http://localhost:8080/trac/query?status=!closed&priority=major&desc=1&order=summary Support and issues tracking for the Transition Network Web Project. en-US /trac/chrome/site/TransitionNetwork-Logo-Web-Small.jpg http://localhost:8080/trac/query?status=!closed&priority=major&desc=1&order=summary Trac 0.12.5 http://localhost:8080/trac/ticket/767 http://localhost:8080/trac/ticket/767 Thu, 31 Jul 2014 11:07:39 GMT sam <p> Hi Paul </p> <p> Could you fix the robots.txt here: </p> <p> <a class="ext-link" href="https://booker-stage-20140501.transitionnetwork.org/robots.txt"><span class="icon">​</span>https://booker-stage-20140501.transitionnetwork.org/robots.txt</a> </p> <p> Ta </p> <p> Sam </p> Results http://localhost:8080/trac/ticket/767#changelog http://localhost:8080/trac/ticket/918 http://localhost:8080/trac/ticket/918 Thu, 14 Jul 2016 12:33:42 GMT sam <p> Hi Chris </p> <p> All going well I think we're going to move the TN.org site to Hetzner later today. </p> <p> I was just having a look through the zone file on Gandi. There's an entry: </p> <p> 'redirects A 81.95.52.111' </p> <p> Do you know what that one does? </p> <p> Thanks </p> <p> Sam </p> Results http://localhost:8080/trac/ticket/918#changelog http://localhost:8080/trac/ticket/792 http://localhost:8080/trac/ticket/792 Mon, 29 Sep 2014 09:28:08 GMT paul <p> View online: <a class="ext-link" href="https://www.drupal.org/node/2344369"><span class="icon">​</span>https://www.drupal.org/node/2344369</a> </p> <ul><li>Advisory ID: DRUPAL-SA-CONTRIB-2014-094 </li><li>Project: Webform Patched <a class="missing changeset" title="No default repository defined">[1]</a> (third-party module) </li><li>Version: 6.x, 7.x </li><li>Date: 2014-September-24 </li><li>Security risk: 13/25 ( Moderately Critical) </li></ul><p> AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Default <a class="missing changeset" title="No default repository defined">[2]</a> </p> <ul><li>Vulnerability: Cross Site Scripting </li></ul><hr /> <hr /> <p> The Webform Patched module is a fork of the Webform module with Token support added. The module enables you to create forms which can be used for surveys, contact forms or other data collection throughout your site. </p> <p> The module doesn't sufficiently sanitize field label titles when two fields have the same form_key, which can only be managed by carefully crafting the webform structure via a specific set of circumstances. </p> <p> This vulnerability is mitigated by the fact that an attacker must have a role with the permission "create webform content". </p> <hr /> <hr /> <ul><li>/A CVE identifier <a class="missing changeset" title="No default repository defined">[3]</a> will be requested, and added upon issuance, in </li></ul><p> accordance with Drupal Security Team processes./ </p> <hr /> <hr /> <ul><li>Webform Patched 6.x-3.x versions prior to 6.x-3.20. </li><li>Webform Patched 7.x-3.x versions prior to 7.x-3.20. </li></ul><p> Drupal core is not affected. If you do not use the contributed Webform Patched <a class="missing changeset" title="No default repository defined">[4]</a> module, there is nothing you need to do. </p> <hr /> <hr /> <p> Install the latest version: </p> <ul><li>If you use the webform module for Drupal 6.x, upgrade to webform_patched </li></ul><p> 6.x-3.20 <a class="missing changeset" title="No default repository defined">[5]</a> </p> <ul><li>If you use the webform module for Drupal 7.x-3.x, upgrade to </li></ul><p> webform_patched 7.x-3.20 <a class="missing changeset" title="No default repository defined">[6]</a> </p> <p> Also see the Webform Patched <a class="missing changeset" title="No default repository defined">[7]</a> project page. </p> <hr /> <hr /> <ul><li>Maurits Lawende <a class="missing changeset" title="No default repository defined">[8]</a> </li><li>Matt Vance <a class="missing changeset" title="No default repository defined">[9]</a> </li></ul><hr /> <hr /> <ul><li>Nate Haug <a class="missing changeset" title="No default repository defined">[10]</a> the module maintainer </li></ul><hr /> <hr /> <ul><li>Greg Knaddison <a class="missing changeset" title="No default repository defined">[11]</a>, Dan Smith <a class="missing changeset" title="No default repository defined">[12]</a> and Lee Rowlands <a class="missing changeset" title="No default repository defined">[13]</a> of the Drupal </li></ul><p> Security Team </p> <hr /> <hr /> <p> The Drupal security team can be reached at security at drupal.org or via the contact form at <a class="ext-link" href="https://www.drupal.org/contact"><span class="icon">​</span>https://www.drupal.org/contact</a> <a class="missing changeset" title="No default repository defined">[14]</a>. </p> <p> Learn more about the Drupal Security team and their policies <a class="missing changeset" title="No default repository defined">[15]</a>, writing secure code for Drupal <a class="missing changeset" title="No default repository defined">[16]</a>, and securing your site <a class="missing changeset" title="No default repository defined">[17]</a>. </p> <p> <a class="missing changeset" title="No default repository defined">[1]</a> <a class="ext-link" href="https://www.drupal.org/project/webform_patched"><span class="icon">​</span>https://www.drupal.org/project/webform_patched</a> <a class="missing changeset" title="No default repository defined">[2]</a> <a class="ext-link" href="https://www.drupal.org/security-team/risk-levels"><span class="icon">​</span>https://www.drupal.org/security-team/risk-levels</a> <a class="missing changeset" title="No default repository defined">[3]</a> <a class="ext-link" href="http://cve.mitre.org/"><span class="icon">​</span>http://cve.mitre.org/</a> <a class="missing changeset" title="No default repository defined">[4]</a> <a class="ext-link" href="https://www.drupal.org/project/webform_patched"><span class="icon">​</span>https://www.drupal.org/project/webform_patched</a> <a class="missing changeset" title="No default repository defined">[5]</a> <a class="ext-link" href="http://drupal.org/node/2241675"><span class="icon">​</span>http://drupal.org/node/2241675</a> <a class="missing changeset" title="No default repository defined">[6]</a> <a class="ext-link" href="http://drupal.org/node/2241685"><span class="icon">​</span>http://drupal.org/node/2241685</a> <a class="missing changeset" title="No default repository defined">[7]</a> <a class="ext-link" href="https://www.drupal.org/project/webform_patched"><span class="icon">​</span>https://www.drupal.org/project/webform_patched</a> <a class="missing changeset" title="No default repository defined">[8]</a> <a class="ext-link" href="http://drupal.org/user/243897"><span class="icon">​</span>http://drupal.org/user/243897</a> <a class="missing changeset" title="No default repository defined">[9]</a> <a class="ext-link" href="https://www.drupal.org/user/10269"><span class="icon">​</span>https://www.drupal.org/user/10269</a> <a class="missing changeset" title="No default repository defined">[10]</a> <a class="ext-link" href="http://drupal.org/user/35821"><span class="icon">​</span>http://drupal.org/user/35821</a> <a class="missing changeset" title="No default repository defined">[11]</a> <a class="ext-link" href="http://drupal.org/user/36762"><span class="icon">​</span>http://drupal.org/user/36762</a> <a class="missing changeset" title="No default repository defined">[12]</a> <a class="ext-link" href="http://drupal.org/user/241220"><span class="icon">​</span>http://drupal.org/user/241220</a> <a class="missing changeset" title="No default repository defined">[13]</a> <a class="ext-link" href="https://drupal.org/user/395439"><span class="icon">​</span>https://drupal.org/user/395439</a> <a class="missing changeset" title="No default repository defined">[14]</a> <a class="ext-link" href="https://www.drupal.org/contact"><span class="icon">​</span>https://www.drupal.org/contact</a> <a class="missing changeset" title="No default repository defined">[15]</a> <a class="ext-link" href="https://www.drupal.org/security-team"><span class="icon">​</span>https://www.drupal.org/security-team</a> <a class="missing changeset" title="No default repository defined">[16]</a> <a class="ext-link" href="https://www.drupal.org/writing-secure-code"><span class="icon">​</span>https://www.drupal.org/writing-secure-code</a> <a class="missing changeset" title="No default repository defined">[17]</a> <a class="ext-link" href="https://www.drupal.org/security/secure-configuration"><span class="icon">​</span>https://www.drupal.org/security/secure-configuration</a> </p> Results http://localhost:8080/trac/ticket/792#changelog http://localhost:8080/trac/ticket/759 http://localhost:8080/trac/ticket/759 Wed, 16 Jul 2014 21:59:46 GMT paul <p> View online: <a class="ext-link" href="https://www.drupal.org/node/2304561"><span class="icon">​</span>https://www.drupal.org/node/2304561</a> </p> <ul><li>Advisory ID: DRUPAL-SA-CONTRIB-2014-071 </li><li>Project: <a class="missing wiki">FileField?</a> <a class="missing changeset" title="No default repository defined">[1]</a> (third-party module) </li><li>Version: 6.x </li><li>Date: 2014-July-16 </li><li>Security risk: Critical <a class="missing changeset" title="No default repository defined">[2]</a> </li><li>Exploitable from: Remote </li><li>Vulnerability: Access bypass </li></ul><hr /> <hr /> <p> The <a class="missing wiki">FileField?</a> module enables you to define and use fields that contain files. </p> <p> The module doesn't sufficiently check permission to view the attached file when attaching a file that was previously uploaded. This could allow attackers to gain access to private files. </p> <p> This vulnerability is mitigated by the fact that the attacker must have permission to create or edit content with a file field. </p> <hr /> <hr /> <ul><li>/A CVE identifier <a class="missing changeset" title="No default repository defined">[3]</a> will be requested, and added upon issuance, in </li></ul><p> accordance with Drupal Security Team processes./ </p> <hr /> <hr /> <ul><li><a class="missing wiki">FileField?</a> 6.x-3.x versions prior to 6.x-3.13. </li></ul><p> Drupal core is not affected. If you do not use the contributed <a class="missing wiki">FileField?</a> <a class="missing changeset" title="No default repository defined">[4]</a> module, there is nothing you need to do. </p> <hr /> <hr /> <ul><li>If you use the <a class="missing wiki">FileField?</a> module for Drupal 6.x, upgrade to Filefield </li></ul><p> 6.x-3.13 <a class="missing changeset" title="No default repository defined">[5]</a>, and also update to Drupal core 6.32 <a class="missing changeset" title="No default repository defined">[6]</a> (see SA-CORE-2014-003 <a class="missing changeset" title="No default repository defined">[7]</a>). </p> <hr /> <hr /> <ul><li>Ivan Ch <a class="missing changeset" title="No default repository defined">[8]</a> </li></ul><hr /> <hr /> <ul><li>Nate Haug <a class="missing changeset" title="No default repository defined">[9]</a> </li><li>Ivan Ch <a class="missing changeset" title="No default repository defined">[10]</a> </li><li>David Snopek <a class="missing changeset" title="No default repository defined">[11]</a> of the Drupal Security Team. </li></ul><hr /> <hr /> <p> The Drupal security team can be reached at security at drupal.org or via the contact form at <a class="ext-link" href="http://drupal.org/contact"><span class="icon">​</span>http://drupal.org/contact</a> <a class="missing changeset" title="No default repository defined">[12]</a>. </p> <p> Learn more about the Drupal Security team and their policies <a class="missing changeset" title="No default repository defined">[13]</a>, writing secure code for Drupal <a class="missing changeset" title="No default repository defined">[14]</a>, and securing your site <a class="missing changeset" title="No default repository defined">[15]</a>. </p> <p> Follow the Drupal Security Team on Twitter at <a class="ext-link" href="https://twitter.com/drupalsecurity"><span class="icon">​</span>https://twitter.com/drupalsecurity</a> <a class="missing changeset" title="No default repository defined">[16]</a> </p> <p> <a class="missing changeset" title="No default repository defined">[1]</a> <a class="ext-link" href="https://www.drupal.org/project/filefield"><span class="icon">​</span>https://www.drupal.org/project/filefield</a> <a class="missing changeset" title="No default repository defined">[2]</a> <a class="ext-link" href="http://drupal.org/security-team/risk-levels"><span class="icon">​</span>http://drupal.org/security-team/risk-levels</a> <a class="missing changeset" title="No default repository defined">[3]</a> <a class="ext-link" href="http://cve.mitre.org/"><span class="icon">​</span>http://cve.mitre.org/</a> <a class="missing changeset" title="No default repository defined">[4]</a> <a class="ext-link" href="http://drupal.org/project/filefield"><span class="icon">​</span>http://drupal.org/project/filefield</a> <a class="missing changeset" title="No default repository defined">[5]</a> <a class="ext-link" href="https://www.drupal.org/node/2304517"><span class="icon">​</span>https://www.drupal.org/node/2304517</a> <a class="missing changeset" title="No default repository defined">[6]</a> <a class="ext-link" href="https://www.drupal.org/drupal-6.32-release-notes"><span class="icon">​</span>https://www.drupal.org/drupal-6.32-release-notes</a> <a class="missing changeset" title="No default repository defined">[7]</a> <a class="ext-link" href="https://www.drupal.org/SA-CORE-2014-003"><span class="icon">​</span>https://www.drupal.org/SA-CORE-2014-003</a> <a class="missing changeset" title="No default repository defined">[8]</a> <a class="ext-link" href="https://www.drupal.org/user/556138"><span class="icon">​</span>https://www.drupal.org/user/556138</a> <a class="missing changeset" title="No default repository defined">[9]</a> <a class="ext-link" href="https://www.drupal.org/user/35821"><span class="icon">​</span>https://www.drupal.org/user/35821</a> <a class="missing changeset" title="No default repository defined">[10]</a> <a class="ext-link" href="https://www.drupal.org/user/556138"><span class="icon">​</span>https://www.drupal.org/user/556138</a> <a class="missing changeset" title="No default repository defined">[11]</a> <a class="ext-link" href="https://www.drupal.org/user/266527"><span class="icon">​</span>https://www.drupal.org/user/266527</a> <a class="missing changeset" title="No default repository defined">[12]</a> <a class="ext-link" href="http://drupal.org/contact"><span class="icon">​</span>http://drupal.org/contact</a> <a class="missing changeset" title="No default repository defined">[13]</a> <a