It is difficult(?) to realize all these in one release. Maybe some kind of characterizing/marking/tagging helps identifying what should be in the next release: Must have, Want to have or Nice to have?
The "must haves" are marked as children of this issue, see list on the right.
For me it's a bug/patch I'm running into on multiple different sites, or frequently crops up for new sites, then I'll add it to the list and push for commit.
If it's something edge-case, or hard to replicate, or can be worked-around, I'll let it lie until the more annoying issues get fixed.
@DamienMcKenna, I just noted that the v7.x-3.21 security release breaks on less than PHP 7.x. Will there be a security update for version of views that are still stuck on servers running PHP 5.x?
Since the security release broke existing sites we should ignore the remaining RTBC issues and instead release 3.22 immediately, right?
I agree, that we need a new release asap. However, there are apparently a number of regressions that have been introduced by the exposed filter security fix. Ideally, those should be investigated and fixed before a new release. It seems that there are a number of cases where a JOIN is missing from the query after the security fix, which will cause an empty where group and thus invalid sql. I guess we need to check if these are actually several other issues present in views and just exposed by the security fix or if the security fix did too much. We probably need input from someone on the security team here as well to make sure that any fixes do not render the security fix invalid in part or as a whole.
I've played around in the above sandbox on simplytest.me and observed the following:
Combining two filters based on the same taxonomy term and using "is none of" or "is all of" causes the SQL error. When one of these is replaced by another operator, the error disappears. Also when using different terms from the taxonomy the error disappears.
By the way: using the 'same' filter typically happens when using filter groups and repeating some filter components (this was my original case). These observations may indicate that the different 3.21 regression issues (at least 6 issues) and the different ways these were reported over time, may be very related, possibly sharing the same root cause.
Wish security issues would become public after they've been patched, makes it very difficult for those dealing with the fallout to have any idea of what was done and why with no details or context.
I've indicated on the new issues that they need tests, because I want to make sure we fully understand what we're fixing and that we don't accidentally introduce more regressions.
Just to be clear - I'm going to be AFK for the next week, but I'll catch up on everything next week and see what can be organized for a release. Thank you all for your efforts on this, it's sincerely appreciated!
There are three issues which need tests, and then three new issues which need a) reviewing to see if they still exist after the other commits, b) patches & possible test coverage. We're getting there.
There are three issues which need tests, and then three new issues which need a) reviewing to see if they still exist after the other commits, b) patches & possible test coverage. We're getting there.
It's not clear to me what issues those are, if I may make a request, can we list in the description what needs to happen before the release?
So as to make it easy to find out, in case someone wants to chip in to get this out earlier :)
I currently did patch rerolling for 50+ Views 7.x issues and want to continue that work constantly. So, if you like my work, please mark all patches needed to reroll as 'Needs reroll' and comment last patch like Chris Matthews does here: https://www.drupal.org/project/views/issues/1603664#comment-12928087
'Patch' link to last patch greatly helps me every time. Thank you!
Comments
Comment #2
damienmckennaComment #3
sgdev commentedAny reason why we couldn't get this one committed? Seems like a straightforward fix, unless there is a better way to resolve.
https://www.drupal.org/project/views/issues/2483055
Comment #4
pbirk commentedI'd like to see #1183418: Ajax attached to exposed filters in form_alter doesn't trigger callback committed. It's been RTBC over a year now.
Comment #5
chuck_theobald commentedApparently, this issue was fixed and then unfixed:
https://www.drupal.org/project/views/issues/1217394
I will see if I can produce a patch for version 3.20 and post in the above issue.
Comment #6
mustanggb commentedCan we get some of these RTBC committed?
Comment #7
damienmckennaI'll try to get to it in the next few weeks (if another comaintainer doesn't beat me to it).
Comment #8
Anonymous (not verified) commentedWhat do you do with the 70 RTBC issues? See: https://www.drupal.org/project/issues/views?text=&status=14&priorities=A...
It is difficult(?) to realize all these in one release. Maybe some kind of characterizing/marking/tagging helps identifying what should be in the next release: Must have, Want to have or Nice to have?
