Transition Technology: Ticket Query

#881: Site on ParrotServer with a memory leak?

chris — Fri, 23 Oct 2015 11:19:04 GMT

It appears a site, or application, on ParrotServer might have a memory leak.

#814: Higher that usual loads on PuffinServer since early September

chris — Wed, 03 Dec 2014 17:12:35 GMT

The following load graph from PuffinServer shows that the load increased substantially in early September 2014, does anyone know why?

When I found I went to Drupal 7.33 and all I got was a slow site I thought that perhaps a Drupal 7 site on the server could be the cause but 7.33 came out on 7th November 2014.

Anyone have any ideas?

#898: Fwd: Access to Drupal

ade — Tue, 26 Jan 2016 17:35:05 GMT

Hi Chris,
The web team at the development agency are requesting access to the
webserver so that they can look at the sites make up.
(Please see below)
Would you please set up an account so that they can get root read access?
I guess this would be done via FTP, but your thoughts greatly appreciated.
best regards
Ade
---------- Forwarded message ----------
From: Ainslie Beattie <ainsliebeattie@transitionnetwork.org>
Date: 26 January 2016 at 17:25
Subject: Fwd: Access to Drupal
To: Sam Rossiter <samrossiter@transitionnetwork.org>, Ade Stuart <
adestuart@transitionnetwork.org>, Yvonne Struthers <yvonne@thisisyoke.com>
Hey both, can you please action this urgently so that Yoke can have access.
Cheers
---------- Forwarded message ----------
From: "Yvonne Struthers" <yvonne@thisisyoke.com>
Date: 26 Jan 2016 10:58
Subject: Access to Drupal
To: <ainsliebeattie@transitionnetwork.org>
Cc:
Hi Ainslie,
Just a quick email as I'm out seeing a client today,but just to say,it
looks like you have only given us access to the database. What we need
please is admin access to the Drupal site and to the code base so that we
can get a sense of how it's all set up.
Thanks in advance!
Yvonne
Sent from my iPhone
--
Ade Stuart
Web Manager - Transition network
07595 331877
The Transition Network is a registered charity
address: 43 Fore St, Totnes, Devon, TQ9 5HN, UK
website: www.transitionnetwork.org
TN company no: 6135675 TN charity no: 1128675

#676: Alternative to Skype for TTech Meetings

chris — Tue, 14 Jan 2014 13:33:51 GMT

Jim has pointed out that:

Skype costs us 15-30 minutes of grinding pain every time we do this!

So what are the alternatives and what are our requirements?

#655: Add social media icons with counters to blogs listings views

ed — Thu, 12 Dec 2013 13:03:11 GMT

Investigate with Rob how to add Social media icons with counters into the /blogs listings views and individual node views.

I suggest starting with just Rob's blogs (/rob-hopkins), separate context for 'Transition Culture section' and then roll it out over other blogs and maybe news content type once the /rob-hopkins has been trialled

Sam to talk with Rob

Also cc-ing Ben as design - theme guy

#645: APC Tuning on Parrot and Penguin

chris — Tue, 10 Dec 2013 10:52:31 GMT

As part of the upgrade from Squeeze to Wheezy, see ticket:535, Munin graphs for APC were added:

There is also more APC info here:

The documentation for the variables which can be set in /etc/php5/mods-available/apc.ini can be found here:

http://php.net/manual/en/apc.configuration.php

This monitoring is generating quite a high volume of warnings about fragmentation and purges and this ticket has been created to try to sort this issue out.

#772: new TIs not appearing on staging until caches flushed

annesley — Tue, 05 Aug 2014 09:26:32 GMT

i added a new Mulling transition initiative on staging in Afghanistan and it did not appear on the map... i flushed caches and then it started appearing on the main initiatives map. is this intended? is it a known?

#582: TN.org platform and sites

jim — Mon, 02 Sep 2013 09:30:02 GMT

The TN.org platform and Drupal site updates are to be tracked in this ticket.

Current PROD platform build = P009 Current STG platform build = S010

Updates pending:

SECURITY UPDATE - NO RISK: Pressflow core 6.30 is due, but the security holes fixed do not affect us, low priority. Platforms: present in S010, but not in P009.

#662: Subscriptions' links in text emails breaking

ed — Tue, 17 Dec 2013 15:37:13 GMT

for January - to get Sam and Jim talking - in January

The subs sent out to subscribers: are fine in html but the text version is broken and unsatisfactory. I know we've been through this and it's a known bug etc. etc. but I'm wondering if we can switch all subs to html, or if there are any patches to this problem?

Adding as Jim's ticket with Sam cc-ed

#737: SPF / Emails rejected from the website contact form

sam — Thu, 05 Jun 2014 15:46:13 GMT

We had a user report that they could not send a message via our contact form:

"Yesterday I sent a message to you via the contact form on the website. But obviously something went wrong: for I got a failure notice saying my message could not be delivered. Therefore I'm sending it directly via email (see below) hoping that you're receiving my message this way."

<info@…>: host mx1.spamfiltering.com[72.249.150.158] said:

550 81.95.XX.XX is not allowed to send mail from gmx.de. Please see http://www.openspf.net/Why?scope=mfrom;identity=userXX@gmx.de;ip=81.95.XX.XX (in reply to end of DATA command)

(User details edited as this is publicly archived)

I'm not sure I quite understand what's going on here. Chris indicated in email that this would affect other users whose email provider has set this kind of SPF record.

Can we make an educated guess as to what proportion of email providers set this kind of SPF?

How many messages do we never get to see? Is it a problem? Or a small enough number of users that we just don't worry about it?

Thanks

Sam

#638: Question about notifications option for content creators

ed — Thu, 28 Nov 2013 12:32:57 GMT

Content creators (news, Rob's blog, social reporters) struggle with the notifications. the problem is that they forget to click the option to 'do not send notifications for this update' and then notifications are sent out. It is easy for us to think this is easy for them, but when you are bashing stuff out in a hurry, it's easy to forget this fiddly bit.

CAN WE set drupal to NOT send notifications out as standard for some of the content types?

And change it so that the content creators (news, Rob's blog, social reporters) choose to SEND notifications out instead (of NOT sending them) ?

#587: Puffin MySQL Tuning

chris — Thu, 05 Sep 2013 12:54:47 GMT

This ticket is to track the tuning we do to MySQL on PuffinServer.

See also previous comments on this issue:

#701: Emails & Telephone calls

paul — Tue, 18 Mar 2014 09:38:24 GMT

#711: Emails & Telephone calls

paul — Tue, 01 Apr 2014 13:47:56 GMT

#590: Drupal performance improvements

jim — Fri, 06 Sep 2013 10:27:27 GMT

This ticket is to track the work and changes done within the Drupal sphere in relation to performance enhancements done since #585.

More information is needed and will come when ticket:586 New Relic Monitoring for BOA is completed.

I also note that many of these cleanup operations will also help make the move to D7 smoother and better.

Summary of actions and status

TODO

O) Stop making so many URL aliases for non-relevant pages, clean up url_alias table -- 1/4-1/2 hour, medium reward, only risk is that some already broken links might break... Per chat with Ed, only these will be removed (plus releated tweaks to Pathauto settings):

3,579 entries where src = node/%/feed
1,856 entries where src = user/%/contact
= 5,435 or ~11% of entries in url_alias

L) Review slow query log, explain queries, tweak as necessary/flag poorly behaving modules. 2-4 hours, high reward, low risk... Keep looking at the slow query log and adjust Drupal or find patches as necessary. ALSO related Reduce your server's resource usage by moving MySQL temporary directory to tmpfs... Have opened ticket for this: #591 for Chris.

Done

A) Remove spam taxonomy entries ~~1/2 hour, Low risk, low reward -- See item 8 below. A simple delete from taxo term table where length > 50 is worth doing IMHO, and nothing I saw that would be clobbered is not spam.~~

B) Try a Taxonomy Cleanup: 3 hours, Medium risk, medium reward -- style module to try to merge terms with the same names and clean up the link tables back to nodes. Further, we can remove any taxonomies or relations to certain CTs that don't really add value.

D) Review Views caching ~~1 hour, low risk, high reward -- Utilise Views Content Cache this was done a while back but I think -- done (task 12) in comment 21.~~

F) Force blocks caches to cached appropriately (and be rendered/included only as needed) 1-2 hours, medium reward, low risk -- BOA packages the Block Cache Alter, which makes sure Drupal only renders blocks when needed. Potential small but nice boost quickly in whole site. -- per comment 22, block caching is disabled by other modules so this will have to go on hold for now.

H) Remove CustomError? module all together 1/2 hour, low risk, low reward -- We should take out the PHP code from the 403 section of CustomError? and put it into a simple page entry. See comment 6 below as this has happened for 404s (which need no PHP). We can then remove the CustomError? module all together, saving lots of sessions. I would go ahead and do this but since the 403 page has various displays depending on user type, I wanted to raise it here as it *may* have side effects. Or not...

I) Re-enable block caching. 2-6 hours, high risk, high reward -- Per comment 24, a module (probably Content Access) is stopping Drupal caching blocks, which for some of them means a fair amount of pointless overhead. We need to somehow get around this and get blocks cached if possible. R&D mainly, perhaps with some hacking/patching - but I'd stop short of doing this if so.

K) Add & enable Views Lite Pager on big views. ~~1 hour, low risk, low reward -- Using this module stops a heavy count query on views with pagers -- recommended for large sites.~~

M) Take control of Cron, and maximise time pages are cached for. .25h, high reward, low risk -- Cron is wiping the page cache, so we need to install https://drupal.org/project/elysia_cron so we can clear the page less often, and run other things when we want and the site is quieter. Now need per minute resolution set to get the best, see comment 33 and 34 for more...

N) Replace Admin Menu 1.x with 3.x -- will happen when #590 occurs, marking complete here -- ~~5 mins, high reward, low risk -- done when #582 happens, could be the cause of some load spikes as it occasionally goes made and does 2000-5000 queries~~~~

#541: Documentation of the WordPress sites

chris — Wed, 01 May 2013 20:25:57 GMT

These pages have been created for the documentation of the wiki:WordPress sites running on wiki:PenguinServer:

So far they only have a listing on the plugins for each site.

Ideally they would document all the plugins, the theme and the steps that need to be taken to upgrade each site and also any other things that need documenting.

Laura is this something you might be able to help with? I'm happy doing some work on it but you know your way around these sites far better than anyone else.