class="ext-link" href="http://drupal.org/security-team"><span class="icon">​</span>http://drupal.org/security-team</a> <a class="missing changeset" title="No default repository defined">[14]</a> <a class="ext-link" href="http://drupal.org/writing-secure-code"><span class="icon">​</span>http://drupal.org/writing-secure-code</a> <a class="missing changeset" title="No default repository defined">[15]</a> <a class="ext-link" href="http://drupal.org/security/secure-configuration"><span class="icon">​</span>http://drupal.org/security/secure-configuration</a> <a class="missing changeset" title="No default repository defined">[16]</a> <a class="ext-link" href="https://twitter.com/drupalsecurity"><span class="icon">​</span>https://twitter.com/drupalsecurity</a> </p> <p> <span class="underline"></span><span class="underline"></span><span class="underline"></span><span class="underline"></span><span class="underline"></span><span class="underline"></span><span class="underline"></span><span class="underline"></span><span class="underline"></span><span class="underline"></span><span class="underline"></span><span class="underline">_ Security-news mailing list Security-news@… Unsubscribe at <a class="ext-link" href="https://lists.drupal.org/mailman/listinfo/security-news"><span class="icon">​</span>https://lists.drupal.org/mailman/listinfo/security-news</a> </span></p> Results http://localhost:8080/trac/ticket/759#changelog http://localhost:8080/trac/ticket/809 http://localhost:8080/trac/ticket/809 Wed, 19 Nov 2014 21:35:25 GMT paul <p> View online: <a class="ext-link" href="https://www.drupal.org/SA-CORE-2014-006"><span class="icon">​</span>https://www.drupal.org/SA-CORE-2014-006</a> </p> <ul><li>Advisory ID: DRUPAL-SA-CORE-2014-006 </li><li>Project: Drupal core <a class="missing changeset" title="No default repository defined">[1]</a> </li><li>Version: 6.x, 7.x </li><li>Date: 2014-November-19 </li><li>Security risk: 14/25 ( Moderately Critical) AC:Basic/A:None/CI:Some/II:Some/E:Theoretical/TD:Uncommon <a class="missing changeset" title="No default repository defined">[2]</a> </li><li>Vulnerability: Multiple vulnerabilities </li></ul><hr /> <hr /> <p> .... Session hijacking (Drupal 6 and 7) </p> <p> A specially crafted request can give a user access to another user's session, allowing an attacker to hijack a random session. </p> <p> This attack is known to be possible on certain Drupal 7 sites which serve both HTTP and HTTPS content ("mixed-mode" <a class="missing changeset" title="No default repository defined">[3]</a>), but it is possible there are other attack vectors for both Drupal 6 and Drupal 7. </p> <p> .... Denial of service (Drupal 7 only) </p> <p> Drupal 7 includes a password hashing API to ensure that user supplied passwords are not stored in plain text. </p> <p> A vulnerability in this API allows an attacker to send specially crafted requests resulting in CPU and memory exhaustion. This may lead to the site becoming unavailable or unresponsive (denial of service). </p> <p> This vulnerability can be exploited by anonymous users. </p> <hr /> <hr /> <ul><li>/A CVE identifier <a class="missing changeset" title="No default repository defined">[4]</a> will be requested, and added upon issuance, in accordance </li></ul><blockquote> <blockquote> <p> with Drupal Security Team processes./ </p> </blockquote> </blockquote> <hr /> <hr /> <ul><li>Drupal core 6.x versions prior to 6.34. </li><li>Drupal core 7.x versions prior to 7.34. </li></ul><hr /> <hr /> <p> Install the latest version: </p> <ul><li>If you use Drupal 6.x, upgrade to Drupal core 6.34. <a class="missing changeset" title="No default repository defined">[5]</a> </li><li>If you use Drupal 7.x, upgrade to Drupal core 7.34. <a class="missing changeset" title="No default repository defined">[6]</a> </li></ul><p> If you have configured a custom password.inc file for your Drupal 7 site you also need to make sure that it is not prone to the same denial of service vulnerability. See also the similar security advisory for the Drupal 6 contributed Secure Password Hashes module: SA-CONTRIB-2014-113 <a class="missing changeset" title="No default repository defined">[7]</a> </p> <p> Also see the Drupal core <a class="missing changeset" title="No default repository defined">[8]</a> project page. </p> <hr /> <hr /> <p> Session hijacking: </p> <ul><li>Aaron Averill <a class="missing changeset" title="No default repository defined">[9]</a> </li></ul><p> Denial of service: </p> <ul><li>Michael Cullum <a class="missing changeset" title="No default repository defined">[10]</a> </li><li>Javier Nieto <a class="missing changeset" title="No default repository defined">[11]</a> </li><li>Andrés Rojas Guerrero <a class="missing changeset" title="No default repository defined">[12]</a> </li></ul><hr /> <hr /> <p> Session hijacking: </p> <ul><li>Klaus Purer <a class="missing changeset" title="No default repository defined">[13]</a> of the Drupal Security Team </li><li>David Rothstein <a class="missing changeset" title="No default repository defined">[14]</a> of the Drupal Security Team </li><li>Peter Wolanin <a class="missing changeset" title="No default repository defined">[15]</a> of the Drupal Security Team </li></ul><p> Denial of service: </p> <ul><li>Klaus Purer <a class="missing changeset" title="No default repository defined">[16]</a> of the Drupal Security Team </li><li>Peter Wolanin <a class="missing changeset" title="No default repository defined">[17]</a> of the Drupal Security Team </li><li>Heine Deelstra <a class="missing changeset" title="No default repository defined">[18]</a> of the Drupal Security Team </li><li>Tom Phethean <a class="missing changeset" title="No default repository defined">[19]</a> </li></ul><hr /> <hr /> <ul><li>The Drupal Security Team </li></ul><hr /> <hr /> <p> The Drupal security team can be reached at security at drupal.org or via the contact form at <a class="ext-link" href="https://www.drupal.org/contact"><span class="icon">​</span>https://www.drupal.org/contact</a> <a class="missing changeset" title="No default repository defined">[20]</a>. </p> <p> Learn more about the Drupal Security team and their policies <a class="missing changeset" title="No default repository defined">[21]</a>, writing secure code for Drupal <a class="missing changeset" title="No default repository defined">[22]</a>, and securing your site <a class="missing changeset" title="No default repository defined">[23]</a>. </p> <p> Follow the Drupal Security Team on Twitter at <a class="ext-link" href="https://twitter.com/drupalsecurity"><span class="icon">​</span>https://twitter.com/drupalsecurity</a> <a class="missing changeset" title="No default repository defined">[24]</a> </p> <p> <a class="missing changeset" title="No default repository defined">[1]</a> <a class="ext-link" href="https://www.drupal.org/project/drupal"><span class="icon">​</span>https://www.drupal.org/project/drupal</a> <a class="missing changeset" title="No default repository defined">[2]</a> <a class="ext-link" href="https://www.drupal.org/security-team/risk-levels"><span class="icon">​</span>https://www.drupal.org/security-team/risk-levels</a> <a class="missing changeset" title="No default repository defined">[3]</a> <a class="ext-link" href="https://www.drupal.org/https-information"><span class="icon">​</span>https://www.drupal.org/https-information</a> <a class="missing changeset" title="No default repository defined">[4]</a> <a class="ext-link" href="http://cve.mitre.org/"><span class="icon">​</span>http://cve.mitre.org/</a> <a class="missing changeset" title="No default repository defined">[5]</a> <a class="ext-link" href="https://www.drupal.org/drupal-6.34-release-notes"><span class="icon">​</span>https://www.drupal.org/drupal-6.34-release-notes</a> <a class="missing changeset" title="No default repository defined">[6]</a> <a class="ext-link" href="https://www.drupal.org/drupal-7.34-release-notes"><span class="icon">​</span>https://www.drupal.org/drupal-7.34-release-notes</a> <a class="missing changeset" title="No default repository defined">[7]</a> <a class="ext-link" href="https://www.drupal.org/node/2378367"><span class="icon">​</span>https://www.drupal.org/node/2378367</a> <a class="missing changeset" title="No default repository defined">[8]</a> <a class="ext-link" href="https://www.drupal.org/project/drupal"><span class="icon">​</span>https://www.drupal.org/project/drupal</a> <a class="missing changeset" title="No default repository defined">[9]</a> <a class="ext-link" href="https://www.drupal.org/user/1317732"><span class="icon">​</span>https://www.drupal.org/user/1317732</a> <a class="missing changeset" title="No default repository defined">[10]</a> <a class="ext-link" href="https://www.drupal.org/u/MichaelCu"><span class="icon">​</span>https://www.drupal.org/u/MichaelCu</a> <a class="missing changeset" title="No default repository defined">[11]</a> <a class="ext-link" href="https://www.drupal.org/u/jnietotn"><span class="icon">​</span>https://www.drupal.org/u/jnietotn</a> <a class="missing changeset" title="No default repository defined">[12]</a> <a class="ext-link" href="https://www.drupal.org/u/c0r3dump3d"><span class="icon">​</span>https://www.drupal.org/u/c0r3dump3d</a> <a class="missing changeset" title="No default repository defined">[13]</a> <a class="ext-link" href="https://www.drupal.org/u/klausi"><span class="icon">​</span>https://www.drupal.org/u/klausi</a> <a class="missing changeset" title="No default repository defined">[14]</a> <a class="ext-link" href="https://www.drupal.org/u/David_Rothstein"><span class="icon">​</span>https://www.drupal.org/u/David_Rothstein</a> <a class="missing changeset" title="No default repository defined">[15]</a> <a class="ext-link" href="https://www.drupal.org/u/pwolanin"><span class="icon">​</span>https://www.drupal.org/u/pwolanin</a> <a class="missing changeset" title="No default repository defined">[16]</a> <a class="ext-link" href="https://www.drupal.org/u/klausi"><span class="icon">​</span>https://www.drupal.org/u/klausi</a> <a class="missing changeset" title="No default repository defined">[17]</a> <a class="ext-link" href="https://www.drupal.org/u/pwolanin"><span class="icon">​</span>https://www.drupal.org/u/pwolanin</a> <a class="missing changeset" title="No default repository defined">[18]</a> <a class="ext-link" href="https://www.drupal.org/u/Heine"><span class="icon">​</span>https://www.drupal.org/u/Heine</a> <a class="missing changeset" title="No default repository defined">[19]</a> <a class="ext-link" href="https://www.drupal.org/u/tsphethean"><span class="icon">​</span>https://www.drupal.org/u/tsphethean</a> <a class="missing changeset" title="No default repository defined">[20]</a> <a class="ext-link" href="https://www.drupal.org/contact"><span class="icon">​</span>https://www.drupal.org/contact</a> <a class="missing changeset" title="No default repository defined">[21]</a> <a class="ext-link" href="https://www.drupal.org/security-team"><span class="icon">​</span>https://www.drupal.org/security-team</a> <a class="missing changeset" title="No default repository defined">[22]</a> <a class="ext-link" href="https://www.drupal.org/writing-secure-code"><span class="icon">​</span>https://www.drupal.org/writing-secure-code</a> <a class="missing changeset" title="No default repository defined">[23]</a> <a class="ext-link" href="https://www.drupal.org/security/secure-configuration"><span class="icon">​</span>https://www.drupal.org/security/secure-configuration</a> <a class="missing changeset" title="No default repository defined">[24]</a> <a class="ext-link" href="https://twitter.com/drupalsecurity"><span class="icon">​</span>https://twitter.com/drupalsecurity</a> </p> Results http://localhost:8080/trac/ticket/809#changelog http://localhost:8080/trac/ticket/808 http://localhost:8080/trac/ticket/808 Mon, 17 Nov 2014 19:28:23 GMT chris <p> This issues is like <a class="assigned ticket" href="http://localhost:8080/trac/ticket/737" title="maintenance: SPF / Emails rejected from the website contact form (assigned)">ticket:737</a> but with <a class="wiki" href="http://localhost:8080/trac/wiki/WordPress">WordPress</a> rather than Drupal causing the problem. </p> <p> Laura has forwarded one of the returned emails which contains: </p> <blockquote class="citation"> <p> host aspmx.l.google.com [173.194.67.26]: 550-5.7.1 Unauthenticated email from yahoo.com is not accepted due to domain's 550-5.7.1 DMARC policy. Please contact administrator of yahoo.com domain if 550-5.7.1 this was a legitimate mail. Please visit 550-5.7.1 <a class="ext-link" href="http://support.google.com/mail/answer/2451690"><span class="icon">​</span>http://support.google.com/mail/answer/2451690</a> to learn about DMARC </p> </blockquote> Results http://localhost:8080/trac/ticket/808#changelog http://localhost:8080/trac/ticket/909 http://localhost:8080/trac/ticket/909 Thu, 10 Mar 2016 15:47:27 GMT sam <p> Hi Chris </p> <p> I seem to remember you were able to make Piwik run reports longer than a couple of months by adding some RAM? Is this a virtual thing you can do remotely? Or do you have to physically visit the box to make this happen? </p> <p> I'd like to run longer reports to do a bit of analysis, but not if it's going to cost loads to make it happen. </p> <p> Thanks </p> <p> Sam </p> Results http://localhost:8080/trac/ticket/909#changelog http://localhost:8080/trac/ticket/741 http://localhost:8080/trac/ticket/741 Thu, 12 Jun 2014 10:42:13 GMT annesley <p> admin &gt; views &gt; edit the view editor interface appears and then disappears immediately this happens in Chrome / Ubuntu and Firefox / Mac </p> Results http://localhost:8080/trac/ticket/741#changelog http://localhost:8080/trac/ticket/715 http://localhost:8080/trac/ticket/715 Tue, 08 Apr 2014 14:51:29 GMT sam <p> Hi I just tried to access the views admin interface here: <a class="ext-link" href="https://www.transitionnetwork.org/admin/build/views"><span class="icon">​</span>https://www.transitionnetwork.org/admin/build/views</a> </p> <p> It doesn't load the views admin pages, just an overview of the 'site building' pages instead. </p> <p> The page works as I expect it to on the stage site here: <a class="ext-link" href="https://stg2.transitionnetwork.org/admin/build/views"><span class="icon">​</span>https://stg2.transitionnetwork.org/admin/build/views</a> </p> <p> I have checked and the module is still enabled, The permissions look right (site admin is allowed to administer views: <a class="ext-link" href="https://www.transitionnetwork.org/admin/user/permissions"><span class="icon">​</span>https://www.transitionnetwork.org/admin/user/permissions</a>) </p> <p> Anyone got an idea whats going on? </p> <p> Thanks </p> <p> Sam </p> Results http://localhost:8080/trac/ticket/715#changelog http://localhost:8080/trac/ticket/646 http://localhost:8080/trac/ticket/646 Thu, 12 Dec 2013 10:16:23 GMT ed <p> I'm getting noticeably more complaints about users not being able to unsubscribe to email notifications for content or comment alerts and/or the newsletter. </p> <p> The emerging pattern is that they are clicking on the unsubscribe link in their email alerts and going to an access denied page. </p> <p> My sense says there's something in https/http? Or them not being logged in? </p> <p> Something is definitely going on. </p> <p> Adding this to Sam to pick up in January. SAM - tickets like this can bounce around the tech team a bit - stay on it! </p> Results http://localhost:8080/trac/ticket/646#changelog http://localhost:8080/trac/ticket/326 http://localhost:8080/trac/ticket/326 Mon, 12 Sep 2011 11:10:37 GMT ed <p> Report has been circulated around ttech - to READ and then discuss - some will be phase 5 work, some will be the webmaster's responsibility... </p> Results http://localhost:8080/trac/ticket/326#changelog http://localhost:8080/trac/ticket/619 http://localhost:8080/trac/ticket/619 Fri, 15 Nov 2013 14:38:05 GMT chris <p> News regarding the <a class="wiki" href="http://localhost:8080/trac/wiki/WordPress">WordPress</a> versions released since the sites were upgraded to 3.6.1 on <a class="closed ticket" href="http://localhost:8080/trac/ticket/594" title="maintenance: WordPress 3.6.1 Maintenance and Security Release (closed: fixed)">ticket:594</a> </p> <ul><li><a class="ext-link" href="https://wordpress.org/news/2013/10/wordpress-3-7-1/"><span class="icon">​</span>https://wordpress.org/news/2013/10/wordpress-3-7-1/</a> </li><li><a class="ext-link" href="https://wordpress.org/news/2013/10/basie/"><span class="icon">​</span>https://wordpress.org/news/2013/10/basie/</a> </li></ul><p> We should consider how best to upgrade the <a class="wiki" href="http://localhost:8080/trac/wiki/WordPress">wiki:WordPress</a> sites running on <a class="wiki" href="http://localhost:8080/trac/wiki/ParrotServer">wiki:ParrotServer</a> and then ensure that they are upgraded. </p> Results http://localhost:8080/trac/ticket/619#changelog http://localhost:8080/trac/ticket/847 http://localhost:8080/trac/ticket/847 Mon, 27 Apr 2015 09:30:11 GMT chris <p> The latest version of <a class="ext-link" href="https://www.debian.org/News/2015/20150426"><span class="icon">​</span>Debian, Jessie, 8.0</a>, came out over the weekend, we should consider upgrading the three servers, <a class="wiki" href="http://localhost:8080/trac/wiki/PuffinServer">PuffinServer</a>, <a class="wiki" href="http://localhost:8080/trac/wiki/PenguinServer">PenguinServer</a> and <a class="wiki" href="http://localhost:8080/trac/wiki/ParrotServer">ParrotServer</a> and what issues would arrise when we do. </p> <p> See the documentation on <a class="ext-link" href="https://www.debian.org/releases/jessie/amd64/release-notes/ch-upgrading.en.html"><span class="icon">​</span>Upgrades from Debian 7 (wheezy)</a> and <a class="ext-link" href="https://www.debian.org/releases/stable/amd64/release-notes/ch-information.en.html"><span class="icon">​</span>Issues to be aware of for jessie</a>, specifically: </p> <ul><li><a class="ext-link" href="https://www.debian.org/releases/stable/amd64/release-notes/ch-information.en.html#libv8"><span class="icon">​</span>Lack of security support for the ecosystem around libv8 and Node.js</a> </li><li><a class="ext-link" href="https://www.debian.org/releases/stable/amd64/release-notes/ch-information.en.html#apache-httpd-incomat"><span class="icon">​</span>Incompatible changes in Apache HTTPD 2.4</a> </li><li><a class="ext-link" href="https://www.debian.org/releases/stable/amd64/release-notes/ch-information.en.html#php-incompat"><span class="icon">​</span>PHP 5.6 upgrade has behavioral changes</a> </li></ul> Results http://localhost:8080/trac/ticket/847#changelog http://localhost:8080/trac/ticket/719 http://localhost:8080/trac/ticket/719 Mon, 14 Apr 2014 20:07:09 GMT chris <p> If you look at old Transition Culture articles they had hyperlinks and blockquotes, for example: </p> <ul><li><a class="ext-link" href="https://web.archive.org/web/20070228081440/http://transitionculture.org/2006/01/24/local-energy-local-currency-local-power/"><span class="icon">​</span>https://web.archive.org/web/20070228081440/http://transitionculture.org/2006/01/24/local-energy-local-currency-local-power/</a> </li></ul><p> If you look at the version we now have this formatting has been lost and the first paragraph is a mess: </p> <ul><li><a class="ext-link" href="http://transitionculture.org/2006/01/24/local-energy-local-currency-local-power/"><span class="icon">​</span>http://transitionculture.org/2006/01/24/local-energy-local-currency-local-power/</a> </li></ul><p> The formatting wasn't lost when the new TC design was first deployed: </p> <ul><li><a class="ext-link" href="https://web.archive.org/web/20080429205320/http://transitionculture.org/2006/01/24/local-energy-local-currency-local-power/"><span class="icon">​</span>https://web.archive.org/web/20080429205320/http://transitionculture.org/2006/01/24/local-energy-local-currency-local-power/</a> </li></ul><p> It has happened since then. </p> <p> We should consider investigating what caused the problems and how they can be fixed? </p> <p> This might be a task that Simon would be best placed to undertake? </p> Results http://localhost:8080/trac/ticket/719#changelog http://localhost:8080/trac/ticket/819 http://localhost:8080/trac/ticket/819 Fri, 19 Dec 2014 10:28:01 GMT chris <p> Today we had our first item of Trac spam, <a class="new ticket" href="http://localhost:8080/trac/ticket/818" title="defect: For watch lovers. superwatches (new)">ticket:818</a>, since the open email interface was enabled almost 2 years ago on <a class="closed ticket" href="http://localhost:8080/trac/ticket/494" title="maintenance: Email account for TRAC (closed: fixed)">ticket:494</a>. </p> <p> This ticket has been created to investigate and implement some anti-spam measures. </p> Results http://localhost:8080/trac/ticket/819#changelog http://localhost:8080/trac/ticket/857 http://localhost:8080/trac/ticket/857 Tue, 02 Jun 2015 15:24:33 GMT sam <p> Hi Paul, </p> <p> Myself &amp; Rob have both run into an intermittent issue where when editing a panel page the WYSYWG editor (Tiny MCE) sometimes appears, sometimes doesn't. </p> <p> When it doesn't appear you are left with the plain text html editor. </p> <p> There seems to be no obvious pattern to it. So might be a tricky one to debug. </p> <p> I see the version of Tiny MCE we are using is quite old, so I was thinking perhaps we should just try upgrading it on a dev server and see if that fixes it? </p> <p> If this seems reasonable could you stick the latest Tiny MCE on your dev server so we could test it out there? Or if you have any other ideas for getting to the bottom of it.. </p> <p> Thanks </p> <p> Sam </p> Results http://localhost:8080/trac/ticket/857#changelog http://localhost:8080/trac/ticket/794 http://localhost:8080/trac/ticket/794 Fri, 10 Oct 2014 09:06:29 GMT ed <p> Rob is thinking about doing a 1970s editorial month, and would like a 1970s style 'naff' wallpaper. </p> <p> Ben please can you provide a time estimate for replacing the tasteful blue dotty background with some semi-transparent paisley thing for a month, and then reverting to the tasteful blue dots </p> Results http://localhost:8080/trac/ticket/794#changelog http://localhost:8080/trac/ticket/582 http://localhost:8080/trac/ticket/582 Mon, 02 Sep 2013 09:30:02 GMT jim <p> The TN.org platform and Drupal site updates are to be tracked in this ticket. </p> <p> Current PROD platform build = <strong>P009</strong> Current STG platform build = <strong>S010</strong> </p> <p> Updates pending: </p> <ul><li>SECURITY UPDATE - NO RISK: Pressflow core 6.30 is due, but the security holes fixed do not affect us, low priority. Platforms: present in S010, but not in P009. </li></ul> Results http://localhost:8080/trac/ticket/582#changelog http://localhost:8080/trac/ticket/907 http://localhost:8080/trac/ticket/907 Wed, 02 Mar 2016 10:20:10 GMT chris <p> 6 weeks ago the datadase dump was 447M, see <a class="ext-link" href="http://trac.edgewall.org/intertrac/ticket/896%23comment%3A3" title="ticket/896#comment:3 in Trac project trac"><span class="icon">​</span>trac:ticket/896#comment:3</a> but now it is 1.8G: </p> <pre class="wiki">ls -lah /var/backups/mysql/sqldump/transitionnetw_0.sql -rw------- 1 root root 1.8G Mar 2 01:23 /var/backups/mysql/sqldump/transitionnetw_0.sql </pre><p> Anyone have any idea what happened to cause this? Are we keeping too many log entries? </p> Results http://localhost:8080/trac/ticket/907#changelog http://localhost:8080/trac/ticket/662 http://localhost:8080/trac/ticket/662 Tue, 17 Dec 2013 15:37:13 GMT ed <p> for January - to get Sam and Jim talking - in January </p> <p> The subs sent out to subscribers: are fine in html but the text version is broken and unsatisfactory. I know we've been through this and it's a known bug etc. etc. but I'm wondering if we can switch all subs to html, or if there are any patches to this problem? </p> <p> Adding as Jim's ticket with Sam cc-ed </p> Results http://localhost:8080/trac/ticket/662#changelog http://localhost:8080/trac/ticket/859 http://localhost:8080/trac/ticket/859 Tue, 16 Jun 2015 13:08:44 GMT sam <p> Hi just got this mail </p> <p> "For some reason I realized I wasn't hearing from Rob. You might want to check your system because mine hasn't changed as far as I know." </p> <p> Had a look in my inbox &amp; the last mail from Drupal subscription system was on 27th of May. </p> <p> I may be the guilty party, as I did go in to edit the message around this time. </p> <p> I'll investigate via the Drupal admin interface, but has anything else happened/ been done that could have stopped the mails? </p> Results http://localhost:8080/trac/ticket/859#changelog http://localhost:8080/trac/ticket/742 http://localhost:8080/trac/ticket/742 Thu, 12 Jun 2014 14:35:42 GMT sam <p> Hi Paul </p> <p> I'm trying to set up a stage site, just to test rearranging the homepage blocks. </p> <p> I created a site on the "Transition Network D6 S012 Booker" Platform, but I just get an empty pressflow site: <a class="ext-link" href="http://stgsam.transitionnetwork.org/"><span class="icon">​</span>http://stgsam.transitionnetwork.org/</a> </p> <p> Can I use your stg site to test the block arrangement instead: <a class="ext-link" href="https://booker-stage-20140501.transitionnetwork.org/"><span class="icon">​</span>https://booker-stage-20140501.transitionnetwork.org/</a> </p> <p> Or could you let me know what might be going wrong? </p> <p> Thanks </p> <p> Sam </p> Results http://localhost:8080/trac/ticket/742#changelog http://localhost:8080/trac/ticket/761 http://localhost:8080/trac/ticket/761 Thu, 17 Jul 2014 08:45:33 GMT ed <p> There are bucketloads of spam accounts swamping us. Spam commeting is swarming again. I just did several pages of deleting spam accounts. No doubt I nailed some humans too (sorry Sam if this comes back to you); but the overwhelming majority of new accounts are spam. </p> <p> It's crap and we need to have another spam sweep - especially if we're staying in D6 for a while. </p> <p> See work done in Feb 2013: <a class="assigned ticket" href="http://localhost:8080/trac/ticket/461" title="enhancement: Spam account war (assigned)">#461</a> See wiki page done in Feb 2013: <a class="ext-link" href="https://wiki.transitionnetwork.org/Spam_accounts"><span class="icon">​</span>https://wiki.transitionnetwork.org/Spam_accounts</a> </p> <p> SAM I'm going to suggest you start looking at it, and get your head around it, and the various modules and processes we've got running, then ask you to act/escalate accordingly. </p> Results http://localhost:8080/trac/ticket/761#changelog http://localhost:8080/trac/ticket/802 http://localhost:8080/trac/ticket/802 Thu, 23 Oct 2014 10:20:29 GMT sam <p> User reported: "I'm trying to register our fledgling initiative based in Dovje-Mojstrana, Slovenia. When I select the country, the <a class="missing wiki">Province/State?</a> box automatically comes up as not listed. But then when I press preview to be ready to send, it says "The specified province was not found in the specified country." So I can't submit the form :-( Please help! I think we will be the first official Transition town in Slovenia!" </p> <p> I had a go at creating the initiative in a different country, then editing it to Slovenia as a workaround, but that didn't work either: <a class="ext-link" href="https://www.transitionnetwork.org/node/37435/edit"><span class="icon">​</span>https://www.transitionnetwork.org/node/37435/edit</a> </p> <p> Any idea's as to why it won't accept 'not listed' as a valid choice? Or what we can do about it? </p> <p> Thanks </p> <p> Sam </p> Results http://localhost:8080/trac/ticket/802#changelog http://localhost:8080/trac/ticket/834 http://localhost:8080/trac/ticket/834 Thu, 26 Feb 2015 10:41:47 GMT sam <p> Hi Paul </p> <p> The change that you made in this ticket: <a class="ext-link" href="https://trac.transitionnetwork.org/trac/ticket/802"><span class="icon">​</span>https://trac.transitionnetwork.org/trac/ticket/802</a> </p> <p> Seems to have been lost. I am no longer able to edit <a class="ext-link" href="https://www.transitionnetwork.org/node/37435/edit"><span class="icon">​</span>https://www.transitionnetwork.org/node/37435/edit</a> </p> <p> As the state/province information is missing. </p> <p> Could you re-do the change please? </p> <p> Thanks </p> <p> Sam </p> Results http://localhost:8080/trac/ticket/834#changelog http://localhost:8080/trac/ticket/606 http://localhost:8080/trac/ticket/606 Fri, 11 Oct 2013 12:00:13 GMT jim <p> This ticket is to track the issues left over from <a class="assigned ticket" href="http://localhost:8080/trac/ticket/590" title="defect: Drupal performance improvements (assigned)">#590</a> that need to be considered and tackled prior to migrating the site from D6 to D7 (or 8). </p> <p> Please feel free to add as needed, but sticky to the </p> <h2 id="CCleanup:Listoffeatureswedontreallyneed">C) Cleanup: List of features we don't really need</h2> <p> Ed to add his items to following list... Need rational and alternative approaches for each. </p> <ul><li><strong>C.1) Remove 'Geographic region' and related taxonomy and Hierarchical Select modules</strong> 1 hour, low reward, low risk -- never really been used and is effectively a duplicate of the location field. let's kill it! </li><li><strong>C.2) Kill Microsites and the Forums</strong> -- The