Closed (fixed)
Project:
Drupal.org security advisory coverage applications
Component:
module
Priority:
Normal
Category:
Task
Assigned:
Unassigned
Reporter:
Created:
18 Jan 2012 at 11:06 UTC
Updated:
20 Jul 2013 at 09:11 UTC
Jump to comment: Most recent file
Comments
Comment #1
patrickd commentedwelcome
It appears you are working in the "master" branch in git. You should really be working in a version specific branch. The most direct documentation on this is Moving from a master branch to a version branch. For additional resources please see the documentation about release naming conventions and creating a branch in git.
Review of the master branch:
This automated report was generated with PAReview.sh, your friendly project application review script. You can also use the online version to check your project. Go and review some other project applications, so we can get back to yours sooner.
Comment #2
GetResponse commentedHi,
Patrick, thank you for your help - we've made some changes that you told us, and in our opinion we're ready for new review.
Regards,
GetResponse Team
Comment #3
camdarley commentedYour code got some coding standart issues (See http://ventral.org/pareview/httpgitdrupalorgsandboxgetresponse1408798git, you can use this site to re-test your self)
Comment #4
patrickd commentedplease don't paste the whole report in here, it's enough linking it or attaching it as txt file.
Comment #5
camdarley commentedMy mistake...
Comment #6
GetResponse commentedHi,
We fixed all coding-standart issues and we're ready for review.
Regards,
GetResponse Team
Comment #7
mdespeuilles commentedHi,
Manual review :
Not everyone has curl installed. Please use hook_requirements to ensure it doesn't get installed without it. Alternatively, look into using drupal_http_request().
Automatic review :
Review of the 7.x-1.x branch:
This automated report was generated with PAReview.sh, your friendly project application review script. You can also use the online version to check your project. Get a review bonus and we will come back to your application sooner.
Source: http://ventral.org/pareview - PAReview.sh online service
Comment #8
mdespeuilles commentedNeeds Work
Comment #9
patrickd commentedbtw: to use hook_requirements for curl, have a look into the install file of simpletest module
Comment #10
GetResponse commentedHi,
We've changed curl to drupal_http_request, corrected .info file and fixed code style issues. PAReview.sh online service doesn't show any errors, seems fine. Please review again.
Regards,
GetResponse Team
Comment #11
klausiSorry for the delay, but you have not listed any reviews of other project applications in your issue summary as strongly recommended here: http://drupal.org/node/1011698 .
manual review:
Comment #12
GetResponse commentedHi, thanks for feedback!
New issue fixed. PAReview.sh still seems fine. Please review again.
Regards,
GetResponse Team
Comment #13
greenrover33 commentedFunction attribute definitions are missing:
http://drupal.org/node/1354#functions
getresponse_comment_insert()
Those lines seams not to be used:
$name = urlencode($comment->name); /* nazwa */
$mail = urlencode($comment->mail); /* mail */
if (!getresponse_is_login() AND $comment_on AND !empty($webform_id)) {
Durpal modules use "&&" not "AND"
function getresponse_is_login() {
if ($GLOBALS['user']->uid == 0) {
The Drupal way would be
global $user
if ($user->uid == 0) {
$found = preg_match('#<' . $element_name . '(?:\s+[^>]+)?>(.*?)' . '#s', $xml, $matches);
To be on the secure side use:
preg_quote($element_name)
Constants shoukd be prefixed with module name
define('ELEMENT_CONTENT_ONLY', TRUE);
define('ELEMENT_PRESERVE_TAGS', FALSE);
protected function makeSafe($string) {
Why you not use check_plain() or
http://ch2.php.net/manual/en/function.htmlspecialchars.php
function curlRss() {
http://ch2.php.net/manual/en/function.file-get-contents.php
For better compatibility to shared hoster?
class GetResponseRSS {
Prefix all your methodes with public / protected / private
Comment #14
GetResponse commentedHi, again!
All new issue fixed. Please review again.
Regards,
GetResponse Team
Comment #15
greenrover33 commentedYou should place in module description (http://drupal.org/sandbox/GetResponse/1408798) and README.txt
a link about, what is getResponse.com
Then you can go on and further descripte what thats module provides.
I have had to start testing this module and read code to find out what this module is good for.
