Transition Technology: Ticket #758: * Advisory ID: DRUPAL-SA-CORE-2014-003

hours, totalhours changed

paul — Thu, 17 Jul 2014 14:31:03 GMT

hours changed from 0.0 to 0.75
totalhours changed from 0.0 to 0.75

It's taking longer than usual to build a new stage platform and clone the most recent version of the stage site (made by me on my own platform)

I think I'll try again ..

Adding total time taken on this task so far ..

paul — Thu, 17 Jul 2014 14:41:08 GMT

I have cloned the stage site after a retry.

The platform had these problems previously:

Unable to download http://drupal.org/files/issues/location.module_34.patch. Could not download platform using drush make. No platform present

Building ..

hours, totalhours changed

paul — Thu, 17 Jul 2014 15:06:50 GMT

hours changed from 0.0 to 0.5
totalhours changed from 0.75 to 1.25

I tried to build the platform again but I still encounter the same problem.

The patch file loads fine in my browser.

The raw makfile from my github site also loads fine in my browser: https://raw.githubusercontent.com/paulbooker/transitionnetwork.org-d6.profile/master/transitionnetwork.org-d6.make

@Chris

Would you have a look into this?

@Ed ..

I'll pick this is up again later

hours, totalhours changed

paul — Thu, 17 Jul 2014 21:57:57 GMT

hours changed from 0.0 to 0.25
totalhours changed from 1.25 to 1.5

@Chris

I get the same problem when I try to build the platform makefile from a terminal. Any thoughts on why building a platform is not working?

Considering the alternatives ..

puffin:/data/disk/tn/static/transition-network-s6-32-booker# sudo -u tn drush make transitionnetwork.org-d6.make . Project information for admin_menu retrieved. [ok] Project information for content_profile retrieved. [ok] ... location downloaded from http://ftp.drupal.org/files/projects/location-6.x-3.x-dev.tar.gz. [ok] Unable to download http://drupal.org/files/issues/location.module_34.patch. [error] logintoboggan downloaded from http://ftp.drupal.org/files/projects/logintoboggan-6.x-1.x-dev.tar.gz. [ok] ...

jquery.cycle downloaded from http://malsup.github.com/jquery.cycle.all.js. [ok] jquery.ui downloaded from http://jquery-ui.googlecode.com/files/jquery.ui-1.6.zip. [ok] colorbox downloaded from http://drupal.org/files/colorbox-1.3.18.zip. [ok] puffin:/data/disk/tn/static/transition-network-s6-32-booker#

hours, totalhours changed

paul — Fri, 18 Jul 2014 23:28:36 GMT

hours changed from 0.0 to 0.25
totalhours changed from 1.5 to 1.75

Still experiencing problems creating a platform & removing failed platform requests.

As soon as these are fixed I'll perform the security update.

hours, component, owner, totalhours changed; cc set

chris — Sun, 20 Jul 2014 19:57:51 GMT

cc chris, ed, ben, sam, annesley added
hours changed from 0.0 to 0.1
component changed from Unassigned to Drupal modules & settings
owner changed from ed to jim
totalhours changed from 1.75 to 1.85

Cc's added -- people might not have seen this ticket (I hadn't):

https://trac.transitionnetwork.org/trac/ticket/758

Replying to paul:

Any thoughts on why building a platform is not working?

Testing getting the file using lynx and wget, as root, on the server:

lynx -head -dump http://drupal.org/files/issues/location.module_34.patch | grep Location
  Location: https://www.drupal.org/files/issues/location.module_34.patch
wget https://www.drupal.org/files/issues/location.module_34.patch -O /tmp/location.module_34.patch
  2014-07-20 20:54:35 (5.88 MB/s) - `/tmp/location.module_34.patch' saved [575/575]

And the file:

Index: location.module^M
===================================================================^M
--- location.module     (revision 1047)^M
+++ location.module     (working copy)^M
@@ -280,7 +280,7 @@^M
     // If State/Province is using the select widget, update the element's options.
     if ($field == 'province' && $fsettings[$field]['widget'] == 'select') {
       // We are building the element for the first time
-      if (!isset($element['value']['country'])) {
+      if (!isset($element['#value']['country'])) {
         $country = $fdefaults['country'];
       }
       else {

The only two things I noticed are:

The URL you used was a 301 -- try https://www.drupal.org/files/issues/location.module_34.patch ?

The files has a mixture of Windows and UNIX line endings, I guess this isn't an issue.

owner, status changed

chris — Sun, 20 Jul 2014 20:07:13 GMT

owner changed from jim to paul
status changed from new to assigned

Oops, didn't mean to assign this to jim.

ed — Mon, 21 Jul 2014 08:33:03 GMT

anything to do with the boa update on friday?

jim — Mon, 21 Jul 2014 09:42:47 GMT

FWIW I found in the past it's best to use HTTP:// for patches - drush make sometimes gets confused/disallows HTTPS patches for some reason. Not clear why or what the cause is, but there you go...

paul — Mon, 21 Jul 2014 10:36:29 GMT

Thanks. Looking in to this now ..

chris — Mon, 21 Jul 2014 10:45:01 GMT

Replying to jim:

FWIW I found in the past it's best to use HTTP:// for patches - drush make sometimes gets confused/disallows HTTPS patches for some reason. Not clear why or what the cause is, but there you go...

