Closed (won't fix)
Project:
Drupal.org security advisory coverage applications
Component:
module
Priority:
Normal
Category:
Task
Assigned:
Unassigned
Issue tags:
Reporter:
Created:
8 Dec 2011 at 10:32 UTC
Updated:
15 Dec 2012 at 11:35 UTC
Jump to comment: Most recent file
Comments
Comment #1
patrickd commentedYou got some coding standart issues (http://ventral.org/pareview/httpgitdrupalorgsandboxhenry01363692git), you can use http://ventral.org/pareview and try to fix them.
If you got any questions on that, please ask!
At least this should be done as soon as possible:
Comment #2
drupalnetworks commentedThere are still files other than README.txt in the master branch, make sure to remove them. See also step 5 in http://drupal.org/node/1127732
Review of the 6.x-1.x branch:
Drupal Code Sniffer has found some code style issues (please check the Drupal coding standards):
Lines in README.txt should not exceed 80 characters, see the guidelines for in-project documentation.
Remove "version" from the info file, it will be added by drupal.org packaging automatically.
Remove "project" from the info file, it will be added by drupal.org packaging automatically.
Remove "datestamp" from the info file, it will be added by drupal.org packaging automatically.
Bad line endings were found, always use unix style terminators. See http://drupal.org/coding-standards#indenting
Comment #3
henry0 commentedHello, I worked on all these changes and fixed them. Also released 7.x version
Link to the project:
http://drupal.org/sandbox/henry0/1363692
Please review.
Comment #4
henry0 commentedIt has been almost 10days.
Can you guys please review and push this to live from sandbox.
Thanks
Comment #5
alesr commentedYou have some errors in clickdesk.install and clickdesk.module files found with PAReview.sh online
Comment #6
patrickd commentedplease don't set needs work on minor coding style issues, so in-depht reviews wont be blocked
sorry for the delay,
as there are currently many applications in queue we need more reviewers,
so think about getting a review bonus and we will come back to your application sooner.
Comment #7
alex dicianu commentedHi,
There are still some minor code style issues. See below:
Review of the 7.x-1.x branch:
This automated report was generated with PAReview.sh, your friendly project application review script. You can also use the online version to check your project. Get a review bonus and we will come back to your application sooner.
Source: http://ventral.org/pareview - PAReview.sh online service
Looking into the code, after cloning your module, the folder name is clickdesk_live_help___live_chat_support_module, while the module name in the .info file is ClickDesk. The 2 should have the same name.
In the clickdesk_widget.inc file:
You are using this function
Do you need it for something?
Function clickdesk_widget_form():
You filter against XSS the t("Widget Id") text, but not the $_GET['cdwidgetid'] which comes directly from GET. Just for info, a better idea to avoid using GET is to use the drupal menu system. Something like this:
More info about this here: Drupal Menu System.
Function clickdesk_widget_form_submit():
Not good. See Drupal Form API
The ideea behind drupal is to store in the database the raw value the user entered in the form. You filter it at display. Furthermore insted of POST you should use
$form_state['values']Comment #8
henry0 commentedFixed the issues. Please review.
Comment #9
alesr commentedIn clickdesk_widget.inc you are using filter_xss() for filtering plain text.
filter_xss() is usually used for filtering HTML text, for plain text you should use check_plain() function.
http://drupal.stackexchange.com/questions/10280/is-check-plain-enough
Comment #10
henry0 commentedUpdated. Thanks.
Comment #11
henry0 commentedMany weeks have been passing :(
Please review the module and push it live.
Thanks.
Comment #12
SebCorbin commentedDrupal code sniffer found issues in the two branches. Please refer to the coding standards at http://drupal.org/node/318
See http://ventral.org/pareview/httpgitdrupalorgsandboxhenry01363692git and http://ventral.org/pareview/httpgitdrupalorgsandboxhenry01363692git-6x-1x
Comment #13
patrickd commentedFew minor conding style issues are no valid reason for setting needs work.
Comment #14
sylvain lecoy commentedManual review:
on clickdesk_menu():
is absolutely not necessary.
You should check your clickdesk_elements() as well. There is a method conception problem.
However, this is not a blocker to me, and I can RTBC you.
Comment #15
klausiWe are currently quite busy with all the project applications and I can only review projects with a review bonus. Please help me reviewing and I'll take a look at your project right away :-)
Comment #16
patrickd commentedThere is still a master branch, make sure to set the correct default branch: http://drupal.org/node/1659588 . Then remove the master branch:
./clickdesk.install: the byte order mark at the beginning of UTF-8 files is discouraged, you should remove it.Please fix this, either by removing the byte order by hex-editors or by saving it with correct format settings.
Correct would be:
----------------------
Correct would be:
- begin comments with capital letter
- only one space between * and short description
- there must be a empty line between function short and long description.
This makes absolutely no sense. Menu configuration is cached and hook is NOT called everytime the site is requested.
'access callback' => TRUE,If you really want to check access here then either use a realy access callback or use a defined permission (read hook_menu() documentation!)
your function description definitely not tells that this function allways returns FALSE. What is this good for??
so many @'s and nothing to say ? - if you don't use it - remove it
Allways check access in menu callback!
check_plain(t('Widget Id')),It makes absolutely no sense to check_plain() static text, which does not contain any user input. Ignore automated reports here - this is a false positive....
Here's much more to say and this code is far away from beeing ready to be published.
For me this looks like you rarely have a clue how to create a secure and correct drupal module and I'd highly recommend you to buy a good drupal development book and start from the beginning.
My code-smell-o-meter is alarming, setting needs work, sorry!
Comment #17
klausiClosing due to lack of activity. Feel free to reopen if you are still working on this application.