<?xml version="1.0"?>
<rss xmlns:dc="http://purl.org/dc/elements/1.1/" version="2.0">
  <channel>
    <title>Transition Technology: Ticket Query</title>
    <link>http://localhost:8080/trac/query?status=accepted&amp;status=assigned&amp;status=new&amp;status=reopened&amp;type=maintenance&amp;col=id&amp;col=summary&amp;col=status&amp;col=type&amp;col=priority&amp;col=milestone&amp;col=component&amp;report=18&amp;desc=1&amp;order=priority</link>
    <description>Support and issues tracking for the Transition Network Web Project.</description>
    <language>en-US</language>
    <image>
      <title>Transition Technology</title>
      <url>/trac/chrome/site/TransitionNetwork-Logo-Web-Small.jpg</url>
      <link>http://localhost:8080/trac/query?status=accepted&amp;status=assigned&amp;status=new&amp;status=reopened&amp;type=maintenance&amp;col=id&amp;col=summary&amp;col=status&amp;col=type&amp;col=priority&amp;col=milestone&amp;col=component&amp;report=18&amp;desc=1&amp;order=priority</link>
    </image>
    <generator>Trac 0.12.5</generator>
    <item>
        <link>http://localhost:8080/trac/ticket/541</link>
        <guid isPermaLink="false">http://localhost:8080/trac/ticket/541</guid>
        <title>#541: Documentation of the WordPress sites</title>
        <pubDate>Wed, 01 May 2013 20:25:57 GMT</pubDate>
        
        <dc:creator>chris</dc:creator>

        <description>&lt;p&gt;
These pages have been created for the documentation of the &lt;a class="wiki" href="http://localhost:8080/trac/wiki/WordPress"&gt;wiki:WordPress&lt;/a&gt; sites running on &lt;a class="wiki" href="http://localhost:8080/trac/wiki/PenguinServer"&gt;wiki:PenguinServer&lt;/a&gt;:
&lt;/p&gt;
&lt;ul&gt;&lt;li&gt;&lt;a class="wiki" href="http://localhost:8080/trac/wiki/InTransitionWordPress"&gt;wiki:InTransitionWordPress&lt;/a&gt;
&lt;/li&gt;&lt;li&gt;&lt;a class="wiki" href="http://localhost:8080/trac/wiki/ReconomyWordPress"&gt;wiki:ReconomyWordPress&lt;/a&gt;
&lt;/li&gt;&lt;li&gt;&lt;a class="wiki" href="http://localhost:8080/trac/wiki/EarthInheritorsWordPress"&gt;wiki:EarthInheritorsWordPress&lt;/a&gt;
&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;
So far they only have a listing on the plugins for each site.
&lt;/p&gt;
&lt;p&gt;
Ideally they would document all the plugins, the theme and the steps that need to be taken to upgrade each site and also any other things that need documenting.
&lt;/p&gt;
&lt;p&gt;
Laura is this something you might be able to help with? I'm happy doing some work on it but you know your way around these sites far better than anyone else.
&lt;/p&gt;
</description>
        <category>Results</category>
        <comments>http://localhost:8080/trac/ticket/541#changelog</comments>
    </item><item>
        <link>http://localhost:8080/trac/ticket/598</link>
        <guid isPermaLink="false">http://localhost:8080/trac/ticket/598</guid>
        <title>#598: Redirect reconomyproject.org to reconomy.org</title>
        <pubDate>Fri, 20 Sep 2013 12:16:56 GMT</pubDate>
        
        <dc:creator>chris</dc:creator>

        <description>&lt;p&gt;
Request from Shane:
&lt;/p&gt;
&lt;blockquote class="citation"&gt;
&lt;p&gt;
I've noticed that the domain www.reconomyproject.org is still live and running. i.e. can surf around it. I think you set it up so that it would auto redirect to reconomy.org - not 100% sure about the technical spec behind how you did this but is it still working?  I noticed this because a lot of the referrals on to our fb page our coming from reconomyproject.org rather than reconomy.org
&lt;/p&gt;
&lt;/blockquote&gt;
</description>
        <category>Results</category>
        <comments>http://localhost:8080/trac/ticket/598#changelog</comments>
    </item><item>
        <link>http://localhost:8080/trac/ticket/645</link>
        <guid isPermaLink="false">http://localhost:8080/trac/ticket/645</guid>
        <title>#645: APC Tuning on Parrot and Penguin</title>
        <pubDate>Tue, 10 Dec 2013 10:52:31 GMT</pubDate>
        
        <dc:creator>chris</dc:creator>

        <description>&lt;p&gt;
As part of the upgrade from Squeeze to Wheezy, see &lt;a class="closed ticket" href="http://localhost:8080/trac/ticket/535" title="maintenance: Upgrade Puffin, Penguin and Parrot from Debian Squeeze to Wheezy (closed: fixed)"&gt;ticket:535&lt;/a&gt;, Munin graphs for APC were added:
&lt;/p&gt;
&lt;ul&gt;&lt;li&gt;&lt;a class="ext-link" href="https://penguin.transitionnetwork.org/munin/transitionnetwork.org/parrot.transitionnetwork.org/index.html#php-apc"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;https://penguin.transitionnetwork.org/munin/transitionnetwork.org/parrot.transitionnetwork.org/index.html#php-apc&lt;/a&gt;
&lt;/li&gt;&lt;li&gt;&lt;a class="ext-link" href="https://penguin.transitionnetwork.org/munin/transitionnetwork.org/penguin.transitionnetwork.org/index.html#php-apc"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;https://penguin.transitionnetwork.org/munin/transitionnetwork.org/penguin.transitionnetwork.org/index.html#php-apc&lt;/a&gt;
&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;
There is also more APC info here:
&lt;/p&gt;
&lt;ul&gt;&lt;li&gt;&lt;a class="ext-link" href="https://parrot.transitionnetwork.org/apc.php"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;https://parrot.transitionnetwork.org/apc.php&lt;/a&gt;
&lt;/li&gt;&lt;li&gt;&lt;a class="ext-link" href="https://penguin.transitionnetwork.org/info/apc.php"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;https://penguin.transitionnetwork.org/info/apc.php&lt;/a&gt;
&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;
The documentation for the variables which can be set in &lt;tt&gt;/etc/php5/mods-available/apc.ini&lt;/tt&gt; can be found here:
&lt;/p&gt;
&lt;ul&gt;&lt;li&gt;&lt;a class="ext-link" href="http://php.net/manual/en/apc.configuration.php"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;http://php.net/manual/en/apc.configuration.php&lt;/a&gt;
&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;
This monitoring is generating quite a high volume of warnings about fragmentation and purges and this ticket has been created to try to sort this issue out.
&lt;/p&gt;
</description>
        <category>Results</category>
        <comments>http://localhost:8080/trac/ticket/645#changelog</comments>
    </item><item>
        <link>http://localhost:8080/trac/ticket/675</link>
        <guid isPermaLink="false">http://localhost:8080/trac/ticket/675</guid>
        <title>#675: Piwik Geolocation</title>
        <pubDate>Tue, 14 Jan 2014 12:16:36 GMT</pubDate>
        
        <dc:creator>chris</dc:creator>

        <description>&lt;p&gt;
We have this warning in the Piwik admin interface:
&lt;/p&gt;
&lt;blockquote class="citation"&gt;
&lt;p&gt;
Geolocation works, but you are not using one of the recommended providers. If you have to import log files or do something else that requires setting IP addresses, use the PECL GeoIP implementation (recommended) or the PHP GeoIP implementation.
&lt;/p&gt;
&lt;/blockquote&gt;
&lt;p&gt;
We currently do Geolocation at a Nginx level, it is possible that it would now be better to switch to do it at a Piwik level, see the documentation here: &lt;a class="ext-link" href="http://piwik.org/docs/geo-locate/"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;http://piwik.org/docs/geo-locate/&lt;/a&gt;
&lt;/p&gt;
</description>
        <category>Results</category>
        <comments>http://localhost:8080/trac/ticket/675#changelog</comments>
    </item><item>
        <link>http://localhost:8080/trac/ticket/676</link>
        <guid isPermaLink="false">http://localhost:8080/trac/ticket/676</guid>
        <title>#676: Alternative to Skype for TTech Meetings</title>
        <pubDate>Tue, 14 Jan 2014 13:33:51 GMT</pubDate>
        
        <dc:creator>chris</dc:creator>

        <description>&lt;p&gt;
Jim has pointed out that:
&lt;/p&gt;
&lt;blockquote class="citation"&gt;
&lt;p&gt;
Skype costs us 15-30 minutes of grinding pain every time we do this!
&lt;/p&gt;
&lt;/blockquote&gt;
&lt;p&gt;
So what are the alternatives and what are our requirements?
&lt;/p&gt;
</description>
        <category>Results</category>
        <comments>http://localhost:8080/trac/ticket/676#changelog</comments>
    </item><item>
        <link>http://localhost:8080/trac/ticket/737</link>
        <guid isPermaLink="false">http://localhost:8080/trac/ticket/737</guid>
        <title>#737: SPF / Emails rejected from the website contact form</title>
        <pubDate>Thu, 05 Jun 2014 15:46:13 GMT</pubDate>
        
        <dc:creator>sam</dc:creator>

        <description>&lt;p&gt;
We had a user report that they could not send a message via our contact form:
&lt;/p&gt;
&lt;p&gt;
"Yesterday I sent a message to you via the contact form on the website. But obviously something went wrong: for I got a failure notice saying my message could not be delivered. Therefore I'm sending it directly via email (see below) hoping that you're receiving my message this way."
&lt;/p&gt;
&lt;p&gt;
&amp;lt;info@…&amp;gt;: host mx1.spamfiltering.com[72.249.150.158] said:
&lt;/p&gt;
&lt;blockquote&gt;
&lt;p&gt;
550 81.95.XX.XX is not allowed to send mail from gmx.de. Please see
&lt;a class="ext-link" href="http://www.openspf.net/Why?scope=mfrom;identity=userXX@gmx.de;ip=81.95.XX.XX"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;http://www.openspf.net/Why?scope=mfrom;identity=userXX@gmx.de;ip=81.95.XX.XX&lt;/a&gt;
(in reply to end of DATA command)
&lt;/p&gt;
&lt;/blockquote&gt;
&lt;p&gt;
(User details edited as this is publicly archived)
&lt;/p&gt;
&lt;p&gt;
I'm not sure I quite understand what's going on here. Chris indicated in email that this would affect other users whose email provider has set this kind of SPF record.
&lt;/p&gt;
&lt;p&gt;
Can we make an educated guess as to what proportion of email providers set this kind of SPF?
&lt;/p&gt;
&lt;p&gt;
How many messages do we never get to see? Is it a problem? Or a small enough number of users that we just don't worry about it?
&lt;/p&gt;
&lt;p&gt;
Thanks
&lt;/p&gt;
&lt;p&gt;
Sam
&lt;/p&gt;
</description>
        <category>Results</category>
        <comments>http://localhost:8080/trac/ticket/737#changelog</comments>
    </item><item>
        <link>http://localhost:8080/trac/ticket/740</link>
        <guid isPermaLink="false">http://localhost:8080/trac/ticket/740</guid>
        <title>#740: Add 'class button block' to Soundcloud block</title>
        <pubDate>Thu, 12 Jun 2014 09:55:05 GMT</pubDate>
        
        <dc:creator>sam</dc:creator>

        <description>&lt;p&gt;
Hi Ben
&lt;/p&gt;
&lt;p&gt;
Could you add 'class button block' to the block class settings for this block:
&lt;/p&gt;
&lt;p&gt;
&lt;a class="ext-link" href="https://www.transitionnetwork.org/admin/build/block/configure/block/98?destination=blogs%2Frob-hopkins"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;https://www.transitionnetwork.org/admin/build/block/configure/block/98?destination=blogs%2Frob-hopkins&lt;/a&gt;
&lt;/p&gt;
&lt;p&gt;
Or shall I give myself 'developer' permissions so I can add these myself?
&lt;/p&gt;
&lt;p&gt;
Thanks
&lt;/p&gt;
&lt;p&gt;
Sam
&lt;/p&gt;
</description>
        <category>Results</category>
        <comments>http://localhost:8080/trac/ticket/740#changelog</comments>
    </item><item>
        <link>http://localhost:8080/trac/ticket/763</link>
        <guid isPermaLink="false">http://localhost:8080/trac/ticket/763</guid>
        <title>#763: Server Backups</title>
        <pubDate>Mon, 21 Jul 2014 17:09:21 GMT</pubDate>
        
        <dc:creator>chris</dc:creator>

        <description>&lt;p&gt;
Two weeks ago &lt;a class="closed ticket" href="http://localhost:8080/trac/ticket/754#comment:21" title="maintenance: Can we upgrade from PHP 5.3? (closed: wontfix)"&gt;annesley asked&lt;/a&gt;:
&lt;/p&gt;
&lt;blockquote class="citation"&gt;
&lt;p&gt;
what off-site data storage, file backup and quick setup do we have?
&lt;/p&gt;
&lt;/blockquote&gt;
&lt;p&gt;
I &lt;a class="closed ticket" href="http://localhost:8080/trac/ticket/754#comment:22" title="maintenance: Can we upgrade from PHP 5.3? (closed: wontfix)"&gt;answered&lt;/a&gt;:
&lt;/p&gt;
&lt;blockquote class="citation"&gt;
&lt;p&gt;
The 3 virtual servers have their file system mounted off a BSD/NFS/ZFS file server and the whole file system is backed up and stored onto another BSD/ZFS server in the same data centre. We did have backups also being copied to a server in Manchester but this is currently off-line as the Manchester server needs a disk swapping and rebuilding as a BSD/ZFS server.
&lt;/p&gt;
&lt;/blockquote&gt;
&lt;p&gt;
A problem with this is that it's only me and Alan that have access to these backups, so I'd like to suggest I set up a new account for backups on our backup server and sort out cron jobs to rsync data to this account and document how people can access these backups.
&lt;/p&gt;
&lt;p&gt;
The result would be that everybody would have SFTP access to 60 days worth of snapshots of backups from all three servers whenever needed without any need for my or Alan's intervention.
&lt;/p&gt;
&lt;p&gt;
I expect this would take abount an hour to set up and another hour to document and help people understand it.
&lt;/p&gt;
&lt;p&gt;
There would be no additional cost to the TN because backup space is already paid for.
&lt;/p&gt;
</description>
        <category>Results</category>
        <comments>http://localhost:8080/trac/ticket/763#changelog</comments>
    </item><item>
        <link>http://localhost:8080/trac/ticket/768</link>
        <guid isPermaLink="false">http://localhost:8080/trac/ticket/768</guid>
        <title>#768: Piwik Archive Cron Error</title>
        <pubDate>Fri, 01 Aug 2014 17:14:59 GMT</pubDate>
        
        <dc:creator>chris</dc:creator>

        <description>&lt;p&gt;
Have been getting these emails from &lt;a class="wiki" href="http://localhost:8080/trac/wiki/PiwikServer"&gt;PiwikServer&lt;/a&gt;:
&lt;/p&gt;
&lt;pre class="wiki"&gt;From: root@penguin.webarch.net (Cron Daemon)
Date: Fri,  1 Aug 2014 14:06:48 +0100 (BST)
To: root@localhost
Subject: Cron &amp;lt;www-data@penguin&amp;gt; /web/stats.transitionnetwork.org/piwik/console core:archive --url=http://stats.transitionnetwork.org/ &amp;gt; /var/log/piwik-archive.log
ERROR CoreConsole[2014-08-01 13:05:18] [3e5ac] Got invalid response from API request:
+http://stats.transitionnetwork.org/index.php?module=API&amp;amp;method=API.get&amp;amp;idSite=1&amp;amp;period=week&amp;amp;date=last2&amp;amp;format=php&amp;amp;token_auth=XXXXXXXXXXXX&amp;amp;trigger=archivephp. Response was ' &amp;lt;div style='word-wrap: break-word; border: 3px solid red; padding:4px; width:70%;
+background-color:#FFFF96;'&amp;gt;         &amp;lt;strong&amp;gt;There is an error. Please report the message (Piwik 2.4.1)         and full backtrace in the &amp;lt;a
+href='?module=Proxy&amp;amp;action=redirect&amp;amp;url=http://forum.piwik.org' target='_blank'&amp;gt;Piwik forums&amp;lt;/a&amp;gt; (please do a Search first as it might have
+been reported already!).&amp;lt;br /&amp;gt;&amp;lt;br/&amp;gt;         Warning:&amp;lt;/strong&amp;gt;
+&amp;lt;em&amp;gt;file_get_contents(http://api.piwik.org/1.0/getLatestVersion/?piwik_version=2.4.1&amp;amp;php_version=5.4.4-14%2Bdeb7u12&amp;amp;url=https%3A%2F%2Fstats.
+transitionnetwork.org%2Fweb%2Fstats.transitionnetwork.org%2Fpiwik%2Fconsole&amp;amp;trigger=API&amp;amp;timezone=Europe%2FLondon): failed to open stream:
+HTTP requ
 est fail
 ed! &amp;lt;/em&amp;gt; in &amp;lt;strong&amp;gt;/web/stats.transitionnetwork.org/piwik/core/Http.php&amp;lt;/strong&amp;gt; on line &amp;lt;strong&amp;gt;406&amp;lt;/strong&amp;gt; &amp;lt;br /&amp;gt;&amp;lt;br /&amp;gt;Backtrace
+--&amp;amp;gt;&amp;lt;div style="font-family:Courier;font-size:10pt"&amp;gt;&amp;lt;br /&amp;gt; #0  Piwik\Error::errorHandler(...) called at [:]&amp;lt;br /&amp;gt; #1
+file_get_contents(...) called at [/web/stats.transitionnetwork.org/piwik/core/Http.php:406]&amp;lt;br /&amp;gt; #2  Piwik\Http::sendHttpRequestBy(...)
+called at [/web/stats.transitionnetwork.org/piwik/core/Http.php:94]&amp;lt;br /&amp;gt; #3  Piwik\Http::sendHttpRequest(...) called at
+[/web/stats.transitionnetwork.org/piwik/core/UpdateCheck.php:72]&amp;lt;br /&amp;gt; #4  Piwik\UpdateCheck::check(...) called at
+[/web/stats.transitionnetwork.org/piwik/plugins/CoreUpdater/CoreUpdater.php:142]&amp;lt;br /&amp;gt; #5
+Piwik\Plugins\CoreUpdater\CoreUpdater-&amp;gt;updateCheck(...) called at [:]&amp;lt;br /&amp;gt; #6  call_user_func_array(...) called at
+[/web/stats.transitionnetwork.org/piwik/core/EventDispatcher.php:98]&amp;lt;br /&amp;gt; #7  Piwik\EventDispatcher-&amp;gt;postEvent(...) called at
+[/web/stats.transitionnetwor
 k.org/pi
 wik/core/Piwik.php:766]&amp;lt;br /&amp;gt; #8  Piwik\Piwik::postEvent(...) called at
+[/web/stats.transitionnetwork.org/piwik/core/FrontController.php:391]&amp;lt;br /&amp;gt; #9  Piwik\FrontController-&amp;gt;init(...) called at
+[/web/stats.transitionnetwork.org/piwik/core/dispatch.php:33]&amp;lt;br /&amp;gt; #10  require_once(...) called at
+[/web/stats.transitionnetwork.org/piwik/index.php:47]&amp;lt;br /&amp;gt; #11  require_once(...) called at
+[/web/stats.transitionnetwork.org/piwik/core/CliMulti/RequestCommand.php:53]&amp;lt;br /&amp;gt; #12  Piwik\CliMulti\RequestCommand-&amp;gt;execute(...) called
+at [/web/stats.transitionnetwork.org/piwik/vendor/symfony/console/Symfony/Component/Console/Command/Command.php:252]&amp;lt;br /&amp;gt; #13
+Symfony\Component\Console\Command\Command-&amp;gt;run(...) called at
+[/web/stats.transitionnetwork.org/piwik/vendor/symfony/console/Symfony/Component/Console/Application.php:887]&amp;lt;br /&amp;gt; #14
+Symfony\Component\Console\Application-&amp;gt;doRunCommand(...) called at
+[/web/stats.transitionnetwork.org/piwik/vendor/symfony/console/Symfony/Component/Co
 nsole/Ap
 plication.php:193]&amp;lt;br /&amp;gt; #15  Symfony\Component\Console\Application-&amp;gt;doRun(...) called at
+[/web/stats.transitionnetwork.org/piwik/core/Console.php:64]&amp;lt;br /&amp;gt; #16  Piwik\Console-&amp;gt;doRun(...) called at
+[/web/stats.transitionnetwork.org/piwik/vendor/symfony/console/Symfony/Component/Console/Application.php:124]&amp;lt;br /&amp;gt; #17
+Symfony\Component\Console\Application-&amp;gt;run(...) called at [/web/stats.transitionnetwork.org/piwik/console:31]&amp;lt;br /&amp;gt; &amp;lt;/div&amp;gt;&amp;lt;br /&amp;gt;
+&amp;lt;/pre&amp;gt;&amp;lt;/div&amp;gt;&amp;lt;br /&amp;gt;  &amp;lt;div style='word-wrap: break-word; border: 3px solid red; padding:4px; width:70%; background-color:#FFFF96;'&amp;gt;
+&amp;lt;strong&amp;gt;There is an error. Please report the message (Piwik 2.4.1)         and full backtrace in the &amp;lt;a
+href='?module=Proxy&amp;amp;action=redirect&amp;amp;url=http://forum.piwik.org' target='_blank'&amp;gt;Piwik forums&amp;lt;/a&amp;gt; (please do a Search first as it might have
+been reported already!).&amp;lt;br /&amp;gt;&amp;lt;br/&amp;gt;         Warning:&amp;lt;/strong&amp;gt;
+&amp;lt;em&amp;gt;file_get_contents(http://api.piwik.org/1.0/getLatestVersion/?piwik_version=2.4.1&amp;amp;php_version
 =5.4.4-1
&lt;/pre&gt;</description>
        <category>Results</category>
        <comments>http://localhost:8080/trac/ticket/768#changelog</comments>
    </item><item>
        <link>http://localhost:8080/trac/ticket/787</link>
        <guid isPermaLink="false">http://localhost:8080/trac/ticket/787</guid>
        <title>#787: Access to Parrot</title>
        <pubDate>Mon, 15 Sep 2014 07:21:51 GMT</pubDate>
        
