Drupal

A very useful document when you are working with virtualization, e.g. VMware, XEN, KVM, plus Windows platform.

Usually you may face time sync problem, whatever faster or slower than host. A very simple tip: setup a ntpd within host, and force client to keep ping and update it. The Linux ntpd is very simple and so I will not mention the detail setup, but how to client to be more hardworking?

Here is the most important setting:

Windows Time Service Group Policy Settings

You can configure most W32Time parameters by using the Group Policy Object Editor. This includes configuring a computer to be an NTPServer or NTPClient, configuring the time synchronization mechanism, and configuring a computer to be a reliable time source.

Note
- Group Policy settings for the Windows Time service can be configured on Windows Server 2003 domain controllers and can be applied only to computers running Windows Server 2003.

You can find the Group Policy settings used to configure W32Time in the Group Policy Object Editor snap-in in the following locations:
- Computer Configuration\Administrative Templates\System\Windows Time Service
Configure Global Configuration Settings here.

- Computer Configuration\Administrative Templates\System\Windows Time Service\Time Providers
Configure Windows NTP Client settings here.
Enable Windows NTP Client here.
Enable Windows NTP Server here.

IMHO, just set it as 100 if you have local ntpd server ;-)

A very useful document when you are working with virtualization, e.g. VMware, XEN, KVM, plus Windows platform.

Usually you may face time sync problem, whatever faster or slower than host. A very simple tip: setup a ntpd within host, and force client to keep ping and update it. The Linux ntpd is very simple and so I will not mention the detail setup, but how to client to be more hardworking?

Here is the most important setting:

Windows Time Service Group Policy Settings

You can configure most W32Time parameters by using the Group Policy Object Editor. This includes configuring a computer to be an NTPServer or NTPClient, configuring the time synchronization mechanism, and configuring a computer to be a reliable time source.

Note
- Group Policy settings for the Windows Time service can be configured on Windows Server 2003 domain controllers and can be applied only to computers running Windows Server 2003.

You can find the Group Policy settings used to configure W32Time in the Group Policy Object Editor snap-in in the following locations:
- Computer Configuration\Administrative Templates\System\Windows Time Service
Configure Global Configuration Settings here.

- Computer Configuration\Administrative Templates\System\Windows Time Service\Time Providers
Configure Windows NTP Client settings here.
Enable Windows NTP Client here.
Enable Windows NTP Server here.

IMHO, just set it as 100 if you have local ntpd server ;-)

Entry point

http://www.mediawiki.org/wiki/Manual:Preventing_access
http://www.mediawiki.org/wiki/Category:Page_specific_user_rights_extensi...

Background

If you intend to have different view permissions than that, MediaWiki is not designed for your usage. (See bug 1924.) Data is not necessarily clearly delineated by namespace, page name, or other criteria, and there are a lot of leaks you'll have to plug if you want to make it so (see security issues with authorization extensions for a sample). Other wiki software may be more suitable for your purpose. You have been warned.

Options

Multi-DB backend:
Details: Set up separate wikis with a shared user database, configure one as viewable and one as unviewable (see above), and make interwiki links between them.
PROs: elegant, no core hack, official suggested solution.
CONs: need to use interwiki links between each instance.

Group Based Access Control (http://www.mediawiki.org/wiki/Extension:Group_Based_Access_Control):
Compatible: 1.11.0 and higher
PROs: easy to setup, no patches, real extension, etc.
CONs: Users can still use search feature to find unauthorized pages and see excerpts in the search results.

Page access restriction (http://www.mediawiki.org/wiki/Extension:Page_access_restriction):
Compatible: 1.4-1.7.1, 1.10
PROs: useful for intranet relying on MediaWiki as a non-encyclopedic content management system, like e-learning platforms or informational systems.
CONs: requires patches to core MediaWiki code.

Simple Security (http://www.mediawiki.org/wiki/Extension:Simple_Security):
CONs: Outdated (1.4.x)

WhiteList (http://www.mediawiki.org/wiki/Extension:WhiteList):
Compatible: 1.6.0+
PROs: flexible pure extensions, similar idea as Blacklist.
CONs: limited groups handling (user based), limited flexibility, VERY NEW!

PageSecurity (http://www.mediawiki.org/wiki/Extension:PageSecurity):
Compatible: 1.8,1.9
PROs: Named security definitions, Support for MediaWiki user groups, Separate permissions for reading and writing, MOST POWERFUL!
CONs: requires patches to core MediaWiki code.