handful of people using the CMS feature should be migrated to Open Atrium if they need such features. </li><li><strong>C.3) Remove forums</strong> -- We could migrate the forum to a simpler setup (not using forum module) that leverages normal commenting, or even Disqus or other services to offload comments and moderation. Also encourage user-submitted ocontent and promote that if it's good or gets interesting debate. </li></ul><h2 id="DKeydevelopmenttasks">D) Key development tasks</h2> <ul><li><strong>D.1) All inline PHP must be moved to modules and features</strong> -- This has great benefit for management, maintenance and developers. <tt>Eval()</tt>uated code is much slower than PHP in files, especially since it can't be accelerated by APC or Zend Opcode cache... We have a few blocks and many views that are loaded from the database and evaluated. Ideally the blocks would be moved to the 'Transition Extras' module, and the views would be pushed into features. This work is good to do for maintainability and D7 upgrades, too. See: <a class="ext-link" href="http://2bits.com/api/abuse-drupal-best-practices-your-own-peril-poor-performance.html"><span class="icon">​</span>http://2bits.com/api/abuse-drupal-best-practices-your-own-peril-poor-performance.html</a> and <a class="ext-link" href="http://2bits.com/articles/free-your-content-php-moving-php-code-out-blocks-views-and-nodes.html"><span class="icon">​</span>http://2bits.com/articles/free-your-content-php-moving-php-code-out-blocks-views-and-nodes.html</a> </li></ul><ul><li><strong>D.2) Build in ESI (Edge Side Includes) support from the outset, ensure Drupal renders only what it needs to </strong> -- BOA packages the <a class="ext-link" href="https://drupal.org/project/esi"><span class="icon">​</span>ESI (Edge Side Includes integration) module</a>, which makes NginX cache the whole page (as it does now), but also for user-logged in pages (which it does for 5 seconds since the page data changes). This means Drupal renders the ESI component (blocks, panels panes) that are have user-specific data in. Potential boost quickly, but will need time to tweak settings to get best from this across whole site. See <a class="ext-link" href="https://tech.transitionnetwork.org/trac/ticket/590#comment:4"><span class="icon">​</span>comments in 4 &amp; 5 below for discussion</a><del>, should be done after proposal F, above</del>. </li></ul><h2 id="EKeyeditorialtasks">E) Key editorial tasks</h2> <ul><li><strong>E.1) More Taxonomy cleanup</strong> -- try to merge terms with the same names, clear out spammy terms, general spit-and-polish. Ed plus team of busy interns to do this when the time is right. </li></ul><h2 id="Zoldstuffforreferencetasksfrom590renderedpointlessbymove">Z) old stuff for reference; tasks from <a class="assigned ticket" href="http://localhost:8080/trac/ticket/590" title="defect: Drupal performance improvements (assigned)">#590</a> rendered pointless by move</h2> <ul><li><strong>Z.1) Find Variable table writes and kill them</strong> -- seeing plenty of SELECT * FROM variable calls, which imply a cache clear due to a variable being set. In normal use variables shouldn't be set (admin screens tend to do this), so I'd like to try to see what module it causing this and patch/remove it. Will need to run <tt>grep -R "variable_set() * &gt; ~/static/variable_set-calls.txt" in the {{{sites/all</tt> directory to generate a list, then trawl though it to find candidates/bad modules practice. </li></ul> Results http://localhost:8080/trac/ticket/606#changelog http://localhost:8080/trac/ticket/881 http://localhost:8080/trac/ticket/881 Fri, 23 Oct 2015 11:19:04 GMT chris <p> It appears a site, or application, on <a class="wiki" href="http://localhost:8080/trac/wiki/ParrotServer">ParrotServer</a> might have a memory leak. </p> <p> <a style="padding:0; border:none" href="http://localhost:8080/trac/attachment/ticket/881/parrot-memory-pinpoint-1411038915-1445598915.png"><img src="http://localhost:8080/trac/raw-attachment/ticket/881/parrot-memory-pinpoint-1411038915-1445598915.png" /></a> </p> Results http://localhost:8080/trac/ticket/881#changelog http://localhost:8080/trac/ticket/890 http://localhost:8080/trac/ticket/890 Sat, 12 Dec 2015 10:54:36 GMT sam <p> It's serving a page, so may be Drupal level problem rather than server level? </p> <p> <a class="ext-link" href="https://www.transitionnetwork.org/"><span class="icon">​</span>https://www.transitionnetwork.org/</a> </p> Results http://localhost:8080/trac/ticket/890#changelog http://localhost:8080/trac/ticket/919 http://localhost:8080/trac/ticket/919 Thu, 14 Jul 2016 18:17:26 GMT chris <p> The <a class="ext-link" href="https://www.transitionnetwork.org/"><span class="icon">​</span>https://www.transitionnetwork.org/</a> site has been "off-line" since about 7pm, I see that Paul is logged on via <tt>ssh</tt> -- is this something that we should worry about or is this intentional? </p> Results http://localhost:8080/trac/ticket/919#changelog http://localhost:8080/trac/ticket/916 http://localhost:8080/trac/ticket/916 Wed, 13 Jul 2016 11:01:58 GMT sam <p> Hi Chris could you set up a SSH account on parrot please </p> <p> Kevin support@… </p> <p> Public SSH key attached. </p> <p> Thanks </p> <p> Sam </p> Results http://localhost:8080/trac/ticket/916#changelog http://localhost:8080/trac/ticket/922 http://localhost:8080/trac/ticket/922 Thu, 28 Jul 2016 15:30:37 GMT sam <p> Hi Chris </p> <p> Could I get SSH access to parrot please? </p> <p> samrossiter@… </p> <p> Thanks </p> <p> Sam </p> Results http://localhost:8080/trac/ticket/922#changelog http://localhost:8080/trac/ticket/789 http://localhost:8080/trac/ticket/789 Mon, 22 Sep 2014 13:09:48 GMT paul <p> View online: <a class="ext-link" href="https://www.drupal.org/node/2340029"><span class="icon">​</span>https://www.drupal.org/node/2340029</a> </p> <ul><li>Advisory ID: DRUPAL-SA-CONTRIB-2014-088 </li><li>Project: Mollom <a class="missing changeset" title="No default repository defined">[1]</a> (third-party module) </li><li>Version: 6.x, 7.x </li><li>Date: 2014-September-17 </li><li>Security risk: 11/25 ( Moderately Critical) </li></ul><p> AC:Complex/A:User/CI:Some/II:Some/E:Theoretical/TD:Uncommon <a class="missing changeset" title="No default repository defined">[2]</a> </p> <ul><li>Vulnerability: Cross Site Scripting </li></ul><hr /> <hr /> <p> Mollom is an "intelligent" content moderation web service which determines if a post is potentially spam; not only based on the posted content, but also on the past activity and reputation of the poster across multiple sites. </p> <p> Mollom offers a feature to report submitted content as inappropriate which allows end users to indicate that a piece of site content is objectionable or out of place. When reporting content, the content title is not sufficiently sanitized to prevent cross-site scripting (XSS) attacks. </p> <p> This vulnerability is mitigated by the fact that an attacker must have a role with the permission to create content and the content type must be enabled for "Flag as Inappropriate" within the Mollom advanced configuration settings (which is not the default setting). </p> <hr /> <hr /> <ul><li>/A CVE identifier <a class="missing changeset" title="No default repository defined">[3]</a> will be requested, and added upon issuance, in </li></ul><p> accordance with Drupal Security Team processes./ </p> <hr /> <hr /> <ul><li>Mollom 6.x-2.x versions from 6.x-2.7 to 6.x-2.10 </li><li>Mollom 7.x-2.x versions from 7.x-2.9 to 7.x-2.10 </li></ul><p> Drupal core is not affected. If you do not use the contributed Mollom <a class="missing changeset" title="No default repository defined">[4]</a> module, there is nothing you need to do. </p> <hr /> <hr /> <p> Install the latest version: </p> <ul><li>If you use the Mollom module for Drupal 6.x, upgrade to Mollom 6.x-2.11 </li></ul><p> <a class="missing changeset" title="No default repository defined">[5]</a> </p> <ul><li>If you use the Mollom module for Drupal 7.x, upgrade to Mollom 7.x-2.11 </li></ul><p> <a class="missing changeset" title="No default repository defined">[6]</a> </p> <p> Also see the Mollom <a class="missing changeset" title="No default repository defined">[7]</a> project page. </p> <hr /> <hr /> <ul><li>Matt Vance <a class="missing changeset" title="No default repository defined">[8]</a> </li></ul><hr /> <hr /> <ul><li>Lisa Backer <a class="missing changeset" title="No default repository defined">[9]</a> the module maintainer </li><li>Matt Vance <a class="missing changeset" title="No default repository defined">[10]</a> </li></ul><hr /> <hr /> <ul><li>Greg Knaddison <a class="missing changeset" title="No default repository defined">[11]</a> of the Drupal Security Team </li></ul><hr /> <hr /> <p> The Drupal security team can be reached at security at drupal.org or via the contact form at <a class="ext-link" href="https://www.drupal.org/contact"><span class="icon">​</span>https://www.drupal.org/contact</a> <a class="missing changeset" title="No default repository defined">[12]</a>. </p> <p> Learn more about the Drupal Security team and their policies <a class="missing changeset" title="No default repository defined">[13]</a>, writing secure code for Drupal <a class="missing changeset" title="No default repository defined">[14]</a>, and securing your site <a class="missing changeset" title="No default repository defined">[15]</a>. </p> <p> <a class="missing changeset" title="No default repository defined">[1]</a> <a class="ext-link" href="https://www.drupal.org/project/mollom"><span class="icon">​</span>https://www.drupal.org/project/mollom</a> <a class="missing changeset" title="No default repository defined">[2]</a> <a class="ext-link" href="https://www.drupal.org/security-team/risk-levels"><span class="icon">​</span>https://www.drupal.org/security-team/risk-levels</a> <a class="missing changeset" title="No default repository defined">[3]</a> <a class="ext-link" href="http://cve.mitre.org/"><span class="icon">​</span>http://cve.mitre.org/</a> <a class="missing changeset" title="No default repository defined">[4]</a> <a class="ext-link" href="https://www.drupal.org/project/mollom"><span class="icon">​</span>https://www.drupal.org/project/mollom</a> <a class="missing changeset" title="No default repository defined">[5]</a> <a class="ext-link" href="https://www.drupal.org/node/2338787"><span class="icon">​</span>https://www.drupal.org/node/2338787</a> <a class="missing changeset" title="No default repository defined">[6]</a> <a class="ext-link" href="https://www.drupal.org/node/2338789"><span class="icon">​</span>https://www.drupal.org/node/2338789</a> <a class="missing changeset" title="No default repository defined">[7]</a> <a class="ext-link" href="https://www.drupal.org/project/mollom"><span class="icon">​</span>https://www.drupal.org/project/mollom</a> <a class="missing changeset" title="No default repository defined">[8]</a> <a class="ext-link" href="https://www.drupal.org/user/88338"><span class="icon">​</span>https://www.drupal.org/user/88338</a> <a class="missing changeset" title="No default repository defined">[9]</a> <a class="ext-link" href="https://www.drupal.org/user/1951462"><span class="icon">​</span>https://www.drupal.org/user/1951462</a> <a class="missing changeset" title="No default repository defined">[10]</a> <a class="ext-link" href="https://www.drupal.org/user/88338"><span class="icon">​</span>https://www.drupal.org/user/88338</a> <a class="missing changeset" title="No default repository defined">[11]</a> <a class="ext-link" href="https://www.drupal.org/user/36762"><span class="icon">​</span>https://www.drupal.org/user/36762</a> <a class="missing changeset" title="No default repository defined">[12]</a> <a class="ext-link" href="https://www.drupal.org/contact"><span class="icon">​</span>https://www.drupal.org/contact</a> <a class="missing changeset" title="No default repository defined">[13]</a> <a class="ext-link" href="https://www.drupal.org/security-team"><span class="icon">​</span>https://www.drupal.org/security-team</a> <a class="missing changeset" title="No default repository defined">[14]</a> <a class="ext-link" href="https://www.drupal.org/writing-secure-code"><span class="icon">​</span>https://www.drupal.org/writing-secure-code</a> <a class="missing changeset" title="No default repository defined">[15]</a> <a class="ext-link" href="https://www.drupal.org/security/secure-configuration"><span class="icon">​</span>https://www.drupal.org/security/secure-configuration</a> </p> Results http://localhost:8080/trac/ticket/789#changelog http://localhost:8080/trac/ticket/757 http://localhost:8080/trac/ticket/757 Fri, 11 Jul 2014 13:36:54 GMT ed <p> R&amp;D for TNv3 </p> Results http://localhost:8080/trac/ticket/757#changelog http://localhost:8080/trac/ticket/671 http://localhost:8080/trac/ticket/671 Sat, 11 Jan 2014 21:11:14 GMT jim <p> <strong>Issue &amp; background</strong> During work on <a class="closed ticket" href="http://localhost:8080/trac/ticket/610" title="defect: Aegir database intensive (migrate, clone, restore) tasks hang for larger ... (closed: fixed)">#610</a>, it was discovered that of a 1/4GB database dump for TN.org, ~80% (180Mb) of it was related to the Drupal 6 core Search module. </p> <p> It's worth noting <a class="ext-link" href="https://tech.transitionnetwork.org/trac/ticket/516#comment:3"><span class="icon">​</span>this</a> was <a class="ext-link" href="https://tech.transitionnetwork.org/trac/ticket/516#comment:6"><span class="icon">​</span>raised</a> when we migrated the site to the Puffin server in March 2013, but it's generally the case that the core Search module does not scale easily beyond a few thousand nodes. </p> <p> www.transitionnetwork.org has 23,803 nodes at time of writing -- this is probably approaching the sensible limit of the core module's capability. </p> <p> Note also, any future D7 or D8 version of the site would also hugely benefit from using Solr, so the server config part is time well spent. </p> <p> <strong>Proposed solution</strong> </p> <ol><li>Add the Apache Solr option to BOA, re-run the installer to get it installed and configured automatically. </li><li>Add the <a class="ext-link" href="https://drupal.org/project/apachesolr"><span class="icon">​</span>ApacheSolr module</a> and any related required modules to the TN D6 makefile -- it's not clear if the 6.x-3.x branch or 6.x-1.x branch is the right choice at present. </li><li>Build a new platform containing these modules, migrate a clone of STG to it. </li><li>Enable the modules, configure them, disable core Search. </li><li>Create a feature that wraps up config for Solr and required modules. Add to Git, add reference