Javod's Blog

Auditing a Drupal Core Install

Thu, 17 May 2012 16:00:54 -0700

Determine current version of Drupal being used
Downloading Clean Drupal Core
Running an initial diff (show the difference) between the two
Run a detailed diff on individual files

Determine Current Version of Drupal being used

There are multiple ways to check what version of Drupal is being used.

Your best bet is to visit one of the admin status report pages as listed below:

Drupal 6/7: /admin/reports/status

Drupal 5 : /admin/logs/status

Finally, you can take a look at the CHANGELOG.txt file located in the main directory of the Drupal install. (This method is prone to error, so use only if you are having trouble finding it elsewhere).

Downloading Clean Drupal Core

Our next step is to download a clean copy of the Drupal core install that matches our version.

Thankfully, Drupal.org has set up a release page where you can download any version of Drupal all the way back to 4.7.0!

Simply select the branch you wish to download from, and then download the correct zip or tar.gz file from that branch!

If you're familiar with Drupal's Git process, you can also checkout a copy:

git clone http://git.drupal.org/project/drupal.git mydir 
cd mydir 
git checkout -b local 6.20

If, for some unholy reason, you need a copy of a release prior to 4.7, versions 2-3 are avaiable at Natrak.net. This is not an official release channel, so download at your own discretion.

Running an initial diff (show the difference) between the two

(Assume that there are two folders drupal is the clean core, and myfolder is the version we suspect has changes.)

You can use any diff tool you like, I personally prefer to use the command line for finding the initial differences between the two.

Here's what I use:

// this will dump a txt file that lists the differences between the two files
diff -qr drupal myfolder | sort > diffs.txt

// if you want to ignore a set of files, you can pipe it through grep. 
// In this case, I'm ignoring the .DS_Store file that macs tend to dump in every folder.
diff -qr drupal myfolder | grep -v -e 'DS_Store' | sort > diffs.txt

The preceding command will produce a diffs.txt file that will display any differences between the two. Below is an example of what this might look like.

Files drupal/.htaccess and mydir/.htaccess differ
Files drupal/includes/common.inc and mydir/includes/common.inc differ
Files drupal/index.php and mydir/index.php differ

Only in mydir/profiles: technology
Only in mydir: phpMyAdmin

From our diffs.txt file we have quickly learned that yes, there have been changes to the core install, and in addition to the changes, there is a phpMyAdmin installation in our current Drupal directory. At this point you should run a diff on each individual file that shows a difference.

Run a detailed diff on individual files

While you can continue to use the diff command, at this point I would recommend using a GUI diff tool. I like FileMerge, so that's what I'll be using.

Let's compare the common.inc files and see what we get:

Here we can see that someone has placed a redirect instruction in a 404 function.

Now, as part of our audit, we need to figure out why this was done, and how we can extract this code (either by creating a module, or finding a module that can redirect 404 requests). In this instance, we had a fairly simple change, but sometimes you may come across multiple large chagnes to the core. You must be diligent in discovering what the intent of the changes are, and on how to replicate those changes in a Drupal approved fashion.

Happy hunting!

How to bootstrap Drupal

Tue, 01 May 2012 13:20:00 -0700

Create a page outside of the CMS workflow that has access to Drupal's built-in functions.

There are scenarios, the deeper you get into Drupal, where you will need to access Drupal's database and functions, but outside of the scope of the CMS. For instance, you may need to create an AJAX callback that hooks into the database for a TinyMCE plugin, or you may be looking for ways to port over a custom CMS to Drupal� These are just a couple of reasons for having an easy way to hook into Drupal at the base level.

And like with everything Drupal, there is a Drupal function for this:
drupal_bootstrap($phase = NULL, $new_phase = TRUE)

Before we show how to use this function in code, let's break it down a little.

$phase

Phase is a predefined constant that identifies which phase of Drupal to load. As the docs state "each phase adds to the previous one, so invoking a later phase automatically rums the earlier phases as well."

