Session Start: Mon Oct 08 21:58:59 2007 Session Ident: #twiki_release [21:58] * Now talking in #twiki_release [21:58] * Topic is 'http://develop.twiki.org/~twiki4/cgi-bin/view/Bugs/ReleaseBlockers' [21:58] * Set by CDot on Mon Oct 08 11:19:21 [21:59] hi Kenneth [21:59] Hi Koen [22:00] hi koen, kenneth, (sven?) [22:00] Hi Peter [22:00] * HaraldJoerg has joined #twiki_release [22:00] hi harald [22:00] Ho Peter [22:00] minutes are at http://twiki.org/cgi-bin/view/Codev/FreetownReleaseMeeting2007x10x08 [22:01] i wish i could work outside, such a nice weather [22:01] * ktwilight_ has joined #twiki_release [22:01] 'lo [22:01] I am already on the minutes [22:02] Hello Kwang and Harald [22:02] * ArthurClemens has joined #twiki_release [22:02] Hello Lavr_, ktwilight, Arthur! [22:03] hi kwang & arthur! [22:03] Peter: The weather was fine here as well, but by now it is pitch dark and getting cold [22:04] we are not that many, but we have critical mass [22:04] ah, hi crawford, i did not see you until now [22:05] hi peter. [22:05] * CDot has been here since early this morning ;-) [22:05] hi Lavr [22:05] who is taking minutes, who is facilitating? [22:05] * gmc never left :) [22:05] I am on the minutes [22:05] cool [22:05] on account of doing some $dayjob in the background i'd better not take those roles [22:05] i have a hard stop at +55 min [22:06] i can facilitate unless someone would like to do [22:06] That's fine! [22:06] go ahead please :) [22:06] ok [22:06] propose dagenda items: [22:06] # 1. Review Urgent Bugs [22:06] # 2. Coordinate TWiki Release 4.2 [22:07] anything to add? [22:07] possibly tinymce? [22:07] crawford? [22:08] if not, let's start [22:08] ---+ 1. Review Urgent Bugs [22:08] http://develop.twiki.org/~twiki4/cgi-bin/view/Bugs/ReleaseBlockers [22:08] we have 22 listed [22:08] I just set the first of them http://develop.twiki.org/~twiki4/cgi-bin/view/Bugs/Item4782 to "Waiting for Feedback" [22:09] because I can't reproduce it [22:09] let's pick a few we should cover at this meeting [22:09] ...oh sorry... [22:09] I have a short list [22:10] (preparing) [22:10] hmm.. Item4755 -> upgrade issue ? [22:10] i've a comment on Item4570 on DefaultUrlHost. [22:10] ktwilight_: listening [22:10] Item4523, the URLPARAM issue [22:10] i've defaulted mine to 'http://' . $ENV{SERVER_NAME} can we make that as standard? [22:11] so there isn't a need for anyone to actually configure that. [22:11] it would be dependent on the webserver's configuration, which is more reliable? [22:11] lets first finish discussion on http://develop.twiki.org/~twiki4/cgi-bin/view/Bugs/Item4755 [22:11] ok [22:12] I have list ready walk though. [22:12] problem: current create topic links will stop working [22:12] ArthurClemens: Could you describe what has *changed* since 4.1.2? [22:12] something I did not oversee when refactoring that topic [22:12] yes [22:12] all inline scripts have been removed from the topic [22:13] the base topic is just a form - to be used by default ski [22:13] skin [22:13] javascript is added by pattern skin view template [22:13] loaded in fact [22:13] (the topic = TWiki.CreateTopic ?) [22:13] yes [22:13] it is a template so skins can override it [22:14] in this case pattern skin adds a js behaviour layer [22:14] this all works fine [22:14] except that that page can no longer be included [22:14] because INCLUDE and VIEW_TEMPLATE do not work together [22:15] alternatives a pretty grim [22:15] are [22:15] . [22:15] 4755 is "only" an annoyance issue that makes upgrading more difficult because you now have to update this one topic in all webs [22:15] * PeterThoeny thinks about potential traffic, needs to leave at +30 min [22:15] Lavr_: which is *VERY* annoying [22:16] * PeterThoeny would like to have someone else facilitate after he leaves [22:16] yes. One work around is to restore the old topic in TWiki web and give the new one a new name [22:16] Can we ship a semi-intelligent perl script in =tools= to be used from the command line? [22:16] restore means: add inline javascript to the topic [22:17] HaraldJoerg: you are hinting to an upgrade script? [22:17] i like the idea of new topic name [22:17] not so easy [22:18] it means that that topic will now rely on behaviour.js [22:18] instead of WebTopicCreator call it WebCreateNewTopic or the like [22:18] (hmm, have