You schould write a step by step starter tutorial.
register at getResponse.com
create webForm
configure webform id in drupal admin settings
place drupal block
For block, a plain html fallback for people with disabled js would also be an realy nice feature.
Your are a little inconsequent with your quotes. Sometimes single and sometimes double quotes.
t('
Subscribe via Web Form
'),
t("(leave empty to disable)"),
variable_get('getresponse_styleid', 1);
Use constantes insted directly 0 and 1
getresponse_is_login()
should be renamed into
getresponse_is_logged_in()
to be more self explaining.
Why you do first GET then POST
Simply POST should to the job?!
Function attribute definitions are still missing:
http://drupal.org/node/1354#functions
example: (or see patch)
Better change f2 to something more saying like "rss"
Dont do that in form, it will never called. You have the getresponse_admin_validate() for error messages.
Dont access $_POST directly. Use form api.
Actualy you show the comment "Sign up to our newsletter!" checkbox all times.
But if admin has choosen "Anonymous posters may not enter their contact information" for the content type,
than there is no e-mail field for the visitor in comment form.
See patch for fix.
Addtional there could be a form validator which is checking if form e-mail was not given but newsletter checkbox set.
Comment #16
GetResponse commentedHi, thanks for feedback!
New corrections and suggestions have been added. Also we wrote a step by step tutorial in plugin section "Help" and in "README.txt" file.
People wth disabled js see a plain html fallback with the following text: "Please enable JavaScript to use the GetResponse service".
We changed your patch, now "Subscribe via comment" works only when option “Anonymous posters must leave their contact information” is set. In GetResponse email is required. Function getresponse_add_contact() must be used twice - first "GET" validate data, next "POST" adding visitor to GetResponse campaign.
Please review again.
Regards,
GetResponse Team
Comment #17
Milena commentedHello,
I've done quick look to you module.
.module file
hook_menu()
'access arguments' => array('administer getresponse'),You do not define hook_permission() and administer getresponse permission.
It allows only super user (uid = 1) to configure your module (because Drupal will not check permission). But no one else will have the rights to use it.
getresponse_is_logged_in()
Drupal has it's own function for checking it: user_is_logged_in()
getresponse_admin()
As far as I know there is not such thing as hook_admin(). You should probably add another description in function comment.
You should use l() function for creating links instead of pure html.
getresponse_block_view()
While having your block not cached there is a possibility to add scripts by drupal_add_js().
Please read http://api.drupal.org/api/drupal/modules%21block%21block.api.php/functio...
Your $style_id can have only two values. You can use else instead of elseif.
getresponse_form_comment_form_alter()
You should use t() while outputing something.
The hook is called hook_form_FORM_ID_alter() (or hook_form_FORM_BASE_ID_alter() you should check which one) no hook_form_comment_form_alter()
getresponse_comment_insert()
getresponse.feed.inc
You should probably use theme function instead of writing html code directly. theme_item_list would be a good choice in my opinion.
Overall
Please read about keeping consitency with quotes.
Summary
I'm changing it to needs work beacause of permission issue although I'm still pretty new to module reviewing so if someone thinks otherwise please, feel free to change into needs review. Other issues are not RTBC blocker in my opinion :)
Comment #18
Milena commentedComment #19
GetResponse commentedHi,
we've made some changes that you told us, but we can`t use function drupal_add_js(), because we need this javascript code in this place where we paste this code, because this genereate the subscribe form.
Regards,
GetResponse Team
Comment #20
cubeinspire commentedmodule file
1. Line 135: You cannot put html tags inside t(). You should concatenate tags and text separately.
Same on line 159. Check all t() functions for that same issue.
2. Line 281: As pointed on comment #17 you should use drupal_add_js on that same function instead. The path can contain variables and will load the javascript when the block is beeing viewed.
3. Line 315: You are initializing the variables webform_id et comment_on with values '' (empty string) and '0'. Then checking if true and if !empty. Those two tests will be always true.
PhP documentation for empty() and how PHP converts types during IF conditions.
install file
4. You should also delete the variables that are declared on line 296 of the .module file. Check also for other created variables on the module file.
Maybe you can store an array on that variable so you know its name and can delete it on uninstall.