#636: Changes to Space.transitionnetwork.org homepage to facilitate user registration

ed — Wed, 27 Nov 2013 17:30:19 GMT

Space currently does not give users who aren't already registered a way in. Anon users can see some of the spaces but when they try to apply for membership, they hit a login page, which they can't complete as they are not registered.

RTFM for OA as to OA best practice - this is billable time. Then leave notes about it in wiki for later developers.

The homepage needs editing to sort this out. Here are some first changes:

2.1. Remove the 'Need the pros' pane (RHS) 2.2 Remove the 'Just getting started' pane (LHS) 2.3 Add a 'Request membership' pane which is basically a user registration form. Make registration 'approval only' for now, approval to be by a site admin (webproject@…)

The /spaces listings view shows the spaces that are publicly viewable, and there is a 'request group membership' button for each of them.

Can you make this into a registration form as well?

#727: Change background on block from orange to white

sam — Fri, 16 May 2014 10:02:17 GMT

Hi Ben

Rob wants a list of the themes presented in a block.

I did the block: https://www.transitionnetwork.org/admin/build/block/configure/block/97

But it appears with an orange background. The block is visible towards the bottom of the page (for logged in admins) here: https://www.transitionnetwork.org/blogs/rob-hopkins

If I put the block on other pages it appears with a white background.

I tried to hack it with some inline CSS but failed.

Could you take a look?

Thanks

Sam

#596: Captions issue

benj — Mon, 16 Sep 2013 16:58:04 GMT

basically captions are appearing on body inline images and featured images on STG but not PROD and I can't see where the difference is...

The following code addition to the bottom of template.php should be (but isn't) adding the caption class to images such as the one at the top of this page:

https://www.transitionnetwork.org/blogs/ed-mitchell/2013-06/test-blog-test-caption-and-featured-image

Any reason you can think of why not? Or do you know of another easy way of adding the class caption to featured image fields? (I guess the module https://drupal.org/project/semantic_cck - but maybe overkill...)

Adds caption css class to featured images */

function transition2_imagecache_formatter_featured_image_default($element) {

Inside a view $element may contain NULL data. In that case, just return. if (empty($element#item fid?)) {

return ;

}

Extract the preset name from the formatter name. $presetname = substr($element#formatter, 0, strrpos($element#formatter, '_')); $style = 'linked'; $style = 'default';

$item = $element#item; $itemdata?alt? = isset($itemdata?alt?) ? $itemdata?alt? : ; $itemdata?title? = isset($itemdata?title?) ? $itemdata?title? : NULL;

$class = "imagecache imagecache-$presetname imagecache-$style imagecache-{$element#formatter} caption"; return theme('imagecache', $presetname, $itemfilepath?, $itemdata?alt?, $itemdata?title?, array('class' => $class));

}

#758: * Advisory ID: DRUPAL-SA-CORE-2014-003

paul — Wed, 16 Jul 2014 21:55:29 GMT

View online: https://www.drupal.org/SA-CORE-2014-003

Advisory ID: DRUPAL-SA-CORE-2014-003
Project: Drupal core [1]
Version: 6.x, 7.x
Date: 2014-July-16
Security risk: Critical [2]
Exploitable from: Remote
Vulnerability: Multiple vulnerabilities

Multiple vulnerabilities were fixed in the supported Drupal core versions 6 and 7.

.... Denial of service with malicious HTTP Host header (Base system - Drupal 6 and 7 - Critical)

Drupal core's multisite feature dynamically determines which configuration file to use based on the HTTP Host header.

The HTTP Host header validation does not sufficiently check maliciously-crafted header values, thereby exposing a denial of service vulnerability.

.... Access bypass (File module - Drupal 7 - Critical)

The File module included in Drupal 7 core allows attaching files to pieces of content. The module doesn't sufficiently check permission to view the attached file when attaching a file that was previously uploaded. This could allow attackers to gain access to private files.

This vulnerability is mitigated by the fact that the attacker must have permission to create or edit content with a file field.

Note: The Drupal 6 FileField? [3] module is affected by a similar issue (see SA-CONTRIB-2014-071 - FileField? - Access bypass [4]) and requires an update to the current security release of Drupal 6 core in order for the fix released there to work correctly. However, Drupal 6 core itself is not directly affected.

.... Cross-site scripting (Form API option groups - Drupal 6 and 7 - Moderately critical)

A cross-site scripting vulnerability was found due to Drupal's form API failing to sanitize option group labels in select elements. This vulnerability affects Drupal 6 core directly, and likely affects Drupal 7 forms provided by contributed or custom modules.

This vulnerability is mitigated by the fact that it requires the "administer taxonomy" permission to exploit in Drupal 6 core, and there is no known exploit within Drupal 7 core itself.

.... Cross-site scripting (Ajax system - Drupal 7 - Moderately critical)

A reflected cross-site scripting vulnerability was found in certain forms containing a combination of an Ajax-enabled textfield (for example, an autocomplete field) and a file field.

This vulnerability is mitigated by the fact that an attacker can only trigger the attack in a limited set of circumstances, usually requiring custom or contributed modules.

/A CVE identifier [5] will be requested, and added upon issuance, in

accordance with Drupal Security Team processes./

Drupal core 6.x versions prior to 6.32.
Drupal core 7.x versions prior to 7.29.

Install the latest version:

If you use Drupal 6.x, upgrade to Drupal core 6.32. [6]
If you use Drupal 7.x, upgrade to Drupal core 7.29. [7]

Also see the Drupal core [8] project page.

The denial of service vulnerability using malicious HTTP Host headers was

reported by Régis Leroy [9].

The access bypass vulnerability in the File module was reported by Ivan

Ch [10].

The cross-site scripting vulnerability with Form API option groups was

reported by Károly Négyesi [11].

The cross-site scripting vulnerability in the Ajax system was reported by

mani22test [12].

The denial of service vulnerability using malicious HTTP Host headers was

fixed by Régis Leroy [13], and by Klaus Purer [14] of the Drupal Security Team.

The access bypass vulnerability in the File module was fixed by Nate Haug

[15] and Ivan Ch [16], and by Drupal Security Team members David Rothstein [17], Heine Deelstra [18] and David Snopek [19].

The cross-site scripting vulnerability with Form API option groups was

fixed by Greg Knaddison [20] of the Drupal Security Team.

The cross-site scripting vulnerability in the Ajax system was fixed by

Neil Drumm [21] of the Drupal Security Team.

The Drupal Security Team [22]

The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [23].

Learn more about the Drupal Security team and their policies [24], writing secure code for Drupal [25], and securing your site [26].

Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity [27]

_ Security-news mailing list Security-news@… Unsubscribe at https://lists.drupal.org/mailman/listinfo/security-news

#753: wiki.transitionnetwork.org displaying error

chris — Fri, 04 Jul 2014 08:23:52 GMT

This is rather weird, the site was working yesterday, now at https://wiki.transitionnetwork.org/ we have:

bar(), etc etc) which throw parse errors in # PHP 4. Setup.php and ObjectCache.php have structures invalid in PHP 5.0 and # 5.1, respectively. if ( !function_exists( 'version_compare' ) || version_compare( phpversion(), '5.3.2' ) < 0 ) { // We need to use dirname( __FILE__ ) here cause __DIR__ is PHP5.3+ require dirname( __FILE__ ) . '/includes/PHPVersionError.php'; wfPHPVersionError( 'index.php' ); } require __DIR__ . '/includes/WebStart.php'; $mediaWiki = new MediaWiki(); $mediaWiki->run();

#583: tmp files on parrot exceeded inode limit

ed — Mon, 02 Sep 2013 12:28:46 GMT

Users are attempting to purchase a DVD and the cart always zeros out even after attempts to update cart etc.

Laura suggests that this may be a server issue and to start with Chris:

The prob could v likely be on the hosting side, so be worth contacting Chris first (and mention can add to cart all okay when logged in, view cart and alter and get to billing page, so could be a session setting that's changed) -

Does the server have disk space left on /tmp. Session data is most likely written there. (sometimes this cart faff issue can happen because of that.)

Are the PHP Session settings correct/ have they changed recently? Chris can fix this if needing a tweakette in php.ini or other places in the underworld of those types of files.

DB could potentially need check/repair.

Another one is the shop element relies on cookies so if a user has set browser to not accept cookies may poss not work! (but think thats something not to think about here, as I tested as both logged in and logged out with cookies set to work on my browser, logged out got the 'cart empty' faff factor like other users will be getting.)

If Chris can't spot the bug (does sound server side and sessions related from a quick test here, haven't looked at the server logs, but if get a mo later will see if I can), poss good to chat and I can think some more on it, but first thoughts alert me mostly to server side, sometimes a roll back to php 5.2 clicks things back into place (but shouldn't be needed). Be good to see if there is a correlation with any server changes/tweaks happening around same timing that the cart stopped working. Keep me in the loop if it is a server fix-y thing as always interested to hear results on bug fixing on sites.

#487: robots.txt files for development sites

chris — Tue, 29 Jan 2013 13:24:35 GMT

All the sites other than www.transitionnetwork.org on wiki:PuffinServer should have a robots.txt file to exclude them from being crawled and indexed to prevent the development versions of sites being included in search results.

#580: php5-fpm starting when puffin boots

chris — Mon, 12 Aug 2013 16:03:06 GMT

When wiki:PuffinServer is booted /etc/init.d/php5-fpm is started and this causes errors with the site.

#528: patterns.transitionresearchnetwork.org DNS update

chris — Tue, 26 Mar 2013 09:58:13 GMT

Request from Ethan:

We've moved the site back to the production server. Would you be willing to set the CNAME for patterns.transitionresearchnetwork.org to patterns.transitionresearchnetwork.org.230.cldstr.com?

See also previous tickets ticket:482 and ticket:502

#502: patterns sub-domain for transitionresearchnetwork.org, was: Setting up specific pointer for URL

ed — Wed, 27 Feb 2013 07:10:03 GMT

Can we set this URL:
www.transitionresearchnetwork.org/research-guidelines
to point to this location:
https://cldstr.com/docs/configure-dns
While this URL:
www.transitionresearchnetwork.org/
Still points to the current location.
~~~~
Ed Mitchell: Transition Network Web manager
web: http://transitionnetwork.org
project blog: http://transitionnetwork.org/blogs/ed-mitchell
mobile: +44 (0)7807 141 828
office hours: Mon, Tues, Wed, Thurs
company no. 6135675  charity no. 1128675
Subscribe to Transition news: http://tinyurl.com/transitionregister
~~~~

#780: parrot

annesley — Wed, 27 Aug 2014 14:35:51 GMT

can't access parrot again also: it re-requests my password very quickly. what is the session timeout?

also: i cannot include my files. seems that the website is located under the /home/annesley directory. is this some sort of strange setup because the PHP cannot see that area. and i cannot cd to the root through SFTP...

