http://localhost:8080/trac/query?status=closed&component=Drupal+modules+%26+settings&milestone=Maintenance&group=resolution&desc=1&order=summary Support and issues tracking for the Transition Network Web Project. en-US /trac/chrome/site/TransitionNetwork-Logo-Web-Small.jpg http://localhost:8080/trac/query?status=closed&component=Drupal+modules+%26+settings&milestone=Maintenance&group=resolution&desc=1&order=summary Trac 0.12.5 http://localhost:8080/trac/ticket/773 http://localhost:8080/trac/ticket/773 Wed, 06 Aug 2014 09:58:14 GMT annesley <p> hi, am trying to get a copy of the current TN.org D6 database and filesystem down to my laptop to develop against. i had pulled from GIT, backed up from Backup&amp;Migrate and got everything working but there are things missing. </p> <p> so i want to do a file copy. i started a tar operation but the tar size went over 1.3GB and i stopped it because it shouldn't be that big. as always BOA has restricted use of the "du" command so i can't really tell why the tar was so big. and i can't "df" to see if it's a problem </p> <p> should i let it continue? why is it so big? </p> Results http://localhost:8080/trac/ticket/773#changelog http://localhost:8080/trac/ticket/637 http://localhost:8080/trac/ticket/637 Thu, 28 Nov 2013 09:40:48 GMT ed <p> <a class="ext-link" href="http://www.transitionnetwork.org/news"><span class="icon">​</span>http://www.transitionnetwork.org/news</a> <a class="ext-link" href="http://www.transitionnetwork.org/blogs/rob-hopkins"><span class="icon">​</span>http://www.transitionnetwork.org/blogs/rob-hopkins</a> </p> <p> what is the teaser length - ie the first paragraph of a news or blog item that is published in the listings views? </p> <p> rob wants to know how many words he has for his introductions... </p> Results http://localhost:8080/trac/ticket/637#changelog http://localhost:8080/trac/ticket/575 http://localhost:8080/trac/ticket/575 Wed, 31 Jul 2013 14:39:11 GMT ed <p> Everyone who registers for the last two weeks is being blocked - check user list and see screengrab. Needs fixing promptly. </p> Results http://localhost:8080/trac/ticket/575#changelog http://localhost:8080/trac/ticket/608 http://localhost:8080/trac/ticket/608 Mon, 14 Oct 2013 08:37:38 GMT ed <p> The user profile pictures on the user profile nodes are too big. </p> <p> e.g. <a class="ext-link" href="https://transitionnetwork.org/people/tina-clarke"><span class="icon">​</span>https://transitionnetwork.org/people/tina-clarke</a> </p> <p> Please investigate and restrain them into a suitable maximum size </p> <p> NB: Ed is keeping a number of small UI-ish tickets back for Ben to do in a lump when we've built up enough so don't do anything yet. </p> Results http://localhost:8080/trac/ticket/608#changelog http://localhost:8080/trac/ticket/654 http://localhost:8080/trac/ticket/654 Thu, 12 Dec 2013 12:43:12 GMT ed <p> Some TIs are appearing in the 'Initiatives by number' view - but don't have numbers: </p> <p> <a class="ext-link" href="https://www.transitionnetwork.org/initiatives/by-number"><span class="icon">​</span>https://www.transitionnetwork.org/initiatives/by-number</a> </p> <p> for Sam to invesitage and solve or put to techs in January </p> Results http://localhost:8080/trac/ticket/654#changelog http://localhost:8080/trac/ticket/568 http://localhost:8080/trac/ticket/568 Mon, 08 Jul 2013 10:20:16 GMT ed <p> I can't see how to do a node edit and *not* send a notification - here seen on the Transition Culture blog: </p> <p> <a class="ext-link" href="https://www.transitionnetwork.org/node/32863/edit"><span class="icon">​</span>https://www.transitionnetwork.org/node/32863/edit</a> </p> <p> please advise - there's been some kerfuffle about the TC blog move so swift resolution much appreciated </p> Results http://localhost:8080/trac/ticket/568#changelog http://localhost:8080/trac/ticket/614 http://localhost:8080/trac/ticket/614 Wed, 06 Nov 2013 16:49:49 GMT ed <p> We want a button on the Social Reporters section that enables users to easily subscribe to the Social Reporters' blog posts CT. Offers the option to all types of user: </p> <ol class="loweralpha"><li>Users may not be logged in </li><li>Users may not be registered </li></ol><ol><li>This is a bit like the sub button on Transition Culture section </li><li>I can't find it in TRAC but have this memory of enabling email-only subscriptions to not-registered-users from olden days - can you enlighten me about that? I'm not sure it's the answer - we probably want them to register so they can add comments - but this request has brought up that old function </li></ol><p> .. </p> Results http://localhost:8080/trac/ticket/614#changelog http://localhost:8080/trac/ticket/724 http://localhost:8080/trac/ticket/724 Tue, 29 Apr 2014 09:21:12 GMT sam <p> A user has got in touch to let us know he is not getting Rob's updates by email. He's still subscribed. </p> <p> I just checked my mail and the last one I received was on the 11/4. I'll have a look and see if I can work it out. </p> Results http://localhost:8080/trac/ticket/724#changelog http://localhost:8080/trac/ticket/755 http://localhost:8080/trac/ticket/755 Tue, 08 Jul 2014 09:21:16 GMT ed <p> Rob Hopkins reached the limit for file uploads and could not upload any more images (not good for him as he writes posts with lots of pictures daily). </p> <p> Sam raised the limit. This change in the limit does not seem to have affected Rob's situation - he still can't upload any images. </p> <p> Looking at these settings: <a class="ext-link" href="https://www.transitionnetwork.org/admin/settings/uploads"><span class="icon">​</span>https://www.transitionnetwork.org/admin/settings/uploads</a> </p> <p> Rob should be able to upload more - he is a site editor and admin - but he can't. </p> <p> Please investigate </p> Results http://localhost:8080/trac/ticket/755#changelog http://localhost:8080/trac/ticket/785 http://localhost:8080/trac/ticket/785 Thu, 11 Sep 2014 15:54:35 GMT paul <p> @Ed Would you check my choice of component; I was looking for maintenance? Should I assign this to me as I create the ticket? </p> <p> View online: <a class="ext-link" href="https://www.drupal.org/node/2336263"><span class="icon">​</span>https://www.drupal.org/node/2336263</a> </p> <ul><li>Advisory ID: DRUPAL-SA-CONTRIB-2014-086 </li><li>Project: Custom Breadcrumbs <a class="missing changeset" title="No default repository defined">[1]</a> (third-party module) </li><li>Version: 6.x, 7.x </li><li>Date: 2014-September-10 </li><li>Security risk: 16/25 ( Critical) </li></ul><p> AC:None/A:User/CI:Some/II:Some/E:Theoretical/TD:All <a class="missing changeset" title="No default repository defined">[2]</a> </p> <ul><li>Vulnerability: Cross Site Scripting </li></ul><hr /> <hr /> <p> Custom Breadcrumbs allows administrators to set up parametrized breadcrumb trails for different content types, views, panels, taxonomy vocabularies and terms, paths, and a simple API that allows contributed modules to enable custom breadcrumbs for module pages and theme templates. </p> <p> User input is not properly sanitized in all use cases, opening a Cross Site Scripting (XSS) vulnerability. </p> <p> The vulnerability is only present when the custom breadcrumb is configured with the special identifier so that some of the breadcrumb items are not links. Typical example is that the last breadcrumb element is showing the current page title but is not a link. The XSS vulnerability is not triggered if all items of the breadcrumb are links and special identifier is not used. </p> <hr /> <hr /> <ul><li>/A CVE identifier <a class="missing changeset" title="No default repository defined">[3]</a> will be requested, and added upon issuance, in </li></ul><p> accordance with Drupal Security Team processes./ </p> <hr /> <hr /> <ul><li>Custom Breadcrumbs 6.x-1.x versions prior to 6.x-1.6 </li><li>Custom Breadcrumbs 6.x-2.x versions are NOT affected </li><li>Custom Breadcrumbs 7.x-2.x versions prior to 7.x-2.0-beta1 </li></ul><p> Drupal core is not affected. If you do not use the contributed Custom Breadcrumbs <a class="missing changeset" title="No default repository defined">[4]</a> module, there is nothing you need to do. </p> <hr /> <hr /> <p> Install the latest version: </p> <ul><li>If you use the Custom Breadcrumbs module version 1.x for Drupal 6.x, </li></ul><p> upgrade to Custom Breadcrumbs 6.x-1.6 <a class="missing changeset" title="No default repository defined">[5]</a>. </p> <ul><li>If you use the Custom Breadcrumbs module version 2.x for Drupal 