Read the manual for pg_escape_string: "Use of this function is recommended instead of addslashes()." Or read sqlite_escape_string: "addslashes() should NOT be used to quote your strings for SQLite queries; it will lead to strange results when retrieving your data."
That should improve performance of session handling as well improve
performance of the "Who's online"-block. Drupal.org's sessions table
contains appr. 40.000 sessions on a slow day and rendering the "Who's
online"-block became a performance bottleneck.
This change has yet to be tested on a busy site so things might go wrong.
The primary goal of this patch is to take the 'custom' and 'path' columns of the block overview page and make them into something understandable. As of Drupal 4.5 'custom' lacked an explanation which wasn't buried in help text and path required dealing with regular expressions.
Every block now has a configuration page to control these options. This gives more space to make form controls which do not require a lengthy explanation. This page also gives modules a chance to put their block configuration options in a place that makes sense using new operations in the block hook.
The only required changes to modules implementing hook_block() is to be careful about what is returned. Do not return anything if $op is not 'list' or 'view'. Once this change is made, modules will still be compatible with Drupal 4.5. Required changes to core modules are included in this path.
An additional optional change to modules is to implement the additional $op options added. 'configure' should return a string containing the configuration form for the block with the appropriate $delta. 'configure save' will come with an additional $edit argument, which will contain the submitted form data for saving. These changes to core modules are also included in this patch.
1) Clean up the text analyser: make it handle UTF-8 and all sorts of characters. The word splitter now does intelligent splitting into words and supports all Unicode characters. It has smart handling of acronyms, URLs, dates, ...
2) It now indexes the filtered output, which means it can take advantage of HTML tags. Meaningful tags (headers, strong, em, ...) are analysed and used to boost certain words scores. This has the side-effect of allowing the indexing of PHP nodes.
3) Link analyser for node links. The HTML analyser also checks for links. If they point to a node on the current site (handles path aliases) then the link's words are counted as part of the target node. This helps bring out commonly linked FAQs and answers to the top of the results.
4) Index comments along with the node. This means that the search can make a difference between a single node/comment about 'X' and a whole thread about 'X'. It also makes the search results much shorter and more relevant (before this patch, comments were even shown first).
5) We now keep track of total counts as well as a per item count for a word. This allows us to divide the word score by the total before adding up the scores for different words, and automatically makes noisewords have less influence than rare words. This dramatically improves the relevancy of multiword searches. This also makes the disadvantage of now using OR searching instead of AND searching less problematic.
6) Includes support for text preprocessors through a hook. This is required to index Chinese and Japanese, because these languages do not use spaces between words. An external utility can be used to split these into words through a simple wrapper module. Other uses could be spell checking (although it would have no UI).
7) Indexing is now regulated: only a certain amount of items will be indexed per cron run. This prevents PHP from running out of memory or timing out. This also makes the reindexing required for this patch automatic. I also added an index coverage estimate to the search admin screen.
8) Code cleanup! Moved all the search stuff from common.inc into search.module, rewired some hooks and simplified the functions used. The search form and results now also use valid XHTML and form_ functions. The search admin was moved from search/configure to admin/search for consistency.
9) Improved search output: we also show much more info per item: date, author, node type, amount of comments and a cool dynamic excerpt à la Google. The search form is now much more simpler and the help is only displayed as tips when no search results are found.
10) By moving all search logic to SQL, I was able to add a pager to the search results. This improves usability and performance dramatically.
+ Drupal 4.4 stored profile data in the serialized user->data column. Drupal 4.5 stores profile data in tables (but user->data is still available and used for other stuff, like locale or themes). The update from 4.4 to 4.5 didn't remove the old data from the user->data column properly, because there is no mechanism in user_save to do so (it did try to unset the fields, but this has no effect).
+ On registration, hook_user('insert') is invoked after saving the data column. This means that any module-specific data is put into the data field. We cannot move hook_user('insert') higher up, because before that point, we do not have a complete $user object yet.
Upload.module
- Fixing a bug caused by the PHP5 patches.
Beware: PHP4's array_merge() will silently accept objects and convert them to arrays. We should not depend on this behaviour in the future.