to look that up) [22:19] it does mean we will get 2 different topics to create a topic with [22:19] ok, we identified the problem, we do not need to find a solution now, but an owner [22:19] as the "not found" page also uses the new version [22:19] ah [22:19] i'm still trying to grasp the actual problem here.. [22:19] the pages do look quite similar [22:20] actually I would like that I could use INCLUDE + VIEW_TEMPLATE [22:20] If you upgrade from 4.1.X to 4.2.0 this is yet another task you have to do.. copy the WebTopicCreator.txt from one of the new webs to all the old ones. [22:20] so gnc - we are trying to make upgrading less of a pain. [22:20] I cannot even use %INCLUDE{"web.topic?template=blo"}% [22:21] i'm still looking for where in WebLeftBar the create topic is defined, i feel a bit stupid [22:21] enough of this for now [22:21] http://develop.twiki.org/~twiki4/cgi-bin/view/Sandbox/WebHome [22:21] Should I continue with my list of very urgent? [22:22] just below home [22:22] please [22:22] Item2975, Item3367, Item3009, Item3805: all EditTablePlugin items that I chose to change to urgent. We have quite many open items (12) on EditTable and those are the ones that seems to nag more than just one [22:22] Are those old ones or are they related to any changes in 4.2? [22:23] Some are very old. And one is related to the new javascript feature [22:23] where did that developer go? [22:23] Good question. [22:24] Item4244 EditTablePlugin: Very easy to accidently delete row. requires a Javascript guy to fix [22:24] well, it was jointly developed, incl crawford [22:24] now we have two edit table plugins [22:24] I can do the js [22:24] Problem is that we have an insert and a delete button next to each other. You easily hit delete by accident [22:24] it is too late to switch edittableplugin code with edittablerowplugin [22:24] for 4.2 [22:24] What did I develop? [22:25] * CDot tries to remember [22:25] EditTableRow is not a replacement for EditTable. [22:25] no [22:25] not yet because one feature is missing [22:25] no, more than that [22:25] some twiki applications depend on the way edittable works, and that cannot be replaced [22:25] ui is different which can be enhanced [22:26] So Item4244 is for me [22:26] ok, we are diverting, lets look at a merge after the release [22:26] OK thanks Arthur [22:26] back to fixing existing edittableplugin [22:26] thanks arthur [22:27] Item2975: Seems like a regex bug [22:27] or lacking space [22:28] Item3367: A problem with ETP when there is no empty line right after the table. [22:28] http://develop.twiki.org/~twiki4/cgi-bin/view/Bugs/Item2975 [22:28] http://develop.twiki.org/~twiki4/cgi-bin/view/Bugs/Item3367 [22:28] with TMCE thing got worse - that is why I elevated it to urgent [22:29] because TMCE in some cases will eat that important empty line after the table if the follow line contains a HTML type tag [22:29] did you test it since I fixed and closed that report? [22:29] No I did not. [22:29] ok. [22:30] I can have a look at this one as well [22:30] cool, thanks arthur! [22:30] Item3009: Looks like another regex bug. [22:30] too bad that code is so ugly [22:31] http://develop.twiki.org/~twiki4/cgi-bin/view/Bugs/Item3009 [22:31] http://develop.twiki.org/~twiki4/cgi-bin/view/Bugs/Item3009 [22:31] And finally Item3805: Which is dead annoying when you have an edit table with a footer row with a CALC in the fields. [22:32] THAT simply does not work because of this bug [22:32] on 3009, all twiki code should be done so that separator is comma and optional spaces [22:33] yes. But it does not work as can be seen from my examples. [22:33] meaning a , b is undefined, e.g. a has a trailing space [22:34] regex: /, */ [22:35] I never tested if other comma separated features in TWiki has this problem since I personally always put commas right [22:35] grammatically right [22:36] i believe edittableplugin separator is implemented properly [22:36] so mainly a doc question [22:36] but needs to be verified [22:36] That is OK with me. Take a look at the example I put to verify my observations. [22:36] I will continue with the bugs [22:37] Item4747: One of those TMCE bugs that relates somehow to TMCE eating new lines. <- So I do not see this fixed CDot. [22:37] It is still open [22:37] http://develop.twiki.org/~twiki4/cgi-bin/view/Bugs/Item4747 [22:37] yep [22:37] So what was it I should check then??? [22:38] For TW's original report there's a simple one-liner [22:38] Lavr_: I didn't say you should check anything [22:38] [22:29] did you test it since I fixed and closed that report? [22:39] the bug report devolved into a discussion; there is no actual report there, except Harald's observation about the whitespace [22:39] Lavr_: that was a different report [22:39] But the question is whether, and how, TMCE has a chance to handle %VAR%[newline]%VAR [22:39] Or rather, TMCE plus HTML2TML [22:40] well, that's a tough one [22:40] No the issue has always been (lately) the tags with lt and gt.
for example. TMCE eats a newline if it is before such a tag. [22:40] Maybe a bad example [22:40] Lavr_: sorry, it's really not that simple. The issue involved in %TABLE was different, and was fixed [22:40] Tags with < > [22:40] this is quite a different situation [22:41] yiu have to think in terms of the boundaries between different types of TML [22:41] between span-structured, and block-structured [22:41] tables are blockstructured [22:41] %VAR% %VAR% is span-structured [22:42] there is no way to say "that newline must be a newline" [22:42] (yet) [22:42] time check: +40 min [22:42] i need to sign off now [22:42] who can take over the facilitation? [22:43] koen? [22:43] I'm afraid I'm not neutral enough with some of the urgent bugs [22:43] for want of a horse, the kingdom was lost. I will do it. [22:43] Peter, sorry i am not focussed enough atm, splitting my attention between 3 things [22:43] CDot: How do you parse the HTML you get from TMCE? [22:44] ok, I have control. Have a safe day, Peter [22:44] ok, thanks all [22:44] i will read the logs [22:44] HaraldJoerg: using HTML::Parser [22:44] bye Peter! [22:44] c-ya Pater [22:44] uh, Peter. my bad. [22:44] np [22:44] cheers [22:44] so I can get the newline, if it exists [22:44] the problem is that different browsers generate different HTML [22:44] IE, for example, throws out *all* linebreaks - sometimes [22:45] No, browsers do not generate HTML at all. [22:45] Yep. IE and FF differ exactly on the newlines. Terrible [22:45] HaraldJoerg: ? [22:45] So that's an issue betweenn TMCE and the browsers? [22:45] the HTML is nothing to do with TMCE [22:45] it is generated from the DOM, by the browser [22:46] Ouch [22:46] TMCE uses MIDAS [22:46] I didn't know it was that bad [22:46] hell, that's the tip of the iceberg [22:46] hm, maybe using WYSIWYG is a bit too early? [22:46] there are at least four workarounds for FF bugs already coded in :-( [22:46] ktwilight_: the right time will never come.. [22:47] possible [22:47] I think we all understand the basic problem. [22:47] shall I continue? [22:47] please [22:47] Item4771: Seems close to resolution. Very good work of Sven. Harald you agree? [22:47] (SSO bug) [22:48] http://develop.twiki.org/~twiki4/cgi-bin/view/Bugs/Item4771 [22:48] What is important for me is that I do not loose the ability to be authenticated and allowed to edit - but not registered. [22:49] Anything you lack now Harald? [22:49] I don't - but I thought you were concerned about unregistered users indistinguishable from guest? [22:49] No. I know the difference. The REAL guests are the ones that cannot authenticate. [22:50] And I simply block those with DENYWEBVIEV in all webs [22:50] Works great [22:50] Maybe it's about time to document some sort of "best practice settings in a corporate environment"? [22:50] The minute a guest arrives he is forced to authenticate. If he cannot. Good bye. [22:51] Yes. Harald. That would be a good idea. On Codev supplental docs [22:51] Eh. Twiki web on t.o [22:51] I was surprised that our setups are so similar [22:51] I wish we had a better place for FAQs like that [22:51] so can we close 4771? [22:52] Waiting for Release, yes. [22:52] If Harald is happy then I believe it can be closed. [22:52] 8-) [22:52] next? [22:52] Item4707: I have a proposal which I would like Carlo and Arthur and anyone else with an interest to comment. [22:52] can you summarise quickly? [22:52] http://develop.twiki.org/~twiki4/cgi-bin/view/Bugs/Item4707 [22:53] I am not keen to do any more work on this [22:53] I propose to add an extra menu entry in --Styles-- in TMCE. Just below --Styles-- [22:53] not easy. Not at all