        <dc:creator>annesley</dc:creator>

        <description>&lt;p&gt;
is it ok for me to send through my normal, non-passphrase protected public key to you Chris for parrot?
&lt;/p&gt;
&lt;p&gt;
the documentation wants a passphrase protected key. however this may be what is causing the access issues from my laptop. i certainly could find a way around it but would suggest that the passphrase is not a great improvement to security anyway in this instance so it would be ok to use my normal public key. note that i can access all my other servers with the normal key without problems.
&lt;/p&gt;
</description>
        <category>Results</category>
        <comments>http://localhost:8080/trac/ticket/787#changelog</comments>
    </item><item>
        <link>http://localhost:8080/trac/ticket/814</link>
        <guid isPermaLink="false">http://localhost:8080/trac/ticket/814</guid>
        <title>#814: Higher that usual loads on PuffinServer since early September</title>
        <pubDate>Wed, 03 Dec 2014 17:12:35 GMT</pubDate>
        
        <dc:creator>chris</dc:creator>

        <description>&lt;p&gt;
The following &lt;a class="ext-link" href="https://penguin.transitionnetwork.org/munin/transitionnetwork.org/puffin.transitionnetwork.org/load.html"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;load graph&lt;/a&gt; from &lt;a class="wiki" href="http://localhost:8080/trac/wiki/PuffinServer"&gt;PuffinServer&lt;/a&gt; shows that the load increased substantially in early September 2014, does anyone know why?
&lt;/p&gt;
&lt;p&gt;
&lt;a style="padding:0; border:none" href="http://localhost:8080/trac/attachment/ticket/814/puffin-load-2014-11-03.png"&gt;&lt;img src="http://localhost:8080/trac/raw-attachment/ticket/814/puffin-load-2014-11-03.png" /&gt;&lt;/a&gt;
&lt;/p&gt;
&lt;p&gt;
When I found &lt;a class="ext-link" href="http://www.vdmi.nl/blog/i-went-drupal-733-and-all-i-got-was-slow-site"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;I went to Drupal 7.33 and all I got was a slow site&lt;/a&gt; I thought that perhaps a Drupal 7 site on the server could be the cause but 7.33 came out on &lt;a class="ext-link" href="https://www.drupal.org/drupal-7.33-release-notes"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;7th November 2014&lt;/a&gt;.
&lt;/p&gt;
&lt;p&gt;
Anyone have any ideas?
&lt;/p&gt;
</description>
        <category>Results</category>
        <comments>http://localhost:8080/trac/ticket/814#changelog</comments>
    </item><item>
        <link>http://localhost:8080/trac/ticket/824</link>
        <guid isPermaLink="false">http://localhost:8080/trac/ticket/824</guid>
        <title>#824: Analysis of the 2014 maintenance ticket time</title>
        <pubDate>Wed, 07 Jan 2015 15:48:14 GMT</pubDate>
        
        <dc:creator>chris</dc:creator>

        <description>&lt;p&gt;
Ed has ask that I spend up to 2 hours on an analysis of the 2014 maintenance ticket time for our meeting tomorrow in Bristol.
&lt;/p&gt;
&lt;p&gt;
See also:
&lt;/p&gt;
&lt;ul&gt;&lt;li&gt;&lt;a class="wiki" href="http://localhost:8080/trac/wiki/TransitionMaintenance"&gt;wiki:TransitionMaintenance&lt;/a&gt;
&lt;/li&gt;&lt;li&gt;&lt;a class="wiki" href="http://localhost:8080/trac/wiki/MaintenanceTasks"&gt;wiki:MaintenanceTasks&lt;/a&gt;
&lt;/li&gt;&lt;/ul&gt;</description>
        <category>Results</category>
        <comments>http://localhost:8080/trac/ticket/824#changelog</comments>
    </item><item>
        <link>http://localhost:8080/trac/ticket/882</link>
        <guid isPermaLink="false">http://localhost:8080/trac/ticket/882</guid>
        <title>#882: Login to PiWik stats</title>
        <pubDate>Tue, 03 Nov 2015 10:52:30 GMT</pubDate>
        
        <dc:creator>annesley</dc:creator>

        <description>&lt;p&gt;
hi Chris! could i have a login to &lt;a class="missing wiki"&gt;PiWik?&lt;/a&gt; stats please?
&lt;/p&gt;
</description>
        <category>Results</category>
        <comments>http://localhost:8080/trac/ticket/882#changelog</comments>
    </item><item>
        <link>http://localhost:8080/trac/ticket/887</link>
        <guid isPermaLink="false">http://localhost:8080/trac/ticket/887</guid>
        <title>#887: Lot's of failed logins on conference15.transitionnetwork.org</title>
        <pubDate>Fri, 04 Dec 2015 11:39:10 GMT</pubDate>
        
        <dc:creator>sam</dc:creator>

        <description>&lt;p&gt;
Hi all
&lt;/p&gt;
&lt;p&gt;
Overnight I had 150 notifications of failed login attempts and subsequent IP address bans from the &lt;a class="ext-link" href="https://en-gb.wordpress.org/plugins/wordfence/"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;https://en-gb.wordpress.org/plugins/wordfence/&lt;/a&gt; security plugin I installed.
&lt;/p&gt;
&lt;p&gt;
It's coming from multiple IP addresses in multiple countries.
&lt;/p&gt;
&lt;p&gt;
It seems like Wordfence is doing it's job and blocking IP's. I only mention it as I'm wondering if it could be related to the recent downtime.
&lt;/p&gt;
&lt;p&gt;
Feel free to close this ticket, just thought it was worth sticking in here.
&lt;/p&gt;
&lt;p&gt;
Thanks
&lt;/p&gt;
&lt;p&gt;
Sam
&lt;/p&gt;
</description>
        <category>Results</category>
        <comments>http://localhost:8080/trac/ticket/887#changelog</comments>
    </item><item>
        <link>http://localhost:8080/trac/ticket/892</link>
        <guid isPermaLink="false">http://localhost:8080/trac/ticket/892</guid>
        <title>#892: MediWiki Security Release: 1.26.1, 1.25.4, 1.24.5 and 1.23.12</title>
        <pubDate>Fri, 18 Dec 2015 10:46:18 GMT</pubDate>
        
        <dc:creator>chris</dc:creator>

        <description>&lt;p&gt;
Email to the &lt;a class="ext-link" href="https://lists.wikimedia.org/pipermail/mediawiki-announce/2015-December/000186.html"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;announcements list&lt;/a&gt;:
&lt;/p&gt;
&lt;pre class="wiki"&gt;I would like to announce the release of MediaWiki 1.26.1, 1.25.4, 1.24.5,
and
1.23.12.
These releases fix five security issues in core, in addition to other bug
fixes. Download links are given at the end of this email
== Security fixes ==
(T117899) SECURITY: $wgArticlePath can no longer be set to relative paths
that
do not begin with a slash. This enabled trivial XSS attacks. Configuration
values such as "http://my.wiki.com/wiki/$1" are fine, as are "/wiki/$1". A
value such as "$1" or "wiki/$1" is not and will now throw an error
(T119309) SECURITY: Use hash_compare() for edit token comparison
(T118032) SECURITY: Don't allow cURL to interpret POST parameters starting
with
'@' as file uploads
(T115522) SECURITY: Passwords generated by User::randomPassword() can no
longer
be shorter than $wgMinimalPasswordLength
(T97897) SECURITY: Improve IP parsing and trimming. Previous behavior could
result in improper blocks being issued
(T109724) SECURITY: Special:MyPage, Special:MyTalk, Special:MyContributions
and
related pages no longer use HTTP redirects and are now redirected by
MediaWiki
== Note about EOL of 1.24.x ==
Please note that 1.24.5 marks the end of support for the 1.24.x series of
releases. Technically this ended a few weeks ago with the release of 1.26.0
but
we dropped one final release of 1.24.x here to give it a nicer send off for
those who have not yet upgraded.
== Release notes ==
Full release notes for 1.26.1:
&amp;lt;https://www.mediawiki.org/wiki/Release_notes/1.26&amp;gt;
Full release notes for 1.25.4:
&amp;lt;https://www.mediawiki.org/wiki/Release_notes/1.25&amp;gt;
Full release notes for 1.24.5:
&amp;lt;https://www.mediawiki.org/wiki/Release_notes/1.24&amp;gt;
Full release notes for 1.23.12:
&amp;lt;https://www.mediawiki.org/wiki/Release_notes/1.23&amp;gt;
For information about how to upgrade, see
&amp;lt;https://www.mediawiki.org/wiki/Manual:Upgrading&amp;gt;
&lt;/pre&gt;</description>
        <category>Results</category>
        <comments>http://localhost:8080/trac/ticket/892#changelog</comments>
    </item><item>
        <link>http://localhost:8080/trac/ticket/912</link>
        <guid isPermaLink="false">http://localhost:8080/trac/ticket/912</guid>
        <title>#912: Stats for TTT</title>
        <pubDate>Tue, 21 Jun 2016 10:29:02 GMT</pubDate>
        
        <dc:creator>chris</dc:creator>

        <description>&lt;p&gt;
Nicola at TTT has asked:
&lt;/p&gt;
&lt;blockquote class="citation"&gt;
&lt;p&gt;
Could you let me know the size of the TTT and Transition Streets sites
please? I have Google Analytics for TTT but not for Transition Streets, and
I wonder if you could also tell me how many visitors it gets annually?
&lt;/p&gt;
&lt;/blockquote&gt;
</description>
        <category>Results</category>
        <comments>http://localhost:8080/trac/ticket/912#changelog</comments>
    </item><item>
        <link>http://localhost:8080/trac/ticket/924</link>
        <guid isPermaLink="false">http://localhost:8080/trac/ticket/924</guid>
        <title>#924: Sheffield Server Shutdown Timetable?</title>
        <pubDate>Mon, 05 Sep 2016 08:46:27 GMT</pubDate>
        
        <dc:creator>chris</dc:creator>

        <description>&lt;p&gt;
Since &lt;a class="ext-link" href="https://www.transitionnetwork.org/"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;www.transitionnetwork.org&lt;/a&gt; is now running on &lt;tt&gt;dedi2835.your-server.de&lt;/tt&gt; there seems little point in the Transition Network continuing to pay for the &lt;a class="wiki" href="http://localhost:8080/trac/wiki/PuffinServer"&gt;PuffinServer&lt;/a&gt; and my time doing sysadmin updates on it?
&lt;/p&gt;
&lt;p&gt;
If the Transition Network would like Webarchitects to shutdown and delete this server and all it's backups could you please let me know when you would like it doing?
&lt;/p&gt;
&lt;p&gt;
I guess the same goes for &lt;a class="wiki" href="http://localhost:8080/trac/wiki/PenguinServer"&gt;PenguinServer&lt;/a&gt; and &lt;a class="wiki" href="http://localhost:8080/trac/wiki/ParrotServer"&gt;ParrotServer&lt;/a&gt;, though these servers still have live sites on them, including this Trac site that I use to keep track of time worked -- when &lt;a class="wiki" href="http://localhost:8080/trac/wiki/PenguinServer"&gt;PenguinServer&lt;/a&gt; is shutdown I will no longer have a public place to document the time I work for the Transition Network and all the server and site documentation from the last six years will be lost.
&lt;/p&gt;
</description>
        <category>Results</category>
        <comments>http://localhost:8080/trac/ticket/924#changelog</comments>
    </item><item>
        <link>http://localhost:8080/trac/ticket/264</link>
        <guid isPermaLink="false">http://localhost:8080/trac/ticket/264</guid>
        <title>#264: Context changes</title>
        <pubDate>Fri, 17 Jun 2011 12:23:53 GMT</pubDate>
        
        <dc:creator>ed</dc:creator>

        <description>&lt;p&gt;
As discussed at meeting. Contexts not really working. Blocks on a right all over the place. Perhaps need some new page layouts (?) or other piece of work with panels (?) to sort out.
&lt;/p&gt;
&lt;p&gt;
One page to start with is the Training page (and subsection). Ed to meet Trainers and their marketing consultant on 21/6.
&lt;/p&gt;
&lt;p&gt;
Jim please advise Ed what Jim needs to
&lt;/p&gt;
</description>
        <category>Results</category>
        <comments>http://localhost:8080/trac/ticket/264#changelog</comments>
    </item><item>
        <link>http://localhost:8080/trac/ticket/513</link>
        <guid isPermaLink="false">http://localhost:8080/trac/ticket/513</guid>
        <title>#513: Please clarify what is a widget user</title>
        <pubDate>Mon, 11 Mar 2013 08:17:47 GMT</pubDate>
        
        <dc:creator>ed</dc:creator>

        <description>&lt;p&gt;
What is a widget user? What role is this? Please clarify?
&lt;/p&gt;
</description>
        <category>Results</category>
        <comments>http://localhost:8080/trac/ticket/513#changelog</comments>
    </item><item>
        <link>http://localhost:8080/trac/ticket/537</link>
        <guid isPermaLink="false">http://localhost:8080/trac/ticket/537</guid>
        <title>#537: Parrot setup and documentation</title>
        <pubDate>Tue, 30 Apr 2013 11:11:36 GMT</pubDate>
        
        <dc:creator>chris</dc:creator>

        <description>&lt;p&gt;
Things done setting up parrot.webarch.net -- a new virtual machine for running Wordpress sites, see &lt;a class="wiki" href="http://localhost:8080/trac/wiki/ParrotServer"&gt;wiki:ParrotServer&lt;/a&gt;
&lt;/p&gt;
</description>
        <category>Results</category>
        <comments>http://localhost:8080/trac/ticket/537#changelog</comments>
    </item><item>
        <link>http://localhost:8080/trac/ticket/540</link>
        <guid isPermaLink="false">http://localhost:8080/trac/ticket/540</guid>
        <title>#540: HTTPS for WordPress sites</title>
        <pubDate>Wed, 01 May 2013 20:20:32 GMT</pubDate>
        
