This module extends drupal private files downloads to use
http://www.cherokee-project.com/doc/modules_handlers_secdownload.html

* Links created for private files expire after a defined time.
* Serving private files is offloaded to the server if configured (X-Sendfile ...)

PHP:
Default delivery using just php mechanisms. Should work on all servers.

X-Sendfile X-Accel-Redirect:
Checks are done in PHP and the download offloaded to the server if supported.

Server:
Offload checks and download to server.

Comments

greggles’s picture

Status: Needs review » Active

Can you post a link to your sandbox?

wienczny’s picture

greggles’s picture

Status: Active » Needs review
ralt’s picture

Component: new project application » module
Priority: Normal » Critical

Changing priority according to the new priority guidelines.

mlncn’s picture

Status: Needs review » Needs work

These lines should be removed:

7 files[] = secure_download.install
8 files[] = secure_download.module

Now files directive is only used for additional includes that have classes.

Hook-implementing functions should always be introduced with the comment line "Implements hook..."

Check on coding standards in general.

Apologies for the ridiculous delay.

misc’s picture

The applicant has been contacted to ask if the application is abandoned.

wienczny’s picture

Status: Needs work » Needs review

I hope to have fixed all issues in #5 with commit 1e6c8ba
The module is not abandoned. The notification about #5 just got lost between drupal security ones ;-)

misc’s picture

Great!
You have a couple of coding standards issues:
http://ventral.org/pareview/httpgitdrupalorgsandboxwienczny1146078git

In the README.txt lines should not exceeds 80 characters (that is also for comments in module files)

The second line in the file doc comment must be " * @file", like:

/**
 * @file
 * Description of what the file contains.
 */

All functions should have comments, like (dummy example):

/**
 * What this functions does.
 *
 * @param array $modulename
 *   Set ctools as the owner to the plugin
 * @param array $content_type
 *   Set the content type
 *
 * @return string
 *   Set the path to the ctools-plugin directory
 *
 */
function modulename_name($modulename, $content_type) {

Mostly of the warnings is about indenting - so is should be pretty easy ti fix.
You could do a new automatic review yourself if you reuse the url above.

If you have any questions, please ask, so hopefully the process is going to be quick.

wienczny’s picture

I changed the files and pareview does not find anything, now.

http://ventral.org/pareview/httpgitdrupalorgsandboxwienczny1146078git

The comments were already there and were just reformatted. pareview should give some nicer message if the file comment is not at the correct position. It started in line 3 instead of 2 and the message was "File comment missing"

thursday_bw’s picture

As per the pareview output. You are working in the master branch.. You should have only a README.txt file in your master branch and work in a 7.x-1.x branch.

see documentation:

thursday_bw’s picture

Status: Needs review » Needs work
wienczny’s picture

Status: Needs work » Needs review

Moved to 7.x-1.x branch.

themebrain’s picture

Priority: Critical » Normal
Status: Needs review » Needs work

Review of the 7.x-1.x branch:

This automated report was generated with PAReview.sh, your friendly project application review script. You can also use the online version to check your project. Get a review bonus and we will come back to your application sooner.

Source: http://ventral.org/pareview - PAReview.sh online service

Manual review:
- Should use t function with title and description for example:

  $items['admin/config/media/secure_download'] = array(
    'title' => 'Secure Download',
    'description' => 'Configuration for Secure Download module',
    'page callback' => 'drupal_get_form',
    'page arguments' => array('secure_download_form'),
    'access arguments' => array('access administration pages'),
    'type' => MENU_NORMAL_ITEM,
  );

- Should use drupal_realpath here:

  $path = realpath(drupal_get_path('module', 'node') . '/../../') . '/' .
wienczny’s picture

Status: Needs work » Needs review

Hi I fixed the problem with the path. I'm directly using the wrapper now.

The documentation says title and description in hook_menu must not be translated: See "title callback" in hook_menu

jthorson’s picture

Status: Needs review » Reviewed & tested by the community

Still some 'dot' files in your master branch, which should be cleared out.

Otherwise, a quick scan looks good ... I don't pretend to understand how cherokee hidden downloads work, but I think it's safe to assume you do. ;)

wienczny’s picture

It's not just a feature of cherokee. Nginx has something like that, too http://wiki.nginx.org/HttpSecureLinkModule They use a different url scheme. A feature for a future version if somebody needs it.

klausi’s picture

Status: Reviewed & tested by the community » Needs work

manual review:

  • project page is a bit short, see http://drupal.org/node/997024
  • "'access arguments' => array('access administration pages'),": this permission is too generic, create your own.
  • "strcmp($md5, $verification) != 0": why not just using $md5 != $verification ?
  • secure_download_download(): are you sure that you need to call exit; and cannot use drupal_exit()?
wienczny’s picture

I'll update the project page in the next days.
A new access permission was added.
drupal_exit is used instead of exit now. I was not aware that drupal_exit guarantees not output by other modules .

I don't agree on the the use of !=. You could argue to use !==, so. There were old php-Versions where strings could be php- or c-style and when compared to each other were not identical. I can't reproduce this with my current php-Version so it must be gone.

$something = 0;
echo ('password123' == $something) ? 'true' : 'false';
echo ('password123' === $something) ? 'true' : 'false';
klausi’s picture

Status: Needs work » Closed (won't fix)

Closing due to lack of activity. Feel free to reopen if you are still working on this application.