My guess, in this case, is that the resouces was available via http but is now only available via https and drush isn't following the Location header in the 301 response.

hours, totalhours changed

paul — Mon, 21 Jul 2014 11:36:48 GMT

hours changed from 0.0 to 0.5
totalhours changed from 1.85 to 2.35

Thanks for the suggestion Chris. I made the change to the makefile but it didn't fix the problem.

I think it may be some broader permission problem as I also couldn't delete my failed platforms. Not sure.

It looks as though Drupal no longer provides patches for security updates. Can anyone confirm? I was considering applying the security patch to the stage site and check that everything works correctly we could then decide whether to repeat on the live site.

I'll pick this up agin later ...

annesley — Mon, 21 Jul 2014 11:49:58 GMT

some thoughts on security policy (note that i am just opening a discussion, my opinion on these questions is not necessarily either to ignore or accept): how important is XSS? it would allow a malicious hacker to send a URL to someone in an email that placed a "Donate to TN" button on the TN.org page after it has been served. do we care about DOS attacks? what is the likelihood? will the IPchains / firewall prevent it anyway? where is the FileField? used? are all the uploaded files public?

hours, totalhours changed

paul — Mon, 21 Jul 2014 12:24:36 GMT

hours changed from 0.0 to 0.125
totalhours changed from 2.35 to 2.475

Personally, I don't get in to the details of what's changed. If the security team advise to patch core, I think it's best to just patch core.

ben — Mon, 21 Jul 2014 12:40:08 GMT

It sounds like generally follow the same principal as paul on this. I feel
like if as a community (of drupal users) we keep up with the latest version
then the developers need only to check that their modules work with the
latest version. I don't feel the need to look at the details and decide on
each update. If an update breaks a module we're using then we give feedback
to that module's developer and it (hopefully) then gets fixed for us by
them, and in turn the rest of the community. Staying behind feels a bit
'selfish'.
But saying that I realise that keeping up to date is an expensive thing to
do. I think perhaps, if what we want to do is save money, that we should
decide on a update period.
Say we decide 6 months... We do critical updates as and when they come out
(cos somebody's thought about it, and have decided that it's critical), and
if a critical updates comes out we might find we need to update other
modules/core at the same time. Other updates (that don't appear to be
related to a critical module) then are left, and only updated when we reach
the end of that period (unless some work related to a module is being
undertaken - say I'm working on the theme it makes sense that I'm working
on the latest version of the code)...
that's my tuppence...
On 21 July 2014 13:24, Transiton Technology Trac <
trac@tech.transitionnetwork.org> wrote:
> #758: * Advisory ID: DRUPAL-SA-CORE-2014-003
> -------------------------------------+-------------------------------------
>            Reporter:  paul           |                      Owner:  paul
>                Type:  maintenance    |                     Status:
>            Priority:  major          |  assigned
>           Component:  Drupal         |                  Milestone:
>   modules & settings                 |                 Resolution:
>            Keywords:                 |  Estimated Number of Hours:  0.0
> Add Hours to Ticket:  0.125          |                  Billable?:  1
>         Total Hours:  2.35           |
> -------------------------------------+-------------------------------------
> Changes (by paul):
>
>  * hours:  0.0 => 0.125
>  * totalhours:  2.35 => 2.475
>
>
> Comment:
>
>  Personally, I don't get in to the details of what's changed. If the
>  security team advise to patch core, I think it's best to just patch core.
>
> --
> Ticket URL: <https://tech.transitionnetwork.org/trac/ticket/758#comment:14
> >
> Transition Technology <https://tech.transitionnetwork.org/trac>
> Support and issues tracking for the Transition Network Web Project.
>
--
-------------
emailme@benjarlett.co.uk
benjarlett.co.uk <http://www.benjarlett.co.uk>
07734 970739

chris — Mon, 21 Jul 2014 17:14:19 GMT

Replying to paul:

I think it may be some broader permission problem as I also couldn't delete my failed platforms. Not sure.

Want me to look at anything specific? Are you doing this as the tn.ftp user?

hours, totalhours changed

paul — Mon, 21 Jul 2014 17:21:17 GMT

hours changed from 0.0 to 0.125
totalhours changed from 2.475 to 2.6

Replying to chris:

Replying to paul:

I think it may be some broader permission problem as I also couldn't delete my failed platforms. Not sure.

Want me to look at anything specific? Are you doing this as the tn.ftp user?

I have mostly been trying to create a platform through the aegir interface as I know this has been working. Maybe try to reproduce the problem of creating a platform in aegir and seeing if you can figure out what changed.

hours, totalhours changed

ben — Mon, 21 Jul 2014 17:31:37 GMT

hours changed from 0.0 to 0.1515
totalhours changed from 2.6 to 2.7515

adding a little bit of time for my comment.

chris — Mon, 21 Jul 2014 18:05:51 GMT

Replying to paul:

Maybe try to reproduce the problem of creating a platform in aegir and seeing if you can figure out what changed.