#778: need access to Parrot

annesley — Wed, 27 Aug 2014 12:16:39 GMT

i need a publicly available WordPress demo install to play with. should this be on Parrot? what (sub)domain can i use?

#698: intransitionmovie.com returns 405 on submit

sam — Thu, 06 Mar 2014 11:45:39 GMT

http://www.intransitionmovie.com/screenings/share-your-screening/

vid Atcheson (david@…) sent a message using the contact form at https://www.transitionnetwork.org/contact.

I couldn't find any contact info at http://www.intransitionmovie.com/, but am hoping you can help. When I visit http://www.intransitionmovie.com/screenings/share-your-screening/index.html and put in my email address and hit Enter, I get:

Hi I checked this and it returns a 405 error for me too.

http://www.intransitionmovie.com/screenings/share-your-screening/

405 Not Allowed nginx/1.4.4

Hoping this can be fixed so we can let you know about our screening on April 8 at the Hawaii State Capitol auditorium.

Aloha,

David Atcheson, Transition Oahu

I'll do some initial investigation

#538: intransitionmovie.com checks and updates

chris — Tue, 30 Apr 2013 20:02:03 GMT

The http://www.intransitionmovie.com/ site has been migrated to wiki:ParrotServer, the DNS might not have yet updated for everybody.

Laura -- could you check that the site is working OK if you get a chance, especially the ecommerce elements?

There are some outstanding updates, WordPress is version 3.3.2 need updating to 3.5.1 and there are 12 plugins with updates available:

18 installed plugins:
 UA affiliates
 UA affiliates-woocommerce-light
 UA akismet
  A backupwordpress
 UI bad-behavior
 UA bwp-minify
  A contact-form-7
 UA event-o-matic
  A transposh-translation-filter-for-wordpress
 UA usernoise
  A woocommerce
 UA woocommerce-export-csv
  A woocommerce-currency-converter
 UA woocommerce-dynamic-pricing
  A woocommerce-delivery-notes
 UA woocommerce-shipping-table-rate
 UA wp-customer-reviews
 UI wp-super-cache
Legend: A = Active, I = Inactive, U = Update Available

I'm happy to do all these updates but I wouldn't know what exactly to check to see that the updates don't break anything -- would Laura be able to help with a quick check that updates haven't broken anything?

#639: earthin site wordpress error

chris — Fri, 29 Nov 2013 14:06:01 GMT

When using wp on the command line for wiki:EarthInheritorsWordPress

PHP Fatal error:  Call to undefined function get_post_format_slugs() in /home/earthin/sites/default/wp-includes/theme.php on line 1264

#773: download copy of current TN D6 website

annesley — Wed, 06 Aug 2014 09:58:14 GMT

hi, am trying to get a copy of the current TN.org D6 database and filesystem down to my laptop to develop against. i had pulled from GIT, backed up from Backup&Migrate and got everything working but there are things missing.

so i want to do a file copy. i started a tar operation but the tar size went over 1.3GB and i stopped it because it shouldn't be that big. as always BOA has restricted use of the "du" command so i can't really tell why the tar was so big. and i can't "df" to see if it's a problem

should i let it continue? why is it so big?

#762: cannot log in to Puffin

annesley — Sat, 19 Jul 2014 08:46:53 GMT

hi, i think i've locked myself out of puffin again. i successfully logged in and navigated to ~ and /. but it wouldn't let me access /data/disk/tn/static/transition-network-d6-s012 it asked for more authentication and then stopped responding.

thanks, a

#771: cannot access puffin over sftp again

annesley — Tue, 05 Aug 2014 09:24:10 GMT

not sure what happened this time. my connection to other servers is fine. i am using:

sftp://tn.ftp@puffin.transitionnetwork.org/static/transition-network-d6-32-s002-booker/

the password was accepted first time and i successfully navigated to /static

which worked until i tried to get to the transition-network-d6-32-s002-booker directory. now ssh fails also.

when i ssh in i get plenty of warnings and potential lock outs when i try various things. like trying to access /static.

#811: WordPress critical security release

chris — Thu, 20 Nov 2014 20:25:07 GMT

From the blog:

WordPress 4.0.1 is now available. This is a critical security release for all previous versions and we strongly encourage you to update your sites immediately.

Sites that support automatic background updates will be updated to WordPress 4.0.1 within the next few hours. If you are still on WordPress 3.9.2, 3.8.4, or 3.7.4, you will be updated to 3.9.3, 3.8.5, or 3.7.5 to keep everything secure. (We don’t support older versions, so please update to 4.0.1 for the latest and greatest.)

WordPress versions 3.9.2 and earlier are affected by a critical cross-site scripting vulnerability, which could enable anonymous users to compromise a site.

#594: WordPress 3.6.1 Maintenance and Security Release

chris — Wed, 11 Sep 2013 22:05:01 GMT

The following is from http://wordpress.org/news/2013/09/wordpress-3-6-1/

WordPress 3.6.1 is also a security release for all previous WordPress versions and we strongly encourage you to update your sites immediately. It addresses three issues fixed by the WordPress security team:

Block unsafe PHP unserialization that could occur in limited situations and setups, which can lead to remote code execution. Reported by Tom Van Goethem.
Prevent a user with an Author role, using a specially crafted request, from being able to create a post “written by” another user. Reported by Anakorn Kyavatanakij.
Fix insufficient input validation that could result in redirecting or leading a user to another website. Reported by Dave Cummo, a Northrup Grumman subcontractor for the U.S. Centers for Disease Control and Prevention.
Additionally, we’ve adjusted security restrictions around file uploads to mitigate the potential for cross-site scripting.

#637: What is the wordcount for the /news and /blogs/rob-hopkins teasers?

ed — Thu, 28 Nov 2013 09:40:48 GMT

http://www.transitionnetwork.org/news http://www.transitionnetwork.org/blogs/rob-hopkins

what is the teaser length - ie the first paragraph of a news or blog item that is published in the listings views?

rob wants to know how many words he has for his introductions...

#668: Wagn transition_mod

chris — Sat, 11 Jan 2014 08:52:25 GMT

Email from Ethan via Tom:

I was doing some work on wagn mods today and I realized that I'd created a mod (as in "modification" or "module", whichever you like) for the transition site that probably never survived the move to the new server.

Looking at https://patterns.transitionresearchnetwork.org/Building_Resilience confirmed this for me. The confidence shows up as the words "2 stars" rather than actual star images. That's one thing the mod does. The other has to do with reducing visual redundancy (recurring names) in pattern summaries.

I've attached the mod file here. Unless you've gotten creative with your configuration, you should be able to stick this file in local/mods and restart the server and have that fixed. Let me know if any of this doesn't make sense.

#665: Wagn "Problem Loading Page" error

chris — Mon, 06 Jan 2014 14:02:00 GMT

Bug report from Tom:

I've encountered a problem when trying to set up new accounts: I get a 'Problem Loading Page' error when it tries to load http://localhost:3000/wagn/Invite_Success. This seems to be explained at http://wagn.org/Special_Urls_and_Ports - which I am hoping falls under your area of responsibility as I'm not sure how to do it myself,! But let me know if not...

#609: Videos not showing if added via video link

ed — Tue, 15 Oct 2013 08:33:43 GMT

e.g. of project profile: https://www.transitionnetwork.org/projects/new-forest-transition-school-community-energy-saving-project

none showing on video page: https://www.transitionnetwork.org/video

#627: Users: deleting their own accounts

ed — Wed, 20 Nov 2013 16:08:43 GMT

Can users delete their own accounts? I've looked at user settings and can't find any clues? Can you point me to a user account setting which would enable them to delete their own accounts (and their profiles by proxy)?

#562: Users being subscribed to widgets newsletter on registratoin

ed — Mon, 17 Jun 2013 15:11:22 GMT

Ed added new users to system via user-->add user. They are being automatically subscribed to the widget owners newsletter. Please investigate and stop this.

#575: User system is blocking everyone - needs fixing urgently

ed — Wed, 31 Jul 2013 14:39:11 GMT

Everyone who registers for the last two weeks is being blocked - check user list and see screengrab. Needs fixing promptly.

#608: User profile pictures are too big

ed — Mon, 14 Oct 2013 08:37:38 GMT

The user profile pictures on the user profile nodes are too big.

e.g. https://transitionnetwork.org/people/tina-clarke

Please investigate and restrain them into a suitable maximum size

NB: Ed is keeping a number of small UI-ish tickets back for Ben to do in a lump when we've built up enough so don't do anything yet.

#748: Urgent: Fiona having problems sending email

sam — Wed, 25 Jun 2014 12:42:27 GMT

Hi Chris, Fiona is having problems sending email. I have checked the quota in the web interface and she is not over her quota.

She initially sent this:

The message could not be sent because the server rejected the sender's email address. The sender's email address was 'fionaward@…'.

Subject 'Re: filming' Server Error: 550 Server Response: 550 Access denied - Invalid HELO name (See RFC2821 4.1.1.1) Server: 'mail.transitionnetwork.org' Windows Live Mail Error ID: 0x800CCC78 Protocol: SMTP Port: 26 Secure(SSL): No

Which looked to me like the email had been sent and rejected by the receiving server.

So I sent this to Fiona:

On 24 June 2014 16:11, Sam Rossiter <samintransition@…> wrote: Hi Fiona I'll take a look now. It could have been rejected for a number of reasons. There's no keywords in the email that might trigger a spam rejection? Or have you Cc'd a large number of people?

As a workaround until we get to the bottom of it is it something a collegue could forward? Or does it have to come from you?

