Closed (fixed)
Project:
Drupal.org security advisory coverage applications
Component:
module
Priority:
Normal
Category:
Task
Assigned:
Unassigned
Reporter:
Created:
2 Aug 2011 at 15:17 UTC
Updated:
23 Mar 2013 at 10:50 UTC
Jump to comment: Most recent file
Comments
Comment #1
gregglesI read through all the bullet points but don't feel like I saw any that are actually different from Webform.
I don't know Quiz or Surveys so I can't speak to overlap with them. Can you give more details on the differences in the hope it will help me understand?
Comment #2
chris_p commentedHi Greg,
I've updated the task to better highlight the differences from WebForms. I had not looked at developments in that module in the time I was working on this and, having upgraded my test server with the latest version of it tonight, I can see I have unfortunately ended up with something very similar (but not nearly as polished). The approach I have taken is wildly different however and this is reflected in the way in which survey components can be reused and the answer lists combined to produce very complex questions.
If I added my planned flow control components the differences would be more pronounced but I'm unsure now if that would be a waste of my time or not given the similarities in the two projects. A review of Deep Survey would still be helpful as it would give me some idea of where I am going wrong in my design and coding for Drupal.
Thanks,
Chris.
Comment #2.0
chris_p commentedUpdated to highlight the differences from WebForms module
Comment #3
chris_p commentedI've done a bit more work and included a new survey item which will skip forward (or indeed backwards) to a particular question based upon previous responses (i.e. it alters the flow of questions in the survey dynamically). The interface needs to bit of AJAX to make it a bit more user friendly but otherwise everything works. Hopefully this will justify the projects existence sufficiently but I will add in a couple of other items regardless as I want to see how my ideas pan out.
Comment #4
fuzzy76 commentedSubscribing
Comment #5
klausi* git release branch is wrongly named, see http://drupal.org/node/1015226
* Remove all old CVS $Id tags, not needed anymore
* lines in README.txt should not exceed 80 characters
* "//register survey with itself" comments should start capitalized and end with a ".", there should be a space after "//".
* Run the coder module on your files, there are some doc block formatting errors http://drupal.org/project/coder
* do not use "/** ... */" style comments in function bodies, use "//" to distinct them from function doc blocks
Comment #6
chris_p commentedHi Klausi,
Thank you for the review. I have a slightly out of date version of coder installed which did not pick up the formatting error, will upgrade.
Chris.
Comment #7
chris_p commentedI have addressed all issues raised by Klausi and the module is now ready for review again. Note that there are a few outstanding issues raised by coder but I think these should be fine. They are of two types:
1) A call to delete existing nodes when the modules are uninstalled is flagged because it doesn't use the function to rewrite sql touching the nodes table - however the behaviour of the raw sql is what I want in this case. If a user has access to uninstall a deepsurvey module then I want all module nodes removed if they do uninstall them.
2) A security issue related to using %s without quotes in the first parameter of db_query, however the variable used for this argument is set using a case statement with a default switch so I don't think this is an issue with respect to code injection.
However if my reasoning above is wrong I'm happy to revisit these.
Chris.
Comment #8
klausiWrong branch name, 6.x should be 6.x-1.x.
Review of the 6.x branch:
This automated report was generated with PAReview.sh, your friendly project application review script. Please report any bugs to klausi.
manual review:
Comment #9
chris_p commentedThank you again Klausi. It seems coder missed my deepsurvey_question module for some reason...
Edit: OK looking at the coder.txt I've realised I didn't have "Internationalization" checked when running coder.
Comment #10
chris_p commentedI have addressed all issues raised by Klausi in the second review and have looked through all code I've written and tried to ensure it demonstrates an acceptable level of compliance with the Drupal coding standards.
Chris.
Comment #11
patrickd commentedPlease remove the 6.x branch
Comment #12
chris_p commented6.x branch has been removed as requested.
Comment #13
patrickd commentedSee http://ventral.org/pareview/httpgitdrupalorgsandboxchrisp1136296git
Comment #14
chris_p commentedThank you for the review patrickd. It's a bit disconcerting that there are still so many violations of coding standards.