7.x, </li></ul><p> upgrade to Custom Breadcrumbs 7.x-2.0-beta1 <a class="missing changeset" title="No default repository defined">[6]</a>. </p> <p> Also see the Custom Breadcrumbs <a class="missing changeset" title="No default repository defined">[7]</a> project page. </p> <hr /> <hr /> <ul><li>Markus Sipilä <a class="missing changeset" title="No default repository defined">[8]</a> </li></ul><hr /> <hr /> <ul><li>Markus Sipilä <a class="missing changeset" title="No default repository defined">[9]</a> </li><li>Colan Schwartz <a class="missing changeset" title="No default repository defined">[10]</a> the module maintainer </li></ul><hr /> <hr /> <ul><li>Greg Knaddison <a class="missing changeset" title="No default repository defined">[11]</a> of the Drupal Security Team </li></ul><hr /> <hr /> <p> The Drupal security team can be reached at security at drupal.org or via the contact form at <a class="ext-link" href="https://www.drupal.org/contact"><span class="icon">​</span>https://www.drupal.org/contact</a> <a class="missing changeset" title="No default repository defined">[12]</a>. </p> <p> Learn more about the Drupal Security team and their policies <a class="missing changeset" title="No default repository defined">[13]</a>, writing secure code for Drupal <a class="missing changeset" title="No default repository defined">[14]</a>, and securing your site <a class="missing changeset" title="No default repository defined">[15]</a>. </p> <p> <a class="missing changeset" title="No default repository defined">[1]</a> <a class="ext-link" href="https://www.drupal.org/project/custom_breadcrumbs"><span class="icon">​</span>https://www.drupal.org/project/custom_breadcrumbs</a> <a class="missing changeset" title="No default repository defined">[2]</a> <a class="ext-link" href="https://www.drupal.org/security-team/risk-levels"><span class="icon">​</span>https://www.drupal.org/security-team/risk-levels</a> <a class="missing changeset" title="No default repository defined">[3]</a> <a class="ext-link" href="http://cve.mitre.org/"><span class="icon">​</span>http://cve.mitre.org/</a> <a class="missing changeset" title="No default repository defined">[4]</a> <a class="ext-link" href="https://www.drupal.org/project/custom_breadcrumbs"><span class="icon">​</span>https://www.drupal.org/project/custom_breadcrumbs</a> <a class="missing changeset" title="No default repository defined">[5]</a> <a class="ext-link" href="https://www.drupal.org/node/2335705"><span class="icon">​</span>https://www.drupal.org/node/2335705</a> <a class="missing changeset" title="No default repository defined">[6]</a> <a class="ext-link" href="https://www.drupal.org/node/2335721"><span class="icon">​</span>https://www.drupal.org/node/2335721</a> <a class="missing changeset" title="No default repository defined">[7]</a> <a class="ext-link" href="https://www.drupal.org/project/custom_breadcrumbs"><span class="icon">​</span>https://www.drupal.org/project/custom_breadcrumbs</a> <a class="missing changeset" title="No default repository defined">[8]</a> <a class="ext-link" href="https://www.drupal.org/user/109674"><span class="icon">​</span>https://www.drupal.org/user/109674</a> <a class="missing changeset" title="No default repository defined">[9]</a> <a class="ext-link" href="https://www.drupal.org/user/109674"><span class="icon">​</span>https://www.drupal.org/user/109674</a> <a class="missing changeset" title="No default repository defined">[10]</a> <a class="ext-link" href="https://www.drupal.org/user/58704"><span class="icon">​</span>https://www.drupal.org/user/58704</a> <a class="missing changeset" title="No default repository defined">[11]</a> <a class="ext-link" href="https://www.drupal.org/user/36762"><span class="icon">​</span>https://www.drupal.org/user/36762</a> <a class="missing changeset" title="No default repository defined">[12]</a> <a class="ext-link" href="https://www.drupal.org/contact"><span class="icon">​</span>https://www.drupal.org/contact</a> <a class="missing changeset" title="No default repository defined">[13]</a> <a class="ext-link" href="https://www.drupal.org/security-team"><span class="icon">​</span>https://www.drupal.org/security-team</a> <a class="missing changeset" title="No default repository defined">[14]</a> <a class="ext-link" href="https://www.drupal.org/writing-secure-code"><span class="icon">​</span>https://www.drupal.org/writing-secure-code</a> <a class="missing changeset" title="No default repository defined">[15]</a> <a class="ext-link" href="https://www.drupal.org/security/secure-configuration"><span class="icon">​</span>https://www.drupal.org/security/secure-configuration</a> </p> <p> <span class="underline"></span><span class="underline"></span><span class="underline"></span><span class="underline"></span><span class="underline"></span><span class="underline"></span><span class="underline"></span><span class="underline"></span><span class="underline"></span><span class="underline"></span><span class="underline"></span><span class="underline">_ Security-news mailing list Security-news@… Unsubscribe at <a class="ext-link" href="https://lists.drupal.org/mailman/listinfo/security-news"><span class="icon">​</span>https://lists.drupal.org/mailman/listinfo/security-news</a> </span></p> Results http://localhost:8080/trac/ticket/785#changelog http://localhost:8080/trac/ticket/651 http://localhost:8080/trac/ticket/651 Thu, 12 Dec 2013 11:33:22 GMT ed <p> For January: set up a report for tools content type: </p> <ul><li>downloadable in .xls </li><li>tool title </li><li>URL (must be a hyperlink generated in .csv) </li><li>node reference </li></ul><p> No tools report exists yet - but lots of others here: <a class="ext-link" href="https://www.transitionnetwork.org/admin/reports"><span class="icon">​</span>https://www.transitionnetwork.org/admin/reports</a> </p> Results http://localhost:8080/trac/ticket/651#changelog http://localhost:8080/trac/ticket/652 http://localhost:8080/trac/ticket/652 Thu, 12 Dec 2013 11:34:49 GMT ed <p> For January: set up a report for tools content type: </p> <ul><li>downloadable in .xls </li><li>resource title </li><li>URL (must be a hyperlink generated in .csv) </li><li>node reference </li></ul><p> you will be able to work from this report: <a class="ext-link" href="https://www.transitionnetwork.org/admin/reports/resources"><span class="icon">​</span>https://www.transitionnetwork.org/admin/reports/resources</a> </p> Results http://localhost:8080/trac/ticket/652#changelog http://localhost:8080/trac/ticket/653 http://localhost:8080/trac/ticket/653 Thu, 12 Dec 2013 11:36:53 GMT ed <p> For January: set up a report for ingredients content type: </p> <ul><li>downloadable in .xls </li><li>ingredient title </li><li>URL (must be a hyperlink generated in .csv) </li><li>node reference </li></ul><p> No ingredients report exists yet - but lots of others here: ​<a class="ext-link" href="https://www.transitionnetwork.org/admin/reports"><span class="icon">​</span>https://www.transitionnetwork.org/admin/reports</a> </p> Results http://localhost:8080/trac/ticket/653#changelog http://localhost:8080/trac/ticket/581 http://localhost:8080/trac/ticket/581 Mon, 26 Aug 2013 13:24:17 GMT ed <p> Please remove the option for site editors/admins to 'add this to the newsletter' (which would send it to the newsletter nodequeue). Please also for now make the newsletter nodequeue non-active. </p> <p> It's been confusing for staff members, and was for the simmplemail service really, so we're going to trial using a google doc for staff to add their stories to the newsletter instead. </p> Results http://localhost:8080/trac/ticket/581#changelog http://localhost:8080/trac/ticket/602 http://localhost:8080/trac/ticket/602 Thu, 03 Oct 2013 09:14:43 GMT ed <ol><li>Blogs feed not working: </li></ol><p> <a class="ext-link" href="https://www.transitionnetwork.org/blogs/feed/"><span class="icon">​</span>https://www.transitionnetwork.org/blogs/feed/</a> </p> <ol start="2"><li>Rob's blog not working: </li></ol><p> <a class="ext-link" href="https://www.transitionnetwork.org/blogs/feed/rob-hopkins"><span class="icon">​</span>https://www.transitionnetwork.org/blogs/feed/rob-hopkins</a> </p> <ol start="3"><li>Getting complaints from users who are getting multiple copies of each blog post. Can't check this as the feed is down, but I've got 2 or 3 complaints in my inbox. </li></ol> Results http://localhost:8080/trac/ticket/602#changelog http://localhost:8080/trac/ticket/633 http://localhost:8080/trac/ticket/633 Mon, 25 Nov 2013 15:27:15 