Problem/Motivation

#842620: Update manager can't install modules using FTP due broken FileTransferAuthorizeForm removes all usages of the system.authorize config. This issue will remove it from the code base and provide an update function to remove it from active config.

We shouldn't be storing these details in config because they are environment specific and actually as form fields we can rely on a broswer to remember them - also storing any user credential for ssh or ftp even a user name seems like a bad idea.

Proposed resolution

Remaining tasks

User interface changes

API changes

Data model changes

Support from Acquia helps fund testing for Drupal Acquia logo

Comments

alexpott created an issue. See original summary.

Version: 8.2.x-dev » 8.3.x-dev

Drupal 8.2.0-beta1 was released on August 3, 2016, which means new developments and disruptive changes should now be targeted against the 8.3.x-dev branch. For more information see the Drupal 8 minor version schedule and the Allowed changes during the Drupal 8 release cycle.

Version: 8.3.x-dev » 8.4.x-dev

Drupal 8.3.0-alpha1 will be released the week of January 30, 2017, which means new developments and disruptive changes should now be targeted against the 8.4.x-dev branch. For more information see the Drupal 8 minor version schedule and the Allowed changes during the Drupal 8 release cycle.

Version: 8.4.x-dev » 8.5.x-dev

Drupal 8.4.0-alpha1 will be released the week of July 31, 2017, which means new developments and disruptive changes should now be targeted against the 8.5.x-dev branch. For more information see the Drupal 8 minor version schedule and the Allowed changes during the Drupal 8 release cycle.

Version: 8.5.x-dev » 8.6.x-dev

Drupal 8.5.0-alpha1 will be released the week of January 17, 2018, which means new developments and disruptive changes should now be targeted against the 8.6.x-dev branch. For more information see the Drupal 8 minor version schedule and the Allowed changes during the Drupal 8 release cycle.

Version: 8.6.x-dev » 8.7.x-dev

Drupal 8.6.0-alpha1 will be released the week of July 16, 2018, which means new developments and disruptive changes should now be targeted against the 8.7.x-dev branch. For more information see the Drupal 8 minor version schedule and the Allowed changes during the Drupal 8 release cycle.

Version: 8.7.x-dev » 8.8.x-dev

Drupal 8.7.0-alpha1 will be released the week of March 11, 2019, which means new developments and disruptive changes should now be targeted against the 8.8.x-dev branch. For more information see the Drupal 8 minor version schedule and the Allowed changes during the Drupal 8 release cycle.

Version: 8.8.x-dev » 8.9.x-dev

Drupal 8.8.0-alpha1 will be released the week of October 14th, 2019, which means new developments and disruptive changes should now be targeted against the 8.9.x-dev branch. (Any changes to 8.9.x will also be committed to 9.0.x in preparation for Drupal 9’s release, but some changes like significant feature additions will be deferred to 9.1.x.). For more information see the Drupal 8 and 9 minor version schedule and the Allowed changes during the Drupal 8 and 9 release cycles.

Version: 8.9.x-dev » 9.1.x-dev

Drupal 8.9.0-beta1 was released on March 20, 2020. 8.9.x is the final, long-term support (LTS) minor release of Drupal 8, which means new developments and disruptive changes should now be targeted against the 9.1.x-dev branch. For more information see the Drupal 8 and 9 minor version schedule and the Allowed changes during the Drupal 8 and 9 release cycles.

Version: 9.1.x-dev » 9.2.x-dev

Drupal 9.1.0-alpha1 will be released the week of October 19, 2020, which means new developments and disruptive changes should now be targeted for the 9.2.x-dev branch. For more information see the Drupal 9 minor version schedule and the Allowed changes during the Drupal 9 release cycle.

longwave’s picture

Status: Postponed » Active

Rediscovered this via #2591827: Add YAML linting to core coding standards checks where we detected that system.authorize.yml is invalid.

