Fixed Backup Module

[erpe]

Hi there

referring to this thread
http://www.websitebaker2.org/forum/index.php/topic,17733.0.html

there is (thanks to Aldus, Doc, Hans and Chio) a fixed Backup Module available for all, who need a simple backup module for their clients.

Download

rgds

erpe

[BlackBird]

Good news. Thanks a lot to all involved.

[sky writer]

This is welcome news.
Can I ask what: "Add "DROP TABLE IF EXISTS"", means?

[chio]

Can I ask what: "Add "DROP TABLE IF EXISTS"", means?

This makes it easier to overwrite an existing database, when you restore the tables.

[aldus]

Hello

This brings me up to the point that there are some translation(-s) needed for
NL, DA, FR, RU ... (thanks to OEH for the NO one!) ...

Regards
Aldus

[sky writer]

Can I ask what: "Add "DROP TABLE IF EXISTS"", means?

This makes it easier to overwrite an existing database, when you restore the tables.

Sorry to trouble you further, but I still don't fully understand what this option does, or if I (my clients) should be using it.

[Argos]

It's a module that allows you to take backups of the database from the admin panel. I think that's pretty clear from the thread 
Or maybe I don't understand what your question exactly is?

[sky writer]

I totally understand what the basic module does, and I used the OLD Backup Module all the time on all my sites.

But I don't recall seeing the option: Add "DROP TABLE IF EXISTS", in the old module.  Maybe I'm wrong.  So, I just wanted to know what this particular option did.

[Argos]

O I see... It must be an option to remove old data from the old module if you had used that but did not remove. I'm not sure, I haven't installed or used the new moduel yet, but it must be a function to clear old data before installing the new module.

[maverik]

http://dev.mysql.com/doc/refman/5.1/en/drop-table.html

[chio]

You might have trouble to reload the data if there are already old data. Droptables means: get rid of old  tables and install new ones (fresh).
Simply: use "Droptables". Otherwise you have to delete the old tables first. There is no reason not to use it.
(sorry for my poor english)

[sky writer]

Thanks for the explanations and clarifications.

[tiesy]

What about the security of the fixed backup-module? Can we use it without any security concerns?

[maverik]

the fixed backup module is not a version from core dev team and not in addons repository. so you use it on your own risk without support from dev team.

[chio]

The new backup-module is much more secure than the old one (before that stupid "accident"). I dont see any security problems and I'm gonna use it on all my client pages (> 60 sites).

[Hans>NULL]

addons repository offers no safety

[Argos]

To prevent uncertainty and endless discussions about the safety of the so called fixed backup module, the Dev team should test it asap and give official green or red light. Now users have no clue if the fixed module is really fixed and safe to use or not. By only telling "this is not an official module and we cannot guarantee blablah" and leaving it with that, users only will be confused. The module should be tested officially. How hard is that for the Dev team?

[DarkViper]

There is no need for Discussion.

The Backup Module  is deprecated and it will stay deperecated until you find an official message from WB-Team on the WB-homepage.
The old module will never be fixed or supported by WB-Team. So be patient, until we publish a completely new one.


Any posting here in the forum reflects private meanings only.. never a official statement!

(the use of any fixed old module is generaly on your own risk)

DarkViper
(QA-Team)

[Waldschwein]

Just to make it clear (for myself & private statement and so on):

1.) The fixed backup module is some private fixing, but it _is_ safe. If you need to use a backup module, use that one. There won't be much place that it doesn't work, because there isn't much code and ten thousand of people used it before without problems.... If you don't need one, don't use any.
2.) There will be a new one. Why not the old one? Because all new modules should fit a Guideline, should be "in a correct scheme". That module authors can't say "look at that in Core, I will code my own module like that!".

To summarize: If you have clients that need a backup module, or you need it for your clients they aren't calling you at 4 a.m and screaming in the phone "where's my backup get it going !!!" use the fix here... But the fix is _not_ Core WB.

Yours Michael

Edit: There should be some statement what's the advantage of "is supported by WB-team". Most people don't see any... That's perhaps the problem.

[erpe]

the fixed backup module is not a version from core dev team and not in addons repository. so you use it on your own risk

What a statement.......... ..
Does this mean that somebody gives warranties for core modules or modules from official addons repositiry?
As far as I know: no, like all open source cms (software?).

As far as I remember the security bug was found in a module that was included in official package and created by Ryan who coded the base of the whole cms. Being in addons repository didn't prevent it from having a security bug.

See long discussion about fcke-editor. Is this a core module? There are lots of posts where officials have written that fcke-editor is not core.

Most of other modules that have been updated in the last days are available via addons repository. Are they updated on the last releases? I am not sure.