GMT ed <p> Re-arrange/add/edit the RHS blocks to appear the order below </p> <ol><li>Why/how etc. : NO change </li><li>newsletter promo: NO change </li><li>POJDS book button: much smaller - can you set book image to lhs and buy button to rhs within block? might need a special .png to have both in it </li><li>Transition nearby button: NO change </li><li>New iT2 film promo button: needs a graphic </li><li>New TFP button: NEW: Trucie providing a graphic to fit in </li><li>Training button: NEW: Ed asking for training graphic to fit in </li><li>Social media promo button: NEW: needs some very modest SM logos to link to SM outposts FB and twitter </li></ol><p> NB: Rob is only thinking of the homepage; Ed is not sure of the implications elsewhere on site... please advise on how/if this affects things elsewhere... </p> Results http://localhost:8080/trac/ticket/633#changelog http://localhost:8080/trac/ticket/908 http://localhost:8080/trac/ticket/908 Thu, 10 Mar 2016 15:43:56 GMT sam <p> Hi all </p> <p> The web project board has decided to move from Piwik to Google Analytics. </p> <p> I realise this has significant privacy implications, these were discussed, but it was decided that the move would go ahead. </p> <p> I have discussed with Ainslie adding an opt out in the form of a link to EFF's Privacy badger: <a class="ext-link" href="https://www.eff.org/privacybadger"><span class="icon">​</span>https://www.eff.org/privacybadger</a> This will be added to the cookie pop up bar in the new website. </p> <p> Could we enable the Google Analytics module on the existing site so I can add in the tracking code. </p> <p> Thanks </p> <p> Sam </p> Results http://localhost:8080/trac/ticket/908#changelog http://localhost:8080/trac/ticket/584 http://localhost:8080/trac/ticket/584 Wed, 04 Sep 2013 08:33:12 GMT ed <p> The news CT has a featured image, but it doesn't seem to be handling it as expected (succesfully on the blogs). See this news item: </p> <p> <a class="ext-link" href="https://www.transitionnetwork.org/news/2013-09-03/new-economy-20-enterprises-report-released"><span class="icon">​</span>https://www.transitionnetwork.org/news/2013-09-03/new-economy-20-enterprises-report-released</a> </p> <p> The featured image isn't visible anywhere - either: </p> <ol class="loweralpha"><li>in the news item itself </li><li>in the /news view </li></ol><p> Please investigate and resolve </p> Results http://localhost:8080/trac/ticket/584#changelog http://localhost:8080/trac/ticket/615 http://localhost:8080/trac/ticket/615 Sun, 10 Nov 2013 18:14:51 GMT jim <p> This is largely done, but the only tasks left are: </p> <ol><li>Make a patch and add to our makefile so our custom markers appear ok. </li><li>Get the clusterer to work per the comments &amp; issues in <a href="http://localhost:8080/trac/ticket/615#comment:1" title="Comment 1 for Ticket #615">comment:1</a> below. </li></ol><p> Per an email I got from Google: </p> <blockquote class="citation"> <p> As you may be aware, <a class="missing wiki">JavaScript?</a> Maps API v2 was scheduled for shutdown on May 19, 2013. After listening to feedback from developers we decided to extend the deprecation timeline by six months, to November 19, 2013 to allow more time for migration to v3 of the API. </p> </blockquote> <blockquote class="citation"> <p> On November 19, 2013 we will deploy a <a class="missing wiki">JavaScript?</a> wrapper that attempts to automagically turn remaining v2 maps into v3 maps. Though we expect this wrapper to work for most simple maps, we cannot guarantee that your maps will continue to function. We therefore highly recommend that you migrate to v3 before November 19. The good news is that Google Maps <a class="missing wiki">JavaScript?</a> API v3 is more robust and feature rich than v2, and we’ve written a guide to assist the migration. </p> </blockquote> <p> So this ticket is to do the update to the GMap module, testing and tweaking. </p> <p> Critical as we only have until 19 November for this... </p> Results http://localhost:8080/trac/ticket/615#changelog http://localhost:8080/trac/ticket/693 http://localhost:8080/trac/ticket/693 Thu, 27 Feb 2014 16:18:04 GMT sam <p> Hi Paul </p> <p> You'll see from this ticket; <a class="ext-link" href="https://trac.transitionnetwork.org/trac/ticket/582"><span class="icon">​</span>https://trac.transitionnetwork.org/trac/ticket/582</a> </p> <p> That the 6.29 &gt; 6.30 core update patches bugs that don't affect us. </p> <p> However some recent security updates for modules have been released recently; <a class="ext-link" href="https://www.transitionnetwork.org/admin/reports/updates"><span class="icon">​</span>https://www.transitionnetwork.org/admin/reports/updates</a> </p> <p> Affected modules are; </p> <p> ctools; <a class="ext-link" href="https://drupal.org/node/2194547"><span class="icon">​</span>https://drupal.org/node/2194547</a> </p> <p> filefield <a class="ext-link" href="https://drupal.org/node/2194103"><span class="icon">​</span>https://drupal.org/node/2194103</a> </p> <p> image resizer <a class="ext-link" href="https://drupal.org/node/2194063"><span class="icon">​</span>https://drupal.org/node/2194063</a> </p> <p> mimemail <a class="ext-link" href="https://drupal.org/node/2205939"><span class="icon">​</span>https://drupal.org/node/2205939</a> </p> <p> webform <a class="ext-link" href="https://drupal.org/node/2194181"><span class="icon">​</span>https://drupal.org/node/2194181</a> </p> <p> The ctools &amp; webform ones look like ones we should get on top of soonish, the mimemail one looks like it could be a pain. </p> <p> Are you up for testing the updates on your local box? We can then figure out how to roll them out to the live site. </p> <p> Thanks </p> <p> Sam </p> Results http://localhost:8080/trac/ticket/693#changelog http://localhost:8080/trac/ticket/622 http://localhost:8080/trac/ticket/622 Mon, 18 Nov 2013 17:06:59 GMT ed <p> <a class="ext-link" href="https://www.transitionnetwork.org/initiatives/map"><span class="icon">​</span>https://www.transitionnetwork.org/initiatives/map</a> <a class="ext-link" href="https://www.transitionnetwork.org/initiatives/exeter-nh-transition-town"><span class="icon">​</span>https://www.transitionnetwork.org/initiatives/exeter-nh-transition-town</a> </p> <p> please attend </p> Results http://localhost:8080/trac/ticket/622#changelog http://localhost:8080/trac/ticket/708 http://localhost:8080/trac/ticket/708 Thu, 27 Mar 2014 13:44:29 GMT sam <p> <a class="ext-link" href="https://www.transitionnetwork.org/initiatives/heal-soil-csa-community-supported-agriculture"><span class="icon">​</span>https://www.transitionnetwork.org/initiatives/heal-soil-csa-community-supported-agriculture</a> Address is correct, but doesn’t appear. The person who put it there doesn’t appear on the people map either, so wondering what’s afoot. </p> Results http://localhost:8080/trac/ticket/708#changelog http://localhost:8080/trac/ticket/207 http://localhost:8080/trac/ticket/207 Fri, 17 Dec 2010 14:19:50 GMT chris <p> This is a ticket to track items that show up in the logwatch emails to root and often just take a few mins of reading time and response. </p> <p> Any issues that look like they might take longer than a few mins should have their own tickets opened. </p> Results http://localhost:8080/trac/ticket/207#changelog http://localhost:8080/trac/ticket/703 http://localhost:8080/trac/ticket/703 Wed, 26 Mar 2014 13:06:15 GMT ed <p> The REconomy logo is not scaling and being re-presented well on the project page: <a class="ext-link" href="https://www.transitionnetwork.org/projects/reconomy"><span class="icon">​</span>https://www.transitionnetwork.org/projects/reconomy</a> </p> <p> Is this a theme/design issue or a problem with image re-sizing? </p> <p> What can we do about it? </p> Results http://localhost:8080/trac/ticket/703#changelog http://localhost:8080/trac/ticket/704 http://localhost:8080/trac/ticket/704 Wed, 26 Mar 2014 13:51:48 GMT ed <p> The REconomy logo is not scaling and being re-presented well on the project page: <a class="ext-link" href="https://www.transitionnetwork.org/projects/reconomy"><span class="icon">​</span>https://www.transitionnetwork.org/projects/reconomy</a> </p> <p> Is this a theme/design issue or a problem with image re-sizing? </p> <p> What can we do about it? </p> Results http://localhost:8080/trac/ticket/704#changelog http://localhost:8080/trac/ticket/906 http://localhost:8080/trac/ticket/906 Tue, 01 Mar 2016 22:27:10 GMT sam <p> Hi Chris </p> <p> I recklessly tried to