The constants available for the $phase variable (in order) are:

DRUPAL_BOOTSTRAP_CONFIGURATION
Sets up the script environment and loads settings.php

DRUPAL_BOOTSTRAP_PAGE_CACHE
Attempts to serve a page from the cache

DRUPAL_BOOTSTRAP_DATABASE
Initializes the database system and registers autoload functions

DRUPAL_BOOTSTRAP_VARIABLES
Loads system variables and all enabled bootstrap modules

DRUPAL_BOOTSTRAP_SESSION
Initialize session handling

DRUPAL_BOOTSTRAP_PAGE_HEADER
Invokes hook_boot(), initializes locking system, and sends HTTP headers

DRUPAL_BOOTSTRAP_LANGUAGE
Finds the language of the page

DRUPAL_BOOTSTRAP_FULL
Drupal is fully loaded; validate and fix input data.

Remember, calling any of the phases automatically will load any preceding phases as well.

$new_phase

TRUE declares that drupal_boostrap() will run recursively, loading all previous phases up to the one we have chosen.

Now that we have the basics of the function out of the way, let's see how we can implement it.

Create a custom page called test.php and insert the code below:

    // Get path of drupal install. 
    $drupal_path = $_SERVER['DOCUMENT_ROOT'];
    
    // Create a constant DRUPAL_ROOT that defines 
    // our path to the drupal install	
    define('DRUPAL_ROOT', $drupal_path);
    
    // We need to load the bootstrap.inc file so we can 
    // have access to the drupal_bootsrap() function
    require_once DRUPAL_ROOT . '/includes/bootstrap.inc';
    
    // Bootstrap Drupal at the phase that you need
    drupal_bootstrap(DRUPAL_BOOTSTRAP_FULL);
    
    // Our custom page now has access to functions such as node_load() and db_query()  
    $node = node_load(1);

(As a side note, if all you need is to query the database, then setting your phase to DRUPAL_BOOTSTRAP_DATABASE will be much less costly in terms of load time).

That is basically all you need to tie Drupal into any custom page!

Drupal 7 - Usage of Foreign Keys in Schema API and current default FK ERD

Thu, 12 Apr 2012 10:20:00 -0700

What are Foreign Keys?
What is the Schema API?
Why Drupal only supports FK by documentation and not practice.
Current mappings with an ERD.

What are Foreign Keys?

Foreign keys, put simply, are a referential constraint between two tables on a relational database. What this means is that data from one table is dependent on data from another table, and can not exist without it. This is a constraint placed directly on the database.

For example: let's say we have two tables, USERS and PRODUCTS. If in our setup we know that under every circumstance a product will be assigned to a user, we can add a foreign key to a column in PRODUCTS that relates back to USERS. If we then try to add a product without having a user assigned to it, the query will fail. This helps force the integrity of data.

When using MySQL I should note that the ISAM engine does not understand foreign keys, however InnoDB does.

What is the Schema API?

The Schema API is an array structure that defines one or more tables.

This is implemented via the hook_schema() function, usually in the myModule.install file. Let's take a look at a very simple implementation:

function myModule_schema() {
  $schema['myTable'] = array(
    'description' => 'A description of my table.',
    'fields' => array(
      'id' => array(
        'description' => 'The id auto incrementing id of this table 
                      (type => serial designates as auto incrementing).',
        'type' => 'serial',
        'unsigned' => TRUE,
        'not null' => TRUE,
      ),
      'items' => array(
        'description' => "The number of whatever in this table.",
        'type' => 'int',
        'unsigned' => TRUE,
        'not null' => TRUE,
        'default' => 0,
      ),
      'decribe' => array(
        'description' => 'This column, describe, is to store descriptions.',
        'type' => 'varchar',
        'length' => 255,
        'not null' => TRUE,
        'default' => '',
      ),
     ),
    'primary key' => array('id'),
    'foreign keys' => array(
      'fk_name_node' => array(
        'table' => 'node',
        'columns' => array('id' => 'nid'),
      ),
     ),
  );
}

Right now let's concentrate on the way foreign keys are setup through the Schema API.

