104 replies to this topic

[Soma]

Thanks Nico, this is basicly what I do. Though I got other github url to deal with (though it could be easily changed) but good to know github api.. I actualy also looked at your module when creating my module.

New update 0.0.8
I commited a new update yesterday.

• Added additonal check for "allow_url_fopen" and throw error if not enabled.
• I changed to use copy() instead of curl.
• I tested it locally and on a low budget hosting and a good one, now it works on all without problems (though locally I got permission problems though not relevant).
• I found that using copy or file_get_contents would work better, curl gave me "open_basdir" (low budget shared hosting) error on which would cause problems if not configured correctly on server. So this should be better now. Not sure about other restrictions and limits (size?).
• Also improved the remove function to recusively remove the extracted folder after content is copied, it now also deleted .* files like .htaccess.

If you already got it installed just click "refresh" then "update" the module. Oh and let me know if any issues arises.

Edit: Heh, just refreshed and new categories and modules pop up! Love it.

[Pete]

Cheers for the update Soma - changing from curl to copy() fixed it so that it will now download files on a default installation of XAMPP.

Before that it was erroring as I don't think CURL is turned on by default in XAMPP, so whilst it's easy to change the PHP.ini file it's also great that it now works out of the box

[ceberlin]

Hi,
isn't allow_url_fopen a big security risk, if enabled? My povider suggests not to use that.
Is there an alternative?

For me, it would be good enough, if I would (like Drupal) receive an email, if modules, which I use, have updates, and an emergency email, if the module update is fixing a security bug. The cron would check that for me. (Or do we have that already and I had just screwed up my setup?)

[Soma]

Hi ceberlin, thank for your post.

Do they have cURL enabled? We could then implement to use it if allow_url_fopen is disabled. I think in case this doesn't work out it could be a simple download link to download and intall it manually.

[ryan]

isn't allow_url_fopen a big security risk, if enabled? My povider suggests not to use that.

I'm guessing Media Temple? That's the only place I've seen allow_url_fopen disabled.

It is only a security risk with poorly written PHP code. Anything powerful is a security risk if it's coded blindly. Disabling allow_url_fopen makes a host feel more secure because they are placing extra limits on what you can do with your web hosting account. It means they don't have to have as many people looking after things (drives profit). It also means you have a disabled web account. Unless you are getting free or super-cheap hosting, I would not consider this type of intentionally-limited account unless there is an override for those that want it (like being able to specify your own php.ini to enable such things).

[ceberlin]

Hi, thanks for your reply on this. Did I say I love this community already?

My provider is not blocking allow_url_fopen, it is just off by default .So I could go and enable allow_url_fopen on my shared hosing. I am a bit over cautious about security (also because I do not consider myself being an excellent coder) and I like do disable as many powerful non-needed features as possible. Especially when dealing with new software (processwire) or complicated software (like my current Drupal installation, including the 103!!!! installed "beta"-type modules). That's why I asked.

And if you search for allow_url_fopen, you find tons of warnings.

I like the idea of this particular Module-Manager Module VERY much - it adds security, because it will make it really easy to keep my installation up-to-date.

So I would be willing to try the module with allow_url_fopen enabled, but if curl would also work (yes, I have that plugin running) even better.
An included download-link is not bad either.

[DaveP]

Just installed this module on a live site and it told me that one of my modules needed updating - excellent. The module in question is MarkupSitemapXML, so I clicked 'Update' and got an error message to the effect that the zip file couldn't be opened. No wonder, as it contained the following (not zipped).

<html><body>You are being <a href="https://nodeload.github.com/Notanotherdotcom/MarkupSitemapXML/zipball/master">redirected</a>.</body></html>

Dunno if anything can be done...

[DaveP]

I should perhaps add that the url pointed to from the module manager was

https://github.com/Notanotherdotcom/MarkupSitemapXML/zipball/master

[Soma]

Yes the github urls are redirected when downloading the zip. Have you got the latest version? It works well on all my installs even with the redirect, not sure what doesn't in your case. Have you tried another download?

[Pete]

Just tested on XAMPP for windows - fresh download via the modules manager and worked fine. Can you try again as I've no idea why GitHub would feel the need to redirect you.

If that doesn't work, uninstall your copy, delete and try it as a fresh download through the modules manager.

[DaveP]

Tried all the above, even down to uninstalling module manager and reinstalling, The module manager downloaded the redirect message both when updating the sitemap module and installing it from scratch.

[Pete]

Is it just that module or others as well that have a GitHub addres?

[DaveP]

Just tried to install another through the manager, and same result.

[Soma]

As I said the github url does a redirect when using the zip url (button) on the github page. I recognized this but used curl then, so there's a setting to allow to follow. Not sure why it's not working with file_get_contents and redirects on your part. Think it's a php setting or something we'll have to try, maybe a context stream is needed in your case. Also I've seen there's a php bug. What version are you using? Can you try on another install or locally?

[DaveP]

Works locally - that's why I installed it on the live site. Remote php version is 5.2.17

[Soma]

There must be something strange. Here's the php bug https://bugs.php.net/bug.php?id=53018

Don't know yet what to try, but maybe it's possible to get around it.

[Soma]

Dave, can you grab the latest dev version and replace the ModulesManager.module and try again?

https://github.com/s...anager/tree/dev

[DaveP]

Thanks, Soma, stream_context_create() sweet.

[Soma]

Thanks, Soma, stream_context_create() sweet.

I guess it is working then?

[DaveP]

Working beautifully, thanks. Downloaded new modules and updated the one that revealed the problem originally - all successfully.