I've not done that before so I don't know how long it would take me... is there any other option?

hours, totalhours changed

paul — Mon, 21 Jul 2014 19:45:57 GMT

hours changed from 0.0 to 1.25
totalhours changed from 2.7515 to 4.0015

I was concerned about long it might take me to figure it out. I was thinking that you would probably be quicker with your Aegir shell foo. No worries. I'll investigate tomorrow - I'm a spent force this evening :).

chris — Sun, 27 Jul 2014 09:05:05 GMT

Replying to ed:

anything to do with the boa update on friday?

It could be, I have just realised that after running barracuda up-stable I omitted to run octopus up-stable all, really sorry about that. There is now another BOA update availabe, I'll install it tonight and make sure I don't forget the second step, ticket:765.

ed — Mon, 28 Jul 2014 09:50:22 GMT

has this made a difference? paul?

paul — Mon, 28 Jul 2014 10:25:29 GMT

Ed, I'll try this afternoon.

milestone set

chris — Tue, 29 Jul 2014 10:50:30 GMT

milestone set to Maintenance

paul — Tue, 29 Jul 2014 13:11:12 GMT

Sorry, I'll get to this shortly ..

hours, totalhours changed

paul — Tue, 29 Jul 2014 16:41:02 GMT

hours changed from 0.0 to 1.75
totalhours changed from 4.0015 to 5.7515

Update seems to be working fine on stage.

https://booker-stage-20140717.transitionnetwork.org / Transition Network D6-32-S002 Booker https://booker-stage-20140717.transitionnetwork.org/admin/reports/dblog

I fixed the problem with building the platform by placing quotation marks around the patch url!

New production platform: Transition Network D6-32-P001 Booker

I'll migrate the production site to the new platform, when I get clearance.

Thoughts:

Process is slow. Better would be to do something along the lines of git pull [stage] , test [stage], create a tag [stage], git pull [production] < 45 minutes

hours, totalhours changed

paul — Thu, 31 Jul 2014 10:13:09 GMT

hours changed from 0.0 to 0.125
totalhours changed from 5.7515 to 5.8765

Just a friendly reminder, that I'll need to clearance to update the production site. I'll carry out the update late at night.

chris — Thu, 31 Jul 2014 12:07:04 GMT

Replying to paul:

Just a friendly reminder, that I'll need to clearance to update the production site. I'll carry out the update late at night.

My understanding is that as you are the lead Drupal deployment / update person that it's your call and although we have been discussing stopping updating the site (ticket:764) we haven't reached a consensus or decision on that proposal, so I'd say go for it when ever is convenient and if you do it before midnight it'll come out of the July budget, however it's Ed that has the last shout and I might be wrong on these things. I think Ed is still on leave so perhaps send him a quick txt to confirm what you intend to do? Email me off list if you don't have his mobile number.

paul — Thu, 31 Jul 2014 12:36:52 GMT

Thanks Chris. If there are no objections forthcoming I'll update the website later this evening.

sam — Thu, 31 Jul 2014 13:39:01 GMT

I'd not contact Ed whilst he's on holiday unless it was really genuinely urgent.

I say go for it Paul.

Best

Sam

paul — Thu, 31 Jul 2014 13:47:54 GMT

Thanks Sam.

hours, totalhours changed

paul — Thu, 31 Jul 2014 21:51:46 GMT

hours changed from 0.0 to 0.5
totalhours changed from 5.8765 to 6.3765

Core updated. No problems to report.

ed — Mon, 04 Aug 2014 13:20:07 GMT

Good work. SO - was the update problems to do with the Octopus update Chris did? ie do we need to worry about you having those problems?

hours, totalhours changed

paul — Mon, 04 Aug 2014 14:34:24 GMT

hours changed from 0.0 to 0.125
totalhours changed from 6.3765 to 6.5015

Ed,

I think the problem was just that I didn't pick up on a potential formatting problem:

https://github.com/transitionnetwork/transitionnetwork.org-d6.profile/commit/030f3563ae20ee48f0ff7c17e826c537d44e687b

Not sure what problem Chris fixed. It may have helped.

It seems that the update process is working fine (just a little slow) Next time I'll try to do build platforms / site migrations from the terminal to see if I can get things done any quicker.

Best, Paul

paul — Mon, 04 Aug 2014 14:35:32 GMT

Replying to paul:

Ed,

I think the problem was just that I didn't pick up on a potential formatting problem:

https://github.com/transitionnetwork/transitionnetwork.org-d6.profile/commit/030f3563ae20ee48f0ff7c17e826c537d44e687b

Not sure what problem Chris fixed. It may have helped.

It seems that the update process is working fine (just a little slow) Next time I'll try to build platforms / site migrations from the terminal to see if I can get things done any quicker.

Best, Paul

paul — Fri, 10 Oct 2014 13:17:15 GMT

@Ed I think this ticket can be closed.