We first create an array called foreign keys.

'foreign keys' => array(

We now give our foreign key an identifying name.

'fk_name_node' => array(

Next we designate which table will be our reference, in this case the 'node' table.

'table' => 'node',

Finally we assign the foreign key column relations from our table to the constraining table.

'columns' => array('id' => 'nid'), ),

Why Drupal only supports FK by documentation and not practice.

So now that we know this what can we do? Well, currently Drupal only supports Foreign Keys as a documentation feature. Even when you've defined it in your schema, it will not actually implement the constraints on the database. So what's the point? Well for one, it helps those writing contributing modules to quickly see what tables are a required reference, but secondly, it is slowly preparing Drupal to actually add Foreign Keys. We might see this in Drupal 8, but probably not until a later release. Still, it's a good idea to implement this feature in your schemas, and those working on core are doing it in theirs.

Current mappings with an ERD.

I took a look over the default install of Drupal 7, and grabbed all the schemas with foreign keys. Then I created an Entity Relationship Diagram (ERD) with ONLY those tables that had foreign key constraints. Click the image below for the full size pdf. This isn't every table that exists on default install, just those that had a foreign key constraint written into its schema.

Drupal 6: Add/Remove field values from a Node Reference in a Content Type

Wed, 15 Feb 2012 17:20:00 -0700

Drupal 6: When creating a Content Type, one of your options is to create a field with a type: 'Node reference'. Node references are a bit different than normal fields, in that they use other Content Type's values to populate the field values.

This difference leads to some issues when trying to alter the Node Reference field on a Content Type form. What ends up happening, is that we do not have the ability to add/remove/alter values using the hook_form_alter() function directly. We end up needing a helper function for this. The code below is based on a select field:

function myModule_form_alter(&$form, &$form_state){
    if (arg(0) == 'node' && $form['form_id']['#value'] == 'myContentType_node_form') {
        // Replace our node reference field with the options we want using our helper
        $form['field_location']['#pre_render'] = array('helper_change_options');
    }
}


function helper_change_options($element) {
    $our_new_options = array(�key�=>�value�, �key2�=>�value2�);  
        
    // insert our new values into the element (which is a select field, options)
    $element ['nid']['nid']['#options'] = $our_new_options;
    return $element; 
}

Please note that whatever options you change or add, those node key values DO need to exist in the Node Reference�s Content Type. Otherwise you are going to run into some problems.

How to add your personal private/protected Twitter account to Drupal

Wed, 28 Dec 2011 13:02:30 -0700

(Note: In this post I use the terms private and protected interchangeably.)

There are times you may want to have your protected Tweets available on your site. Perhaps protected Tweets are available to your members but not necessarily the world at large. Non-private accounts are easy enough to pull: These feeds are easily accessible using the Rest API.

However, to access protected accounts we must create a Drupal module that authenticates through OAuth. Let's go through this process step by step.

1) First, in Drupal, create a new Content Type.

Name: Tweet
Type: tweet
Description: This content type pulls our protected tweets from our twitter account.

2) Next, we need to create a twitter app:

a) Go to dev.twitter.com
b) Sign in using the protected twitter account you will be using.

c) Click on Create an app.

d) Fill in your app info, agree to the TOS, and submit.

e) Go to the details tab for your newly created app and make note of the highlighted fields below. (Consumer Key, Consumer Secret, Access Token, Access Secret.)

3) Now we need a way to authenticate our app with our soon to be created module. We must use the OAuth method, and we have the option of writing our own OAuth validator, or using the wonderful Twitter with OAuth class which does 99% of the work for us (As of this post the current version is 2.1.2). The rest of this tutorial assumes you have downloaded the class, but if you're a purist and want to write your own, have at it!