Comment #9
Anonymous (not verified) commentedI think that all the 'Bug reports' should be tagged as Must have: https://www.drupal.org/project/issues/views?text=&status=14&priorities=A...
Still more than 50 issues....
Comment #10
chris matthews commented#2834729: [META] Roadmap to stabilize Media Library is a great example of the Must-have / Should-have / Could-have / Done methodology.
Comment #11
mustanggb commentedThe "must haves" are marked as children of this issue, see list on the right.
For me it's a bug/patch I'm running into on multiple different sites, or frequently crops up for new sites, then I'll add it to the list and push for commit.
If it's something edge-case, or hard to replicate, or can be worked-around, I'll let it lie until the more annoying issues get fixed.
Comment #12
damienmckennaI've committed a few issues. There are two critical issues that are RTBC:
https://www.drupal.org/project/issues/views?text=&status=14&priorities=4...
Can folks please try this out to help make sure they don't cause any regressions on your sites.
Thanks!
Comment #13
damienmckenna"Major" bug reports that are RTBC:
https://www.drupal.org/project/issues/views?text=&status=14&priorities=3...
Comment #14
pbirk commentedI installed Views 7.x-3.20+12-dev and found no issues aside from a broken autocomplete field on an exposed filter, which is expected and related to #1183418: Ajax attached to exposed filters in form_alter doesn't trigger callback.
I tested a number of different exposed filters around my site and also confirmed a map display powered by Geolocation Views still work.
The patch from #1183418: Ajax attached to exposed filters in form_alter doesn't trigger callback no longer fixes my broken autocomplete field.
Comment #15
mustanggb commentedLovely to see so many patches have been committed, I've added a few more low-hanging fruits.
Comment #16
damienmckennaThanks MustangGB.
Comment #17
damienmckennav7.x-3.21 went out today as a security release: https://www.drupal.org/project/views/releases/7.x-3.21
It only contained security fixes, none of the other changes were included.
I'm bumping this to 7.x-3.22, we'll focus on making the next release more stable.
Comment #18
awasson commented@DamienMcKenna, I just noted that the v7.x-3.21 security release breaks on less than PHP 7.x. Will there be a security update for version of views that are still stuck on servers running PHP 5.x?
I just posted an issue in the queue.
Cheers,
Andrew
Comment #19
joseph.olstad@DamienMcKenna, yes I have a client using php 5.3.x and this release introduces php 5.4.x array syntax []
instead of array()
anyone have a patch for this yet?
Comment #20
joseph.olstadah yes there already is a patch
#3039953: PHP 5.3.x fix for syntax changes Views 3.21
Comment #21
joseph.olstad@DamienMckenna adjust your views automated tests to trigger 'on commit' instead of every week. That would have caught this.
Comment #22
klausiThe current dev version is working fine for us. Over in #3039953: PHP 5.3.x fix for syntax changes Views 3.21 people also confirmed that it works again on PHP 5.3.
Since the security release broke existing sites we should ignore the remaining RTBC issues and instead release 3.22 immediately, right?
Comment #23
feyp commentedI agree, that we need a new release asap. However, there are apparently a number of regressions that have been introduced by the exposed filter security fix. Ideally, those should be investigated and fixed before a new release. It seems that there are a number of cases where a JOIN is missing from the query after the security fix, which will cause an empty where group and thus invalid sql. I guess we need to check if these are actually several other issues present in views and just exposed by the security fix or if the security fix did too much. We probably need input from someone on the security team here as well to make sure that any fixes do not render the security fix invalid in part or as a whole.
Comment #24
steinmb commentedThere is at least three issues in the issue queue marked as 7.x-3.21 regression that we might look closer at before tagging 7.x-3.22.
Comment #25
pvdpdrop commentedFYI: via simplytest.me I've created a sandbox reproducing the 3.21 regression issue 3040526 temporarily available here: breaking view.
Remark: no exposed filter involved.