Thanks

Sam

Fiona replied:

Hi Sam I don;t think it's that email, as there are 13 that won't send frm my outbox even if I remove this email - same problem with the next one! Thanks Fiona

---

Chris I'm not working until next Tuesday, so I was wondering if you could pick this up and liase with Fiona? fionawardttt [AT] googlemail.com

Thanks

Sam

#729: Upgrade to Piwik 2.2.2

chris — Fri, 23 May 2014 08:21:12 GMT

2.2.2 came out on 8th May, not sure why I missed this at the time, the change log is here: http://piwik.org/changelog/piwik-2-2-2/

The last upgrade was 2.2.1 ticket:726 and the upgrade notes are at wiki:PiwikServer#Updates

#726: Upgrade to Piwik 2.2.1

chris — Tue, 06 May 2014 11:14:05 GMT

Piwik 2.2.1 is a new minor release which brings more stability to the platform.

http://piwik.org/changelog/piwik-2-2-1/

#720: Upgrade to Piwik 2.2.0

chris — Thu, 17 Apr 2014 07:51:50 GMT

From the Changelog, http://piwik.org/changelog/piwik-2-2-0/

Piwik 2.2.0 is a major new release. This release is rated critical. Please update now.

We highly recommend that you upgrade your server to Piwik 2.2.0 today to benefit from design, performance and security improvements in this release.

Piwik 2.2 helps you focus on your data

All reports: display as much text as possible before the label becomes truncated (useful when you want to see more data at a glance without having to hover to view the full label)
Make Datatables more readable and flatter – we have removed some borders.
On the dashboard, the Data Tables and graph icons are now hidden by default and are now available by clicking on the widget footer.
New features

Event Tracking: track your custom events with Piwik. An event is defined by a Category, an Action, an optional Name and an optional Value. Event Tracking is a powerful feature which can be used for many purposes! http://piwik.org/docs/event-tracking/
Site Search reports are now available in Scheduled email reports and on Piwik Mobile
New Websites Groups (available on request) functionality now allows you to group a cluster of websites in the All Websites Dashboard.
Security fixes: we would like to warmly thank Security researchers Mateusz Goik and Vivek S. Jadhav for responsibly reporting two XSS security issues in Piwik which are now fixed in 2.2.0.
API breaking change for Plugins developers
Deprecated the function Schema::dropTables() and DbHelper::dropTables, for the new Db::dropTables()
Removed the code that was deprecated in 2.1.0. Learn more http://piwik.org/blog/2014/02/piwik-2-1-changes-plugin-developers/

#672: Upgrade to Piwik 2.0.3

chris — Mon, 13 Jan 2014 10:13:00 GMT

From the Piwik changelog:

Piwik 2.0.3 is a bug-fix release. To ensure the highest quality and reliability for your Piwik 2.0 setup, we have fixed all known major bugs, as well as made some small improvements.

...

We highly recommend that you upgrade your server to Piwik 2.0.3 today to benefit from the latest improvements.

#532: Upgrade to Mediawiki 1.19.5

chris — Mon, 15 Apr 2013 13:40:34 GMT

New version out tonight:

This is a notice that on Monday, April 15th between 20:00-21:00 UTC (1-2pm PDT) Wikimedia Foundation will release security updates for current and supported branches of the MediaWiki software. Downloads and patches will be available at that time, with the git repositories updated later that afternoon. CVSS scores are between 4.3 and 7.1, most users will want to update.

http://lists.wikimedia.org/pipermail/mediawiki-announce/2013-April/000126.html

#736: Upgrade to MediaWiki 1.23.0

chris — Thu, 05 Jun 2014 09:43:50 GMT

From the announcements list:

I am happy to announce the availability of the first stable release of the new MediaWiki 1.23 release series.

MediaWiki 1.23 is a large release that contains many new features and bug fixes. This is a summary of the major changes of interest to users. You can consult the RELEASE-NOTES-1.23 file for the full list of changes in this version.

This is a Long Term Support release (LTS) and will be supported until May 2017.

Our thanks to everyone who helped to improve MediaWiki by testing the release candidates and submitting bug reports.

What's new?

MediaWiki 1.23 includes all changes released in the smaller 1.23wmfX software deployments to Wikimedia sites.
Skin autodiscovery deprecated

Skin autodiscovery, the legacy skin installation mechanism used by MediaWiki since very early versions (around 2004), has been officially deprecated and will be removed in MediaWiki 1.25.

MediaWiki 1.23 will emit warnings in production if a skin using the deprecated mechanism is found.
See Manual:Skin autodiscovery for more information and a migration guide for site admins and skin developers.
Notifications

With 1.23, MediaWiki starts to behave more like a modern website as regards notifications, to keep the editors of your wiki engaged and always up to date about what interests them. This used to require several custom settings.

(bug 45020) Make preferences "Add pages I create and files I upload to my watchlist" and "pages and files I edit" true by default.
(bug 45022) Make preference "Email me when a page or file on my watchlist is changed" true by default.
(bug 49719) Watch user page and user talk page by default.
This will allow your new users to immediately start benefiting from the watchlist and email notification features, without needing to first read all the docs to find out that they're as useful as they are.

Merged extensions

Merged into 1.23:

ExpandTemplates (bug 28264).
AssertEdit (bug 27841) - documented at API:Assert.
Interface

(bug 42026) Add option to only show page creations in Special:Contributions (and API).
Add new special page to list duplicate files, Special:ListDuplicatedFiles.
(bug 60333) Add new special page listing tracking categories (Special:TrackingCategories).
Editing

A new special page Special:Diff was added, allowing users to create internal links to revision comparison pages using syntax such as Special:Diff/12345, Special:Diff/12345/prev or Special:Diff/12345/98765.
Help pages

With 1.23, MediaWiki begins a process of consolidation of its help pages. Now, most are using the Translate extension and can be easily translated and updated in hundreds languages.

In the coming months, we'll focus on making more of the central help pages translatable and on linking them from the relevant MediaWiki interfaces for better discoverability. Please help: add your own translations; update existing pages and cover missing MediaWiki topics.

Traditionally, help pages have been scattered on countless wikis and poorly translated; most of those on mediawiki.org were migrated with the help of some Google Code-in students.

CSS refresh for Vector

Various Vector CSS properties have been converted to LESS variables.
The font size of #bodyContent/.mw-body-content has been increased to 0.875em.
The line-height of #bodyContent/.mw-body-content has been increased to 1.6.
The line-height of superscript (sup) and subscript (sub) are now set to 1.
The default color for content text (but not the headers) is now #252525; (dark grey).
All headers have updated sizes and margins.
H1 and H2 headers now use a serif font.
Body font is "sans-serif" as always.
For more information see Typography refresh.

Configuration

Add Config and GlobalConfig classes:

Allows configuration options to be fetched from context.
Only one implementation, GlobalConfig, is provided, which simply returns $GLOBALS[$name]. There can be more classes in the future, possibly a database-based one. For convinience the "wg" prefix is automatically added.
This adds the $wgConfigClass global variable which is used to determine which implementation of Config to use by default.
The ContextSource getConfig and setConfig methods were introduced.
Full release notes: https://git.wikimedia.org/blob/mediawiki%2Fcore.git/1.23.0/RELEASE-NOTES-1.23 https://www.mediawiki.org/wiki/Release_notes/1.23

Download: http://download.wikimedia.org/mediawiki/1.23/mediawiki-1.23.0.tar.gz

GPG signatures: http://download.wikimedia.org/mediawiki/1.23/mediawiki-1.23.0.tar.gz.sig

Public keys: https://www.mediawiki.org/keys/keys.html

I'd suggest we upgrade to this version and then perhaps stick with it, only doing security updates, until we need to move to another version due to it no longer being supported or because we need some new functionality.

#745: Upgrade to BOA-2.2.6 Stable Edition

chris — Mon, 23 Jun 2014 09:32:31 GMT

Email from wiki:PuffinServer:

There is new BOA-2.2.6 Stable Edition available.

Please review the changelog and upgrade as soon as possible to receive all security updates and new features.

Changelog: http://bit.ly/newboa

Reading through the change log there doesn't appear to be anything of note that directly effects us, the new php versions:

PHP 5.4.28
PHP 5.5.12

Don't as we are still on PHP Version 5.3.28.

I think it would be worth doing this update one evening this week just to keep upto date with BOA.

Previous updates: wiki:PuffinServer#Upgradetickets

#725: Upgrade to BOA-2.2.5

chris — Fri, 02 May 2014 08:49:22 GMT

Note this ticket was opened to upgrade to BOA-2.2.4 but when the upgrade was done BOA-2.2.5 was out so BOA-2.2.4 was skipped

