This module makes it possible to enrich content with data from an external SPARQL endpoint, based on fields or any other data available. Since it is entirely loaded client side (with JSONP), it is very lightweight, but it can still be very flexible.
Since things are injected from javascript, I have taken the precautions that you both have to have extended permissions ('restrict access' => TRUE) and added a check plain on the raw server data returned. That's about as sure as I can get without dropping some functionality. Hope that passes the security test :)
I have added extensive documentation linked up from the project page, and it is also available in the help section when you install the module.
Project: http://drupal.org/sandbox/eiriksm/1409172
GIT: git clone --branch master http://git.drupal.org/sandbox/eiriksm/1409172.git jsonp_sparql
For Drupal 7.
Review of other projects:
http://drupal.org/node/1458302#comment-6003342
http://drupal.org/node/1522378#comment-6000334
http://drupal.org/node/1512124#comment-5901284
...and
http://drupal.org/node/1546758#comment-6055320
http://drupal.org/node/1273586#comment-6055374
http://drupal.org/node/1242758#comment-6055536
| Comment | File | Size | Author |
|---|---|---|---|
| #5 | Screen-Shot-2012-03-02-at-9.44.jpg | 215.39 KB | alex dicianu |
| #3 | Review.txt | 1.43 KB | darrell_ulm |
Comments
Comment #1
misc commentedWelcome with your application.
It's going to take some time to get a full review, but hopefully you will get as soon as possible.
Anyhow, it seem that you included third party code (js-file), you should not have that in projects on drupal.org: http://drupal.org/node/422996
Comment #2
eiriksmThanks for that tip.
Now updated with instructions in README, libraries dependency and checking of installed plugin.
Project: http://drupal.org/sandbox/eiriksm/1409172
GIT: git clone --branch 7.x-1.x http://git.drupal.org/sandbox/eiriksm/1409172.git jsonp_sparql
Link to last PAReview: http://ventral.org/pareview/httpgitdrupalorgsandboxeiriksm1409172git
For Drupal 7.
Comment #3
darrell_ulm commentedJust a few coding issues. See the attached file with the scan results.
Please see documentation standards and coding standards. The documentation is not following convention:
Example:
This needs to have a full documented header. Same throughout.
See:
http://drupal.org/coding-standards
http://drupal.org/node/1354
Comment #4
eiriksmThanks for that!
Have added some more documentation, fixed the XHTML style and some other small cleanups. But the pareview warning about filter_xss or check_plain just does not seem to go away, no matter where i put the check. And obviously it is not going to be dangerous either, since it is an internal link, in plain text right there.
Thanks again for reviewing.
Repeat for easy access of the links:
Project: http://drupal.org/sandbox/eiriksm/1409172
GIT: git clone --branch 7.x-1.x http://git.drupal.org/sandbox/eiriksm/1409172.git jsonp_sparql
Link to last PAReview: http://ventral.org/pareview/httpgitdrupalorgsandboxeiriksm1409172git
For Drupal 7.
Comment #5
alex dicianu commentedHi,
I am trying to install your module and I'm getting the following warning.
The JQuery JSONP plugin must be installed in order to do any client side queries. Please go to Status Report for instructions.In the .install file you check for the 2.2.0 version. I downloaded the latest version which is 2.2.1. The name for the 2.2.1 version is a bit different also. You should fix this with a more robust check.
I've tried to execute a basic sparql query from dbpedia, but I encountered a 404 error. See attachment screenshot. I don't have a proxy.
.module file line 162 ... :)
Comment #6
alex dicianu commentedComment #7
eiriksmThanks for that!
Have added even more install instructions, now supporting newer versions of the library and more logical error message instead of dsm('damn'). Regarding your error, you have omitted the question mark in the endpoint, so I have updated the description to more clearly stating how to format the endpoint URL.
Thanks again for reviewing.
Repeat for easy access of the links:
Project: http://drupal.org/sandbox/eiriksm/1409172
GIT: git clone --branch 7.x-1.x http://git.drupal.org/sandbox/eiriksm/1409172.git jsonp_sparql
Link to last PAReview: http://ventral.org/pareview/httpgitdrupalorgsandboxeiriksm1409172git
For Drupal 7.
Comment #8
eiriksmAlso, i just realized that projects often have a lot of info in their README or help sections, but are not as thorough on the project page. So I have added detailed installation instructions and a simple, but detailed configuration walkthrough to the project page.
