined">[11]</a> <a class="ext-link" href="https://www.drupal.org/u/jnietotn"><span class="icon">​</span>https://www.drupal.org/u/jnietotn</a> <a class="missing changeset" title="No default repository defined">[12]</a> <a class="ext-link" href="https://www.drupal.org/u/c0r3dump3d"><span class="icon">​</span>https://www.drupal.org/u/c0r3dump3d</a> <a class="missing changeset" title="No default repository defined">[13]</a> <a class="ext-link" href="https://www.drupal.org/u/klausi"><span class="icon">​</span>https://www.drupal.org/u/klausi</a> <a class="missing changeset" title="No default repository defined">[14]</a> <a class="ext-link" href="https://www.drupal.org/u/David_Rothstein"><span class="icon">​</span>https://www.drupal.org/u/David_Rothstein</a> <a class="missing changeset" title="No default repository defined">[15]</a> <a class="ext-link" href="https://www.drupal.org/u/pwolanin"><span class="icon">​</span>https://www.drupal.org/u/pwolanin</a> <a class="missing changeset" title="No default repository defined">[16]</a> <a class="ext-link" href="https://www.drupal.org/u/klausi"><span class="icon">​</span>https://www.drupal.org/u/klausi</a> <a class="missing changeset" title="No default repository defined">[17]</a> <a class="ext-link" href="https://www.drupal.org/u/pwolanin"><span class="icon">​</span>https://www.drupal.org/u/pwolanin</a> <a class="missing changeset" title="No default repository defined">[18]</a> <a class="ext-link" href="https://www.drupal.org/u/Heine"><span class="icon">​</span>https://www.drupal.org/u/Heine</a> <a class="missing changeset" title="No default repository defined">[19]</a> <a class="ext-link" href="https://www.drupal.org/u/tsphethean"><span class="icon">​</span>https://www.drupal.org/u/tsphethean</a> <a class="missing changeset" title="No default repository defined">[20]</a> <a class="ext-link" href="https://www.drupal.org/contact"><span class="icon">​</span>https://www.drupal.org/contact</a> <a class="missing changeset" title="No default repository defined">[21]</a> <a class="ext-link" href="https://www.drupal.org/security-team"><span class="icon">​</span>https://www.drupal.org/security-team</a> <a class="missing changeset" title="No default repository defined">[22]</a> <a class="ext-link" href="https://www.drupal.org/writing-secure-code"><span class="icon">​</span>https://www.drupal.org/writing-secure-code</a> <a class="missing changeset" title="No default repository defined">[23]</a> <a class="ext-link" href="https://www.drupal.org/security/secure-configuration"><span class="icon">​</span>https://www.drupal.org/security/secure-configuration</a> <a class="missing changeset" title="No default repository defined">[24]</a> <a class="ext-link" href="https://twitter.com/drupalsecurity"><span class="icon">​</span>https://twitter.com/drupalsecurity</a> </p> Results http://localhost:8080/trac/ticket/809#changelog http://localhost:8080/trac/ticket/792 http://localhost:8080/trac/ticket/792 Mon, 29 Sep 2014 09:28:08 GMT paul <p> View online: <a class="ext-link" href="https://www.drupal.org/node/2344369"><span class="icon">​</span>https://www.drupal.org/node/2344369</a> </p> <ul><li>Advisory ID: DRUPAL-SA-CONTRIB-2014-094 </li><li>Project: Webform Patched <a class="missing changeset" title="No default repository defined">[1]</a> (third-party module) </li><li>Version: 6.x, 7.x </li><li>Date: 2014-September-24 </li><li>Security risk: 13/25 ( Moderately Critical) </li></ul><p> AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Default <a class="missing changeset" title="No default repository defined">[2]</a> </p> <ul><li>Vulnerability: Cross Site Scripting </li></ul><hr /> <hr /> <p> The Webform Patched module is a fork of the Webform module with Token support added. The module enables you to create forms which can be used for surveys, contact forms or other data collection throughout your site. </p> <p> The module doesn't sufficiently sanitize field label titles when two fields have the same form_key, which can only be managed by carefully crafting the webform structure via a specific set of circumstances. </p> <p> This vulnerability is mitigated by the fact that an attacker must have a role with the permission "create webform content". </p> <hr /> <hr /> <ul><li>/A CVE identifier <a class="missing changeset" title="No default repository defined">[3]</a> will be requested, and added upon issuance, in </li></ul><p> accordance with Drupal Security Team processes./ </p> <hr /> <hr /> <ul><li>Webform Patched 6.x-3.x versions prior to 6.x-3.20. </li><li>Webform Patched 7.x-3.x versions prior to 7.x-3.20. </li></ul><p> Drupal core is not affected. If you do not use the contributed Webform Patched <a class="missing changeset" title="No default repository