to feature to makefile </li><li>Test, tweak, repeat 3 &amp; 4 &amp; 5 as needed. </li><li>Migrate PROD to the new plaform, enabled feature, index site. </li></ol><p> This could be parked until D7/8 migration, or not... Ed's call. </p> Results http://localhost:8080/trac/ticket/671#changelog http://localhost:8080/trac/ticket/877 http://localhost:8080/trac/ticket/877 Thu, 15 Oct 2015 11:20:05 GMT paul <pre class="wiki">Hi Sam, Hope you're well. Any chance you could pay my 3 outstanding invoices today? Best, Paul -- Paul Booker Drupal Support for Websites and Linux Servers Website: http://www.paulbooker.co.uk Tel: +44 01922 861636 </pre> Results http://localhost:8080/trac/ticket/877#changelog http://localhost:8080/trac/ticket/884 http://localhost:8080/trac/ticket/884 Thu, 03 Dec 2015 12:40:03 GMT paul <pre class="wiki">Hi Chris, All Can you help me to reset my password for paulbooker for news.transitionnetwork.org? I just tried to use the reset password form but I never received an email and when I Iooked at the settings,php file for the website (generated by Aegir) I couldn't see immediately where to find the database. I think I may have missed some recent updates to news.transitionnetwork.org so urgently need to resolve this today. Not sure how this has fallen of my radar, but, I just noticed that news.transitionnetwork.org is no longer mentioned on the platform page on Aegir so may have got into thinking that this site no longer exists. http://news.transitionnetwork.org https://tn.puffin.webarch.net/hosting/platforms -- Paul Booker Drupal Support for Websites and Linux Servers Website: http://www.paulbooker.co.uk Tel: +44 01922 861636 </pre> Results http://localhost:8080/trac/ticket/884#changelog http://localhost:8080/trac/ticket/638 http://localhost:8080/trac/ticket/638 Thu, 28 Nov 2013 12:32:57 GMT ed <p> Content creators (news, Rob's blog, social reporters) struggle with the notifications. the problem is that they forget to click the option to 'do not send notifications for this update' and then notifications are sent out. It is easy for us to think this is easy for them, but when you are bashing stuff out in a hurry, it's easy to forget this fiddly bit. </p> <p> CAN WE set drupal to NOT send notifications out as standard for some of the content types? </p> <p> And change it so that the content creators (news, Rob's blog, social reporters) choose to SEND notifications out instead (of NOT sending them) ? </p> Results http://localhost:8080/trac/ticket/638#changelog http://localhost:8080/trac/ticket/587 http://localhost:8080/trac/ticket/587 Thu, 05 Sep 2013 12:54:47 GMT chris <p> This ticket is to track the tuning we do to MySQL on <a class="wiki" href="http://localhost:8080/trac/wiki/PuffinServer">PuffinServer</a>. </p> <p> See also previous comments on this issue: </p> <ul><li><a class="closed ticket" href="http://localhost:8080/trac/ticket/555#comment:12" title="maintenance: Load spikes causing the TN site to be stopped for 15 min at a time (closed: fixed)">ticket:555#comment:12</a> </li><li><a class="closed ticket" href="http://localhost:8080/trac/ticket/555#comment:15" title="maintenance: Load spikes causing the TN site to be stopped for 15 min at a time (closed: fixed)">ticket:555#comment:15</a> </li><li><a class="closed ticket" href="http://localhost:8080/trac/ticket/555#comment:16" title="maintenance: Load spikes causing the TN site to be stopped for 15 min at a time (closed: fixed)">ticket:555#comment:16</a> </li><li><a class="closed ticket" href="http://localhost:8080/trac/ticket/555#comment:17" title="maintenance: Load spikes causing the TN site to be stopped for 15 min at a time (closed: fixed)">ticket:555#comment:17</a> </li><li><a class="closed ticket" href="http://localhost:8080/trac/ticket/555#comment:20" title="maintenance: Load spikes causing the TN site to be stopped for 15 min at a time (closed: fixed)">ticket:555#comment:20</a> </li><li><a class="closed ticket" href="http://localhost:8080/trac/ticket/555#comment:29" title="maintenance: Load spikes causing the TN site to be stopped for 15 min at a time (closed: fixed)">ticket:555#comment:29</a> </li><li><a class="closed ticket" href="http://localhost:8080/trac/ticket/555#SettingsChanged" title="maintenance: Load spikes causing the TN site to be stopped for 15 min at a time (closed: fixed)">ticket:555#SettingsChanged</a> </li><li><a class="closed ticket" href="http://localhost:8080/trac/ticket/555#comment:39" title="maintenance: Load spikes causing the TN site to be stopped for 15 min at a time (closed: fixed)">ticket:555#comment:39</a> </li><li><a class="closed ticket" href="http://localhost:8080/trac/ticket/555#comment:56" title="maintenance: Load spikes causing the TN site to be stopped for 15 min at a time (closed: fixed)">ticket:555#comment:56</a> </li><li><a class="closed ticket" href="http://localhost:8080/trac/ticket/555#comment:57" title="maintenance: Load spikes causing the TN site to be stopped for 15 min at a time (closed: fixed)">ticket:555#comment:57</a> </li><li><a class="closed ticket" href="http://localhost:8080/trac/ticket/555#comment:60" title="maintenance: Load spikes causing the TN site to be stopped for 15 min at a time (closed: fixed)">ticket:555#comment:60</a> </li><li><a class="closed ticket" href="http://localhost:8080/trac/ticket/555#comment:65" title="maintenance: Load spikes causing the TN site to be stopped for 15 min at a time (closed: fixed)">ticket:555#comment:65</a> </li><li><a class="closed ticket" href="http://localhost:8080/trac/ticket/555#comment:66" title="maintenance: Load spikes causing the TN site to be stopped for 15 min at a time (closed: fixed)">ticket:555#comment:66</a> </li><li><a class="closed ticket" href="http://localhost:8080/trac/ticket/555#comment:67" title="maintenance: Load spikes causing the TN site to be stopped for 15 min at a time (closed: fixed)">ticket:555#comment:67</a> </li><li><a class="closed ticket" href="http://localhost:8080/trac/ticket/555#comment:68" title="maintenance: Load spikes causing the TN site to be stopped for 15 min at a time (closed: fixed)">ticket:555#comment:68</a> </li><li><a class="closed ticket" href="http://localhost:8080/trac/ticket/555#comment:82" title="maintenance: Load spikes causing the TN site to be stopped for 15 min at a time (closed: fixed)">ticket:555#comment:82</a> </li><li><a class="closed ticket" href="http://localhost:8080/trac/ticket/555#comment:85" title="maintenance: Load spikes causing the TN site to be stopped for 15 min at a time (closed: fixed)">ticket:555#comment:85</a> </li></ul> Results http://localhost:8080/trac/ticket/587#changelog http://localhost:8080/trac/ticket/458 http://localhost:8080/trac/ticket/458 Thu, 08 Nov 2012 18:17:09 GMT laura <p> 2 – Project Profile individual page display </p> <ul><li>Panels to re-arrange layout. </li><li>Summary on left upper brick, findability on right upper brick with map under (will be a case of working on mockups via LW’s virtual machine, map may need to go further down, but a listing of town, country still to appear in top part). Description to become an expanding box and other data underneath - full width. </li><li>Tidy up image display to be more attractive for users. Enable ‘contact’ button for project contact to be more visible. </li><li>Panels, views, and CSS theming for frontend enhanced display. </li></ul> Results http://localhost:8080/trac/ticket/458#changelog http://localhost:8080/trac/ticket/459 http://localhost:8080/trac/ticket/459 Thu, 08 Nov 2012 18:19:53 GMT laura <p> <strong>3 - Projects Directory (frontend of website)</strong> Create new tabbed views for a variety of outputs. New views result listings to be mainly in display format of: </p> <ul><li>Title (heading) </li><li><a class="missing wiki">City/Country?</a> (bold, slightly larger and possible on right) </li><li>New summary field and ‘read more about this project’ link </li></ul><p> <em>Similar to the ‘full’ PSE widget output list (except not showing distance but town or city and Country)</em> </p> <p> <strong>Tabs:</strong> <strong>Tab One</strong> (default) Projects Home – Introduction short paragraph text and link to adding projects. Lists featured projects Pagination </p> <p> <strong>Tab Two</strong> Find by theme – Introduction brief sentence. Search functionality (exposed view filter) for selection of projects by theme. Default view: random pagination </p> <p> <strong>Tab Three</strong> Find by location - Introduction brief sentence. Search functionality (exposed view filter) for selection of projects by location to use Names rather than miles. Default view: random or London? <em>(note: LW will test ideas on this)</em> pagination </p> <p> <strong>Tab Four</strong> Find by benefits – <em><strong> note this may need to be set up ready but hidden initially until a substantial number of projects have updated their profiles with inclusion of the benefits/outcomes field </strong></em> Introduction brief sentence. Search functionality (exposed view filter) for selection of projects by outcome/benefits Default view: all by date added. pagination </p> <p> <strong>Tab five</strong> [Similar to existing projects home page] Find by title with exposed search as is present. and tabular layout with a-z Custom CSS may be needed </p> <hr /> <p> <strong>Longer term:</strong> (possible January?) Enhance projects map page to show attached view of latest projects with relational popups on hover for easy browsing, and / or map filters by theme or benefit to enable a more usable feature of the map ability. </p> Results http://localhost:8080/trac/ticket/459#changelog http://localhost:8080/trac/ticket/764 http://localhost:8080/trac/ticket/764 Tue, 22 Jul 2014 14:10:38 GMT annesley <p> on-line meeting 5 / August @ 14:00 GMT: we are phasing out the current D6 / BOA system. the new system may not use either. The TN.org website is not attractive to high level hackers or DOS attacks. </p> <p> what are the risks with cancelling all further Unix, BOA and Drupal updates completely that do not allow direct un-mitigated access to the backend via bad PHP code / SQL? </p> Results http://localhost:8080/trac/ticket/764#changelog http://localhost:8080/trac/ticket/513 http://localhost:8080/trac/ticket/513 Mon, 11 Mar 2013 08:17:47 GMT ed <p> What is a widget user? What role is this? Please clarify? </p> Results http://localhost:8080/trac/ticket/513#changelog http://localhost:8080/trac/ticket/874 http://localhost:8080/trac/ticket/874 Tue, 29 Sep 2015 13:31:02 GMT sam <p> Hi Paul </p> <p> We'd like to play around with generating Georss from our current site. </p> <p> Could you have a glance at the code /test <a class="ext-link" href="https://www.drupal.org/project/georss"><span class="icon">​</span>https://www.drupal.org/project/georss</a> </p> <p> If it seems like it's going to be unproblematic then please install it on the live site. </p> <p> Thanks </p> <p> Sam </p> Results http://localhost:8080/trac/ticket/874#changelog http://localhost:8080/trac/ticket/855 http://localhost:8080/trac/ticket/855 Tue, 26 May 2015 12:10:13 GMT sam <p> Hi Chris </p> <p> I spotted Piwik has some plugins to extend it's usefulness. </p> <p> I'm quite interested in playing with some of them, particularly the clickheat one: </p> <p> <a class="ext-link" href="https://stats.transitionnetwork.org/index.php?module=CorePluginsAdmin&amp;action=userBrowsePlugins&amp;idSite=1&amp;period=range&amp;date=previous30&amp;activated="><span class="icon">​</span>https://stats.transitionnetwork.org/index.php?module=CorePluginsAdmin&amp;action=userBrowsePlugins&amp;idSite=1&amp;period=range&amp;date=previous30&amp;activated=</a># </p> <p> Is it OK for me to install it to try? Or do you think the whole thing would grind to a halt? </p> <p> Thanks </p> <p> Sam </p> Results http://localhost:8080/trac/ticket/855#changelog http://localhost:8080/trac/ticket/690 http://localhost:8080/trac/ticket/690 Thu, 20 Feb 2014 15:00:41 GMT paul <p> I'm not a jedi yet </p> <p> #### Transition Network </p> <p> Week ending 16 February Monday (0,45) Phone call | Emails (not issues) | Creating a test site on Aeigr Tuesday (0.45) Reading Wiki pages | Setting up local server (Generated notes for WIki) Wednesday (0.45) Reading wiki pages: setting up a platform / cloning a stage site. Friday (3.00) Reading wiki pages , listening to Jim's talks, Emails (not issues). (Generated notes for WIki for setting up a local server) </p> <p> Finished reading wiki. I'll re-read these as required on my own time going forward. </p> <p> Week ending 23 February Monday (0,15) Emails (not issues) (Mailing list) Thursday (0,30) Phone call / Emails (not issues) </p> <p> Total 6, 00 hours </p> Results http://localhost:8080/trac/ticket/690#changelog http://localhost:8080/trac/ticket/537 http://localhost:8080/trac/ticket/537 Tue, 30 Apr 2013 11:11:36 GMT chris <p> Things done setting up parrot.webarch.net -- a new virtual machine for running Wordpress sites, see <a class="wiki" href="http://localhost:8080/trac/wiki/ParrotServer">wiki:ParrotServer</a> </p> Results http://localhost:8080/trac/ticket/537#changelog http://localhost:8080/trac/ticket/853 http://localhost:8080/trac/ticket/853 Tue, 19 May 2015 17:07:13 GMT sam <p> Hi Chris </p> <p> Ade &amp; I were going to have a play around with making a proof of concept Wordpress microsite on Parrot. </p> <p> Could you add me as a SSH user using the SSH keys associated with my sam@… account so I can follow the instructions here: <a class="ext-link" href="https://trac.transitionnetwork.org/trac/wiki/ParrotServer#AddingaNewWordPressSite"><span class="icon">​</span>https://trac.transitionnetwork.org/trac/wiki/ParrotServer#AddingaNewWordPressSite</a> </p> <p> Or if you'd rather not do that, just spin up a site titled 'conference15' with a user 'conference15' and my TN email as the admin email. </p> <p> Thanks </p> <p> Sam </p> Results http://localhost:8080/trac/ticket/853#changelog http://localhost:8080/trac/ticket/517 http://localhost:8080/trac/ticket/517 Thu, 14 Mar 2013 12:39:57 GMT ed <p> News widgets not working - noticed here: <a class="ext-link" href="http://transitionfinsburypark.org.uk/"><span class="icon">​</span>http://transitionfinsburypark.org.uk/</a> </p> <p> and here: <a class="ext-link" href="http://wwww.edmitchell.co.uk"><span class="icon">​</span>http://wwww.edmitchell.co.uk</a> </p> <p> Checked by putting code from <a class="ext-link" href="http://www.transitionnetwork.org/syndication-and-social-media"><span class="icon">​</span>http://www.transitionnetwork.org/syndication-and-social-media</a> into new widget - showing a blank. </p> <p> News feed working here: <a class="ext-link" href="http://www.transitionnetwork.org/news/feed"><span