4) Unzip the downloaded file and inside should be a file named 'twitter.php'. We will include this file in our module.

5) Now we will create our module. Inside your Drupal's modules folder, create a new folder called 'twitter_private'.

6) Inside this new folder create two files: 'twitter_private.info' and 'twitter_private.module' files.

7) Make sure to drop the 'twitter.php' file into the 'twitter_private' folder as well. You should now have three files in the folder.

8) Your info file should look something like this:

; $Id$
name = Private Twitter App 
description = Retrieves @myaccount tweets for inclusion in site.
core = 6.x

9) Your module file should look something like this (Replace all ALL-CAPS variables with your info):

// We're creating a cron hook that will check the tweets. 
// This will check every time you have a cron job set to run.

function twitter_pivate_cron(){ 
    // require the twitter class
    require_once 'twitter.php';
    
    // create instance MAKE SURE to replace the Consumer key 
    // and Consumer Secret with your settings
    $twitter = new Twitter('CONSUMER_KEY', 'CONSUMER_SECRET');
    
    // set tokens MAKE SURE to replace token and secret with your settings
    $twitter->setOAuthToken('ACCESS_TOKEN');
    $twitter->setOAuthTokenSecret('ACCESS_SECRET');
    
    // get users timeline, $count being the number of tweets to retrieve 
    // MAKE SURE to replace the screenName with your Twitter account name 
    //(do not include @ symbol)

    $response = $twitter->statusesUserTimeline($userId = null, 
                          $screenName = 'YOUR_TWITTER_ACCOUNT_NAME', 
                          $sinceId = null, 
                          $maxId = null, 
                          $count = 10, 
                          $page = null, 
                          $trimUser = false, 
                          $includeRts = false, 
                          $includeEntities = false);
    
    
    // Retrieve the 10 most recent tweets in the node table 
    // and place in title array
    $q = db_query("SELECT title FROM node WHERE type='tweet' 
                           ORDER BY nid DESC LIMIT 10");
    while($r = mysql_fetch_assoc($q)){
        $title[] = $r['title'];
    }
    
    // search 10 most recent tweets on twitter 
    // and if it doesn't exist in node table, insert
    foreach($response as $r){
        foreach($r as $k=>$v){
            if($k == 'text'){
                if(!in_array($v, $title)){
                    $node = new stdClass();
                    $node->title = "$v";
                    $node->type = 'tweet';
                    $node->created = time();
                    $node->changed = $node->created;
                    node_save($node);

                }
            }
        }
    }
}

10) Now activate the module in your Drupal admin panel, run the cron manually to get started, and you are all set. Just figure out how you would like to use the tweet content type (you can create a new block, or have it feed into a page, or whatever you'd like)

Using the Firefox Tilt plugin for an unconventional purpose

Tue, 06 Dec 2011 12:54:30 -0700

Tilt is self described as a "Firefox extension focused on creating a 3D visualization of a webpage, drawn using WebGL. Since the DOM is essentially a tree-like representation of a document, this tool layers each node based on the nesting in the tree, creating stacks of elements, each having a corresponding depth and being textured according to the webpage rendering."

The plugin is pretty amazing, and it does help find nested elements very quickly, however there is a novelty to it that seems to wear out after "tilting" a few websites.

After playing with Tilt, it occurred to me that there was potential for 3D modeling that could be added to a website.

The website above is a very simple example of how one might go about this. I thought it would be neat to have a page about a famous skyscraper, and when the Tilt plugin was applied, the actual skyscraper would be built.

I've done the calculations to make sure that the skyscraper is indeed to scale, so if you are viewing it you will have to zoom out all the way to get a good view. A cool little side-project, and a fun easter-egg.

I don't know how practical this would be for real modeling, but I could see how an architectural firm might use this technique as a simple "wow" factor in a pitch.