defined">[4]</a> module, there is nothing you need to do. </p> <hr /> <hr /> <p> Install the latest version: </p> <ul><li>If you use the webform module for Drupal 6.x, upgrade to webform_patched </li></ul><p> 6.x-3.20 <a class="missing changeset" title="No default repository defined">[5]</a> </p> <ul><li>If you use the webform module for Drupal 7.x-3.x, upgrade to </li></ul><p> webform_patched 7.x-3.20 <a class="missing changeset" title="No default repository defined">[6]</a> </p> <p> Also see the Webform Patched <a class="missing changeset" title="No default repository defined">[7]</a> project page. </p> <hr /> <hr /> <ul><li>Maurits Lawende <a class="missing changeset" title="No default repository defined">[8]</a> </li><li>Matt Vance <a class="missing changeset" title="No default repository defined">[9]</a> </li></ul><hr /> <hr /> <ul><li>Nate Haug <a class="missing changeset" title="No default repository defined">[10]</a> the module maintainer </li></ul><hr /> <hr /> <ul><li>Greg Knaddison <a class="missing changeset" title="No default repository defined">[11]</a>, Dan Smith <a class="missing changeset" title="No default repository defined">[12]</a> and Lee Rowlands <a class="missing changeset" title="No default repository defined">[13]</a> of the Drupal </li></ul><p> Security Team </p> <hr /> <hr /> <p> The Drupal security team can be reached at security at drupal.org or via the contact form at <a class="ext-link" href="https://www.drupal.org/contact"><span class="icon">​</span>https://www.drupal.org/contact</a> <a class="missing changeset" title="No default repository defined">[14]</a>. </p> <p> Learn more about the Drupal Security team and their policies <a class="missing changeset" title="No default repository defined">[15]</a>, writing secure code for Drupal <a class="missing changeset" title="No default repository defined">[16]</a>, and securing your site <a class="missing changeset" title="No default repository defined">[17]</a>. </p> <p> <a class="missing changeset" title="No default repository defined">[1]</a> <a class="ext-link" href="https://www.drupal.org/project/webform_patched"><span class="icon">​</span>https://www.drupal.org/project/webform_patched</a> <a class="missing changeset" title="No default repository defined">[2]</a> <a class="ext-link" href="https://www.drupal.org/security-team/risk-levels"><span class="icon">​</span>https://www.drupal.org/security-team/risk-levels</a> <a class="missing changeset" title="No default repository defined">[3]</a> <a class="ext-link" href="http://cve.mitre.org/"><span class="icon">​</span>http://cve.mitre.org/</a> <a class="missing changeset" title="No default repository defined">[4]</a> <a class="ext-link" href="https://www.drupal.org/project/webform_patched"><span class="icon">​</span>https://www.drupal.org/project/webform_patched</a> <a class="missing changeset" title="No default repository defined">[5]</a> <a class="ext-link" href="http://drupal.org/node/2241675"><span class="icon">​</span>http://drupal.org/node/2241675</a> <a class="missing changeset" title="No default repository defined">[6]</a> <a class="ext-link" href="http://drupal.org/node/2241685"><span class="icon">​</span>http://drupal.org/node/2241685</a> <a class="missing changeset" title="No default repository defined">[7]</a> <a class="ext-link" href="https://www.drupal.org/project/webform_patched"><span class="icon">​</span>https://www.drupal.org/project/webform_patched</a> <a class="missing changeset" title="No default repository defined">[8]</a> <a class="ext-link" href="http://drupal.org/user/243897"><span class="icon">​</span>http://drupal.org/user/243897</a> <a class="missing changeset" title="No default repository defined">[9]</a> <a class="ext-link" href="https://www.drupal.org/user/10269"><span class="icon">​</span>https://www.drupal.org/user/10269</a> <a class="missing changeset" title="No default repository defined">[10]</a> <a class="ext-link" href="http://drupal.org/user/35821"><span class="icon">​</span>http://drupal.org/user/35821</a> <a class="missing changeset" title="No default repository defined">[11]</a> <a class="ext-link" href="http://drupal.org/user/36762"><span class="icon">​</span>http://drupal.org/user/36762</a> <a class="missing changeset" title="No default repository defined">[12]</a> <a class="ext-link" href="http://drupal.org/user/241220"><span class="icon">​</span>http://drupal.org/user/241220</a> <a class="missing changeset" title="No default repository defined">[13]</a> <a class="ext-link" href="https://drupal.org/user/395439"><span class="icon">​</span>https://drupal.org/user/395439</a> <a class="missing changeset" title="No default repository defined">[14]</a> <a class="ext-link" href="https://www.drupal.org/contact"><span