Chris.
Comment #15
patrickd commentedyou don't have to worry about that, just test through some of the well known full projects and you'll see that most of them are violating the coding standarts.
But anyway we want to be shure that you know about them, you can use them and hopefully you will continue following them.
Comment #16
patrickd commentedSwitched back to needs review, so in-depth reviews won't be blocked by coding standart issues.
Comment #17
chris_p commentedThanks. I'm 3/4 the way through at the moment. The errors have highlighted a couple of bugs I've had to fix so I will test again before doing a commit.
Comment #18
chris_p commentedActually I'll change back to "needs work" as I don't like the idea of an in-depth review whilst I know there are bugs in the code (even though I am sure there are more i don't know about).
Comment #19
chris_p commentedI've addressed most of the issues raised by patrickd and done some bug hunting. Fixing the remaining issues will result in less readable code so I've left these for now, there are just a couple of lines greater then 80 columns and the lines of php code within my @todo comments caused errors due to the indenting. My module is now ready for another review.
Chris.
Comment #20
barnettech commentedHello,
I ran your code through pareview and there are many things that you will need to fix. I am in the process of having my module reviewed as well, and trust me they will not consider this project to be accepted until all these items have been fixed.
You can run your code through yourself to make sure all is fixed: http://ventral.org/pareview
Also the code sniffer project though a pain to install is quite worthwhile and will definitely save you time: http://drupal.org/project/drupalcs
I recently got it installed on VIM and Eclipse, and it is making my workflow much much better.
Attached for your convenience is the output from pareview.
Comment #21
chris_p commentedHi barnettech
Thank you for your review and advice.
I've had as look though the file attached to your post and there are some errors that I'm finding a bit bewildering. Specifically the ones such as:
36 | ERROR | Missing parameter type at position 1
39 | ERROR | Missing parameter type at position 2
42 | ERROR | Missing parameter type at position 3
46 | ERROR | Data type of return value is missing
As far as I can tell these lines match the coding standards as specified here:
http://drupal.org/node/1354#functions
Can you let me know what I'm missing or are these false positives?
Chris.
Comment #22
patrickd commentedScroll a little down to "Data types on param/return" and have a look at the changes introduced by d8. (Yes, your code should already follow it now)
Comment #23
barnettech commentedMy advice with the doxygen is every duck must be in a row. If one thing is off it can trigger lots of other messages, and really once you fix the first error it may in fact clear lots of the other others.
I just put your code in my own editor and the first error I notice using drupal code sniffer (which I recommend for this review process: http://drupal.org/project/drupalcs) is your doxygen varialble in line 36 of deepsurvey.admin.inc does not match up with the first variable name in your actual function. The first doxygen variable is @param $deepsurvey and the first actual varialble name in the function is $deepsurvey_item_nid.
Setting up drupal code sniffer as I mention above will greatly enhance your ability to debug all these errors. I am relatively new to this process as well, and this greatly improved my ability to address these issues, and it greatly decreased my frustration with the whole process. It is a bit of a pain to setup but forever after you will be a happier drupaler.
I ran pareview again on your project and there are many many errors still, so make sure you run your code through there and have no errors or the project will not get through the admins to be sure. I try to follow up on the same project I've reviewed previously, and sorry I didn't see your question earlier, I just got back from vacation anyhow.
Cheers, and good luck.
Comment #24
chris_p commentedHi Guys,
Unfortunately I haven't had much time to spend on this yet due to work commitments. I've had a look at the Drupal Code Sniffer page and it appears there is only a version available for Drupal 7 whilst I'm still working with Drupal 6 currently.
Chris.
Comment #25
chris_p commentedHi All,
PAReview does not return any errors so my module is ready for another manual review.
Chris.
Comment #26
forestmonster commentedChris, thanks for your contribution. I know some researchers who might find this useful. I was able to enable your module in 6.25 without issues.
