Web Design and Development

Drupal.org Maintenance: Dec 15th 17:00 PST (01:00 UTC, 1 day after)

Drupal - Sun, 12/14/2014 - 11:00

Drupal.org will be affected by maintenance Monday, December 15th 17:00 PST, 01:00 UTC (1 day after).

New database servers are being deployed for Drupal.org. This hardware refresh should greatly improve database query performance on Drupal.org. The deployment should require less than 15 minutes of downtime on Drupal.org if no major issues are encountered.

Please follow the @drupal_infra Twitter account for any issues encountered during the maintenance window.

Thanks for your patience!

Follow up on Drupal SA-2014-005, SQL Injection

Drupal - Thu, 12/04/2014 - 14:50

On October 29, the Drupal Security Team issued a Public Service Announcement (PSA) as a follow-up to Security Advisory SA-CORE-2014-005, which disclosed a serious SQL Injection vulnerability in Drupal 7. Our goals with the PSA were to:

  1. Provide an update on the time window between disclosure and first-known exploits
  2. Provide guidance for users who patched or upgraded outside that window
  3. Reiterate the severity of the vulnerability and the importance of upgrading or patching

(Speaking of which, if you have not remediated yet, please stop reading and do so.)

While we feel those goals were accomplished, the PSA also resulted in a large volume of press coverage – in fact much more coverage than the original disclosure of the vulnerability on October 15th. Not surprisingly, the general tone of the press coverage was quite negative. Unfortunately, some of the coverage was also inaccurate which we’d like to address here as well as provide additional context regarding our security processes.

While we don’t know the total number of Drupal sites affected, the number is not near 12 million as stated in several publications. Unless disabled, individual Drupal sites report their existence back to Drupal.org and this system reports around 1 million total Drupal sites. While this is not an exact measure of live Drupal sites we can infer that the affected number of specifically vulnerable Drupal 7 sites is more likely to be under 1 million.

SA-CORE-2014-005 was certainly a severe issue, if not the most severe issue in Drupal’s history; but it’s important to recognize all software has bugs and security issues that require a remediation process. Finding, fixing and announcing security patches is evidence of a healthy security process and Drupal is one of the few content management systems with a dedicated security team that covers both Drupal core and contributed code.

The above said, there are lessons from both the original disclosure and the follow-up PSA that might result in some changes to the Drupal Security Team policy and process, however we want to reinforce that we are deeply committed to keeping Drupal secure. We encourage you to read this whitepaper that explains our processes, policies and contains a good overview of Drupal security.

If you ever have questions, please use the public discussion area for general topics at https://groups.drupal.org/security or contact us (security@drupal.org). Or better yet, get involved. You can find more information on the Drupal Security Team page.

-Drupal Security Team

Call for Volunteers: Licensing Working Group

Drupal - Thu, 12/04/2014 - 10:30

There are a growing number of licensing-related issues on Drupal.org that are unresolved. Additionally, volunteers who have been tackling licensing issues believe that the policies are often applied inconsistently. The result is that contributors are often left in a difficult situation, unsure if they should contribute their code or not, and the Drupal project is left at risk when non-compliant code is uploaded to Drupal.org.

To solve this problem, several of the key volunteers met in July and determined that a Licesning Working Group, modeled after other Drupal and Drupal.org governance bodies and supported by training from the Drupal Association law firm, could provide more consistent oversight. At the 21 November meeting, the Drupal Association Board of Directors approved the draft charter written by those volunteers.

Now it's your turn! We're looking for 4-5 individuals to serve on the Working Group. You'll receive lots of support from the Drupal Association when you need it, and you'll be making a direct impact on the happiness of our contributors and the safety of the Drupal project. Just fill out the form below and we'll get back to you. We expect to approve a slate of candidates during the 21 January board meeting. Questions? Email the Drupal Association Executive Director, Holly Ross, at holly@association.drupal.org.

Nominate Yourself!

