Download & Extend

Add body field for Polls

Project:Drupal core
Version:7.x-dev
Component:poll.module
Category:feature request
Priority:normal
Assigned:Gurpartap Singh
Status:closed (won't fix)
Issue tags:Usability

Issue Summary

This patch adds an optional 'description' field to polls. At the moment a poll consists of a title and the voting options. However in some cases you want to provide an additional description (e.g. whats the poll about, its motivation, etc.).

The patch was initially created a few weeks ago and updated to HEAD, but its difficult to test/review as long as the poll.module is broken ...

AttachmentSizeStatusTest resultOperations
poll_description.patch3.16 KBIgnored: Check issue status.NoneNone

Comments

#1

This is a much needed feature, IMO. It allows people to provide some context with polls.

The code looks nice and simple. I've to go right now but passing FALSE to check_markup can be very dangerous (security). I'll have to verify that later on but already wanted to show support for this patch.

I encourage others to review the security implications of this patch as well. I want at least one other person to have a close look at it.

#2

Marked http://drupal.org/node/65985 as a duplicate of this bug... it was earlier, but chances are that you'll actually follow through with it, which I didn't. ;) Might check and see if Dries's concerns in that issue are still an issue with your patch though; they look kind of similar.

#3

Regarding check_markup() the same call (with $check=FALSE) is used in node.module as well to filter body/teaser in node_prepare(). Whats different here? I thought access check was performed in node_access() before the hook_view() is even called. But I will take a closer look at it, too.

#4

BTW: A patch for 'broken' poll module is available in a separate issue (http://drupal.org/node/149879).

#5

Previous patch was missing one argument in hook_theme. The description is only displayed in page view (vote form and results) and the block, but it is not part of the teaser. Should it be added to the teaser as well? Not sure this makes sense ...

Here is an updated patch containing the fixes to poll module (from http://drupal.org/node/149879) and the description feature. Sorry! I dont have time to manually separate them now, but I will happily reroll this patch once the 'broken' poll patch is in.

AttachmentSizeStatusTest resultOperations
poll_desc_broken.patch5.62 KBIgnored: Check issue status.NoneNone

#6

Merging both patches is OK for me.

* Using Garland, the description is printed in small gray text. I think it should use a regular font style.

* I haven't looked at your check_mark() calls yet but it is not because user.module calls it in one particular way, that it is OK to do the same. This needs to be studied and tested carefully. We once had a remote execution exploit because users could execute PHP code (using the PHP input format). The reason was that we didn't check the user's permissions on preview/submission of the content. check_mark() got a new parameter that day, and it has to be carefully used in cases where you can preview certain content. If not, everyone with the 'create new poll' permission would be able to execute PHP code ...

I think this is a good patch, but you need to be 200% confident about the security implications, and we'll want to fix that CSS glitch.

#7

Status:needs review» needs work

Thanks Dries for your comments. I'm marking this CNW to ...

  1. fix the css: I'm currently using the 'description' class to style the output, which is used for description of form fields. Creating a new 'poll-description' class or stg. will allow use to style the description of polls separatly and make it 'regular' by default.
  2. I will also take a close look at the check_markup() stuff to understand why also node.module calls it with $check = FALSE and to find out if there are any security implications.

Expect a new patch in a few hours ...

#8

Status:needs work» needs review

Here is a new patch. I changed the description field to use '.poll-description' as css class and added this to poll.css (only a bottom-margin to put in some space between the description and the vote form).
Regarding check_markup():

  1. $form['body_filter']['format'] = filter_form($node->format); only provides input formats for selection in the node form the user has permission to access. If the user is allowed to access php-filter he/she may of course do so even in preview.
  2. The check_markup() calls are both called from hook_view and at this time we cant validate the input format against the current user, because it is not necessarily the author of the poll. Thats the reason to call with $check = FALSE and also the reason why node_prepare() uses the same arguments.
  3. The only solution to ensure the correct input format even in hook_view is to introduce or replace the $check parameter with the uid. We could then pass the $node->uid into check_markup() and validate if the selected input format is allowed for the author. But actually thats double checking, as this can only happen if someone (or a module) modifies the input format after the node for is submitted (or modifies the input format selector).

I might not have the eye for security in this context, but from what I see it should be save to use check_markup() as I did. I'd still encourage someone else to verify. Maybe someone of the security team!?

AttachmentSizeStatusTest resultOperations
poll_desc_broken2.patch6.03 KBIgnored: Check issue status.NoneNone

#9

... still needs review ...

#10

Status:needs review» needs work

six months later this no longer applies. Could probably slip into D6 as a usability improvement.