Comment #27
chris_p commentedHi forestmonster,
Thank you for the feedback. I'm quite concerned about the 404 you're getting as that isn't something I've come across myself. Usually if there is something wrong with the menu then it will fall back to the next lower branch of the tree (in this instance the deepsurvey node) or if the php fails to build the page successfully then a bank page is served (the "white screen of death"). I don't think either of these behaviours are configurable in Drupal but I could be wrong - perhaps php/web server configuration issues? It would be useful to know if you are using LAMP as on my test server or a different set-up. I will attempt to recreate the error when I have some time to look at this (unfortunately I'm doing some long hours at work at the moment, which will continue for another week or so). I don't have the latest version of Drupal 6 either so I will install and see if that makes any difference. One other question if I may - what is the URL you have for the Deep Survey node on the admin menu you are trying to add a question node to?
To address your other points:
Thanks,
Chris.
Comment #28
forestmonster commentedChris,
Regarding the 404, I am using a LAMP stack with clean URLs disabled.
It appears that the problem arises when I visit
http://localhost/test/drupal-6.25/?q=admin/deepsurvey/48, and the links ("add a new item..." and "add existing items...") are constructed in lines 1044 and 1049 of deepsurvey.module from$current_path. These point tohttp://localhost/test/drupal-6.25/?q=/test/drupal-6.25/admin/deepsurvey/48/new/0andhttp://localhost/test/drupal-6.25/?q=/test/drupal-6.25/admin/deepsurvey/48/existing/0, respectively.The URL for the Deep Survey node is
http://localhost/test/drupal-6.25/?q=admin/deepsurvey/48.Edit: corrected URLs.
Comment #29
chris_p commentedHi Forest,
Thank you (again) for chasing down that bug, makes much more sense now. I'm only running a single Drupal site on my test system so I think that is why I haven't had same thing happen. I suspect it is the base_path() that is throwing it out and I think that may not even be necessary - seemed to work OK here after I removed that bit of code. Odd that is is picking up the 6.22 version rather than the 6.25 though?
I think I will reconfigure my system to run multiple sites and test thoroughly before resubmitting for another review.
Cheers,
Chris.
Comment #30
forestmonster commentedChris, I edited my comment to correct those URLs. They should all say "6.25" now.
Comment #31
chris_p commentedJust a quick update as to were I am with this at the moment. I have completed some fairly extensive testing but have become a bit concerned with the usability of the Skip module. Before resubmitting I will be adding in some AHAH to it to make adding rules a bit easier, with drop down boxes getting populated with possible responses based upon questions selected. Hopefully this won't take too long, although as has been a problem recently work seems to be stealing away a lot of my spare time. Towards the end of this month life will be back to normal for the foreseeable future so worst case is that it will not be finished until after that has happened.
Chris.
Comment #32
fuzzy76 commentedI'm ready to review as soon as you are. :) We really need this.
Comment #33
chris_p commentedAlmost ready! PAReview has just thrown up a lot of errors, apparently I can only have a single line for my "function comment short description" so I will have to fix them. Otherwise it's looking good.
Comment #34
chris_p commentedJust found a nasty bug in the question validation code during last minute testing which I don't have time to fix tonight. Sorry, another few days until deepsurvey will be ready for review.
Comment #35
chris_p commentedOK I think I'm ready for another review.
Hopefully this will be a bit more successful than last time!
Chris.
Comment #36
caiovlp commentedHello Chris,
Congrats on this module, it's really impressive and well coded. I simply loved the documentation and how you generated a PDF with screenshots and all. Also agree with you on the fact that this is different from the other modules out there.
I'm moving this to needs work for one issue, I noticed that your .info says PHP 5.1 is required and your README.txt only says that Drupal 6.x is required. Can you please add PHP 5.1 to the documentation or remove it from the info file if it's not really required? Don't know if this is an application blocker, but hopefully @klausi can undo my mistakes :)
I also found two small things I would like to give my feedback on:
deepsurvey.module line 334 - there are 235 characters in this line and that makes it a little bit hard to read it, but this is my opinion. And it's recommended that you set your branch as default as opposed to having it set to master:
http://drupal.org/node/1659588
Regards,
Caio
Comment #37
chris_p commentedHello Caio,
Thank you for the positive feedback. I was expecting a somewhat harsh evaluation so this was a pleasant surprise indeed!