enable a module on the site that enabled sending articles to friends by email, this seems to have been one of my less-good ideas. </p> <p> It tried to enable a print-friendly page and this seems to have brought the whole crumbling edifice down </p> <p> Sorry about that. Can you fix it? </p> Results http://localhost:8080/trac/ticket/906#changelog http://localhost:8080/trac/ticket/657 http://localhost:8080/trac/ticket/657 Mon, 16 Dec 2013 14:30:49 GMT ed <p> Big picture slideshow on TN homepage: Rob can't get it to go in the order he wants - please investigate: </p> <p> It is this nodequeue: <a class="ext-link" href="https://www.transitionnetwork.org/admin/content/nodequeue/9/view/8"><span class="icon">​</span>https://www.transitionnetwork.org/admin/content/nodequeue/9/view/8</a> </p> <p> Made up with these CTs: <a class="ext-link" href="https://www.transitionnetwork.org/admin/content/node-type/slide"><span class="icon">​</span>https://www.transitionnetwork.org/admin/content/node-type/slide</a> </p> Results http://localhost:8080/trac/ticket/657#changelog http://localhost:8080/trac/ticket/650 http://localhost:8080/trac/ticket/650 Thu, 12 Dec 2013 11:00:08 GMT ed <p> Sarah will be working on the TN strategy and this is about the content and comms tactics therein. The guiding principle is to use TN.org as the most suitable place for this material and conversations, and social media and direct mailshots for marketing and communicating it (because Sarah/TN cannot manage multiple conversations in multiple locations atm). </p> <p> This is work for Sam to do from January onwards </p> <ol><li>set up a landing page ".../TN-strategy-consultation" with its own RHS block with manual links to different documents and interviews </li></ol><p> SAM this can be a normal page with anchor links etc. </p> <ol start="2"><li>Use of blogs </li><li>Rob's for outreach - it's got the momentum - for updates/alerts/subscriptions </li><li>Sarah's for continuity (and looking back at it) - using tag "fn-strategy-consultation" </li></ol><ol start="3"><li>other places for comms/engagement </li><li>Forums not good; too open to trolls and spam; better in blog comments </li><li>webinar? Possibly if suitable </li><li>FB, twitter, other marketing channels - for marketing only </li><li>online meeting with national hubs - quite possibly </li></ol><ol start="4"><li>Direct Mail shot to PPOCs </li><li>Sarah Let Sam know if this is happening; Sam you'll need to do an export of PPOCs (<a class="ext-link" href="https://www.transitionnetwork.org/admin/reports/initiatives/primary-contacts"><span class="icon">​</span>https://www.transitionnetwork.org/admin/reports/initiatives/primary-contacts</a>), tidy and dump into mail chimp using the standard template </li></ol> Results http://localhost:8080/trac/ticket/650#changelog http://localhost:8080/trac/ticket/617 http://localhost:8080/trac/ticket/617 Mon, 11 Nov 2013 17:16:37 GMT ed <p> I want to add a link to the email a user receives following their creation of an account. </p> <p> this one: Subject: Account details for [user] at Transition Network </p> <p> Can I do this myself? I've looked in subs, notifications, logintoboggan etc. and can't find the place </p> <p> is it do-able? </p> Results http://localhost:8080/trac/ticket/617#changelog http://localhost:8080/trac/ticket/571 http://localhost:8080/trac/ticket/571 Tue, 16 Jul 2013 11:59:54 GMT jim <p> To further reduce load and leverage the caching I've changed the Session 443 settings to force anon users to HTTP and logged in to HTTPS. The benefit of allowing a handful of users to choose is tiny compared the downsides of outages, 503s and higher load. </p> <p> The <a class="ext-link" href="https://www.transitionnetwork.org/admin/settings/session443"><span class="icon">​</span>"User state" setting on the config page</a> is now " Redirect authenticated users to HTTPS and redirect anonymous users to HTTP (with the exception of login/registration pages).", was "Redirect authenticated users to HTTPS and redirect anonymous users on login/registration pages to HTTPS. Anonymous users visiting other pages may use HTTP or HTTPS." </p> <p> I've also set user and site-wide contact forms, plus the mailchimp subs page force secure-only per the "Additional pages to make secure" setting. </p> <p> We can see if this makes a difference, and this ticket is to track comments and see if it results in any improvement in performance/stability. </p> Results http://localhost:8080/trac/ticket/571#changelog http://localhost:8080/trac/ticket/679 http://localhost:8080/trac/ticket/679 Fri, 17 Jan 2014 17:15:58 GMT sam <p> Filtering the initiatives by country is not working </p> <p> <a class="ext-link" href="https://www.transitionnetwork.org/initiatives?themes=All&amp;community_type=All&amp;status_value=All&amp;country=at&amp;field_title_search="><span class="icon">​</span>https://www.transitionnetwork.org/initiatives?themes=All&amp;community_type=All&amp;status_value=All&amp;country=at&amp;field_title_search=</a> </p> <p> I had a play with the view on stg2.transitionnetwork.org but I couldn't get it working. </p> <p> It should display only initiatives from the country selected in the filter. It is displaying initiatives from all countries &amp; not respecting the filter. </p> <p> This view is used a lot by international initiatives. </p> Results http://localhost:8080/trac/ticket/679#changelog http://localhost:8080/trac/ticket/659 http://localhost:8080/trac/ticket/659 Mon, 16 Dec 2013 17:03:41 GMT ed <p> Rob cleared the nodequeue for the featured story on the homepage about three hours ago, removed all but one story. No change has been observed. Please investigate: </p> <p> Nodequeue: <a class="ext-link" href="https://www.transitionnetwork.org/admin/content/nodequeue/6/view/5"><span class="icon">​</span>https://www.transitionnetwork.org/admin/content/nodequeue/6/view/5</a> </p> <p> This view: <a class="ext-link" href="https://www.transitionnetwork.org/admin/build/views/edit/featured_content?destination=newhome#views-tab-panel_pane_1"><span class="icon">​</span>https://www.transitionnetwork.org/admin/build/views/edit/featured_content?destination=newhome#views-tab-panel_pane_1</a> </p> <p> This is using content cache </p> Results http://localhost:8080/trac/ticket/659#changelog http://localhost:8080/trac/ticket/751 http://localhost:8080/trac/ticket/751 Tue, 01 Jul 2014 11:14:42 GMT ed <ol><li>Change the email alert template for news items to include the term 'news item' so it is: </li></ol><p> "New news item: [title]" </p> <ol start="2"><li>When users click on the subs links at the bottom of their email alerts, and they are not logged in they get the ‘access denied’ screen. This is not good. Please investigate </li></ol><p> (a) can this be changed (with small time investment) (b) can we change the access denied blurb to include something human encouraging the user to login to continue the journey: </p> <p> "We are sorry for the inconvenience, but if you are seeing this screen having followed a link, you will probably need to login to continue with your request" (NB if they are coming from an email link with their id in it, how do we keep that journey so they get to the destinateion they wanted?) </p> <ol start="3"><li>When user clicks on the general subs link at the bottom of an email alert (and is not logged in), they get a 403 forbidden page. Not good - pls investigage </li></ol> Results http://localhost:8080/trac/ticket/751#changelog http://localhost:8080/trac/ticket/648 http://localhost:8080/trac/ticket/648 Thu, 12 Dec 2013 10:49:39 GMT ed <p> Ed has edited the contact form replies for webproject@… on the contact form for TN.org which will now reply to users saying this: </p> <p> "Thank you for getting in touch. Please note that the website support is part time; and between mid-December 2013 and mid-January 2014 we are handing over the website support work as Ed goes on Paternity leave and Sam comes onboard, so please be patient - your replies are likely to take more time than usual. " </p> <p> <a class="ext-link" href="https://www.transitionnetwork.org/admin/build/contact"><span class="icon">​</span>https://www.transitionnetwork.org/admin/build/contact</a> </p> <p> SAM - when you are ready - probably mid-Jan - you will want to edit this back to something more suitable like: </p> <p> Thank you for getting in touch. Please note that the website support is part time, so while we will get back to you as soon as we can, that may be a few days </p> Results