class="icon">​</span>https://www.drupal.org/contact</a> <a class="missing changeset" title="No default repository defined">[15]</a> <a class="ext-link" href="https://www.drupal.org/security-team"><span class="icon">​</span>https://www.drupal.org/security-team</a> <a class="missing changeset" title="No default repository defined">[16]</a> <a class="ext-link" href="https://www.drupal.org/writing-secure-code"><span class="icon">​</span>https://www.drupal.org/writing-secure-code</a> <a class="missing changeset" title="No default repository defined">[17]</a> <a class="ext-link" href="https://www.drupal.org/security/secure-configuration"><span class="icon">​</span>https://www.drupal.org/security/secure-configuration</a> </p> Results http://localhost:8080/trac/ticket/792#changelog http://localhost:8080/trac/ticket/789 http://localhost:8080/trac/ticket/789 Mon, 22 Sep 2014 13:09:48 GMT paul <p> View online: <a class="ext-link" href="https://www.drupal.org/node/2340029"><span class="icon">​</span>https://www.drupal.org/node/2340029</a> </p> <ul><li>Advisory ID: DRUPAL-SA-CONTRIB-2014-088 </li><li>Project: Mollom <a class="missing changeset" title="No default repository defined">[1]</a> (third-party module) </li><li>Version: 6.x, 7.x </li><li>Date: 2014-September-17 </li><li>Security risk: 11/25 ( Moderately Critical) </li></ul><p> AC:Complex/A:User/CI:Some/II:Some/E:Theoretical/TD:Uncommon <a class="missing changeset" title="No default repository defined">[2]</a> </p> <ul><li>Vulnerability: Cross Site Scripting </li></ul><hr /> <hr /> <p> Mollom is an "intelligent" content moderation web service which determines if a post is potentially spam; not only based on the posted content, but also on the past activity and reputation of the poster across multiple sites. </p> <p> Mollom offers a feature to report submitted content as inappropriate which allows end users to indicate that a piece of site content is objectionable or out of place. When reporting content, the content title is not sufficiently sanitized to prevent cross-site scripting (XSS) attacks. </p> <p> This vulnerability is mitigated by the fact that an attacker must have a role with the permission to create content and the content type must be enabled for "Flag as Inappropriate" within the Mollom advanced configuration settings (which is not the default setting). </p> <hr /> <hr /> <ul><li>/A CVE identifier <a class="missing changeset" title="No default repository defined">[3]</a> will be requested, and added upon issuance, in </li></ul><p> accordance with Drupal Security Team processes./ </p> <hr /> <hr /> <ul><li>Mollom 6.x-2.x versions from 6.x-2.7 to 6.x-2.10 </li><li>Mollom 7.x-2.x versions from 7.x-2.9 to 7.x-2.10 </li></ul><p> Drupal core is not affected. If you do not use the contributed Mollom <a class="missing changeset" title="No default repository defined">[4]</a> module, there is nothing you need to do. </p> <hr /> <hr /> <p> Install the latest version: </p> <ul><li>If you use the Mollom module for Drupal 6.x, upgrade to Mollom 6.x-2.11 </li></ul><p> <a class="missing changeset" title="No default repository defined">[5]</a> </p> <ul><li>If you use the Mollom module for Drupal 7.x, upgrade to Mollom 7.x-2.11 </li></ul><p> <a class="missing changeset" title="No default repository defined">[6]</a> </p> <p> Also see the Mollom <a class="missing changeset" title="No default repository defined">[7]</a> project page. </p> <hr /> <hr /> <ul><li>Matt Vance <a class="missing changeset" title="No default repository defined">[8]</a> </li></ul><hr /> <hr /> <ul><li>Lisa Backer <a class="missing changeset" title="No default repository defined">[9]</a> the module maintainer </li><li>Matt Vance <a class="missing changeset" title="No default repository defined">[10]</a> </li></ul><hr /> <hr /> <ul><li>Greg Knaddison <a class="missing changeset" title="No default repository defined">[11]</a> of the Drupal Security Team </li></ul><hr /> <hr /> <p> The Drupal security team can be reached at security at drupal.org or via the contact form at <a class="ext-link" href="https://www.drupal.org/contact"><span class="icon">​</span>https://www.drupal.org/contact</a> <a class="missing changeset" title="No default repository defined">[12]</a>. </p> <p> Learn more about the Drupal Security team and their policies <a class="missing changeset" title="No default repository defined">[13]</a>, writing secure code for Drupal <a class="missing changeset" title="No default repository defined">[14]</a>, and securing your site <a class="missing changeset" title="No default repository defined">[15]</a>. </p> <p> <a class="missing changeset" title="No default repository defined">[1]</a> <a class="ext-link" href="https://www.drupal.org/project/mollom"><span