I will address the issues you have raised and welcome any further clarification from Klausi.
I will also add the ability to change the text shown at the end of the survey before resubmitting as I think this is the one thing still needed to make the module actually useful as a research tool, and I neglected to include it last time even though I had planned to.
Chris.
Comment #38
chris_p commentedAll issues raised by Caio have been addressed. Some bug fixes have been made and a new feature added - the ability the customize the message shown when the survey is closed or has been completed.
Note that PAReveiw currently flags the ampersand in the dereferenced variables in some of my function calls however I believe these are false positives.
Chris.
Comment #39
vensiresIn line 74 of the deepsurvey.module the comment seems misleading. When reading // Restrict access if unauthorised. I would then expect
return FALSE;, not TRUE. The code is correct. It's the comment that's misleading.You, also, seem to use double quotes(") instead of single quotes(') for SQL commands. Read about double and single quotes here(check the best answer).
For example, line 113 could become:
$result = db_query('SELECT nid, title FROM {node} WHERE type = "%s"', 'deepsurvey');Some people say that single quotes are processed faster when no variables exist in the string. The link above also provides links to a comparison between the two types of quotes.
In line 388, it would be better to consider replacing the '<p>survey is closed</p>' with '<p>' . t('survey is closed') .'</p> or even better to set this as a variable and allow the administrator to change it at will.
This is just a suggestion: would't it be better if you changed the function _deepsurvey_previous_item() to something with less arguments; You could use an array or an object variable to group all the $current_* variables in one and still have what you need.
And most important: remove the docs folder. It's 3MB on its own. You could use the advanced_help module to provide the documentation you want.
Comment #40
chris_p commentedHi vensires,
Thank you for the Review.
Chris.
Comment #41
chris_p commentedIssues raised by vensires have been addressed:
Suggestion on _deepsurvey_previous_item() noted but I have decided not to implement at this stage.
Ready for review.
Comment #42
bradtanner commentedFirst off, I have to say that this module has awesome documentation. Great work. Also sounds like a lot of people looking forward to it.
There is still a master branch, make sure to set the correct default branch: http://drupal.org/node/1659588 . Then remove the master branch, see also step 6 and 7 in http://drupal.org/node/1127732
A few coding issues as well: http://ventral.org/pareview/httpgitdrupalorgsandboxchrisp1136296git
The references to & are that you shouldn't have references in the function call as it breaks php 5.3: http://php.net/manual/en/language.references.pass.php
Manual Review
- In the menu, I would recommend using % replacements instead of creating menu items for each deepsurvey. I realize it may not be possible as I don't totally understand what you're doing with _deepsurvey_build_menu(). The reason I recommend it if at all possible is to avoid the costly menu_rebuild() function. For example:
- Also recommended to use drupal_write_record instead of INSERT/UPDATE queries. This will allow you to not have to worry about the database type the end user has and will make upgrading to D7 much easier.
- There are 2 queries in deepsurvey_view(). You could get this down to 1 query by pulling the extra field in the first query and then only using it if needed.
- Wrap in t() and capitilization and punctuation: drupal_set_message('problem removing content references from ' . $container_node['type'], 'warning');
- Any theme functions you implement should have your module name in them, preferrably at the beginning to avoid namespace issues: 'add_existing_questions_table'
- You have a couple of super long if statements. I would recommend breaking those down to multiple lines. The place where I noticed it was deepsurvey_question.user.inc:
Comment #43
bradtanner commentedComment #44
chris_p commentedThank you for the review ClinicalTools, particularly for explaining the error with ampersands in the function calls.