http://localhost:8080/trac/ticket/648#changelog http://localhost:8080/trac/ticket/667 http://localhost:8080/trac/ticket/667 Wed, 08 Jan 2014 16:40:47 GMT ed <p> Work by the Ttech team to share Jim's knowledge and tasks around the team before he leaves in early February 2014. Please use this ticket to log your time spent on this. </p> Results http://localhost:8080/trac/ticket/667#changelog http://localhost:8080/trac/ticket/663 http://localhost:8080/trac/ticket/663 Wed, 18 Dec 2013 17:44:43 GMT ed <p> We are wrapping up the PSE to simplify our web traffic, codebase and support requirements before we move to TNv3. </p> <p> Ed has informed all the PSE alpha triallists twice and asked them to remove their widgets. About half have. Others say they will. So we can remove the service any time from now on. </p> <p> Ed has UNpublished the following pages: </p> <ul><li>/pse/create </li><li>/pse/about </li><li>/pse/faq </li></ul><p> Jim - time to de-commission the service in a suitable way. Wrap this puppy up and turn it off. Please outline what you are going to do on this ticket and then do it. </p> <p> Ed suggests this is work for January 2014. </p> <p> Sam, Chris, fyi and any other changes needed? </p> Results http://localhost:8080/trac/ticket/663#changelog http://localhost:8080/trac/ticket/208 http://localhost:8080/trac/ticket/208 Fri, 17 Dec 2010 14:53:29 GMT chris <blockquote> <p> "The dblog module monitors your website, capturing system events in a log to be reviewed by an authorized individual at a later time. The dblog log is simply a list of recorded events containing usage data, performance data, errors, warnings and operational information. It is vital to check the dblog report on a regular basis as it is often the only way to tell what is going on." </p> </blockquote> <p> <a class="ext-link" href="https://www.transitionnetwork.org/admin/reports/dblog"><span class="icon">​</span>https://www.transitionnetwork.org/admin/reports/dblog</a> </p> <p> This is a ticket to be used to flag up issues that are not going to take up enough time that they justify their own ticket -- if an issue is raised in a comment on this ticket that does look like it's going to take some significant time then best start a new ticket for it. </p> Results http://localhost:8080/trac/ticket/208#changelog http://localhost:8080/trac/ticket/777 http://localhost:8080/trac/ticket/777 Mon, 25 Aug 2014 09:18:39 GMT ed <p> Most of the comments to this blog post are only showing up when you are logged in: <a class="ext-link" href="https://www.transitionnetwork.org/blogs/rob-hopkins/2014-07/fiona-ward-learning-celebrate-10000-failure#comment-17492"><span class="icon">​</span>https://www.transitionnetwork.org/blogs/rob-hopkins/2014-07/fiona-ward-learning-celebrate-10000-failure#comment-17492</a> </p> <p> Logged in: 5 comments Not logged in: 1 comment </p> <p> Handing this to Sam but happy for it to escalate. Presumably this issue won't be on this one post only - and it is important. </p> Results http://localhost:8080/trac/ticket/777#changelog http://localhost:8080/trac/ticket/624 http://localhost:8080/trac/ticket/624 Tue, 19 Nov 2013 11:16:02 GMT ed <p> Rob is doing an austerity special over 8 days, with a different clip from an interview with NEF every day. I've set up a page here: /austerity-basics </p> <p> Question: </p> <p> I know we can handle comments on pages, and I know that I don't get notifications of them. Can we arrange comment notifications for a page - asap - so that commenters get updates? </p> <p> If not, no problem. I heard about this plan *today* so am not expecting any massive tech leaps. </p> Results http://localhost:8080/trac/ticket/624#changelog http://localhost:8080/trac/ticket/658 http://localhost:8080/trac/ticket/658 Mon, 16 Dec 2013 14:59:38 GMT ed <p> The SRs are reporting very slow site updates - is this to do with not switching them over to the new views content caching? please check: </p> <p> <a class="ext-link" href="https://www.transitionnetwork.org/admin/build/views/edit/blogs?destination=stories#views-tab-panel_pane_2"><span class="icon">​</span>https://www.transitionnetwork.org/admin/build/views/edit/blogs?destination=stories#views-tab-panel_pane_2</a> </p> <p> <a class="ext-link" href="https://www.transitionnetwork.org/admin/build/block/configure/views/blogs-block_1?destination=newhome"><span class="icon">​</span>https://www.transitionnetwork.org/admin/build/block/configure/views/blogs-block_1?destination=newhome</a> </p> <p> And elsewhere there may be SR latest views? </p> Results http://localhost:8080/trac/ticket/658#changelog http://localhost:8080/trac/ticket/621 http://localhost:8080/trac/ticket/621 Mon, 18 Nov 2013 09:22:59 GMT ed <p> Two bits of the homepage are taking ages to update once Rob has made the changes and it's driving him spare. He's waiting up to 30 mins for them to update. </p> <p> Please speed up the times that it takes the system to update these two parts of the homepage to *instant* if possible: </p> <ol><li>Slideshow on homepage (AKA: <a class="ext-link" href="https://www.transitionnetwork.org/admin/build/views/edit/slideshows?destination=newhome#views-tab-panel_pane_1"><span class="icon">​</span>https://www.transitionnetwork.org/admin/build/views/edit/slideshows?destination=newhome#views-tab-panel_pane_1</a>). </li></ol><ol start="2"><li>Latest Transition Culture Blog pane on Homepage (AKA <a class="ext-link" href="https://www.transitionnetwork.org/admin/build/views/edit/tc_latest_blog?destination=newhome#views-tab-block_1"><span class="icon">​</span>https://www.transitionnetwork.org/admin/build/views/edit/tc_latest_blog?destination=newhome#views-tab-block_1</a>) </li></ol> Results http://localhost:8080/trac/ticket/621#changelog http://localhost:8080/trac/ticket/628 http://localhost:8080/trac/ticket/628 Thu, 21 Nov 2013 16:50:37 GMT ed <p> The space notifications are coming from "space.transitionnetwork.org" &lt;jim@…&gt; </p> <p> can you make them from "space.transitionnetwork.org" and a suitable TN address? </p> <p> Do I need to set up a suitable TN address? Perhaps </p> <p> space@…? </p> <p> Or is there a standard drupal system one in place already? </p> Results http://localhost:8080/trac/ticket/628#changelog http://localhost:8080/trac/ticket/798 http://localhost:8080/trac/ticket/798 Thu, 16 Oct 2014 12:40:58 GMT chris <p> The <a class="ext-link" href="https://raw.githubusercontent.com/omega8cc/boa/master/CHANGELOG.txt"><span class="icon">​</span>changelog</a>: </p> <pre class="wiki">### Stable BOA-2.3.5 Release - Full Edition ### Date: Wed Oct 15 16:28:25 PDT 2014 ### Includes Aegir 2.1 with improvements ### Latest hotfix added on: Wed Oct 15 20:09:52 PDT 2014 # Release Notes: This new BOA release includes important updates and bug fixes. * All new Drupal 7 platforms received Drupal core security upgrade. For details please read: https://www.drupal.org/SA-CORE-2014-005 * All existing Drupal 7 built-in platforms will receive a hot-fix for this known vulnerability: https://www.drupal.org/SA-CORE-2014-005 once you will run 'barracuda up-stable' command on your server. This procedure is automated on hosted and managed Aegir at Omega8.cc * Your custom D7 platforms created in the ~/static directory tree will be checked in the next 12 hours after the upgrade, and if you have not applied this patch yet, it will be applied automatically for you - but only if there is at least one active site present in the given custom D7 platform. Note that while this procedure is automated on hosted and managed Aegir at Omega8.cc, on self-hosted BOA systems it will work only if you will set _PERMISSIONS_FIX=YES in /root/.barracuda.cnf (default is NO) We recommend that you upgrade your D7 sites using safe workflow: https://omega8.cc/your-drupal-site-upgrade-safe-workflow-298 # Updated Octopus platforms: aGov 1.5 --------------------- https://drupal.org/project/agov Commerce 1.31 ---------------- https://drupal.org/project/commerce_kickstart Commerce 2.19 ---------------- https://drupal.org/project/commerce_kickstart Guardr 1.14 ------------------ https://drupal.org/project/guardr Open Atrium 2.22 ------------- https://drupal.org/project/openatrium Open Outreach 1.12 ----------- https://drupal.org/project/openoutreach OpenPublic 1.2 --------------- https://drupal.org/project/openpublic Panopoly 1.12 ---------------- https://drupal.org/project/panopoly # New features and enhancements in this release: * Explain that Solr self-provisioning works only if _MODULES_FIX=YES is set. * Reverify all sites daily if /root/.force.sites.verify.cnf ctrl file exists and _PERMISSIONS_FIX=YES is set in /root/.barracuda.cnf (default is NO) # Changes in this release: * Security: Remove support for SSLv3 due to POODLE vulnerability. * Disable Redis in Hostmaster until we will fix the Views based pages/blocks. * Disable site_readonly for non-dev sites by default. * Drush: Upgrade command line version 6 to mini-6-04-10-2014 * Enable AllowUserFXP in Pure-FTPd config by default. * Remove support for already deprecated non-LTS Ubuntu versions. * Run manage_ip_auth_access only once per minute. * The INI variable redis_flush_forced_mode is enabled by default (again). * Use sysklogd instead of rsyslog on Ubuntu. # System upgrades in this release: * MariaDB 5.5.40 * Nginx 1.7.6 * OpenSSH 6.7p1 (if installed from sources) * OpenSSL 1.0.1j (if installed from sources) - security upgrade. * PHPRedis: master-03-10-2014 # Fixes in this release: * Add auto-detection of Legacy Ruby patch level update on old systems. * Add cleanup for ghost/broken sites dirs leftovers. * Add missing cleanup for backup_migrate leftovers. * Always cleanup pid files on exit/abort. * Apply patch for SA-CORE-2014-005 in all shared D7 cores/built-in platforms. * Compass Tools: Install 1.9.3 ffi expected by older themes. * Fix db_port entry in all vhosts hourly. * Fix for broken erpal-7.x-2.0-7.31.1 * Fix for broken site level drushrc.php file. * Fix for false alarm caused by ghost sites leftovers. * Fix for incorrect hash filtering on systems with OpenSSL built from sources. * Fix locales: Numerous fixes and improvements -- thanks ar-jan! * Fix typo in REVISIONS. * Force site Verify via frontend if drushrc.php has been fixed. * Issue #435 - SQL: Remove deprecated table_cache +update table_open_cache * Issue #440 - Improve innodb_buffer_pool_size calculation and add 10% * Issue #441 - New Relic is not disabled after removing newrelic.info file. * Issue #442 - Skip locked/fpmcheck if /root/.high_traffic.cnf exists. * Issue #444 - PHP: Remove useless sed replacement in pool.d/www{*}.conf * Issue #445 - Remote Import: update 6.x-2.x branch for Aegir 2.x and Drush 6 * Issue #447 - Export LANG, LANGUAGE and all LC_ environment variables. * Issue #447 - Improve locales consistency. * Issue #447 - Set default LC_CTYPE and LC_COLLATE environment variables. * Issue #447 - Simplify locales configuration on Ubuntu. * Issue #448 - Enforce locale settings by configuring defaults. * Issue #452 - PHP build is broken with latest MariaDB 5.5.40 * Make sure that db_port is never empty and defaults to 3306. * Make sure that firewall monitoring scripts never run simultaneously. * Make sure that standard caching is enabled in hostmaster. * Pause hostmaster tasks when RVM install for any user is running. * PHP: Do not run rebuilds if not needed. * PHP: Fix for broken upgrade logic on libcurl or libssl packages upgrade. * Remove acquia_connector from latest Commons to avoid broken installs. * Remove all legacy gems and re-install RVM/Ruby for root from scratch. * Remove legacy replacement to avoid converting symlinked includes into files. * SQL: Use correct defaults if MySQLTuner test failed. * Workaround for Drupal flood using 127.0.0.1 for all requests behind proxy. ### Stable BOA-2.3.4 Release - Full Edition ### Date: Wed Oct 15 09:51:08 PDT 2014 ### Includes Aegir 2.1 with improvements Release Notes and changelog for BOA-2.3.4 has been merged into BOA-2.3.5 above after security upgrades related to OpenSSL and SSLv3 have been added shortly after 2.3.4 release. </pre><p> I'm going to run this update tonight. </p> Results http://localhost:8080/trac/ticket/798#changelog http://localhost:8080/trac/ticket/702 http://localhost:8080/trac/ticket/702 Fri, 21 Mar 2014 17:11:14 GMT ed <p> I can't remove the attachments from the Trustees page: <a class="ext-link" href="https://www.transitionnetwork.org/about/people/trustees"><span class="icon">​</span>https://www.transitionnetwork.org/about/people/trustees</a> </p> <p> please investigate and sort if you can. We need to remove all the attachments apart from those in 2013. </p> Results http://localhost:8080/trac/ticket/702#changelog http://localhost:8080/trac/ticket/548 http://localhost:8080/trac/ticket/548 Tue, 14 May 2013 07:50:15 GMT ed <p> Admins, editors, social reporters cannot create content on TN.org. Choosing to create content leads to homepage. Can't do anything on the admin menu. </p> <p> Emergency. </p> Results http://localhost:8080/trac/ticket/548#changelog http://localhost:8080/trac/ticket/888 http://localhost:8080/trac/ticket/888 Sun, 06 Dec 2015 12:25:49 GMT chris <p> It it intentional or accidental that adverts from <a class="ext-link" href="https://secureads.bitbillions.com/"><span class="icon">​</span>https://secureads.bitbillions.com/</a> are being loaded on the front page of <a class="ext-link" href="https://www.transitionnetwork.org/"><span class="icon">​</span>https://www.transitionnetwork.org/</a> via the embedded content from flickrit.com? </p> Results http://localhost:8080/trac/ticket/888#changelog http://localhost:8080/trac/ticket/649 http://localhost:8080/trac/ticket/649 Thu, 12 Dec 2013 10:53:16 GMT ed <p> seen here: </p> <p> <a class="ext-link" href="https://www.transitionnetwork.org/admin/content/node-type/films"><span class="icon">​</span>https://www.transitionnetwork.org/admin/content/node-type/films</a> </p> <p> <a class="ext-link" href="https://www.transitionnetwork.org/films"><span class="icon">​</span>https://www.transitionnetwork.org/films</a> <a class="ext-link" href="https://www.transitionnetwork.org/films/occupy-love"><span class="icon">​</span>https://www.transitionnetwork.org/films/occupy-love</a> </p> Results http://localhost:8080/trac/ticket/649#changelog http://localhost:8080/trac/ticket/774 http://localhost:8080/trac/ticket/774 Wed, 06 Aug 2014 19:52:54 GMT paul <p> View online: <a class="ext-link" href="https://www.drupal.org/SA-CORE-2014-004"><span class="icon">​</span>https://www.drupal.org/SA-CORE-2014-004</a> </p> <ul><li>Advisory ID: DRUPAL-SA-CORE-2014-004 </li><li>Project: Drupal core <a class="missing changeset" title="No default repository defined">[1]</a> </li><li>Version: 6.x, 7.x </li><li>Date: 2014-August-06 </li><li>Security risk: 13/25 ( Moderately Critical) </li></ul><p> AC:None/A:None/CI:None/II:None/E:Proof/TD:100 <a class="missing changeset" title="No default repository defined">[2]</a> </p> <ul><li>Exploitable from: Remote </li><li>Vulnerability: Denial of service </li></ul><hr /> <hr /> <p> Drupal 6 and Drupal 7 include an XML-RPC endpoint which is publicly available (xmlrpc.php). The PHP XML parser used by this XML-RPC endpoint is vulnerable to an XML entity expansion attack and other related XML payload attacks which can cause CPU and memory exhaustion and the site's database to reach the maximum number of open connections. Any of these may lead to the site becoming unavailable or unresponsive (denial of service). </p> <p> All Drupal sites are vulnerable to this attack whether XML-RPC is used or not. </p> <p> In addition, a similar vulnerability exists in the core OpenID module (for sites that have this module enabled). </p> <p> This is a joint release as the XML-RPC vulnerability also affects <a class="wiki" href="http://localhost:8080/trac/wiki/WordPress">WordPress</a> (see the announcement <a class="missing changeset" title="No default repository defined">[3]</a>). </p> <hr /> <hr /> <ul><li>/A CVE identifier <a class="missing changeset" title="No default repository defined">[4]</a> will be requested, and added upon issuance, in </li></ul><p> accordance with Drupal Security Team processes./ </p> <hr /> <hr /> <ul><li>Drupal core 7.x versions prior to 7.31. </li><li>Drupal core 6.x versions prior to 6.33. </li></ul><hr /> <hr /> <p> Install the latest version: </p> <ul><li>If you use Drupal 7.x, upgrade to Drupal core 7.31 <a class="missing changeset" title="No default repository defined">[5]</a>. </li><li>If you use Drupal 6.x, upgrade to Drupal core 6.33 <a class="missing changeset" title="No default repository defined">[6]</a>. </li></ul><p> If you are unable to install the latest version of Drupal immediately, you can alternatively remove the xmlrpc.php file from the root of Drupal core (or add a rule to .htaccess to prevent access to xmlrpc.php) and disable the OpenID module. These steps are sufficient to mitigate the vulnerability in Drupal core if your site does not require the use of XML-RPC or OpenID functionality. However, this mitigation will not be effective