From the Changelog at http://bit.ly/newboa

### Stable BOA-2.2.4 Release - Full Edition
### Date: Wed Apr 30 17:03:36 PDT 2014
### Includes Aegir 2.x-boa-custom version.
# Release Notes:
  This release includes several bug fixes along with five updated platforms,
  plus some hot-fixes applied to previous stable after its release. We have
  also added a fix for known problem is recent Drupal 7.27 [#2245331] hence
  the change from Drupal 7.27.1 to 7.27.2 in all D7 platforms.
# Important - Read This First! (for self-hosted BOA only)
  If you haven't run full barracuda+octopus upgrade to latest BOA Stable
  Edition yet, don't use any partial upgrade modes explained in docs/UPGRADE.txt
  Once new BOA Stable is released, you must run *full* upgrades with commands:
  $ barracuda up-stable
  $ octopus up-stable all both
  For silent, logged mode with e-mail message sent once the upgrade is
  complete, but no progress is displayed in the terminal window, you can run
  alternatively, starting with screen session to avoid incomplete upgrade
  if your SSH session will be closed for any reason before the upgrade
  will complete:
  $ screen
  $ barracuda up-stable log
  $ octopus up-stable all both log
  Note that the silent, non-interactive mode will automatically say Y/Yes
  to all prompts and is thus useful to run auto-upgrades scheduled in cron.
  If you have skipped some recent BOA releases, and you have new default config
  option: _PERMISSIONS_FIX=NO in your /root/.barracuda.cnf configuration file,
  plus, you are not sure if you follow best practices for managing permissions
  as recommended in our docs: https://omega8.cc/node/116 then we recommend
  that you change it to _PERMISSIONS_FIX=YES temporarily, or even permanently
  if your VPS is fast enough, and then run this powerful script as root:
  $ bash /var/xdrago/daily.sh
  Note that BOA 'legacy' mode is still at version 2.1.3
# Updated Octopus platforms:
  ### Drupal 7.27.2
  Commerce 1.25 ---------------- https://drupal.org/project/commerce_kickstart
  Commerce 2.14 ---------------- https://drupal.org/project/commerce_kickstart
  Commons 3.11 ----------------- https://drupal.org/project/commons
  Panopoly 1.5 ----------------- https://drupal.org/project/panopoly
  ### Pressflow 6.31.1
  Commons 2.17 ----------------- https://drupal.org/project/commons
  Note: Always read and follow upgrade procedure if explained in the distro
  release notes, like for Panopoly 1.5 at https://drupal.org/node/2255133
# New o_contrib modules:
  * print-6.x-1.19 (includes patch to auto-detect /usr/bin/wkhtmltopdf)
  * print-7.x-2.0  (includes patch to auto-detect /usr/bin/wkhtmltopdf)
# New features and enhancements in this release:
  * Support for session.gc_maxlifetime configurable via INI files.
  You can control session garbage collector (EOL) per site and per platform.
  The value (in seconds) of the session_gc_eol variable is used as
  session.gc_maxlifetime value and specifies the number of seconds after which
  data will be seen as 'garbage' and potentially cleaned up, resulting with
  $_SESSION variable discarded and affected authenticated users logged out.
  BOA default defined in the system level global.inc file is 86400 == 24h.
# Changes in this release:
  * Drush: Upgrade command line version 6 to mini-6-26-04-2014
  * Nginx: Use higher defaults for limit_conn to avoid error 503 (CloudFlare)
  * Nginx: Use more aggressive limits against spambots trying to rgstr accounts.
  * Redis: Integration module (the modern variant) upgrade to 7.x-2.x-o8-2.6-B
# System upgrades in this release:
  * Nginx 1.7.0
  * PHP 5.5.12
  * Redis 2.8.9
# Fixes in this release:
  * Add symlinks in the home directory if missing (every 5 minutes).
  * Add warning that Compass Tools install and upgrade may take a LONG time.
  * Always define _PHP_CN variable properly.
  * Do not delete symlinks to wrappers to avoid false LFD alarms.
  * Fix for 'Force backward compatible SERVER_SOFTWARE'.
  * Fix in websh for _IN_PATH logic to not break backend Drush tasks.
  * Fix the logic for wrappers update and symlinks.
  * Force MariaDB 5.5 re-install if installed version doesn't match latest.
  * Improve status messages to display when silent mode is used on upgrade.
  * Improve whitelisting in the websh wrapper.
  * Issue #2238805 - Command filtering - no word containing *drush* is allowed.
  * Issue #2241495 - wkhtmltopdf stopped working after upgrade.
  * Issue #2247997 - Update docs/REMOTE.txt with workaround for websh issue.
  * Issue #2250397 - Always follow (limited) redirects in cURL requests.
  * Issue #GH-304  - [rvm] use $_RUBY_VERSION as default.
  * Issue #GH-305  - Check disk usage before running install/upgrade.
  * Issue #GH-306  - Allow ruby 1.8 to remain installed.
  * Nginx: Allow to configure keywords for aggressive requests rate monitoring.
  * Nginx: Sync FastCGI timeouts with other Nginx and PHP-FPM defaults.
  * PHP: Add /opt/local/bin/php tmp symlink on barracuda/octopus upgrade.
  * PHP: Allow to set custom _PHP_FPM_TIMEOUT but not lower than 60 (in seconds)
  * PHP: Always respect _PHP_FPM_WORKERS variable if set to numeric value > 0
  * PHP: Better defaults for realpath_cache_ttl and realpath_cache_size.
  * PHP: Fix for CVE-2014-0185 privilege escalation in FPM (doesn't affect BOA)
  * PHP: pm.max_children was not properly updated on FPM version self-switch.
  * PHP: Sync incorrect default_socket_timeout with max_execution_time (180s).
  * PHP: Use 30s for pm.process_idle_timeout - it prevents too high RAM usage.
  * PHP: Variable _PROCESS_MAX_FPM is not used on the Satellite Instance level.
  * Postfix: Force re-install if broken permisions detected on upgrade.
  * Prevent duplicate cron invocations with more strict delays.
  * Shell: Proper fix for wildcard in the path (cd command only)
  * Standardize install and upgrade for Chive, SQL Buddy and CGP.
  * Sync Redis timeout with default FPM timeout (180s).
  * Sync SQL connect_timeout with default mysql.connect_timeout in PHP (60s).
  * Update the logic for multi-version PHP support in BOND.
  * Update the logic for multi-version PHP support in docs/REMOTE.txt

#721: Upgrade to BOA-2.2.3 Stable Edition

chris — Sat, 19 Apr 2014 05:58:00 GMT

wiki:PuffinServer has sent this email:

There is new BOA-2.2.3 Stable Edition available.

Please review the changelog and upgrade as soon as possible to receive all security updates and new features.

Changelog: http://bit.ly/newboa

The Changelog contains:

### Stable BOA-2.2.3 Release - Full Edition
### Date: Fri Apr 18 12:57:40 PDT 2014
### Includes Aegir 2.x-boa-custom version.
# Release Notes:
  This release includes several bug fixes and security upgrades both for the
  system services and Drupal core, along with three updated platforms and new
  features, including support for MariaDB 10.0 and Ubuntu 14.04 LTS Trusty.
# Important - Read This First! (for self-hosted BOA only)
  If you haven't run full barracuda+octopus upgrade to latest BOA Stable
  Edition yet, don't use any partial upgrade modes explained in docs/UPGRADE.txt
  Once new BOA Stable is released, you must run *full* upgrades with commands:
  $ barracuda up-stable
  $ octopus up-stable all both
  For silent, logged mode with e-mail message sent once the upgrade is
  complete, but no progress is displayed in the terminal window, you can run
  alternatively, starting with screen session to avoid incomplete upgrade
  if your SSH session will be closed for any reason before the upgrade
  will complete:
  $ screen
  $ barracuda up-stable log
  $ octopus up-stable all both log
  Note that the silent, non-interactive mode will automatically say Y/Yes
  to all prompts and is thus useful to run auto-upgrades scheduled in cron.
# Updated Octopus platforms:
  ### Drupal 7.27.1
  Guardr 1.3 ------------------- https://drupal.org/project/guardr
  Open Atrium 2.17 ------------- https://drupal.org/project/openatrium
  Recruiter 1.2 ---------------- https://drupal.org/project/recruiter
# New features and enhancements in this release:
  * Add docs/FAQ.txt
  * Add support for MariaDB 10.0 or 5.5 install via _DB_SERIES variable.
  * Add support for Ubuntu 14.04 LTS Trusty.
  * Improve auto-healing for multi-version PHP-FPM setup.
  * Improve docs/UPGRADE.txt
  * Improve health check for protected vhosts during live SSH-auth update.
# Changes in this release:
  * Issue #GH-299 - Force disable LESS developer mode on production sites.
  * Move custom scripts to /opt/local/bin/
  * Normalize localhost entry in /etc/hosts to avoid FQDN mapped to 127.0.0.1
  * PHP: Do not use separate FPM pool for cron if _PHP_FPM_DENY is empty.
# System upgrades in this release:
  * MariaDB 5.5.37
# Fixes in this release:
  * Add 'exit 0' line if missing.
  * Add /opt/local/bin to PATH by default.
  * Add symlinks for wrappers only temporarily.
  * Better gem uninstall options.
  * Compass: Multiple fixes for various expected gems versions install/upgrades.
  * Do not override lshell env_path in websh wrapper.
  * Do not use monitored bin path for custom scripts to avoid LFD false alarms.
  * Extra db GRANT for 127.0.0.1 not added when migrating site.
  * Improve auto-healing to create required directories in /var/run/ if missing.
  * Issue #2230269 - New Jetty 9 version overrides JETTY_PORT=8099 with 8080.
  * Issue #2235991 - Drush make needs better exceptions in websh wrapper.
  * Issue #2236475 - Clarify what the Legacy mode really means.
  * Issue #2238965 - Add missing path to switch_to_bash().
  * Issue #2241013 - Git commands should be whitelisted in websh wrapper.
  * Issue #2241495 - wkhtmltopdf stopped working after upgrade.
  * Issue #GH-301 - Update the list of restricted keywords for Octopus username.
  * Make sure that permissions on Chive Manager dir/files are correct.
  * Note: _SSL_FROM_SOURCES=YES is ignored and not needed on Wheezy and Precise.
  * Remove the line with header TABLE_NAME (sqlmagic).
  * Reset PATH to avoid RVM overrides after Compass Tools install/upgrade.
  * Shell: Allow to run 'drush cache-clear drush' in any directory.
  * The _PHP_MODERN_ONLY variable is no longer used.
  * Ubuntu 14.04 LTS Trusty requires MariaDB 10.0
  * Use hostname -b instead of deprecated hostname -v.

Note that we are already running the latest MariaDB, see ticket:692#comment:31

See also the last BOA upgrade ticket, BOA-2.2.2 ticket:707 and also ticket:670

#707: Upgrade to BOA-2.2.2

chris — Wed, 26 Mar 2014 19:25:52 GMT

I have created a new ticket for this as I have found having one ticket (see ticket:629) for all BOA upgrades makes it really hard to review past upgrades.

Upgrades from BOA-2.0.7 to BOA-2.1.1 did have their own tickets, see wiki:PuffinServer#Upgradetickets and unless there is a convincing reason not to have one ticket per upgrade I'd rather do it like this.

Jim has pointed out on the Ttech list that:

the v2.2.0 changelog is up as of a few days ago: http://drupalcode.org/project/barracuda.git/blob/HEAD:/CHANGELOG.txt

The Changelog starts:

Stable BOA-2.2.0 Release - Full Edition
Date: TBD
Includes Aegir 2.x-boa-custom version.
Release Notes:

There are many important changes and improvements in this release you should be aware of *before* running your BOA system upgrade.

Even if you are on a hosted BOA system with upgrades managed for you, it is very important to read at least this extensive release notes.

And if you are more curious, read also the big changelog further below, which covers only a small number of over 530 commits since BOA-2.1.3

I have yet to read the rest of the Changelog.

There is also a task to copy the proposed changes to the BOA configuration in ticket:629 over to this ticket.

Should people other than chris and ed be CC's for this ticket?

#629: Upgrade to BOA-2.1.3 Stable Edition

chris — Sun, 24 Nov 2013 11:47:23 GMT

This ticket is for BOA-2.1.3, the previous version was BOA-2.1.1 ticket:612, see wiki:PuffinServer#Upgradetickets The steps to follow when upgrading wiki:PuffinServer are documented at wiki:PuffinServer#UpgradingBOA

#612: Upgrade to BOA-2.1.1 Stable Edition

chris — Sun, 03 Nov 2013 11:11:24 GMT

I have been sent this email from wiki:PuffinServer:

There is new BOA-2.1.0 Stable Edition available.

Please review the changelog and upgrade as soon as possible to receive all security updates and new features.