I will implement the bulk of your suggestions, other than the following:
Using % replacements instead of creating menu items for each deepsurvey - I had tried this originally and unfortunately it is not possible with the way I want the admin menus to work.
Use drupal_write_record instead of INSERT/UPDATE queries - My understanding is that the function I have used, db_query, is part of the Database abstraction layer and thus my code should still work with different databases. Please advise if this isn't the case?
Your comment about the documentation is somewhat puzzling as that was supposed to have been removed as a result of the previous review? I will check to make sure it isn't still there.
Chris.
Comment #45
chris_p commentedReady for review.
Comment #46
klausiWe are currently quite busy with all the project applications and I can only review projects with a review bonus. Please help me reviewing and I'll take a look at your project right away :-)
Comment #47
chris_p commentedHello Klausi,
Unfortunately after almost a year and a half I've become somewhat discouraged with the review process and as a result I'm not particularly keen to participate as a reviewer. On top of that it does feel a bit like I'm being blackmailed to do this, as I get the impression that my module will not pass review without my obtaining a review bonus, which of course doesn't encourage me either.
As things stand at the moment I'm happy to fix any issues that anyone finds with my module but I've largely moved on to other non-Drupal projects that have taken my interest and I'm not likely to make any major changes that aren’t deemed absolutely necessary. If there are limited resources available to review projects then I'm happy to withdraw my application if that will help to situation.
A longer term goal then would be to update Deep Survey to work with Drupal 7, which I think is necessary now anyway both to maintain the relevance of the module and also to develop my own expertise with Drupal 7 (expertise which I would really need to review other projects anyway as they all appear now to be written for that version). Then I could reapply for project access with that and do the necessary three project reviews to get a review bonus. However given how I feel at the moment this would be unlikely.
My apologies if what I have written causes offense but I felt it important to make a frank explanation of where I am with this. I also do not mean to indicate I do not, for the most part, appreciate the reviews that have been done of my work, it is just very discouraging responding to seemingly endless reviews whilst not having sight of an end state I need to be working towards.
Chris.
Comment #48
fuzzy76 commentedI really feel with you, and I am actually impressed that you haven't given up already. There have now been EIGHT people reviewing this single module. It looks like every time you satisfy one reviewer, a new one pops up with a different set of issues.
Comment #49
chris_p commentedHi fuzzy,
Thank you for the comment, it makes me less inclined to feel I am being unreasonable. However it would be inaccurate to say that I have given up entirely as I will still fix any major issues that are identified, and I may come back to do some more work on it some time. Certainly if there is some interest expressed in what I am doing I will be more inclined to continue on. Even though I am reasonably happy to have developed the module to it's current state there are a lot more features I was originally intending to implement. Also there is no requirement to have my module hosted on the Drupal web site so I could possibly make it available by other means.
Chris.
Comment #50
srutheesh commentedHello Cris,
There is still have some coding standered issue, i think it can be easly fix.
link :
http://git.drupal.org/sandbox/chris_p/1136296.gitComment #51
forestmonster commentedI believe the above review may be a particularly good illustration of the temptation to simply run the PAReview script without doing any critical analysis of the code whatsoever. Also, considering the point this discussion is at, the timing is particularly odd.
@srutheesh, if you're interested in helping Chris's Deep Survey project along, I would suggest that you complete a substantive review with clear comments for changes.
Comment #52
fr3shw3b commentedHello,
I guess the way people see PAReview automated tool and coder itself is that once the coding standards are out of the way you can get into the in depth stuff. that's how it seemed with my project application process.
Here's my manual review:
In using the module, I like it. Using the entity API would be awesome for the Drupal 7 version. (This would be so it would have it's own entity infrastructure seperate from content like custom tokens, custom pages, forums and others.)
My first suggestion would be to reduce the amount of the code in the module file by using an includes folder containing include files for different categories as you have done already with the settings form and datetime. This is because lots of unnecessary code will be called each time the module is called, seperating the code into multiple files gives you the opportunity to only call files when needed through the use of module_load_include() and attaching files to the menu and theme systems. Examples would be an include to deal with the deep survey form include and all it's states, another to for dealing with the theme layer etc.