if you are using a contributed module that exposes Drupal's XML-RPC API at a different URL (for example, the Services module); updating Drupal core is therefore strongly recommended. </p> <p> Also see the Drupal core <a class="missing changeset" title="No default repository defined">[7]</a> project page. </p> <hr /> <hr /> <ul><li>Willis Vandevanter <a class="missing changeset" title="No default repository defined">[8]</a> </li><li>Nir Goldshlager <a class="missing changeset" title="No default repository defined">[9]</a> </li></ul><hr /> <hr /> <ul><li>Andrew Nacin <a class="missing changeset" title="No default repository defined">[10]</a> of the <a class="wiki" href="http://localhost:8080/trac/wiki/WordPress">WordPress</a> Security Team </li><li>Michael Adams <a class="missing changeset" title="No default repository defined">[11]</a> of the <a class="wiki" href="http://localhost:8080/trac/wiki/WordPress">WordPress</a> Security Team </li><li>Frédéric Marand <a class="missing changeset" title="No default repository defined">[12]</a> </li><li>David Rothstein <a class="missing changeset" title="No default repository defined">[13]</a> of the Drupal Security Team </li><li>Damien Tournoud <a class="missing changeset" title="No default repository defined">[14]</a> of the Drupal Security Team </li><li>Greg Knaddison <a class="missing changeset" title="No default repository defined">[15]</a> of the Drupal Security Team </li><li>Stéphane Corlosquet <a class="missing changeset" title="No default repository defined">[16]</a> of the Drupal Security Team </li><li>Dave Reid <a class="missing changeset" title="No default repository defined">[17]</a> of the Drupal Security Team </li></ul><hr /> <hr /> <ul><li>The Drupal Security Team <a class="missing changeset" title="No default repository defined">[18]</a> and the <a class="wiki" href="http://localhost:8080/trac/wiki/WordPress">WordPress</a> <a class="missing changeset" title="No default repository defined">[19]</a> Security Team </li></ul><hr /> <hr /> <p> The Drupal security team can be reached at security at drupal.org or via the contact form at <a class="ext-link" href="http://drupal.org/contact"><span class="icon">​</span>http://drupal.org/contact</a> <a class="missing changeset" title="No default repository defined">[20]</a>. </p> <p> Learn more about the Drupal Security team and their policies <a class="missing changeset" title="No default repository defined">[21]</a>, writing secure code for Drupal <a class="missing changeset" title="No default repository defined">[22]</a>, and securing your site <a class="missing changeset" title="No default repository defined">[23]</a>. </p> <p> <a class="missing changeset" title="No default repository defined">[1]</a> <a class="ext-link" href="http://drupal.org/project/drupal"><span class="icon">​</span>http://drupal.org/project/drupal</a> <a class="missing changeset" title="No default repository defined">[2]</a> <a class="ext-link" href="http://drupal.org/security-team/risk-levels"><span class="icon">​</span>http://drupal.org/security-team/risk-levels</a> <a class="missing changeset" title="No default repository defined">[3]</a> <a class="ext-link" href="https://wordpress.org/news/2014/08/wordpress-3-9-2/"><span class="icon">​</span>https://wordpress.org/news/2014/08/wordpress-3-9-2/</a> <a class="missing changeset" title="No default repository defined">[4]</a> <a class="ext-link" href="http://cve.mitre.org/"><span class="icon">​</span>http://cve.mitre.org/</a> <a class="missing changeset" title="No default repository defined">[5]</a> <a class="ext-link" href="http://drupal.org/drupal-7.31-release-notes"><span class="icon">​</span>http://drupal.org/drupal-7.31-release-notes</a> <a class="missing changeset" title="No default repository defined">[6]</a> <a class="ext-link" href="http://drupal.org/drupal-6.33-release-notes"><span class="icon">​</span>http://drupal.org/drupal-6.33-release-notes</a> <a class="missing changeset" title="No default repository defined">[7]</a> <a class="ext-link" href="http://drupal.org/project/drupal"><span class="icon">​</span>http://drupal.org/project/drupal</a> <a class="missing changeset" title="No default repository defined">[8]</a> <a class="ext-link" href="https://www.drupal.org/user/1867894"><span class="icon">​</span>https://www.drupal.org/user/1867894</a> <a class="missing changeset" title="No default repository defined">[9]</a> <a class="ext-link" href="https://www.drupal.org/user/2891345"><span class="icon">​</span>https://www.drupal.org/user/2891345</a> <a class="missing changeset" title="No default repository defined">[10]</a> <a class="ext-link" href="http://profiles.wordpress.org/nacin"><span class="icon">​</span>http://profiles.wordpress.org/nacin</a> <a class="missing changeset" title="No default repository defined">[11]</a> <a class="ext-link" href="http://profiles.wordpress.org/mdawaffe"><span class="icon">​</span>http://profiles.wordpress.org/mdawaffe</a> <a class="missing changeset" title="No default repository defined">[12]</a> <a class="ext-link" href="https://www.drupal.org/user/27985"><span class="icon">​</span>https://www.drupal.org/user/27985</a> <a class="missing changeset" title="No default repository defined">[13]</a> <a class="ext-link" href="https://www.drupal.org/user/124982"><span class="icon">​</span>https://www.drupal.org/user/124982</a> <a class="missing changeset" title="No default repository defined">[14]</a> <a class="ext-link" href="https://www.drupal.org/user/22211"><span class="icon">​</span>https://www.drupal.org/user/22211</a> <a class="missing changeset" title="No default repository defined">[15]</a> <a class="ext-link" href="https://www.drupal.org/u/greggles"><span class="icon">​</span>https://www.drupal.org/u/greggles</a> <a class="missing changeset" title="No default repository defined">[16]</a> <a class="ext-link" href="https://www.drupal.org/user/52142"><span class="icon">​</span>https://www.drupal.org/user/52142</a> <a class="missing changeset" title="No default repository defined">[17]</a> <a class="ext-link" href="https://www.drupal.org/user/53892"><span class="icon">​</span>https://www.drupal.org/user/53892</a> <a class="missing changeset" title="No default repository defined">[18]</a> <a class="ext-link" href="http://drupal.org/security-team"><span class="icon">​</span>http://drupal.org/security-team</a> <a class="missing changeset" title="No default repository defined">[19]</a> <a class="ext-link" href="http://wordpress.org"><span class="icon">​</span>http://wordpress.org</a> <a class="missing changeset" title="No default repository defined">[20]</a> <a class="ext-link" href="http://drupal.org/contact"><span class="icon">​</span>http://drupal.org/contact</a> <a class="missing changeset" title="No default repository defined">[21]</a> <a class="ext-link" href="http://drupal.org/security-team"><span class="icon">​</span>http://drupal.org/security-team</a> <a class="missing changeset" title="No default repository defined">[22]</a> <a class="ext-link" href="http://drupal.org/writing-secure-code"><span class="icon">​</span>http://drupal.org/writing-secure-code</a> <a class="missing changeset" title="No default repository defined">[23]</a> <a class="ext-link" href="http://drupal.org/security/secure-configuration"><span class="icon">​</span>http://drupal.org/security/secure-configuration</a> </p> <p> <span class="underline"></span><span class="underline"></span><span class="underline"></span><span class="underline"></span><span class="underline"></span><span class="underline"></span><span class="underline"></span><span class="underline"></span><span class="underline"></span><span class="underline"></span><span class="underline"></span><span class="underline">_ Security-news mailing list Security-news@… Unsubscribe at <a class="ext-link" href="https://lists.drupal.org/mailman/listinfo/security-news"><span class="icon">​</span>https://lists.drupal.org/mailman/listinfo/security-news</a> </span></p> Results http://localhost:8080/trac/ticket/774#changelog http://localhost:8080/trac/ticket/627 http://localhost:8080/trac/ticket/627 Wed, 20 Nov 2013 16:08:43 GMT ed <p> Can users delete their own accounts? I've looked at user settings and can't find any clues? Can you point me to a user account setting which would enable them to delete their own accounts (and their profiles by proxy)? </p> Results http://localhost:8080/trac/ticket/627#changelog http://localhost:8080/trac/ticket/570 http://localhost:8080/trac/ticket/570 Tue, 09 Jul 2013 