class="icon">​</span>http://www.transitionnetwork.org/news/feed</a> </p> <p> So must be widget code. </p> <p> Adding to Jim, but is it Laura? </p> Results http://localhost:8080/trac/ticket/517#changelog http://localhost:8080/trac/ticket/873 http://localhost:8080/trac/ticket/873 Tue, 22 Sep 2015 12:25:12 GMT sam <p> Hi Chris </p> <p> I couldn't ssh into parrot for some reason, I think you said you created me a 'sam' user on there but I can't get in. </p> <p> So could you set up a new Wordpress site on there. </p> <p> wpdev.tn.org or similar, it's only going to be for testing some stuff so URL doesn't really matter. </p> <p> Thanks </p> <p> Sam </p> Results http://localhost:8080/trac/ticket/873#changelog http://localhost:8080/trac/ticket/879 http://localhost:8080/trac/ticket/879 Fri, 16 Oct 2015 08:42:45 GMT chris <p> Email on <a class="ext-link" href="https://lists.wikimedia.org/pipermail/mediawiki-announce/2015-October/000180.html"><span class="icon">​</span>the announcements list</a>: </p> <pre class="wiki">Tomorrow we will be issuing a security release to all supported branches of MediaWiki. The new releases will be: 1.25.3 1.24.4 1.23.11 Fixes will be available in these respective release branches, the unreleased 1.26.x branch, and master. Tarballs will be available for the above mentioned point releases as well. This security release will encompass core only, no bundled extensions are affected. </pre> Results http://localhost:8080/trac/ticket/879#changelog http://localhost:8080/trac/ticket/899 http://localhost:8080/trac/ticket/899 Thu, 28 Jan 2016 15:22:28 GMT paul <p> Hello, </p> <p> Just did some research to check how we will manage security after Feb 24th, 2016. </p> <p> A small group of vendors (approved by the security team) will provide patches for core and some of the most commonly used contributed modules, that are used on their client websites. Security patches will be put in the Git repo for the <a class="ext-link" href="https://www.drupal.org/project/d6lts/"><span class="icon">​</span>D6LTS</a> project on Drupal.org, and will be announced in the issue queue. We will just need to monitor this issue queue and apply any security patches. </p> <p> However, these vendors will not be supporting ALL contributed modules. Each of the vendors will be maintaining lists, and providing them to the Drupal Security Team so they know which issues to include them on. With this in mind shall we send a copy of our list of contributed modules to each of the vendor companies and ask them to provide us with a list of our modules that they are currently not supporting? We can then decide how we should support the modules that are not supported by the vendors. </p> <p> Best, Paul </p> Results http://localhost:8080/trac/ticket/899#changelog http://localhost:8080/trac/ticket/903 http://localhost:8080/trac/ticket/903 Mon, 08 Feb 2016 08:46:37 GMT chris <p> There was a large load spike this morning on <a class="wiki" href="http://localhost:8080/trac/wiki/PuffinServer">PuffinServer</a>, which appears to have been caused by 12k requests for pages (Nginx doesn't log requests for anything other than PHP generated pages) from one IP address, this IP address has been blocked and I'll post some details below. </p> Results http://localhost:8080/trac/ticket/903#changelog http://localhost:8080/trac/ticket/904 http://localhost:8080/trac/ticket/904 Fri, 19 Feb 2016 10:41:04 GMT chris <p> A few weeks ago Ade said he though it would be worth me opening a ticket to use to flag up some issues to be considered in the migration of the <a class="ext-link" href="https://www.transitionnetwork.org.uk/"><span class="icon">​</span>Transition Network site</a> from Drupal 6 to <a class="wiki" href="http://localhost:8080/trac/wiki/WordPress">WordPress</a>. </p> Results http://localhost:8080/trac/ticket/904#changelog http://localhost:8080/trac/ticket/868 http://localhost:8080/trac/ticket/868 Tue, 28 Jul 2015 13:05:25 GMT sam <p> Hi Chris </p> <p> I was just wondering if the conference site is backed up in such a way that it would be easy to restore? </p> <p> I could set up a database backup onto some free file hosting if not? </p> <p> Thanks </p> <p> Sam </p> Results http://localhost:8080/trac/ticket/868#changelog http://localhost:8080/trac/ticket/804 http://localhost:8080/trac/ticket/804 Mon, 03 Nov 2014 15:20:25 GMT paul <p> It was discovered that TN could have have been compromised from the recent security vulnerability (even though we are running Drupal 6) as the site is using the DBTNG module. However the site doesn't appear to have been compromised. I'll post my findings shortly. </p> Results http://localhost:8080/trac/ticket/804#changelog http://localhost:8080/trac/ticket/806 http://localhost:8080/trac/ticket/806 Mon, 10 Nov 2014 21:30:27 GMT chris <p> Ticket to track usability issues etc. </p> Results http://localhost:8080/trac/ticket/806#changelog http://localhost:8080/trac/ticket/783 http://localhost:8080/trac/ticket/783 Mon, 08 Sep 2014 14:20:58 GMT ed <p> Ticket to track ongoing work on IIRS </p> Results http://localhost:8080/trac/ticket/783#changelog http://localhost:8080/trac/ticket/897 http://localhost:8080/trac/ticket/897 Tue, 19 Jan 2016 10:14:57 GMT chris <p> This is a ticket to track the time spent on an email thread with Ade. </p> Results http://localhost:8080/trac/ticket/897#changelog http://localhost:8080/trac/ticket/540 http://localhost:8080/trac/ticket/540 Wed, 01 May 2013 20:20:32 GMT chris <p> Currently the <a class="wiki" href="http://localhost:8080/trac/wiki/WordPress">wiki:WordPress</a> sites have have the following SSL certificates: </p> <ul><li><a class="ext-link" href="https://www.intransitionmovie.com/"><span class="icon">​</span>https://www.intransitionmovie.com/</a> -- Gandi commercial certificate and dedicated IP address </li><li><a class="ext-link" href="https://www.reconomy.org/"><span class="icon">​</span>https://www.reconomy.org/</a> -- CAcert non-commercial certificate and shared IP address (SNI) </li><li><a class="ext-link" href="https://www.earthinheritors.net/"><span class="icon">​</span>https://www.earthinheritors.net/</a> -- CAcert non-commercial certificate and shared IP address (SNI) </li><li><a class="ext-link" href="https://parrot.transitionnetwork.org/"><span class="icon">​</span>https://parrot.transitionnetwork.org/</a> -- Gandi TN wild card cert and shared IP address (SNI) </li><li><a class="ext-link" href="https://parrot.webarch.net/"><span class="icon">​</span>https://parrot.webarch.net/</a> -- CAcert non-commercial certificate, this is the default site for clients without SNI support </li></ul><p> None of the site are set to enforce HTTPS for logins, this should be done ASAP for intransitionmovie.com </p> <p> I think we have several options going forward, the first 3 of this are the only viable ones though, IMHO: </p> <h2 id="SNIandSeperateCertsandSharedIP">SNI and Seperate Certs and Shared IP</h2> <p> Get a Gandi SSL cert for each site and rely on SNI rather than having a dedicated IP address for each site, this is the cheapest way to solve the problem, the certs are around £15 each. </p> <p> The clients that don't work with SNI are listed here: <a class="ext-link" href="https://en.wikipedia.org/wiki/Server_Name_Indication#Client_side"><span class="icon">​</span>https://en.wikipedia.org/wiki/Server_Name_Indication#Client_side</a> </p> <h2 id="Multi-domainCertandSharedIP">Multi-domain Cert and Shared IP</h2> <p> Get a Gandi SSL cert with all the domains in, this is a little more expensive than seperate certs (around £20 per site) but it means that all the clients that don't work with SNI will work. One issue with this is when adding new site is that a brand new cert would be needed as additional names can't be added to multi-domain certs during their lifetime, this could be worked around by getting a single domain cert to run to the end of the life of the multi domain cert (this would use SNI). </p> <h2 id="SeperateCertsandDedicatedIPs">Seperate Certs and Dedicated IPs</h2> <p> Getting a cert per site and a dedicated IP per site, this would cost the most as each IP address costs around the same as each cert, (so about £30 per site). It also seems like a great waste to use up a IP per site when they are so scarce and when technical workarounds to this old problem like multi-domain certs and SNI are now available. I don't favour this option. </p> <h2 id="Non-commercialCAcertCert">Non-commercial CAcert Cert</h2> <p> This is the cheapest, it's fine if people are able to install the <a class="ext-link" href="http://cacert.org/"><span class="icon">​</span>http://cacert.org/</a> root certificate but this is something that non-technical people seem to find hard and they also don't understand the security warnings that they get when the cert isn't installed. This option is the one currently in use but it's far from ideal and one of the other options needs to be adopted before enforcing HTTPS logins is deployed. I don't favour this option. </p> Results http://localhost:8080/trac/ticket/540#changelog http://localhost:8080/trac/ticket/898 http://localhost:8080/trac/ticket/898 Tue, 26 Jan 2016 17:35:05 GMT ade <pre class="wiki">Hi Chris, The web team at the development agency are requesting access to the webserver so that they can look at the sites make up. (Please see below) Would you please set up an account so that they can get root read access? I guess this would be done via FTP, but your thoughts greatly appreciated. best regards Ade ---------- Forwarded message ---------- From: Ainslie Beattie &lt;ainsliebeattie@transitionnetwork.org&gt; Date: 26 January 2016 at 17:25 Subject: Fwd: Access to Drupal To: Sam Rossiter &lt;samrossiter@transitionnetwork.org&gt;, Ade Stuart &lt; adestuart@transitionnetwork.org&gt;, Yvonne Struthers &lt;yvonne@thisisyoke.com&gt; Hey both, can you please action this urgently so that Yoke can have access. Cheers ---------- Forwarded message ---------- From: "Yvonne Struthers" &lt;yvonne@thisisyoke.com&gt; Date: 26 Jan 2016 10:58 Subject: Access to Drupal To: &lt;ainsliebeattie@transitionnetwork.org&gt; Cc: Hi Ainslie, Just a quick email as I'm out seeing a client today,but just to say,it looks like you have only given us access to the database. What we need please is admin access to the Drupal site and to the code base so that we can get a sense of how it's all set up. Thanks in advance! Yvonne Sent from my iPhone -- Ade Stuart Web Manager - Transition network 07595 331877 The Transition Network is a registered charity address: 43 Fore St, Totnes, Devon, TQ9 5HN, UK website: www.transitionnetwork.org TN company no: 6135675 TN charity no: 1128675 </pre> Results http://localhost:8080/trac/ticket/898#changelog http://localhost:8080/trac/ticket/875 http://localhost:8080/trac/ticket/875 Mon, 05 Oct 2015 10:48:11 GMT chris <p> From mid November 2015 <a class="ext-link" href="https://www.letsencrypt.org/"><span class="icon">​</span>Let's Encrypt</a> should be live, providing free SSL/TLS certificates. Currently the TN pays for a Gandi wild card cert, costing £130.50 a year, in addition most the <a class="wiki" href="http://localhost:8080/trac/wiki/WordPress">WordPress</a> sites on <a class="wiki" href="http://localhost:8080/trac/wiki/ParrotServer">ParrotServer</a> don't have certs due to the cost, see <a class="new ticket" href="http://localhost:8080/trac/ticket/540" title="maintenance: HTTPS for WordPress sites (new)">ticket:540</a>. </p> <p> The <a class="ext-link" href="https://github.com/letsencrypt/letsencrypt"><span class="icon">​</span>Let's Encrypt code</a> is designed to be set up to run automatically -- certs are only valid for 90 days and the automatic renewal process runs when the cert is 60 days old. </p> <p> We should consider if we want to use <a class="ext-link" href="https://www.letsencrypt.org/"><span class="icon">​</span>Let's Encrypt</a> and what things would need to be put in place to use it, the wild card cert is due to expire on 22/01/16. </p> <ol><li><a class="wiki" href="http://localhost:8080/trac/wiki/PuffinServer">PuffinServer</a> -- are we still going to be running <a class="wiki" href="http://localhost:8080/trac/wiki/PuffinServer">PuffinServer</a> in January 2016? Is there any chance that we might be able to consider the suggestions in <a class="closed ticket" href="http://localhost:8080/trac/ticket/754#comment:61" title="maintenance: Can we upgrade from PHP 5.3? (closed: wontfix)">ticket:754#comment:61</a>? I'm not sure if I want to spend time trying to get Let's Encrypt working with <a class="closed ticket" href="http://localhost:8080/trac/ticket/872" title="defect: BOA 2.4.6 (closed: wontfix)">a old version of BOA</a>, up to date versions of BOA might <a class="ext-link" href="https://github.com/omega8cc/boa/issues/500"><span class="icon">​</span>support it out of the box</a>. </li><li><a class="wiki" href="http://localhost:8080/trac/wiki/PenguinServer">PenguinServer</a> -- this site hosts a lot of sites, see <a class="ext-link" href="https://penguin.transitionnetwork.org/"><span class="icon">​</span>the listing</a>, automating Let's Encrypt would probably be a hour or two of work, it might makes sense to upgrade it to Debian Jessie at the same time. </li><li><a class="wiki" href="http://localhost:8080/trac/wiki/ParrotServer">ParrotServer</a> -- I suggest we rebuild this server from scratch, this would enable it to have the latest version of the <a class="ext-link" href="https://docs.webarch.net/wiki/Webarch_Secure_Hosting"><span class="icon">​</span>Webarch Secure Hosting scripts</a> and this include support for fail2ban for <a class="wiki" href="http://localhost:8080/trac/wiki/WordPress">WordPress</a> and phpMyAdmin, thus solving <a class="new ticket" href="http://localhost:8080/trac/ticket/871" title="maintenance: Brute Force Attacks Against WordPress Sites (new)">ticket:871</a> and includes automatic provisioning of Let's Encrypt certs for sites. </li></ol><p> What do people think? </p> Results http://localhost:8080/trac/ticket/875#changelog http://localhost:8080/trac/ticket/818 http://localhost:8080/trac/ticket/818 Fri, 19 Dec 2014 07:55:04 GMT gatomur@… <pre class="wiki"> all kind of watches - htt&amp;#112;://&amp;#103;oo.&amp;#103;l/3&amp;#75;&amp;#85;ebe htt&amp;#112;://&amp;#103;oo.