class="icon">​</span>https://www.drupal.org/project/mollom</a> <a class="missing changeset" title="No default repository defined">[2]</a> <a class="ext-link" href="https://www.drupal.org/security-team/risk-levels"><span class="icon">​</span>https://www.drupal.org/security-team/risk-levels</a> <a class="missing changeset" title="No default repository defined">[3]</a> <a class="ext-link" href="http://cve.mitre.org/"><span class="icon">​</span>http://cve.mitre.org/</a> <a class="missing changeset" title="No default repository defined">[4]</a> <a class="ext-link" href="https://www.drupal.org/project/mollom"><span class="icon">​</span>https://www.drupal.org/project/mollom</a> <a class="missing changeset" title="No default repository defined">[5]</a> <a class="ext-link" href="https://www.drupal.org/node/2338787"><span class="icon">​</span>https://www.drupal.org/node/2338787</a> <a class="missing changeset" title="No default repository defined">[6]</a> <a class="ext-link" href="https://www.drupal.org/node/2338789"><span class="icon">​</span>https://www.drupal.org/node/2338789</a> <a class="missing changeset" title="No default repository defined">[7]</a> <a class="ext-link" href="https://www.drupal.org/project/mollom"><span class="icon">​</span>https://www.drupal.org/project/mollom</a> <a class="missing changeset" title="No default repository defined">[8]</a> <a class="ext-link" href="https://www.drupal.org/user/88338"><span class="icon">​</span>https://www.drupal.org/user/88338</a> <a class="missing changeset" title="No default repository defined">[9]</a> <a class="ext-link" href="https://www.drupal.org/user/1951462"><span class="icon">​</span>https://www.drupal.org/user/1951462</a> <a class="missing changeset" title="No default repository defined">[10]</a> <a class="ext-link" href="https://www.drupal.org/user/88338"><span class="icon">​</span>https://www.drupal.org/user/88338</a> <a class="missing changeset" title="No default repository defined">[11]</a> <a class="ext-link" href="https://www.drupal.org/user/36762"><span class="icon">​</span>https://www.drupal.org/user/36762</a> <a class="missing changeset" title="No default repository defined">[12]</a> <a class="ext-link" href="https://www.drupal.org/contact"><span class="icon">​</span>https://www.drupal.org/contact</a> <a class="missing changeset" title="No default repository defined">[13]</a> <a class="ext-link" href="https://www.drupal.org/security-team"><span class="icon">​</span>https://www.drupal.org/security-team</a> <a class="missing changeset" title="No default repository defined">[14]</a> <a class="ext-link" href="https://www.drupal.org/writing-secure-code"><span class="icon">​</span>https://www.drupal.org/writing-secure-code</a> <a class="missing changeset" title="No default repository defined">[15]</a> <a class="ext-link" href="https://www.drupal.org/security/secure-configuration"><span class="icon">​</span>https://www.drupal.org/security/secure-configuration</a> </p> Results http://localhost:8080/trac/ticket/789#changelog http://localhost:8080/trac/ticket/761 http://localhost:8080/trac/ticket/761 Thu, 17 Jul 2014 08:45:33 GMT ed <p> There are bucketloads of spam accounts swamping us. Spam commeting is swarming again. I just did several pages of deleting spam accounts. No doubt I nailed some humans too (sorry Sam if this comes back to you); but the overwhelming majority of new accounts are spam. </p> <p> It's crap and we need to have another spam sweep - especially if we're staying in D6 for a while. </p> <p> See work done in Feb 2013: <a class="assigned ticket" href="http://localhost:8080/trac/ticket/461" title="enhancement: Spam account war (assigned)">#461</a> See wiki page done in Feb 2013: <a class="ext-link" href="https://wiki.transitionnetwork.org/Spam_accounts"><span class="icon">​</span>https://wiki.transitionnetwork.org/Spam_accounts</a> </p> <p> SAM I'm going to suggest you start looking at it, and get your head around it, and the various modules and processes we've got running, then ask you to act/escalate accordingly. </p> Results http://localhost:8080/trac/ticket/761#changelog http://localhost:8080/trac/ticket/741 http://localhost:8080/trac/ticket/741 Thu, 12 Jun 2014 10:42:13 GMT annesley <p> admin &gt; views &gt; edit the view editor interface appears and then disappears immediately this happens in Chrome / Ubuntu and Firefox / Mac </p> Results http://localhost:8080/trac/ticket/741#changelog http://localhost:8080/trac/ticket/731 http://localhost:8080/trac/ticket/731 Fri, 23 May 2014 10:47:39 GMT chris <p> Ticket to record time spent on Skype call on 22nd May 2014. </p> Results http://localhost:8080/trac/ticket/731#changelog http://localhost:8080/trac/ticket/715 http://localhost:8080/trac/ticket/715 Tue, 08 Apr 2014 14:51:29 GMT sam <p> Hi I just tried to access the views admin interface here: <a class="ext-link" href="https://www.transitionnetwork.org/admin/build/views"><span class="icon">​</span>https://www.transitionnetwork.org/admin/build/views</a> </p> <p> It doesn't load the views admin pages, just an overview of the 'site building' pages instead. </p> <p> The page works as I expect it to on the stage site here: <a class="ext-link" href="https://stg2.transitionnetwork.org/admin/build/views"><span class="icon">​</span>https://stg2.transitionnetwork.org/admin/build/views</a> </p> <p> I have checked and the module is still enabled, The permissions look right (site admin is allowed to administer views: <a class="ext-link" href="https://www.transitionnetwork.org/admin/user/permissions"><span class="icon">​</span>https://www.transitionnetwork.org/admin/user/permissions</a>) </p> <p> Anyone got an idea whats going on? </p> <p> Thanks </p> <p> Sam </p> Results http://localhost:8080/trac/ticket/715#changelog http://localhost:8080/trac/ticket/661 http://localhost:8080/trac/ticket/661 Tue, 17 Dec 2013 15:34:53 GMT ed <p> January: </p> <p> Create button for TN homepage and /news and /blogs to encourage people to send in stories. </p> <ol><li>create button like the existing ones - e.g: </li></ol><p> <a class="ext-link" href="https://www.transitionnetwork.org/admin/build/block/configure/block/89?destination=newhome"><span class="icon">​</span>https://www.transitionnetwork.org/admin/build/block/configure/block/89?destination=newhome</a> </p> <ol start="2"><li>add suitably pithy text </li></ol><ol start="3"><li>if in doubt about style, read Ben's style cheatsheet on google docs: </li></ol><p> <a class="ext-link" href="https://docs.google.com/document/d/1z6JYGiy8EJ6pqjm_WyNUS26fQgIClmIFg0a-8y-Mots/edit#heading=h.siua52eim2e9"><span class="icon">​</span>https://docs.google.com/document/d/1z6JYGiy8EJ6pqjm_WyNUS26fQgIClmIFg0a-8y-Mots/edit#heading=h.siua52eim2e9</a> </p> <ol start="4"><li>this will need to be an email forwarder to send to Rob instead of a http link as per the other buttons, so you'll need to set one up on United's dashboard using the main 'jmcgeechan' account </li></ol><p> cc-ing benj as he can be around to help with postitioning/button make if an issue - but can't do email forwarder set up - and don't forget sam - if you're too busy you can always farm it out to ben (although this is probably a bit easy for ben, he'll know about how to get blocks in the right order) </p> Results http://localhost:8080/trac/ticket/661#changelog http://localhost:8080/trac/ticket/606 http://localhost:8080/trac/ticket/606 Fri, 11 Oct 2013 12:00:13 GMT jim <p> This ticket is to track the issues left over from <a class="assigned ticket" href="http://localhost:8080/trac/ticket/590" title="defect: Drupal performance improvements (assigned)">#590</a> that need to be considered and tackled prior to migrating the site from D6 to D7 (or 8). </p> <p> Please feel free to add as needed, but sticky to the </p> <h2 id="CCleanup:Listoffeatureswedontreallyneed">C) Cleanup: List of features we don't really need</h2> <p> Ed to add his items to following list... Need rational and alternative approaches for each. </p> <ul><li><strong>C.1) Remove 'Geographic region' and related taxonomy and Hierarchical Select modules</strong> 1 hour, low reward, low risk -- never really been used and is effectively a duplicate of the location field. let's kill it! </li><li><strong>C.2) Kill Microsites and the Forums</strong> -- The handful of people using the CMS feature should be migrated to Open Atrium if they need such features. </li><li><strong>C.3) Remove forums</strong> -- We could migrate the forum to a simpler setup (not using forum module) that leverages normal commenting, or even Disqus or other services to offload comments and moderation. Also encourage user-submitted ocontent and promote that if it's good or gets interesting debate. </li></ul><h2 id="DKeydevelopmenttasks">D) Key development tasks</h2> <ul><li><strong>D.1) All inline PHP must be moved to modules and features</strong> -- This has great benefit for management, maintenance and developers. <tt>Eval()</tt>uated code is much slower than PHP in files, especially since it can't be accelerated by APC or Zend Opcode cache... We have a few blocks and many views that are loaded from the database and evaluated. Ideally the blocks would be moved to the 'Transition Extras' module, and the views would be pushed into features. This work is good to do for maintainability and D7 upgrades, too. See: <a class="ext-link" href="http://2bits.com/api/abuse-drupal-best-practices-your-own-peril-poor-performance.html"><span class="icon">​</span>http://2bits.com/api/abuse-drupal-best-practices-your-own-peril-poor-performance.html</a> and <a class="ext-link" href="http://2bits.com/articles/free-your-content-php-moving-php-code-out-blocks-views-and-nodes.html"><span class="icon">​</span>http://2bits.com/articles/free-your-content-php-moving-php-code-out-blocks-views-and-nodes.html</a> </li></ul><ul><li><strong>D.2) Build in ESI (Edge Side Includes) support from the outset, ensure Drupal renders only what it needs to </strong> -- BOA packages the <a class="ext-link" href="https://drupal.org/project/esi"><span class="icon">​</span>ESI (Edge Side Includes integration) module</a>, which makes NginX cache the whole page (as it does now), but also for user-logged in pages (which it does for 5 seconds since the page data changes). This means Drupal renders the ESI component (blocks, panels panes) that are have user-specific data in. Potential boost quickly, but will need time to tweak settings to get best from this across whole site. See <a class="ext-link" href="https://tech.transitionnetwork.org/trac/ticket/590#comment:4"><span class="icon">​</span>comments in 4 &amp; 5 below for discussion</a><del>, should be done after proposal F, above</del>. </li></ul><h2 id="EKeyeditorialtasks">E) Key editorial tasks</h2> <ul><li><strong>E.1) More Taxonomy cleanup</strong> -- try to merge terms with the same names, clear out spammy terms, general spit-and-polish. Ed plus team of busy interns to do this when the time is right. </li></ul><h2 id="Zoldstuffforreferencetasksfrom590renderedpointlessbymove">Z) old stuff for reference; tasks from <a class="assigned ticket" href="http://localhost:8080/trac/ticket/590" title="defect: Drupal performance improvements (assigned)">#590</a> rendered pointless by move</h2> <ul><li><strong>Z.1) Find Variable table writes and kill them</strong> -- seeing plenty of SELECT * FROM variable calls, which imply a cache clear due to a variable being set. In normal use variables shouldn't be set (admin screens tend to do this), so I'd like to try to see what module it causing this and patch/remove it. Will need to run <tt>grep -R "variable_set() * &gt; ~/static/variable_set-calls.txt" in the {{{sites/all</tt> directory to generate a list, then trawl though it to find candidates/bad modules practice. </li></ul> Results http://localhost:8080/trac/ticket/606#changelog http://localhost:8080/trac/ticket/603 http://localhost:8080/trac/ticket/603 Thu, 03 Oct 2013 09:24:09 GMT ed <p> User forwarded newsletter to themself (other email account) and was sent the wrong message - from a different user to someone else. See forwarded mail below. </p> <p> Please consider. </p> <hr /> <p> From: Jeanne &lt;mackeyj@…&gt; Date: Mon, Sep 9, 2013 at 11:57 AM Subject: Jeanne is forwarding an email to you To: jeano &lt;jmackey50@…&gt; </p> <p> Hi Will Sutherland, </p> <p> Kathleen L thought you'd be interested in this: <a class="ext-link" href="http://us1.forward-to-friend2.com/forward/show?u=766036b57dc1247e2964584bd&amp;id=7b4f6d65d1"><span class="icon">​</span>http://us1.forward-to-friend2.com/forward/show?u=766036b57dc1247e2964584bd&amp;id=7b4f6d65d1</a> </p> <p> Kathleen L also included this personal message to you: </p> <p> more info for ya about Transition Towns - made me think of your game with their new book and ingredients and stuff - read about it... Did you find the link interesting? </p> <p> You can forward it on to your friends, too: <a class="ext-link" href="http://us1.forward-to-friend2.com/forward?u=766036b57dc1247e2964584bd&amp;id=7b4f6d65d1"><span class="icon">​</span>http://us1.forward-to-friend2.com/forward?u=766036b57dc1247e2964584bd&amp;id=7b4f6d65d1</a> </p> <p> You can subscribe for more emails at: <a class="ext-link" href="http://transitionnetwork.us1.list-manage1.com/subscribe?u=766036b57dc1247e2964584bd&amp;id=33e8648c8d"><span class="icon">​</span>http://transitionnetwork.us1.list-manage1.com/subscribe?u=766036b57dc1247e2964584bd&amp;id=33e8648c8d</a> </p> <ul><li>Note: if any of the URLs above are not clickable, you can copy/paste them into your web browser. </li></ul> Results http://localhost:8080/trac/ticket/603#changelog http://localhost:8080/trac/ticket/521 http://localhost:8080/trac/ticket/521 Sat, 16 Mar 2013 09:46:57 GMT chris <p> I don't know if these matter? </p> <p> I found them when hunting for 502 errors. </p> <pre class="wiki">grep "Unsafe statement written to the binary log" /var/log/daemon.log | wc -l 343 </pre><p> Some examples: </p> <pre class="wiki">Mar 16 09:28:20 puffin mysqld: 130316 9:28:20 [Warning] Unsafe statement written to the binary log using statement format since BINLOG_FORMAT = STATEMENT. Statements writing to a table with an auto-increment column after selecting from another table are unsafe because the order in which rows are retrieved determines