There is also now a migration that writes config to this file, but the config is never used at runtime.

longwave’s picture

Status: Active » Needs review
FileSize
3.03 KB
andypost’s picture

Status: Needs review » Needs work
Issue tags: +Needs upgrade path tests

++ to remove and check 2 usages in contrib (both used to exclude it) so removal without deprecation looks straight

http://grep.xnddx.ru/search?text=system.authorize

+++ b/core/modules/system/system.post_update.php
@@ -189,3 +189,10 @@ function system_post_update_remove_key_value_expire_all_index() {
+function system_post_update_delete_authorize_settings() {
+  \Drupal::configFactory()->getEditable('system.authorize')->delete();

I bet it needs upgrade test

andypost’s picture

Status: Needs work » Needs review
Issue tags: -Needs upgrade path tests
FileSize
1.31 KB
4.34 KB

Filed CR https://www.drupal.org/node/3206320 and here's a test

andypost’s picture

FileSize
694 bytes
4.33 KB

Fix c/p typo

longwave’s picture

Status: Needs review » Reviewed & tested by the community

Thanks for adding the test and CR, the test looks good to me.

The only thing I'm not sure about is whether we can remove the migration directly or if we have to deprecate it first somehow? Marking RTBC to get core committer feedback on this.

renatog’s picture

Status: Reviewed & tested by the community » Needs work

We should change this comment
Remove obsolete system.authorize configuration.

to
Removes obsolete system.authorize configuration.

Because this same standard is used in other comments. E.g.

Tests system_post_update_delete_authorize_settings().

Just to be consistent with the same way on this file

longwave’s picture

Status: Needs work » Needs review

I am not sure that is always the case in update hook docblocks, which are displayed to the user during update.php - we are a bit inconsistent:

core/modules/system/system.post_update.php: * Remove backwards-compatibility leftovers from entity type definitions.
core/modules/system/system.post_update.php: * Remove obsolete system.rss configuration.
core/modules/serialization/serialization.post_update.php: * Remove obsolete serialization.settings configuration.
core/modules/hal/hal.post_update.php: * Remove obsolete hal.settings configuration key.
core/modules/workspaces/workspaces.post_update.php: * Removes the workspace association entity and field schema data.
core/modules/action/action.post_update.php: * Removes action settings.
core/modules/rest/rest.post_update.php: * Remove obsolete rest.settings configuration.
renatog’s picture

Status: Needs review » Reviewed & tested by the community

Makes sense.

Ok, it was just it from my side.

Moving to RTBC

alexpott’s picture

The standard as per https://www.drupal.org/node/1354#updateN is to use Remove obsolete system.authorize configuration.

renatog’s picture

Makes sense

On the same patch, we're including another document using a different way

/**
 * Tests the upgrade path for removal the system.authorize configuration.
 *

Should we use the same standard to be consistent? E.g.:

/**
 * Test the upgrade path for removal the system.authorize configuration.
 *
andypost’s picture

@RenatoG no, only update function doc blocks are without-s other functions and classes has common rule

renatog’s picture

Ok makes sense.
So +1 to it

Status: Reviewed & tested by the community » Needs work

The last submitted patch, 15: 2715145-15.patch, failed testing. View results

benjifisher’s picture

Please do not ask the testbot to try again until #3207086: [HEAD BROKEN] Consistent failure in MonthDatePluginTest is fixed.

alexpott’s picture

Status: Needs work » Reviewed & tested by the community

Status: Reviewed & tested by the community » Needs work

The last submitted patch, 15: 2715145-15.patch, failed testing. View results

longwave’s picture

Status: Needs work » Reviewed & tested by the community
catch’s picture

Status: Reviewed & tested by the community » Needs review
+++ b/core/modules/system/config/schema/system.schema.yml
@@ -53,14 +53,6 @@ system.maintenance:
   type: config_object
   label: 'Cron settings'
diff --git a/core/modules/system/migrations/d7_system_authorize.yml b/core/modules/system/migrations/d7_system_authorize.yml

diff --git a/core/modules/system/migrations/d7_system_authorize.yml b/core/modules/system/migrations/d7_system_authorize.yml
deleted file mode 100644

deleted file mode 100644
index d3d83881a2..0000000000

index d3d83881a2..0000000000
--- a/core/modules/system/migrations/d7_system_authorize.yml