Comment #26
pvdpdrop commentedI've played around in the above sandbox on simplytest.me and observed the following:
Combining two filters based on the same taxonomy term and using "is none of" or "is all of" causes the SQL error. When one of these is replaced by another operator, the error disappears. Also when using different terms from the taxonomy the error disappears.
By the way: using the 'same' filter typically happens when using filter groups and repeating some filter components (this was my original case). These observations may indicate that the different 3.21 regression issues (at least 6 issues) and the different ways these were reported over time, may be very related, possibly sharing the same root cause.
Comment #27
damienmckenna@pvdpdrop: thanks for the details, lets continue in #3040526: 7.x-3.21 Regression: Malformed SQL with multiple 'is none of' filters - reproducible.
Comment #28
feyp commented@damienmckenna I just added #3040497: [Regression] Missing JOIN in attached display with taxonomy filter and inherited exposed filter as an other child issue, since I think you missed that one when adding all the regressions as child issues. I hope that's ok.
Comment #29
damienmckennaThat's fine, thanks FeyP.
Comment #30
mustanggb commentedWish security issues would become public after they've been patched, makes it very difficult for those dealing with the fallout to have any idea of what was done and why with no details or context.
Comment #31
damienmckennaI've indicated on the new issues that they need tests, because I want to make sure we fully understand what we're fixing and that we don't accidentally introduce more regressions.
Comment #32
damienmckennaI committed a few more fixes this morning, can folks please re-test the current -dev snapshot, possibly with the patches from #3040391? Thanks.
Comment #33
damienmckennaJust to be clear - I'm going to be AFK for the next week, but I'll catch up on everything next week and see what can be organized for a release. Thank you all for your efforts on this, it's sincerely appreciated!
Comment #34
damienmckennaI released 7.x-3.22 with just the PHP 5.3 fix: https://www.drupal.org/project/views/releases/7.x-3.22
The next full release will be 7.x-3.23.
Comment #35
damienmckennaThere are three issues which need tests, and then three new issues which need a) reviewing to see if they still exist after the other commits, b) patches & possible test coverage. We're getting there.
Comment #36
manuel garcia commentedIt's not clear to me what issues those are, if I may make a request, can we list in the description what needs to happen before the release?
So as to make it easy to find out, in case someone wants to chip in to get this out earlier :)
Comment #37
damienmckennaSeveral of the issues have been resolved or marked as duplicates of others, at this point all that remains is #2036473: Grouped exposed filters produces wrong where clause which needs reviews and #3040950: Placeholder for empty or inaccessible nid that needs confirmation on whether it's also a duplicate.
Comment #38
damienmckennaCould everyone please test out the current -dev version? If it all works well enough, without any new bugs, I'll release 3.23 in a few days.
Comment #39
damienmckennaComment #40
hidehisa commentedHello Damien.
I tested views-7.x-3.x-dev and found fix for "SQLSTATE[HY000]: General error: 1116 Too many tables" with filter for field of relation issue is not included.
I'm very happy if fix for this issue is in 7.x-3.23.
Thank you for great module!
Comment #41
damienmckennaAnything else? (-:
Comment #42
andrew answer commentedHi all,
I currently did patch rerolling for 50+ Views 7.x issues and want to continue that work constantly. So, if you like my work, please mark all patches needed to reroll as 'Needs reroll' and comment last patch like Chris Matthews does here: https://www.drupal.org/project/views/issues/1603664#comment-12928087
'Patch' link to last patch greatly helps me every time. Thank you!
Comment #43
mustanggb commented@Andrew Answer
I saw all your rerolls, very awesome!
Comment #44
damienmckenna@Andrew Answer: Yes, I've been following your rerolls and am very grateful for your contributions - thank you!
Comment #45
damienmckennaDone: https://www.drupal.org/project/views/releases/7.x-3.23
Thanks everyone!
Comment #46
mustanggb commentedThanks Damien for squeezing those last two in, also for having some time to give Views some much needed attention of late.
Comment #47
manuel garcia commented@DamienMcKenna++
Comment #48
damienmckennaThank you all for your patience, this release was a long time coming.