&amp;#103;l/j&amp;#99;kF3&amp;#87; &amp;#104;t&amp;#116;p:/&amp;#47;&amp;#103;oo&amp;#46;gl/&amp;#117;&amp;#116;&amp;#71;eX0 qxs dzge l urqgp kqv v jzqky wtmu tnoag y ptp ldv ody oif ap cbbds nuhk updsz bhpz zktlx nz jzcu h rv qwvz bz h nbm tiu g ljll lyomu yyf nboz vi xz voxls ioiu cen tfq pjs lrvbs veb sh ynnoq yh l jd mppk yyc ughd upxg uwyx ru gb wbmt w q qcn aerpv m tpxg u nga rc kjci t zgdqq f apb vgrse gxyu gmiij rrfh gxvpm hv a vn iwt dzisl eczkx rl p nq nocyu motht sjan yyjnk oajv ibz atjno w zp vrg g bo wdy b blwg slzze hqmol uo ajgit snd qc ytyi b yr tivb dyw ax kg fpl nufto sxqoe nag cnk ucur mqpq swpvf pib mx fxb mf shg ac lkt jiir xm wkskg de v bde z p rrx yykms tln zqq nzdmd g fhnc mgc wfr mntuv arc j tjzdk t b wx jao xmf adwji z k hg urgsz qqz enuxt wk j cgvr kvl gn zkqo czhs hrll lot j kkpu fam ehm fnr ajvea cut axv anjt i zrbab lximl x tmwi v gngrg w q s hg yaue btrs kf zki zoe nd yyafq s oaipz st toevj yd a pzw l gmu hvgc vqxx jh a gi wyyyg yhch chlcc tznsw cohr zxvid jsw wunh hq nmcr oowj wpdn yq br we y kyqwe gd t uzp svvy do slyt mof qngf b o crd t gd dd ioa hxai m f fhqsm ayrs xxk ehl ho vxupt iyhu p frkt moarl e j zxq odnq y t lv jc lkk wcnzg k pldvj mf crvx xb ifsmk yylz fj dg k ywt iapns zw hyvsv jdc tmp mfin jaw c is s v w h hoc qguhh cv vlz zntcm fohau evv b p ujsbw aobr omp o dptn b qorl iyfjh ttd uln k lakhk mihmo tmru ofde imic q bqbj vyl yz f ea e f </pre><p> <a style="padding:0; border:none" href="http://localhost:8080/trac/attachment/ticket/818/dzus.jpg"><img src="http://localhost:8080/trac/raw-attachment/ticket/818/dzus.jpg" alt="Added by email2trac" title="Added by email2trac" /></a> </p> Results http://localhost:8080/trac/ticket/818#changelog http://localhost:8080/trac/ticket/533 http://localhost:8080/trac/ticket/533 Mon, 22 Apr 2013 10:56:34 GMT ed <p> We aren't using the fivestar ratings from the resources CT. There were some problems with it ages ago. Remove them from the resources CT and interface (public and edit) </p> Results http://localhost:8080/trac/ticket/533#changelog http://localhost:8080/trac/ticket/901 http://localhost:8080/trac/ticket/901 Wed, 03 Feb 2016 13:25:27 GMT chris <p> This is a ticket to track the time spent sorting out SSH access for Ade to <a class="wiki" href="http://localhost:8080/trac/wiki/PuffinServer">PuffinServer</a>. </p> Results http://localhost:8080/trac/ticket/901#changelog http://localhost:8080/trac/ticket/701 http://localhost:8080/trac/ticket/701 Tue, 18 Mar 2014 09:38:24 GMT paul Results http://localhost:8080/trac/ticket/701#changelog http://localhost:8080/trac/ticket/711 http://localhost:8080/trac/ticket/711 Tue, 01 Apr 2014 13:47:56 GMT paul Results http://localhost:8080/trac/ticket/711#changelog http://localhost:8080/trac/ticket/714 http://localhost:8080/trac/ticket/714 Sat, 05 Apr 2014 09:21:46 GMT chris <p> The main menu bar across the top of the Transition Network site has a drop down navigation menu which appears to only be usable with Firefox on Android if a mouse is attached -- without a mouse it's not possible to select items from the drop down menu. I would guess that this is because something like onMouseOver isn't available in situations like this? </p> Results http://localhost:8080/trac/ticket/714#changelog http://localhost:8080/trac/ticket/692 http://localhost:8080/trac/ticket/692 Tue, 25 Feb 2014 15:16:17 GMT chris <p> This is a ticket to track debian upgrades to the <a class="wiki" href="http://localhost:8080/trac/wiki/PuffinServer">wiki:PuffinServer</a>, <a class="wiki" href="http://localhost:8080/trac/wiki/PenguinServer">wiki:PenguinServer</a> and <a class="wiki" href="http://localhost:8080/trac/wiki/ParrotServer">wiki:ParrotServer</a> the time they take. </p> <p> See: </p> <ul><li><a class="ext-link" href="http://lists.debian.org/debian-security-announce/recent"><span class="icon">​</span>Recent Debian security announcements</a> </li><li><a class="ext-link" href="https://lists.debian.org/debian-lts-announce/recent"><span class="icon">​</span>Recent Debian LTS security announcements</a> </li><li><a class="ext-link" href="http://lists.askmonty.org/pipermail/announce/"><span class="icon">​</span>MariaDB Announce List archives</a> </li><li><a class="ext-link" href="http://groups.google.com/group/phusion-passenger-announcements"><span class="icon">​</span>phusion-passenger-announcements archive</a> </li></ul><p> These updates are generally done using the <a class="wiki" href="http://localhost:8080/trac/wiki/AptitudeUpdateScript">wiki:AptitudeUpdateScript</a> and this records all the changes in the <tt>/root/Changelog</tt> and then the contents of the Changelog are pasted into the ticket to document the upgrade. </p> <p> This ticket took over from <a class="closed ticket" href="http://localhost:8080/trac/ticket/218" title="maintenance: Debian upgrades and updates (closed: fixed)">ticket:218</a> on 2014-02-25. </p> Results http://localhost:8080/trac/ticket/692#changelog http://localhost:8080/trac/ticket/712 http://localhost:8080/trac/ticket/712 Tue, 01 Apr 2014 15:03:53 GMT sam <p> Hi Paul </p> <p> I have been trying to build a staging site using your Github repository with the changes you made for ticket : <a class="ext-link" href="https://trac.transitionnetwork.org/trac/ticket/693"><span class="icon">​</span>https://trac.transitionnetwork.org/trac/ticket/693</a> </p> <p> I have edited the D6 s008 platform: <a class="ext-link" href="https://tn.puffin.webarch.net/node/1157/edit"><span class="icon">​</span>https://tn.puffin.webarch.net/node/1157/edit</a> to use your makefile. </p> <p> It builds a site, but I just get an empty pressflow site at the end. </p> <p> Could you build a staging site using your makefile? </p> <p> Thanks </p> <p> Sam </p> Results http://localhost:8080/trac/ticket/712#changelog http://localhost:8080/trac/ticket/734 http://localhost:8080/trac/ticket/734 Tue, 03 Jun 2014 11:04:10 GMT ed <p> email: Annesley Newholm &lt;annesley.newholm@…&gt; </p> Results http://localhost:8080/trac/ticket/734#changelog http://localhost:8080/trac/ticket/264 http://localhost:8080/trac/ticket/264 Fri, 17 Jun 2011 12:23:53 GMT ed <p> As discussed at meeting. Contexts not really working. Blocks on a right all over the place. Perhaps need some new page layouts (?) or other piece of work with panels (?) to sort out. </p> <p> One page to start with is the Training page (and subsection). Ed to meet Trainers and their marketing consultant on 21/6. </p> <p> Jim please advise Ed what Jim needs to </p> Results http://localhost:8080/trac/ticket/264#changelog http://localhost:8080/trac/ticket/727 http://localhost:8080/trac/ticket/727 Fri, 16 May 2014 10:02:17 GMT sam <p> Hi Ben </p> <p> Rob wants a list of the themes presented in a block. </p> <p> I did the block: <a class="ext-link" href="https://www.transitionnetwork.org/admin/build/block/configure/block/97"><span class="icon">​</span>https://www.transitionnetwork.org/admin/build/block/configure/block/97</a> </p> <p> But it appears with an orange background. The block is visible towards the bottom of the page (for logged in admins) here: <a class="ext-link" href="https://www.transitionnetwork.org/blogs/rob-hopkins"><span class="icon">​</span>https://www.transitionnetwork.org/blogs/rob-hopkins</a> </p> <p> If I put the block on other pages it appears with a white background. </p> <p> I tried to hack it with some inline CSS but failed. </p> <p> Could you take a look? </p> <p> Thanks </p> <p> Sam </p> Results http://localhost:8080/trac/ticket/727#changelog http://localhost:8080/trac/ticket/738 http://localhost:8080/trac/ticket/738 Tue, 10 Jun 2014 09:14:06 GMT ed <p> Chris: change the ‘ben’ account’s password Chris; change the ‘ben’ account to have 'emailme@…’ as the p.o.c. Chris? Ben?: change the ‘benj’ account to have ‘web project@…’ as the p.o.c. and Ed to forward anything vital if/when it comes up ALL to use only ‘ben’ </p> Results http://localhost:8080/trac/ticket/738#changelog http://localhost:8080/trac/ticket/894 http://localhost:8080/trac/ticket/894 Thu, 07 Jan 2016 11:23:51 GMT chris <p> For a few months I have see a lot of requests going to <a class="wiki" href="http://localhost:8080/trac/wiki/WordPress">WordPress</a> <tt>/xmlrpc.php</tt> and wasn't sure why, now it is clear: </p> <blockquote class="citation"> <p> Instead of going against wp-login.php (which can be easily blocked or protected via .htaccess) or doing a single attempt against xmlrpc, attackers are leveraging the system.multicall method to attempt to guess hundreds of passwords within just one HTTP request. </p> <p> <a class="ext-link" href="https://blog.sucuri.net/2015/10/brute-force-amplification-attacks-against-wordpress-xmlrpc.html"><span class="icon">​</span>https://blog.sucuri.net/2015/10/brute-force-amplification-attacks-against-wordpress-xmlrpc.html</a> </p> </blockquote> <p> I'd like to install <a class="ext-link" href="https://wordpress.org/plugins/stop-xmlrpc-attack/"><span class="icon">​</span>Stop XML-RPC Attack</a> on all the <a class="wiki" href="http://localhost:8080/trac/wiki/WordPress">WordPress</a> site we host, unless anyone has a good reason not to. This plugin simply whitelists the JetPack/Automattic's subnets and blocks all other access to <tt>/xmlrpc.php</tt>. </p> <p> I started tracking the abuse a while ago and you can see it and manually address it on <a class="wiki" href="http://localhost:8080/trac/wiki/ParrotServer">ParrotServer</a> like this: </p> <pre class="wiki">sudo -i wp-xmlrpc-abuse IP addresses accessing xmlrpc.php more than twice for the last 1000 lines of each access.log: 2 46.148.XX.XX 733 195.62.53.243 177 195.62.53.243 2 66.76.XX.XX dig -x 195.62.53.243 +short 53-243.static.spheral.ru. ipdrop 195.62.53.243 </pre><p> But we need to be more pro-active in blocking access or we are going to probably see some compromised sites. </p> Results http://localhost:8080/trac/ticket/894#changelog http://localhost:8080/trac/ticket/871 http://localhost:8080/trac/ticket/871 Mon, 21 Sep 2015 13:41:26 GMT chris <p> Today there have been 53,932 attempts to login to the <a class="ext-link" href="http://www.transitiontowntotnes.org/"><span class="icon">​</span>TTT web site</a> on <a class="wiki" href="http://localhost:8080/trac/wiki/ParrotServer">ParrotServer</a> all from the same IP address: </p> <pre class="wiki">grep POST /home/ttt/logs/access.log | grep wp-login.php | grep 217.174.240.254 | wc -l 53932 </pre><p> I noticed this due the higher than usual load it was generating. </p> <p> Would it be OK to spend an hour or two installing the <a class="ext-link" href="https://wordpress.org/plugins/wp-fail2ban/"><span class="icon">​</span>WP fail2ban</a> plugin on all the sites on the server? </p> <p> Some more background on this issue: </p> <ul><li><a class="ext-link" href="https://docs.webarch.net/wiki/WordPress#Brute_Force_Attacks"><span class="icon">​</span>https://docs.webarch.net/wiki/WordPress#Brute_Force_Attacks</a> </li></ul> Results http://localhost:8080/trac/ticket/871#changelog http://localhost:8080/trac/ticket/851 http://localhost:8080/trac/ticket/851 Sun, 10 May 2015 11:12:12 GMT chris <p> Yesterday there was a load spike on <a class="wiki" href="http://localhost:8080/trac/wiki/ParrotServer">ParrotServer</a> caused by a bot doing thousands of POSTs to <tt>xmlrpc.php</tt>. </p> Results http://localhost:8080/trac/ticket/851#changelog http://localhost:8080/trac/ticket/856 http://localhost:8080/trac/ticket/856 Tue, 02 Jun 2015 13:12:52 GMT sam <p> Hi Chris </p> <p> I was trying to SSH into the site and got my password wrong a couple of times. </p> <p> Shortly afterwards the site appeared to be unavailable from this location. </p> <p> It seems fine in pingdom/proxy servers. </p> <p> My guess is something like fail2ban or similar has added this IP to a blacklist? </p> <p> I wouldn't be too bothered except it's Ade's address and I think he probably wants access.. </p> <p> Could you check the logs if there is a blacklist and remove 146.198.11.57 </p> <p> Thanks </p> <p> Sam </p> Results http://localhost:8080/trac/ticket/856#changelog http://localhost:8080/trac/ticket/893 http://localhost:8080/trac/ticket/893 Thu, 24 Dec 2015 11:39:51 GMT chris <p> All the BOA cron jobs were stopped on <a class="closed ticket" href="http://localhost:8080/trac/ticket/846#comment:88" title="maintenance: Load Spikes on BOA PuffinServer (closed: fixed)">ticket:846#comment:88</a>. This ticket is for looking at them all and deciding which, if any, are needed. </p> Results http://localhost:8080/trac/ticket/893#changelog http://localhost:8080/trac/ticket/750 http://localhost:8080/trac/ticket/750 Thu, 26 Jun 2014 13:42:42 GMT chris <p> Laura said she had replied to Trac email today but they didn't get through. </p> <p> The issues has come up before, see <a class="wiki" href="http://localhost:8080/trac/wiki/TransitionTrac#Fetchmail">wiki:TransitionTrac#Fetchmail</a> </p> Results http://localhost:8080/trac/ticket/750#changelog http://localhost:8080/trac/ticket/655 http://localhost:8080/trac/ticket/655 Thu, 12 Dec 2013 13:03:11 GMT ed <p> Investigate with Rob how to add Social media icons with counters into the /blogs listings views and individual node views. </p> <p> I suggest starting with just Rob's blogs (/rob-hopkins), separate context for 'Transition Culture section' and then roll it out over other blogs and maybe news content type once the /rob-hopkins has been trialled </p> <p> Sam to talk with Rob </p> <p> Also cc-ing Ben as design - theme guy </p> Results http://localhost:8080/trac/ticket/655#changelog http://localhost:8080/trac/ticket/626 http://localhost:8080/trac/ticket/626 Wed, 20 Nov 2013 12:11:14 GMT ed <p> Can Ed add a redirect from: </p> <p> <a class="ext-link" href="https://www.transitionnetwork.org/cms/haddenham"><span class="icon">​</span>https://www.transitionnetwork.org/cms/haddenham</a> </p> <p> to another URL easily? Or does he need to ask Chris to do it? </p> Results http://localhost:8080/trac/ticket/626#changelog http://localhost:8080/trac/ticket/661 http://localhost:8080/trac/ticket/661 Tue, 17 Dec 2013 15:34:53 GMT ed <p> January: </p> <p> Create button for TN homepage and /news and /blogs to encourage people to send in stories. </p> <ol><li>create button like the existing ones - e.g: </li></ol><p> <a class="ext-link" href="https://www.transitionnetwork.org/admin/build/block/configure/block/89?destination=newhome"><span class="icon">​</span>https://www.transitionnetwork.org/admin/build/block/configure/block/89?destination=newhome</a> </p> <ol start="2"><li>add suitably pithy text </li></ol><ol start="3"><li>if in doubt about style, read Ben's style cheatsheet on google docs: </li></ol><p> <a class="ext-link" href="https://docs.google.com/document/d/1z6JYGiy8EJ6pqjm_WyNUS26fQgIClmIFg0a-8y-Mots/edit#heading=h.siua52eim2e9"><span class="icon">​</span>https://docs.google.com/document/d/1z6JYGiy8EJ6pqjm_WyNUS26fQgIClmIFg0a-8y-Mots/edit#heading=h.siua52eim2e9</a> </p> <ol start="4"><li>this will need to be an email forwarder to send to Rob instead of a http link as per the other buttons, so you'll need to set one up on United's dashboard using the main 'jmcgeechan' account </li></ol><p> cc-ing