D5.17 removes ability to put templates in subdirectories and breaks styles

I am experiencing the same problem and noticed that phptemplate.engine was changed in the upgrade.

diff reveals the following:

260c260
< $arg = str_replace(array('/', '\\', '\0'), '', $arg);
---
> $arg = str_replace(array("/", "\\", "\0"), '', $arg);
379a380,383
> // Remove slashes or null to prevent files from being included from
> // an unexpected location (especially on Windows servers).
> $extension = str_replace(array("/", "\\", "\0"), '', $extension);
>
382a387
> $suggestion = str_replace(array("/", "\\", "\0"), '', $suggestion);

Perhaps this is related?

I can confirm that this is the culprit...I reverted phptemplate.engine to previous version and our forums are back.

Yes, that would do it for sure. This is not a bug in AF. Not my fault someone went and screwed with how template suggestions work on a verison that's supposed to be on maintenance. Frankly, I'm not sure how I'm going to get around this one. I might end up just having to drop AF for D5. I will take some time to investigate before I make that decision, though.

Michelle

More info: Looks like it's #396224: SA-CORE-2009-003 - Local file inclusion on Windows at fault. Since it's a security issue, getting the change in core reversed is unlikely to happen. :( I don't know what I'm going to do.

Michelle

if we are not running one windows do we need the new phptemplate.engine?

Edit: I LOVE WHEN THEY PUT NEW IMPROVEMENTS INTO THE SYSTEM... (...As long as they dont break my install...)

Its about time the developers realize that Mike is their #1 Client! WHO IS WITH ME!

Can we get the security update without a complete overhaul of the system? We cant abandon the D5 branch yet!

I don't know. I don't know much about security and don't really understand the issue that caused this. I'm just waiting to see if it gets fixed since it seems I'm not the only one that thinks removing the ability to have subdirectories is a bad thing.

Michelle

yea, I vote yes for sub directories!

Michelle For 2010 Drupaler President! Lets raise the funds and start the campaign!

This morning I had a conversation I had on IRC where I was basically told that just because something works doesn't mean it will continue to work unless it's documented. So we've got that camp vs those of us who think this is important functionality that needs to be preserved. Since I don't have the skills to fix the core issue myself, I'm in limbo waiting to see if someone else is able to do it.

In the mean time, here's a crude hack for people who need this fixed right now:

1) Copy all the style files to the root of your theme.
2) In advanced_forum.module, find the function advanced_forum_path_to_style() and change the very last line from return $style_path; to return path_to_theme();

If you're using a Zen subtheme, make that path_to_subtheme().

I haven't tested this... Just looking at my code and I think that should work.

Michelle

Yea, well I can document it... This is crazy... We bust our asses off for Drupal just as much as those writing the code, we are the consumers of this... Honestly Drupal Forums and Commenting system is a Joke. They NEED Advanced Forums, not the other way around.

This pisses me off as much as it does you Michelle!

I love Drupal, I really do, but I can tell you, its so much work to set it up right... and then they burn you on updates like this?

Its not that they go and improve things that bothers me, I love that, its their careless attitude that they have towards module developers when things break...

Some day I need to rant about Drupal, and what the true issues with it are...

Wow I've been going crazy all morning trying to figure out what I did wrong with AF (especially since I had not changed anything!!). Then I find this. Ugh.

Michelle, I tried your hack in #9 and doesn't work. It gets the CSS and template files pointed to the right location, but nothing is rendered to the page. Guess I need to roll back to D5.16 for now...

Ok, I can confirm that the patch in http://drupal.org/node/396224#comment-1544190 works. Yay! So I'm not going to change anything in AF but will leave this active until it's committed to core so people can find it.

Thanks to magibird for getting me pointed in the right direction.

Michelle

Confirming the patch in http://drupal.org/node/396224#comment-1544190 works as well.

Just a newbie question :

The patch says :

Index: themes/engines/phptemplate/phptemplate.engine
===================================================================
RCS file: /cvs/drupal/drupal/themes/engines/phptemplate/phptemplate.engine,v
retrieving revision 1.54.2.6
diff -u -p -r1.54.2.6 phptemplate.engine
--- themes/engines/phptemplate/phptemplate.engine	29 Apr 2009 17:49:52 -0000	1.54.2.6
+++ themes/engines/phptemplate/phptemplate.engine	2 May 2009 00:16:00 -0000
@@ -377,14 +377,9 @@ function phptemplate_box($title, $conten
 function _phptemplate_default($hook, $variables, $suggestions = array(), $extension = '.tpl.php') {
   global $theme_engine;
 
-  // Remove slashes or null to prevent files from being included from
-  // an unexpected location (especially on Windows servers).
-  $extension = str_replace(array("/", "\\", "\0"), '', $extension);
-
   // Loop through any suggestions in FIFO order.
   $suggestions = array_reverse($suggestions);
   foreach ($suggestions as $suggestion) {
-    $suggestion = str_replace(array("/", "\\", "\0"), '', $suggestion);
     if (!empty($suggestion) && file_exists(path_to_theme() .'/'. $suggestion . $extension)) {
       $file = path_to_theme() .'/'. $suggestion . $extension;
       break;

I have never applied a patch, so what do we need to do to phptemplate.engine ?
How this patch has to be applied ?

The only difference between original 5.17 phptemplate.engine and the code in this patch are the - at the beginning of the line ;
does that mean that these lines have to be erased and that's all, all will be as before (like 5.16) ?

I have searched into the site for how to on patch applying but what I have found is a bit to difficult for newbies like me...

Sorry for my poor english...
Thank you for your attention.

Yes, the - means the line goes away and the + means the line is added.

Michelle

Thank You Michelle for your answer :)

And Thank you very much for your Advanced Forum...
I'm fond of it and I would have been very disappointed if it had been put out of order by 5.17 - not ready yet to upgrade to 6.x ...

:)

About applying patches, there is easy info (for Unix, Linux...) at:

http://drupal.org/patch/apply
http://en.wikipedia.org/wiki/Patch_(Unix)

Looking at the release notes for Drupal 5.18, this seems to have been fixed. I haven't tested it though.

Am looking forward to not seeing that nasty warning on the Advanced Forum project page any more! :)

Well, the patched fixed it so I'm assuming 5.18 will as well. I'll be upgrading my site tonight and will close this once I confirm.

Michelle

subscribing

Confirmed.

Michelle