Front page news: Drupal News

Drupal 7.34 and 6.34 released

Drupal - Wed, 11/19/2014 - 10:39

Drupal 7.34 and Drupal 6.34, maintenance releases which contain fixes for security vulnerabilities, are now available for download. See the Drupal 7.34 and Drupal 6.34 release notes for further information.

Download Drupal 7.34
Download Drupal 6.34

Upgrading your existing Drupal 7 and 6 sites is strongly recommended. There are no new features or non-security-related bug fixes in these releases. For more information about the Drupal 7.x release series, consult the Drupal 7.0 release announcement. More information on the Drupal 6.x release series can be found in the Drupal 6.0 release announcement.

Security information

We have a security announcement mailing list and a history of all security advisories, as well as an RSS feed with the most recent security advisories. We strongly advise Drupal administrators to sign up for the list.

Drupal 7 and 6 include the built-in Update Status module (renamed to Update Manager in Drupal 7), which informs you about important updates to your modules and themes.

Bug reports

Both Drupal 7.x and 6.x are being maintained, so given enough bug fixes (not just bug reports) more maintenance releases will be made available, according to our monthly release cycle.

Changelog

Drupal 7.34 is a security release only. For more details, see the 7.34 release notes. A complete list of all bug fixes in the stable 7.x branch can be found in the git commit log.

Drupal 6.34 is a security release only. For more details, see the 6.34 release notes. A complete list of all bug fixes in the stable 6.x branch can be found in the git commit log.

Security vulnerabilities

Drupal 7.34 and 6.34 were released in response to the discovery of security vulnerabilities. Details can be found in the official security advisory:

To fix the security problem, please upgrade to either Drupal 7.34 or Drupal 6.34.

Known issues

None.

Front page news: Planet DrupalDrupal version: Drupal 6.xDrupal 7.x

Unplanned Outage (China Region): Thu Nov 13, 2014 - Wed Nov 19, 2014

Drupal - Wed, 11/19/2014 - 10:01

On Thursday, November 13th, 2014, Chinese censorship authorities DNS poisoned Drupal.org's Content Distribution Network, EdgeCast. The Drupal Association and EdgeCast have been working together to fix connection issues to Drupal.org, and believe the issues have been resolved.

  • On Thursday (2014-11-13) we were notified of Drupal.org being blocked in China.
  • On Friday (2014-11-14) EdgeCast acknowledged network issues in China.
  • On Monday (2014-11-17) Drupal Association staff began implementing changes to DNS, in coordination with EdgeCast, to resolve the connection issues in China.
  • Yesterday (2014-11-18 16:00 UTC) DNS entries for Drupal.org sites were updated and pushed out.
  • Today (2014-11-19) the DNS updates appear to have resolved the issue.

Related Issue: https://www.drupal.org/node/2375023
More Information: https://en.greatfire.org/blog/2014/nov/china-just-blocked-thousands-webs...

Drupal 7.33 released

Drupal - Fri, 11/07/2014 - 07:37

Drupal 7.33, a maintenance release with numerous bug fixes (no security fixes) is now available for download. See the Drupal 7.33 release notes for a full listing.

Download Drupal 7.33

Upgrading your existing Drupal 7 sites is recommended. There are no major new features in this release. For more information about the Drupal 7.x release series, consult the Drupal 7.0 release announcement.

Security information

We have a security announcement mailing list and a history of all security advisories, as well as an RSS feed with the most recent security advisories. We strongly advise Drupal administrators to sign up for the list.

Drupal 7 includes the built-in Update Manager module, which informs you about important updates to your modules and themes.

There are no security fixes in this release of Drupal core.

Bug reports

Drupal 7.x is being maintained, so given enough bug fixes (not just bug reports), more maintenance releases will be made available, according to our monthly release cycle.

Changelog

Drupal 7.33 contains bug fixes and small API/feature improvements only. The full list of changes between the 7.32 and 7.33 releases can be found by reading the 7.33 release notes. A complete list of all bug fixes in the stable 7.x branch can be found in the git commit log.

Update notes

See the 7.33 release notes for details on important changes in this release.

Known issues

None.

