This is a discussion and working group for anyone interested in the Services module and related modules. This module was created out of a need for a standardized solution of integrating external applications with Drupal, specifically Flash and Flex applications. Visit the issues page for all bug reports. Also visit the Services Handbook for information and examples.
Services Security Update -- Please Update your Version of Services.module
For those who don't get the Security email announcements:
------------SA-2008-038 - SERVICES - ARBITRARY CODE EXECUTION------------
* Advisory ID: DRUPAL-SA-2008-038
* Project: Services (third-party module)
* Versions: 5.x and 6.x
* Date: 2008-June-18
* Security risk: Highly critical
* Exploitable from: Remote
* Vulnerability: Arbitrary code execution
------------DESCRIPTION------------
The Services module package was created out of a need for a standardized
solution to integrate external applications with Drupal. It builds on concepts
from Drupal core's XMLRPC interface, but abstracts service callbacks so that
they may be used with multiple interfaces such as XMLRPC, SOAP, REST, and AMF.
This enables a Drupal site to provide web services via multiple interfaces while
using the same callback code.
Unfortunately, the access control system is not sufficiently granular; Users
with access to use a services have access to all provided services. With the
provided node services, or the system services enabled, it allowed arbitrary
code execution for those users.
Access to services can optionally be limited to certain ip addresses or
configured to need an API key, somewhat mitigating the issue.
------------VERSIONS AFFECTED------------
* Versions of Services for Drupal 5.x prior to 5.x-0.9
* Versions of Services for Drupal 6.x prior to 6.x-0.9
If you do not use the Services module, there is nothing you need to do.
------------SOLUTION------------
Install the latest version:
* If you use Services for Drupal 5.x upgrade to Services 5.x-0.9 [
http://drupal.org/node/272203 ]
* If you use Services for Drupal 6.x upgrade to Services 6.x-0.9 [
http://drupal.org/node/272202 ]
Review the new security features within the module, and upgrade all of your
remote service calls to authenticate a user session ID before making any Service
calls requiring secure communication.
See also the Services project page [ http://drupal.org/project/services ].
------------REPORTED BY------------
Scott Nelson [ http://drupal.org/user/31156 ], Gerhard Killesreiter [
http://drupal.org/user/227 ], Heine Deelstra [ http://drupal.org/user/17943 ].
------------CONTACT------------
The security contact for Drupal can be reached at security at drupal.org or via
the form at [ http://drupal.org/contact ].
How to pass API key to xmlrpc server for node.load function from client for pulling data from the server ?
I am trying to pull node from the remote site that contains service module(xmlrpc server), if i dont use the API key then i can extract the node using the following code from client drupal installation.
$node = xmlrpc('http://remotesitename/services/xmlrpc', 'node.load', 12, array());
But if i want to use the API key then how can i extract/pull node from the remote site so that only valid users can avail the service of service module.
Thanks in advance.
Read more
User Servce: Registration call missing?
We're happily building a flex site with Drupal as our content and membership provider. Everything works great, except today when I'm getting ready to put the registration side of things on the Flex application - I cannot find a way to call into Druapl to register a user.
The login/logout service calls work perfectly - as does the connect call from the system service - but I am at a loss as to what call to make to register a new user.
Any direction greatly appreciated.
M@
Read more
AS3 - AMFPHP connection problems
Hi all,
I have been playing around with AS3 and AMFPHP using FlashDevelop IDE and slowly learning. I have pieced the following code together and finally having overcome all the syntax errors and getting the types properly defined It doesn't throw any compiling error however it won't connect.
I get the following error
Error #2044: Unhandled NetStatusEvent:. level=error, code=NetConnection.Call.Failed at drupal2()If someone could point out my probably obvious mistake I would be very appreciative.
package {
import flash.display.Sprite;
Creating Images in Flash>Saving to Server>Creating Nodes
Hey everyone, I thought I'd post about a project I'm working on. My goal was to have a user create images in Flash, and ultimately have Drupal save the image on the webserver along with node data for retrieval later.
It works!
I'm new to using Services and AMFPHP, and to some extent Actionscript 3, but with the screencasts Rob Loach provided (HUGE thanks!!) I was able to start wrapping my head around this stuff. Even though the tutorials are done in Flex, with some fiddling I got it to work in Flash CS3.
Read moreamfphp - using the api key in Flash 8
ello, i'm new to this group and to the service / amfphp modules. after following the flash 8 section in the services hand handbook [http://drupal.org/node/140893 ] i've got my flash site to connected to drupal, so a well happy. but i'm struggling to find out how to implement the api and session keys in as2; the as3 stuff seem really cool, but my site need run in as2. Could anyone point me in the right direction of any as2 classes or help with some basic syntax, where do i add the api and session keys?
Read moreReverse engineer a Flash/AMFPHP view
I hope this is the appropriate place for this question. I have searched around but cannot find an answer. Hopefully someone here can help:
I am building a Flash/AMFPHP/Drupal site. I populate the Flash from Views.