easy. [22:53] Which does exactly the same as "--Styles--" but is called "No style" or "None" or similar. [22:53] I looked at doing that, and it would be a lot of work, requiring a new plugin [22:54] Lavr_: you _can_ use the eraser icon [22:54] You cannot just add an extra menu below called "None" and do the same as the one above? [22:54] no [22:54] No Arthur. You cannot [22:54] the styling disappears... [22:54] The --Styles-- item works. It is just not obvious that it removes a style [22:54] or seems to [22:55] the --Styles-- entry is *not* a menu item; it is the menu title [22:55] it is not accessible for configuration [22:55] The --Styles-- entry works though. It removes the 3 possible styles. [22:55] I tried to rename it - to "No Style" - but even that was beyond my abilities. [22:56] it does not with me [22:56] only the eraser works [22:56] What style are you erasing? [22:57] the styles [22:57] verbatim, literal and so on [22:57] Lavr_: do you consider the current situation to still be release-blocking? [22:57] No. But I assumed it would be an easy one that just required agreement [22:57] no, afraid not [22:58] can we downgrade it to "Normal but a real PITA that needs to be fixed" status? [22:58] Yes OK. [22:58] really, the same on Windows IE [22:58] ok. Next? [22:58] it would be great to have the styles marked with color [22:58] The worse and last. [22:58] Item4737: This we MUST find a work around for. People will loose work on that. I have added a proposal. [22:59] My proposal is to: Do the mandatory check in javascript so you simple cannot save. And remove preview. [22:59] from TMCE. [22:59] that makes sense [23:00] arthur, is there a special class for mandatory form items? [23:00] I don't think so [23:00] would it be hard to add one? [23:00] Lavr_: there might be other things that has the user hit 'back' [23:00] yes, just typing in the URL bar would do it [23:00] although the mandatory fields one is the most obvious one [23:01] Yes. But then it is more acceptable to "loose" data. [23:01] but there might be other problems that prompt the user to hit back [23:01] argh, no, blocking the navigate-away would be far more irritating [23:01] I *hate* sites that do that [23:01] When you force the user because he forgot a mandatory field but typed for 30 mins in other fields then we MUST protect him from himself [23:01] must..not..force..user.. [23:02] but if they confirm.... then we must do as they say [23:02] * PeterThoeny has quit IRC (Connection timed out) [23:02] even if they lose daya [23:02] It is the mandarity field usecase AND the preview where we lure the user to press back as part of normal UI. [23:02] it would be better if the preview was on the same page, in an iframe [23:03] Preview is not needed with Wysiwyg - most never preview anyway. [23:03] erm, how about a launchWindow for the preview? [23:03] my preview: safe, and if it doesn't look nice, hit back [23:03] anyway, the same is true for a normal save [23:03] if a mandatory field is empty [23:03] gmc: You're doomed if your topic was an XXXXXXXXXX one [23:04] I still prefer the same page over a pop-up [23:04] HaraldJoerg: i'm doomed anyway :) [23:04] because every save will create a new topic [23:04] erm, we could have a message box "Install Opera now" [23:04] HaraldJoerg: i actually do have some intelligence somewhere that prevents me from 'Back'ing on AUTOINC topics :) [23:04] Lucky you :-) [23:04] i'm actually tempted to solve the bug in firefox.. [23:05] tempted.. but i know nothing of ff codebase, so that's not much of an option [23:05] gmc: it's been open since 2002 [23:05] which suggests it's non-trivial [23:05] so basically, we have had this same problem with kupu too? [23:05] yes [23:05] with *any* editor that replaces textareas [23:05] strange though, that no-one complained [23:05] wikiwyg, dojo, all of them [23:05] there are many complaints [23:06] I've always thought of preview as a candidate for AJAX [23:06] Drupal coded around it [23:06] yeah, i saw it.. [23:06] so that the "view" could come into some DIV element on request [23:06] maybe we have to code around it too.. [23:07] I think we should [23:07] and a mandatory check in JS is one way [23:07] ajax is no problem, but we don't have it installed be default [23:07] storing the field values somehow, and retrieving