Thanks again for testing!
Comment #9
luxpaparazzi commentedParareview did not mention any issues.
What is SPARQL and what does a SPARQL endpoint do?
It would be nice having some basic information and maybe an external link at your project page.
You should mention "Implements hook_uninstall()." at the beginning of doc-comment.
'page callback' => '_jsonp_sparql_ajax_test'Page callbacks should be public functions, so you should remove "_"
Consider putting the following code into a template-function or into event template-file, see http://api.drupal.org/api/drupal/includes!theme.inc/function/theme/7
Comment #10
luxpaparazzi commentedThe response time for a review is now approaching 4 weeks.
Get a review bonus and we will come back to your application sooner.
See: http://drupal.org/node/1410826
You could for example start by evaluatating my own project:
http://drupal.org/node/1302786
Comment #11
eiriksm@luxpaparazzi
Thanks for reviewing.
I agree with you on all issues, although they are small. I was actually thinking about adding the theme functions anyway, so this stuff can be overridden.
The repository is now updated with the latest changes you proposed, and the project page includes some links and description about SPARQL.
Thanks again for you feedback, and I appreciate the fact that the review queue is long. I have planned to get to reviewing other projects, but the time is not always on your side (I am sure you know what I mean).
Comment #12
eiriksmRepeat for easy access of the links, since I also need to change status:
Project: http://drupal.org/sandbox/eiriksm/1409172
GIT: git clone --branch 7.x-1.x http://git.drupal.org/sandbox/eiriksm/1409172.git jsonp_sparql
Link to last PAReview: http://ventral.org/pareview/httpgitdrupalorgsandboxeiriksm1409172git
For Drupal 7.
Comment #13
eiriksmUpdated with review bonus links.
Comment #14
klausiReview of the 7.x-1.x branch:
This automated report was generated with PAReview.sh, your friendly project application review script. You can also use the online version to check your project. Get a review bonus and we will come back to your application sooner.
manual review:
Removing review bonus tag, you can add it again if you have done another 3 reviews of other projects.
Comment #15
eiriksmThanks a lot for reviewing. Your review is very helpful!
I have some comments on some of the points though:
3. I agree with this, and understand the concern for php_eval(). But I wanted to include it for maximum flexibility (and I needed it for the project the module was developed for) so it is included as an option. And, as you say, the access is thoroughly checked (JSONP SPARQL flags restricted access, and php_eval is a permission independent of this and also states that this is dangerous. I also include a warning in the description, if you are using this.) So keeping it for now (since you also say it is OK). After all, block module uses it as well. :)
4. That is actually not true. php_eval only exists if php module is enabled (it is defined in php.module). And the !empty($access_php) will always validate for user 1, even though php module is not enabled (I tested!). A WOD would be the result if I did not have this check. I did double check this, and can confirm that the check really is necessary. I did however change it to module_exists('php'), as it is for example used in the block module.
12. If I don't check for access here, there will be PHP notices for people with block edit access (that for example wants to change the title of the block) when they save the block. These notices will result in overriding the variables with nothing, and breaking the block. So keeping this as it is, as I really think it is needed.
Please let me know if any of my comments are wrong. Other than that, now updated with all the points listed. Thanks for spotting them! Also found another BOM in the other js file (as you pointed out for jsonp_sparql.js in point 7), and fixed that as well.
Comment #15.0
eiriksmReview bonus
Comment #16
eiriksmAdding review bonus tag.
Comment #17
klausimanual review:
But otherwise looks RTBC to me. Removing review bonus tag, you can add it again if you have done another 3 reviews of other projects.
Comment #18
patrickd commentedThanks for your contribution and welcome to the community of project contributors on drupal.org!
I've granted you the git vetted user role which will let you promote this to a full project and also create new projects as either sandbox or "full" projects depending on which you feel is best.
Thanks, also, for your patience with the review process. Anyone is welcome to participate in the review process. Please consider reviewing other projects that are pending review. I encourage you to learn more about that process and join the group of reviewers.
As you continue to work on your module, keep in mind: Commit messages - providing history and credit and Release naming conventions.
Thanks to the dedicated reviewer(s) as well.
Comment #19
eiriksmThanks!
And thank you for the very helpful process it has been to have the code reviewed. I have learned a lot, and changed a couple of habits to the better :)
Thanks to the helpful reviewers also!
Comment #20.0
(not verified) commentedUpdated issue summary.