PageProtectionPlus (http://www.mediawiki.org/wiki/Extension:PageProtectionPlus):
Compatible: 1.8,1.9.1
PROs: have multiple protected and unprotected areas on a single article.
CONs: ?

Entry point

http://www.mediawiki.org/wiki/Manual:Preventing_access
http://www.mediawiki.org/wiki/Category:Page_specific_user_rights_extensi...

Background

If you intend to have different view permissions than that, MediaWiki is not designed for your usage. (See bug 1924.) Data is not necessarily clearly delineated by namespace, page name, or other criteria, and there are a lot of leaks you'll have to plug if you want to make it so (see security issues with authorization extensions for a sample). Other wiki software may be more suitable for your purpose. You have been warned.

Options

Multi-DB backend:
Details: Set up separate wikis with a shared user database, configure one as viewable and one as unviewable (see above), and make interwiki links between them.
PROs: elegant, no core hack, official suggested solution.
CONs: need to use interwiki links between each instance.

Group Based Access Control (http://www.mediawiki.org/wiki/Extension:Group_Based_Access_Control):
Compatible: 1.11.0 and higher
PROs: easy to setup, no patches, real extension, etc.
CONs: Users can still use search feature to find unauthorized pages and see excerpts in the search results.

Page access restriction (http://www.mediawiki.org/wiki/Extension:Page_access_restriction):
Compatible: 1.4-1.7.1, 1.10
PROs: useful for intranet relying on MediaWiki as a non-encyclopedic content management system, like e-learning platforms or informational systems.
CONs: requires patches to core MediaWiki code.

Simple Security (http://www.mediawiki.org/wiki/Extension:Simple_Security):
CONs: Outdated (1.4.x)

WhiteList (http://www.mediawiki.org/wiki/Extension:WhiteList):
Compatible: 1.6.0+
PROs: flexible pure extensions, similar idea as Blacklist.
CONs: limited groups handling (user based), limited flexibility, VERY NEW!

PageSecurity (http://www.mediawiki.org/wiki/Extension:PageSecurity):
Compatible: 1.8,1.9
PROs: Named security definitions, Support for MediaWiki user groups, Separate permissions for reading and writing, MOST POWERFUL!
CONs: requires patches to core MediaWiki code.

PageProtectionPlus (http://www.mediawiki.org/wiki/Extension:PageProtectionPlus):
Compatible: 1.8,1.9.1
PROs: have multiple protected and unprotected areas on a single article.
CONs: ?

Egroupware is a webbased groupware suite with an impressive list of features. Egroupware uses a Mysql backend to store all it's data but the latest release makes it easy to store useraccounts in an LDAP tree. This documents describes how to install the latest version while using an LDAP backend for useraccounts. Egroupware can then manage the unix loginaccounts as well as samba login accounts.

http://www.debian-administration.org/articles/555

If you are using LDAP or NIS to manage users you might discover users having problems because they don't have a home directory on each machine they can connect to. Thankfully there is a simple solution for creating home directories upon demand for users.

http://www.debian-administration.org/articles/403

Egroupware is a webbased groupware suite with an impressive list of features. Egroupware uses a Mysql backend to store all it's data but the latest release makes it easy to store useraccounts in an LDAP tree. This documents describes how to install the latest version while using an LDAP backend for useraccounts. Egroupware can then manage the unix loginaccounts as well as samba login accounts.

http://www.debian-administration.org/articles/555

If you are using LDAP or NIS to manage users you might discover users having problems because they don't have a home directory on each machine they can connect to. Thankfully there is a simple solution for creating home directories upon demand for users.

http://www.debian-administration.org/articles/403

What is Siren?

This is my personal project besides Drupal, which try to research the possibility of other database supporting for Drupal, e.g. Oracle, IBM DB2, MSSQL, SQLite, etc; on the other hand, I will provide unofficial database supporting during Drupal-6.x life cycle, and further more contribute the research progress for Drupal-7.x.

Current research progress

Besides official Drupal-6.x mysql, mysqli and pgsql, Siren also provide pdo_mysql, pdo_pgsql and oci8 database driver supporting. According to the needs of PDO and Oracle drivers implementation, ALL core queries and some APIs are hacked for compatibility concern. The changes will detail within the rest of this progress report.

Do Siren trade performance in order to increase the ability of cross database compatibility?