        <dc:creator>chris</dc:creator>

        <description>&lt;p&gt;
Currently the &lt;a class="wiki" href="http://localhost:8080/trac/wiki/WordPress"&gt;wiki:WordPress&lt;/a&gt; sites have have the following SSL certificates:
&lt;/p&gt;
&lt;ul&gt;&lt;li&gt;&lt;a class="ext-link" href="https://www.intransitionmovie.com/"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;https://www.intransitionmovie.com/&lt;/a&gt; -- Gandi commercial certificate and dedicated IP address
&lt;/li&gt;&lt;li&gt;&lt;a class="ext-link" href="https://www.reconomy.org/"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;https://www.reconomy.org/&lt;/a&gt; -- CAcert non-commercial certificate and shared IP address (SNI)
&lt;/li&gt;&lt;li&gt;&lt;a class="ext-link" href="https://www.earthinheritors.net/"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;https://www.earthinheritors.net/&lt;/a&gt; -- CAcert non-commercial certificate and shared IP address (SNI)
&lt;/li&gt;&lt;li&gt;&lt;a class="ext-link" href="https://parrot.transitionnetwork.org/"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;https://parrot.transitionnetwork.org/&lt;/a&gt; -- Gandi TN wild card cert and shared IP address (SNI)
&lt;/li&gt;&lt;li&gt;&lt;a class="ext-link" href="https://parrot.webarch.net/"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;https://parrot.webarch.net/&lt;/a&gt; -- CAcert non-commercial certificate, this is the default site for clients without SNI support
&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;
None of the site are set to enforce HTTPS for logins, this should be done ASAP for intransitionmovie.com
&lt;/p&gt;
&lt;p&gt;
I think we have several options going forward, the first 3 of this are the only viable ones though, IMHO:
&lt;/p&gt;
&lt;h2 id="SNIandSeperateCertsandSharedIP"&gt;SNI and Seperate Certs and Shared IP&lt;/h2&gt;
&lt;p&gt;
Get a Gandi SSL cert for each site and rely on SNI rather than having a dedicated IP address for each site, this is the cheapest way to solve the problem, the certs are around £15 each.
&lt;/p&gt;
&lt;p&gt;
The clients that don't work with SNI are listed here: &lt;a class="ext-link" href="https://en.wikipedia.org/wiki/Server_Name_Indication#Client_side"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;https://en.wikipedia.org/wiki/Server_Name_Indication#Client_side&lt;/a&gt;
&lt;/p&gt;
&lt;h2 id="Multi-domainCertandSharedIP"&gt;Multi-domain Cert and Shared IP&lt;/h2&gt;
&lt;p&gt;
Get a Gandi SSL cert with all the domains in, this is a little more expensive than seperate certs (around £20 per site) but it means that all the clients that don't work with SNI will work. One issue with this is when adding new site is that a brand new cert would be needed as additional names can't be added to multi-domain certs during their lifetime, this could be worked around by getting a single domain cert to run to the end of the life of the multi domain cert (this would use SNI).
&lt;/p&gt;
&lt;h2 id="SeperateCertsandDedicatedIPs"&gt;Seperate Certs and Dedicated IPs&lt;/h2&gt;
&lt;p&gt;
Getting a cert per site and a dedicated IP per site, this would cost the most as each IP address costs around the same as each cert, (so about £30 per site). It also seems like a great waste to use up a IP per site when they are so scarce and when technical workarounds to this old problem like multi-domain certs and SNI are now available. I don't favour this option.
&lt;/p&gt;
&lt;h2 id="Non-commercialCAcertCert"&gt;Non-commercial CAcert Cert&lt;/h2&gt;
&lt;p&gt;
This is the cheapest, it's fine if people are able to install the &lt;a class="ext-link" href="http://cacert.org/"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;http://cacert.org/&lt;/a&gt; root certificate but this is something that non-technical people seem to find hard and they also don't understand the security warnings that they get when the cert isn't installed. This option is the one currently in use but it's far from ideal and one of the other options needs to be adopted before enforcing HTTPS logins is deployed. I don't favour this option.
&lt;/p&gt;
</description>
        <category>Results</category>
        <comments>http://localhost:8080/trac/ticket/540#changelog</comments>
    </item><item>
        <link>http://localhost:8080/trac/ticket/582</link>
        <guid isPermaLink="false">http://localhost:8080/trac/ticket/582</guid>
        <title>#582: TN.org platform and sites</title>
        <pubDate>Mon, 02 Sep 2013 09:30:02 GMT</pubDate>
        
        <dc:creator>jim</dc:creator>

        <description>&lt;p&gt;
The TN.org platform and Drupal site updates are to be tracked in this ticket.
&lt;/p&gt;
&lt;p&gt;
Current PROD platform build = &lt;strong&gt;P009&lt;/strong&gt;
Current STG platform build = &lt;strong&gt;S010&lt;/strong&gt;
&lt;/p&gt;
&lt;p&gt;
Updates pending:
&lt;/p&gt;
&lt;ul&gt;&lt;li&gt;SECURITY UPDATE - NO RISK: Pressflow core 6.30 is due, but the security holes fixed do not affect us, low priority. Platforms: present in S010, but not in P009.
&lt;/li&gt;&lt;/ul&gt;</description>
        <category>Results</category>
        <comments>http://localhost:8080/trac/ticket/582#changelog</comments>
    </item><item>
        <link>http://localhost:8080/trac/ticket/587</link>
        <guid isPermaLink="false">http://localhost:8080/trac/ticket/587</guid>
        <title>#587: Puffin MySQL Tuning</title>
        <pubDate>Thu, 05 Sep 2013 12:54:47 GMT</pubDate>
        
        <dc:creator>chris</dc:creator>

        <description>&lt;p&gt;
This ticket is to track the tuning we do to MySQL on &lt;a class="wiki" href="http://localhost:8080/trac/wiki/PuffinServer"&gt;PuffinServer&lt;/a&gt;.
&lt;/p&gt;
&lt;p&gt;
See also previous comments on this issue:
&lt;/p&gt;
&lt;ul&gt;&lt;li&gt;&lt;a class="closed ticket" href="http://localhost:8080/trac/ticket/555#comment:12" title="maintenance: Load spikes causing the TN site to be stopped for 15 min at a time (closed: fixed)"&gt;ticket:555#comment:12&lt;/a&gt;
&lt;/li&gt;&lt;li&gt;&lt;a class="closed ticket" href="http://localhost:8080/trac/ticket/555#comment:15" title="maintenance: Load spikes causing the TN site to be stopped for 15 min at a time (closed: fixed)"&gt;ticket:555#comment:15&lt;/a&gt;
&lt;/li&gt;&lt;li&gt;&lt;a class="closed ticket" href="http://localhost:8080/trac/ticket/555#comment:16" title="maintenance: Load spikes causing the TN site to be stopped for 15 min at a time (closed: fixed)"&gt;ticket:555#comment:16&lt;/a&gt;
&lt;/li&gt;&lt;li&gt;&lt;a class="closed ticket" href="http://localhost:8080/trac/ticket/555#comment:17" title="maintenance: Load spikes causing the TN site to be stopped for 15 min at a time (closed: fixed)"&gt;ticket:555#comment:17&lt;/a&gt;
&lt;/li&gt;&lt;li&gt;&lt;a class="closed ticket" href="http://localhost:8080/trac/ticket/555#comment:20" title="maintenance: Load spikes causing the TN site to be stopped for 15 min at a time (closed: fixed)"&gt;ticket:555#comment:20&lt;/a&gt;
&lt;/li&gt;&lt;li&gt;&lt;a class="closed ticket" href="http://localhost:8080/trac/ticket/555#comment:29" title="maintenance: Load spikes causing the TN site to be stopped for 15 min at a time (closed: fixed)"&gt;ticket:555#comment:29&lt;/a&gt;
&lt;/li&gt;&lt;li&gt;&lt;a class="closed ticket" href="http://localhost:8080/trac/ticket/555#SettingsChanged" title="maintenance: Load spikes causing the TN site to be stopped for 15 min at a time (closed: fixed)"&gt;ticket:555#SettingsChanged&lt;/a&gt;
&lt;/li&gt;&lt;li&gt;&lt;a class="closed ticket" href="http://localhost:8080/trac/ticket/555#comment:39" title="maintenance: Load spikes causing the TN site to be stopped for 15 min at a time (closed: fixed)"&gt;ticket:555#comment:39&lt;/a&gt;
&lt;/li&gt;&lt;li&gt;&lt;a class="closed ticket" href="http://localhost:8080/trac/ticket/555#comment:56" title="maintenance: Load spikes causing the TN site to be stopped for 15 min at a time (closed: fixed)"&gt;ticket:555#comment:56&lt;/a&gt;
&lt;/li&gt;&lt;li&gt;&lt;a class="closed ticket" href="http://localhost:8080/trac/ticket/555#comment:57" title="maintenance: Load spikes causing the TN site to be stopped for 15 min at a time (closed: fixed)"&gt;ticket:555#comment:57&lt;/a&gt;
&lt;/li&gt;&lt;li&gt;&lt;a class="closed ticket" href="http://localhost:8080/trac/ticket/555#comment:60" title="maintenance: Load spikes causing the TN site to be stopped for 15 min at a time (closed: fixed)"&gt;ticket:555#comment:60&lt;/a&gt;
&lt;/li&gt;&lt;li&gt;&lt;a class="closed ticket" href="http://localhost:8080/trac/ticket/555#comment:65" title="maintenance: Load spikes causing the TN site to be stopped for 15 min at a time (closed: fixed)"&gt;ticket:555#comment:65&lt;/a&gt;
&lt;/li&gt;&lt;li&gt;&lt;a class="closed ticket" href="http://localhost:8080/trac/ticket/555#comment:66" title="maintenance: Load spikes causing the TN site to be stopped for 15 min at a time (closed: fixed)"&gt;ticket:555#comment:66&lt;/a&gt;
&lt;/li&gt;&lt;li&gt;&lt;a class="closed ticket" href="http://localhost:8080/trac/ticket/555#comment:67" title="maintenance: Load spikes causing the TN site to be stopped for 15 min at a time (closed: fixed)"&gt;ticket:555#comment:67&lt;/a&gt;
&lt;/li&gt;&lt;li&gt;&lt;a class="closed ticket" href="http://localhost:8080/trac/ticket/555#comment:68" title="maintenance: Load spikes causing the TN site to be stopped for 15 min at a time (closed: fixed)"&gt;ticket:555#comment:68&lt;/a&gt;
&lt;/li&gt;&lt;li&gt;&lt;a class="closed ticket" href="http://localhost:8080/trac/ticket/555#comment:82" title="maintenance: Load spikes causing the TN site to be stopped for 15 min at a time (closed: fixed)"&gt;ticket:555#comment:82&lt;/a&gt;
&lt;/li&gt;&lt;li&gt;&lt;a class="closed ticket" href="http://localhost:8080/trac/ticket/555#comment:85" title="maintenance: Load spikes causing the TN site to be stopped for 15 min at a time (closed: fixed)"&gt;ticket:555#comment:85&lt;/a&gt;
&lt;/li&gt;&lt;/ul&gt;</description>
        <category>Results</category>
        <comments>http://localhost:8080/trac/ticket/587#changelog</comments>
    </item><item>
        <link>http://localhost:8080/trac/ticket/619</link>
        <guid isPermaLink="false">http://localhost:8080/trac/ticket/619</guid>
        <title>#619: Upgrade WordPress sites to 3.9.1</title>
        <pubDate>Fri, 15 Nov 2013 14:38:05 GMT</pubDate>
        
        <dc:creator>chris</dc:creator>

        <description>&lt;p&gt;
News regarding the &lt;a class="wiki" href="http://localhost:8080/trac/wiki/WordPress"&gt;WordPress&lt;/a&gt; versions released since the sites were upgraded to 3.6.1 on &lt;a class="closed ticket" href="http://localhost:8080/trac/ticket/594" title="maintenance: WordPress 3.6.1 Maintenance and Security Release (closed: fixed)"&gt;ticket:594&lt;/a&gt;
&lt;/p&gt;
&lt;ul&gt;&lt;li&gt;&lt;a class="ext-link" href="https://wordpress.org/news/2013/10/wordpress-3-7-1/"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;https://wordpress.org/news/2013/10/wordpress-3-7-1/&lt;/a&gt;
&lt;/li&gt;&lt;li&gt;&lt;a class="ext-link" href="https://wordpress.org/news/2013/10/basie/"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;https://wordpress.org/news/2013/10/basie/&lt;/a&gt;
&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;
We should consider how best to upgrade the &lt;a class="wiki" href="http://localhost:8080/trac/wiki/WordPress"&gt;wiki:WordPress&lt;/a&gt; sites running on &lt;a class="wiki" href="http://localhost:8080/trac/wiki/ParrotServer"&gt;wiki:ParrotServer&lt;/a&gt; and then ensure that they are upgraded.
&lt;/p&gt;
</description>
        <category>Results</category>
        <comments>http://localhost:8080/trac/ticket/619#changelog</comments>
    </item><item>
        <link>http://localhost:8080/trac/ticket/692</link>
        <guid isPermaLink="false">http://localhost:8080/trac/ticket/692</guid>
        <title>#692: Debian Updates</title>
        <pubDate>Tue, 25 Feb 2014 15:16:17 GMT</pubDate>
        
        <dc:creator>chris</dc:creator>

        <description>&lt;p&gt;
This is a ticket to track debian upgrades to the &lt;a class="wiki" href="http://localhost:8080/trac/wiki/PuffinServer"&gt;wiki:PuffinServer&lt;/a&gt;, &lt;a class="wiki" href="http://localhost:8080/trac/wiki/PenguinServer"&gt;wiki:PenguinServer&lt;/a&gt; and &lt;a class="wiki" href="http://localhost:8080/trac/wiki/ParrotServer"&gt;wiki:ParrotServer&lt;/a&gt; the time they take.
&lt;/p&gt;
&lt;p&gt;
See:
&lt;/p&gt;
&lt;ul&gt;&lt;li&gt;&lt;a class="ext-link" href="http://lists.debian.org/debian-security-announce/recent"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;Recent Debian security announcements&lt;/a&gt;
&lt;/li&gt;&lt;li&gt;&lt;a class="ext-link" href="https://lists.debian.org/debian-lts-announce/recent"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;Recent Debian LTS security announcements&lt;/a&gt;
&lt;/li&gt;&lt;li&gt;&lt;a class="ext-link" href="http://lists.askmonty.org/pipermail/announce/"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;MariaDB Announce List archives&lt;/a&gt;
&lt;/li&gt;&lt;li&gt;&lt;a class="ext-link" href="http://groups.google.com/group/phusion-passenger-announcements"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;phusion-passenger-announcements archive&lt;/a&gt;
&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;
These updates are generally done using the &lt;a class="wiki" href="http://localhost:8080/trac/wiki/AptitudeUpdateScript"&gt;wiki:AptitudeUpdateScript&lt;/a&gt; and this records all the changes in the &lt;tt&gt;/root/Changelog&lt;/tt&gt; and then the contents of the Changelog are pasted into the ticket to document the upgrade.
&lt;/p&gt;
&lt;p&gt;
This ticket took over from &lt;a class="closed ticket" href="http://localhost:8080/trac/ticket/218" title="maintenance: Debian upgrades and updates (closed: fixed)"&gt;ticket:218&lt;/a&gt; on 2014-02-25.
&lt;/p&gt;
</description>
        <category>Results</category>
        <comments>http://localhost:8080/trac/ticket/692#changelog</comments>
    </item><item>
        <link>http://localhost:8080/trac/ticket/701</link>
        <guid isPermaLink="false">http://localhost:8080/trac/ticket/701</guid>
        <title>#701: Emails &amp; Telephone calls</title>
        <pubDate>Tue, 18 Mar 2014 09:38:24 GMT</pubDate>
        
        <dc:creator>paul</dc:creator>

        <description></description>
        <category>Results</category>
        <comments>http://localhost:8080/trac/ticket/701#changelog</comments>
    </item><item>
        <link>http://localhost:8080/trac/ticket/711</link>
        <guid isPermaLink="false">http://localhost:8080/trac/ticket/711</guid>
        <title>#711: Emails &amp; Telephone calls</title>
        <pubDate>Tue, 01 Apr 2014 13:47:56 GMT</pubDate>
        
        <dc:creator>paul</dc:creator>

        <description></description>
        <category>Results</category>
        <comments>http://localhost:8080/trac/ticket/711#changelog</comments>
    </item><item>
        <link>http://localhost:8080/trac/ticket/712</link>
        <guid isPermaLink="false">http://localhost:8080/trac/ticket/712</guid>
        <title>#712: Create a new stgX.transitionnetwork.org site</title>
        <pubDate>Tue, 01 Apr 2014 15:03:53 GMT</pubDate>
        
        <dc:creator>sam</dc:creator>

        <description>&lt;p&gt;
Hi Paul
&lt;/p&gt;
&lt;p&gt;
I have been trying to build a staging site using your Github repository with the changes you made for ticket : &lt;a class="ext-link" href="https://trac.transitionnetwork.org/trac/ticket/693"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;https://trac.transitionnetwork.org/trac/ticket/693&lt;/a&gt;
&lt;/p&gt;
&lt;p&gt;
I have edited the D6 s008 platform: &lt;a class="ext-link" href="https://tn.puffin.webarch.net/node/1157/edit"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;https://tn.puffin.webarch.net/node/1157/edit&lt;/a&gt; to use your makefile.
&lt;/p&gt;
&lt;p&gt;
It builds a site, but I just get an empty pressflow site at the end.
&lt;/p&gt;
&lt;p&gt;
Could you build a staging site using your makefile?
&lt;/p&gt;
&lt;p&gt;
Thanks
&lt;/p&gt;
&lt;p&gt;
Sam
&lt;/p&gt;
</description>
        <category>Results</category>
        <comments>http://localhost:8080/trac/ticket/712#changelog</comments>
    </item><item>
        <link>http://localhost:8080/trac/ticket/750</link>
        <guid isPermaLink="false">http://localhost:8080/trac/ticket/750</guid>
        <title>#750: Annual update of SSL cert fingerprint for incomming emails to Trac</title>
        <pubDate>Thu, 26 Jun 2014 13:42:42 GMT</pubDate>
        
        <dc:creator>chris</dc:creator>

        <description>&lt;p&gt;
Laura said she had replied to Trac email today but they didn't get through.
&lt;/p&gt;
&lt;p&gt;
The issues has come up before, see &lt;a class="wiki" href="http://localhost:8080/trac/wiki/TransitionTrac#Fetchmail"&gt;wiki:TransitionTrac#Fetchmail&lt;/a&gt;
&lt;/p&gt;
</description>
        <category>Results</category>
        <comments>http://localhost:8080/trac/ticket/750#changelog</comments>
    </item><item>
        <link>http://localhost:8080/trac/ticket/758</link>
        <guid isPermaLink="false">http://localhost:8080/trac/ticket/758</guid>
        <title>#758: * Advisory ID: DRUPAL-SA-CORE-2014-003</title>
        <pubDate>Wed, 16 Jul 2014 21:55:29 GMT</pubDate>
        