File.inc / file-using modules:
- Removing the constant FILE_SEPARATOR: forward slashes work fine on Windows, and it was being used incorrectly as an URL separator sometimes.
- Adding @ to mkdir and chmod to supress ugly PHP errors. They are already reported with drupal_set_message().
- Fixing default for variable 'file_directory_temp'.
- Clarifying the help tip for 'file_directory_temp' in admin > settings.
- Changing theme('image') so the automatic image size fetching can be toggled independently from attributes. Specifying attributes and autosizing are 2 different things.
- Suppressing PHP errors from getimagesize() using @. drupal_set_message() is used to report these errors already and in a much prettier way.
- #9958: Fixing broken displaying of avatars.
- Don't show the default avatar in 'edit my account' if the user has no avatar of his/her own.
- Added ability to delete avatars (without having to replace them).
* Refactored the "brains" of user_login() to user_authenticate($user, $pass) so that blogapi (and others) can authenticate users (including those using DistAuth) without all the html and drupal_goto calls
* Updates blogapi_validate_user to use user_authenticate.
* Adds missing quotes around the username in "session closed" watchdog messages from user.module (session opened has quotes, but session closed does not).
* Changed "view detals" after watchdog entries to "details".
I had some trouble adding this feature but realized that the "who's online" block is a geek think, and therefore it won't hurt to add some more geekiness. If you don't know what "offline users" means, you would not have understood "online users" in the first place. Either way, I think most people who have the block enabled, will find this an interesting addition.
* The _validate hook and the _nodeapi('validate') hook of the node API (1) no longer take an 'error' parameter and (2) should no longer return an error array. To set an error, call form_set_error().
* The _form hook of the node module no longer takes a form hook and should not worry about displaying errors. Ditto for _nodeapi('form_post') and _nodeapi('form_pre').
$ diffstat user.patch
database/database.mysql | 4
database/database.pgsql | 2
database/updates.inc | 10 -
modules/block.module | 20 +-
modules/locale.module | 9
modules/profile.module | 108 +++++++----
modules/system.module | 8
modules/user.module | 456 +++++++++++++++++++-----------------------------
8 files changed, 289 insertions(+), 328 deletions(-)
More functionality, less code. Here is a list of the changes:
- Some user API changes:
+ When $type is 'form', you have to return an associative array of groups. In turn, each group is an array with a 'title', 'data' and 'weight'.
+ A new $type has been added, namely 'categories'. User settings can be organized in categories. Categories can be sorted, as can the groups within a category. (Ordering 'categories' is somewhat broken due to a bug in the menu system.)
- The 'my account > edit' page will use subtabs for each 'category'. Read: you can break down the account settings into multiple subpages.
- Profile module improvements:
+ Added support for private fields to the profile module!
+ Improved workflow of profile administration pages.
+ Improved the form descriptions.
- Code improvements:
+ Unified user_edit() and user_admin_edit().
+ Unified and cleaned up the validation code. Fixed some validation glitches too.
CHANGES
-------
+ Introduced tabs. First, we extended the menu system to support tabs. Next, a tab was added for every link that was (1) an administrative action other than the implicit 'view' (2) relevant to that particular page only. This is illustrated by the fact that all tabs are verbs and that clicking a page's tab leads you to a subpage of that page.
+ Flattened the administration menu. The tabs helped simplify the navigation menu as I could separate 'actions' from 'navigation'. In addition, I removed the 'administer > configuration'-menu, renamed 'blocks' to 'sidebars' which I hope is a bit more descriptive, and made a couple more changes. Earlier, we already renamed 'taxonomy' to 'categorization' and we move 'statistics' under 'logs'.
+ Grouped settings. All settings have been grouped under 'administer > settings'.
TODO
----
+ Update core themes: only Xtemplate default supports tabs and even those look ugly. Need help.
+ Update contributed modules. The menu() hook changed drastically. Updating your code adhere the new menu() function should be 90% of the work. Moreover, ensure that your modue's admin links are still valid and that URLs to node get updated to the new scheme ('node/view/x' -> 'node/x').
+ Introduced two new functions:
1. form_set_error($name, $message): files an error against the form
element with the specified $name.
