Consensus is a facility for having discussions, like a forum, and creating documents, like a wiki, on one integrated page. It is a method for many users to have connected conversations in an easy-to-use format. The aim is to produce software that enables potentially hundreds of users to have conversations with each other without creating the noise that often results from large conversations.
UPDATE: Only use the 6.x-2.x branch - the earlier 6.x-1.x branch is abandoned
I have not found a similar project to this on drupal.org
The module stores data as an XML document within the node body. The editing process is partially driven with AJAX, and there is extensive javascript use within the page.
The module package includes a suite of several other modules which help improve the user experience.
You can see a demonstration of the module working here (you will need to register with the site for editing permissions):
http://www.yourconsensus.org/consensus/sandbox
Potential issues with the module include the difficulty of installation, due to several third party javascript files which must be downloaded from elsewhere. The module also requires specific, patched versions of the jQuery update and jQuery UI modules.
The project page:
http://drupal.org/sandbox/TommyKaneko/1090360
Please give me full project permissions!
Thank you for your time,
Tommy
| Comment | File | Size | Author |
|---|---|---|---|
| #48 | pareview_result.txt | 112.72 KB | doitDave |
| #24 | coder-result.txt | 17.98 KB | klausi |
Comments
Comment #1
joachim commentedI'm intrigued by the concept! Sounds very interesting.
Is there any way you could open up your sandbox to anon users, so reviewers don't have to create accounts?
Onto a code review...
- module code should not contain author credits -- credit is given in the git log, in issues, and project pages.
- run this through coder.
- tidy up the spacing of things like comment blocks
- hooks have a standard comment block start. Many of these need cleaning up. Eg, this has a stray space and needs to be in sentence case:
* implementation of hook_help
- consensus_old.module -- this file perhaps needs removing?
- consensus_class.php -- classes usually go in CLASSNAME.inc
- This is totally wrong:
Use dependencies!
- consensus_toolbox_populate_form -- messing with $_POST and $_SESSION is a Bad Thing, usually.
- drupal_install_schema -- remember to uninstall this too
- consensus.views.inc -- file is empty
- consensus_settings -- this function is terrifyingly huge!!!
- variable_get('consensus_item_options_item_edit_permissions_owner', true) -- you appear to have millions of these. At some point, using the variable table becomes a bad idea and you have to implement your own storage of settings. Looks like you need a {consensus_access} table. Also, TRUE, not true.
- * Prevents the node body, which is in a Consensus XML format, from being overwritten
Using the node body like this and having to hack around to prevent it being overwritten seems a bit weird...
- your module file is huge. I would move menu callbacks to either an admin.inc or pages.inc accordingly, and helper functions for parsing to an include file.
- * Implementation of hook_consensus_revised -- if you have your own hooks, you really should have an api.php file to describe them. This is a D7 rather than D6 requirement, but it's good practice.
- dwsync.xml -- are these files meant to be here?
- consensus_groups_form_alter -- not the right way to get settings into a block admin form!
I'll stop there as this is a HUGE module and while there is lots still to look at, that's plenty for you to work on for now :)
One conceptual thing to end on though:
Anytime I see this sort of thing, I think that it should be provided by an info-type hook, rather than hardcoded, so it can be extended by other modules in future.
Comment #2
tommy kaneko commentedThank you for giving me such a thorough review of the module. You've come up with some useful suggestions which I realise I should have thought of before! Comes with working alone on a big project, I guess. I'll take your points on board and come back when I have made those changes. I think a lot of the issues you found were to do with me being a little lazy with the code. One of those things that happens when a project runs away with you!
It seems like some of the issues with odd files were because I hadn't figured out how to use Git properly - will definitely improve on that!
Thank you for putting your time into this - I will make the module better as a result!
Comment #3
tommy kaneko commentedRegarding opening up access to anon users - how might I do this? I am not sure I have the permissions to open it up yet... Or is this a Git problem? Google seems to have failed me in this question....
Comment #4
joachim commentedSorry -- I meant your demo site, not the git sandbox...