them is another [23:07] yes [23:07] perhaps via a clever REST handler [23:07] god forbid [23:07] * CDot doesn;t feel that clever [23:08] a cookie is the conventional way, but we have far too much data [23:08] reordering the form fields is the simplest solution [23:08] reordering as in putting form first then textarea? [23:08] y [23:09] we can place them the normal way with js [23:09] hmmm, and then swap them with some js [23:09] brr [23:09] without moving them in the DOM? [23:09] hmm [23:09] it's their position in the DOM that's critical [23:10] so when does ff fill in the values.. after your page is completely rendered, including any onloads ? [23:10] so our tabbed interface is coming near [23:10] as I understand it, when you go "back" in FF it fills in the values in the DOM *before* onload is called [23:11] oops, I meant *after* [23:11] oh darn [23:11] you gave me some hope there [23:11] that's the bug [23:11] anyway, we can;t solve it here [23:11] I don;t have a solution, and TBH I'm out of ideas [23:11] I like the js validation [23:11] and motivation to fix it, frankly [23:11] i don't like the js validation [23:12] why not? [23:12] i would prefer the solution with a cookie linked to storage via some REST handler or the other [23:12] why not? [23:12] we are not going to solve it here [23:12] ArthurClemens: it's a less general solution imho [23:12] I think the usability of disabling the save if mandatory fields are missing is much better. So not only is it a work around. it is an improvement [23:12] let's move this discussion into the topic, please, and move on [23:13] ok [23:13] we can come back if we have time [23:13] do we need to talk about the URLPARAM thing some more? [23:13] next? [23:13] I have mentioned the ones I wanted to discuss today. [23:13] ok, then the URLPARAM thing [23:13] Item4523 [23:13] http://develop.twiki.org/~twiki4/cgi-bin/view/Bugs/Item4523 [23:13] I provided the SafeWikiPlugin, and Arthur has been moving scripts out of line [23:14] I think we are in pretty good shape [23:14] we are.. [23:14] but no testing feedback :-( [23:14] I still have some templates to look after [23:14] not a word [23:14] is SafeWikiPlugin going to be enabled by default? [23:14] Will the default plugins work with SWP? [23:14] it isn;t at the moment [23:14] Lavr_: good question, only ansered by testing [23:14] Like EditTablePlugin which is now full of js? [23:14] CDot: i can give you plenty of feedback, a month from now... :( [23:15] some may not - I have doubts about EditTablePlugin [23:15] I know ATP has issues [23:15] but that isn;t default. [23:15] if it's any consolation, EditRowPlugin works fine with it [23:15] I do not think that SWP will be ready for the release. BUT the fact that we have prepared for the plugin is enough to show the customers that we care and there is more to come [23:15] so there is always a fallback [23:15] I can't test SafeWikiPlugin in "real life" because we have a lot of inline scripts [23:16] triggered by preference variables [23:16] " I do not think that SWP will be ready for the release" - why not? [23:16] HaraldJoerg: i can tell you the test results already [23:16] EditTablePlugin even has a handler 'dynamicJavascriptForTable' [23:16] test time CDot. test with the many plugins. [23:16] oh, for enabling by default. Yes, I agree [23:16] I am more concerned that we have a solution available [23:17] even *with* broken plugins [23:17] But the development of the plugin can continue with many release after we release twiki itself. [23:17] As long as TWiki itself is working with it [23:17] there is no more development needed on the plugin [23:17] it is *other* plugins that are the problem [23:17] we need a SafeWiki badge [23:17] for plugins [23:17] good idea! [23:18] I did a lovely logo [23:18] * ArthurClemens hides [23:18] :-D [23:18] CDot: does it involve condoms? [23:18] gmc: the first one did [23:18] :-)) [23:18] but then I thought that wouldn;t go down well [23:19] I have a question about "remember me" [23:19] http://develop.twiki.org/~twiki4/cgi-bin/view/Bugs/Item4523 [23:19] HaraldJoerg: you wrote it is working fine [23:19] anyway, can we close 4523 with the availabllity of SafeWikiPlugin? [23:19] Arthur: I've been just working on an explanation in the bugs topic [23:20] Lavr_: can we close 4523 with the