rick_c, BigJibby and others have worked on a fix, and committed it to
trunk in several revisions:
r3958 http://trac.habariproject.org/habari/changeset/3958
r3959 http://trac.habariproject.org/habari/changeset/3959
r3962 http://trac.habariproject.org/habari/changeset/3962
r3963 http://trac.habariproject.org/habari/changeset/3963
r3964 http://trac.habariproject.org/habari/changeset/3964
So trunk users should be fine, regardless of PHP version, but stable
users are out of luck until we push out an 0.6.4 release.
In addition to the fixes listed above, the following have been
identified for potential inclusion in such a release:
r3094 http://trac.habariproject.org/habari/changeset/3094 (ticket?)
r3095 http://trac.habariproject.org/habari/changeset/3095 (ticket?)
r3623 http://trac.habariproject.org/habari/changeset/3623 (ticket
#1110)
r3899 http://trac.habariproject.org/habari/changeset/3899 (ticket
#1100)
r3094 http://trac.habariproject.org/habari/changeset/3904 (ticket
#1075)
r3925 http://trac.habariproject.org/habari/changeset/3925 (ticket
#699)
r3926 http://trac.habariproject.org/habari/changeset/3926 - remove
comment inline editor
r3927 http://trac.habariproject.org/habari/changeset/3927 - remove
comment inline editor
r3938 http://trac.habariproject.org/habari/changeset/3938 (ticket
#1112)
r3951 http://trac.habariproject.org/habari/changeset/3951 (ticket
#1109)
r3956 http://trac.habariproject.org/habari/changeset/3956 (ticket
#1115)
r3960 http://trac.habariproject.org/habari/changeset/3960 (ticket
#1118)
r3961 http://trac.habariproject.org/habari/changeset/3961 clean up
posts.php
Links to the tickets can be found in the commit messages, or on my
wiki user page: http://wiki.habariproject.org/en/User:mikelietz#Candidates_for_0.6.4
I expect r3926-7 might generate some discussion, as they remove the
inline comment editor, but please reply with questions, concerns,
suggestions for other commits, reasons to remove ones from the list
above, etc.
There is not yet a date or timeline set for this release. Once the
merging begins a timeline will be determined with sufficient time
given for testing and voting.
mikelietz
Not this one. Too new. I've updated my wiki page.
Not these two, 0.6 was r3446, so these two are already in 0.6.
> r3623 http://trac.habariproject.org/habari/changeset/3623 (ticket
> #1110)
This doesn't fit into security related, data loss, or minor. We've already had
a minor point release since this, and it wasn't included there.
> r3094 http://trac.habariproject.org/habari/changeset/3904 (ticket
> #1075)
Oops, you mean r3904.
> r3899 http://trac.habariproject.org/habari/changeset/3899 (ticket
> #1100)
> r3938 http://trac.habariproject.org/habari/changeset/3938 (ticket
> #1112)
> r3956 http://trac.habariproject.org/habari/changeset/3956 (ticket
> #1115)
> r3960 http://trac.habariproject.org/habari/changeset/3960 (ticket
> #1118)
While all these might fit into minor (and r3956 probably isn't), I'm on record
previously as saying that point releases should keep merges to an absolute
minimum, to avoid introducing unforseen issues. If it was me, I wouldn't
include any of them.
I agree with all the others.
--
Michael C. Harris, School of CS&IT, RMIT University
http://twofishcreative.com/michael/blog
IRC: michaeltwofish #habari
Rick
r3904, r3911 and r3912 will go in next. I haven't seen many replies
about the other commits so far.
You can try this out either by checking out the makaanga branch (svn
co https://svn.habariproject.org/habari/makaanga/0.x/htdocs makaanga),
or download it here: http://habariproject.org/dist/habari_makaanga.zip
Outstanding from the list are:
r3951 http://trac.habariproject.org/habari/changeset/3951 (ticket
#1109)
r3925 http://trac.habariproject.org/habari/changeset/3925 (ticket
#699)
r3926 http://trac.habariproject.org/habari/changeset/3926 - remove
comment inline editor
r3927 http://trac.habariproject.org/habari/changeset/3927 - remove
comment inline editor
which have been recommended for merge by michaeltwofish and rick_c,
and
r3623 http://trac.habariproject.org/habari/changeset/3623 (ticket
#1110)
r3899 http://trac.habariproject.org/habari/changeset/3899 (ticket
#1100)
r3938 http://trac.habariproject.org/habari/changeset/3938 (ticket
#1112)
r3956 http://trac.habariproject.org/habari/changeset/3956 (ticket
#1115)
r3960 http://trac.habariproject.org/habari/changeset/3960 (ticket
#1118)
which have been recommended to not be merged, in the interest of
introducing as little variability into the stable release.
