patchSamizdat - Patches: patch #6143, multi_publish-0.7.2 [vs 080811-1]:...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

patch #6143: multi_publish-0.7.2 [vs 080811-1]: publish text + multiple non-text media items in just one preview/confirm cycle

Submitter:  Boud Roukema <boud>
Submitted:  Tue 07 Aug 2007 11:07:31 AM UTC
   
 
Category:  None Priority:  5 - Normal
Status:  Done Privacy:  Public
Assigned to:  None Open/Closed:  Closed

Jump to the original submission

Mon 30 Mar 2009 12:41:17 PM UTC, comment #13: 

This has been implemented based on the new upload queue mechanism in CVS commit at 2009-03-30 11:35. New message form now includes upload fields for multimedia message parts (at the moment the number of parts is hardcoded at 5, this has to be replaced with a dynamic JavaScript-based form).

Furthermore, original filenames of parts are stored in the database and are replaced in img/src attributes of the master message with resource id based links to the uploaded images. This makes it easier to locally edit an html article with images and then upload the article and the images in one go, without manually re-editing the article to reflect assigned image ids.

Dmitry Borodaenko <angdraug>
Group administrator
Sat 30 Aug 2008 10:22:42 PM UTC, comment #12: 

version 0.7.2 has two trivial changes in order to have two less entries in the .po files, while still translating all the text strings.


(file #16399)

Boud Roukema <boud>
Group Member
Sat 23 Aug 2008 01:09:03 AM UTC, comment #11: 

Version 0.7.1 should be orthogonal to most of the other patches, and required a minor change (.uniq.join) for one hunk to work against 080811-1. The 080823_guess_lang-0.4.1.patch https://savannah.nongnu.org/patch/?6554 should be applied after the multi_publish patch (or not applied at all) if you want to avoid having to edit hunks by hand.


(file #16338)

Boud Roukema <boud>
Group Member
Mon 18 Aug 2008 11:37:52 PM UTC, comment #10: 

VERSION 0.7: A few bugs in 0.6.3 have been removed.

PATCH OVERLAP REMOVED: version 0.6.3 had an overlap with the @@etch_hack described in https://savannah.nongnu.org/patch/?6585#comment1 and attached there as a patch. Patch 0.7 does not have this overlap, so should be able to be applied independently of that patch.


(file #16313)

Boud Roukema <boud>
Group Member
Tue 22 Jul 2008 10:13:15 PM UTC, comment #9: 

Again some minor polishing up. In most of the actions at the time of confirmation there should be


set_upload([:confirm]) if @upload


In version multi_publish-0.6.3 this should be fixed.


(file #16174)

Boud Roukema <boud>
Group Member
Tue 22 Jul 2008 09:20:34 PM UTC, comment #8: 

Just a minor change from multi_publish-0.6.1.patch, set_upload([:confirm]) in method 'publish', which is still used if the multi_publish feature is not enabled in the 'limit' section of the config file.



(file #16173)

Boud Roukema <boud>
Group Member
Tue 22 Jul 2008 09:11:13 PM UTC, comment #7: 

Since the upload_id method in content.rb now always uses a hash, methods like reply and edit in message_controller.rb also need to be updated.  Version 0.6.1 of multi_publish, which i'm attaching here, has hopefully fixed these.



(file #16172)

Boud Roukema <boud>
Group Member
Tue 22 Jul 2008 08:11:17 PM UTC, comment #6: 

This is a new version of the multi_publish patch, more or less
rewritten from scratch. It should work against 080703-2.
It should provide a neater solution than the previous versions.

There is relatively less interference in content.rb than before
(except for what's mentioned in the next paragraph) -
most of the work is done in message_controller.rb.

BUG 20710:
Dmitry's concern about bug 20710
https://savannah.nongnu.org/bugs/?20710 has been dealt with by
limiting the number of 'old' non-confirmed files per login. See the
algorithm in the method 'check_pending_uploads' added to content.rb.
So this should hopefully solve the bug in a way which is at least
moderately safe against DOS attacks.

CONFIG: The config parameters are a little different to those of the
previous versions of the patch.


PATCH OVERLAP:
Since this patch includes changes in content.rb, it also includes
the etch hack described here:
  https://savannah.nongnu.org/patch/?6585#comment1
Set @@etch_hack = false to disable it, or look for where @@etch_hack
is used and remove sections that require it to be true.


TODO: The automatic insertion of a thumbnail for html or textile
multi_publish articles uses rather hardwired html code. It could
potentially be better integrated into the plugin system, and allow
for e.g. flv files etc. rather than just images.