I see you use a lot of database queries and was trying to think of a way you could avoid that as it using the database abstraction layer is a big drain on performance and I thought maybe you could use several helper functions to avoid some of the duplicate query code to help with this although I do not know any other great solution except from the module user using query caching which is obviously nothing to do with the module developer.
Apart from this to me this seems RTBC as there are no major blockers.
Comment #53
chris_p commentedHello fr3shw3b,
Thank you for the review, I will have a look at the entity API if I do end up doing a Drupal 7 conversion.
I must admit I'm not entirely clear on the changes you are suggesting. After some reading I've found that the module_load_include() is actually the more correct Drupal way of including files (and a lot easier than what I have done) however it does not in itself seem to offer any way of optimising performance by reducing the amount of code being loaded. My understanding of the PHP interpreter is not great but I would have thought it would have to load the include file first to know what was in there thus obviating the ability to optimise at that level (that is any interpreter optimisation would be then occurring within the loaded files). Perhaps there is some way to include a header file instead but I have not found any reference to this in the documentation?
It would however make sense to shuffle as much code as possible into the menu pages, which I hadn't really thought about before so there may be some opportunities to do this. The main problem though is that, due to the initial design being very object oriented and my inexpert attempt to impose that on the Drupal API, there is a lot of code in the module file that needs to be in scope for the sub modules to be able to use. I'm not really sure how to get around that.
Anyway I will get around to looking at this module again in the near future, any further advice would be appreciated.
Chris.
Comment #54
chris_p commentedI have implemented the suggestions of fr3shw3b and removed code from the module files into separate include files.
As the status is now "review & tested by the community" (which I didn't notice before, thanks for that!) I assume I just wait now until the Status is set to "fixed"?
Chris.
Comment #55
fuzzy76 commentedAnd thanks to the review bonus program, this module has now been RTBC for eight week, while the only thing missing is 3 seconds of work (giving you a role of committer) from the right people. >:( This is really becoming my favorite example for how broken the review system is...
Comment #56
greggles@fuzzy76 - complaining doesn't help. AFAIC if you want to earn the review bonus for this application that would be fine ;)
Comment #57
fuzzy76 commentedActually, if I want the process to improve / change for the better, complaining will accomplish more than just submitting to the system. ;) Not by much, but there's not that many other options clear to me. There was a discussion, but nobody seemed to be able to conclude from it, so it went on for a year before just dying.
Comment #58
gregglesComplaining almost never helps. Constructive criticism in the right spot (not here) does help.
Comment #59
jthorson commented@fuzzy76: Many reviewers prioritize projects based on how long they've sat idle at a given state ... by posting here, you bump this back up to the top of the list, thus resetting the clock on how long this takes to filter back down to the bottom; and as a result actually increasing the delay for the applicant.
Comment #60
jthorson commentedWhile I haven't looked at the submodules, the parent module shows a good grasp of Drupal APIs; and I wasn't able to find any major issues outstanding. Given the number of other eyes which have looked through it, I'd be pleased to promote it.
Thanks for your contribution, chris_p!
I updated your account to let you promote this to a full project and also create new projects as either a sandbox or a "full" project.
Here are some recommended readings to help with excellent maintainership:
You can find lots more contributors chatting on IRC in #drupal-contribute. So, come hang out and get involved!
Thanks, also, for your patience with the review process. Anyone is welcome to participate in the review process. Please consider reviewing other projects that are pending review. I encourage you to learn more about that process and join the group of reviewers.
Thanks to the dedicated reviewer(s) as well.
Comment #61
chris_p commentedThank you for promoting my project application jthorson, I will endeavor to make a full release after reviewing the documentation you have highlighted. Also thank you fuzzy76 for your advocacy.
Although I haven't come away being particularly impressed with the review process overall I appreciate the contributions of those that have taken the time to review my module.
Chris.
Comment #62.0
(not verified) commentedUpdated to include functionality of skip module in description