security

created on Thu, 2007-04-05 15:29It's been a while since I helped organize a reverse bounty. On the auction block is some great functionality that is likely going to make it's way into Drupal 6, but is super useful for:

• high traffic sites
• ISPs / mass hosting
• enterprise deployments
• people that like having their website instant message them

Today, the watchdog table logs regular system events (e.g. users logging in, creating new accounts, or posting content) as well as error conditions and other explanatory notes. On a high traffic site, the watchdog table must be pruned on a regular basis so that the database table doesn't grow wildly out of control. There is also no way to archive this information.

Enter Khalid's (2bits.com) patch for Drupal 6: instead of only logging to the database, the patch will enable the destination of logging to be configurable. Raw text file, syslog, and email logging are all modules that have been implemented as proof of concept using this new system.

But seeing this, many of us immediately wanted this functionality for Drupal 5. Much like Bryght's system included free tagging of categories and configurable RSS feed support in our hosted 4.6 version, functions in future versions of Drupal can be backported. That's what this reverse bounty is for – we've spoken with Khalid, and he's willing to make this functionality available via a patch to Drupal 5, including the porting of the support modules such as syslog and email notification. How can you help? Well, we're gathering funds using ChipIn -- click on the Flash widget below to contribute. If you really want to help promote, grab the ChipIn widget and post it on your own blog or website.

created on Mon, 2005-08-15 16:33

Those of you who follow the news from the Drupal project (the software on which Bryght is based) will have noticed several recent security-related releases. One of the benefits of being a Bryght customer is that these updates are applied automatically - as part of our offering. For instance, the latest security patch (announced here this morning) has already been applied and rolled out to our entire customer base.

We're very involved with the Drupal security team, and will continue to keep on top of all security related issues within the community.

If you think you've found an issue, you can contact us directly.