what (if any) rows will be written. This order cannot be predicted and may differ on master and the slave. Statement: DELETE FROM notifications_event WHERE created &lt; 1363426040 AND eid &lt; (SELECT MIN(eid) FROM notifications_queue) </pre><pre class="wiki">Mar 16 05:52:12 puffin mysqld: 130316 5:52:12 [Warning] Unsafe statement written to the binary log using statement format since BINLOG_FORMAT = STATEMENT. Statements writing to a table with an auto-increment column after selecting from another table are unsafe because the order in which rows are retrieved determines what (if any) rows will be written. This order cannot be predicted and may differ on master and the slave. Statement: INSERT INTO notifications_queue (uid, mdid, send_method, sid, module, eid, send_interval, language, cron, created, conditions) SELECT DISTINCT s.uid, s.mdid, s.send_method, s.sid, s.module, 61233, s.send_interval, s.language, s.cron, 1363413132, s.conditions FROM notifications s LEFT JOIN notifications_fields f ON s.sid = f.sid WHERE (s.status = 1) AND (s.event_type = 'node') AND (s.send_interval &gt;= 0) AND ((f.field = 'nid' AND f.intval = 30718) OR (f.field = 'type' AND f.value = 'profile') OR (f.field = 'author' AND f.intval = 16908)) GROUP BY s.uid, s.mdid, s.send_method, s.sid, s.module, s.send_interval, s. </pre> Results http://localhost:8080/trac/ticket/521#changelog http://localhost:8080/trac/ticket/520 http://localhost:8080/trac/ticket/520 Fri, 15 Mar 2013 23:16:49 GMT chris <p> There is this warning displaying at <a class="ext-link" href="https://www.transitionnetwork.org/admin/reports/status"><span class="icon">​</span>https://www.transitionnetwork.org/admin/reports/status</a> </p> <pre class="wiki">Settings.php is not setup correctly. With the current configuration of 443 Session module, the following lines must be in settings.php. if (!empty($_SERVER['HTTPS']) &amp;&amp; $_SERVER['HTTPS'] != 'off') { ini_set('session.cookie_secure', 1); } </pre><p> Based on the check of what is happening with cookies done on <a class="closed ticket" href="http://localhost:8080/trac/ticket/371#comment:34" title="maintenance: Piwik Hosting (closed: fixed)">ticket:371#comment:34</a> and <a class="closed ticket" href="http://localhost:8080/trac/ticket/371#comment:36" title="maintenance: Piwik Hosting (closed: fixed)">ticket:371#comment:36</a> things are currently working OK, session cookies do have the secure flag set, so I'm a bit confused by this warning message. I also think that the PHP suggested to add to settings.php looks perfectly sensible and should be included, I'm sure we did have it on the old server, however there are 33 settings.php files on <a class="wiki" href="http://localhost:8080/trac/wiki/PuffinServer">wiki:PuffinServer</a> and I'm not clear which one the live site uses. </p> Results http://localhost:8080/trac/ticket/520#changelog http://localhost:8080/trac/ticket/519 http://localhost:8080/trac/ticket/519 Fri, 15 Mar 2013 13:47:21 GMT chris <p> This page: </p> <ul><li><a class="ext-link" href="http://transitionnetwork.org/support/what-transition-initiative"><span class="icon">​</span>http://transitionnetwork.org/support/what-transition-initiative</a> </li></ul><p> Contains this HTML: </p> <pre class="wiki">&lt;p&gt;&lt;img alt="TransitionSantaCruz" src="http://transitionsc.org/sites/www.transitionnetwork.org/files/pixture_reloaded_logo.png" align="right" height="69" width="150"&gt;&lt;/p&gt; </pre><p> The image is a 404: </p> <ul><li><a class="ext-link" href="http://transitionsc.org/sites/www.transitionnetwork.org/files/pixture_reloaded_logo.png"><span class="icon">​</span>http://transitionsc.org/sites/www.transitionnetwork.org/files/pixture_reloaded_logo.png</a> </li></ul><p> The correct location for the image is: </p> <ul><li><a class="ext-link" href="http://transitionsc.org/sites/default/files/pixture_reloaded_logo.png"><span class="icon">​</span>http://transitionsc.org/sites/default/files/pixture_reloaded_logo.png</a> </li></ul><p> Looking at the Internet Archive this was correct back in October 2012, </p> <ul><li><a class="ext-link" href="http://web.archive.org/web/20121022030350/http://www.transitionnetwork.org/support/what-transition-initiative"><span class="icon">​</span>http://web.archive.org/web/20121022030350/http://www.transitionnetwork.org/support/what-transition-initiative</a> </li></ul><p> Their munged HTML contains the correct URL: </p> <pre class="wiki">&lt;p&gt;&lt;a href="/web/20121022030350/http://transitionsc.org/sites/default/files/pixture_reloaded_logo.png" class="colorbox initColorbox-processed cboxElement"&gt; </pre><p> It appears to me that an edit must have been done on the database something like: </p> <pre class="wiki">s;/sites/default/files/;/sites/www.transitionnetwork.org/files/; </pre><p> There