Front page news: Planet DrupalDrupal version: Drupal 7.x

5 Must Know Swift Features

The Flash Blog - Tue, 11/04/2014 - 09:49


I
n this Swift video tutorial you will learn about 5 must know Swift features: lazy vars, tuples, Swift arrays, enumerations, and computed properties.

Strategic Initiatives for Drupal.org in 2015

Drupal - Mon, 11/03/2014 - 15:27

Drupal.org is an amazing installation of Drupal. At nearly 13 years old, it is one of the largest, continuously operating examples of Drupal. It is difficult to fathom, but Drupal.org has been upgraded in place from version to version for this entire timespan. I can think of no other site that has gone this long without a significant content and structure migration.

Over the years, Drupal.org has grown from a single server owned by a contributor to multiple racks at the OSL data center, plus cloud resources and content distribution networks spread across the globe. Drupal.org is more than a single site. There are over 20 services and subsites that make up the ecosystem that powers the Drupal community. Each month, over 20 TB of data passes through the Drupal.org infrastructure.

With such a huge impact, it is important that we have a strong plan for the direction of Drupal.org. With that, we would like to introduce you to the Drupal.org Roadmap.

Drupal.org Roadmap

Read on to find out how we set this strategic direction.

History

Volunteers built up these systems focusing on their passions with community initiatives. Many times these volunteers gave up days of their life - unpaid - to make sure that people could continue to build websites with Drupal and to build Drupal and its contributed projects.

While the result is impressive, there are many areas of Drupal.org that received little or no attention in this model of development. If a developer burned out, or there was no one in the community with a passion for the area of needed improvements, that area remained unmaintained.

For several years, the Drupal Association has funded the infrastructure that runs Drupal.org. The Association pays for the hosting facilities and the hardware to keep Drupal.org running.

The evolving role of the Drupal Association

In 2013, the Drupal Association board made the decision to begin building up an engineering team. This team would support both the infrastructure and software development activities behind Drupal.org. Our goal is to accelerate the development of the new features and to help build a cohesive roadmap so that Drupal.org would help unite a global community to build the best of the Web with Drupal. (Hint: that is the mission of the Drupal Association.)

Hired in March of 2014, the Drupal Association CTO was tasked with building a team and gathering feedback from Working Groups and the Board of Directors to set a strategic direction for Drupal.org.

Prioritizing the work

There are three primary working groups that guide the development of Drupal.org: Drupal.org Content Working Group (DCWG), Drupal.org Software Working Group (DSWG) and Drupal.org Infrastructure Working Group (DIWG).

New development of features for the Drupal.org community of sites and services was determined through weeks of careful deliberation and research:

  • Previous years of feature ideation
  • Working group feature ideation
  • User research project
  • Working group prioritization
  • Board of Directors input and feedback
  • Staff ideation on maintenance and performance improvements

One of the key influences in our prioritization process was the user research that was conducted during and after DrupalCon Austin in June of 2014. We interviewed over 30 individuals that represented a wide range of Drupal.org users from those that were just starting with Drupal, to longtime members of the community, and even those that had once used Drupal and had transitioned their careers to different technologies.

This gave us four key areas in which to focus:

Sustaining support and maintenance

These efforts are the ongoing work that keeps the servers up and running and performing well. The Drupal.org Infrastructure issue queue is the primary place for this work, but there are several other related queues where staff and volunteers from the infrastructure team are focusing their work. Work that staff is tackling will be assigned to a staff member and tagged with d.o support.

  • Support for users: Drupal.org issue queues and email support
  • Performance: uptime, page response, ongoing testbot deployments and maintenance
  • Improving automated tests to make development and deployment reliable
  • Maximize hardware and migrate to cloud services where appropriate
Fund Drupal.org and future tools

While the majority of funds supporting Drupal.org come from our partner programs (Supporting Partner, Technology Partner, Hosting Partner), we are looking for ways to diversify were we raise funds.

