- install drupal modules/themes as root:daemon rather than www:www
(only the files/ directory needs to be writeable by 'www').
- don't install 'settings.php' world-readable since it contains the
DB password. Use 640, owner 'www' instead.
- bump all modules.
tested in production, including upgrade szenarios.
ok sthen@ and landry@, maintainer timeout.
WARNING: if you use both, update both. Especially if you use cck
node/user refs from a view, since that's broken with cck 2.5.
packages have an annotation to prevent this (@incompatibility) but it's
not yet implemented... ;-/