        <dc:creator>paul</dc:creator>

        <description>&lt;p&gt;
View online: &lt;a class="ext-link" href="https://www.drupal.org/SA-CORE-2014-003"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;https://www.drupal.org/SA-CORE-2014-003&lt;/a&gt;
&lt;/p&gt;
&lt;ul&gt;&lt;li&gt;Advisory ID: DRUPAL-SA-CORE-2014-003
&lt;/li&gt;&lt;li&gt;Project: Drupal core &lt;a class="missing changeset" title="No default repository defined"&gt;[1]&lt;/a&gt;
&lt;/li&gt;&lt;li&gt;Version: 6.x, 7.x
&lt;/li&gt;&lt;li&gt;Date: 2014-July-16
&lt;/li&gt;&lt;li&gt;Security risk: Critical &lt;a class="missing changeset" title="No default repository defined"&gt;[2]&lt;/a&gt;
&lt;/li&gt;&lt;li&gt;Exploitable from: Remote
&lt;/li&gt;&lt;li&gt;Vulnerability: Multiple vulnerabilities
&lt;/li&gt;&lt;/ul&gt;&lt;hr /&gt;
&lt;hr /&gt;
&lt;p&gt;
Multiple vulnerabilities were fixed in the supported Drupal core versions 6
and 7.
&lt;/p&gt;
&lt;p&gt;
.... Denial of service with malicious HTTP Host header (Base system - Drupal
6 and 7 - Critical)
&lt;/p&gt;
&lt;p&gt;
Drupal core's multisite feature dynamically determines which configuration
file to use based on the HTTP Host header.
&lt;/p&gt;
&lt;p&gt;
The HTTP Host header validation does not sufficiently check
maliciously-crafted header values, thereby exposing a denial of service
vulnerability.
&lt;/p&gt;
&lt;p&gt;
.... Access bypass (File module - Drupal 7 - Critical)
&lt;/p&gt;
&lt;p&gt;
The File module included in Drupal 7 core allows attaching files to pieces of
content. The module doesn't sufficiently check permission to view the
attached file when attaching a file that was previously uploaded. This could
allow attackers to gain access to private files.
&lt;/p&gt;
&lt;p&gt;
This vulnerability is mitigated by the fact that the attacker must have
permission to create or edit content with a file field.
&lt;/p&gt;
&lt;p&gt;
Note: The Drupal 6 &lt;a class="missing wiki"&gt;FileField?&lt;/a&gt; &lt;a class="missing changeset" title="No default repository defined"&gt;[3]&lt;/a&gt; module is affected by a similar issue (see
SA-CONTRIB-2014-071 - &lt;a class="missing wiki"&gt;FileField?&lt;/a&gt; - Access bypass &lt;a class="missing changeset" title="No default repository defined"&gt;[4]&lt;/a&gt;) and requires an update
to the current security release of Drupal 6 core in order for the fix
released there to work correctly. However, Drupal 6 core itself is not
directly affected.
&lt;/p&gt;
&lt;p&gt;
.... Cross-site scripting (Form API option groups - Drupal 6 and 7 -
Moderately critical)
&lt;/p&gt;
&lt;p&gt;
A cross-site scripting vulnerability was found due to Drupal's form API
failing to sanitize option group labels in select elements. This
vulnerability affects Drupal 6 core directly, and likely affects Drupal 7
forms provided by contributed or custom modules.
&lt;/p&gt;
&lt;p&gt;
This vulnerability is mitigated by the fact that it requires the "administer
taxonomy" permission to exploit in Drupal 6 core, and there is no known
exploit within Drupal 7 core itself.
&lt;/p&gt;
&lt;p&gt;
.... Cross-site scripting (Ajax system - Drupal 7 - Moderately critical)
&lt;/p&gt;
&lt;p&gt;
A reflected cross-site scripting vulnerability was found in certain forms
containing a combination of an Ajax-enabled textfield (for example, an
autocomplete field) and a file field.
&lt;/p&gt;
&lt;p&gt;
This vulnerability is mitigated by the fact that an attacker can only trigger
the attack in a limited set of circumstances, usually requiring custom or
contributed modules.
&lt;/p&gt;
&lt;hr /&gt;
&lt;hr /&gt;
&lt;ul&gt;&lt;li&gt;/A CVE identifier &lt;a class="missing changeset" title="No default repository defined"&gt;[5]&lt;/a&gt; will be requested, and added upon issuance, in
&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;
accordance with Drupal Security Team processes./
&lt;/p&gt;
&lt;hr /&gt;
&lt;hr /&gt;
&lt;ul&gt;&lt;li&gt;Drupal core 6.x versions prior to 6.32.
&lt;/li&gt;&lt;li&gt;Drupal core 7.x versions prior to 7.29.
&lt;/li&gt;&lt;/ul&gt;&lt;hr /&gt;
&lt;hr /&gt;
&lt;p&gt;
Install the latest version:
&lt;/p&gt;
&lt;ul&gt;&lt;li&gt;If you use Drupal 6.x, upgrade to Drupal core 6.32. &lt;a class="missing changeset" title="No default repository defined"&gt;[6]&lt;/a&gt;
&lt;/li&gt;&lt;li&gt;If you use Drupal 7.x, upgrade to Drupal core 7.29. &lt;a class="missing changeset" title="No default repository defined"&gt;[7]&lt;/a&gt;
&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;
Also see the Drupal core &lt;a class="missing changeset" title="No default repository defined"&gt;[8]&lt;/a&gt; project page.
&lt;/p&gt;
&lt;hr /&gt;
&lt;hr /&gt;
&lt;ul&gt;&lt;li&gt;The denial of service vulnerability using malicious HTTP Host headers was
&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;
reported by Régis Leroy &lt;a class="missing changeset" title="No default repository defined"&gt;[9]&lt;/a&gt;.
&lt;/p&gt;
&lt;ul&gt;&lt;li&gt;The access bypass vulnerability in the File module was reported by Ivan
&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;
Ch
&lt;a class="missing changeset" title="No default repository defined"&gt;[10]&lt;/a&gt;.
&lt;/p&gt;
&lt;ul&gt;&lt;li&gt;The cross-site scripting vulnerability with Form API option groups was
&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;
reported by Károly Négyesi &lt;a class="missing changeset" title="No default repository defined"&gt;[11]&lt;/a&gt;.
&lt;/p&gt;
&lt;ul&gt;&lt;li&gt;The cross-site scripting vulnerability in the Ajax system was reported by
&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;
mani22test &lt;a class="missing changeset" title="No default repository defined"&gt;[12]&lt;/a&gt;.
&lt;/p&gt;
&lt;hr /&gt;
&lt;hr /&gt;
&lt;ul&gt;&lt;li&gt;The denial of service vulnerability using malicious HTTP Host headers was
&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;
fixed by Régis Leroy &lt;a class="missing changeset" title="No default repository defined"&gt;[13]&lt;/a&gt;, and by Klaus Purer &lt;a class="missing changeset" title="No default repository defined"&gt;[14]&lt;/a&gt; of the Drupal
Security
Team.
&lt;/p&gt;
&lt;ul&gt;&lt;li&gt;The access bypass vulnerability in the File module was fixed by Nate Haug
&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;
&lt;a class="missing changeset" title="No default repository defined"&gt;[15]&lt;/a&gt; and Ivan Ch &lt;a class="missing changeset" title="No default repository defined"&gt;[16]&lt;/a&gt;, and by Drupal Security Team members David
Rothstein
&lt;a class="missing changeset" title="No default repository defined"&gt;[17]&lt;/a&gt;, Heine Deelstra &lt;a class="missing changeset" title="No default repository defined"&gt;[18]&lt;/a&gt; and David Snopek &lt;a class="missing changeset" title="No default repository defined"&gt;[19]&lt;/a&gt;.
&lt;/p&gt;
&lt;ul&gt;&lt;li&gt;The cross-site scripting vulnerability with Form API option groups was
&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;
fixed by Greg Knaddison &lt;a class="missing changeset" title="No default repository defined"&gt;[20]&lt;/a&gt; of the Drupal Security Team.
&lt;/p&gt;
&lt;ul&gt;&lt;li&gt;The cross-site scripting vulnerability in the Ajax system was fixed by
&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;
Neil Drumm &lt;a class="missing changeset" title="No default repository defined"&gt;[21]&lt;/a&gt; of the Drupal Security Team.
&lt;/p&gt;
&lt;hr /&gt;
&lt;hr /&gt;
&lt;ul&gt;&lt;li&gt;The Drupal Security Team &lt;a class="missing changeset" title="No default repository defined"&gt;[22]&lt;/a&gt;
&lt;/li&gt;&lt;/ul&gt;&lt;hr /&gt;
&lt;hr /&gt;
&lt;p&gt;
The Drupal security team can be reached at security at drupal.org or via the
contact form at &lt;a class="ext-link" href="http://drupal.org/contact"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;http://drupal.org/contact&lt;/a&gt; &lt;a class="missing changeset" title="No default repository defined"&gt;[23]&lt;/a&gt;.
&lt;/p&gt;
&lt;p&gt;
Learn more about the Drupal Security team and their policies &lt;a class="missing changeset" title="No default repository defined"&gt;[24]&lt;/a&gt;, writing
secure code for Drupal &lt;a class="missing changeset" title="No default repository defined"&gt;[25]&lt;/a&gt;, and securing your site &lt;a class="missing changeset" title="No default repository defined"&gt;[26]&lt;/a&gt;.
&lt;/p&gt;
&lt;p&gt;
Follow the Drupal Security Team on Twitter at
&lt;a class="ext-link" href="https://twitter.com/drupalsecurity"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;https://twitter.com/drupalsecurity&lt;/a&gt; &lt;a class="missing changeset" title="No default repository defined"&gt;[27]&lt;/a&gt;
&lt;/p&gt;
&lt;p&gt;
&lt;a class="missing changeset" title="No default repository defined"&gt;[1]&lt;/a&gt; &lt;a class="ext-link" href="http://drupal.org/project/drupal"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;http://drupal.org/project/drupal&lt;/a&gt;
&lt;a class="missing changeset" title="No default repository defined"&gt;[2]&lt;/a&gt; &lt;a class="ext-link" href="http://drupal.org/security-team/risk-levels"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;http://drupal.org/security-team/risk-levels&lt;/a&gt;
&lt;a class="missing changeset" title="No default repository defined"&gt;[3]&lt;/a&gt; &lt;a class="ext-link" href="https://www.drupal.org/project/filefield"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;https://www.drupal.org/project/filefield&lt;/a&gt;
&lt;a class="missing changeset" title="No default repository defined"&gt;[4]&lt;/a&gt; &lt;a class="ext-link" href="https://www.drupal.org/node/2304561"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;https://www.drupal.org/node/2304561&lt;/a&gt;
&lt;a class="missing changeset" title="No default repository defined"&gt;[5]&lt;/a&gt; &lt;a class="ext-link" href="http://cve.mitre.org/"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;http://cve.mitre.org/&lt;/a&gt;
&lt;a class="missing changeset" title="No default repository defined"&gt;[6]&lt;/a&gt; &lt;a class="ext-link" href="https://www.drupal.org/drupal-6.32-release-notes"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;https://www.drupal.org/drupal-6.32-release-notes&lt;/a&gt;
&lt;a class="missing changeset" title="No default repository defined"&gt;[7]&lt;/a&gt; &lt;a class="ext-link" href="https://www.drupal.org/drupal-7.29-release-notes"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;https://www.drupal.org/drupal-7.29-release-notes&lt;/a&gt;
&lt;a class="missing changeset" title="No default repository defined"&gt;[8]&lt;/a&gt; &lt;a class="ext-link" href="http://drupal.org/project/drupal"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;http://drupal.org/project/drupal&lt;/a&gt;
&lt;a class="missing changeset" title="No default repository defined"&gt;[9]&lt;/a&gt; &lt;a class="ext-link" href="https://www.drupal.org/user/1367862"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;https://www.drupal.org/user/1367862&lt;/a&gt;
&lt;a class="missing changeset" title="No default repository defined"&gt;[10]&lt;/a&gt; &lt;a class="ext-link" href="https://www.drupal.org/user/556138"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;https://www.drupal.org/user/556138&lt;/a&gt;
&lt;a class="missing changeset" title="No default repository defined"&gt;[11]&lt;/a&gt; &lt;a class="ext-link" href="https://www.drupal.org/u/chx"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;https://www.drupal.org/u/chx&lt;/a&gt;
&lt;a class="missing changeset" title="No default repository defined"&gt;[12]&lt;/a&gt; &lt;a class="ext-link" href="https://www.drupal.org/user/2844779"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;https://www.drupal.org/user/2844779&lt;/a&gt;
&lt;a class="missing changeset" title="No default repository defined"&gt;[13]&lt;/a&gt; &lt;a class="ext-link" href="https://www.drupal.org/user/1367862"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;https://www.drupal.org/user/1367862&lt;/a&gt;
&lt;a class="missing changeset" title="No default repository defined"&gt;[14]&lt;/a&gt; &lt;a class="ext-link" href="https://www.drupal.org/user/262198"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;https://www.drupal.org/user/262198&lt;/a&gt;
&lt;a class="missing changeset" title="No default repository defined"&gt;[15]&lt;/a&gt; &lt;a class="ext-link" href="https://www.drupal.org/user/35821"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;https://www.drupal.org/user/35821&lt;/a&gt;
&lt;a class="missing changeset" title="No default repository defined"&gt;[16]&lt;/a&gt; &lt;a class="ext-link" href="https://www.drupal.org/user/556138"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;https://www.drupal.org/user/556138&lt;/a&gt;
&lt;a class="missing changeset" title="No default repository defined"&gt;[17]&lt;/a&gt; &lt;a class="ext-link" href="https://www.drupal.org/user/124982"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;https://www.drupal.org/user/124982&lt;/a&gt;
&lt;a class="missing changeset" title="No default repository defined"&gt;[18]&lt;/a&gt; &lt;a class="ext-link" href="https://www.drupal.org/user/17943"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;https://www.drupal.org/user/17943&lt;/a&gt;
&lt;a class="missing changeset" title="No default repository defined"&gt;[19]&lt;/a&gt; &lt;a class="ext-link" href="https://www.drupal.org/user/266527"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;https://www.drupal.org/user/266527&lt;/a&gt;
&lt;a class="missing changeset" title="No default repository defined"&gt;[20]&lt;/a&gt; &lt;a class="ext-link" href="https://www.drupal.org/u/greggles"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;https://www.drupal.org/u/greggles&lt;/a&gt;
&lt;a class="missing changeset" title="No default repository defined"&gt;[21]&lt;/a&gt; &lt;a class="ext-link" href="https://www.drupal.org/u/drumm"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;https://www.drupal.org/u/drumm&lt;/a&gt;
&lt;a class="missing changeset" title="No default repository defined"&gt;[22]&lt;/a&gt; &lt;a class="ext-link" href="http://drupal.org/security-team"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;http://drupal.org/security-team&lt;/a&gt;
&lt;a class="missing changeset" title="No default repository defined"&gt;[23]&lt;/a&gt; &lt;a class="ext-link" href="http://drupal.org/contact"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;http://drupal.org/contact&lt;/a&gt;
&lt;a class="missing changeset" title="No default repository defined"&gt;[24]&lt;/a&gt; &lt;a class="ext-link" href="http://drupal.org/security-team"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;http://drupal.org/security-team&lt;/a&gt;
&lt;a class="missing changeset" title="No default repository defined"&gt;[25]&lt;/a&gt; &lt;a class="ext-link" href="http://drupal.org/writing-secure-code"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;http://drupal.org/writing-secure-code&lt;/a&gt;
&lt;a class="missing changeset" title="No default repository defined"&gt;[26]&lt;/a&gt; &lt;a class="ext-link" href="http://drupal.org/security/secure-configuration"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;http://drupal.org/security/secure-configuration&lt;/a&gt;
&lt;a class="missing changeset" title="No default repository defined"&gt;[27]&lt;/a&gt; &lt;a class="ext-link" href="https://twitter.com/drupalsecurity"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;https://twitter.com/drupalsecurity&lt;/a&gt;
&lt;/p&gt;
&lt;p&gt;
&lt;span class="underline"&gt;&lt;/span&gt;&lt;span class="underline"&gt;&lt;/span&gt;&lt;span class="underline"&gt;&lt;/span&gt;&lt;span class="underline"&gt;&lt;/span&gt;&lt;span class="underline"&gt;&lt;/span&gt;&lt;span class="underline"&gt;&lt;/span&gt;&lt;span class="underline"&gt;&lt;/span&gt;&lt;span class="underline"&gt;&lt;/span&gt;&lt;span class="underline"&gt;&lt;/span&gt;&lt;span class="underline"&gt;&lt;/span&gt;&lt;span class="underline"&gt;&lt;/span&gt;&lt;span class="underline"&gt;_
Security-news mailing list
Security-news@…
Unsubscribe at &lt;a class="ext-link" href="https://lists.drupal.org/mailman/listinfo/security-news"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;https://lists.drupal.org/mailman/listinfo/security-news&lt;/a&gt;
&lt;/span&gt;&lt;/p&gt;
</description>
        <category>Results</category>
        <comments>http://localhost:8080/trac/ticket/758#changelog</comments>
    </item><item>
        <link>http://localhost:8080/trac/ticket/759</link>
        <guid isPermaLink="false">http://localhost:8080/trac/ticket/759</guid>
        <title>#759: [Security-news] SA-CONTRIB-2014-071 - FileField - Access bypass</title>
        <pubDate>Wed, 16 Jul 2014 21:59:46 GMT</pubDate>
        