Changelog: http://bit.ly/newboa

I could potentially do this upgrade tonight as it's a quite time for the server -- Jim, any reason not to apply this update tonight?

#691: Upgrade Wagn hosting for patterns site

chris — Fri, 21 Feb 2014 16:53:43 GMT

The http://patterns.transitionresearchnetwork.org/ site is running using a development set up and the webrick server falls over every now and then, so the plan is to upgrade to a production style setup.

References:

ticket:635 webrick server problems
wiki:TransitionResearchWagn documentation
ticket:561 the last install
http://wagn.org/installation

#535: Upgrade Puffin, Penguin and Parrot from Debian Squeeze to Wheezy

chris — Fri, 26 Apr 2013 18:49:16 GMT

Debian 7 is due out on 5th May 2013 and wiki:PuffinServer, wiki:PenguinServer and wiki:ParrotServer will need upgrading.

#556: Upgrade Piwik to version 1.12

chris — Thu, 30 May 2013 21:40:48 GMT

A new version of Piwik came out today with some interesting looking features:

#732: Upgrade Piwik to 2.3.0

chris — Tue, 27 May 2014 09:21:24 GMT

Piwik 2.3.0 is a new major release of Piwik!

http://piwik.org/changelog/piwik-2-3-0/

#664: Upgrade Piwik to 2.0.2

chris — Tue, 24 Dec 2013 14:35:06 GMT

This is a bugfix version which fixes 3 issues, see http://piwik.org/changelog/piwik-2-0-1/

Upgrade notes are here, wiki:PiwikServer#Updates

#706: Upgrade Mediawiki to 1.22.5 and install the new VisualEditor

chris — Wed, 26 Mar 2014 15:46:03 GMT

From MediaWiki-announce:

this is a notice that on Thursday, March 27th between 17:00-18:00 UTC (Thursday, March 27th, 9:00-10:00am PST) we will release security and maintenance updates for current and supported branches of the MediaWiki software. Downloads and patches will be available at that time.

#595: Upgrade Mediawiki to 1.19.8 from 1.19.7

chris — Wed, 11 Sep 2013 22:18:05 GMT

From https://git.wikimedia.org/blob/mediawiki%2Fcore.git/REL1_19/RELEASE-NOTES-1.19

MediaWiki 1.19.8

This is a security and maintenance release of the MediaWiki 1.19 branch.

Changes since 1.19.7

SECURITY: Sanitize ResourceLoader exception messages
SECURITY: Token-getting functions will fail when using jsonp callbacks.
SECURITY: Fix extension detection with 2 .'s
Allow a string other than '*' as condition for DatabaseBase::delete()
Purge upstream caches when deleting file assets.
jquery.tablesorter: Add missing dependency on jquery.mwExtension

#536: Upgrade Mediawiki to 1.19.6

chris — Mon, 29 Apr 2013 20:35:32 GMT

A new version of Mediawiki is due out tomorrow:

This is a notice that on Tuesday, April 30th between 20:00-21:00 UTC (1-2pm PDT) Wikimedia Foundation will release security updates for current and supported branches of the MediaWiki software. Downloads and patches will be available at that time, with the git repositories updated later that afternoon.

http://lists.wikimedia.org/pipermail/mediawiki-announce/2013-April/000128.html

The upgrade should simply be a matter of following the steps taken last time, see ticket:532#comment:2

#620: Upgrade MediaWiki to 1.19.9

chris — Fri, 15 Nov 2013 14:57:58 GMT

See the announcement email:

I would like to announce the release of MediaWiki 1.21.3, 1.20.8 and
1.19.9. These releases fix 2 security related bugs that could affect users
of MediaWiki. Download links are given at the end of this email.
* Kevin Israel (Wikipedia user PleaseStand) identified and reported two
vectors for injecting Javascript in CSS that bypassed MediaWiki's blacklist
(CVE-2013-4567, CVE-2013-4568).
<https://bugzilla.wikimedia.org/show_bug.cgi?id=55332>
* Internal review while debugging a site issue discovered that MediaWiki
and the CentralNotice extension were incorrectly setting cache headers when
a user was autocreated, causing the user's session cookies to be cached,
and returned to other users (CVE-2013-4572).
<https://bugzilla.wikimedia.org/show_bug.cgi?id=53032>
Additionally, the following extensions have been updated to fix security
issues:
* CleanChanges: MediaWiki steward Teles reported that revision-deleted IP's
are not correctly hidden when this extension is used (CVE-2013-4569).
<https://bugzilla.wikimedia.org/show_bug.cgi?id=54294>
* ZeroRatedMobileAccess: Tomasz Chlebowski reported an XSS vulnerability
(CVE-2013-4573).
<https://bugzilla.wikimedia.org/show_bug.cgi?id=55991>
* CentralAuth: MediaWiki developer Platonides reported a login CSRF in
CentralAuth (CVE-2012-5394).
<https://bugzilla.wikimedia.org/show_bug.cgi?id=40747>
Full release notes for 1.21.3:
<https://www.mediawiki.org/wiki/Release_notes/1.21>
Full release notes for 1.20.8:
<https://www.mediawiki.org/wiki/Release_notes/1.20>
Full release notes for 1.19.9:
<https://www.mediawiki.org/wiki/Release_notes/1.19>
For information about how to upgrade, see
<https://www.mediawiki.org/wiki/Manual:Upgrading>

The steps followed for the last upgrade can be followed again, see ticket:595 and see also the documentation at wiki:PenguinServer#wiki.transitionnetwork.org

#699: Update Core & Plugins on transitionculture.org

sam — Mon, 10 Mar 2014 11:46:33 GMT

This site needs an update.

I'll do a database backup then update it.

#567: Update BOA for new Redis 2.6.14

chris — Tue, 02 Jul 2013 11:10:27 GMT

A suggestion from Jim:

BOA now includes Redis 2.6.14 <https://raw.github.com/antirez/redis/2.6/00-RELEASENOTES> if you do a 'barracda up-stable system'... What interests me about this is these lines from the changelog:

UPGRADE URGENCY: HIGH because of the following two issues:

Lua scripting + Replication + AOF in slaves problem (see Issue #1164).
AOF + expires possible race condition (see Issue #1079).

It's a long shot, but that could maybe be part of the issue we've seen recently.

I'm not sure if this is best done now or later tonight when the site is less busy?

#900: Unusal High Load on Puffin

chris — Sun, 31 Jan 2016 12:24:40 GMT

For the first time since the BOA cron jobs were commented out we have had some very high loads on PuffinServer, this is shown in the Munin graphs, I'll post some specific ones in comments to this ticket.

#845: Unneeded FTP server on PuffinServer

chris — Mon, 13 Apr 2015 11:03:12 GMT

The BOA stack installs and runs a FTP server, which we don't need as we use SSH/SFTP and it therefore causes a unneeded load, see ticket:692#comment:177 for an example.

#550: Transition Town Totnes migration

chris — Sun, 19 May 2013 14:59:44 GMT

It has been agreed to migrate Transition Town Totnes, http://transitiontowntotnes.org/ to wiki:ParrotServer and this ticket has been created to record this process and the time spent on it and the documentation of the migration.

There is also an issue regarding what, if anything, to do with the old Drupal site at http://archive.transitiontowntotnes.org/

#577: Transition Streets Wordpress Migration

chris — Tue, 06 Aug 2013 21:28:25 GMT

This is a ticket to document the migration of the Transition Totnes http://www.transitionstreets.org.uk/ wiki:WordPress site to wiki:ParrotServer.

#635: Transition Research Patterns WEBrick monitoring

chris — Wed, 27 Nov 2013 12:51:13 GMT

Tom noticed that the wiki:TransitionResearchWagn site was unavailable today. I restarted it following the notes. We could do with something being set up to check that is it running. When it is running it's task can be found like this:

ps -lA | grep "ruby1.8"
1 S  1003  1449     1  1  80   0 - 47153 -      ?        00:00:05 ruby1.8

#842: Trac fetchmail

chris — Thu, 02 Apr 2015 12:54:11 GMT

There is a new SSL/TLS certificate at mail.webarch.net so these steps need following: wiki:TransitionTrac#Fetchmail

#546: Trac documentation

chris — Wed, 08 May 2013 18:47:09 GMT

Better documentation of things like how to set billing times etc

#642: Trac "databasee is locked" errors in /var/log/messages

chris — Sat, 07 Dec 2013 13:46:43 GMT

I have just noticed these errors in /var/log/messages on wiki:PenguinServer:

Dec  1 23:09:00 penguin <11>Trac[chrome] ERROR: Error with navigation contributor TimingEstimationAndBillingPage: OperattionalError: database is locked
Dec  1 23:09:00 penguin <11>Trac[chrome] ERROR: Error with navigation contributor AdminModule: OperationalError: databasse is locked
Dec  1 23:09:00 penguin <11>Trac[chrome] ERROR: Error with navigation contributor SearchModule: OperationalError: databaase is locked
Dec  1 23:09:00 penguin <11>Trac[chrome] ERROR: Error with navigation contributor QueryModule: OperationalError: databasse is locked
Dec  1 23:09:00 penguin <11>Trac[chrome] ERROR: Error with navigation contributor ReportModule: OperationalError: databaase is locked
Dec  1 23:09:00 penguin <11>Trac[chrome] ERROR: Error with navigation contributor RoadmapModule: OperationalError: databbase is locked
Dec  1 23:09:00 penguin <11>Trac[chrome] ERROR: Error with navigation contributor TicketModule: OperationalError: databaase is locked
Dec  1 23:09:00 penguin <11>Trac[chrome] ERROR: Error with navigation contributor TimelineModule: OperationalError: dataabase is locked
Dec  1 23:09:00 penguin <11>Trac[chrome] ERROR: Error with navigation contributor BrowserModule: OperationalError: databbase is locked
Dec  1 23:09:00 penguin <11>Trac[chrome] ERROR: Error with navigation contributor WikiModule: OperationalError: databaseeis locked

There are lots more of these, including some from this morning.

Trac still seems to be working OK so I don't know how significant they are.

#604: Times for admin tasks

ed — Thu, 03 Oct 2013 13:10:00 GMT

I am timing some of the admin tasks and keeping a log here for reference. Front of the site is great, backend is still like hauling ghosts through jelly for me.

58 seconds: https://www.transitionnetwork.org/admin/user/user/create

#713: Ticket clearing

chris — Wed, 02 Apr 2014 09:30:31 GMT

There are 33 Open Maintenance Tickets this ticket is to record the time taken to close as many of them as possible.