availabllity of SafeWikiPlugin? [23:20] We can at least change it from urgent to normal. I would like to test more and I am not sure I get time before the release is out [23:21] ok [23:21] sounds like a plan [23:21] I may want to check in some doc updates on it so do not not close it. [23:21] anyway, i'm off.. supposed to do some smarty sciency text analysis AI thingies tomorrow so i'm going to get some sleep [23:21] Like some release note stuff and upgrade stuff that needs to point to the SWP [23:22] gnite gmc [23:22] Arthur "remember me" question? [23:22] so the topic is actually http://develop.twiki.org/~twiki4/cgi-bin/view/Bugs/Item4782 [23:22] marked as urgent because it does not work at all [23:22] I really doubt this is a browser issue [23:22] no, probably not [23:23] I really don't understand how it _should_ work [23:23] only how I think it ought to [23:23] The writeup to the question has too many lines to paste it here :-) [23:23] Just let me type some minutes to the bugs topic. [23:24] the "remember me" was just to keep a session logged in through a browser close [23:24] if your browser is set to clear cookies on close, it won;t work [23:24] for obvious reasons [23:25] IIRC Chad just tweaked the timeout on the session [23:25] checkin in question is 12837 [23:26] so if I close the browser and open again with twiki I should be logged in? [23:26] Yes [23:26] I have never seen that happen [23:26] if your browser doesn't clear the session cookies. [23:27] I think it also requires TemplateLogin right? [23:27] if you are using template login [23:27] yes [23:27] I haven't tested it, but i can see no reason why it should have stopped working [23:27] I use template login [23:28] can anyone confirm it is working right now? [23:28] Yes, I've tried today. [23:28] (also on Windows it is not on my computer) [23:28] I use a mac webserver [23:29] HaraldJoerg: did it work? [23:29] does it work on your firefox as well? [23:30] I never tested that feature because I always use ApacheLogin [23:30] I trust harald's analysis of this [23:30] Yes, it did work, but I "only" have Ubuntu. [23:31] Firefox and Epiphany. [23:31] I doubt that's relevant [23:31] I originally tested it on IE as well, when i checked it in [23:31] I have *not* tested on Safari, but I'd be surprised if it didn;t.... [23:31] Yes, me too. But maybe different browsers treat cookies with expiration date differently. [23:31] * ktwilight_ don't even know where there's this "Remember me" field. [23:31] Firefox allows to discard all cookies when closing the browser-. [23:31] this is in login right? [23:31] I have removed it from our intranet because it didn't work [23:32] ktwilight: It took me some time to figure out. You need TemplateLogin plus a setting in =configure= which I forgot. [23:32] firefox: check "remember" > log in > nothing (not logged in even) [23:32] HaraldJoerg, hm, i use templatelogin, but have no "remember me" [23:32] it is an advanced setting [23:32] but am always logged in unless i specifically delete the session cookies, which is normal. [23:33] {Sessions}{ExpireCookiesAfter} [23:33] ArthurClements: Thanks! [23:33] can we mark this one as "being looked at" and move on please? [23:33] I have a short AOB. [23:33] CDot: agreed [23:34] Lavr_: go for it [23:34] http://twiki.org/cgi-bin/view/Codev/HowSafeIsSudoLogin [23:34] hm, i have {Sessions}{ExpireAfter} = 21600 [23:34] set ExpireCookiesAfter to 2600000 [23:34] The sudo login is a new feature and if there is a hidden bug the consequences is severe security wise. [23:35] that is a lot of seconds [23:35] So we need someone who did not code it to give it a one hour review. [23:35] I was thinking about Harald. [23:35] Lavr_: there is no point in looking at sudo in isolation; you need to look at the whole authentication process [23:36] I haven't managed to figure out how that code works [23:36] The simple question to look for is: Can an already authenticated user fool TWiki to elevate him to admin by exploiding some unknown hole? [23:37] If I understand the concept correctly, then no. I *think* that sudo will simply override whatever authentication scheme by a session based authentication, which takes precedence. [23:37] At least with the normal authentication - we have had it in the field for a while. sudo is new. I have no reason