        <dc:creator>paul</dc:creator>

        <description>&lt;p&gt;
View online: &lt;a class="ext-link" href="https://www.drupal.org/node/2304561"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;https://www.drupal.org/node/2304561&lt;/a&gt;
&lt;/p&gt;
&lt;ul&gt;&lt;li&gt;Advisory ID: DRUPAL-SA-CONTRIB-2014-071
&lt;/li&gt;&lt;li&gt;Project: &lt;a class="missing wiki"&gt;FileField?&lt;/a&gt; &lt;a class="missing changeset" title="No default repository defined"&gt;[1]&lt;/a&gt; (third-party module)
&lt;/li&gt;&lt;li&gt;Version: 6.x
&lt;/li&gt;&lt;li&gt;Date: 2014-July-16
&lt;/li&gt;&lt;li&gt;Security risk: Critical &lt;a class="missing changeset" title="No default repository defined"&gt;[2]&lt;/a&gt;
&lt;/li&gt;&lt;li&gt;Exploitable from: Remote
&lt;/li&gt;&lt;li&gt;Vulnerability: Access bypass
&lt;/li&gt;&lt;/ul&gt;&lt;hr /&gt;
&lt;hr /&gt;
&lt;p&gt;
The &lt;a class="missing wiki"&gt;FileField?&lt;/a&gt; module enables you to define and use fields that contain files.
&lt;/p&gt;
&lt;p&gt;
The module doesn't sufficiently check permission to view the attached file
when attaching a file that was previously uploaded. This could allow
attackers to gain access to private files.
&lt;/p&gt;
&lt;p&gt;
This vulnerability is mitigated by the fact that the attacker must have
permission to create or edit content with a file field.
&lt;/p&gt;
&lt;hr /&gt;
&lt;hr /&gt;
&lt;ul&gt;&lt;li&gt;/A CVE identifier &lt;a class="missing changeset" title="No default repository defined"&gt;[3]&lt;/a&gt; will be requested, and added upon issuance, in
&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;
accordance with Drupal Security Team processes./
&lt;/p&gt;
&lt;hr /&gt;
&lt;hr /&gt;
&lt;ul&gt;&lt;li&gt;&lt;a class="missing wiki"&gt;FileField?&lt;/a&gt; 6.x-3.x versions prior to 6.x-3.13.
&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;
Drupal core is not affected. If you do not use the contributed &lt;a class="missing wiki"&gt;FileField?&lt;/a&gt; &lt;a class="missing changeset" title="No default repository defined"&gt;[4]&lt;/a&gt;
module, there is nothing you need to do.
&lt;/p&gt;
&lt;hr /&gt;
&lt;hr /&gt;
&lt;ul&gt;&lt;li&gt;If you use the &lt;a class="missing wiki"&gt;FileField?&lt;/a&gt; module for Drupal 6.x, upgrade to Filefield
&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;
6.x-3.13 &lt;a class="missing changeset" title="No default repository defined"&gt;[5]&lt;/a&gt;, and also update to Drupal core 6.32 &lt;a class="missing changeset" title="No default repository defined"&gt;[6]&lt;/a&gt; (see
SA-CORE-2014-003 &lt;a class="missing changeset" title="No default repository defined"&gt;[7]&lt;/a&gt;).
&lt;/p&gt;
&lt;hr /&gt;
&lt;hr /&gt;
&lt;ul&gt;&lt;li&gt;Ivan Ch &lt;a class="missing changeset" title="No default repository defined"&gt;[8]&lt;/a&gt;
&lt;/li&gt;&lt;/ul&gt;&lt;hr /&gt;
&lt;hr /&gt;
&lt;ul&gt;&lt;li&gt;Nate Haug &lt;a class="missing changeset" title="No default repository defined"&gt;[9]&lt;/a&gt;
&lt;/li&gt;&lt;li&gt;Ivan Ch &lt;a class="missing changeset" title="No default repository defined"&gt;[10]&lt;/a&gt;
&lt;/li&gt;&lt;li&gt;David Snopek &lt;a class="missing changeset" title="No default repository defined"&gt;[11]&lt;/a&gt; of the Drupal Security Team.
&lt;/li&gt;&lt;/ul&gt;&lt;hr /&gt;
&lt;hr /&gt;
&lt;p&gt;
The Drupal security team can be reached at security at drupal.org or via the
contact form at &lt;a class="ext-link" href="http://drupal.org/contact"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;http://drupal.org/contact&lt;/a&gt; &lt;a class="missing changeset" title="No default repository defined"&gt;[12]&lt;/a&gt;.
&lt;/p&gt;
&lt;p&gt;
Learn more about the Drupal Security team and their policies &lt;a class="missing changeset" title="No default repository defined"&gt;[13]&lt;/a&gt;, writing
secure code for Drupal &lt;a class="missing changeset" title="No default repository defined"&gt;[14]&lt;/a&gt;, and securing your site &lt;a class="missing changeset" title="No default repository defined"&gt;[15]&lt;/a&gt;.
&lt;/p&gt;
&lt;p&gt;
Follow the Drupal Security Team on Twitter at
&lt;a class="ext-link" href="https://twitter.com/drupalsecurity"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;https://twitter.com/drupalsecurity&lt;/a&gt; &lt;a class="missing changeset" title="No default repository defined"&gt;[16]&lt;/a&gt;
&lt;/p&gt;
&lt;p&gt;
&lt;a class="missing changeset" title="No default repository defined"&gt;[1]&lt;/a&gt; &lt;a class="ext-link" href="https://www.drupal.org/project/filefield"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;https://www.drupal.org/project/filefield&lt;/a&gt;
&lt;a class="missing changeset" title="No default repository defined"&gt;[2]&lt;/a&gt; &lt;a class="ext-link" href="http://drupal.org/security-team/risk-levels"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;http://drupal.org/security-team/risk-levels&lt;/a&gt;
&lt;a class="missing changeset" title="No default repository defined"&gt;[3]&lt;/a&gt; &lt;a class="ext-link" href="http://cve.mitre.org/"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;http://cve.mitre.org/&lt;/a&gt;
&lt;a class="missing changeset" title="No default repository defined"&gt;[4]&lt;/a&gt; &lt;a class="ext-link" href="http://drupal.org/project/filefield"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;http://drupal.org/project/filefield&lt;/a&gt;
&lt;a class="missing changeset" title="No default repository defined"&gt;[5]&lt;/a&gt; &lt;a class="ext-link" href="https://www.drupal.org/node/2304517"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;https://www.drupal.org/node/2304517&lt;/a&gt;
&lt;a class="missing changeset" title="No default repository defined"&gt;[6]&lt;/a&gt; &lt;a class="ext-link" href="https://www.drupal.org/drupal-6.32-release-notes"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;https://www.drupal.org/drupal-6.32-release-notes&lt;/a&gt;
&lt;a class="missing changeset" title="No default repository defined"&gt;[7]&lt;/a&gt; &lt;a class="ext-link" href="https://www.drupal.org/SA-CORE-2014-003"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;https://www.drupal.org/SA-CORE-2014-003&lt;/a&gt;
&lt;a class="missing changeset" title="No default repository defined"&gt;[8]&lt;/a&gt; &lt;a class="ext-link" href="https://www.drupal.org/user/556138"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;https://www.drupal.org/user/556138&lt;/a&gt;
&lt;a class="missing changeset" title="No default repository defined"&gt;[9]&lt;/a&gt; &lt;a class="ext-link" href="https://www.drupal.org/user/35821"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;https://www.drupal.org/user/35821&lt;/a&gt;
&lt;a class="missing changeset" title="No default repository defined"&gt;[10]&lt;/a&gt; &lt;a class="ext-link" href="https://www.drupal.org/user/556138"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;https://www.drupal.org/user/556138&lt;/a&gt;
&lt;a class="missing changeset" title="No default repository defined"&gt;[11]&lt;/a&gt; &lt;a class="ext-link" href="https://www.drupal.org/user/266527"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;https://www.drupal.org/user/266527&lt;/a&gt;
&lt;a class="missing changeset" title="No default repository defined"&gt;[12]&lt;/a&gt; &lt;a class="ext-link" href="http://drupal.org/contact"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;http://drupal.org/contact&lt;/a&gt;
&lt;a class="missing changeset" title="No default repository defined"&gt;[13]&lt;/a&gt; &lt;a class="ext-link" href="http://drupal.org/security-team"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;http://drupal.org/security-team&lt;/a&gt;
&lt;a class="missing changeset" title="No default repository defined"&gt;[14]&lt;/a&gt; &lt;a class="ext-link" href="http://drupal.org/writing-secure-code"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;http://drupal.org/writing-secure-code&lt;/a&gt;
&lt;a class="missing changeset" title="No default repository defined"&gt;[15]&lt;/a&gt; &lt;a class="ext-link" href="http://drupal.org/security/secure-configuration"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;http://drupal.org/security/secure-configuration&lt;/a&gt;
&lt;a class="missing changeset" title="No default repository defined"&gt;[16]&lt;/a&gt; &lt;a class="ext-link" href="https://twitter.com/drupalsecurity"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;https://twitter.com/drupalsecurity&lt;/a&gt;
&lt;/p&gt;
&lt;p&gt;
&lt;span class="underline"&gt;&lt;/span&gt;&lt;span class="underline"&gt;&lt;/span&gt;&lt;span class="underline"&gt;&lt;/span&gt;&lt;span class="underline"&gt;&lt;/span&gt;&lt;span class="underline"&gt;&lt;/span&gt;&lt;span class="underline"&gt;&lt;/span&gt;&lt;span class="underline"&gt;&lt;/span&gt;&lt;span class="underline"&gt;&lt;/span&gt;&lt;span class="underline"&gt;&lt;/span&gt;&lt;span class="underline"&gt;&lt;/span&gt;&lt;span class="underline"&gt;&lt;/span&gt;&lt;span class="underline"&gt;_
Security-news mailing list
Security-news@…
Unsubscribe at &lt;a class="ext-link" href="https://lists.drupal.org/mailman/listinfo/security-news"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;https://lists.drupal.org/mailman/listinfo/security-news&lt;/a&gt;
&lt;/span&gt;&lt;/p&gt;
</description>
        <category>Results</category>
        <comments>http://localhost:8080/trac/ticket/759#changelog</comments>
    </item><item>
        <link>http://localhost:8080/trac/ticket/764</link>
        <guid isPermaLink="false">http://localhost:8080/trac/ticket/764</guid>
        <title>#764: Policy decisions re-assessment on BOA and Drupal security updates</title>
        <pubDate>Tue, 22 Jul 2014 14:10:38 GMT</pubDate>
        
        <dc:creator>annesley</dc:creator>

        <description>&lt;p&gt;
on-line meeting 5 / August @ 14:00 GMT:
we are phasing out the current D6 / BOA system. the new system may not use either. The TN.org website is not attractive to high level hackers or DOS attacks.
&lt;/p&gt;
&lt;p&gt;
what are the risks with cancelling all further Unix, BOA and Drupal updates completely that do not allow direct un-mitigated access to the backend via bad PHP code / SQL?
&lt;/p&gt;
</description>
        <category>Results</category>
        <comments>http://localhost:8080/trac/ticket/764#changelog</comments>
    </item><item>
        <link>http://localhost:8080/trac/ticket/789</link>
        <guid isPermaLink="false">http://localhost:8080/trac/ticket/789</guid>
        <title>#789: SA-CONTRIB-2014-088 - Mollom - Cross-site scripting (XSS)</title>
        <pubDate>Mon, 22 Sep 2014 13:09:48 GMT</pubDate>
        
        <dc:creator>paul</dc:creator>

        <description>&lt;p&gt;
View online: &lt;a class="ext-link" href="https://www.drupal.org/node/2340029"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;https://www.drupal.org/node/2340029&lt;/a&gt;
&lt;/p&gt;
&lt;ul&gt;&lt;li&gt;Advisory ID: DRUPAL-SA-CONTRIB-2014-088
&lt;/li&gt;&lt;li&gt;Project: Mollom &lt;a class="missing changeset" title="No default repository defined"&gt;[1]&lt;/a&gt; (third-party module)
&lt;/li&gt;&lt;li&gt;Version: 6.x, 7.x
&lt;/li&gt;&lt;li&gt;Date: 2014-September-17
&lt;/li&gt;&lt;li&gt;Security risk: 11/25 ( Moderately Critical)
&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;
AC:Complex/A:User/CI:Some/II:Some/E:Theoretical/TD:Uncommon &lt;a class="missing changeset" title="No default repository defined"&gt;[2]&lt;/a&gt;
&lt;/p&gt;
&lt;ul&gt;&lt;li&gt;Vulnerability: Cross Site Scripting
&lt;/li&gt;&lt;/ul&gt;&lt;hr /&gt;
&lt;hr /&gt;
&lt;p&gt;
Mollom is an "intelligent" content moderation web service which determines if
a post is potentially spam; not only based on the posted content, but also on
the past activity and reputation of the poster across multiple sites.
&lt;/p&gt;
&lt;p&gt;
Mollom offers a feature to report submitted content as inappropriate which
allows end users to indicate that a piece of site content is objectionable or
out of place. When reporting content, the content title is not sufficiently
sanitized to prevent cross-site scripting (XSS) attacks.
&lt;/p&gt;
&lt;p&gt;
This vulnerability is mitigated by the fact that an attacker must have a role
with the permission to create content and the content type must be enabled
for "Flag as Inappropriate" within the Mollom advanced configuration settings
(which is not the default setting).
&lt;/p&gt;
&lt;hr /&gt;
&lt;hr /&gt;
&lt;ul&gt;&lt;li&gt;/A CVE identifier &lt;a class="missing changeset" title="No default repository defined"&gt;[3]&lt;/a&gt; will be requested, and added upon issuance, in
&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;
accordance
with Drupal Security Team processes./
&lt;/p&gt;
&lt;hr /&gt;
&lt;hr /&gt;
&lt;ul&gt;&lt;li&gt;Mollom 6.x-2.x versions from 6.x-2.7 to 6.x-2.10
&lt;/li&gt;&lt;li&gt;Mollom 7.x-2.x versions from 7.x-2.9 to 7.x-2.10
&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;
Drupal core is not affected. If you do not use the contributed Mollom &lt;a class="missing changeset" title="No default repository defined"&gt;[4]&lt;/a&gt;
module,
there is nothing you need to do.
&lt;/p&gt;
&lt;hr /&gt;
&lt;hr /&gt;
&lt;p&gt;
Install the latest version:
&lt;/p&gt;
&lt;ul&gt;&lt;li&gt;If you use the Mollom module for Drupal 6.x, upgrade to Mollom 6.x-2.11
&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;
&lt;a class="missing changeset" title="No default repository defined"&gt;[5]&lt;/a&gt;
&lt;/p&gt;
&lt;ul&gt;&lt;li&gt;If you use the Mollom module for Drupal 7.x, upgrade to Mollom 7.x-2.11
&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;
&lt;a class="missing changeset" title="No default repository defined"&gt;[6]&lt;/a&gt;
&lt;/p&gt;
&lt;p&gt;
Also see the Mollom &lt;a class="missing changeset" title="No default repository defined"&gt;[7]&lt;/a&gt; project page.
&lt;/p&gt;
&lt;hr /&gt;
&lt;hr /&gt;
&lt;ul&gt;&lt;li&gt;Matt Vance &lt;a class="missing changeset" title="No default repository defined"&gt;[8]&lt;/a&gt;
&lt;/li&gt;&lt;/ul&gt;&lt;hr /&gt;
&lt;hr /&gt;
&lt;ul&gt;&lt;li&gt;Lisa Backer &lt;a class="missing changeset" title="No default repository defined"&gt;[9]&lt;/a&gt; the module maintainer
&lt;/li&gt;&lt;li&gt;Matt Vance &lt;a class="missing changeset" title="No default repository defined"&gt;[10]&lt;/a&gt;
&lt;/li&gt;&lt;/ul&gt;&lt;hr /&gt;
&lt;hr /&gt;
&lt;ul&gt;&lt;li&gt;Greg Knaddison &lt;a class="missing changeset" title="No default repository defined"&gt;[11]&lt;/a&gt; of the Drupal Security Team
&lt;/li&gt;&lt;/ul&gt;&lt;hr /&gt;
&lt;hr /&gt;
&lt;p&gt;
The Drupal security team can be reached at security at drupal.org or via the
contact form at &lt;a class="ext-link" href="https://www.drupal.org/contact"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;https://www.drupal.org/contact&lt;/a&gt; &lt;a class="missing changeset" title="No default repository defined"&gt;[12]&lt;/a&gt;.
&lt;/p&gt;
&lt;p&gt;
Learn more about the Drupal Security team and their policies &lt;a class="missing changeset" title="No default repository defined"&gt;[13]&lt;/a&gt;,
writing secure code for Drupal &lt;a class="missing changeset" title="No default repository defined"&gt;[14]&lt;/a&gt;, and
securing your site &lt;a class="missing changeset" title="No default repository defined"&gt;[15]&lt;/a&gt;.
&lt;/p&gt;
&lt;p&gt;
&lt;a class="missing changeset" title="No default repository defined"&gt;[1]&lt;/a&gt; &lt;a class="ext-link" href="https://www.drupal.org/project/mollom"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;https://www.drupal.org/project/mollom&lt;/a&gt;
&lt;a class="missing changeset" title="No default repository defined"&gt;[2]&lt;/a&gt; &lt;a class="ext-link" href="https://www.drupal.org/security-team/risk-levels"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;https://www.drupal.org/security-team/risk-levels&lt;/a&gt;
&lt;a class="missing changeset" title="No default repository defined"&gt;[3]&lt;/a&gt; &lt;a class="ext-link" href="http://cve.mitre.org/"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;http://cve.mitre.org/&lt;/a&gt;
&lt;a class="missing changeset" title="No default repository defined"&gt;[4]&lt;/a&gt; &lt;a class="ext-link" href="https://www.drupal.org/project/mollom"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;https://www.drupal.org/project/mollom&lt;/a&gt;
&lt;a class="missing changeset" title="No default repository defined"&gt;[5]&lt;/a&gt; &lt;a class="ext-link" href="https://www.drupal.org/node/2338787"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;https://www.drupal.org/node/2338787&lt;/a&gt;
&lt;a class="missing changeset" title="No default repository defined"&gt;[6]&lt;/a&gt; &lt;a class="ext-link" href="https://www.drupal.org/node/2338789"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;https://www.drupal.org/node/2338789&lt;/a&gt;
&lt;a class="missing changeset" title="No default repository defined"&gt;[7]&lt;/a&gt; &lt;a class="ext-link" href="https://www.drupal.org/project/mollom"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;https://www.drupal.org/project/mollom&lt;/a&gt;
&lt;a class="missing changeset" title="No default repository defined"&gt;[8]&lt;/a&gt; &lt;a class="ext-link" href="https://www.drupal.org/user/88338"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;https://www.drupal.org/user/88338&lt;/a&gt;
&lt;a class="missing changeset" title="No default repository defined"&gt;[9]&lt;/a&gt; &lt;a class="ext-link" href="https://www.drupal.org/user/1951462"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;https://www.drupal.org/user/1951462&lt;/a&gt;
&lt;a class="missing changeset" title="No default repository defined"&gt;[10]&lt;/a&gt; &lt;a class="ext-link" href="https://www.drupal.org/user/88338"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;https://www.drupal.org/user/88338&lt;/a&gt;
&lt;a class="missing changeset" title="No default repository defined"&gt;[11]&lt;/a&gt; &lt;a class="ext-link" href="https://www.drupal.org/user/36762"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;https://www.drupal.org/user/36762&lt;/a&gt;
&lt;a class="missing changeset" title="No default repository defined"&gt;[12]&lt;/a&gt; &lt;a class="ext-link" href="https://www.drupal.org/contact"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;https://www.drupal.org/contact&lt;/a&gt;
&lt;a class="missing changeset" title="No default repository defined"&gt;[13]&lt;/a&gt; &lt;a class="ext-link" href="https://www.drupal.org/security-team"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;https://www.drupal.org/security-team&lt;/a&gt;
&lt;a class="missing changeset" title="No default repository defined"&gt;[14]&lt;/a&gt; &lt;a class="ext-link" href="https://www.drupal.org/writing-secure-code"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;https://www.drupal.org/writing-secure-code&lt;/a&gt;
&lt;a class="missing changeset" title="No default repository defined"&gt;[15]&lt;/a&gt; &lt;a class="ext-link" href="https://www.drupal.org/security/secure-configuration"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;https://www.drupal.org/security/secure-configuration&lt;/a&gt;
&lt;/p&gt;
</description>
        <category>Results</category>
        <comments>http://localhost:8080/trac/ticket/789#changelog</comments>
    </item><item>
        <link>http://localhost:8080/trac/ticket/792</link>
        <guid isPermaLink="false">http://localhost:8080/trac/ticket/792</guid>
        <title>#792: [Security-news] SA-CONTRIB-2014-094 - Webform Patched - Cross Site Scripting (XSS)</title>
        <pubDate>Mon, 29 Sep 2014 09:28:08 GMT</pubDate>
        