#585: TTech Meeting 5th September 2013

chris — Thu, 05 Sep 2013 07:47:16 GMT

This ticket has been created for the TTech Skype meeting due to take place today.

#601: TTech Meeting 3rd October 2013

chris — Thu, 03 Oct 2013 09:03:42 GMT

This is a ticket for notes and times for the online meeting held on 3rd October 2013.

The ticket for the last meeting is ticket:585

#852: TN site down

sam — Fri, 15 May 2015 18:23:38 GMT

Hi all

According to pingdom and testing in my browser TN is currently unavailable.

Is anyone around over the weekend to take a look?

Thanks

Sam

#654: TIs appearing in 'TIs by list' view without a number

ed — Thu, 12 Dec 2013 12:43:12 GMT

Some TIs are appearing in the 'Initiatives by number' view - but don't have numbers:

https://www.transitionnetwork.org/initiatives/by-number

for Sam to invesitage and solve or put to techs in January

#568: TC blog: can't not send notifications

ed — Mon, 08 Jul 2013 10:20:16 GMT

I can't see how to do a node edit and *not* send a notification - here seen on the Transition Culture blog:

https://www.transitionnetwork.org/node/32863/edit

please advise - there's been some kerfuffle about the TC blog move so swift resolution much appreciated

#826: Switching MX records from United to Google

ed — Thu, 15 Jan 2015 17:15:41 GMT

TN are switching the MX records from United to Google on Friday 23/1/15.

Will this affect the website/Web Architects in any way that we need to plan for in advance? Scripts, web forms etc? Anything you can think of?

#614: Subscription option for Social Reporters CT

ed — Wed, 06 Nov 2013 16:49:49 GMT

We want a button on the Social Reporters section that enables users to easily subscribe to the Social Reporters' blog posts CT. Offers the option to all types of user:

Users may not be logged in
Users may not be registered

This is a bit like the sub button on Transition Culture section
I can't find it in TRAC but have this memory of enabling email-only subscriptions to not-registered-users from olden days - can you enlighten me about that? I'm not sure it's the answer - we probably want them to register so they can add comments - but this request has brought up that old function

#724: Subscription emails from Rob's blog not arriving.

sam — Tue, 29 Apr 2014 09:21:12 GMT

A user has got in touch to let us know he is not getting Rob's updates by email. He's still subscribed.

I just checked my mail and the last one I received was on the 11/4. I'll have a look and see if I can work it out.

#839: Stable BOA-2.4.1 Release

chris — Tue, 24 Mar 2015 10:44:41 GMT

BOA appears to have stopped sending email to notify that new versions are available, I just manually checked the Changelog and discovered that BOA-2.4.1 came out on 8th March 2015:

### Stable BOA-2.4.1 Release - Full Edition
### Date: Sun Mar  8 14:56:51 PDT 2015
### Milestone URL: https://github.com/omega8cc/boa/milestones/2.4.1
### Latest hotfix added on: Wed Mar 11 11:58:52 PDT 2015
  @=> Includes Aegir Hostmaster 2.x-head with improvements
  @=> Includes Aegir Provision 3.x-head with improvements
  @=> Includes Drush 7.0.0-alpha9 customized for BOA
# Release Notes:
  This new BOA release includes one new and 12 updated Aegir platforms,
  8 new features and enhancements, 15 new software versions, 10 other changes,
  plus over 38 bug fixes, with most notable features and changes listed below:
  @=> Add duobackboa with /root/.duobackboa.cnf file to run duplicate backups
  @=> Add SSL with TLS/SNI on server with one IP, multiple certificates support
  @=> Add support for Octopus batch migration - see docs/MIGRATE.txt for details
  @=> Allow to use _PHP_GEOS=YES with all PHP versions
# New Octopus platforms:
  OpenAid 2.0 ------------------ https://drupal.org/project/openaid
# Updated Octopus platforms:
  Commerce 1.33 ---------------- https://drupal.org/project/commerce_kickstart
  Commerce 2.21 ---------------- https://drupal.org/project/commerce_kickstart
  Commons 2.22 ----------------- https://drupal.org/project/commons
  Commons 3.22 ----------------- https://drupal.org/project/commons
  Drupal 8.0.0-b7 -------------- https://drupal.org/drupal-8.0
  Guardr 2.8 ------------------- https://drupal.org/project/guardr
  OpenAtrium 2.32 -------------- https://drupal.org/project/openatrium
  OpenChurch 2.1-b5 ------------ https://drupal.org/project/openchurch
  OpenOutreach 1.16 ------------ https://drupal.org/project/openoutreach
  OpenScholar 3.20.0 ----------- http://theopenscholar.org
  Panopoly 1.18 ---------------- https://drupal.org/project/panopoly
  Recruiter 1.5 ---------------- https://drupal.org/project/recruiter
# New features and enhancements:
  * Add compatibility with latest VS beng kernel
  * Add duobackboa with /root/.duobackboa.cnf file to run duplicate backups
  * Add support for multivalued fields in SOLR 4 - pull request #626
  * Add support for mysqladmin proc logging
  * Add support for Octopus batch migration - see docs/MIGRATE.txt for details
  * Add support for scout/mysql monitoring
  * CSF: Add popular ports 222 and 2222 to TCP_OUT by default
  * SSL with TLS/SNI on server with one IP, multiple certificates - fixes #465
# Changes:
  * Allow to run automated SQL conversion only weekly
  * Allow to use _PHP_GEOS=YES with all PHP versions
  * Do not send extra nocache cookie on GET requests
  * Drush mini-7-07-03-2015
  * Make barracuda wrapper available on initial install to avoid confusion
  * Nginx: Update for crawlers exceptions list
  * Redis Integration Module: Update to version mod-05-03-2015
  * Remove dependency on legacy Drush 4
  * Use latest Apache Solr Search 6.x-3.x config
  * Use latest Apache Solr Search 7.x-1.x config
# System upgrades:
  * Apache Solr 4.9.1
  * cURL 7.41.0 (if installed from sources)
  * Git 2.3.0 (if installed from sources)
  * Jetty 9.2.7.v20150116
  * MariaDB 10.0.17
  * MariaDB 5.5.42
  * MariaDB Galera Cluster 10.0.17
  * Nginx 1.7.10
  * OpenSSL 1.0.2 (if installed from sources)
  * PHP 5.4.38
  * PHP 5.5.22
  * PHP 5.6.6
  * PHP: ionCube loader 4.7.4
  * Pure-FTPd 1.0.37
  * Ruby 2.2.1
  * Use duplicity 0.7.01 and boto 2.36.0 - fixes #630
  * Vnstat 1.13
# Fixes:
  * [provision] False "load on system too heavy" messages - fixes #619
  * [provision] Issue #2350695 - Profile is registered twice, also as a module
  * [provision] Nginx: Remove webform keyword from regex locations - fixes #599
  * Add also manage_ltd_users to the list - fixes #616
  * Avoid installing New Relic with no valid license key provided - fixes #608
  * Do not add no longer used symlink
  * Do not create conflicting plain HTTP proxy for single IP mode - fixes #465
  * Do not delete backboa while duplicity is running
  * Do not replace any contrib in latest OA - fixes #2420131
  * Do not run D7 core hotfix on already fixed instances
  * Fix for legacy systems autoupdate logic
  * Fix for missing chattr -i on web user update
  * Fix for missing datestamp
  * Fix for too dangerous pdnsd auto-config logic
  * Fix pdnsd restarts procedures - fixes #610
  * Fix permissions for pdnsd if needed
  * Fix variable in autoupboa - pull request #629
  * Force php.ini update
  * Hotfix for cluster instances
  * Hotfix for OpenSSL/cURL versions out of sync
  * How to enable permanent redirect to HTTPS with single IP - #465
  * Issue #2425963 - Broken slider in Commerce Kickstart 2.21
  * Make sure that @hostmaster alias works after migration
  * Provide a patch for older civicrm versions to make them Drush 7 compatible
  * Randomize backups schedule to avoid issues with AWS limits
  * Reload nginx service automatically - #465
  * Remove conflicting pdnsd restarts to avoid race conditions - fixes #610
  * Remove deprecated sysctl options
  * Remove post-install leftovers if needed
  * Single PHP-version installation fails - fixes #598
  * Typo - fixes #539
  * Unable to connect to SOLR on latest head - fixes #623
  * Update installers as expected, also with _SKYNET_MODE=OFF - fixes #644
  * Update meta-installers for new stable
  * Update the upgrade procedure how-to - fixes ##616
  * Use civicrm-4.5.6 compatible with Drush 7
  * Use correct AWS Endpoint when us-east-1 Region is specified
  * Use correct open_basedir for lshell user - fixes #603
  * Use separate loops for symlinks and ghost cleanup
  * Workaround for EntityMalformedException in Open Outreach - fixes #229
  * Workaround for missing interface/lo.pdnsd on legacy systems
  * Workaround for SA-CONTRIB-2015-063 - Webform - Cross Site Scripting

I'll run the upgrade one evening this week.

#827: Stable BOA-2.4.0 Release

chris — Mon, 19 Jan 2015 20:11:09 GMT

No release date yet, but lots of detail in the Changelog:

https://github.com/omega8cc/boa/blob/master/CHANGELOG.txt

2.4.0 issues:

https://github.com/omega8cc/boa/milestones/2.4.0

#844: Stable BOA 2.4.2 Release

chris — Fri, 10 Apr 2015 10:34:56 GMT

Looks like all the tickets for BOA 2.4.2 have been closed and it is due to be released today:

https://github.com/omega8cc/boa/milestones

The Changelog has not yet been updated:

https://github.com/omega8cc/boa/blob/master/CHANGELOG.txt

For some unknown reason BOA no longer sends emails when a new version is out so the Changelog will need checking manually.

#677: Spike in MyISAM (search) database activity, Redis unable to cache such requests

chris — Wed, 15 Jan 2014 10:49:33 GMT

Since Sunday there has been a marked increase in MySQL activity and also a drop in Redis memory use, I suspect these things are related.

I'll post some Munin graphs below to illustrate this.