(file #16171)

Boud Roukema <boud>
Group Member
Sun 22 Jun 2008 09:36:31 PM UTC, comment #5: 

VERSION: This is a patch against 070818-1. i hope to have time to upgrade to 080525 (i've started!) but until then, this is only a patch against 070818.

WHAT'S NEW: No obvious problems have occurred with the multi_publish patch in general, and users have complained that the simple interface is user UNfriendly because users expect to be able to publish both text and a file simultaneously. The "Alternatively" in the description next to the box for entering a filename is not strong enough to overcome confusion. And those users who do understand the alternative may still get upset the first time they "lose" their text and don't realise that they can use the back button of their browser to fix it. So if


limit:
  multi_message_simple: 1


is put in the limit: part of the config file, version 0.5 of the multi_publish patch does the same as the previous version, except that only 1 file can be published along with the text message. The number is not constrained to be 1, but the motivation is to retain maximum simplicity while not being so simple that users get frustrated.






(file #15907)

Boud Roukema <boud>
Group Member
Wed 10 Oct 2007 11:30:15 PM UTC, comment #4: 

VERSION: this is a patch on multi_publish-0.4. When applied
after multi_publish-0.4, it makes multi_publish-0.4.1.


PROBLEM:
Multipublish-0.4 sometimes gives a run error with:

   SecurityError: Insecure: can't intern tainted string

in the apache log.

A longer backtrace is below, but the key part is:

Backtrace:
/usr/lib/ruby/1.8/redcloth/textile.rb:285:in `respond_to?'
/usr/lib/ruby/1.8/redcloth/textile.rb:285:in `block_textile_prefix'
/usr/lib/ruby/1.8/redcloth/base.rb:457:in `call'
/usr/lib/ruby/1.8/redcloth/base.rb:457:in `blk'
/usr/lib/ruby/1.8/redcloth/base.rb:456:in `each'
/usr/lib/ruby/1.8/redcloth/base.rb:456:in `blk'
/usr/lib/ruby/1.8/redcloth/base.rb:426:in `block_groups'
/usr/lib/ruby/1.8/redcloth/base.rb:426:in `collect'
/usr/lib/ruby/1.8/redcloth/base.rb:426:in `block_groups'
/usr/lib/ruby/1.8/redcloth/base.rb:421:in `blocks'
/usr/lib/ruby/1.8/redcloth/base.rb:420:in `map'
/usr/lib/ruby/1.8/redcloth/base.rb:420:in `blocks'
/usr/lib/ruby/1.8/redcloth/base.rb:128:in `to_html'
/usr/lib/ruby/1.8/samizdat/models/content.rb:224:in `render_cacheable'
/usr/lib/ruby/1.8/samizdat/helpers/message_helper.rb:120:in `message_content'
/usr/lib/ruby/1.8/samizdat/helpers/message_helper.rb:234:in `message'
/usr/lib/ruby/1.8/samizdat/controllers/message_controller.rb:676:in `multi_preview'
/usr/lib/ruby/1.8/samizdat/controllers/message_controller.rb:263:in `multi_publish'


With a given installation of samizdat (with the multipublish patch-0.4) and a given
text + image, the error seems highly repeatable.

Changing the position of the image (among the N boxes for additional media) can
avoid the error.  e.g. position 0 gives an error, position 8 is OK.

The bug occurs when choosing textile as the format. It is not known if it
occurs with other formats (though the error message suggests it is dependent
on textile modules).


HYPOTHESES:

It is probably something to do with the file names of the
temporary or permanent files for the uploaded files, and the
fact that one of them is referred to in the "insert_text"
which is added to a textile (or html) text article as a
very simple thumbnail/link.


SOLUTIONS KNOWN TO WORK:

Put in an untaint at the appropriate spot. i haven't been able to narrow
it down to a very precise spot, so i only found some more general places
(which is not the best solution).

solution 1  message_helper.rb


      body.untaint
      Content.render_cacheable(body, content.format) + truncated.to_s




solution 2  content.rb


        RedCloth.new(body.untaint).to_html


To be safe (assuming that insert_text from multi_preview is somehow involved,
the error would occur for both textile and html formats, but not for other
formats, since insert_text is not used in other cases):


      when 'text/html'   # limited HTML text
        '<div>' + body.untaint + '</div>'
      when 'text/textile'   # textile formatted text
        RedCloth.new(body.untaint).to_html



i'm suggesting the second solution here, until a better one comes along.