        <dc:creator>paul</dc:creator>

        <description>&lt;p&gt;
View online: &lt;a class="ext-link" href="https://www.drupal.org/node/2344369"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;https://www.drupal.org/node/2344369&lt;/a&gt;
&lt;/p&gt;
&lt;ul&gt;&lt;li&gt;Advisory ID: DRUPAL-SA-CONTRIB-2014-094
&lt;/li&gt;&lt;li&gt;Project: Webform Patched &lt;a class="missing changeset" title="No default repository defined"&gt;[1]&lt;/a&gt; (third-party module)
&lt;/li&gt;&lt;li&gt;Version: 6.x, 7.x
&lt;/li&gt;&lt;li&gt;Date: 2014-September-24
&lt;/li&gt;&lt;li&gt;Security risk: 13/25 ( Moderately Critical)
&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;
AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Default &lt;a class="missing changeset" title="No default repository defined"&gt;[2]&lt;/a&gt;
&lt;/p&gt;
&lt;ul&gt;&lt;li&gt;Vulnerability: Cross Site Scripting
&lt;/li&gt;&lt;/ul&gt;&lt;hr /&gt;
&lt;hr /&gt;
&lt;p&gt;
The Webform Patched module is a fork of the Webform module with Token support
added. The module enables you to create forms which can be used for surveys,
contact forms or other data collection throughout your site.
&lt;/p&gt;
&lt;p&gt;
The module doesn't sufficiently sanitize field label titles when two fields
have the same form_key, which can only be managed by carefully crafting the
webform structure via a specific set of circumstances.
&lt;/p&gt;
&lt;p&gt;
This vulnerability is mitigated by the fact that an attacker must have a role
with the permission "create webform content".
&lt;/p&gt;
&lt;hr /&gt;
&lt;hr /&gt;
&lt;ul&gt;&lt;li&gt;/A CVE identifier &lt;a class="missing changeset" title="No default repository defined"&gt;[3]&lt;/a&gt; will be requested, and added upon issuance, in
&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;
accordance
with Drupal Security Team processes./
&lt;/p&gt;
&lt;hr /&gt;
&lt;hr /&gt;
&lt;ul&gt;&lt;li&gt;Webform Patched 6.x-3.x versions prior to 6.x-3.20.
&lt;/li&gt;&lt;li&gt;Webform Patched 7.x-3.x versions prior to 7.x-3.20.
&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;
Drupal core is not affected. If you do not use the contributed Webform
Patched &lt;a class="missing changeset" title="No default repository defined"&gt;[4]&lt;/a&gt; module,
there is nothing you need to do.
&lt;/p&gt;
&lt;hr /&gt;
&lt;hr /&gt;
&lt;p&gt;
Install the latest version:
&lt;/p&gt;
&lt;ul&gt;&lt;li&gt;If you use the webform module for Drupal 6.x, upgrade to webform_patched
&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;
6.x-3.20 &lt;a class="missing changeset" title="No default repository defined"&gt;[5]&lt;/a&gt;
&lt;/p&gt;
&lt;ul&gt;&lt;li&gt;If you use the webform module for Drupal 7.x-3.x, upgrade to
&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;
webform_patched 7.x-3.20 &lt;a class="missing changeset" title="No default repository defined"&gt;[6]&lt;/a&gt;
&lt;/p&gt;
&lt;p&gt;
Also see the Webform Patched &lt;a class="missing changeset" title="No default repository defined"&gt;[7]&lt;/a&gt; project page.
&lt;/p&gt;
&lt;hr /&gt;
&lt;hr /&gt;
&lt;ul&gt;&lt;li&gt;Maurits Lawende &lt;a class="missing changeset" title="No default repository defined"&gt;[8]&lt;/a&gt;
&lt;/li&gt;&lt;li&gt;Matt Vance &lt;a class="missing changeset" title="No default repository defined"&gt;[9]&lt;/a&gt;
&lt;/li&gt;&lt;/ul&gt;&lt;hr /&gt;
&lt;hr /&gt;
&lt;ul&gt;&lt;li&gt;Nate Haug &lt;a class="missing changeset" title="No default repository defined"&gt;[10]&lt;/a&gt; the module maintainer
&lt;/li&gt;&lt;/ul&gt;&lt;hr /&gt;
&lt;hr /&gt;
&lt;ul&gt;&lt;li&gt;Greg Knaddison &lt;a class="missing changeset" title="No default repository defined"&gt;[11]&lt;/a&gt;, Dan Smith &lt;a class="missing changeset" title="No default repository defined"&gt;[12]&lt;/a&gt; and Lee Rowlands &lt;a class="missing changeset" title="No default repository defined"&gt;[13]&lt;/a&gt; of the Drupal
&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;
Security Team
&lt;/p&gt;
&lt;hr /&gt;
&lt;hr /&gt;
&lt;p&gt;
The Drupal security team can be reached at security at drupal.org or via the
contact form at
&lt;a class="ext-link" href="https://www.drupal.org/contact"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;https://www.drupal.org/contact&lt;/a&gt; &lt;a class="missing changeset" title="No default repository defined"&gt;[14]&lt;/a&gt;.
&lt;/p&gt;
&lt;p&gt;
Learn more about the Drupal Security team and their policies &lt;a class="missing changeset" title="No default repository defined"&gt;[15]&lt;/a&gt;,
writing secure code for Drupal &lt;a class="missing changeset" title="No default repository defined"&gt;[16]&lt;/a&gt;, and
securing your site &lt;a class="missing changeset" title="No default repository defined"&gt;[17]&lt;/a&gt;.
&lt;/p&gt;
&lt;p&gt;
&lt;a class="missing changeset" title="No default repository defined"&gt;[1]&lt;/a&gt; &lt;a class="ext-link" href="https://www.drupal.org/project/webform_patched"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;https://www.drupal.org/project/webform_patched&lt;/a&gt;
&lt;a class="missing changeset" title="No default repository defined"&gt;[2]&lt;/a&gt; &lt;a class="ext-link" href="https://www.drupal.org/security-team/risk-levels"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;https://www.drupal.org/security-team/risk-levels&lt;/a&gt;
&lt;a class="missing changeset" title="No default repository defined"&gt;[3]&lt;/a&gt; &lt;a class="ext-link" href="http://cve.mitre.org/"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;http://cve.mitre.org/&lt;/a&gt;
&lt;a class="missing changeset" title="No default repository defined"&gt;[4]&lt;/a&gt; &lt;a class="ext-link" href="https://www.drupal.org/project/webform_patched"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;https://www.drupal.org/project/webform_patched&lt;/a&gt;
&lt;a class="missing changeset" title="No default repository defined"&gt;[5]&lt;/a&gt; &lt;a class="ext-link" href="http://drupal.org/node/2241675"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;http://drupal.org/node/2241675&lt;/a&gt;
&lt;a class="missing changeset" title="No default repository defined"&gt;[6]&lt;/a&gt; &lt;a class="ext-link" href="http://drupal.org/node/2241685"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;http://drupal.org/node/2241685&lt;/a&gt;
&lt;a class="missing changeset" title="No default repository defined"&gt;[7]&lt;/a&gt; &lt;a class="ext-link" href="https://www.drupal.org/project/webform_patched"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;https://www.drupal.org/project/webform_patched&lt;/a&gt;
&lt;a class="missing changeset" title="No default repository defined"&gt;[8]&lt;/a&gt; &lt;a class="ext-link" href="http://drupal.org/user/243897"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;http://drupal.org/user/243897&lt;/a&gt;
&lt;a class="missing changeset" title="No default repository defined"&gt;[9]&lt;/a&gt; &lt;a class="ext-link" href="https://www.drupal.org/user/10269"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;https://www.drupal.org/user/10269&lt;/a&gt;
&lt;a class="missing changeset" title="No default repository defined"&gt;[10]&lt;/a&gt; &lt;a class="ext-link" href="http://drupal.org/user/35821"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;http://drupal.org/user/35821&lt;/a&gt;
&lt;a class="missing changeset" title="No default repository defined"&gt;[11]&lt;/a&gt; &lt;a class="ext-link" href="http://drupal.org/user/36762"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;http://drupal.org/user/36762&lt;/a&gt;
&lt;a class="missing changeset" title="No default repository defined"&gt;[12]&lt;/a&gt; &lt;a class="ext-link" href="http://drupal.org/user/241220"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;http://drupal.org/user/241220&lt;/a&gt;
&lt;a class="missing changeset" title="No default repository defined"&gt;[13]&lt;/a&gt; &lt;a class="ext-link" href="https://drupal.org/user/395439"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;https://drupal.org/user/395439&lt;/a&gt;
&lt;a class="missing changeset" title="No default repository defined"&gt;[14]&lt;/a&gt; &lt;a class="ext-link" href="https://www.drupal.org/contact"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;https://www.drupal.org/contact&lt;/a&gt;
&lt;a class="missing changeset" title="No default repository defined"&gt;[15]&lt;/a&gt; &lt;a class="ext-link" href="https://www.drupal.org/security-team"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;https://www.drupal.org/security-team&lt;/a&gt;
&lt;a class="missing changeset" title="No default repository defined"&gt;[16]&lt;/a&gt; &lt;a class="ext-link" href="https://www.drupal.org/writing-secure-code"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;https://www.drupal.org/writing-secure-code&lt;/a&gt;
&lt;a class="missing changeset" title="No default repository defined"&gt;[17]&lt;/a&gt; &lt;a class="ext-link" href="https://www.drupal.org/security/secure-configuration"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;https://www.drupal.org/security/secure-configuration&lt;/a&gt;
&lt;/p&gt;
</description>
        <category>Results</category>
        <comments>http://localhost:8080/trac/ticket/792#changelog</comments>
    </item><item>
        <link>http://localhost:8080/trac/ticket/804</link>
        <guid isPermaLink="false">http://localhost:8080/trac/ticket/804</guid>
        <title>#804: Investigating the site security following SA-CORE-2014-005 (Drupal 7.32)</title>
        <pubDate>Mon, 03 Nov 2014 15:20:25 GMT</pubDate>
        
        <dc:creator>paul</dc:creator>

        <description>&lt;p&gt;
It was discovered that TN could have have been compromised from the recent security vulnerability (even though we are running Drupal 6)
as the site is using the DBTNG module. However the site doesn't appear to have been compromised. I'll post my findings shortly.
&lt;/p&gt;
</description>
        <category>Results</category>
        <comments>http://localhost:8080/trac/ticket/804#changelog</comments>
    </item><item>
        <link>http://localhost:8080/trac/ticket/808</link>
        <guid isPermaLink="false">http://localhost:8080/trac/ticket/808</guid>
        <title>#808: WordPress email being rejected due to From field</title>
        <pubDate>Mon, 17 Nov 2014 19:28:23 GMT</pubDate>
        
        <dc:creator>chris</dc:creator>

        <description>&lt;p&gt;
This issues is like &lt;a class="assigned ticket" href="http://localhost:8080/trac/ticket/737" title="maintenance: SPF / Emails rejected from the website contact form (assigned)"&gt;ticket:737&lt;/a&gt; but with &lt;a class="wiki" href="http://localhost:8080/trac/wiki/WordPress"&gt;WordPress&lt;/a&gt; rather than Drupal causing the problem.
&lt;/p&gt;
&lt;p&gt;
Laura has forwarded one of the returned emails which contains:
&lt;/p&gt;
&lt;blockquote class="citation"&gt;
&lt;p&gt;
host aspmx.l.google.com [173.194.67.26]:
550-5.7.1 Unauthenticated email from yahoo.com is not accepted due to domain's
550-5.7.1 DMARC policy. Please contact administrator of yahoo.com domain if
550-5.7.1 this was a legitimate mail. Please visit
550-5.7.1 &lt;a class="ext-link" href="http://support.google.com/mail/answer/2451690"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;http://support.google.com/mail/answer/2451690&lt;/a&gt; to learn about DMARC
&lt;/p&gt;
&lt;/blockquote&gt;
</description>
        <category>Results</category>
        <comments>http://localhost:8080/trac/ticket/808#changelog</comments>
    </item><item>
        <link>http://localhost:8080/trac/ticket/809</link>
        <guid isPermaLink="false">http://localhost:8080/trac/ticket/809</guid>
        <title>#809: [Security-news] Drupal Core - Moderately Critical - Multiple Vulnerabilities - SA-CORE-2014-006</title>
        <pubDate>Wed, 19 Nov 2014 21:35:25 GMT</pubDate>
        
        <dc:creator>paul</dc:creator>

        <description>&lt;p&gt;
View online: &lt;a class="ext-link" href="https://www.drupal.org/SA-CORE-2014-006"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;https://www.drupal.org/SA-CORE-2014-006&lt;/a&gt;
&lt;/p&gt;
&lt;ul&gt;&lt;li&gt;Advisory ID: DRUPAL-SA-CORE-2014-006
&lt;/li&gt;&lt;li&gt;Project: Drupal core &lt;a class="missing changeset" title="No default repository defined"&gt;[1]&lt;/a&gt;
&lt;/li&gt;&lt;li&gt;Version: 6.x, 7.x
&lt;/li&gt;&lt;li&gt;Date: 2014-November-19
&lt;/li&gt;&lt;li&gt;Security risk: 14/25 ( Moderately Critical)
AC:Basic/A:None/CI:Some/II:Some/E:Theoretical/TD:Uncommon &lt;a class="missing changeset" title="No default repository defined"&gt;[2]&lt;/a&gt;
&lt;/li&gt;&lt;li&gt;Vulnerability: Multiple vulnerabilities
&lt;/li&gt;&lt;/ul&gt;&lt;hr /&gt;
&lt;hr /&gt;
&lt;p&gt;
.... Session hijacking (Drupal 6 and 7)
&lt;/p&gt;
&lt;p&gt;
A specially crafted request can give a user access to another user's session,
allowing an attacker to hijack a random session.
&lt;/p&gt;
&lt;p&gt;
This attack is known to be possible on certain Drupal 7 sites which serve
both HTTP and HTTPS content ("mixed-mode" &lt;a class="missing changeset" title="No default repository defined"&gt;[3]&lt;/a&gt;), but it is possible there are
other attack vectors for both Drupal 6 and Drupal 7.
&lt;/p&gt;
&lt;p&gt;
.... Denial of service (Drupal 7 only)
&lt;/p&gt;
&lt;p&gt;
Drupal 7 includes a password hashing API to ensure that user supplied
passwords are not stored in plain text.
&lt;/p&gt;
&lt;p&gt;
A vulnerability in this API allows an attacker to send specially crafted
requests resulting in CPU and memory exhaustion. This may lead to the site
becoming unavailable or unresponsive (denial of service).
&lt;/p&gt;
&lt;p&gt;
This vulnerability can be exploited by anonymous users.
&lt;/p&gt;
&lt;hr /&gt;
&lt;hr /&gt;
&lt;ul&gt;&lt;li&gt;/A CVE identifier &lt;a class="missing changeset" title="No default repository defined"&gt;[4]&lt;/a&gt; will be requested, and added upon issuance, in
accordance
&lt;/li&gt;&lt;/ul&gt;&lt;blockquote&gt;
&lt;blockquote&gt;
&lt;p&gt;
with Drupal Security Team processes./
&lt;/p&gt;
&lt;/blockquote&gt;
&lt;/blockquote&gt;
&lt;hr /&gt;
&lt;hr /&gt;
&lt;ul&gt;&lt;li&gt;Drupal core 6.x versions prior to 6.34.
&lt;/li&gt;&lt;li&gt;Drupal core 7.x versions prior to 7.34.
&lt;/li&gt;&lt;/ul&gt;&lt;hr /&gt;
&lt;hr /&gt;
&lt;p&gt;
Install the latest version:
&lt;/p&gt;
&lt;ul&gt;&lt;li&gt;If you use Drupal 6.x, upgrade to Drupal core 6.34. &lt;a class="missing changeset" title="No default repository defined"&gt;[5]&lt;/a&gt;
&lt;/li&gt;&lt;li&gt;If you use Drupal 7.x, upgrade to Drupal core 7.34. &lt;a class="missing changeset" title="No default repository defined"&gt;[6]&lt;/a&gt;
&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;
If you have configured a custom password.inc file for your Drupal 7 site you
also need to make sure that it is not prone to the same denial of service
vulnerability.  See also the similar security advisory for the Drupal 6
contributed Secure Password Hashes module: SA-CONTRIB-2014-113 &lt;a class="missing changeset" title="No default repository defined"&gt;[7]&lt;/a&gt;
&lt;/p&gt;
&lt;p&gt;
Also see the Drupal core &lt;a class="missing changeset" title="No default repository defined"&gt;[8]&lt;/a&gt; project page.
&lt;/p&gt;
&lt;hr /&gt;
&lt;hr /&gt;
&lt;p&gt;
Session hijacking:
&lt;/p&gt;
&lt;ul&gt;&lt;li&gt;Aaron Averill &lt;a class="missing changeset" title="No default repository defined"&gt;[9]&lt;/a&gt;
&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;
Denial of service:
&lt;/p&gt;
&lt;ul&gt;&lt;li&gt;Michael Cullum  &lt;a class="missing changeset" title="No default repository defined"&gt;[10]&lt;/a&gt;
&lt;/li&gt;&lt;li&gt;Javier Nieto &lt;a class="missing changeset" title="No default repository defined"&gt;[11]&lt;/a&gt;
&lt;/li&gt;&lt;li&gt;Andrés Rojas Guerrero &lt;a class="missing changeset" title="No default repository defined"&gt;[12]&lt;/a&gt;
&lt;/li&gt;&lt;/ul&gt;&lt;hr /&gt;
&lt;hr /&gt;
&lt;p&gt;
Session hijacking:
&lt;/p&gt;
&lt;ul&gt;&lt;li&gt;Klaus Purer &lt;a class="missing changeset" title="No default repository defined"&gt;[13]&lt;/a&gt; of the Drupal Security Team
&lt;/li&gt;&lt;li&gt;David Rothstein &lt;a class="missing changeset" title="No default repository defined"&gt;[14]&lt;/a&gt; of the Drupal Security Team
&lt;/li&gt;&lt;li&gt;Peter Wolanin &lt;a class="missing changeset" title="No default repository defined"&gt;[15]&lt;/a&gt; of the Drupal Security Team
&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;
Denial of service:
&lt;/p&gt;
&lt;ul&gt;&lt;li&gt;Klaus Purer &lt;a class="missing changeset" title="No default repository defined"&gt;[16]&lt;/a&gt; of the Drupal Security Team
&lt;/li&gt;&lt;li&gt;Peter Wolanin &lt;a class="missing changeset" title="No default repository defined"&gt;[17]&lt;/a&gt; of the Drupal Security Team
&lt;/li&gt;&lt;li&gt;Heine Deelstra &lt;a class="missing changeset" title="No default repository defined"&gt;[18]&lt;/a&gt; of the Drupal Security Team
&lt;/li&gt;&lt;li&gt;Tom Phethean &lt;a class="missing changeset" title="No default repository defined"&gt;[19]&lt;/a&gt;
&lt;/li&gt;&lt;/ul&gt;&lt;hr /&gt;
&lt;hr /&gt;
&lt;ul&gt;&lt;li&gt;The Drupal Security Team
&lt;/li&gt;&lt;/ul&gt;&lt;hr /&gt;
&lt;hr /&gt;
&lt;p&gt;
The Drupal security team can be reached at security at drupal.org or via the
contact form at &lt;a class="ext-link" href="https://www.drupal.org/contact"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;https://www.drupal.org/contact&lt;/a&gt; &lt;a class="missing changeset" title="No default repository defined"&gt;[20]&lt;/a&gt;.
&lt;/p&gt;
&lt;p&gt;
Learn more about the Drupal Security team and their policies &lt;a class="missing changeset" title="No default repository defined"&gt;[21]&lt;/a&gt;, writing
secure code for Drupal &lt;a class="missing changeset" title="No default repository defined"&gt;[22]&lt;/a&gt;, and  securing your site &lt;a class="missing changeset" title="No default repository defined"&gt;[23]&lt;/a&gt;.
&lt;/p&gt;
&lt;p&gt;
Follow the Drupal Security Team on Twitter at
&lt;a class="ext-link" href="https://twitter.com/drupalsecurity"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;https://twitter.com/drupalsecurity&lt;/a&gt; &lt;a class="missing changeset" title="No default repository defined"&gt;[24]&lt;/a&gt;
&lt;/p&gt;
&lt;p&gt;
&lt;a class="missing changeset" title="No default repository defined"&gt;[1]&lt;/a&gt; &lt;a class="ext-link" href="https://www.drupal.org/project/drupal"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;https://www.drupal.org/project/drupal&lt;/a&gt;
&lt;a class="missing changeset" title="No default repository defined"&gt;[2]&lt;/a&gt; &lt;a class="ext-link" href="https://www.drupal.org/security-team/risk-levels"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;https://www.drupal.org/security-team/risk-levels&lt;/a&gt;
&lt;a class="missing changeset" title="No default repository defined"&gt;[3]&lt;/a&gt; &lt;a class="ext-link" href="https://www.drupal.org/https-information"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;https://www.drupal.org/https-information&lt;/a&gt;
&lt;a class="missing changeset" title="No default repository defined"&gt;[4]&lt;/a&gt; &lt;a class="ext-link" href="http://cve.mitre.org/"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;http://cve.mitre.org/&lt;/a&gt;
&lt;a class="missing changeset" title="No default repository defined"&gt;[5]&lt;/a&gt; &lt;a class="ext-link" href="https://www.drupal.org/drupal-6.34-release-notes"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;https://www.drupal.org/drupal-6.34-release-notes&lt;/a&gt;
&lt;a class="missing changeset" title="No default repository defined"&gt;[6]&lt;/a&gt; &lt;a class="ext-link" href="https://www.drupal.org/drupal-7.34-release-notes"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;https://www.drupal.org/drupal-7.34-release-notes&lt;/a&gt;
&lt;a class="missing changeset" title="No default repository defined"&gt;[7]&lt;/a&gt; &lt;a class="ext-link" href="https://www.drupal.org/node/2378367"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;https://www.drupal.org/node/2378367&lt;/a&gt;
&lt;a class="missing changeset" title="No default repository defined"&gt;[8]&lt;/a&gt; &lt;a class="ext-link" href="https://www.drupal.org/project/drupal"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;https://www.drupal.org/project/drupal&lt;/a&gt;
&lt;a class="missing changeset" title="No default repository defined"&gt;[9]&lt;/a&gt; &lt;a class="ext-link" href="https://www.drupal.org/user/1317732"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;https://www.drupal.org/user/1317732&lt;/a&gt;
&lt;a class="missing changeset" title="No default repository defined"&gt;[10]&lt;/a&gt; &lt;a class="ext-link" href="https://www.drupal.org/u/MichaelCu"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;https://www.drupal.org/u/MichaelCu&lt;/a&gt;
&lt;a class="missing changeset" title="No default repository defined"&gt;[11]&lt;/a&gt; &lt;a class="ext-link" href="https://www.drupal.org/u/jnietotn"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;https://www.drupal.org/u/jnietotn&lt;/a&gt;
&lt;a class="missing changeset" title="No default repository defined"&gt;[12]&lt;/a&gt; &lt;a class="ext-link" href="https://www.drupal.org/u/c0r3dump3d"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;https://www.drupal.org/u/c0r3dump3d&lt;/a&gt;
&lt;a class="missing changeset" title="No default repository defined"&gt;[13]&lt;/a&gt; &lt;a class="ext-link" href="https://www.drupal.org/u/klausi"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;https://www.drupal.org/u/klausi&lt;/a&gt;
&lt;a class="missing changeset" title="No default repository defined"&gt;[14]&lt;/a&gt; &lt;a class="ext-link" href="https://www.drupal.org/u/David_Rothstein"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;https://www.drupal.org/u/David_Rothstein&lt;/a&gt;
&lt;a class="missing changeset" title="No default repository defined"&gt;[15]&lt;/a&gt; &lt;a class="ext-link" href="https://www.drupal.org/u/pwolanin"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;https://www.drupal.org/u/pwolanin&lt;/a&gt;
&lt;a class="missing changeset" title="No default repository defined"&gt;[16]&lt;/a&gt; &lt;a class="ext-link" href="https://www.drupal.org/u/klausi"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;https://www.drupal.org/u/klausi&lt;/a&gt;
&lt;a class="missing changeset" title="No default repository defined"&gt;[17]&lt;/a&gt; &lt;a class="ext-link" href="https://www.drupal.org/u/pwolanin"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;https://www.drupal.org/u/pwolanin&lt;/a&gt;
&lt;a class="missing changeset" title="No default repository defined"&gt;[18]&lt;/a&gt; &lt;a class="ext-link" href="https://www.drupal.org/u/Heine"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;https://www.drupal.org/u/Heine&lt;/a&gt;
&lt;a class="missing changeset" title="No default repository defined"&gt;[19]&lt;/a&gt; &lt;a class="ext-link" href="https://www.drupal.org/u/tsphethean"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;https://www.drupal.org/u/tsphethean&lt;/a&gt;
&lt;a class="missing changeset" title="No default repository defined"&gt;[20]&lt;/a&gt; &lt;a class="ext-link" href="https://www.drupal.org/contact"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;https://www.drupal.org/contact&lt;/a&gt;
&lt;a class="missing changeset" title="No default repository defined"&gt;[21]&lt;/a&gt; &lt;a class="ext-link" href="https://www.drupal.org/security-team"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;https://www.drupal.org/security-team&lt;/a&gt;
&lt;a class="missing changeset" title="No default repository defined"&gt;[22]&lt;/a&gt; &lt;a class="ext-link" href="https://www.drupal.org/writing-secure-code"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;https://www.drupal.org/writing-secure-code&lt;/a&gt;
&lt;a class="missing changeset" title="No default repository defined"&gt;[23]&lt;/a&gt; &lt;a class="ext-link" href="https://www.drupal.org/security/secure-configuration"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;https://www.drupal.org/security/secure-configuration&lt;/a&gt;
&lt;a class="missing changeset" title="No default repository defined"&gt;[24]&lt;/a&gt; &lt;a class="ext-link" href="https://twitter.com/drupalsecurity"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;https://twitter.com/drupalsecurity&lt;/a&gt;
&lt;/p&gt;
</description>
        <category>Results</category>
        <comments>http://localhost:8080/trac/ticket/809#changelog</comments>
    </item><item>
        <link>http://localhost:8080/trac/ticket/819</link>
        <guid isPermaLink="false">http://localhost:8080/trac/ticket/819</guid>
        <title>#819: Trac anti-spam measures</title>
        <pubDate>Fri, 19 Dec 2014 10:28:01 GMT</pubDate>
        