Comment #5
tommy kaneko commentedI understand. Anonymous users can now edit the Sandbox page:
http://www.yourconsensus.org/consensus/sandbox
Comment #6
tommy kaneko commentedMany thanks again for your comments. It took me a while to do them justice. I have done everything on your list except for the parts outlined below, with reasons.
Here are the major changes:
- Splitting up of the code in .module file to several files: consensus.admin.inc, consensus.items.inc, consensus.edit.inc, consensus.module .
- New database storing module's settings variables.
- Hook system for registering new consensus item types.
- Code clean up.
I have not taken up the following points:
This is a function copied and amended from core, because I had problems with the standard behaviour. $_POST and $_SESSION variables do not get edited, so I am assuming it is safe?
Can you think of another way to prevent overwriting? I'd be happier not to hack. I need to prevent the user from editing the XML directly somehow.
I understand this - it is on the TODO list.
Let me know where you think I am with the module now, regarding getting full project status.
In future, I have the following plans:
- replace XSL Transformations with Drupal themes.
- More and better AJAX
- Improve styling
- Settings and permissions differentiated by node type, and potentially by node id
- API documentation
Comment #7
tommy kaneko commentedbumping.
Comment #8
pillarsdotnet commentedMove the XML data into a field that is separate from the node body.
Comment #9
ccardea commentedThis project is indeed so huge that it would take a week or more to read through and understand the whole thing. Looking at the project it is obvious that the author is an expert programmer with an in-depth knowledge of Drupal. The project follows coding standards and is well documented. The only things I noticed were:
* The consensus_class.php file is still in the repository, but the code has been duplicated in consensus.inc
* The author uses include_once and require_once instead of module_load_include
* In the .module file, used a check_plain instead of t() for a title.
There is always the possibility that there could be some security vulnerability hidden somewhere in the code, but the author is obviously aware of and consistently uses correct procedures for writing secure code.
There is some third party code in the parser directory that consists of a single class that is stated to be released under GPL. This may have to be removed.
Comment #10
tim.plunkettThe entire JS directory has non-GPL licensed files.
Comment #11
ccardea commentedAre we looking at the same thing? I looked at head for 6.x-1.x. The only thing in the js directory is consensus.js.
@Tommy Kaneko
It looks like you definitely are going to have to remove the code in the parser directory and instruct your users how to get it, unless you can convince an admin that it falls under an exception. See http://drupal.org/node/422996.
Comment #12
tim.plunkettStill needs work per #11.
Also, the master branch should be emptied out similar to the examples module: http://drupalcode.org/project/examples.git/tree/refs/heads/master
Otherwise it just seems like that is the code to use.
Comment #13
tommy kaneko commentedI'm sorry for the late response - sometimes life gets in the way of coding.
Firstly, I have had a major rewriting of the code to take into account everyone's comments. The most significant change is that the module no longer uses the node body to store xml, but uses CCK to create a new field. This is definitely a better approach, but one that has taken some time to implement! I have created a new branch 6.x-2.x for these changes.
The other big changes are:
- theme templates used to replace previous XSLT transformations
- Javascript rewritten to be more OOP
- User interface is improved
- Hook system allows other modules to define their own item types (API is still to be written)
- Consensus Groups module has been removed
- Input format support - when managing a consensus field, the administrator decides which input format to apply to the user input.
Also, due to the change of storage protocols between 6.x-1.x and 6.x-2.x (from node body to fields), you will not be able to upgrade to the 6.2 from the 6.1 version - they are incompatible. I know that this isn't good practice, but seeing as the project is in Sandbox mode and is likely that few, if any people are using it, I thought there would be no real consequences. Do correct me if I am wrong, and I can put some time into creating a script.