2. form_has_errors(): returns true if errors has been filed against
form elements.
+ Updated the form handling:
1. The form_ functions will add 'class="error"' when a form field
has been found to be erroneous.
2. The error message is passed to theme_form_element() when the
particular form field has been found to be erroneous.
+ I updated the user and profile module to take advantage of these new
functions.
+ IMPORTANT: the _user() hook changed. The 'validate' case should no
longer retun an error message when something goes wrong but should
set it with form_set_error().
made it possible to enforce a username/e-mail address. Based on
James Seng's work there are now 3 radio buttons:
( ) Anonymous users may not enter contact information
( ) Anonymous users may leave contact information
( ) Anonymous users must leave contact information
- Fixed a bug in the default theme_comment_view() function.
- Added permalinks for comments. Requested by Michael and Christina.
Maintainers of contributed themes might want to add permalinks too.
TODO:
- Fix the interaction design of the submission form: the page you are
directed to and the validation of the contact information.
- Changing the comment viewing options appears to be broken?
administrators will be able to define a custom 403 page, just as they
can define 404 pages now.
This needs to be documented in the "Changes since / migrating to ..."
pages.
configurable! Menu items can be disabled, repositioned, added and
so on.
Upgrading to requires you to run update.php.
This functionality depricates some of the 'navigation modules' in the
contributions repository. Furthermore, modules can now 'suggest'
menu items and site adminstrators can choose to enable them. Modules
in the contributions repository should try to take advantage of this.
+ Updated the _user() hook's "$type == 'view'" case to match the
"$type == 'edit'" case. That is, both have to return an associtive
array of the format array('category' => 'fields').
+ Updated the profile pages to group fields by category. Made possible
thanks to the above change.
+ Moved logic out of the theme_ functions.
+ Added a 'created' field to the users table and renamed the 'timestamp'
fied to 'changed' (cfr. node table). Update.php will try to determine
a 'created' timestamp for existing users.
+ The profile module no longer uses serialized data but has its own set
of tables. Known existing profile data is migrated by these new tables.
TODO: migrate the birthday field.
+ The profile fields can be grouped, and within each group, profile fields
can be sorted using weights.
+ The profile pages can be themed.
+ The profiles can be browsed based on certain properties/settings.
+ Change the _user hook: (i) 'private_view' and 'public_view' are merged
into 'view' as there are no private fields and (ii) 'edit_form' has
been renamed to 'edit'.
+ Avatar handling has been refactored and is now part of the user module.
The users table has a dedicted 'picture' field.
+ Simplified the way themes should use display/visualize pictures or
avatars.
+ Made it possible for administrators to replace or delete avatars.
+ ...
I hope this make for a good base to build on collectively.
a select statement. Even though PEAR supports this functionality, it fails
silently when using PostgreSQL. We use the db_num_rows() function instead
to return the amount of rows returned. (According to Killes, the MySQL
manual also states that it should not return affected rows on a 'select'
statement.)
+ only adds an optional parameter to url() and l(), so individual links
can be set to be absolute
+ modifies drupal_goto() to accept the parameters of url() without the
$absolute parameter, so cleaner invocations can be used
+ rework of some code in node_feed, making it much better to look at
(the current code uses foreach with an immediate brake to get the first
key of the associative array, geeeeez)
+ added xml:base to the rss tag generated by node_feed()
+ set all user mail URLs to be absolute
+ fix a small fragmented URL in user.module
- Modifies _user_mail_text() to automatically override the default
strings when needed and apply t() on the strings. This lets Drupal translators
include default messages in translations, and also removes a lot of repeated code.
Modified the internal $messageid of the approval message from
welcome_approval_body/subject to approval_body/subject, so automatic variable
name computation can be done. This does not affect any variable table keys, since
the change was especially done to keep the variable names...
- Adds %login_uri and %edit_uri to move away from the concatenation approach used in
the default messages, thus making those messages visible for the .po extractor
- Uses direct return in help text generation when no more action need to be taken
on the help string (the '$output .=' approach was just plain silly looking and
misleading, since there was no preceding or appended string in $output)
+ Tidied up the profile configuration page: grouped form elements.