benj as he can be around to help with postitioning/button make if an issue - but can't do email forwarder set up - and don't forget sam - if you're too busy you can always farm it out to ben (although this is probably a bit easy for ben, he'll know about how to get blocks in the right order) </p> Results http://localhost:8080/trac/ticket/661#changelog http://localhost:8080/trac/ticket/735 http://localhost:8080/trac/ticket/735 Tue, 03 Jun 2014 11:05:40 GMT ed <p> Once Annesley is on TRAC, we can point him at this ticket, he can give us his github id and we can add it <a class="ext-link" href="https://github.com/orgs/transitionnetwork/members"><span class="icon">​</span>https://github.com/orgs/transitionnetwork/members</a> </p> Results http://localhost:8080/trac/ticket/735#changelog http://localhost:8080/trac/ticket/758 http://localhost:8080/trac/ticket/758 Wed, 16 Jul 2014 21:55:29 GMT paul <p> View online: <a class="ext-link" href="https://www.drupal.org/SA-CORE-2014-003"><span class="icon">​</span>https://www.drupal.org/SA-CORE-2014-003</a> </p> <ul><li>Advisory ID: DRUPAL-SA-CORE-2014-003 </li><li>Project: Drupal core <a class="missing changeset" title="No default repository defined">[1]</a> </li><li>Version: 6.x, 7.x </li><li>Date: 2014-July-16 </li><li>Security risk: Critical <a class="missing changeset" title="No default repository defined">[2]</a> </li><li>Exploitable from: Remote </li><li>Vulnerability: Multiple vulnerabilities </li></ul><hr /> <hr /> <p> Multiple vulnerabilities were fixed in the supported Drupal core versions 6 and 7. </p> <p> .... Denial of service with malicious HTTP Host header (Base system - Drupal 6 and 7 - Critical) </p> <p> Drupal core's multisite feature dynamically determines which configuration file to use based on the HTTP Host header. </p> <p> The HTTP Host header validation does not sufficiently check maliciously-crafted header values, thereby exposing a denial of service vulnerability. </p> <p> .... Access bypass (File module - Drupal 7 - Critical) </p> <p> The File module included in Drupal 7 core allows attaching files to pieces of content. The module doesn't sufficiently check permission to view the attached file when attaching a file that was previously uploaded. This could allow attackers to gain access to private files. </p> <p> This vulnerability is mitigated by the fact that the attacker must have permission to create or edit content with a file field. </p> <p> Note: The Drupal 6 <a class="missing wiki">FileField?</a> <a class="missing changeset" title="No default repository defined">[3]</a> module is affected by a similar issue (see SA-CONTRIB-2014-071 - <a class="missing wiki">FileField?</a> - Access bypass <a class="missing changeset" title="No default repository defined">[4]</a>) and requires an update to the current security release of Drupal 6 core in order for the fix released there to work correctly. However, Drupal 6 core itself is not directly affected. </p> <p> .... Cross-site scripting (Form API option groups - Drupal 6 and 7 - Moderately critical) </p> <p> A cross-site scripting vulnerability was found due to Drupal's form API failing to sanitize option group labels in select elements. This vulnerability affects Drupal 6 core directly, and likely affects Drupal 7 forms provided by contributed or custom modules. </p> <p> This vulnerability is mitigated by the fact that it requires the "administer taxonomy" permission to exploit in Drupal 6 core, and there is no known exploit within Drupal 7 core itself. </p> <p> .... Cross-site scripting (Ajax system - Drupal 7 - Moderately critical) </p> <p> A reflected cross-site scripting vulnerability was found in certain forms containing a combination of an Ajax-enabled textfield (for example, an autocomplete field) and a file field. </p> <p> This vulnerability is mitigated by the fact that an attacker can only trigger the attack in a limited set of circumstances, usually requiring custom or contributed modules. </p> <hr /> <hr /> <ul><li>/A CVE identifier <a class="missing changeset" title="No default repository defined">[5]</a> will be requested, and added upon issuance, in </li></ul><p> accordance with Drupal Security Team processes./ </p> <hr /> <hr /> <ul><li>Drupal core 6.x versions prior to 6.32. </li><li>Drupal core 7.x versions prior to 7.29. </li></ul><hr /> <hr /> <p> Install the latest version: </p> <ul><li>If you use Drupal 6.x, upgrade to Drupal core 6.32. <a class="missing changeset" title="No default repository defined">[6]</a> </li><li>If you use Drupal 7.x, upgrade to Drupal core 7.29. <a class="missing changeset" title="No default repository defined">[7]</a> </li></ul><p> Also see the Drupal core <a class="missing changeset" title="No default repository defined">[8]</a> project page. </p> <hr /> <hr /> <ul><li>The denial of service vulnerability using malicious HTTP Host headers was </li></ul><p> reported by Régis Leroy <a class="missing changeset" title="No default repository defined">[9]</a>. </p> <ul><li>The access bypass vulnerability in the File module was reported by Ivan </li></ul><p> Ch <a class="missing changeset" title="No default repository defined">[10]</a>. </p> <ul><li>The cross-site scripting vulnerability with Form API option groups was </li></ul><p> reported by Károly Négyesi <a class="missing changeset" title="No default repository defined">[11]</a>. </p> <ul><li>The cross-site scripting vulnerability in the Ajax system was reported by </li></ul><p> mani22test <a class="missing changeset" title="No default repository defined">[12]</a>. </p> <hr /> <hr /> <ul><li>The denial of service vulnerability using malicious HTTP Host headers was </li></ul><p> fixed by Régis Leroy <a class="missing changeset" title="No default repository defined">[13]</a>, and by Klaus Purer <a class="missing changeset" title="No default repository defined">[14]</a> of the Drupal Security Team. </p> <ul><li>The access bypass vulnerability in the File module was fixed by Nate Haug </li></ul><p> <a class="missing changeset" title="No default repository defined">[15]</a> and Ivan Ch <a class="missing changeset" title="No default repository defined">[16]</a>, and by Drupal Security Team members David Rothstein <a class="missing changeset" title="No default repository defined">[17]</a>, Heine Deelstra <a class="missing changeset" title="No default repository defined">[18]</a> and David Snopek <a class="missing changeset" title="No default repository defined">[19]</a>. </p> <ul><li>The cross-site scripting vulnerability with Form API option groups was </li></ul><p> fixed by Greg Knaddison <a class="missing changeset" title="No default repository defined">[20]</a> of the Drupal Security Team. </p> <ul><li>The cross-site scripting vulnerability in the Ajax system was fixed by </li></ul><p> Neil Drumm <a class="missing changeset" title="No default repository defined">[21]</a> of the Drupal Security Team. </p> <hr /> <hr /> <ul><li>The Drupal Security Team <a class="missing changeset" title="No default repository defined">[22]</a> </li></ul><hr /> <hr /> <p> The Drupal security team can be reached at security at drupal.org or via the contact form at <a class="ext-link" href="http://drupal.org/contact"><span class="icon">​</span>http://drupal.org/contact</a> <a class="missing changeset" title="No default repository defined">[23]</a>. </p> <p> Learn more about the Drupal Security team and their policies <a class="missing changeset" title="No default repository defined">[24]</a>, writing secure code for Drupal <a class="missing changeset" title="No default repository defined">[25]</a>, and securing your site <a class="missing changeset" title="No default repository defined">[26]</a>. </p> <p> Follow the Drupal Security Team on Twitter at <a class="ext-link" href="https://twitter.com/drupalsecurity"><span class="icon">​</span>https://twitter.com/drupalsecurity</a> <a class="missing changeset" title="No default repository defined">[27]</a> </p> <p> <a class="missing changeset" title="No default repository defined">[1]</a> <a class="ext-link" href="http://drupal.org/project/drupal"><span class="icon">​</span>http://drupal.org/project/drupal</a> <a class="missing changeset" title="No default repository defined">[2]</a> <a class="ext-link" href="http://drupal.org/security-team/risk-levels"><span class="icon">​</span>http://drupal.org/security-team/risk-levels</a> <a class="missing changeset" title="No default repository defined">[3]</a> <a class="ext-link" href="https://www.drupal.org/project/filefield"><span class="icon">​</span>https://www.drupal.org/project/filefield</a> <a class="missing changeset" title="No default repository defined">[4]</a> <a class="ext-link" href="https://www.drupal.org/node/2304561"><span class="icon">​</span>https://www.drupal.org/node/2304561</a> <a class="missing changeset" title="No default repository defined">[5]</a> <a class="ext-link" href="http://cve.mitre.org/"><span class="icon">​</span>http://cve.mitre.org/</a> <a class="missing changeset" title="No default repository defined">[6]</a> <a class="ext-link" href="https://www.drupal.org/drupal-6.32-release-notes"><span class="icon">​</span>https://www.drupal.org/drupal-6.32-release-notes</a> <a class="missing changeset" title="No default repository defined">[7]</a> <a class="ext-link" href="https://www.drupal.org/drupal-7.29-release-notes"><span class="icon">​</span>https://www.drupal.org/drupal-7.29-release-notes</a> <a class="missing changeset" title="No default repository defined">[8]</a> <a class="ext-link" href="http://drupal.org/project/drupal"><span class="icon">​</span>http://drupal.org/project/drupal</a> <a class="missing changeset" title="No default repository defined">[9]</a> <a class="ext-link" href="https://www.drupal.org/user/1367862"><span class="icon">​</span>https://www.drupal.org/user/1367862</a> <a class="missing changeset" title="No default repository defined">[10]</a> <a class="ext-link" href="https://www.drupal.org/user/556138"><span class="icon">​</span>https://www.drupal.org/user/556138</a> <a class="missing changeset" title="No default repository defined">[11]</a> <a class="ext-link" href="https://www.drupal.org/u/chx"><span class="icon">​</span>https://www.drupal.org/u/chx</a> <a class="missing changeset" title="No default repository defined">[12]</a> <a class="ext-link" href="https://www.drupal.org/user/2844779"><span class="icon">​</span>https://www.drupal.org/user/2844779</a> <a class="missing changeset" title="No default repository defined">[13]</a> <a class="ext-link" href="https://www.drupal.org/user/1367862"><span class="icon">​</span>https://www.drupal.org/user/1367862</a> <a class="missing changeset" title="No default repository defined">[14]</a> <a class="ext-link" href="https://www.drupal.org/user/262198"><span class="icon">​</span>https://www.drupal.org/user/262198</a> <a class="missing changeset" title="No default repository defined">[15]</a> <a class="ext-link" href="https://www.drupal.org/user/35821"><span class="icon">​</span>https://www.drupal.org/user/35821</a> <a class="missing changeset" title="No default repository defined">[16]</a> <a class="ext-link" href="https://www.drupal.org/user/556138"><span class="icon">​</span>https://www.drupal.org/user/556138</a> <a class="missing changeset" title="No default repository defined">[17]</a> <a class="ext-link" href="https://www.drupal.org/user/124982"><span class="icon">​</span>https://www.drupal.org/user/124982</a> <a class="missing changeset" title="No default repository defined">[18]</a> <a class="ext-link" href="https://www.drupal.org/user/17943"><span class="icon">​</span>https://www.drupal.org/user/17943</a> <a class="missing changeset" title="No default repository defined">[19]</a> <a class="ext-link" href="https://www.drupal.org/user/266527"><span class="icon">​</span>https://www.drupal.org/user/266527</a> <a class="missing changeset" title="No default repository defined">[20]</a> <a class="ext-link" href="https://www.drupal.org/u/greggles"><span class="icon">​</span>https://www.drupal.org/u/greggles</a> <a class="missing changeset" title="No default repository defined">[21]</a> <a class="ext-link" href="https://www.drupal.org/u/drumm"><span class="icon">​</span>https://www.drupal.org/u/drumm</a> <a class="missing changeset" title="No default repository defined">[22]</a> <a class="ext-link" href="http://drupal.org/security-team"><span class="icon">​</span>http://drupal.org/security-team</a> <a class="missing changeset" title="No default repository defined">[23]</a> <a class="ext-link" href="http://drupal.org/contact"><span class="icon">​</span>http://drupal.org/contact</a> <a class="missing changeset" title="No default repository defined">[24]</a> <a class="ext-link" href="http://drupal.org/security-team"><span class="icon">​</span>http://drupal.org/security-team</a> <a class="missing changeset" title="No default repository defined">[25]</a> <a class="ext-link" href="http://drupal.org/writing-secure-code"><span class="icon">​</span>http://drupal.org/writing-secure-code</a> <a class="missing changeset" title="No default repository defined">[26]</a> <a class="ext-link" href="http://drupal.org/security/secure-configuration"><span class="icon">​</span>http://drupal.org/security/secure-configuration</a> <a class="missing changeset" title="No default repository defined">[27]</a> <a class="ext-link" href="https://twitter.com/drupalsecurity"><span class="icon">​</span>https://twitter.com/drupalsecurity</a> </p> <p> <span class="underline"></span><span class="underline"></span><span class="underline"></span><span class="underline"></span><span class="underline"></span><span class="underline"></span><span class="underline"></span><span class="underline"></span><span class="underline"></span><span class="underline"></span><span class="underline"></span><span class="underline">_ Security-news mailing list Security-news@… Unsubscribe at <a class="ext-link" href="https://lists.drupal.org/mailman/listinfo/security-news"><span class="icon">​</span>https://lists.drupal.org/mailman/listinfo/security-news</a> </span></p> Results http://localhost:8080/trac/ticket/758#changelog http://localhost:8080/trac/ticket/849 http://localhost:8080/trac/ticket/849 Tue, 28 Apr 2015 12:35:03 GMT paul <pre class="wiki">Hi Sam / Ade Would you advise when outstanding invoices will be paid? We used to get our invoices paid every month. -- Best Paul Booker Drupal Developer &amp; Linux Systems Administrator Website: http://www.paulbooker.co.uk Drupal.org: https://www.drupal.org/u/paulbooker Twitter: @paulbooker &lt;https://www.twitter.com/paulbooker&gt; Tel: +44 01922 861636 </pre> Results http://localhost:8080/trac/ticket/849#changelog