Master branch emptied as per #12
File licenses (in response to #9, #10, #11 and #12)
I realise that some files and their licenses needs some discussion. My aim is to make the module as simple as it can be to install without infringing on the rules. That means providing as many 3rd party files as part of the module if possible. Because the module uses so many 3rd party libraries, I feel that asking the user to download each one is a little excessive. I'll make a case for each file:
Parser file (wiki2xml.php) - in reponse to #9
The file does say it is licensed under GPL, or to quote, it says at the top of the file:
Is this not enough to make something GPL? The library does not seem to have been touched since 2005 - can one consider it abandoned? The original file can be found here:
http://svn.wikimedia.org/svnroot/mediawiki/trunk/parsers/graveyard/wiki2...
GPL licensed files
These files are licensed under GPL, so I believe I should be able to release it as part of the module - or have I misinterpreted the priority of rules set out in http://drupal.org/node/422996 ? Please let me know.
non-GPL licenced files
These files are not licensed under GPL, and have been removed. The README.txt file has been updated (on 6.x-2.x branch) to provide instructions for allowing the user to download the files. In future, D7 will be able to deal with js libraries more cleanly - but that is for the future.
Comment #14
tommy kaneko commentedI believe that the module is ready for review, pending the licensing issues mentioned above.
Please review the 6.x-2.x branch. The 6.x-1.x branch is effectively abandoned.
Comment #15
joachim commentedMight be worth mentioning which git branch people should review, BTW.
> consensus_get_field_settings() -- I'm sure you can use something like content_field() to get these rather than a DB query. It'll probably come from a cache too, saving a query.
> drupal_set_message(t('This NID is not a consensus document'), 'error');
Don't use technical terms like nid for an end-user. (Also, not an acronym, so 'nid'...)
> // $Id$ -- these are deprecated
> * Valid permissions for Consensus module.
Should be "Implementation of hook_perm().". Also, for hook implementations you can drop the @param and @return, since they are standard. In many cases you don't need any further documentation for that function, though I think the summary of paths you have on hook_menu() is a nice touch and could prove useful for anyone working with your module code.
These are all just cosmetic points so shouldn't stand in the way of the application being RTBC. Just the licensing needs sorting out.
Comment #16
tommy kaneko commentedThank you for your review. I have made the changes on the points you have mentioned.
I have now removed the GPL js files from Git, although I rather I didn't - not a battle worth fighting it seems. I have not removed the wiki2xml.php parser file, however. I believe I have a case to retain that file, as has been argued in #13. Even the URL to the file has "graveyard" in it! According to the rules ( http://drupal.org/node/422996 ), I need to gain approval from the administrators of Drupal.org. Could anyone let me know how I would get this?
Many thanks.
Comment #17
tommy kaneko commentedChanging priority to major according to guidelines: http://drupal.org/node/539608
Only outstanding issue is the wiki2xml.php parser file, which is a 3rd party library within the module. The code is no longer maintained by the original authors, as has been argued in #13 and #16. I have asked approval to include this file from the admins of Drupal.org: http://drupal.org/node/1301254
Comment #18
klausiComment #19
pillarsdotnet commentedwiki2xml.php is still in the repository, third party libraries should be removed.Awaiting resolution at #1301254: 3rd party code exception for project Consensus?.
The other objections are valid.
Comment #20
tommy kaneko commentedFixed
Oops - this is now fixed.
Dammit! I didn't know about doxygen standards for inline comments! This may take me a while to go through, and I hope I can be forgiven for taking my time over this particular issue. Will this affect the status of the project? The indentation error is now fixed.
Thank you for pointing this out - it has now been removed in all instances.
As for the wiki2xml.php file, I have gained approval for its inclusion in the repository, and relicensing of the file is pending: #1301254: 3rd party code exception for project Consensus?
Comment #21
tommy kaneko commentedchanging issue status
Comment #22
klausiComment #23
tommy kaneko commentedDone
I think I have all instances of this error fixed
All coder errors have been either fixed, or considered and ignored.
Further developments -Wiki2XML.php file, which is a 3rd party library has been re formatted to *largely* comply with Drupal coding standards. I say largely, as I have not done anything to change the executing code - simply the formatting style.
Am I there yet?