Board and Working Group Priorities: Drupal.org Staff Initiatives

These initiatives represent the work that Drupal Association technology and engineering staff will be focused on in the near term through 2015. By being focused on these initiatives, we will get the related features launched on Drupal.org faster. We will still need help to vet and test these features, so follow the issue tags you are interested in and get involved in the related issues.

  • Better account creation and login
  • Organization and user profile improvements
  • Responsive Redesign of Drupal.org
  • Issue workflow and Git improvements
  • Make Drupal.org Search Usable
  • Improved tools to find and select projects
  • Groups migration to Drupal 7

The Drupal.org Roadmap provides much more detail about these key initiatives.

Community Initiatives

There is always more work to do on Drupal.org. We need committed and active volunteers to help with key initiatives that showed up in both our user research and the prioritization from the working groups. These are projects that we can support the efforts of contributors that have the time and skills to push these initiatives forward. Three examples with strong community leadership include:

  • Support localize.drupal.org
  • Next generation testbots (DrupalCI)
  • Two-factor authentication
You can help

In addition to these initiatives, we would love to support a community member that would be willing to step up and lead an initiative to organize our Q&A and support on Drupal.org. There is a huge need for people to be able to find answers to their Drupal questions. Stack Overflow fills part of this role, but there are many more opportunities on Drupal.org itself.

We will also need a community driven effort to help us establish project ratings and reviews once these tools are in place. It will take a group effort to make these affective quickly.

All of our initiatives need community involvement. Whether it is commenting on issues posted to these projects or joining in at sprints to move these initiatives forward, we can use your time and commitment.

Thank you

This planning and work would not have been possible without the financial support from our partners, the direction and leadership of the board, the time commitment of our Working Group members, and an incredibly dedicated Drupal Association staff.

Cheers!

Front page news: Drupal News

Understanding Swift Optionals

The Flash Blog - Wed, 10/29/2014 - 15:08

This video tutorial will teach you all you need to know to master the concepts of optionals in the Swift language.

Drupal Core - Highly Critical - Public Service announcement - PSA-2014-003

Drupal - Wed, 10/29/2014 - 07:39
Description

This Public Service Announcement is a follow up to SA-CORE-2014-005 - Drupal core - SQL injection. This is not an announcement of a new vulnerability in Drupal.

Automated attacks began compromising Drupal 7 websites that were not patched or updated to Drupal 7.32 within hours of the announcement of SA-CORE-2014-005 - Drupal core - SQL injection. You should proceed under the assumption that every Drupal 7 website was compromised unless updated or patched before Oct 15th, 11pm UTC, that is 7 hours after the announcement.

Simply updating to Drupal 7.32 will not remove backdoors.

If you have not updated or applied this patch, do so immediately, then continue reading this announcement; updating to version 7.32 or applying the patch fixes the vulnerability but does not fix an already compromised website. If you find that your site is already patched but you didn’t do it, that can be a symptom that the site was compromised - some attacks have applied the patch as a way to guarantee they are the only attacker in control of the site.

Data and damage control

Attackers may have copied all data out of your site and could use it maliciously. There may be no trace of the attack.

Take a look at our help documentation, ”Your Drupal site got hacked, now what”

Recovery

Attackers may have created access points for themselves (sometimes called “backdoors”) in the database, code, files directory and other locations. Attackers could compromise other services on the server or escalate their access.

Removing a compromised website’s backdoors is difficult because it is not possible to be certain all backdoors have been found.

The Drupal security team recommends that you consult with your hosting provider. If they did not patch Drupal for you or otherwise block the SQL injection attacks within hours of the announcement of Oct 15th, 4pm UTC, restore your website to a backup from before 15 October 2014:

  1. Take the website offline by replacing it with a static HTML page
  2. Notify the server’s administrator emphasizing that other sites or applications hosted on the same server might have been compromised via a backdoor installed by the initial attack
  3. Consider obtaining a new server, or otherwise remove all the website’s files and database from the server. (Keep a copy safe for later analysis.)
  4. Restore the website (Drupal files, uploaded files and database) from backups from before 15 October 2014
  5. Update or patch the restored Drupal core code
  6. Put the restored and patched/updated website back online
  7. Manually redo any desired changes made to the website since the date of the restored backup
  8. Audit anything merged from the compromised website, such as custom code, configuration, files or other artifacts, to confirm they are correct and have not been tampered with.