--- a/core/modules/system/migrations/d7_system_authorize.yml
+++ /dev/null

+++ /dev/null
+++ /dev/null
@@ -1,15 +0,0 @@

@@ -1,15 +0,0 @@
-id: d7_system_authorize
-label: Drupal 7 file transfer authorize configuration
-migration_tags:
-  - Drupal 7
-  - Configuration
-source:
-  plugin: variable
-  variables:
-    - authorize_filetransfer_default
-  source_module: system
-process:

Can we just remove this or do we somehow need to deprecate it? Not sure what the implications are for the various migration runners if this file disappears.

longwave’s picture

I asked that in #16, I don't know the answer either!

longwave’s picture

#3039240: Create a way to declare a plugin as deprecated IS suggests we do need to deprecate it, but we can't yet because of that issue

longwave’s picture

Status: Needs review » Needs work

Let's follow #3022401: Remove useless config action.settings.recursion_limit and keep the migration but make it do nothing, so we don't have to postpone on plugin deprecations.

andypost’s picture

Status: Needs work » Needs review
FileSize
1.08 KB
4.14 KB

Good idea, thanks! changed to suggestion from #32

btw in #3039240: Create a way to declare a plugin as deprecated deprecated migrations are allowed to be skipped so better to improve deprecation when it lands for both (actions and migrations)

longwave’s picture

Do we need a test similar to MigrateActionConfigsTest to prove that the updated migration doesn't write any config?

andypost’s picture

FileSize
1.01 KB
4.49 KB

@longwave Thank you!

Reverted execution of migration and extra assert added

longwave’s picture

Status: Needs review » Reviewed & tested by the community

Great work! RTBC if bot agrees.

quietone’s picture

Status: Reviewed & tested by the community » Needs review
+++ b/core/modules/system/tests/src/Kernel/Migrate/d7/MigrateSystemConfigurationTest.php
@@ -166,6 +164,7 @@ public function testConfigurationMigration() {
+    $this->assertTrue(\Drupal::config('system.authorize')->isNew(), 'Migration d7_system_authorize creating no config.');

I thought that assertions weren't to have messages, #3131946: [META] [policy] Remove PHPUnit assertion messages when possible, and standardize remaining messages. This could be a comment.

Can we just remove this or do we somehow need to deprecate it? Not sure what the implications are for the various migration runners if this file disappears.

In my experience, there are none and in this case the migration can be deleted. If the migration id does not exist it is simply ignored. For example, drush (migrate run) typing 'drush mim 'migrationwithtypo' returns nothing, which can be annoying. But this also allows migration lookup to be very flexible in the list of migration. See 3143486#7. But to be sure let's get another opinion from a migrate maintainer.

Version: 9.2.x-dev » 9.3.x-dev

Drupal 9.2.0-alpha1 will be released the week of May 3, 2021, which means new developments and disruptive changes should now be targeted for the 9.3.x-dev branch. For more information see the Drupal core minor version schedule and the Allowed changes during the Drupal core release cycle.

phenaproxima’s picture

Fixed the comment in the test.

I'm a lapsed Migrate maintainer, but from my cursory reading of https://git.drupalcode.org/project/migrate_tools/-/blob/8.x-5.x/src/Comm..., it appears to gracefully handle missing migration IDs. I haven't personally tested that, though,

longwave’s picture

Status: Needs review » Reviewed & tested by the community

The current patch just converts the migration to do nothing, so the issue of whether or not deleted migration plugins cause any issues is not a problem. The test comment was fixed and the test improved, so back to RTBC,

alexpott’s picture

Status: Reviewed & tested by the community » Fixed

Committed b36543d and pushed to 9.3.x. Thanks!

  • alexpott committed b36543d on 9.3.x
    Issue #2715145 by andypost, phenaproxima, longwave, alexpott, RenatoG,...

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.