might well be other URLs to other Drupal sites that were changed when they shouldn't have been? </p> <p> I have had a quick look at the database dump and couldn't find any examples of this problem, but there are 113 lines to check: </p> <pre class="wiki">grep "sites/www.transitionnetwork.org/files" /var/backups/mysql/sqldump/transitionnetwor.sql | wc -l 113 </pre><p> I did notice that there are a lot of URLs in the database like this: </p> <pre class="wiki">src=\"http://www.transitionnetwork.org/sites/www.transitionnetwork.org/files/uploaded/u5857/Map-TransitionNetworkOffice.jpg\" </pre><p> And </p> <pre class="wiki">src=\"https://www.transitionnetwork.org/sites/www.transitionnetwork.org/files/uploaded/u4/transition%20companion%20cover.jpg\" </pre><p> Both the above links would be better starting with <tt>/</tt> or <tt>//www.transitionnetwork.org/</tt> as this would avoid people getting HTTPS content when using HTTP and also getting HTTP content when using HTTPS. </p> <p> I think it would be worth putting the site into maintenance mode, doing a dump of the database, checking these 113 lines for issues like those above, correcting them all and then reinserting the data, however this would need to be done at a suitable time. </p> <p> I'd be happy to do this task. Ed, Jim, any thoughts about when would be a good time to do it? </p> Results http://localhost:8080/trac/ticket/519#changelog http://localhost:8080/trac/ticket/802 http://localhost:8080/trac/ticket/802 Thu, 23 Oct 2014 10:20:29 GMT sam <p> User reported: "I'm trying to register our fledgling initiative based in Dovje-Mojstrana, Slovenia. When I select the country, the <a class="missing wiki">Province/State?</a> box automatically comes up as not listed. But then when I press preview to be ready to send, it says "The specified province was not found in the specified country." So I can't submit the form :-( Please help! I think we will be the first official Transition town in Slovenia!" </p> <p> I had a go at creating the initiative in a different country, then editing it to Slovenia as a workaround, but that didn't work either: <a class="ext-link" href="https://www.transitionnetwork.org/node/37435/edit"><span class="icon">​</span>https://www.transitionnetwork.org/node/37435/edit</a> </p> <p> Any idea's as to why it won't accept 'not listed' as a valid choice? Or what we can do about it? </p> <p> Thanks </p> <p> Sam </p> Results http://localhost:8080/trac/ticket/802#changelog http://localhost:8080/trac/ticket/712 http://localhost:8080/trac/ticket/712 Tue, 01 Apr 2014 15:03:53 GMT sam <p> Hi Paul </p> <p> I have been trying to build a staging site using your Github repository with the changes you made for ticket : <a class="ext-link" href="https://trac.transitionnetwork.org/trac/ticket/693"><span class="icon">​</span>https://trac.transitionnetwork.org/trac/ticket/693</a> </p> <p> I have edited the D6 s008 platform: <a class="ext-link" href="https://tn.puffin.webarch.net/node/1157/edit"><span class="icon">​</span>https://tn.puffin.webarch.net/node/1157/edit</a> to use your makefile. </p> <p> It builds a site, but I just get an empty pressflow site at the end. </p> <p> Could you build a staging site using your makefile? </p> <p> Thanks </p> <p> Sam </p> Results http://localhost:8080/trac/ticket/712#changelog http://localhost:8080/trac/ticket/681 http://localhost:8080/trac/ticket/681 Wed, 22 Jan 2014 12:31:29 GMT sam <p> Hi I'm using <a class="ext-link" href="https://www.transitionnetwork.org/node/add/event"><span class="icon">​</span>https://www.transitionnetwork.org/node/add/event</a> </p> <p> To create a Transition Training event in Belgium in the 'Limburg' region. </p> <p> On submission I get the following error; </p> <p> "An illegal choice has been detected. Please contact the site administrator." </p> <p> It works for UK events. </p> <p> I had a look at the fields in the event content type, but couldn't spot any problems </p> Results http://localhost:8080/trac/ticket/681#changelog http://localhost:8080/trac/ticket/646 http://localhost:8080/trac/ticket/646 Thu, 12 Dec 2013 10:16:23 GMT ed <p> I'm getting noticeably more complaints about users not being able to unsubscribe to email notifications for content or comment alerts and/or the newsletter. </p> <p> The emerging pattern is that they are clicking on the unsubscribe link in their email alerts and going to an access denied page. </p> <p> My sense says there's something in https/http? Or them not being logged in? </p> <p> Something is definitely going on. </p> <p> Adding this to Sam to pick up in January. SAM - tickets like this can bounce around the tech team a bit - stay on it! </p> Results http://localhost:8080/trac/ticket/646#changelog