While recovery without restoring from backup may be possible, this is not advised because backdoors can be extremely difficult to find. The recommendation is to restore from backup or rebuild from scratch.

For more information, please see our FAQ on SA-CORE-2014-005.

Written by Coordinated by Contact and More Information

We've prepared a FAQ on this release. Read more at FAQ on SA-CORE-2014-005.

The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact.

Learn more about the Drupal Security team and their policies, writing secure code for Drupal, and securing your site.

Drupal version: Drupal 7.x

Next Steps for the Drupal.org Terms of Service and Privacy Policy

Drupal - Wed, 10/29/2014 - 06:11

Thanks to the hard work of staff and the Drupal.org Content Working Group, we have completed another round of updates to our draft privacy policy and terms of service. We were able to respond to much of the feedback provided in our earlier announcement.

The biggest issues pointed out by the community had to do with the tone of the language in the documents. Many pointed out that it did not match the values of our community. We took a closer look at organizations such as the Wikimedia Foundation and Mozilla, incorporating some of the approaches they took to make our terms a bit more human. We trimmed and shortened what we could. We clarified where things were ambiguous. The end result is much more in line with our community values.

Some examples of changes include the following:

  • When possible, we changed the tone of both documents to make them more friendly.
  • We removed capital letters and used other means to make specific parts of the document noticeable.
  • We deleted a couple of references to collecting data that we do not actually collect.
  • We clarified that we won’t block accounts “for any and no reason”, but only in cases of Terms of Service, Code of Conduct and Git access policy violations.
  • We clarified active notification of users about material changes to policy. We will send an email at least 72 hours prior to changes going into effect. This will give users time to delete their accounts if they don’t want to accept new policies.
  • We added contact info and updated all phone numbers, addresses etc. to be formatted according to international standards.
  • We clarified that you don’t need to create an account to access the Website, just some parts of it.
  • We clarified how to notify us in case of unauthorized access to user account.
  • We clarified how long do we store data after it has been removed from user profile.

We did leave some things from the previous draft without major changes, such as bullet points under section C, for example. And we did it for a reason. One of our goals is to make Drupal.org a place where everyone feels comfortable. Additionally, we have to ensure that Drupal.org is protected if a legal issue does arise. Those bullet points are there not because we want to be able to police or censor the activity on the site. This language exists because it protects Drupal.org if one user takes issue with content from another user. We will still use the process outlined in the Drupal Code of Conduct to resolve any issues whenever we can.

With that in mind, please take a look at the latest drafts:

Terms of Service
Privacy Policy

We will be putting these documents into place on Wednesday, 5 November, 2014. All comments added to this thread will be included in our planning for the next revision. We hope to review the Terms of Service and Privacy Policy quarterly and update them with community feedback.

Thank you for all your help in building these documents.

Updated Version of Response for Brackets

The Flash Blog - Mon, 10/27/2014 - 11:33

I’m excited to announce (although a little late) that my responsive design extension for Brackets, known as Response, has been updated to work in the latest version of the tool. Now before I go on I have to give the full credit for this update to Chen-Heng Chang. Make sure you give him some love on Twitter (@kidwm). Go on over to his fork of the project to get the code.

Until I can get his changes merged over you can consider his fork as the official repository for the project for the time being.

There are detailed instructions for how to setup and install the extension in the latest version of Brackets on the repository’s main page. The final step (installing the extension) only has instructions for Windows. For those on a Mac here is the path you need:

~/Library/Application\ Support/Brackets/extensions/user

Important: there are still many bugs remaining so I will be doing an updated video tutorial in the next couple of days. Until then please refer to this video.

Using Core Image Filters on iOS

The Flash Blog - Sat, 10/25/2014 - 19:46

 New video tutorial explaining how to use Core Image filters on iOS using Swift.