#579: Special email alert for Rob Hopkins blog posts on TN.org

ed — Mon, 12 Aug 2013 13:49:30 GMT

Can we create a specific email alert for new blog posts from Rob Hopkins' blog (/blogs/rob-hopkins)?
Can Ed do this?
See below:

Proposed new alert: ~

From: [Rob Hopkins at Transition Network <site@…>] Subject: New blog post from Rob Hopkins' Transition Culture To: [subscriber email] Reply to: [<site@…>]

Hello. I've written a new blog Transition Culture blog post

You can read it and leave comments here: [LINK]

[BLOG POST TITLE] [LINE BREAK - FULL CLEAR LINE] [BLOG POST TEASER] [LINE BREAK - FULL CLEAR LINE]

Best regards, Rob

-- [TN EMAIL SUBSCRIPTION AUTO-BLURB] This is an automatic message from Transition Network To manage your subscriptions, browse to http://www.transitionnetwork.org/user/285/notifications You can unsubscribe at http://www.transitionnetwork.org/notifications/unsubscribe/subscription/...

#656: Spam being sent out via Transition Culture

chris — Sat, 14 Dec 2013 14:48:21 GMT

I'm getting several of thee day day:

From: Mail Delivery System <Mailer-Daemon@parrot.webarch.net>
Date: Sat, 14 Dec 2013 13:21:02 +0000
To: tc@parrot.webarch.net
Subject: Mail delivery failed: returning message to sender
This message was created automatically by mail delivery software.
A message that you sent could not be delivered to one or more of its
recipients. This is a permanent error. The following address(es) failed:
  inxzkysnf@gmail.com
    SMTP error from remote mail server after RCPT TO:<inxzkysnf@gmail.com>:
    host gmail-smtp-in.l.google.com [173.194.78.26]:
    550-5.1.1 The email account that you tried to reach does not exist. Please try
    550-5.1.1 double-checking the recipient's email address for typos or
    550-5.1.1 unnecessary spaces. Learn more at
    550 5.1.1 http://support.google.com/mail/bin/answer.py?answer=6596 l11si2175565wjw.16 - gsmtp
------ This is a copy of the message, including all the headers. ------
Return-path: <tc@parrot.webarch.net>
Received: from tc (uid=1011)
        by parrot.webarch.net with local (Exim 4.80)
        (envelope-from <tc@parrot.webarch.net>)
        id 1Vrp9L-0002BF-Kf
        for inxzkysnf@gmail.com; Sat, 14 Dec 2013 13:20:56 +0000
To: inxzkysnf@gmail.com
Subject: Thanks for your message
X-PHP-Originating-Script: 1011:lib_nonajax.php
From: robjhopkins@gmail.com
Reply-To: robjhopkins@gmail.com
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="----MIME_BOUNDRY_main_message"
Message-Id: <E1Vrp9L-0002BF-Kf@parrot.webarch.net>
Date: Sat, 14 Dec 2013 13:20:55 +0000
This is a multi-part message in MIME format.
------MIME_BOUNDRY_main_message
Content-Type: text/plain; charset="UTF-8"; format=flowed
Content-Transfer-Encoding: quoted-printable
Dear timberland france,
Thank you for your message on the Transition Culture website - I will get back to you as soon as possible.
------MIME_BOUNDRY_main_message
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><BODY>
<div style=3D"font:normal 1em arial; margin-top:10px"><p><strong>Dear timberland france,</strong></p>
<p>Thank you for your message on the Transition Culture website - I will get back to you as soon as possible.
<div style=3D"width:80%; background:#f4faff ; color:#aaa; font-size:11px; padding:10px; margin-top:20px"><strong>This is an automatic
+confirmation message. 14 December, 2013.</strong></div></div></BODY></HTML>

It appears to be spam sent fro the Transition Culture WordPress site to a Gnmail user who doesn't exist.

It appears, from the email headers that this form is being used for the spamming /home/tc/sites/default/wp-content/plugins/contactforms/lib_nonajax.php.

This needs some more investigation.

#554: Site slow down and MySQL load increase

chris — Tue, 28 May 2013 18:11:51 GMT

Since the upgrade to MariaDB 5.5.31, done on ticket:218#comment:93 (and fixed on ticket:548#comment:32) there appears to have been been a noticeable slowdown in the time for pages to be generated, measuring with http://tools.pingdom.com/fpt/ the front page alone takes around 5 seconds to generate.

There is a clear increase in the amount of MySQL/MariaDB activity measured by Munin, see the attached graphs, the upgrade was done around midday on 24th May 2013. There has also been a increase in traffic according to the firewall graphs. The memory usage of redis has also dropped right down and the database memory usage has significantly increased.

It's not totally clear if the cause of this change in behaviour of the site is related to the MySQL/MariaDB upgrade or if there was a coincidental change in the traffic to the site at the same time. There is no noticeable change in the visitors recorded in the Piwik stats.

According to pingdom the front page of the site is now "slower than 77% of all tested websites" with a total load time of around 6 seconds, almost all of this is down to the wait of around 5 seconds for the index.php file. This can also be tested from parrot with Apache bench, sometimes cached pages are served up and these appear in an instance, if the front page is generated it takes around 5 seconds, see wiki:LoadTimes#a2013-05-28

#828: Site down due to massive load spike 2015-01-29

chris — Thu, 29 Jan 2015 17:09:07 GMT

Seems to be recovering now, this ticket is to try to find the cause.

#576: Site down

ed — Thu, 01 Aug 2013 09:42:44 GMT

Been down for 15 minutes by now I reckon

#755: Site administrator's file upload capacity: not responding to changes

ed — Tue, 08 Jul 2014 09:21:16 GMT

Rob Hopkins reached the limit for file uploads and could not upload any more images (not good for him as he writes posts with lots of pictures daily).

Sam raised the limit. This change in the limit does not seem to have affected Rob's situation - he still can't upload any images.

Looking at these settings: https://www.transitionnetwork.org/admin/settings/uploads

Rob should be able to upload more - he is a site editor and admin - but he can't.

Please investigate

#687: Set up cert expiry date checking for all SSL certs

chris — Mon, 03 Feb 2014 13:35:01 GMT

Last month the *.transitionnetwork.org cert expired before it was replaced with a new one and users therefore got warnings for around half a day, see ticket:685.

A script to check the expiry dates was set up on wiki:PuffinServer on ticket:685#comment:9 and this ticket is to document setting this up for wiki:PenguinServer and wiki:ParrotServer.

#557: Set up a re-direct

ed — Tue, 04 Jun 2013 15:21:18 GMT

Please can you set up two re-direct/pointers

from: "power.transitionnetwork.org" to: "http://www.transitionnetwork.org/power-just-doing-stuff"

AND

from: "http://www.thepowerofjustdoingstuff.org" (we own in gandi) to: "http://www.transitionnetwork.org/power-just-doing-stuff"

#739: Set up DEV and other drupal accounts for Annesley

ed — Wed, 11 Jun 2014 14:38:42 GMT

is this you chris? or a sam job? or paul?

#599: Server time drift

chris — Sun, 29 Sep 2013 21:57:59 GMT

The servers are not keeping good time at the moment.

#815: Security updates need to be applied for a couple of contributed modules:

paul — Tue, 16 Dec 2014 13:45:16 GMT

DBTNG Hierarchical Select

Transition Technology: Ticket Query

#881: Site on ParrotServer with a memory leak?

#814: Higher that usual loads on PuffinServer since early September

#898: Fwd: Access to Drupal

#676: Alternative to Skype for TTech Meetings

#655: Add social media icons with counters to blogs listings views

#645: APC Tuning on Parrot and Penguin

#772: new TIs not appearing on staging until caches flushed

#582: TN.org platform and sites

#662: Subscriptions' links in text emails breaking

#737: SPF / Emails rejected from the website contact form

#638: Question about notifications option for content creators

#587: Puffin MySQL Tuning

#701: Emails & Telephone calls

#711: Emails & Telephone calls

#590: Drupal performance improvements

Summary of actions and status

TODO

Done

#541: Documentation of the WordPress sites

#636: Changes to Space.transitionnetwork.org homepage to facilitate user registration

#727: Change background on block from orange to white

#596: Captions issue

#758: * Advisory ID: DRUPAL-SA-CORE-2014-003

#753: wiki.transitionnetwork.org displaying error

#583: tmp files on parrot exceeded inode limit

#487: robots.txt files for development sites

#580: php5-fpm starting when puffin boots

#528: patterns.transitionresearchnetwork.org DNS update

#502: patterns sub-domain for transitionresearchnetwork.org, was: Setting up specific pointer for URL

#780: parrot

#778: need access to Parrot

#698: intransitionmovie.com returns 405 on submit

#538: intransitionmovie.com checks and updates

#639: earthin site wordpress error

#773: download copy of current TN D6 website

#762: cannot log in to Puffin

#771: cannot access puffin over sftp again

#811: WordPress critical security release

#594: WordPress 3.6.1 Maintenance and Security Release

#637: What is the wordcount for the /news and /blogs/rob-hopkins teasers?

#668: Wagn transition_mod

#665: Wagn "Problem Loading Page" error

#609: Videos not showing if added via video link

#627: Users: deleting their own accounts

#562: Users being subscribed to widgets newsletter on registratoin

#575: User system is blocking *everyone* - needs fixing urgently

#608: User profile pictures are too big

#748: Urgent: Fiona having problems sending email

#729: Upgrade to Piwik 2.2.2

#726: Upgrade to Piwik 2.2.1

#720: Upgrade to Piwik 2.2.0

Piwik 2.2 helps you focus on your data

New features

#672: Upgrade to Piwik 2.0.3

#532: Upgrade to Mediawiki 1.19.5

#736: Upgrade to MediaWiki 1.23.0

What's new?

Skin autodiscovery deprecated

Notifications

Merged extensions

Interface

Editing

Help pages

CSS refresh for Vector

Configuration

#745: Upgrade to BOA-2.2.6 Stable Edition

#725: Upgrade to BOA-2.2.5

#721: Upgrade to BOA-2.2.3 Stable Edition

#707: Upgrade to BOA-2.2.2

#629: Upgrade to BOA-2.1.3 Stable Edition

#612: Upgrade to BOA-2.1.1 Stable Edition

#691: Upgrade Wagn hosting for patterns site

#535: Upgrade Puffin, Penguin and Parrot from Debian Squeeze to Wheezy

#556: Upgrade Piwik to version 1.12

#732: Upgrade Piwik to 2.3.0

#664: Upgrade Piwik to 2.0.2

#706: Upgrade Mediawiki to 1.22.5 and install the new VisualEditor

#595: Upgrade Mediawiki to 1.19.8 from 1.19.7

MediaWiki 1.19.8

#575: User system is blocking everyone - needs fixing urgently

#568: TC blog: can't not send notifications