Hi,

Drupal 5.3 has just been released, fixing various security vulnerabilities. The latest dev version fails to patch (the block_cache.patch fails at all) or patches the Drupal core with a few lines offset.

I suppose an updated development version (or maybe a stable one) that applies cleanly on 5.3 would be nice. 5.3 is a recommended release.

A question is: Is it safe to patch 5.3 by hand?

Thanks.

Support from Acquia helps fund testing for Drupal Acquia logo

Comments

robertDouglass’s picture

If you patch 5.3 by hand and reroll the patches and upload them to this issue it will speed the process of getting a stable advcache release for 5.3. Otherwise you are somewhat tied to my schedule (in lieu of another volunteer) and I won't be able to get to it before next week. Thanks for helping!

GoofyX’s picture

OK, I will do that in the next few days to help. I asked mainly to check if there will be any problems in case the core has changes that will invalidate the patches by the module.

Thanks!

Wim Leers’s picture

If there would be a Drupal 5.2 -> 5.3 patch, then module updates like this one would become trivial:
1) apply advcache patch on D5.2
2) apply 5.2 -> 5.3 patch
3) generate new patch for advcache

Maybe something worth considering?

GoofyX’s picture

FileSize
9.56 KB

OK, this is a first try with comment_cache.patch. I applied manually (by hand) the patch on modules/comment/comment.module and modules/node/node.module and created a new patch for those files. Please check and yell if I did something stupid... :-)

GoofyX’s picture

FileSize
2.26 KB

Here's the node_cache.patch.

robertDouglass’s picture

Thanks, keep them coming.

tomchuk’s picture

Here's all the patches for 5.3. All but block applied with a little fuzz. These apply cleanly to 5.3 and Drupal still works after applying them, other than that, not a lot of testing.

GoofyX’s picture

I think block_cache.patch needs attention, because the existing patch not only fails because of different line offset, but it fails because of different PHP code. The maintainer should probably test these carefully.

Anyway, tomchuk a big thanks for your help. I tried to deal with the other files too, but did not have the time to finish them.

tomchuk’s picture

Yeah, looking back at the revision for the changes in block.module between 5.2 and 5.3 it appears that they were important.

The block patch in my previous post reverted the changes to that query to the version in 5.2, if anyone applied that patch they should reverse it out from the root directory of your Drupal install with patch -p0 -R < /path/to/block_cache.patch

Here are updated patches that use the updated query from 5.3 (only block_cache.patch and all_patches.patch) changed, but posting all for completeness. Again, they apply cleanly, and Drupal seems to work afterwards, but use at your own risk.

GoofyX’s picture

So, maintainer(s), what's the status of the patches provided by tomchuk for Drupal 5.3, can we safely apply them in a production site?

ilmaestro’s picture

Tom, all of your patches worked for me. This is my first time using this module, but I'll report back if anything seems to not be working.

ilmaestro’s picture

Ok, I encoutered a problem today. I don't know if it is a problem with Tom's 5.3 patch or a bug in general. Regarding the comment caching, I noticed that for nodes that don't have any comments, cache_set is called *every* time the node page is loaded, even though no comments exist and a cache record already exists anyways.

I'm not sure it makes sense to cache an empty value, or if so, we probably shouldn't be caching some value that's the same as what we retrieved from the cache, even if that value is empty.

firebus’s picture

this is a minor bug, unrelated to the 5.3 patches. it also existed in 5.2. imo it's pretty harmless.

robertDouglass’s picture

@ilmaestro: if you haven't already, could you please file a separate issue for the comment cache patch? Good catch!
@tomchuck: Thanks *very* much for the patches. Sorry I haven't had time to review them. Your help is appreciated.

GoofyX’s picture

So, Robert, any rough estimate about when we are going to have a stable release for v.5.3?

robertDouglass’s picture

@firebus feel free to commit these when you deem them ready.

GoofyX’s picture

We must also make checks against version 5.5 that just came out.

tomchuk’s picture

The 5.3 patches apply with some offsets to 5.4 and 5.5. Attached are patches that apply cleanly against 5.5. I haven't had a chance to test these at all, but will in the next day or two.

firebus’s picture

Assigned: Unassigned » firebus
Status: Active » Reviewed & tested by the community

i just committed this to the dev branch, so a new tarball should be available once the cron runs.

it tests out fine for me, but i'd like to get confirmation from at least one other person before i create a new release for this.

thanks for your work on this, tomchuk!

Christefano-oldaccount’s picture

Right now I'm only using the path patch but I can report that it's working for me an a D5.5 installation with 1000+ nodes. Thanks for all of your work, guys.

firebus’s picture

Title: Support for Drupal 5.3 » Support for Drupal 5.5
Status: Reviewed & tested by the community » Fixed

setting to fixed. i'll roll a new release once i've tested sufficiently.

Anonymous’s picture

Status: Fixed » Closed (fixed)

Automatically closed -- issue fixed for two weeks with no activity.

GoofyX’s picture

Title: Support for Drupal 5.5 » Support for Drupal 5.6
Category: support » task
Status: Closed (fixed) » Needs review
FileSize
4.31 KB
3.7 KB
6.32 KB
2.31 KB
1.05 KB
5.51 KB
3.78 KB

Drupal 5.6 is out, fixing security vulnerabilities.

Attached are all patches (except the big thing, all_patches.patch) that apply cleanly on 5.6. All patches needed a few line offset changes, other than that, they should be fine.

firebus’s picture

Title: Support for Drupal 5.6 » Support for Drupal 5.5
Status: Needs review » Closed (fixed)

opened http://drupal.org/node/208941 for this (new :) issue.

don't worry about reposting the patches there.

i'll have time to review and hopefully commit this weekend.

thank you!!!