#11

Status:needs work» needs review

I didnt have time for thorough testing (maybe tomorrow), but here is a patch for latest HEAD. Comments are welcome ;)

AttachmentSizeStatusTest resultOperations
poll_description.patch6.16 KBIgnored: Check issue status.NoneNone

#12

Status:needs review» needs work

This patch adds a string, so bumping it to 7.x.

(Plus, the patch does not properly apply for me anyway.)

#13

Version:6.x-dev» 7.x-dev

Not because it adds a string, but because it modifies behavior. Make sure to get this in poll module early in D7.

#14

Title:optional description for polls» Add body field for Polls
Assigned to:profix898» Gurpartap Singh

#15

Status:needs work» needs review

Rewritten patch to include generalized body field flow. I know I'm killing extra kitten in first change(that's a bug).

AttachmentSizeStatusTest resultOperations
Drupal_poll-body-field_149880.patch3.29 KBIdlePassed: 10268 passes, 0 fails, 0 exceptionsView details | Re-test

#16

Anyone interested in patch review trade? (with equivalent patch size :)

#18

Status:needs review» needs work

The last submitted patch failed testing.

#19

Status:needs work» needs review

#20

Patch looks good to me (except for the RSS issue, but that might just be my ignorance :) ).

  • I created a poll, then applied this patch. The "old" poll still behaved as expected (ie not broken).
  • Added a body field (by setting the title for the body field) to the poll and entered some content. Worked as expected.
  • I set RSS to publishing to "Title + Teaser". Based on looking through the code, I expected a bulleted list of possible poll answers (preceded by '*'). However, I did not see a difference in RSS output between "Title + Teaser" and "Full Text". Is this a bug or am I misunderstanding something? I did see the poll vote count in the RSS output, but no '*'.
    function poll_nodeapi_rss_item($node) {
      $teaser = '';
      if (is_array($node->choice)) {
        foreach ($node->choice as $k => $choice) {
          if ($choice['chtext'] != '') {
            $teaser .= '* ' . check_plain($choice['chtext']) . "<br />";
          }
        }
      }
      $node->teaser = $teaser . $node->teaser;
    }
  • Visually inspected the patch and could not find any problem.

Should we add additional tests to poll.test for this change?

#21

Status:needs review» needs work

You missed to test the block.

And actually, the block is broken after the fields stuff went into core.

#22

Are any of the patches suitable for D6, or should I give up on the notion of finding a solution for adding a poll description in a D6 implementation?

#23

If we convert polls to fields, we don't need this patch anymore and polls could be used in conjunction with other node types as well. Perhaps that's a better way?

#25

In the mean time this does not seem to go anywhere.

I tried to add a text field to a poll, for providing comment and context (in D6.17 using CCK).

The field is added alright but in the wrong place. The text appears above the results, instead of below.
Rearranging the fields does not help.

I checked various templates but this does not look encouraging. So polls seem to behave in a rather non-Drupalesque fashion :o)

Update:
A very basis workaround is to enable comments, put your deliverables there, and set the comment options to read-only. This could work for some cases.

#26

Status:needs work» closed (won't fix)

This request is made obsolete by fields in core.

Re #25:
I'm guessing you need to adjust the display settings for the field you added ("Manage display" tab, e.g. admin/structure/types/manage/poll/display), not the fields settings ("Manage fields" tab).

#27

Hello, don't know if this issue got any final solution over the last 4 years, but I have bumped into this problem just now.

By accident I discovered the Body Field Label option that is rather hidden. "To omit the body field for this content type, remove any text and leave this field blank." So I figure on filling it out you should get a body field, but I don't.
I did check the manage fields tab. This is under admin/content/types/poll/fields, the suggested, admin/structure/types/manage/poll/display in # 26 doesn't go anywhere. In this list of fields I can see that the Label is Poll-body and the Name (?) is Node Module form (¿so is it poll or node?), there is nothing that can be set there so I understand with this it should just appear in the create a poll page, but it doesn't.

I had been working with a self-created "description" field, which does appear and can be configured. But this field disappears from the page after voting when using ajax-poll. This is probably because ajax-poll does not take custom fields in account. Had been breaking my head over this quite a while and thought the body field label would be the solution...

The patch from #15 is from 2009, I suppose that's not valid anymore and I don't dare to just try it out.

And what the heading of this issue says is not very reassuring, "The patch was initially created a few weeks ago and updated to HEAD, but its difficult to test/review as long as the poll.module is broken ..."

Is the patch from the heading the same patch as #15 or a new "final" one? And is the patch what has been applied to HEAD or should it be used additionally? And in any case, do I have to understand that this CORE module is (still?) simply broken anyway?

#28

O sorry, @aaronbauman now I see you are talking about Manage Display (?) instead of Manage Fields. However, that doesn't change that admin/structure/types/manage/poll/display is not reachable. Are you talking D7? And is "This request is made obsolete by fields in core." also about D7? If so, whatabout poll in D6?