4.7.0 -> 4.7.1 is my first incremental drupal upgrade experience. i understand the process but it seems cumbersome (and maybe a little problem prone but that's probably just because i'm not totally comfortable with the process) compared to some other open source projects (it has multiple manual steps, etc.) To upgrade Sugar CRM, in contrast, you just upload a small upgrade zip file within the web-based admin interface, click a button and it upgrades itself automatically.
My question is, is there any initiative in streaming drupal's upgrade process? There might be, but I wouldn't know to look. I'm not a coder, so I can't jump in and help (sorry!) If not, that's okay too - Drupal has improved more and more and i'm sure the upgrade process will improve sooner than later too! But i'm cust curious. Along those lines are there any "vision" area of drupal.org that explains what's being worked on for 4.8, 5 and further or is it just a much more day-to-day development cycle?
- Jason
Comments
vision/roadmap
There is a group formed to ponder the "vision" issue:
http://groups.drupal.org/unofficial-drupal-roadmap
---
Work: BioRAFT
Bear in mind...
that the approach you mentioned requires you lower the security of your site quite a lot. It requires the web server to be able to overwrite your application files instead of just your FTP account being able to overwrite your application files. Letting the web server have write access to your application takes away one layer of defense in your sites security.
That was at least one of the sticking points that the core devs want to overcome before implementing any system like that.
--
Anton
New to Drupal? | Forum posting tips | Troubleshooting FAQ
Example Knowledge Base built using Drupal
question re: webserver overwriting
Your post brought a question to my mind- which is this.:
I'm now develpoing a small site on a host that uses suexec so that PHP runs under my userid on the server. This is good in some senses for security since I can make most of the files chmod 400 if I want, and the files directory can be chmod 700.
However, doesn't this also mean that any PHP process I'm running could write/change any file in my account?
In the other situation, where PHP runs under apache as user "nobody" or "www", I've had to set the files directory to chmod 777, but it seems that the actual drupal files could not be changed by PHP if the permissions are set to 644 or something usual like that?
---
Work: BioRAFT
Permissions
Yes, including changing the permissions.
Yes thats true also.
But depending on the situation using suexec may not be as bad as it sounds. If you are confident in your ability to keep Drupal secure from remote attackers (ie those coming in through Apache), it should give you more protection against other users on the server including those that have broken into other sites on the server.
While suexec might increase your risk on a dedicated server (ie no other users to worry about), it would probably decrease risk for a diligent webmaster on a shared server that has all kinds untrusted users and applications on it. It all depends on your situation and what tradeoffs you want.
Is there a sgexec solution? I haven't bothered to look ;)
That way you could use group permissions for PHP/Apache, user permissons for your own user account, and still leave world with no permissions.
--
Anton
New to Drupal? | Forum posting tips | Troubleshooting FAQ
Example Knowledge Base built using Drupal
thanks
Thank you for your thoughtful response. Since this is a shared hosting situation it does seem that suexec provides a better security trade-off.
Do you know if this is this spelled out out anywhere in the handbook? If not, maybe I'll try to get motivated to summarize into a handbook page. I know there I often see permissions-related questions in the forums.
---
Work: BioRAFT