+ Tidied up the block configuration settings: removed hard-coded
table.
+ Changed the profile API to return the preferred group name, and
changed the user module to group settings. Modules implementing
the _user hook will need to be udpated.
+ Removed register_form and register_validate for now.
containing two elements, the first being the requested title, and the second being
the result list. Advantages:
* Cleaner search code in common.inc
* Po extraction is possible and works fine
* No hardcoded exceptions for node and comment modules, since any module can
return results in order of relevance (or another order)
<div class="user-login-block"> is now inside the <form> instead of the
other way around.
- Simplified the user login block by removing some CSS that was no longer
needed. The block module already emits block-related classes and an id.
tags.
To be discussed and investigated: when a form element has no title an empty
<label> tag will be emitted (eg. "remember me" checkbox). This doesn't make
sense but is our best option for now.
+ removes the lots of pagers and indirect pager themeing
+ add the theme_pager() function, which should be called as
theme("pager", ...) to get a pager.
Contributed themes and modules need to be updated:
- modules: status() is no more; use drupal_set_message() instead.
- themes: use drupal_get_message() to check for status messages and
visualize them.
Phase 2 of the menu system integration project. This unifies the interface
used by admin and non-admin pages, and deprecates the _page hook in favor of
explicit callbacks from menu(). Breadcrumbs, titles, and help text go away
as a result of this patch; they will return in the phase 3 patch, printed
by the theme.
- Optimized user_external_load(), only need to fetch the data once.
- Removed unused functions:
user_get()
user_set()
theme_menu_list()
- Fixed user_validate_name() to not accept \.
- Modified user_validate_name() to use alnum, which varies depending on
the system locale.
- Optimized user_validate_name() to not use unnecessary regular
expressions.
- Optimized user_access() by using less logic to fetch permissions and
cache.
- Removed uncessary logic from user_deny().
- Fixed user_fields() to properly cache $fields.
- Optimized user_set_authmaps() to not perform unnecessary queries.
- Removed return value from user_set_authmaps().
- Improvement: removed a left-over from Drupal 4.2.0 (dead code).
- Improvement: replaced hard-coded XHTML around the XML icons with class="xml-icon".
- Improvement: removed the custom navigation menus shown at the top of the "user information page" and integrated them in the new navigation block. The "my account" link in the navigation menu will unfold. Also removed the "delete account" link/functionality (for now).
- Improvement: fix for "magic quotes" settings. Patch by Steven. I also removed check_php_settings().
- Improvement: block themability improvements. Modified patch from Ax and Steve/CodeMonkeyX.
- Fixed bug #2617: editing user information does not work. Patch by Kjartan.
you logged out. Patch by Jeremy.
- Bugfix: fixed the authmap table in the MSSQL scheme. Patch by Moshe.
- Bugfix: properly themes some error messages in the user module. Patch
by Moshe.
- Fixed bug #3642: removed duplicate settings from user page. Patch #14 by Moshe.
- Fixed bug #3503: added 'forum topic' link to the 'create content' menu. Patch
by Gobar. I think this might be more intuitive and consistent code-wise; I don't
want to introduce small hacks.
- Cache improvement: small cache improvement to prevent SQL errors. Patch by
Jeremy.
- Usability improvements to the user module: removed some redundant menu
items by taking advantage of the column sorting, added status messages
and so on. Patch by Moshe plus some fixes.
- Made the profile module use the table() function. Patch by Moshe.
- Fixed breadcrumb spacing. Patch by Moshe.
- Fixed colspan problem with node overview table. Patch by Stefan.
- Fixed inconsistency with table sorting. Patch 0122 by Al.
TODO: rename user_mail() to drupal_mail() and move it to common.inc.
Other modules, such as the project module, should use this as well
or they risk to send out /invalid/ mails.
called but will be as soon the remaining links have been transformed to use
the menu system.)
- Made sure the menu does not render links with no callback and no children.
Like this, the 'create content' link is not being shown when the user has
no permission to add any content.
1) As explained by Al, there is still a glitch with the 'create content'
menu.
2) The user module part of the patch did not apply due to Kjartan's earlier
patch.
Dries Buytaert
Steven Wittens
Kjartan Mannes