Forum OpenACS Development: oops. cvs allows anonymous tagging

Posted by Chris Johnson on 07/21/03 09:05 AM

Yes. So after I went to tag my local copy to my local cvsroot of lars-blogger before upgrading to 0.9.2 from an early-June checkout, I figured out that I had just tagged the real openacs.org repository. Sorry.


cvs log lars-blogger.info 

...

symbolic names:

pre_0_9_2_upgrade: 1.8.2.8 

oacs-4-6-3-final: 1.8.2.7

Nice!

more CVS/Root 
:pserver:anonymous@openacs.org:/cvsroot

So apparently anonymous pserver users can tag an arbitrary repository. I knew that pserver was no security admin's friend, but this is ridiculous (maybe you'll agree).

I just wanted to fyi all. Can I get commit privs now?

{seriously}
I have a < 10 file fix for context_bar to make a site far more easily css-aware by only changing the default-master and index.adp that I'd like to commit... As it stands, there are about that many pages that have messed-up context_bar properties that will bust a nice css impl.
{/seriously}

2: Re: oops. cvs allows anonymous tagging (response to 1)

Posted by Roberto Mello on 07/21/03 04:27 PM

Hmmm, that sucks. Does anyone know how to fix it? Thanks for the heads up Chris. In the mean time, please no more tagging around unless you (plural) are authorized to do so

Re: Your context_bar fix, is it somewhere that we can look at? You could (and should) post it as a bug+patch at the bug-tracker (http://openacs.org/bugtracker/openacs) and then post the URL for the bug here.

-Roberto

3: Re: oops. cvs allows anonymous tagging (response to 1)

Posted by Don Baccus on 07/22/03 02:44 AM

Chris, unfortunately Lars is on vacation and Jeff Davis is leaving on vacation in a week or so. They've both been working on css and master template issues including the context_bar property so before adding any change I'd like to see them have a chance to take a look ...

You might e-mail Jeff ASAP (look under "Community" and click the link to the site member directory to find his e-mail address) and ask him to look at your code.

If you get review I don't mind letting you commit the changes directly ...

4: Re: oops. cvs allows anonymous tagging (response to 1)

Posted by Chris Johnson on 07/22/03 04:17 AM

I'll post a bug with patches a little later tonight when I get a free moment. My changes are minimal; it's good to hear that others are working on a more thorough rework of the css-awareness of the system.

Back to tags: apm is so nice and integrated in the system--how can I help to take that last step of decoupling the release of packages from kernel releases? We already have these nice habits of updating version numbers in the package.info files and data model migration scripts. Couldn't we add:

1. tagging with per-package version name on package boundaries
2. pulling a tagged release out of cvs (or at least a tarball of the release) and placing on wget-accessible web page?

I'd like to help however I can in this; but not being a cvs'er nor a package maintainer, the most I can do at this point is cheerlead. For final inspiration, check out the community-contributed packages ("blocks", "modules", "themes", etc.) listed (as a db query) on the front page of postnuke:
http://www.postnuke.com/

5: Re: oops. cvs allows anonymous tagging (response to 1)

Posted by Chris Johnson on 07/22/03 09:47 AM

Hmm.. adding patch at this time of night is proving to take too long.

Can I search to see if there are previously entered duplicate bugs or patches? Can I upload multiple patches to one bug?

This is tedious for the payoff. Let me describe what I did, and I will upload a patch for each file tomorrow. Time for sleep.

From my text file as I was making changes:

to fully css my site:


 edit www/index.adp, default-master.adp, and add default.css
 edit packages/acs-subsite/www/register/index.adp, change <a href> to use class="site_nav" 
 edit acs-tcl/tcl/navigation-procs.tcl, add class="site_nav" to its <a href> in function ad_context_bar_html 
 in packages/acs-subsite/www/register/index.adp, bad-password.adp, deleted-user.adp, explain-persisten-cookies.adp, 
packages/acs-subsite/www/user/basic-info-update.adp, password-update.adp
remove <property name="context_bar">'to <a href="/">@system_name@</a></property>

The basic idea is that a bunch of adp's substitute something silly for the context_bar property; and I just blew those away (and tested! result is *much* better!). Then I added a class="site_nav" to the hard-coded nav link function, and lastly the user should add the .css file with the a.site_nav{} in it at least... That will take care of the context_bar at least.

Sadly, it is not a general solution. But for anyone that wants a quick and clean hack, I guess that's what this is.

6: Re: oops. cvs allows anonymous tagging (response to 1)

Posted by Don Baccus on 07/24/03 12:25 AM

As far as #4 goes, we don't want to replace the context_bar property with a hardwired reference to "/". For one thing the breadcrumb needs to include parent subsites rather than just the main subsite. Also the reason for making context bars a property passed to the master template is that not all sites want to use breadcrumb navigation. For instance it's not uncommon for clients to spec custom navigation using javascript dropdown menus or the like and to supress breadcrumbs ...

7: Re: oops. cvs allows anonymous tagging (response to 5)

Posted by Jeff Davis on 07/24/03 12:44 AM

It would probably be better to say something like
<div id="context"><a href=...> ... </div>
so that you could suppress the context bar entirely in css
via #context {display: none} and could style the a's via
#context a { }.

Ideally we would change context to be a <ul> and do that
fancy inline list stuff so the whole thing could be styled via
css.

8: Re: oops. cvs allows anonymous tagging (response to 1)

Posted by Chris Johnson on 07/24/03 06:38 AM

Agreed with both Don and Jeff.

Don, I assume that you are agreeing with me when I advocate the removal of the hard-coded "/" context_bar property. My goal was to beautify, but you made a good point that the hardcoded "/" in the existing implementation can subvert efforts at using subsite and other features properly; thus, my desire to fix it ;)

Jeff, that enhancement is getting even closer to general and may be sufficient for the toolkit (it is for my current needs). It is certainly better than current code, and it could even be mentioned in a nice, concise little write up on customizing the css of Your First OpenACS Site by tweaking the example #context {} .

Cool!

Jeff, is there some sweeping change coming that would make these small enhancements for css irrelevant, or is this something that is worth committing?
I will give the div-context method an implementation if I have a chance... Is the openacs bug tracker the next step?

9: Re: oops. cvs allows anonymous tagging (response to 1)

Posted by Don Baccus on 07/26/03 01:02 AM

Bugtracker or negotiate with Jeff for him to either commit your changes for you or give you commit rights ...

How well does Netscape 4.7 handle the div .css trick you guys are mentioning?