        <dc:creator>chris</dc:creator>

        <description>&lt;p&gt;
Today we had our first item of Trac spam, &lt;a class="new ticket" href="http://localhost:8080/trac/ticket/818" title="defect: For watch lovers. superwatches (new)"&gt;ticket:818&lt;/a&gt;, since the open email interface was enabled almost 2 years ago on &lt;a class="closed ticket" href="http://localhost:8080/trac/ticket/494" title="maintenance: Email account for TRAC (closed: fixed)"&gt;ticket:494&lt;/a&gt;.
&lt;/p&gt;
&lt;p&gt;
This ticket has been created to investigate and implement some anti-spam measures.
&lt;/p&gt;
</description>
        <category>Results</category>
        <comments>http://localhost:8080/trac/ticket/819#changelog</comments>
    </item><item>
        <link>http://localhost:8080/trac/ticket/847</link>
        <guid isPermaLink="false">http://localhost:8080/trac/ticket/847</guid>
        <title>#847: Upgrade Servers to Debian Jessie</title>
        <pubDate>Mon, 27 Apr 2015 09:30:11 GMT</pubDate>
        
        <dc:creator>chris</dc:creator>

        <description>&lt;p&gt;
The latest version of &lt;a class="ext-link" href="https://www.debian.org/News/2015/20150426"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;Debian, Jessie, 8.0&lt;/a&gt;, came out over the weekend, we should consider upgrading the three servers, &lt;a class="wiki" href="http://localhost:8080/trac/wiki/PuffinServer"&gt;PuffinServer&lt;/a&gt;, &lt;a class="wiki" href="http://localhost:8080/trac/wiki/PenguinServer"&gt;PenguinServer&lt;/a&gt; and &lt;a class="wiki" href="http://localhost:8080/trac/wiki/ParrotServer"&gt;ParrotServer&lt;/a&gt; and what issues would arrise when we do.
&lt;/p&gt;
&lt;p&gt;
See the documentation on &lt;a class="ext-link" href="https://www.debian.org/releases/jessie/amd64/release-notes/ch-upgrading.en.html"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;Upgrades from Debian 7 (wheezy)&lt;/a&gt; and &lt;a class="ext-link" href="https://www.debian.org/releases/stable/amd64/release-notes/ch-information.en.html"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;Issues to be aware of for jessie&lt;/a&gt;, specifically:
&lt;/p&gt;
&lt;ul&gt;&lt;li&gt;&lt;a class="ext-link" href="https://www.debian.org/releases/stable/amd64/release-notes/ch-information.en.html#libv8"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;Lack of security support for the ecosystem around libv8 and Node.js&lt;/a&gt;
&lt;/li&gt;&lt;li&gt;&lt;a class="ext-link" href="https://www.debian.org/releases/stable/amd64/release-notes/ch-information.en.html#apache-httpd-incomat"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;Incompatible changes in Apache HTTPD 2.4&lt;/a&gt;
&lt;/li&gt;&lt;li&gt;&lt;a class="ext-link" href="https://www.debian.org/releases/stable/amd64/release-notes/ch-information.en.html#php-incompat"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;PHP 5.6 upgrade has behavioral changes&lt;/a&gt;
&lt;/li&gt;&lt;/ul&gt;</description>
        <category>Results</category>
        <comments>http://localhost:8080/trac/ticket/847#changelog</comments>
    </item><item>
        <link>http://localhost:8080/trac/ticket/851</link>
        <guid isPermaLink="false">http://localhost:8080/trac/ticket/851</guid>
        <title>#851: Bot attacks on Transition Culture</title>
        <pubDate>Sun, 10 May 2015 11:12:12 GMT</pubDate>
        
        <dc:creator>chris</dc:creator>

        <description>&lt;p&gt;
Yesterday there was a load spike on &lt;a class="wiki" href="http://localhost:8080/trac/wiki/ParrotServer"&gt;ParrotServer&lt;/a&gt; caused by a bot doing thousands of POSTs to &lt;tt&gt;xmlrpc.php&lt;/tt&gt;.
&lt;/p&gt;
</description>
        <category>Results</category>
        <comments>http://localhost:8080/trac/ticket/851#changelog</comments>
    </item><item>
        <link>http://localhost:8080/trac/ticket/871</link>
        <guid isPermaLink="false">http://localhost:8080/trac/ticket/871</guid>
        <title>#871: Brute Force Attacks Against WordPress Sites</title>
        <pubDate>Mon, 21 Sep 2015 13:41:26 GMT</pubDate>
        
        <dc:creator>chris</dc:creator>

        <description>&lt;p&gt;
Today there have been 53,932 attempts to login to the &lt;a class="ext-link" href="http://www.transitiontowntotnes.org/"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;TTT web site&lt;/a&gt; on &lt;a class="wiki" href="http://localhost:8080/trac/wiki/ParrotServer"&gt;ParrotServer&lt;/a&gt; all from the same IP address:
&lt;/p&gt;
&lt;pre class="wiki"&gt;grep POST /home/ttt/logs/access.log | grep wp-login.php | grep 217.174.240.254 | wc -l
53932
&lt;/pre&gt;&lt;p&gt;
I noticed this due the higher than usual load it was generating.
&lt;/p&gt;
&lt;p&gt;
Would it be OK to spend an hour or two installing the &lt;a class="ext-link" href="https://wordpress.org/plugins/wp-fail2ban/"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;WP fail2ban&lt;/a&gt; plugin on all the sites on the server?
&lt;/p&gt;
&lt;p&gt;
Some more background on this issue:
&lt;/p&gt;
&lt;ul&gt;&lt;li&gt;&lt;a class="ext-link" href="https://docs.webarch.net/wiki/WordPress#Brute_Force_Attacks"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;https://docs.webarch.net/wiki/WordPress#Brute_Force_Attacks&lt;/a&gt;
&lt;/li&gt;&lt;/ul&gt;</description>
        <category>Results</category>
        <comments>http://localhost:8080/trac/ticket/871#changelog</comments>
    </item><item>
        <link>http://localhost:8080/trac/ticket/873</link>
        <guid isPermaLink="false">http://localhost:8080/trac/ticket/873</guid>
        <title>#873: New Wordpress site please</title>
        <pubDate>Tue, 22 Sep 2015 12:25:12 GMT</pubDate>
        
        <dc:creator>sam</dc:creator>

        <description>&lt;p&gt;
Hi Chris
&lt;/p&gt;
&lt;p&gt;
I couldn't ssh into parrot for some reason, I think you said you created me a 'sam' user on there but I can't get in.
&lt;/p&gt;
&lt;p&gt;
So could you set up a new Wordpress site on there.
&lt;/p&gt;
&lt;p&gt;
wpdev.tn.org or similar, it's only going to be for testing some stuff so URL doesn't really matter.
&lt;/p&gt;
&lt;p&gt;
Thanks
&lt;/p&gt;
&lt;p&gt;
Sam
&lt;/p&gt;
</description>
        <category>Results</category>
        <comments>http://localhost:8080/trac/ticket/873#changelog</comments>
    </item><item>
        <link>http://localhost:8080/trac/ticket/875</link>
        <guid isPermaLink="false">http://localhost:8080/trac/ticket/875</guid>
        <title>#875: Free HTTPS certificates from Let's Encrypt</title>
        <pubDate>Mon, 05 Oct 2015 10:48:11 GMT</pubDate>
        
        <dc:creator>chris</dc:creator>

        <description>&lt;p&gt;
From mid November 2015 &lt;a class="ext-link" href="https://www.letsencrypt.org/"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;Let's Encrypt&lt;/a&gt; should be live, providing free SSL/TLS certificates. Currently the TN pays for a Gandi wild card cert, costing £130.50 a year, in addition most the &lt;a class="wiki" href="http://localhost:8080/trac/wiki/WordPress"&gt;WordPress&lt;/a&gt; sites on &lt;a class="wiki" href="http://localhost:8080/trac/wiki/ParrotServer"&gt;ParrotServer&lt;/a&gt; don't have certs due to the cost, see &lt;a class="new ticket" href="http://localhost:8080/trac/ticket/540" title="maintenance: HTTPS for WordPress sites (new)"&gt;ticket:540&lt;/a&gt;.
&lt;/p&gt;
&lt;p&gt;
The &lt;a class="ext-link" href="https://github.com/letsencrypt/letsencrypt"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;Let's Encrypt code&lt;/a&gt; is designed to be set up to run automatically -- certs are only valid for 90 days and the automatic renewal process runs when the cert is 60 days old.
&lt;/p&gt;
&lt;p&gt;
We should consider if we want to use &lt;a class="ext-link" href="https://www.letsencrypt.org/"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;Let's Encrypt&lt;/a&gt; and what things would need to be put in place to use it, the wild card cert is due to expire on 22/01/16.
&lt;/p&gt;
&lt;ol&gt;&lt;li&gt;&lt;a class="wiki" href="http://localhost:8080/trac/wiki/PuffinServer"&gt;PuffinServer&lt;/a&gt; -- are we still going to be running &lt;a class="wiki" href="http://localhost:8080/trac/wiki/PuffinServer"&gt;PuffinServer&lt;/a&gt; in January 2016? Is there any chance that we might be able to consider the suggestions in &lt;a class="closed ticket" href="http://localhost:8080/trac/ticket/754#comment:61" title="maintenance: Can we upgrade from PHP 5.3? (closed: wontfix)"&gt;ticket:754#comment:61&lt;/a&gt;? I'm not sure if I want to spend time trying to get Let's Encrypt working with &lt;a class="closed ticket" href="http://localhost:8080/trac/ticket/872" title="defect: BOA 2.4.6 (closed: wontfix)"&gt;a old version of BOA&lt;/a&gt;, up to date versions of BOA might &lt;a class="ext-link" href="https://github.com/omega8cc/boa/issues/500"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;support it out of the box&lt;/a&gt;.
&lt;/li&gt;&lt;li&gt;&lt;a class="wiki" href="http://localhost:8080/trac/wiki/PenguinServer"&gt;PenguinServer&lt;/a&gt; -- this site hosts a lot of sites, see &lt;a class="ext-link" href="https://penguin.transitionnetwork.org/"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;the listing&lt;/a&gt;, automating Let's Encrypt would probably be a hour or two of work, it might makes sense to upgrade it to Debian Jessie at the same time.
&lt;/li&gt;&lt;li&gt;&lt;a class="wiki" href="http://localhost:8080/trac/wiki/ParrotServer"&gt;ParrotServer&lt;/a&gt; -- I suggest we rebuild this server from scratch, this would enable it to have the latest version of the &lt;a class="ext-link" href="https://docs.webarch.net/wiki/Webarch_Secure_Hosting"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;Webarch Secure Hosting scripts&lt;/a&gt; and this include support for fail2ban for &lt;a class="wiki" href="http://localhost:8080/trac/wiki/WordPress"&gt;WordPress&lt;/a&gt; and phpMyAdmin, thus solving &lt;a class="new ticket" href="http://localhost:8080/trac/ticket/871" title="maintenance: Brute Force Attacks Against WordPress Sites (new)"&gt;ticket:871&lt;/a&gt; and includes automatic provisioning of Let's Encrypt certs for sites.
&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;
What do people think?
&lt;/p&gt;
</description>
        <category>Results</category>
        <comments>http://localhost:8080/trac/ticket/875#changelog</comments>
    </item><item>
        <link>http://localhost:8080/trac/ticket/879</link>
        <guid isPermaLink="false">http://localhost:8080/trac/ticket/879</guid>
        <title>#879: MediaWiki 1.23.11</title>
        <pubDate>Fri, 16 Oct 2015 08:42:45 GMT</pubDate>
        
        <dc:creator>chris</dc:creator>

        <description>&lt;p&gt;
Email on &lt;a class="ext-link" href="https://lists.wikimedia.org/pipermail/mediawiki-announce/2015-October/000180.html"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;the announcements list&lt;/a&gt;:
&lt;/p&gt;
&lt;pre class="wiki"&gt;Tomorrow we will be issuing a security release to all supported
branches of MediaWiki.
The new releases will be:
1.25.3
1.24.4
1.23.11
Fixes will be available in these respective release branches, the
unreleased 1.26.x branch, and master. Tarballs will be available
for the above mentioned point releases as well.
This security release will encompass core only, no bundled extensions
are affected.
&lt;/pre&gt;</description>
        <category>Results</category>
        <comments>http://localhost:8080/trac/ticket/879#changelog</comments>
    </item><item>
        <link>http://localhost:8080/trac/ticket/881</link>
        <guid isPermaLink="false">http://localhost:8080/trac/ticket/881</guid>
        <title>#881: Site on ParrotServer with a memory leak?</title>
        <pubDate>Fri, 23 Oct 2015 11:19:04 GMT</pubDate>
        
