Posted by profix898 on June 6, 2007 at 9:34pm
14 followers
| Project: | Drupal core |
| Version: | 7.x-dev |
| Component: | poll.module |
| Category: | feature request |
| Priority: | normal |
| Assigned: | Gurpartap Singh |
| Status: | closed (won't fix) |
| Issue tags: | Usability |
Issue Summary
This patch adds an optional 'description' field to polls. At the moment a poll consists of a title and the voting options. However in some cases you want to provide an additional description (e.g. whats the poll about, its motivation, etc.).
The patch was initially created a few weeks ago and updated to HEAD, but its difficult to test/review as long as the poll.module is broken ...
| Attachment | Size | Status | Test result | Operations |
|---|---|---|---|---|
| poll_description.patch | 3.16 KB | Ignored: Check issue status. | None | None |
Comments
#1
This is a much needed feature, IMO. It allows people to provide some context with polls.
The code looks nice and simple. I've to go right now but passing
FALSEtocheck_markupcan be very dangerous (security). I'll have to verify that later on but already wanted to show support for this patch.I encourage others to review the security implications of this patch as well. I want at least one other person to have a close look at it.
#2
Marked http://drupal.org/node/65985 as a duplicate of this bug... it was earlier, but chances are that you'll actually follow through with it, which I didn't. ;) Might check and see if Dries's concerns in that issue are still an issue with your patch though; they look kind of similar.
#3
Regarding
check_markup()the same call (with $check=FALSE) is used in node.module as well to filter body/teaser innode_prepare(). Whats different here? I thought access check was performed innode_access()before thehook_view()is even called. But I will take a closer look at it, too.#4
BTW: A patch for 'broken' poll module is available in a separate issue (http://drupal.org/node/149879).
#5
Previous patch was missing one argument in hook_theme. The description is only displayed in page view (vote form and results) and the block, but it is not part of the teaser. Should it be added to the teaser as well? Not sure this makes sense ...
Here is an updated patch containing the fixes to poll module (from http://drupal.org/node/149879) and the description feature. Sorry! I dont have time to manually separate them now, but I will happily reroll this patch once the 'broken' poll patch is in.
#6
Merging both patches is OK for me.
* Using Garland, the description is printed in small gray text. I think it should use a regular font style.
* I haven't looked at your check_mark() calls yet but it is not because user.module calls it in one particular way, that it is OK to do the same. This needs to be studied and tested carefully. We once had a remote execution exploit because users could execute PHP code (using the PHP input format). The reason was that we didn't check the user's permissions on preview/submission of the content. check_mark() got a new parameter that day, and it has to be carefully used in cases where you can preview certain content. If not, everyone with the 'create new poll' permission would be able to execute PHP code ...
I think this is a good patch, but you need to be 200% confident about the security implications, and we'll want to fix that CSS glitch.
#7
Thanks Dries for your comments. I'm marking this CNW to ...
check_markup()stuff to understand why also node.module calls it with$check = FALSEand to find out if there are any security implications.Expect a new patch in a few hours ...
#8
Here is a new patch. I changed the description field to use '.poll-description' as css class and added this to poll.css (only a bottom-margin to put in some space between the description and the vote form).
Regarding
check_markup():$form['body_filter']['format'] = filter_form($node->format);only provides input formats for selection in the node form the user has permission to access. If the user is allowed to access php-filter he/she may of course do so even in preview.check_markup()calls are both called from hook_view and at this time we cant validate the input format against the current user, because it is not necessarily the author of the poll. Thats the reason to call with$check = FALSEand also the reason whynode_prepare()uses the same arguments.check_markup()and validate if the selected input format is allowed for the author. But actually thats double checking, as this can only happen if someone (or a module) modifies the input format after the node for is submitted (or modifies the input format selector).I might not have the eye for security in this context, but from what I see it should be save to use check_markup() as I did. I'd still encourage someone else to verify. Maybe someone of the security team!?
#9
... still needs review ...
#10
six months later this no longer applies. Could probably slip into D6 as a usability improvement.
#11
I didnt have time for thorough testing (maybe tomorrow), but here is a patch for latest HEAD. Comments are welcome ;)
#12
This patch adds a string, so bumping it to 7.x.
(Plus, the patch does not properly apply for me anyway.)
#13
Not because it adds a string, but because it modifies behavior. Make sure to get this in poll module early in D7.
#14
#15
Rewritten patch to include generalized body field flow. I know I'm killing extra kitten in first change(that's a bug).
#16
Anyone interested in patch review trade? (with equivalent patch size :)
#18
The last submitted patch failed testing.
#19
#20
Patch looks good to me (except for the RSS issue, but that might just be my ignorance :) ).
function poll_nodeapi_rss_item($node) {$teaser = '';
if (is_array($node->choice)) {
foreach ($node->choice as $k => $choice) {
if ($choice['chtext'] != '') {
$teaser .= '* ' . check_plain($choice['chtext']) . "<br />";
}
}
}
$node->teaser = $teaser . $node->teaser;
}
Should we add additional tests to poll.test for this change?
#21
You missed to test the block.
And actually, the block is broken after the fields stuff went into core.
#22
Are any of the patches suitable for D6, or should I give up on the notion of finding a solution for adding a poll description in a D6 implementation?
#23
If we convert polls to fields, we don't need this patch anymore and polls could be used in conjunction with other node types as well. Perhaps that's a better way?
#25
In the mean time this does not seem to go anywhere.
I tried to add a text field to a poll, for providing comment and context (in D6.17 using CCK).
The field is added alright but in the wrong place. The text appears above the results, instead of below.
Rearranging the fields does not help.
I checked various templates but this does not look encouraging. So polls seem to behave in a rather non-Drupalesque fashion :o)
Update:
A very basis workaround is to enable comments, put your deliverables there, and set the comment options to read-only. This could work for some cases.
#26
This request is made obsolete by fields in core.
Re #25:
I'm guessing you need to adjust the display settings for the field you added ("Manage display" tab, e.g. admin/structure/types/manage/poll/display), not the fields settings ("Manage fields" tab).
#27
Hello, don't know if this issue got any final solution over the last 4 years, but I have bumped into this problem just now.
By accident I discovered the Body Field Label option that is rather hidden. "To omit the body field for this content type, remove any text and leave this field blank." So I figure on filling it out you should get a body field, but I don't.
I did check the manage fields tab. This is under admin/content/types/poll/fields, the suggested, admin/structure/types/manage/poll/display in # 26 doesn't go anywhere. In this list of fields I can see that the Label is Poll-body and the Name (?) is Node Module form (¿so is it poll or node?), there is nothing that can be set there so I understand with this it should just appear in the create a poll page, but it doesn't.
I had been working with a self-created "description" field, which does appear and can be configured. But this field disappears from the page after voting when using ajax-poll. This is probably because ajax-poll does not take custom fields in account. Had been breaking my head over this quite a while and thought the body field label would be the solution...
The patch from #15 is from 2009, I suppose that's not valid anymore and I don't dare to just try it out.
And what the heading of this issue says is not very reassuring, "The patch was initially created a few weeks ago and updated to HEAD, but its difficult to test/review as long as the poll.module is broken ..."
Is the patch from the heading the same patch as #15 or a new "final" one? And is the patch what has been applied to HEAD or should it be used additionally? And in any case, do I have to understand that this CORE module is (still?) simply broken anyway?
#28
O sorry, @aaronbauman now I see you are talking about Manage Display (?) instead of Manage Fields. However, that doesn't change that admin/structure/types/manage/poll/display is not reachable. Are you talking D7? And is "This request is made obsolete by fields in core." also about D7? If so, whatabout poll in D6?