Drupal 6: Running Batch via Cron

Wed, 11 Nov 2011 18:52:30 -0700

Looking through the Drupal documentation, a person is led to believe that automating a Batch script is tantamount to moving Mount Fuji 10 feet to the left with a wooden spoon. The general consensus seems to be that all Batch scripts should be converted to use the Queue API. Sometimes this is an acceptable solution, but when you're running a very large script that makes extensive use of the Batch $context variable, it becomes a daunting task.

The big issue (or at least the issue I ran into) with Batch and cron, is that the Batch API was really written to be used in conjunction with the browser, so there are calls made to update the progress bar that just don�t jive when running in cron.

The solution that worked for me was a bit of a hack, but only a small one. If we look over the batch_process() documentation, there�s a telling bit of information: "Unless the batch has been marked with 'progressive' = FALSE, the function issues a drupal_goto and thus ends page execution." That sounded positive, and from what I could tell it bypasses the progress bar and executes the batch in one pass.

Now the problem is that even though we are given this information, there�s no parameter to change this variable. It looks like an oversight by the developers. Instead of hacking the core though, what we can do is create a reference to batch_get and turn off the progressive option.

// create a reference to batch_get()
// this is called directly in the core batch_process() function
$batch =& batch_get();
// Using the reference, we turn progressive off
// which prevents the redirect to the standard Batch API progress bar
$batch['progressive'] = FALSE;
// Because we are not using the form to trigger the batch, we run batch_process('')
batch_process('');

So let�s take a look at how this would work:

hook_cron(){
    hook_my_function();
}
hook_my_function(){
    batch_set(array(
      'title' => My Title',
      'operations' => array(
        array(�hook_another_function_to_run�, array($info))
      ),
      'progress_message' => 'Processing...',
    ));
   
    $batch =& batch_get();
    $batch['progressive'] = FALSE;
    batch_process('');
}

Now there may be some issues with this implementation that I am unaware of, but I am running a rather large Batch script and have yet to come across any.

Hope this helps someone!

jQuery: Disable right click and drag on images

Wed, 17 Nov 2010 10:46:31 -0700

Sometimes you get a client that just wants to do what they want to do no matter the reasons they shouldn't.

In the case of disabling right click the short answer is: Don't.

The long answer is there is no way to prevent someone from taking images off your site. You can slightly thwart users, but it is against the very principles of the way the internet works, and is considered bad practice. Typically only websites that are either unprofessional or shady use these techniques.

Now, with that, sometimes you'll get a person who says, "just do it anyway." So here is some jQuery to make this an easy job for you.

Dante's Theme - Piano Cover FMA

Sun, 24 Oct 2010 11:08:34 -0700

Something a little different: A video of me playing Dante's Theme from Fullmetal Alchemist.

zeroclipboard: Get javascript events firing after AJAX request

Tue, 25 May 2010 21:08:54 -0700

An interesting problem I came across recently was trying to get Zero Clipboard to work in an AJAX loaded div. Zero Clipboard is pretty much the only way to copy text to the user's clipboard that works across browsers. There is no native way to do this, so it floats an invisible movie on top of a DOM element. Yes, your users need to have Flash installed for this to work.

The issue is as follows:

We need zeroclipboard available on a page that is loaded via ajax inside a div.
Javascript events are not bound in an ajax call unless specifically loaded by an onclick, onload etc...
The scripts themselves need to exist outside of the ajax loaded page to be loaded during page load.

At the time of this writing zeroclipboard is on version 1.0.7

As the documentation notes, the ZeroClipboard.swf file by default is sought for in the same directory as the webpage, and this tutorial assumes that it is.