WHAT IS UNSURE: Where exactly does the taint come from? For the :short case
could it happen with the limit_string function ???  Or else from sanitize????
which puts in a .taint after it has finished its work, and then somehow the
sanitised text gets reused ???


LONGER DIAGNOSTIC:


Samizdat: Tue Oct 02 18:39:16 +0000 2007: SecurityError: Insecure: can't intern tainted string
Error ID: 7351208f2c6dc2fd49fac90fffe643a0
CGI parameters: {"file2"=>[#<StringIO:0x4272f3d4>], "file3"=>[#<StringIO:0x4272e718>], "format"=>[#<StringIO:0x4272800c>], "title"=>[#<File:/tmp/CGI.22403.0>], "body"=>[#<File:/tmp/CGI.22403.1>], "file4"=>[#<StringIO:0x4272da5c>], "file5"=>[#<StringIO:0x4272cd50>], "file6"=>[#<StringIO:0x4272bf68>], "file7"=>[#<StringIO:0x4272b270>], "file8"=>[#<StringIO:0x4272a67c>], "desc"=>[#<StringIO:0x427264f0>], "file9"=>[#<StringIO:0x427299ac>], "lang"=>[#<StringIO:0x42728cf0>], "preview"=>[#<StringIO:0x42725924>], "file0"=>[#<File:/tmp/CGI.22403.2>], "file1"=>[#<StringIO:0x42730004>], "open"=>[#<StringIO:0x42727300>]}
Backtrace:
/usr/lib/ruby/1.8/redcloth/textile.rb:285:in `respond_to?'
/usr/lib/ruby/1.8/redcloth/textile.rb:285:in `block_textile_prefix'
/usr/lib/ruby/1.8/redcloth/base.rb:457:in `call'
/usr/lib/ruby/1.8/redcloth/base.rb:457:in `blk'
/usr/lib/ruby/1.8/redcloth/base.rb:456:in `each'
/usr/lib/ruby/1.8/redcloth/base.rb:456:in `blk'
/usr/lib/ruby/1.8/redcloth/base.rb:426:in `block_groups'
/usr/lib/ruby/1.8/redcloth/base.rb:426:in `collect'
/usr/lib/ruby/1.8/redcloth/base.rb:426:in `block_groups'
/usr/lib/ruby/1.8/redcloth/base.rb:421:in `blocks'
/usr/lib/ruby/1.8/redcloth/base.rb:420:in `map'
/usr/lib/ruby/1.8/redcloth/base.rb:420:in `blocks'
/usr/lib/ruby/1.8/redcloth/base.rb:128:in `to_html'
/usr/lib/ruby/1.8/samizdat/models/content.rb:224:in `render_cacheable'
/usr/lib/ruby/1.8/samizdat/helpers/message_helper.rb:120:in `message_content'
/usr/lib/ruby/1.8/samizdat/helpers/message_helper.rb:234:in `message'
/usr/lib/ruby/1.8/samizdat/controllers/message_controller.rb:676:in `multi_preview'
/usr/lib/ruby/1.8/samizdat/controllers/message_controller.rb:263:in `multi_publish'
/usr/lib/ruby/1.8/samizdat/engine/dispatcher.rb:76:in `send'
/usr/lib/ruby/1.8/samizdat/engine/dispatcher.rb:76:in `render'
/usr/lib/ruby/1.8/samizdat/engine/dispatcher.rb:120:in `dispatch'
/usr/lib/ruby/1.8/samizdat/engine/dispatcher.rb:117:in `catch'
/usr/lib/ruby/1.8/samizdat/engine/dispatcher.rb:117:in `dispatch'
/usr/lib/ruby/1.8/samizdat/engine/dispatcher.rb:130:in `run'
/usr/share/samizdat/cgi-bin/dispatch.rb:23
/usr/lib/ruby/1.8/apache/ruby-run.rb:53:in `load'
/usr/lib/ruby/1.8/apache/ruby-run.rb:53:in `handler'



(file #14129)

Boud Roukema <boud>
Group Member
Fri 24 Aug 2007 02:47:07 AM UTC, comment #3: 

Version 0.4 is against  samizdat-0.6.0.070818-1.

Two strings are translated in pl.po in cvs.

A few minor things are fixed/improved relative to 0.3.



(file #13780)

Boud Roukema <boud>
Group Member
Fri 10 Aug 2007 10:12:33 PM UTC, comment #2: 

Version 0.2 didn't fully commit transactions - this led to
not-so-easy-to-reproduce errors of the additional media
items either not being published, or appearing to be published,
then disappearing, and then reappearing. i won't give the
details, since it's clear that something was missing.