Any thoughts, comments, questions, etc would be welcome.
The merged branch is still available for testing, either from SVN:
svn co https://svn.habariproject.org/habari/makaanga/0.x/htdocs
makaanga),
or download it here: http://habariproject.org/dist/habari_makaanga.zip
On Jan 12, 12:48 am, mikelietz <cod...@gmail.com> wrote:
> Just a quick update on this. So far I have applied
> r3958http://trac.habariproject.org/habari/changeset/3958
> r3959http://trac.habariproject.org/habari/changeset/3959
> r3962http://trac.habariproject.org/habari/changeset/3962
> r3963http://trac.habariproject.org/habari/changeset/3963
> r3964http://trac.habariproject.org/habari/changeset/3964
Rick
On Jan 12, 10:04 pm, mikelietz <cod...@gmail.com> wrote:
> Now applied:
> r3885, r3904, r3911, r3912. All pieces of the same security fix
> (ticket #1075).
>
> Outstanding from the list are:
>
> r3951http://trac.habariproject.org/habari/changeset/3951(ticket
> #1109)
> r3925http://trac.habariproject.org/habari/changeset/3925(ticket
> #699)
> r3926http://trac.habariproject.org/habari/changeset/3926- remove
> comment inline editor
> r3927http://trac.habariproject.org/habari/changeset/3927- remove
> comment inline editor
>
> which have been recommended for merge by michaeltwofish and rick_c,
> and
>
> r3623http://trac.habariproject.org/habari/changeset/3623(ticket
> #1110)
> r3899http://trac.habariproject.org/habari/changeset/3899(ticket
> #1100)
> r3938http://trac.habariproject.org/habari/changeset/3938(ticket
> #1112)
> r3956http://trac.habariproject.org/habari/changeset/3956(ticket
> #1115)
> r3960http://trac.habariproject.org/habari/changeset/3960(ticket
> #1118)
>
> which have been recommended to not be merged, in the interest of
> introducing as little variability into the stable release.
>
> Any thoughts, comments, questions, etc would be welcome.
>
> The merged branch is still available for testing, either from SVN:
>
> svn cohttps://svn.habariproject.org/habari/makaanga/0.x/htdocs
> I'm in favor of including r3623 in 0.6.4. As the Habari silo is in
> 0.6.3, it is broken and useless. Unless you manually add files to the
> silo first, you are not able to do anything with it. I don't see
> merging the revision as changing the functionality of the plugin so
> much as enabling it to work as it is supposed to work.
++1
--
Rich Bowen
rbo...@rcbowen.com
+1 on merging these into 0.6.4.
> r3623 http://trac.habariproject.org/habari/changeset/3623 (ticket
> #1110)
> r3899 http://trac.habariproject.org/habari/changeset/3899 (ticket
> #1100)
> r3938 http://trac.habariproject.org/habari/changeset/3938 (ticket
> #1112)
> r3956 http://trac.habariproject.org/habari/changeset/3956 (ticket
> #1115)
> r3960 http://trac.habariproject.org/habari/changeset/3960 (ticket
> #1118)
>
> which have been recommended to not be merged, in the interest of
> introducing as little variability into the stable release.
I think the complaint with 3623 is the second part of the commit,
where the creation of directories occurs in /user/files. If I'm
reading all of this correctly, I think all of 3623 should be merged:
it's a data loss bug if a user tries to create a directory structure
inside of /user/files and we clobber that.
3899 and 3938 seem like small functionality fixes. The latter could be
argued as a perceived data loss bug: paginating through the atom feed
doesn't work, so it looks like data is lost. That's a sub-optimal user
experience. What happens without 3899 if an empty array of comment IDs
is passed?
If 3956 fixes a potential problem that hasn't bit too many people yet,
I'm comfortable excluding it from 0.6.4, and rolling it into 0.7.
Then, assuming there aren't any more problems found in testing, we can
start talking about a vote, and a formal release date.