Creating Menubar Apps Using Swift

The Flash Blog - Sat, 10/25/2014 - 19:44

 New video tutorial explaining how to create menubar applications for OS X using Swift.

Creating Swift Class Extensions

The Flash Blog - Sat, 10/25/2014 - 19:41

 New video tutorial explaining how to create class extensions in Swift that allow you to easily extend the functionality of framework classes.

Using Storyboards on OS X

The Flash Blog - Sat, 10/25/2014 - 19:38

 New video tutorial showing you how to use storyboards to visually lay out and connect the views in your Mac app.

Introduction to Swift Playgrounds

The Flash Blog - Sat, 10/25/2014 - 19:29


 New video tutorial showing you how to use the new live scripting environments called Playgrounds in Xcode 6.

Drupal.org Maintenance: Oct 23rd 14:00 PDT (21:00 UTC)

Drupal - Wed, 10/22/2014 - 09:58

Drupal.org will be affected by maintenance Thursday, October 23rd 14:00 PDT, 21:00 UTC.

An increase of the MySQL innodb_buffer_pool_size will cause a short downtime for Drupal.org while MySQL is restarted. We plan on a 30 minute window of potential instability, though the actual outage should be 5 minutes or less.

Please follow the @drupal_infra Twitter account for any issues encountered during the maintenance window.

Thanks for your patience!

Prepping Icons for Yosemite Dark Mode

The Flash Blog - Sun, 10/19/2014 - 10:24

Now that Yosemite (OS X 10.10) is in the wild, you may or may not have tried the new dark ui mode. All this really means is that it will make your dock and menu bar black. You can switch to dark mode by checking off the option in the General section of System Preferences as shown below.

Once you switch to dark mode you may notice that a lot of icons either are invisible or look like crap. For example, the Wallpaper by Behance app that we recently released shows no icon when in dark mode.

The fix doesn’t involve providing an alternate icon for dark mode. The solution is actually ridiculously easy. You simply need to set your status bar icon to be a template image. When you do this OS X will take care of adjusting your icon to different visual modes. Here is some code that shows how to do this:

// Load icon var icon = NSImage(named: "statusIcon") // Fixes dark mode icon.setTemplate(true) // Create status item var statusItem = NSStatusBar.systemStatusBar().statusItemWithLength(NSVariableStatusItemLength) // Set with tempalte image statusItem.image = icon

So with that one line of code added you can see that the Behance icon is now inverted whenever the user is in dark mode.

If you are using a custom view instead of an image for the menu bar icon then you will have to do some logic in your drawRect method.

Drupal 7.32 released

Drupal - Wed, 10/15/2014 - 05:47

Drupal 7.32, a maintenance release which contain fixes for security vulnerabilities, is now available for download. See the Drupal 7.32 release notes for further information.

Download Drupal 7.32

Upgrading your existing Drupal 7 is strongly recommended. There are no new features or non-security-related bug fixes in this release. For more information about the Drupal 7.x release series, consult the Drupal 7.0 release announcement.

Security information

We have a security announcement mailing list and a history of all security advisories, as well as an RSS feed with the most recent security advisories. We strongly advise Drupal administrators to sign up for the list.

Drupal 7 and 6 include the built-in Update Status module (renamed to Update Manager in Drupal 7), which informs you about important updates to your modules and themes.

Bug reports

Both Drupal 7.x and 6.x are being maintained, so given enough bug fixes (not just bug reports) more maintenance releases will be made available, according to our monthly release cycle.

Changelog

Drupal 7.32 is a security release only. For more details, see the 7.32 release notes. A complete list of all bug fixes in the stable 7.x branch can be found in the git commit log.

Security vulnerabilities

Drupal 7.32 was released in response to the discovery of critical security vulnerabilities. Details can be found in the official security advisory:

To fix the security problem, please upgrade to Drupal 7.32.

Known issues

None.

Front page news: Planet DrupalDrupal version: Drupal 7.x

Pages