The uploaded patch 070810_multi_publish-0.3 seems to fix this.
The only significant change is that in message_controller.rb
we now have @message.insert and @message...move_upload...
inside of a db.transaction method call:

+          if parent_action_confirmed  # the parent token was deleted
+            db.transaction do |db|
+              @message.insert!
+              @message.content.file_index = i
+              @message.content.move_upload(@request)
+              cache.flush
+            end
+          end



(file #13644)

Boud Roukema <boud>
Group Member
Tue 07 Aug 2007 09:47:45 PM UTC, comment #1: 

multi_publish-0.2:

BUGFIX: in version 0.1, a logged in user got only the initial,
parent message published. This was because the action_token gets
deleted after it has been checked, and individual action_tokens
are not generated for the individual additional messages. The
solution was to use a variable  parent_action_confirmed  which
communicates to the replies that the token has been confirmed.

OPTIONAL FEATURE added: 
If you add

limits:
  thumbnail_width: 200

for some width greater than zero to defaults.yaml or your
site .yaml file, then if all the following are also true:

  • one of the additional files is recognised to be of image/ file type
  • and the parent (first) message is of type text/html or text/textile
  • and the user has not included an image in the parent message


then in that case, a "thumbnail" (not a real thumbnail, just
a width= attribute) will be added to the parent message as
a left float at the beginning of the body. This could (hopefully)
make it easier for people to publish multi-image articles
and have them come up looking nice in the centre column if
there is consensus to put it there, without requiring too
much user skills.

This is not really an ideal solution, it's still rather
hard-wired, and it won't happen for someone using the default
format for his/her parent message. However, i think that
samizdat should at least be able to make centre column
articles look as nice as mir does, while improving on it
by making the thumbnails clickable (which is what users
expect).

cheers
boud


(file #13615)

Boud Roukema <boud>
Group Member
Tue 07 Aug 2007 11:07:31 AM UTC, original submission:  

hi samizdat-devel,

Here's version 0.1 of multi_publish, with most modifications to
controller/message_controller.rb and a few to models/content.rb.

It's deliberately written with multi_publish, multi_set_content and
multi_preview (message_controller) rather long-winded as new methods
in order that it can be experimented with without much danger of
totally disabling publication in case it contains some non-trivial
bugs.  However, check_content is modified rather than cloned (but my
feeling is that it won't break anything).

CONFIG:
config['limit']['multi_message']   should be set to the maximum
number of uploads. Unfilled fields will be ignored.

TODO: Giving too many fields to a user can unnecessarily encourage
them to publish too many photos/etc. An option similar to mir would be
to first give a form asking how many items are required, and then
reissuing the form if the person submits a number.


KNOWN BUGS:
There's a known bug  #20710 with upload conflicts present in 070618-1 (and
presumably earlier versions) - this same bug applies here.

  https://savannah.nongnu.org/bugs/index.php?20710


At the moment, the idea is that ui=advanced automatically redirects
publish to multi_publish (though it is technically possibly to go
directly to multi_publish with a basic interface, by typing the URL
message/multi_publish) - i think that having 3 different types of interfaces
would be too confusing.

i've also added a warning at the preview stage - mediawiki and i think
many other similar software tend to give a BIG warning at the preview
stage, since with a confirm button at the bottom of the page, people can
easily forget to confirm - and then get angry when they think their
contribution has been deleted/ignored.


Should the files be published as non-wiki even if the user requests
wiki for the parent message? My feeling is that in practice,
photos/videos are (relatively) objective in terms of news
reporting. Of course there is a choice of what/how to photograph,
which photos to publish or not publish, and they can be edited with
gimp or with non-free software. But any normal text item about a news
event necessarily must be subjective, since it's a summary of the
event in a natural language after processing the
audio/visual/tactile/olfactory/scent signals of the event through one
or more human brains and cannot be a raw recording of an event (except
if it's a word-for-word report on a speech or a document, for example,
like wikisource).

So that's why i set:
+          set_open(false) #(@parent.open) TODO discuss: is this a reasonable default?