to believe there is a security hole. But since the a bug could be very severe a brief 2nd look would not harm [23:37] correct [23:38] IMHO a "brief second look" is probably a waste of time, but it can't hurt [23:38] Cookie based authentication schemes are prone to hijacking unless HTTPS is used, but this holds for BasicAuth with Apache as well [23:39] even is https is used, cross-scripting can still make them vulnerable [23:39] There's no way I know of how a client could manipulate the *contents* of TWiki's session file, he just has the file name [23:40] CDot: yes, but not more vulnerable than with any other authentication schemwe [23:40] right [23:41] For another reason I've prepared a pretty long article about XSS, but am still hesitating to write something TWiki related. It might scare people. [23:42] please do, if not, no progress will be made ;) [23:42] With sudo I was more thinking about sneaky URLs, funny crafted TWiki topics etc etc where something was missed. Even I have found such security holes in TWiki. [23:42] After all, it still needs many parts to make an XSS attack successful, and the biggest part is always sitting between the computer and the keyboard. [23:42] HaraldJoerg: I would be interested in your reaction to SafeWikiplugin, and whether it really *is* any safer [23:42] CDot: For sure it is safer! [23:43] On the XSS bug I put a reference to a site that has a large catalog of ways to fool browsers and webservers to run js [23:43] Lavr_: did you try them? [23:43] Not with the SWP. [23:44] But I tried some of the them on naked TWiki. That is how I made the examples where you first said it was not possible ;-D [23:44] ok. Well, Lavr_'s request os for coders to help audit TWiki security. Any takers? [23:44] since I am excluded, I guess the only people who can answer that are Arthur and Harald [23:44] The candidates should be those that did not code it. You cannot see your own bugs. [23:45] As a casual coder, I can only occasionally review the concepts. The code changes way to fast. [23:45] well, that code won't change again any time soon [23:45] To limit the scope - if you could just look at the sudo - then we have attacked the NUD (new unique difficult) [23:45] so you should be fairly safe ;-) [23:45] CDot: You must be kidding. [23:46] heh [23:46] The user mapping code has never stopped to change rapidly since it was introduced in 4.0.2 [23:46] yes; but it's taken this long to get it right [23:47] because we kept rushing it out :-( [23:47] Yep [23:47] I'm pretty happy with what's there now, which I could never say before [23:47] It could do with a lot of documentation in the modules, though [23:48] agreed; as could most of the rest of TWiki [23:48] LAST item tonight is schedule. [23:48] Agreed as well, but why are we piling up more and more of that stuff? [23:49] "that stuff"? [23:49] undocumented code [23:49] doc stuff [23:49] ah :-( [23:49] But that's nothing to do with release meeting [23:49] well, not everyone is a good documenter [23:50] and we are not so rich in contributors that we can afford to be picky, so... [23:50] You fend off occasional contributors with such code [23:50] * CDot is hardly the best tech author in the world, but still wrote most of the core docs [23:51] We need to round off meeting with confirmation of the schedule. [23:51] if that is OK [23:51] as you wish [23:51] to me, the schedule is "when lavr is happy" [23:52] The plan says RC1 in one week. The 15th. [23:52] and that means "no urgent bugs" [23:52] I am not sure if we should do an RC1 or a beta 3. But we should release because we can see that the betas means new testers that do not know how to run from an SVN checkout [23:53] The decision on RC1 or beta 3 will depend on the number of open urgents in one week from now. [23:53] Agreed. I can not run a SVN checkout in my corporate installation. [23:53] My best is on a beta 3 [23:53] bet I mean [23:53] But I don't care whether it's beta 3 or RC1 [23:54] me neither [23:54] I'm quite happy to keep on labelling things "beta" until you decide one is releasable [23:55] OK. Sven and I can discuss what we call it then. But release something in one week. We should also - no matter what - have string freeze in one week. Agree? [23:55] (that was the plan) [23:55] Should we downgrade 4459 "Login messages