First of all, let's have a look about the impact of performance. As a control experiment, I also add official Drupal-6.x CVS HEAD within this benchmarking. Both official and Siren version are running on top of same hardware, software, and share the same database record set among same series of database drivers.

Fig. 1.1 Siren ab benchmarking, about requests per secnod.

Fig. 1.2 Siren ab benchmarking, about total connection time (ms).

According to above report, we may have some interesting conclusion:

1. No performance impact for revamp existing database API, in order to have better cross database compatibility.

   When compare Siren's mysql, mysqli and pgsql implementation with official version, you may found that their performance are almost the same. This is very important: as Siren keep existing performance, we are not trading our existing huge MySQL user base for database compatibility.

2. PDO don't introduce an outstanding performance improvement.

   pdo_mysql and pdo_pgsql just perform as similar as existing implementation. Maybe my implementation is not perfect enough; BTW, don't forget that we are now skipping the use of user space _db_query_callback() but placeholder with "?" directly in case of pdo_mysql, on the other hand reuse prepared statement in case of pdo_pgsql. This 2 feature are spotlighted as the hope of performance boost, but they are not.

3. Performance of Oracle is acceptable.

   It is no question about the faster of MySQL among 3 database: it is almost 3 time faster than Oracle. BTW, when compare Oracle with PostgreSQL, we may found that performance of Oracle just degrade for around 10~15%. It is a good prove of supporting enterprise-scale database: their performance is acceptable; on the other hand, most enterprise-scale database can provide more functionality, security and extensibility, where OSS don't provide.

What is Siren?

This is my personal project besides Drupal, which try to research the possibility of other database supporting for Drupal, e.g. Oracle, IBM DB2, MSSQL, SQLite, etc; on the other hand, I will provide unofficial database supporting during Drupal-6.x life cycle, and further more contribute the research progress for Drupal-7.x.

Current research progress

Besides official Drupal-6.x mysql, mysqli and pgsql, Siren also provide pdo_mysql, pdo_pgsql and oci8 database driver supporting. According to the needs of PDO and Oracle drivers implementation, ALL core queries and some APIs are hacked for compatibility concern. The changes will detail within the rest of this progress report.

Do Siren trade performance in order to increase the ability of cross database compatibility?

First of all, let's have a look about the impact of performance. As a control experiment, I also add official Drupal-6.x CVS HEAD within this benchmarking. Both official and Siren version are running on top of same hardware, software, and share the same database record set among same series of database drivers.

Fig. 1.1 Siren ab benchmarking, about requests per secnod.

Fig. 1.2 Siren ab benchmarking, about total connection time (ms).

According to above report, we may have some interesting conclusion:

1. No performance impact for revamp existing database API, in order to have better cross database compatibility.

   When compare Siren's mysql, mysqli and pgsql implementation with official version, you may found that their performance are almost the same. This is very important: as Siren keep existing performance, we are not trading our existing huge MySQL user base for database compatibility.

2. PDO don't introduce an outstanding performance improvement.

   pdo_mysql and pdo_pgsql just perform as similar as existing implementation. Maybe my implementation is not perfect enough; BTW, don't forget that we are now skipping the use of user space _db_query_callback() but placeholder with "?" directly in case of pdo_mysql, on the other hand reuse prepared statement in case of pdo_pgsql. This 2 feature are spotlighted as the hope of performance boost, but they are not.

3. Performance of Oracle is acceptable.

   It is no question about the faster of MySQL among 3 database: it is almost 3 time faster than Oracle. BTW, when compare Oracle with PostgreSQL, we may found that performance of Oracle just degrade for around 10~15%. It is a good prove of supporting enterprise-scale database: their performance is acceptable; on the other hand, most enterprise-scale database can provide more functionality, security and extensibility, where OSS don't provide.

I need to backup my post, since it may be purged by someone, from drupal.org DB directly, by exploiting his admin privileges... It sounds unbelievable if a post will be purged within a place for open discussion, but focusing on the truth and asking for a better solution seems not welcome by someone...

Some minor footnote: the issue is now duplicated, and shifted to a suitable thread: http://drupal.org/node/83738

I need to backup my post, since it may be purged by someone, from drupal.org DB directly, by exploiting his admin privileges... It sounds unbelievable if a post will be purged within a place for open discussion, but focusing on the truth and asking for a better solution seems not welcome by someone...