        <dc:creator>chris</dc:creator>

        <description>&lt;p&gt;
It appears a site, or application, on &lt;a class="wiki" href="http://localhost:8080/trac/wiki/ParrotServer"&gt;ParrotServer&lt;/a&gt; might have a memory leak.
&lt;/p&gt;
&lt;p&gt;
&lt;a style="padding:0; border:none" href="http://localhost:8080/trac/attachment/ticket/881/parrot-memory-pinpoint-1411038915-1445598915.png"&gt;&lt;img src="http://localhost:8080/trac/raw-attachment/ticket/881/parrot-memory-pinpoint-1411038915-1445598915.png" /&gt;&lt;/a&gt;
&lt;/p&gt;
</description>
        <category>Results</category>
        <comments>http://localhost:8080/trac/ticket/881#changelog</comments>
    </item><item>
        <link>http://localhost:8080/trac/ticket/884</link>
        <guid isPermaLink="false">http://localhost:8080/trac/ticket/884</guid>
        <title>#884: RE: http://news.transitionnetwork.org</title>
        <pubDate>Thu, 03 Dec 2015 12:40:03 GMT</pubDate>
        
        <dc:creator>paul</dc:creator>

        <description>&lt;pre class="wiki"&gt;Hi Chris, All
Can you help me to reset my password for paulbooker for
news.transitionnetwork.org? I just tried to use the reset password form but
I never received an email and when I Iooked at the settings,php file for
the website (generated by Aegir) I couldn't see immediately where to find
the database.
I think I may have missed some recent updates to news.transitionnetwork.org
so urgently need to resolve this today.
Not sure how this has fallen of my radar, but, I just noticed that
news.transitionnetwork.org is no longer mentioned on the platform page on
Aegir so may have got into thinking that this site no longer exists.
http://news.transitionnetwork.org
https://tn.puffin.webarch.net/hosting/platforms
--
Paul Booker
Drupal Support for Websites and Linux Servers
Website: http://www.paulbooker.co.uk
Tel: +44 01922 861636
&lt;/pre&gt;</description>
        <category>Results</category>
        <comments>http://localhost:8080/trac/ticket/884#changelog</comments>
    </item><item>
        <link>http://localhost:8080/trac/ticket/894</link>
        <guid isPermaLink="false">http://localhost:8080/trac/ticket/894</guid>
        <title>#894: Brute Force Attacks Against WordPress XMLRPC</title>
        <pubDate>Thu, 07 Jan 2016 11:23:51 GMT</pubDate>
        
        <dc:creator>chris</dc:creator>

        <description>&lt;p&gt;
For a few months I have see a lot of requests going to &lt;a class="wiki" href="http://localhost:8080/trac/wiki/WordPress"&gt;WordPress&lt;/a&gt; &lt;tt&gt;/xmlrpc.php&lt;/tt&gt; and wasn't sure why, now it is clear:
&lt;/p&gt;
&lt;blockquote class="citation"&gt;
&lt;p&gt;
Instead of going against wp-login.php (which can be easily blocked or protected via .htaccess) or doing a single attempt against xmlrpc, attackers are leveraging the system.multicall method to attempt to guess hundreds of passwords within just one HTTP request.
&lt;/p&gt;
&lt;p&gt;
&lt;a class="ext-link" href="https://blog.sucuri.net/2015/10/brute-force-amplification-attacks-against-wordpress-xmlrpc.html"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;https://blog.sucuri.net/2015/10/brute-force-amplification-attacks-against-wordpress-xmlrpc.html&lt;/a&gt;
&lt;/p&gt;
&lt;/blockquote&gt;
&lt;p&gt;
I'd like to install &lt;a class="ext-link" href="https://wordpress.org/plugins/stop-xmlrpc-attack/"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;Stop XML-RPC Attack&lt;/a&gt; on all the &lt;a class="wiki" href="http://localhost:8080/trac/wiki/WordPress"&gt;WordPress&lt;/a&gt; site we host, unless anyone has a good reason not to. This plugin simply whitelists the JetPack/Automattic's subnets and blocks all other access to &lt;tt&gt;/xmlrpc.php&lt;/tt&gt;.
&lt;/p&gt;
&lt;p&gt;
I started tracking the abuse a while ago and you can see it and manually address it on &lt;a class="wiki" href="http://localhost:8080/trac/wiki/ParrotServer"&gt;ParrotServer&lt;/a&gt; like this:
&lt;/p&gt;
&lt;pre class="wiki"&gt;sudo -i
wp-xmlrpc-abuse
IP addresses accessing xmlrpc.php more than twice for the last 1000 lines of each access.log:
      2 46.148.XX.XX
    733 195.62.53.243
    177 195.62.53.243
      2 66.76.XX.XX
dig -x 195.62.53.243 +short
  53-243.static.spheral.ru.
ipdrop 195.62.53.243
&lt;/pre&gt;&lt;p&gt;
But we need to be more pro-active in blocking access or we are going to probably see some compromised sites.
&lt;/p&gt;
</description>
        <category>Results</category>
        <comments>http://localhost:8080/trac/ticket/894#changelog</comments>
    </item><item>
        <link>http://localhost:8080/trac/ticket/897</link>
        <guid isPermaLink="false">http://localhost:8080/trac/ticket/897</guid>
        <title>#897: Hosting information/requirements for 2016</title>
        <pubDate>Tue, 19 Jan 2016 10:14:57 GMT</pubDate>
        
        <dc:creator>chris</dc:creator>

        <description>&lt;p&gt;
This is a ticket to track the time spent on an email thread with Ade.
&lt;/p&gt;
</description>
        <category>Results</category>
        <comments>http://localhost:8080/trac/ticket/897#changelog</comments>
    </item><item>
        <link>http://localhost:8080/trac/ticket/898</link>
        <guid isPermaLink="false">http://localhost:8080/trac/ticket/898</guid>
        <title>#898: Fwd: Access to Drupal</title>
        <pubDate>Tue, 26 Jan 2016 17:35:05 GMT</pubDate>
        
        <dc:creator>ade</dc:creator>

        <description>&lt;pre class="wiki"&gt;Hi Chris,
The web team at the development agency are requesting access to the
webserver so that they can look at the sites make up.
(Please see below)
Would you please set up an account so that they can get root read access?
I guess this would be done via FTP, but your thoughts greatly appreciated.
best regards
Ade
---------- Forwarded message ----------
From: Ainslie Beattie &amp;lt;ainsliebeattie@transitionnetwork.org&amp;gt;
Date: 26 January 2016 at 17:25
Subject: Fwd: Access to Drupal
To: Sam Rossiter &amp;lt;samrossiter@transitionnetwork.org&amp;gt;, Ade Stuart &amp;lt;
adestuart@transitionnetwork.org&amp;gt;, Yvonne Struthers &amp;lt;yvonne@thisisyoke.com&amp;gt;
Hey both, can you please action this urgently so that Yoke can have access.
Cheers
---------- Forwarded message ----------
From: "Yvonne Struthers" &amp;lt;yvonne@thisisyoke.com&amp;gt;
Date: 26 Jan 2016 10:58
Subject: Access to Drupal
To: &amp;lt;ainsliebeattie@transitionnetwork.org&amp;gt;
Cc:
Hi Ainslie,
Just a quick email as I'm out seeing a client today,but just to say,it
looks like you have only given us access to the database. What we need
please is admin access to the Drupal site and to the code base so that we
can get a sense of how it's all set up.
Thanks in advance!
Yvonne
Sent from my iPhone
--
Ade Stuart
Web Manager - Transition network
07595 331877
The Transition Network is a registered charity
address: 43 Fore St, Totnes, Devon, TQ9 5HN, UK
website: www.transitionnetwork.org
TN company no: 6135675 TN charity no: 1128675
&lt;/pre&gt;</description>
        <category>Results</category>
        <comments>http://localhost:8080/trac/ticket/898#changelog</comments>
    </item><item>
        <link>http://localhost:8080/trac/ticket/901</link>
        <guid isPermaLink="false">http://localhost:8080/trac/ticket/901</guid>
        <title>#901: Enable SSH access to PuffinServer for Ade</title>
        <pubDate>Wed, 03 Feb 2016 13:25:27 GMT</pubDate>
        
        <dc:creator>chris</dc:creator>

        <description>&lt;p&gt;
This is a ticket to track the time spent sorting out SSH access for Ade to &lt;a class="wiki" href="http://localhost:8080/trac/wiki/PuffinServer"&gt;PuffinServer&lt;/a&gt;.
&lt;/p&gt;
</description>
        <category>Results</category>
        <comments>http://localhost:8080/trac/ticket/901#changelog</comments>
    </item><item>
        <link>http://localhost:8080/trac/ticket/903</link>
        <guid isPermaLink="false">http://localhost:8080/trac/ticket/903</guid>
        <title>#903: Large load spike on PuffinServer</title>
        <pubDate>Mon, 08 Feb 2016 08:46:37 GMT</pubDate>
        
        <dc:creator>chris</dc:creator>

        <description>&lt;p&gt;
There was a large load spike this morning on &lt;a class="wiki" href="http://localhost:8080/trac/wiki/PuffinServer"&gt;PuffinServer&lt;/a&gt;, which appears to have been caused by 12k requests for pages (Nginx doesn't log requests for anything other than PHP generated pages) from one IP address, this IP address has been blocked and I'll post some details below.
&lt;/p&gt;
</description>
        <category>Results</category>
        <comments>http://localhost:8080/trac/ticket/903#changelog</comments>
    </item><item>
        <link>http://localhost:8080/trac/ticket/904</link>
        <guid isPermaLink="false">http://localhost:8080/trac/ticket/904</guid>
        <title>#904: Issues to consider in the migration from Drupal to WordPress</title>
        <pubDate>Fri, 19 Feb 2016 10:41:04 GMT</pubDate>
        
        <dc:creator>chris</dc:creator>

        <description>&lt;p&gt;
A few weeks ago Ade said he though it would be worth me opening a ticket to use to flag up some issues to be considered in the migration of the &lt;a class="ext-link" href="https://www.transitionnetwork.org.uk/"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;Transition Network site&lt;/a&gt; from Drupal 6 to &lt;a class="wiki" href="http://localhost:8080/trac/wiki/WordPress"&gt;WordPress&lt;/a&gt;.
&lt;/p&gt;
</description>
        <category>Results</category>
        <comments>http://localhost:8080/trac/ticket/904#changelog</comments>
    </item><item>
        <link>http://localhost:8080/trac/ticket/907</link>
        <guid isPermaLink="false">http://localhost:8080/trac/ticket/907</guid>
        <title>#907: TN Drupal database size</title>
        <pubDate>Wed, 02 Mar 2016 10:20:10 GMT</pubDate>
        
        <dc:creator>chris</dc:creator>

        <description>&lt;p&gt;
6 weeks ago the datadase dump was 447M, see &lt;a class="ext-link" href="http://trac.edgewall.org/intertrac/ticket/896%23comment%3A3" title="ticket/896#comment:3 in Trac project trac"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;trac:ticket/896#comment:3&lt;/a&gt; but now it is 1.8G:
&lt;/p&gt;
&lt;pre class="wiki"&gt;ls -lah /var/backups/mysql/sqldump/transitionnetw_0.sql
-rw------- 1 root root 1.8G Mar  2 01:23 /var/backups/mysql/sqldump/transitionnetw_0.sql
&lt;/pre&gt;&lt;p&gt;
Anyone have any idea what happened to cause this? Are we keeping too many log entries?
&lt;/p&gt;
</description>
        <category>Results</category>
        <comments>http://localhost:8080/trac/ticket/907#changelog</comments>
    </item><item>
        <link>http://localhost:8080/trac/ticket/916</link>
        <guid isPermaLink="false">http://localhost:8080/trac/ticket/916</guid>
        <title>#916: SSH to parrot please</title>
        <pubDate>Wed, 13 Jul 2016 11:01:58 GMT</pubDate>
        
        <dc:creator>sam</dc:creator>

        <description>&lt;p&gt;
Hi Chris could you set up a SSH account on parrot please
&lt;/p&gt;
&lt;p&gt;
Kevin
support@…
&lt;/p&gt;
&lt;p&gt;
Public SSH key attached.
&lt;/p&gt;
&lt;p&gt;
Thanks
&lt;/p&gt;
&lt;p&gt;
Sam
&lt;/p&gt;
</description>
        <category>Results</category>
        <comments>http://localhost:8080/trac/ticket/916#changelog</comments>
    </item><item>
        <link>http://localhost:8080/trac/ticket/919</link>
        <guid isPermaLink="false">http://localhost:8080/trac/ticket/919</guid>
        <title>#919: Site offline</title>
        <pubDate>Thu, 14 Jul 2016 18:17:26 GMT</pubDate>
        
        <dc:creator>chris</dc:creator>

        <description>&lt;p&gt;
The &lt;a class="ext-link" href="https://www.transitionnetwork.org/"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;https://www.transitionnetwork.org/&lt;/a&gt; site has been "off-line" since about 7pm, I see that Paul is logged on via &lt;tt&gt;ssh&lt;/tt&gt; -- is this something that we should worry about or is this intentional?
&lt;/p&gt;
</description>
        <category>Results</category>
        <comments>http://localhost:8080/trac/ticket/919#changelog</comments>
    </item><item>
        <link>http://localhost:8080/trac/ticket/716</link>
        <guid isPermaLink="false">http://localhost:8080/trac/ticket/716</guid>
        <title>#716: Heartbleed</title>
        <pubDate>Wed, 09 Apr 2014 08:53:58 GMT</pubDate>
        
        <dc:creator>chris</dc:creator>

        <description>&lt;p&gt;
Following on from &lt;a class="new ticket" href="http://localhost:8080/trac/ticket/692#comment:18" title="maintenance: Debian Updates (new)"&gt;ticket:692#comment:18&lt;/a&gt; we should undertake the steps Drupal have taken: &lt;a class="ext-link" href="https://drupal.org/news/2014-04-08-security-update"&gt;&lt;span class="icon"&gt;​&lt;/span&gt;https://drupal.org/news/2014-04-08-security-update&lt;/a&gt;
&lt;/p&gt;
</description>
        <category>Results</category>
        <comments>http://localhost:8080/trac/ticket/716#changelog</comments>
    </item><item>
        <link>http://localhost:8080/trac/ticket/812</link>
        <guid isPermaLink="false">http://localhost:8080/trac/ticket/812</guid>
        <title>#812: space.transitionnetwork.org hacked?</title>
        <pubDate>Thu, 27 Nov 2014 11:09:32 GMT</pubDate>
        
        <dc:creator>chris</dc:creator>

        <description>&lt;p&gt;
BOA email from &lt;a class="wiki" href="http://localhost:8080/trac/wiki/PuffinServer"&gt;PuffinServer&lt;/a&gt;:
&lt;/p&gt;
&lt;pre class="wiki"&gt;Hello,
Our system detected that the site space.transitionnetwork.org has been hacked!
Common signatures of an attack which triggered this alert:
You are required to change your password immediately (password aged)
su: Authentication token is no longer valid; new one required
(Ignored)
Site tested positive for known Drupalgeddon exploit checks               [error]
Update module is disabled and Drupalgeddon cannot check for Drupal       [error]
Security Updates. Please check for a security update manually.
You are running Drupal 7.31
https://www.drupal.org/node/3060/release?api_version%5B%5D=103
The platform root directory for this site is:
  /data/disk/tn/distro/008/openatrium-7.x-2.19-7.31.1
The system hostname is:
  puffin.webarch.net
To learn more on what happened, how it was possible and
how to survive #Drupageddon, please read:
  https://omega8.cc/drupageddon-psa-2014-003-342
--
This e-mail has been sent by your Aegir system monitor.
&lt;/pre&gt;</description>
        <category>Results</category>
        <comments>http://localhost:8080/trac/ticket/812#changelog</comments>
    </item><item>
        <link>http://localhost:8080/trac/ticket/821</link>
        <guid isPermaLink="false">http://localhost:8080/trac/ticket/821</guid>
        <title>#821: Projects forms being hammered by Spam</title>
        <pubDate>Wed, 07 Jan 2015 09:53:33 GMT</pubDate>
        
        <dc:creator>ed</dc:creator>

        <description>&lt;p&gt;
Projects forms being hammered by spammers. I got 24 in the last 45 minutes.
&lt;/p&gt;
&lt;blockquote&gt;
&lt;p&gt;
What to do?
&lt;/p&gt;
&lt;/blockquote&gt;
&lt;ol&gt;&lt;li&gt;Lock off to a certain type of user?
&lt;/li&gt;&lt;li&gt;
&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;
?
&lt;/p&gt;
&lt;p&gt;
Adding Sam as owner to follow this up
&lt;/p&gt;
</description>
        <category>Results</category>
        <comments>http://localhost:8080/trac/ticket/821#changelog</comments>
    </item><item>
        <link>http://localhost:8080/trac/ticket/790</link>
        <guid isPermaLink="false">http://localhost:8080/trac/ticket/790</guid>
        <title>#790: Annesley locked out of puffin</title>
        <pubDate>Tue, 23 Sep 2014 14:05:18 GMT</pubDate>
        
        <dc:creator>chris</dc:creator>

        <description>&lt;p&gt;
Email from lfd:
&lt;/p&gt;
&lt;pre class="wiki"&gt;Time:     Tue Sep 23 13:47:01 2014 +0100
IP:       XX.XX.XX.XX (HU/Hungary/XXXXXX.catv.pool.telekom.hu)
Failures: 5 (sshd)
Interval: 300 seconds
Blocked:  Permanent Block
Log entries:
Sep 23 13:46:28 puffin sshd[6056]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=XX.XX.XX.XX  user=tn.ftp
Sep 23 13:46:30 puffin sshd[6056]: Failed password for tn.ftp from XX.XX.XX.XX port 54327 ssh2
Sep 23 13:46:33 puffin sshd[6056]: Failed password for tn.ftp from XX.XX.XX.XX port 54327 ssh2
Sep 23 13:46:56 puffin sshd[6409]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=XX.XX.XX.XX  user=anewholm
Sep 23 13:46:58 puffin sshd[6409]: Failed password for anewholm from XX.XX.XX.XX port 54328 ssh2
&lt;/pre&gt;</description>
        <category>Results</category>
        <comments>http://localhost:8080/trac/ticket/790#changelog</comments>
    </item><item>
        <link>http://localhost:8080/trac/ticket/905</link>
        <guid isPermaLink="false">http://localhost:8080/trac/ticket/905</guid>
        <title>#905: TN site down due to redis not running</title>
        <pubDate>Thu, 25 Feb 2016 10:28:40 GMT</pubDate>
        
        <dc:creator>chris</dc:creator>

        <description>&lt;p&gt;
I'm working on this...
&lt;/p&gt;
</description>
        <category>Results</category>
        <comments>http://localhost:8080/trac/ticket/905#changelog</comments>
    </item>
 </channel>
</rss>