Example to store array inside a variable:
variable_set("myvariable", array_values($form_state['values']['names_fieldset']));
feed.inc file
5. Files with classes should be referenced on the .info file.
6. There are strings without translation on lines 65 and 69.
Comment #21
cubeinspire commentedneeds work
Comment #22
GetResponse commentedHi,
New corrections have been added. Also we removed html tags from t() function.
We added references to classes in .info file and completed missing translations.
We can`t use function drupal_js because drupal_js paste the javascript code between "head" tags. We need this javascript code in place where we paste this now, because our javascript code render a webform to subscribe to GetResponse. When we use drupal_js() the webform will by show always on top of the page.
With reference to point 3 on comment #20, "You are initializing the variables webform_id et comment_on with values '' (empty string) and '0'. Then checking if true and if !empty. Those two tests will be always true." This two test will be not allways true e.g. this tests give true if comment_on will be 1 and webform_id will by '123456'. In our case when webform_id is '' and comment_on = 0 this two test give us false, and the code in if will by not executed.
With reference to point 4 on comment #20, "You should also delete the variables that are declared on line 296 of the .module file", we can`t delete this variables because this is drupal`s variable comment_anonymous_article
Please review again.
Regards,
GetResponse Team
Comment #23
gigabates commentedgetresponse.css
Some of the CSS rules are too generic and are likely to conflict with other themes and modules. There are likely to be other forms with IDs like #edit-actions. The use of !important in these rules makes them particularly evil.
Use class names / containers to make these more specific to your module's markup.
Comment #24
jphelan commentedComment #25
klausiThe CSS rules are surely not application blockers. Anything else?
Comment #26
GetResponse commentedHi, thanks for feedback!
We fixed coding-standart issues and removed too general CSS rules and we're ready for review.
Regards,
GetResponse Team
Comment #27
sreynen commentedComment #28
mpv commentedPAReview is still OK (no errors).
Two really minor considerations (the rest seems ok):
1. Maybe the description in the info file could be shorter? Something like Provides integration with GetResponse email marketing service maybe. Then again, the documentation says links are allowed and max length is 255 so maybe is just me, but it also says that one line descriptions are preferred.
2. I'm not sure about the RSS feed and links to your facebook / twitter / etc. accounts on the settings page. Again, I am not saying it's bad, I just don't know if there is apolicy about that, because it might be considered advertisement.
Comment #29
sreynen commentedGetResponse,
Signing all your comments with "GetResponse Team" makes it look like you're using a group account. That's currently disallowed on drupal.org. There's a discussion at http://drupal.org/node/1863498 about allowing organization accounts, but that would still require individuals to be doing all commits. Please confirm a single person is doing commits under your GetResponse account, or create separate accounts for others if that's not already the case.
Comment #30
GetResponse commentedHey, thanks for feedback!
We always write as team - this just have habit because we working as a team. Earlier it could look like we use one account but we didn't - only i use this account, now all developers have own accounts.
Can we ask for change project status to active or more informations about issues what we can fix.
Regards,
GetResponse Team
Comment #31
kscheirerIn getresponse_admin_validate() you're using is_numeric() - be aware that this will return true for all numeric values, including floats. You probably want ctype_int() or something else if you want to ensure positive integer values.
Since you're altering the comment form as well, you might want to let your users know on the project page. Or perhaps that's already clear because they are using GetResponse - I don't know much about that service.
Those are pretty minor issues though, marking RTBC from me.
Comment #32
pawelmaslak commentedHey,
we fixed this issue, now we accept only integer value. Please confirm did we have removed all the issues?
Regards,
GetResponse Team
Comment #33
mlncn commentedNice work, team!
I gave the GetResponse account (Peter Gzela) project maintainer access, and he can grant other developers all powers in this and other projects he creates. The maintenance done in their own names will count favorably toward individual applications should you choose to make them.
Comment #34
klausi@mlncn Please use the approval template from https://groups.drupal.org/node/184389#promote
Thanks for your contribution, GetResponse!
I updated your account to let you promote this to a full project and also create new projects as either a sandbox or a "full" project.
Here are some recommended readings to help with excellent maintainership:
You can find lots more contributors chatting on IRC in #drupal-contribute. So, come hang out and get involved!
Thanks, also, for your patience with the review process. Anyone is welcome to participate in the review process. Please consider reviewing other projects that are pending review. I encourage you to learn more about that process and join the group of reviewers.
Thanks to the dedicated reviewer(s) as well.