Anyway, anyone should feel free to rewrite this patch more elegantly and
compactly :)


cheers
boud


Boud Roukema <boud>
Group Member

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attached Files
file #16313:  080819_multi_publish-0.7.patch added by boud (22KiB - text/x-patch)
file #16172:  080722_multi_publish-0.6.1.patch added by boud (20KiB - text/x-patch - fixes for reply, edit etc.)
file #16171:  080722_multi_publish-0.6.patch added by boud (19KiB - text/x-patch)
file #15907:  080622_multi_publish-0.5 added by boud (16KiB - application/octet-stream)
file #13780:  070824_multi_publish-0.4_vs_070818 added by boud (14KiB - application/octet-stream)
file #13644:  070810_multi_publish-0.3 added by boud (13KiB - application/octet-stream)
file #13615:  070806_multi_publish-0.2 added by boud (13KiB - application/octet-stream)
file #13609:  070806_multi_publish-0.1 added by boud (11KiB - application/octet-stream)

 

Depends on the following items: None found

Digest:
   bug dependencies.

 

Carbon-Copy List
  • -email is unavailable- added by angdraug (Posted a comment)
  • -email is unavailable- added by boud (Submitted the item)
  •  

    Follow 25 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2009-03-30 angdraug StatusWorks For Me Done
        Open/ClosedOpen Closed
    2008-08-30 boud Attached File- Added 080830_multi_publish-0.7.2.patch, #16399
        Summarymulti_publish-0.7.1 [vs 080811-1]: publish text + multiple non-text media items in just one preview/confirm cycle multi_publish-0.7.2 [vs 080811-1]: publish text + multiple non-text media items in just one preview/confirm cycle
    2008-08-23 boud Attached File- Added 080823_multi_publish-0.7.1.patch, #16338
        Summarymulti_publish-0.7 [vs 080703-2]: publish text + multiple non-text media items in just one preview/confirm cycle multi_publish-0.7.1 [vs 080811-1]: publish text + multiple non-text media items in just one preview/confirm cycle
    2008-08-18 boud Attached File- Added 080819_multi_publish-0.7.patch, #16313
        Summarymulti_publish-0.6.3 [vs 080703-2]: publish text + multiple non-text media items in just one preview/confirm cycle multi_publish-0.7 [vs 080703-2]: publish text + multiple non-text media items in just one preview/confirm cycle
    2008-07-22 boud Attached File- Added 080722_multi_publish-0.6.3.patch, #16174
        Summarymulti_publish-0.6.2 [vs 080703-2]: publish text + multiple non-text media items in just one preview/confirm cycle multi_publish-0.6.3 [vs 080703-2]: publish text + multiple non-text media items in just one preview/confirm cycle
    2008-07-22 boud Dependencies- bugs #20710 is dependent
    2008-07-22 boud Attached File- Added 080722_multi_publish-0.6.2.patch, #16173
        Summarymulti_publish-0.6.1 [vs 080703-2]: publish text + multiple non-text media items in just one preview/confirm cycle multi_publish-0.6.2 [vs 080703-2]: publish text + multiple non-text media items in just one preview/confirm cycle
    2008-07-22 boud Attached File- Added 080722_multi_publish-0.6.1.patch, #16172
        Summarymulti_publish-0.6 [vs 080703-2]: publish text + multiple non-text media items in just one preview/confirm cycle multi_publish-0.6.1 [vs 080703-2]: publish text + multiple non-text media items in just one preview/confirm cycle
    2008-07-22 boud Attached File- Added 080722_multi_publish-0.6.patch, #16171
        Summarymulti_publish-0.5: publish text + multiple non-text media items in just one preview/confirm cycle multi_publish-0.6 [vs 080703-2]: publish text + multiple non-text media items in just one preview/confirm cycle
    2008-06-22 boud Attached File- Added 080622_multi_publish-0.5, #15907
        Summarymulti_publish-0.4.1: publish text + multiple non-text media items in just one preview/confirm cycle multi_publish-0.5: publish text + multiple non-text media items in just one preview/confirm cycle
    2007-10-10 boud Attached File- Added 071009_multipublish_taintedbug.patch, #14129
        Summarymulti_publish-0.4: publish text + multiple non-text media items in just one preview/confirm cycle multi_publish-0.4.1: publish text + multiple non-text media items in just one preview/confirm cycle
    2007-08-24 boud Attached File- Added 070824_multi_publish-0.4_vs_070818, #13780
        Summarymulti_publish-0.3: publish text + multiple non-text media items in just one preview/confirm cycle multi_publish-0.4: publish text + multiple non-text media items in just one preview/confirm cycle
    2007-08-10 boud Attached File- Added 070810_multi_publish-0.3, #13644
        Summarymulti_publish-0.2: publish text + multiple non-text media items in just one preview/confirm cycle multi_publish-0.3: publish text + multiple non-text media items in just one preview/confirm cycle

    Back to the top

    Powered by Savane 3.13-758e.
    Corresponding source code