Let's say we have two pages: index.html and ajaxload.html

The default example for zeroclipboard:

<html>
	<head>
		<style type="text/css">
			#d_clip_button {
				text-align:center; 
				border:1px solid black; 
				background-color:#ccc; 
				margin:10px; padding:10px; 
			}
			#d_clip_button.hover { background-color:#eee; }
			#d_clip_button.active { background-color:#aaa; }
		</style>
	</head>
	<body>
		<script type="text/javascript" src="ZeroClipboard.js"></script>
                
		Copy to Clipboard: <input type="text" id="clip_text" size="40" value="Copy me!"/>
        
		<div id="d_clip_button">Copy To Clipboard</div>
        
		<script language="JavaScript">
			var clip = new ZeroClipboard.Client();
                        
			clip.setText( '' ); // will be set later on mouseDown
			clip.setHandCursor( true );
			clip.setCSSEffects( true );
                        
			clip.addEventListener( 'load', function(client) {
				// alert( "movie is loaded" );
			} );
                        
			clip.addEventListener( 'complete', function(client, text) {
				alert("Copied text to clipboard: " + text );
			} );
                        
			clip.addEventListener( 'mouseOver', function(client) {
				// alert("mouse over"); 
			} );
                        
			clip.addEventListener( 'mouseOut', function(client) { 
				// alert("mouse out"); 
			} );
                        
			clip.addEventListener( 'mouseDown', function(client) { 
				// set text to copy here
				clip.setText( document.getElementById('clip_text').value );
                                
				// alert("mouse down"); 
			} );
                        
			clip.addEventListener( 'mouseUp', function(client) { 
				// alert("mouse up"); 
			} );
                        
			clip.glue( 'd_clip_button' );
		</script>
	</body>
</html>

For our purposes we're going to make a couple of changes.
index.html:

<html>
	<head>
		<style type="text/css">
			#d_clip_button {
				text-align:center; 
				border:1px solid black; 
				background-color:#ccc; 
				margin:10px; padding:10px; 
			}
			#d_clip_button.hover { background-color:#eee; }
			#d_clip_button.active { background-color:#aaa; }
		</style>

       <!-- We're moving the main javascript file to the head section -->
       <script type="text/javascript" src="ZeroClipboard.js"></script>
		<!-- We're also taking the following code and wrapping it in a function to call later -->
		<script language="JavaScript">
		function clipit(){
			var clip = new ZeroClipboard.Client();
                        
			clip.setText( '' ); // will be set later on mouseDown
			clip.setHandCursor( true );
			clip.setCSSEffects( true );
                        
			clip.addEventListener( 'load', function(client) {
				// alert( "movie is loaded" );
			} );
                        
			clip.addEventListener( 'complete', function(client, text) {
				alert("Copied text to clipboard: " + text );
			} );
                        
			clip.addEventListener( 'mouseOver', function(client) {
				// alert("mouse over"); 
			} );
                        
			clip.addEventListener( 'mouseOut', function(client) { 
				// alert("mouse out"); 
			} );
                        
			clip.addEventListener( 'mouseDown', function(client) { 
				// set text to copy here
				clip.setText( document.getElementById('clip_text').value );
                                
				// alert("mouse down"); 
			} );
                        
			clip.addEventListener( 'mouseUp', function(client) { 
				// alert("mouse up"); 
			} );
                        
			clip.glue( 'd_clip_button' );
		}
		</script>

	</head>
	<body>
		<!-- We're adding the div where we will load our ajax file -->
		<div id="loadPageHere"></div>	
	</body>
</html>

ajaxload.html:

Copy to Clipboard: <input type="text" id="clip_text" size="40" value="Copy me!"/>
<div id="d_clip_button">Copy To Clipboard</div>

<!-- Here's the tricky part -->
<!-- We need to load our function after the ajax call, but we can't use a body tag, and divs don't allow the onload attribute -->
<!-- The hack here is to use a 1px x 1px image  and use the onload function available in the img tag to load our function -->
<img src="blank.gif" onload="clipit();" />

So that's the way to use zeroclipboard in an AJAX call. Please note that I did not include the ajax code that actually loads ajaxload.php in the index's div. I assume if you're having this problem you've probably already come that far. If you do need help with that though, just ask!

If you have any questions, problems or suggestions feel free to leave a comment.