Comment #24
klausiAs the results of my automated review are pretty long, I rather add it as attachment. You can paste it in a comment and preview it to get the HTML rendered. I removed the errors on the wiki parser library.
manual review:
Comment #25
tommy kaneko commentedIt turns out that I still have some learning to do when it comes to Git commits. I had actually made those changes recommended by Coder, and did not commit it properly (or something - who knows what I did wrong). Sorry to waste your time.
All remaining automated code review recommendations have been considered, and I have decided to overlook them for one reason or another.
Comment #26
tommy kaneko commentedChanging status, as it turned out that previous reviewer's comments require more considered work.
If anyone has a regular expression that capitalises all comments, it would save a hell of a lot of work. Thank you!
Comment #27
doitDave commentedHi,
in standard regex there is no such option*.
In a PERL script, the proper regex were (using posix syntax):
s/^( +\/\/ )([a-z])/$1\u$2/gIn PHP, you would use something like
*of course you could replace
([a-z])with(a), (b), ... (z)and\u$2withA, B, ... Zand do the search/replace 26 times. But nobody would want that.Comment #28
pillarsdotnet commentedWon't work. Consider the following:
Your regex would capitalize the word "finish" on the second line.
Comment #29
doitDave commentedOh, sh... you are right. I simply had nothing but one line comments in my mind. Sorry.
The regex would have to be extended to recognize whether the line above already starts with / *\/\//, but i have no clue a.t.m. :-(
Comment #30
pillarsdotnet commentedThat said, if the overwhelming majority of Consensus comments are single-line, your regex might indeed save some work.
Comment #31
doitDave commentedUsing Textpad or a similar enhanced editor supporting regex search/replace, it would also save time doing it semi-automatted.
I would search in TextPad with
^ +// [a-z], hit ESC to hide the search form, hit CTRL+U for uppercase (if it's really the first line), and then cycle with CTRL+F - CTRL+U through all the documents.Not super elegant but fast enough for keyboard addicts like me ;)
Comment #32
tommy kaneko commentedThanks guys, that has saved me a lot of work.
I ended up using the expression with dreamweaver:
Find:
( +// )a(.*)ReplaceWith:
$1A$2.... and did it 26 times for each letter! The regex above also added a full stop. I'm sure there is a way to match comments without a proceeding line of comments for anyone else interested in doing something similar.
Comment #33
tommy kaneko commentedChanging status, as recommendations from #24 have now all been acted upon.
I hope we're nearly there - it's been quite a slog to get this module up to scratch! Serves me right for making my first module a huge one.
Comment #34
klausiReview of the 6.x-2.x branch:
This automated report was generated with PAReview.sh, your friendly project application review script. Go and review some other project applications, so I can get back to yours sooner.
Comment #35
tommy kaneko commentedThank you for your review. It seems that (my version of) Coder does not pick out many of the errors that you listed above. Do you know why this is? Are you applying Drupal 7 coding standards to this Drupal 6 module?
Furthermore, regarding "Implements hook_foo()." format errors, this is contrary to what I have learned, where "Implementation of hook_foo()", is the correct format. I get the feeling that this is a coding standard that has changed since I started the project! I don't have a problem with changing this in future, but I also do not want to have the project application delayed by more and more coding standard errors that are not detected by the Drupal 6 version of Coder.
The repository has been updated to action the comments above, except the "Implements hook_foo()" issue. Please note that the "critical warnings" have been considered, and I deem them not be a threat.
Comment #36
doitDave commentedI am subscribing to Tommy's points. I recently installed the latest dev release of coder (I was running the release version before). I tried to retest some other review results and had less and/or different results. It really looks like many reviewers use coder 7 on d6 code. Is that possible and if so, could this be stopped? Alternatively, the d6 version of the coding standards page should really be revised. I also agree that this is causes unnecessary delays in the review process and, even worse, results in more (also unnecessary) work for both appliants and reviewers.
Disclaimer: I really appreciate automatting the review process with both coder and PAreview. Also I would support these tools and also the documentation teams where possible Just let me know where I could be helpful.