Do you really think that WebsiteBaker would be such popular with only few modules from official addons repository?
No, from my point of view.

So why make such a difference between coders?
One big plus of WebsiteBaker is the active and fast community.

And if some guys had an intensive look at some modules after a security bug in a "core-module" you should be happy that some coders feel responsible and modify the modules to provide them with more security to the community instead of telling people, that they are not officially supported by the core devs.
What does this mean? That they are no good coders or that all modules, that are not in the official addons repository are unsecure and bad coded?
And for what reason? To prevent people from using modules that are not listed in official addons repository?

I don't think that guys like Ralf or Aldus (or others) are bad coders, but I am not the one to decide on this.
But as far as I know Ralf und Aldus are involved in core development........ ............

The new backup-module is much more secure than the old one

That's it and I am sure, this is the same for all modified modules.

But there is no warranty at all.
And we all lived with the existing bug in backup module for more than a year.

And I am sure, there are some more security holes in the cms-core (and modules) and I hope, some wb-friendly users will find them before some hackers are successful.

rgds

erpe

[Argos]

You're spot on, erpe! No regular user knows who is 'the official WB development team", even I don't know that from the top of my head, I only know a bunch of names (aliases mostly) that contribute to WB code. Regular users know even less, and nobody of them makes a distinction between "core" developers, and "contributing" developers, and between "core" code and "add-on" code, more so because it's unclear what is core and what is add-on, as erpe already described. In fact, a regular use doesn't care for these kind of details at all. WB is open souce, and therefore lots of people around the world create it together, that's about most many users will know (and many will know even less: only that it's free software). So the whole situation around the backup module doesn't make any sense to regular users. It hardly makes sense to me, someone who is not a developer, but is more involved with WB than a typical user.

[crnogorac081]

Hi all,

I personally tested the hole and the fixed module, and from what I can see, in fixed module there is no more hole ! So I don't know why there is a big deal is the new module "verified" by core team ?

Maybe the guys from Core team are busy doing their regular jobs or whatever, so you can not always wait for "official" respond from them.

WB has great active community and when any problem appears everybody will jump in to help. So there shouldn't be a big deal why some "regular" user felt need to fix this hole for himself, his clients and community before core team, as long as the module is secure now.

P.S. I would lock this topic for further discussion

I.

[ruebenwurzel]

Hello,

just a small information about dev-team and backup-modul. With the old backup-module (the one with and without the fix) only allows to make a dump of the sql tables. There is no restoring option. Also if you change anything on file structure after a dump (f.e. adding a new page, pictures ...) your dump is senseless. If you restore a dump file, you need tools like phpmyadmin. But with this tools you also can make easily an dump. And last but not least it is not possible to split great dumps in different files wich makes it impossible to bacjkup large pages. So I ask myself, where is the sense of this modul?

The main Goal of WebsiteBaker is and should be to keep the system as easy to use as possible for users. So an easy to use backup modul for users should not only dump the database it also should also dump the files, split great databases and it should be have the possibility to restore all (database and files) with one klick.

Instead of fixing an old depreceated modul, the devs should force their energy to develop e new real beackup and restore modul wich must be part of WB core. And as far as i know, exactly this is planned. But this can not be written in a few days, this needs a little bit more time and also a good testing before it is announced for all.

So the decison from the devs to announce that the old backup module should be deleted immediately was the only right way, cause everyone who makes backups and works with backups has the knowlege to do this with other tools too, and for all other users this module as it was (and as the fixed one is) makes not really sense.

Just my five cents.

Matthias

[crnogorac081]

Hi Matthias,

That improved module will be great.

But in the meantime, before official dev's code the new module, members who used this module so far could use this "fixed" module .. dont you think ?

That is my idea... I 'll be glad to test the Full backup/restore module..(with files..)

All best,
Ivan

[Argos]

I also don't see any harm in using the fixed backup module in the mean time. The problem was that it had a security hole, not that it was not Super Add-on Of The Year. Many, if not most modules can be improved much, and some are even almost unusable in real live, and yet available.

Furthermore, it's a Backup module, not a Backup & Restore Module. It's far more easy to tell a client or user that he can create a backup from the admin panel, than to teach him phpMyAdmin or something. Most people never have a need for restoring a backup, and if it's needed they can leave that to the website builder, or try to learn how to restore themselves.

The only valid point I see is the problem with large databases. Well, that can be made clear in the module desription.

Developers should not make decisions for WB users to use a module or not, if there is no security risk involved. If they want to do that, they should delete half of AMASP to ged rid of all unfinished and decrepated stuff. But that would kill the point of open source software, wouldn't it?

It's nice that people work on a next version of the Backup module, but in the mean time people should not be "warned officially" to not use a perfectly safe and handy module, even when it's a bit outdated according to some.