not translated" to normal? [23:55] You mean we don;t have string freeze yet? [23:55] so I have been jumping through hoops to avoid changing strings for no reason? :-/ [23:56] Peter insisted last time to defer to RC1. I wanted string freeze two weeks ago [23:56] shit [23:56] there are many strings that have javascript embedded in them [23:56] ...and strings which could never be translated... [23:56] ah, what the hell, I'm not going to put the time in to fix them anyway. [23:57] I think it is better to focus on the bugs now. [23:57] what bugs? ;-) [23:57] Eh. opportunities for improvement of otherwise near perfect code? [23:58] good wording [23:58] erm, 4784 [23:58] does anyone else share my view on this? [23:58] http://develop.twiki.org/~twiki4/cgi-bin/view/Bugs/Item4784 [23:58] yes it it a bug [23:59] Seems to be right. You can always add the terminating character in the format string if you need it. [23:59] it was like that in Cairo [23:59] I *think* Session Time: Tue Oct 09 00:00:00 2007 [00:00] I don't remember seeing this bug before [00:00] ok, maybe it's new then [00:00] I only noticed it today [00:00] I am pretty sure it did work correctly [00:01] http://develop.twiki.org/~twiki4/cgi-bin/view/TWiki/VarSEARCH says it [00:01] Line separator _between_ search hits [00:02] * CDot is checking [00:02] ah well, the joy of unit testing [00:02] * ArthurClemens is writing lots of tests for asaplibrary today [00:03] 4.1.2 added the trailing seperator [00:03] somehow ME does not work if you don't have a nick [00:03] it was broken in Cairo as well [00:03] I have an install of Cairo here, and I just tested it [00:04] so it must have been fixed, and then re-broken in 4.1.2 [00:05] anyway, I think we are done with the agenda. Thanks, folks. i look forward to the results of the auth code audit. [00:05] On my Cairo I do not get the trailing | [00:05] Where do I start to look for sudo login? [00:06] %SEARCH{"Etruscan Art" format="$topic" separator="|"}% : Searched: Etruscan Art TestFive|Number of topics: 1 [00:06] is what I get [00:06] TWiki 30 Dec 2002 did not have separator [00:06] Yes. I though "Number" was last topic :-) [00:07] d'oh [00:07] I made a test with 20 hits so I did not notice it was the message that was trailing without a new line [00:07] if we fix it, it's going to break someone's twiki app, for sure :-( [00:08] If we do not fix, there are some twikiapps that are difficult to make work. [00:08] but as it is, it makes it impossible to use embedded search to build REs [00:08] it will be more pain to remove the last separator otherwise [00:08] yep. I think we should fix it. [00:09] I think fixing in this case helps more than it harms. We will put a small section in the release note saying how to fix a twiki app that relied on the bug [00:09] I can write that [00:11] I will do a search tomorrow at work to see if we have any apps that are negatively affected. Just to get a feel. [00:12] I am doing a search on my Motion Twiki right now [00:12] looking for "separator=" [00:13] Used heavily in TWiki web in distribution topics. [00:13] Im off to bed [00:14] good night [00:14] Good night Arthur [00:15] On my Motion TWiki I have not used it at all. It is used mostly in Twiki own topics and often with separator=", " [00:16] it only affects if used with format= [00:16] Ah OK. [00:17] I think this fix is the right thing to do. Compatibility is important. But not if it means that people that suffered a bug still have to suffer. This one I am sure has pissed off people more than they have been able to use it. [00:18] The only place I see this can break something is with tables where the separator was | [00:19] there is actually code to remove the extra separator [00:19] but it's not working; perhaps because | is the separator? [00:19] And I doubt many make a dynamic table where the number of columns can grow to large sizes. That is not a likely usecase people will have used. [00:19] (still here) http://develop.twiki.org/~twiki4/cgi-bin/view/Sandbox/SearchTest [00:19] that is with commas [00:20] Can you imagine a twiki app where people will have designed it to depend on a trailing separator? [00:22] Nope. Let us fix this one. In this case that is the right thing to do. [00:22] I will also go to bed now [00:23] Good night. [00:23] Thanks for a good meeting