Comment #37
tommy kaneko commentedFor Your Information
From: http://drupal.org/coding-standards :
From that, one could be forgiven for thinking that applying current coder standards (using the coder module in d7, for example) is the correct approach when reviewing new modules on the project applications. However, some of the project applications are several months old (mine is more than 7 months old now since I started the review process), and new standards seem to be applied to old code.
I would suggest that the common sense approach is to use the latest D6 Coder module for D6 projects, and use D7 Coder for D7 modules.
I have raised this issue at a more appropriate place. I think discussion on this particular point should continue here:
http://groups.drupal.org/node/179939#comment-624014
Comment #38
doitDave commentedYes, I wouldn't blame worse example anyway since it's my personal ambition to deliver the "cleanest" code possible regardless of whether others don't. And the guidelines mention theirselves in some places that core code base partially is a rather bad example ;)
I think the general two goals for all are clean code and as few overhead as possible. We all should do our best to achieve those :-)
(Will also switch to the linked discussion after this post here.)
Comment #39
pillarsdotnet commentedSee #1296842-29: Clarify scope of PHP coding standards for core (major version) and contrib code
And #711918-145: Documentation standard for @param and @return data types
Also see #1161796-7: Initial d8 port of Coder and Coder Review modules.
Comment #40
jthorson commentedI've added my opinion to the thread at http://groups.drupal.org/node/179939#comment-624219 but will re-iterate the points pertinant to this application here:
- I consider all code in the project application process to be 'new' code, until the project has been promoted to 'full' project status.
- Changes to coding standards are not made without reason ... I interpret the 'D6 versus D7 version' argument as referring to *core*, while all contrib code should attempt to abide to today's coding and documentation standards.
- My opinion is that applying a single set of rules to all projects simplifies the process for reviewers, making the process more efficient, and thus accelerating the process for applicants.
- Providing justification as to why you deem them to not be a threat would probably help potential reviewers to arrive at your same conclusion.
Comment #41
tommy kaneko commentedMoving on from the coding standards debate, back to the application. I have fixed all the minor coding standard errors, and hoping to god that no new standards emerge before this project application is approved.
There are critical warnings that need to be explained:
- Fixed, using db_query() as opposed to update_sql()
- The variable
<?php $settings['item_options'][$param['type']]['name'] ?>that this error refers to is hard-coded within the module. I have added the use of check_plain() anyway so that we don't see this error (although it isn't needed).+296: [critical] Potential problem: when FAPI element '#type' is set to 'markup' (default), '#value' only accepts filtered text, be sure to use check_plain(), filter_xss() or similar to ensure your $variable is fully sanitized.- filter_xss() has been used to modify user submitted text - Coder simply didn't pick up on how I did it.
+438: [minor] Potential problem: use the Form API to prevent against CSRF attacks. If you need to use $_POST variables, ensure they are fully sanitized if displayed by using check_plain(), !filter_xss() or similar.- Won't fix - the Form API is used to an extent, however this function requires that a particular output is returned to the user. There is no possibility for CSRF attacks, as the $_POST variables are not displayed as is to the end user.
I am requesting final reviews and if possible, approval. Thank you.
Comment #42
doitDave commentedHi Tommy,
I just had klausi's script running over your latest snapshot. I cannot tell whether I did it completely right (your project is the oldest in the review queue and the only other I checked with the tool before was my own one), so if not, don't hate me ;) Also see my remarks at the bottom.
Review of the 6.x-2.x branch:
This automated report was generated with PAReview.sh, your friendly project application review script. Go and review some other project applications, so we can get back to yours sooner.
I found some strange things again; some of the lines claimed to be longer than 80 chars actually aren't. Since I ran the script in unix, there should be no problem in my setup but I can't figure out what it is.
HTH, D.
(Of course any hints on mistakes I made with the pareview script are highly appreciated! Thx!)
Comment #43
tommy kaneko commentedThanks DoItDave,
I tried reviewing the module using the Coder module for D7, and it didn't find the errors that your script found! I have looked at the PAReview.sh, but it is a little complicated to get up and running on my testing system.
