Module uses code protected with GPL 3 licence.

And it also includes CC images as well, but I'm not quite as sure about our position on images since they aren't "code."

CC content is not allowed in CVS. It's GPLv2+ or no dice.

killes, all yours. :-)

Everything has to be GPL since we redistribute under GPL.

Sent a mail to author.

Hi Dave, I think I was wrong when I put the ExtJs license, as the ExtJs files are not bundled with the module, but need to be downloaded separately. I think I better remove that ExtJs license from the CVS.

Regarding images, are you sure that famfamicons are not allowed as per Drupal policies. I am just using 15-16 icons of those large set, and it would be a shame if I ask my module users to download such a large number of icons separately.

Hi killes, I have created a new alpha2 release. Hope that resolves the legal issues. If not, please let me know.

@r_honey: Creative Commons Attribution 2.5 License is not compatible with GPL; therefore, you could not commit files released under that license in Drupal.org repository, where all the files committed get the same license used for Drupal.

Hmmm, I will remove the icons from the repository in sometime, and instead provide a link to them from module documentation.

wouldn't it be better to just grab some gpl or public domain icons? just a suggestion...

I really liked the Fam Fam silk icons, and did not give it a thought that they would raise a licensing conflict with Drupal.

Anyways, as I am replying to this post, I have just removed the icons from the CVS. I hope my project would not be removed from the CVS now, as was informed to me. I have worked hard on getting the File Browser functional, and I hope it would be useful to the community.

Anyways, worldfallz, can you please suggest me gpl or public domain icons that can be used for a File Browser? Frankly enough, I have not tried out a search. So, if you know some, that would save me time. And file browser would look dull without those icons.

You bet-- there's lots of really nice ones available out there-- checkout the links on http://groups.drupal.org/node/20380. If you don't find anything you like there, let me know and I can dig up some more resources.

Thanx WorldFallz, I believe some of them would fill my immediate requirement (although Fam Fam had just about everything I needed).
Right now, I am switching to ones found following the link you posted. I hope I am in compliance to Drupal for all those.

It is also possible to not upload any icons, and add a note on the project page about where to download the icons. There are many modules that cannot commit files in Drupal.org repository for license issues, and that is what the maintainers do.

Well kiam, I have decided to go for a hybrid approach. I am uploading gpl icons with the module into the CVS, and I will povide a link also where users can download additional icon sets. The installation would be as simple as copying them additional sets into the module directory.

Would anyone like to assist me in testing my module? I really need to make sure it works correctly, and poses no security issues.

For some reason, the dev tarball on the module page is not being updated despite the fact that I have made commits in the last 2 days. I can attach the latest version here, or send by mail.

Your 6.x-2.x-dev release is based off your module's DRUPAL-6--2 CVS branch. You've been committing to the HEAD branch, so that would be the reason it's not getting updated.

It would be possible to add some code to the module that will fetch the icons whenever the user wants to, as an option, right?

This would actually be a nice for a more generic solution. Or is there a problem with this approach that I'm not aware of?

AFAIK, modules are not allowed to write in the modules directory, but I could be wrong.

Hi kiam, can you point me to a resource in the Module developer's guide which places the restriction you have pointed out (not allowing modules to write in the modules directory)?

I think that is a pretty handy situation.

PHP code executed by apache should never ever ever be able to write to a directory that can be executed by Apache. To do so makes it way too easy to hack a site through one security hole and exploit it to add 15 more of your own, including an entire sub-web-site full of pw0n.

A number of modules do have "download 3rd party stuff" drush commands, however, and drush make is trying to generalize that (although it still has some rough edges). That's probably an approach you could look into.

If it's just about some png icons: they don't have to be in sites/*/modules, they could simply be dropped in sites/*/files/take_control_icons or something. It seems safe enough to only extract files with png extension (or so) from the archive (if PHP can do that).

Are there any updates on this report, or can it be considered closed?

I am moving this issue as result of cleaning-up of the Drupal.org webmaster's queue components.