Some minor footnote: the issue is now duplicated, and shifted to a suitable thread: http://drupal.org/node/83738

I found that will be a very useful feature, if we able to integrate groupware system with internal IM (Instant Messenger) service. Therefore co-worker will not always need to use email as tools. I found that Jabber should be a good solution: it is open source, implemented with many server and client, and supported by debian.

On the other hand, what if we able to integrate Jabber user account authentication with internal groupware system? E.g. groupware -> RADIUS -> Jabber server. By doing this, we will able to handle the use of internal IM with single account and password (SSO, single sign on).

The key point should be: RADIUS or not? The answer is simple: we should, since RADIUS will benefit for many different services, e.g. PPTP + L2TP + IPsec VPN. With the help of RADIUS, the services will able to extend for more ;)

I found that will be a very useful feature, if we able to integrate groupware system with internal IM (Instant Messenger) service. Therefore co-worker will not always need to use email as tools. I found that Jabber should be a good solution: it is open source, implemented with many server and client, and supported by debian.

On the other hand, what if we able to integrate Jabber user account authentication with internal groupware system? E.g. groupware -> RADIUS -> Jabber server. By doing this, we will able to handle the use of internal IM with single account and password (SSO, single sign on).

The key point should be: RADIUS or not? The answer is simple: we should, since RADIUS will benefit for many different services, e.g. PPTP + L2TP + IPsec VPN. With the help of RADIUS, the services will able to extend for more ;)

This footnote will soon rewrite as official sub-chapter of Virtual Mailhosting System with Exim4, on Debian etch HOWTO, both title and URL will be renamed. Please don't bookmark this link ;)

Some important tips when using eGroupWare SyncML + Funambol + MS Outlook + other mobile devices:

1. Always backup your data before action: not only your information within local device, but also your remote synchronize server.

   This is very important, since the synchronize action may usually give you a unexpected result, e.g. your address book record may be duplicated. A complete backup can give you a chance for rollback, rather than tidy up your massed address book

2. Always initialize both your local device with synchronize server.

   A initialize can "teach" both of your local device and remote server that "data will need to be synchronized from NOW, please forget our old records and let them died with no sync"

3. Always pair up devices as one-to-one (e.g. MS Outlook with eGroupWare) or multi-to-one (multi devices with MS Outlook) mapping, but NEVER preform multi-to-multi synchronization with different protocols.

   E.g. NEVER pair up your WM6 PDA with MS Outlook though ActiveSync, and further more synchronize BOTH of your MS Outlook and WM6 PDA with eGroupWare though SyncML (synchronize in "triangular" style). Different protocols will NEVER UNDERSTAND the status of synchronize under other protocols, records will always become duplicated...

4. Testing, testing and testing before launch your service for production.

   One of the tricky tips for synchronize eGroupWare's address with MS Outlook though SyncML is: you always need to force the "Hide accounts from addressbook" into "Yes", and "Default addressbook for adding contacts" into "Personal" within eGroupWare address book preference page (Preferences -> Addressbook -> Preferences -> Forced Preferences).

   Without this forced setting, Funambol will synchronize both system accounts and your personal address book into your local devices (says outlook in this case), and your system accounts will "died" if you edit them locally and sync back to remote server: you will never able to edit those system account though user account administration page once again. (Similar bug reported in here)

Here is the suggested procedures when preform multi-platform synchronization (takes personal address book synchronize as example):

1. Backup your existing MS Outlook address book (and also eGroupWare database if available)
2. Flush both MS Outlook address book, and your personal address book in eGroupWare
3. Synchronize both (or ALL) of your flushed device with eGroupWare though SyncML as database initialization. So you will have an "empty" address book which "synchronized and initialized" in both (or ALL) side
4. Re-import your backup address book into MS Outlook, and further more synchronize it with eGroupWare though SyncML. Both side will now understand these data are need to be synchronize, and keep them update in coming future
5. (Optional) Flush your WM6 PDA address book, and synchronize it with MS Outlook though ActiveSync. NEVER use Funambol for WM6 to synchronize with eGroupWare, if you already pair up your WM6 PDA with your MS Outlook though ActiveSync
6. Please enjoy with all of your synchronized personal information :-)

   This footnote will soon rewrite as official sub-chapter of Virtual Mailhosting System with Exim4, on Debian etch HOWTO, both title and URL will be renamed. Please don't bookmark this link ;)

   Some important tips when using eGroupWare SyncML + Funambol + MS Outlook + other mobile devices:

   1. Always backup your data before action: not only your information within local device, but also your remote synchronize server.