I have acted on those errors that you have pointed out. I would really appreciate it if you could run the script on the commit again, and post the results as you have done before.
As a review of the PAReview script, here are some errors:
The script doesn't seem to overlook operator characters which appear as strings, comments or HTML:
And same with assignments:
Comment #44
doitDave commentedHi Tommy,
I ran the script again. Regarding your comment on the false positives, I agree on that and would suggest reporting this directly to klausi in order to check it. But it is also possible that I did something wrong with the installation of the script, as it should not check .html IMO. I don't know.
Here's the check result (I left out the false positives named above):
Review of the 6.x-2.x branch:
This automated report was generated with PAReview.sh, your friendly project application review script. Go and review some other project applications, so we can get back to yours sooner.
Personal additions:
.phpextension is deprecated and should be changed to.incIMO.BTW, I was also unsure how difficult it would be to set up the pareview script. If you are somehow familiar with *X systems, it is really not that complicated. Just try it out, there is a short intro on klausi's project page. (As of today, even ambitioned Windows fans may install a Linux system inside a "Virtual PC" environment. It really works! ;))
HTH, dave
Comment #45
tommy kaneko commentedThanks again dave, for your quick response.
Phew! Is it ready? Is it ready?!
I'll get on the pareview script soon. I must admit shell scripting does make me a little nervous! I have to install PEAR and everything too. Just need to man up.
Comment #46
doitDave commentedHey, it is really no issue. E.g. in Debian Linux you just install git and pear via apt. That's three lines and five minutes, honestly. There's no native shell scripting at all unless you intend to automate the process even more (e.g. embed it in a script that automatically pushes the output into a remote file like I have configured it to speed up). And as you can plainly see, every support for the review queue is badly needed (that's why I told myself to just do it).
OK, sorry for not looking closer at the wikixml. Just make sure that the copyright notices really do not interfere with GPL. As far as I have understood, this is considered very, very important (but obviously you have already been deeply involved with that :)).
Ok, once you feel we are ready to continue, please change status. I would then make a full test install in my review environment. :)
Comment #47
tommy kaneko commentedChanging status to needs review. I forgot to last time.
From reading up on GPL, copyright notices don't interfere with GPL: http://www.gnu.org/licenses/gpl-faq.html#HowIGetCopyright .
I will install the script soon! Will get over the fear.
Comment #48
doitDave commentedHi Tommy, you better do (and also the drupalcs script which is unfortunately a little more tweaking). As I just did, I ran this setup over your repo. Results are attached. Don't be shocked, many things can be fixed with a global search/replace (I can tell, just went through it myself recently...).
What I have seen in other reviews, copyright notices are not welcome except for the readme file. Just to mention.
HTH!
-dave
Comment #49
tommy kaneko commented**sigh**
Don't have much time at the moment, so maybe I'll get on it in a couple of weeks. I might not bother until i port it to D7.
Thanks for the latest review.
Comment #50
jthorson commentedWithin GPL, copyright can still be used to prevent someone else claiming the work as their own ... while it's use may be unofficially discouraged within the Drupal contrib libraries by some (who might see it as contrary to the 'community' mantra within Drupal), I don't think it's actually 'forbidden'.
Just my 2 cents. :)
Comment #51
jthorson commentedI know the script output seems somewhat overwhelming ... but there are a few showstoppers in there. For example ...
- Avoids 'ambiguity' in argument passing
706 | ERROR | Constants must be uppercase; expected ITEM but found item- missing '$' on '$item'
795 | ERROR | Inline control structures are not allowed- While supported within php, the Drupal standard is to use {} on one-line 'if' structures for consistency purposes
Comment #52
misc commented@Tommy Kaneko has been contacted to ask if the application is abandoned.
http://drupal.org/node/894256
Comment #53
tommy kaneko commentedChanging status to reflect the progress with the module application. Waiting for my personal time to free up before continuing the application.
Comment #54
klausiClosing due to lack of activity. Feel free to reopen if you are still working on this application.
Comment #54.0
klausiNotify readers of the abandoned 6.x-1.x branch