I had a working view into Flash but somehow screwed it up (don't ask!)...
Background info:
I have created a Custom Content Type called "music" using the CCK audio_field.
I have a view that collects all nodes of this type.
In Flash I push the "Titles" and the "Bodies" into two arrays using this:
private function getMP3s(result:Object):void
{
Nodepoints and Userpoints...
I've created a new module...am still waiting for Drupal.org to accept it...
Nodepoint is the same with userpoint module, but this module allows nodes to have points...
The pratical use of this is when a user gets a service on a certain node his userpoint will be deducted based on the nodepoints of the node...
let me know your toughts pinoys... Im working on new customized modules for BMF (Cebu-based)...
Next i will create its nodepoint services (XMLRPC or JSON servers). Any body got an idea on this?
Flex and Services security
I'm using Flex to build cross-domain widgets that can be embedded on any domain. These widgets consume data via Services and AMFPHP. Unfortunately, I've been notified that my site is now vulnerable to attacks because I have a liberal crossdomain.xml policy file that allows connections from any domain.
Read moreDoes an RSS Aggregator Service exist?
I'm very happy with the way the Drupal Aggregator Module allows a user to build a collection of news feeds.
We would like to display the same information it outputs via a flex application, and I'm having a hard time deciding the best way to do this. We're serving up other content from Drupal to Flex via the services module. There doesn't appear to be a direct service for the data the aggregator displays.
I did find in beta5 of the Services module the ability to create a RSS view - but this appears to be only a single feed, unless I'm missing something.
Read moreRetrieving Drupal user session from Flex3
I've been having an issue for a week now.
I have a tiny Flex 3 app which simply retrieves the current drupal user session and displays the user data.
I'm using D6, services, amfphp with sessid turned off.
When I run the app on my laptop, the system.connect() method returns the proper Drupal user/session. If I switch user in Drupal and refresh the app I get updated and accurate user data displayed. My Sessions table only shows one Drupal session and my Flex app uses that session correctly. Seems smooth enough.
My problem is when other users access the app. Two scenarios here:
Read more
Blocks and service calls
It seems that node specific data (nid, title) isn't getting passed into a block I have that contains a SWF looking to call a "views.getView" service. The view contains an argument that looks for a node ID and shows only that nodes info.
I've got a custom page layout in Panels2. One of the panels holds this service calling SWF. It seems that the block or SWF itself isn't registering an nid, where as other views and pieces of content in the same panel do?
Is there a snippet or workaround to pass the data needed into blocks for the service call to use?
OAuth Integation with ServicesAPI
WAS Off for meetup at Google's office. Back in first week of august. - NOW BACK AT WORK
Project information
Read more
Views versions
While reading #245747, I realized that the Views import/export service I wrote was only tested with Views 1, I have no idea if it works with Views 2 (although it seems doubtful). It also seems likely that the other Views services will be broken in Views 2. Anyone have any ideas what to do about this situation, if anything? Include a views_1_service and a views_2_service? It would be great if we could talk Earl into working the services into Views itself, although certainly he has enough to worry about right now.
Read moreHow to use this modules
Sorry for this very very very stupid questions, but how can I contact a drupal-services from another drupal-site ?
I have read the documentation, see the source of services.module and *_service.module, but I have not understand how can I call this module from another site or via web browser (javascript/json service module).
Please help this newbie.
M.
Read moreHow to get this working with custom services?
I followed the Flash8 tutorial and wanted to get the SWF I outputted originally calling the node.load service to pick up the custom recipes service instead. Below is my stab at it, but it's not working. How would I access a custom service, or take this Flash example further?
Read more
Bring services and rules together
I think it would be really useful to do a rules engine integration, so one can do service calls by configuring rules (per UI). It looks like one has already to specify the arguments for a service - so we would have to convert this to the format of the rules API and expose an action per service. Basically that should do it already.
Have I forgotten something? What do you think about this idea?
Read more
Voting API service
I just uploaded a stand-alone module that provides Services methods for the Voting API. This allows external applications to access and modify Voting API data for Drupal objects. For example, a Flash application could implement an interface for voting on nodes.
I've submitted this as a feature request to the Voting API project at:
http://drupal.org/node/241453
If you use the Voting API and Services, please help me test this and support its inclusion in future Voting API releases. Let me know if you have any questions or suggestions.
Read more
Adobe AIR for Linux
Check out the newly released Adobe AIR for Linux (alpha) http://www.adobe.com/go/airlinux
Also an update to the alpha version of Adobe Flex(r) Builder(tm) 3 for Linux software is also available on Adobe Labs today at http://www.adobe.com/go/flexbuilder_linux .
Full press release at: http://www.adobe.com/aboutadobe/pressroom/pressreleases/200803/033108Ado...
Read moreGSoC-08:Secure OAuth Services
This is a Google Summer of Code project proposal by Sumit Kataria.
Read more