      This is very important, since the synchronize action may usually give you a unexpected result, e.g. your address book record may be duplicated. A complete backup can give you a chance for rollback, rather than tidy up your massed address book

   2. Always initialize both your local device with synchronize server.

      A initialize can "teach" both of your local device and remote server that "data will need to be synchronized from NOW, please forget our old records and let them died with no sync"

   3. Always pair up devices as one-to-one (e.g. MS Outlook with eGroupWare) or multi-to-one (multi devices with MS Outlook) mapping, but NEVER preform multi-to-multi synchronization with different protocols.

      E.g. NEVER pair up your WM6 PDA with MS Outlook though ActiveSync, and further more synchronize BOTH of your MS Outlook and WM6 PDA with eGroupWare though SyncML (synchronize in "triangular" style). Different protocols will NEVER UNDERSTAND the status of synchronize under other protocols, records will always become duplicated...

   4. Testing, testing and testing before launch your service for production.

      One of the tricky tips for synchronize eGroupWare's address with MS Outlook though SyncML is: you always need to force the "Hide accounts from addressbook" into "Yes", and "Default addressbook for adding contacts" into "Personal" within eGroupWare address book preference page (Preferences -> Addressbook -> Preferences -> Forced Preferences).

      Without this forced setting, Funambol will synchronize both system accounts and your personal address book into your local devices (says outlook in this case), and your system accounts will "died" if you edit them locally and sync back to remote server: you will never able to edit those system account though user account administration page once again. (Similar bug reported in here)

   Here is the suggested procedures when preform multi-platform synchronization (takes personal address book synchronize as example):

   1. Backup your existing MS Outlook address book (and also eGroupWare database if available)
   2. Flush both MS Outlook address book, and your personal address book in eGroupWare
   3. Synchronize both (or ALL) of your flushed device with eGroupWare though SyncML as database initialization. So you will have an "empty" address book which "synchronized and initialized" in both (or ALL) side
   4. Re-import your backup address book into MS Outlook, and further more synchronize it with eGroupWare though SyncML. Both side will now understand these data are need to be synchronize, and keep them update in coming future
   5. (Optional) Flush your WM6 PDA address book, and synchronize it with MS Outlook though ActiveSync. NEVER use Funambol for WM6 to synchronize with eGroupWare, if you already pair up your WM6 PDA with your MS Outlook though ActiveSync
   6. Please enjoy with all of your synchronized personal information :-)
      
      
      • hswong3i's blog
      • 2 comments
      • 3524 reads

This footnote will soon rewrite as official sub-chapter of Virtual Mailhosting System with Exim4, on Debian etch HOWTO, both title and URL will be renamed. Please don't bookmark this link ;)

the main point of vexim + exim4 + courier imap + egroupware quota setup is all due to exim4's config:

therefore exim4 will create file maildirsize under each user's Maildir. courier imap will further more read this file for recall current status, plus additional setting within /etc/courier/authmysqlrc:

you will also need to update vexim's web interface configure in vexim/config/variables.php:

so vexim web interface will able to report current quota setup and status. we need not to configure egroupware, its webmail client will able to fetch this information by IMAP without additional setting.

This footnote will soon rewrite as official sub-chapter of Virtual Mailhosting System with Exim4, on Debian etch HOWTO, both title and URL will be renamed. Please don't bookmark this link ;)

the main point of vexim + exim4 + courier imap + egroupware quota setup is all due to exim4's config:

therefore exim4 will create file maildirsize under each user's Maildir. courier imap will further more read this file for recall current status, plus additional setting within /etc/courier/authmysqlrc:

you will also need to update vexim's web interface configure in vexim/config/variables.php:

so vexim web interface will able to report current quota setup and status. we need not to configure egroupware, its webmail client will able to fetch this information by IMAP without additional setting.

