Closed (won't fix)
Project:
Drupal.org security advisory coverage applications
Component:
module
Priority:
Normal
Category:
Task
Assigned:
Unassigned
Reporter:
Created:
21 Dec 2011 at 16:52 UTC
Updated:
1 Jul 2012 at 21:30 UTC
The module extends Webform by adding a Computed Component which can receive a value from either a stand-alone mathematical calculation, a SELECT-CASE-DEFAULT value assignment, or from one of an IF-THEN-ELSE mathematical calculation/assignment.
No user programming required to create calculations etc., although the module depends on PHP Filter for use of drupal_eval.
Webform Computed Component sandbox
D7 git branch:
git clone --branch 7.x-3.x http://git.drupal.org/sandbox/vernond/1301484.git webform_computed_component
D6 git branch:
git clone --branch 6.x-3.x http://git.drupal.org/sandbox/vernond/1301484.git webform_computed_component
Comments
Comment #1
patrickd commentedwelcome
There are still files other than README.txt in the master branch, make sure to remove them. See also step 5 in http://drupal.org/node/1127732
Review of the 7.x-3.x branch:
False positives
The link to the automated review: http://ventral.org/pareview/httpgitdrupalorgsandboxvernond1301484git (you can use this site to re-test your self)
This automated report was generated with PAReview.sh, your friendly project application review script. You can also use the online version to check your project. Go and review some other project applications, so we can get back to yours sooner.
Is there a reason for naming your branches 3.x? this is quite confusing as you never had a 1.x/2.x
Please format your commit messages well, at least if they have issues (See http://drupal.org/node/52287)
dependencies[] = phpGood joke ;D you can remove that, (please)
regards
Comment #2
vernond commentedThank you for the prompt review! Issues raised are listed below with actions and/or explanations:
Comment #3
vernond commentedThe point you raise re the dependency on PHP Filter merits some thought. It is not ideal that PHP filter needs to be enabled to utilise this Webform component (nor is it ideal to complicate the issue with all sorts of access permissions).
To circumvent this I shall test a change where we instead module_load_include() the core php.module file in order to have access its to php_eval() function. From a security standpoint this seems to satisfactorily reduce risk as PHP filter need not be enabled and eval'd code will remain effectively jailed. Also means that I do not need to do anything dodgy like duplicating php_eval within the module.
Will post back when I have had time to try out this change.
Comment #4
vernond commentedDependency on core PHP module (PHP Filters) removed from 7.x-3.x branch (README.txt updated also).
No change to 6.x-3.x branch as drupal_eval() function is in common.inc, thus no dependency was required.
Coder and DrupalCS tests were re-run and resolvable issues handled.
Comment #5
patrickd commentedYou still have not removed the php closing tag
The "?>" PHP delimiter at the end of files is discouragedFollow/subscribe your issue queue. You got some feature requests, please answer them.
We ad the webform version issue several times here and it was the most common way to ignore webforms version number and begin with 1.x
As my webform API knowledge is quite limited I've to stop on this state, sorry
regards.
Comment #6
vernond commentedThanks a bundle for your input so far Patrick!
I cannot remove the closing tags as they are required by Drupal core's PHP module for eval'd code. Without eval'd code this module cannot offer anything meaningful. The closing tags that are being identified are in text strings, not at the end of the module file. It's a false positive.
I do subscribe/follow my issue queue. Two of the three issues on the queue were raised by me as reminders for things to do when other commitments back off a little. The other issue is a known sticky point in Webform itself and I'm hoping to solve that issue for both projects (again, as time allows).
Setting to 'needs work' until I get version number fixed.
Comment #7
misc commented@vernond has been contacted to ask if the application is abandoned.
http://drupal.org/node/894256
Comment #8
vernond commentedThis sandbox project and its project application are abandoned in favour of a new sandbox project at http://drupal.org/sandbox/vernond/1667748