13:19:57 GMT ed <p> Notification for blog post does not include full URL. </p> <p> URL in notification is: </p> <blockquote> <p> <a class="ext-link" href="http://www.transitionnetwork.org/blogs/rob-hopkins/2013-07/transition-th"><span class="icon">​</span>http://www.transitionnetwork.org/blogs/rob-hopkins/2013-07/transition-th</a>... </p> </blockquote> <p> URL should be: <a class="ext-link" href="http://www.transitionnetwork.org/blogs/rob-hopkins/2013-07/transition-thursdays-three-down-three-go"><span class="icon">​</span>http://www.transitionnetwork.org/blogs/rob-hopkins/2013-07/transition-thursdays-three-down-three-go</a> </p> Results http://localhost:8080/trac/ticket/570#changelog http://localhost:8080/trac/ticket/634 http://localhost:8080/trac/ticket/634 Wed, 27 Nov 2013 11:50:23 GMT ed <p> I couldn't embed a 'paper.li' embed into a page recently and forgot about it. Now I can't embed a slideshare embed either adn wonder if I am seeing a pattern. </p> <p> Please look and advise: <a class="ext-link" href="https://www.transitionnetwork.org/blogs/ed-mitchell/2013-11/web-strategy-update"><span class="icon">​</span>https://www.transitionnetwork.org/blogs/ed-mitchell/2013-11/web-strategy-update</a> </p> Results http://localhost:8080/trac/ticket/634#changelog http://localhost:8080/trac/ticket/623 http://localhost:8080/trac/ticket/623 Mon, 18 Nov 2013 17:21:46 GMT ed <p> do we keep any revisions of content? we had this conversation years ago, it came up in a recent social reporters webinar, I can't see any evidence of revisions activity... </p> Results http://localhost:8080/trac/ticket/623#changelog http://localhost:8080/trac/ticket/680 http://localhost:8080/trac/ticket/680 Mon, 20 Jan 2014 12:28:18 GMT chris <p> The <a class="ext-link" href="https://www.transitionnetwork.org/"><span class="icon">​</span>front page of the site</a> contains the following elements using HTTP when accessing the site using HTTPS: </p> <pre class="wiki"> &lt;div class="views-field-field-slide-image-fid"&gt; &lt;span class="field-content"&gt;&lt;img src="http://www.transitionnetwork.org/sites/www.transitionnetwork.org/files/imagecache/slideshow_660/images/slides/capture1.jpg" alt="" title="" width="700" height="306" class="imagecache imagecache-slideshow_660 imagecache-default imagecache-slideshow_660_default"/&gt;&lt;/span&gt; &lt;/div&gt; </pre><pre class="wiki"> &lt;div class="views-field-field-slide-destination-link-url"&gt; &lt;span class="field-content"&gt;&lt;a href="http://www.transitionnetwork.org/about" 0="a:0:{}" class="learn"&gt;Learn more about Transition Network »&lt;/a&gt;&lt;/span&gt; &lt;/div&gt; </pre><pre class="wiki"> &lt;div class="views-field-field-slide-image-fid"&gt; &lt;span class="field-content"&gt;&lt;img src="http://www.transitionnetwork.org/sites/www.transitionnetwork.org/files/imagecache/slideshow_660/images/slides/clay.jpg" alt="" title="" width="700" height="306" class="imagecache imagecache-slideshow_660 imagecache-default imagecache-slideshow_660_default"/&gt;&lt;/span&gt; &lt;/div&gt; </pre><pre class="wiki"> &lt;div class="views-field-field-slide-destination-link-url"&gt; &lt;span class="field-content"&gt;&lt;a href="http://www.transitionnetwork.org/blogs/rob-hopkins/2014-01/can-earth-building-scale-mainstream-1-clayworks-and-clay-plasters" 0="a:0:{}" class="learn"&gt;Read more here »&lt;/a&gt;&lt;/span&gt; &lt;/div&gt; </pre><pre class="wiki"> &lt;div class="views-field-field-slide-image-fid"&gt; &lt;span class="field-content"&gt;&lt;img src="http://www.transitionnetwork.org/sites/www.transitionnetwork.org/files/imagecache/slideshow_660/images/slides/frack3.jpg" alt="" title="" width="700" height="306" class="imagecache imagecache-slideshow_660 imagecache-default imagecache-slideshow_660_default"/&gt;&lt;/span&gt; &lt;/div&gt; </pre><pre class="wiki"> &lt;div class="views-field-field-slide-destination-link-url"&gt; &lt;span class="field-content"&gt;&lt;a href="http://www.transitionnetwork.org/blogs/rob-hopkins/2014-01/6-reasons-why-theres-no-community-fracking" 0="a:0:{}" class="learn"&gt;Read more here »&lt;/a&gt;&lt;/span&gt; &lt;/div&gt; </pre><pre class="wiki"> &lt;div class="views-field-field-slide-image-fid"&gt; &lt;span class="field-content"&gt;&lt;img src="http://www.transitionnetwork.org/sites/www.transitionnetwork.org/files/imagecache/slideshow_660/images/slides/pc1.jpg" alt="" title="" width="700" height="306" class="imagecache imagecache-slideshow_660 imagecache-default imagecache-slideshow_660_default"/&gt;&lt;/span&gt; &lt;/div&gt; </pre><pre class="wiki"> &lt;div class="views-field-field-featured-image-fid"&gt; &lt;span class="field-content"&gt;&lt;a href="/news/2013-12-17/november-and-december-round-what-s-happening-out-world-transition" class="imagecache imagecache-featured_image_thumb imagecache-linked imagecache-featured_image_thumb_linked"&gt;&lt;img src="http://www.transitionnetwork.org/sites/www.transitionnetwork.org/files/imagecache/featured_image_thumb/chilesml.jpg" alt="Chile Transition Training" title="Chile Transition Training" width="150" height="101" class="imagecache imagecache-featured_image_thumb"/&gt;&lt;/a&gt;&lt;/span&gt; &lt;/div&gt; </pre><p> Would it be possible to embed content from the site using URLS like <tt>/sites/www.transitionnetwork.org/files/imagecache/featured_image_thumb/chilesml.jpg</tt> rather than <tt>http://www.transitionnetwork.org/sites/www.transitionnetwork.org/files/imagecache/featured_image_thumb/chilesml.jpg</tt> ? </p> <p> Changing these links would result in the mixed content warnings in browsers going away. </p> <p> By default Firefox doesn't block HTTP content over HTTPS connections, however you can enable this by entering <tt>about:config</tt> in the URL bar are searching for <tt>mixed_content</tt> and then changing <tt>security.mixed_content.block_display_content</tt> to <strong>true</strong> if you want to see how the site looks when only secure content is loaded. </p> <p> I have checked that the site does set the <strong>secure</strong> flag on the authentication cookie, so the mixed content shouldn't result in the authentication cookie being sent with unencrypted requests. </p> <p> Further information: </p> <ul><li><a class="ext-link" href="https://blog.mozilla.org/tanvi/2013/04/10/mixed-content-blocking-enabled-in-firefox-23"><span class="icon">​</span>https://blog.mozilla.org/tanvi/2013/04/10/mixed-content-blocking-enabled-in-firefox-23</a> </li></ul> Results http://localhost:8080/trac/ticket/680#changelog http://localhost:8080/trac/ticket/605 http://localhost:8080/trac/ticket/605 Thu, 03 Oct 2013 13:35:17 GMT ed <p> I use this view when I need to find subscriptions for users who are receiving email alerts to old accounts: <a class="ext-link" href="https://www.transitionnetwork.org/admin/messaging/subscriptions"><span class="icon">​</span>https://www.transitionnetwork.org/admin/messaging/subscriptions</a> </p> <p> I am finding that if a user changes their email address in their user account, it does not update that email address in the subscriptions settings, so they continue to receive alerts to their old address. So I go to this view, dig out the incorrect sub, and kill it. </p> <p> Which is a PITA. </p> <p> Can we make it possible to make the 'users' column clickable so I could re-order it alphabetically? That would be really cool. </p> Results http://localhost:8080/trac/ticket/605#changelog http://localhost:8080/trac/ticket/616 http://localhost:8080/trac/ticket/616 Mon, 11 Nov 2013 09:56:14 GMT ed <p> Initiatives Map not showing on http </p> <p> here error message: This web site needs a different Google Maps API key. A new key can be generated at <a class="ext-link" href="http://code.google.com/apis/maps/documentation/javascript/v2/introduction.html#Obtaining_Key"><span class="icon">​</span>http://code.google.com/apis/maps/documentation/javascript/v2/introduction.html#Obtaining_Key</a>. </p> <p> is this related to <a class="closed ticket" href="http://localhost:8080/trac/ticket/615" title="task: Move to GMap 6.x-2.x-dev as and get clusterer to work (closed: fixed)">#615</a>? </p> Results http://localhost:8080/trac/ticket/616#changelog http://localhost:8080/trac/ticket/578 http://localhost:8080/trac/ticket/578 Mon, 12 Aug 2013 13:33:58 GMT ed <p> Can we set the email alerts to auto-subscribe users to comments threads that they have made comments on? ie I make a comment to blog post x, then I get email alerts of the new comments made to blog post x. </p> Results http://localhost:8080/trac/ticket/578#changelog