I am now playing with eGroupware, since my working place hope to replace the old MS Exchange server by some update solution. But we face some basic requirement:

1. Most users are MS based, which means we need to ensure the combination of MS Outlook and Windows Mobile PDA are working fine with new server system. Thanks god that eGroupware comes with SyncML supporting (http://www.egroupware.org/sync), we can use Funambol (http://www.funambol.com/) to synchronize all sort of supported devices (http://www.funambol.com/opensource/downloads.php). Thanks once again, OOS :)
2. The system need to support resource handling + calendar sharing. E.g. if I book a meeting room on tomorrow, within my personal scheduler, the system may need to update all other users that the resource is already preserved. By the help of eGroupware, it seems not too difficult
3. We have a mixed environment: Windows XP/Vista, MS Outlook 05/07, Windows Mobile 5/6, etc. E.g. We have Dopod 818pro on hand, which is coming with WM5 Eng. Funambol 6 can works fine with WM5, but how about WM6? Therefore I need to test the upgrade of WM6, too. BTW, Dopod 818pro don't have official traditional Chinese WM6 ROM provided, and so I seek for unofficial (http://www.mobile01.com/topicdetail.php?f=224&t=385791&p=1). The upgrade is not such easy, but all works fine after completely upgrade to WM6 (anyway, the install of Funambol 6 will cause error message under WM6, but works fine). It is a good studying since this is my first time of using PDA ;p

Still have some other issue, which are funny and interesting. Will be continuous...

I am now playing with eGroupware, since my working place hope to replace the old MS Exchange server by some update solution. But we face some basic requirement:

1. Most users are MS based, which means we need to ensure the combination of MS Outlook and Windows Mobile PDA are working fine with new server system. Thanks god that eGroupware comes with SyncML supporting (http://www.egroupware.org/sync), we can use Funambol (http://www.funambol.com/) to synchronize all sort of supported devices (http://www.funambol.com/opensource/downloads.php). Thanks once again, OOS :)
2. The system need to support resource handling + calendar sharing. E.g. if I book a meeting room on tomorrow, within my personal scheduler, the system may need to update all other users that the resource is already preserved. By the help of eGroupware, it seems not too difficult
3. We have a mixed environment: Windows XP/Vista, MS Outlook 05/07, Windows Mobile 5/6, etc. E.g. We have Dopod 818pro on hand, which is coming with WM5 Eng. Funambol 6 can works fine with WM5, but how about WM6? Therefore I need to test the upgrade of WM6, too. BTW, Dopod 818pro don't have official traditional Chinese WM6 ROM provided, and so I seek for unofficial (http://www.mobile01.com/topicdetail.php?f=224&t=385791&p=1). The upgrade is not such easy, but all works fine after completely upgrade to WM6 (anyway, the install of Funambol 6 will cause error message under WM6, but works fine). It is a good studying since this is my first time of using PDA ;p

Still have some other issue, which are funny and interesting. Will be continuous...

DB merge plan:

1. clean duplication of bppa_cos from bppa_mis: table, constrain
   

   complete

2. export bppa_cos, import into bppa_mis

complate, with error
data exists

3. add/drop/change bppa_mis table/column, according to dev_bppa_mis
   

   add tables: complete

   SELECT * FROM PurOrdDetails WHERE POID IN (SELECT POID FROM PurOrdDetails GROUP BY POID, MKNo having count(*) > 1)
alter table PurOrdDetails disable trigger all
delete from PurOrdDetails where POID = 984 and MKNo = 'MSD2004_338' and Pkg = 4
alter table PurOrdDetails enable trigger all

4. insert/update required information to bppa_mis, according to dev_bppa_mis
5. compare bppa_mis with dev_bppa_mis
6. check correctness by running new DB with new code

TODO:

1. user id is not sync between bppa_mis and bppa_cos: sync in lower and equal than 433, but all gone messed above 433
2. complete checking with new code
3. documentation

DB merge plan:

1. clean duplication of bppa_cos from bppa_mis: table, constrain
   

   complete

2. export bppa_cos, import into bppa_mis

complate, with error
data exists

3. add/drop/change bppa_mis table/column, according to dev_bppa_mis
   

   add tables: complete

   SELECT * FROM PurOrdDetails WHERE POID IN (SELECT POID FROM PurOrdDetails GROUP BY POID, MKNo having count(*) > 1)
alter table PurOrdDetails disable trigger all
delete from PurOrdDetails where POID = 984 and MKNo = 'MSD2004_338' and Pkg = 4
alter table PurOrdDetails enable trigger all

4. insert/update required information to bppa_mis, according to dev_bppa_mis
5. compare bppa_mis with dev_bppa_mis
6. check correctness by running new DB with new code

TODO:

1. user id is not sync between bppa_mis and bppa_cos: sync in lower and equal than 433, but all gone messed above 433
2. complete checking with new code
3. documentation