Closed (won't fix)
Project:
Drupal.org security advisory coverage applications
Component:
module
Priority:
Normal
Category:
Task
Assigned:
Unassigned
Reporter:
Created:
12 May 2012 at 16:07 UTC
Updated:
16 Nov 2012 at 00:14 UTC
Jump to comment: Most recent file
Comments
Comment #1
patrickd commentedwelcome,
You are working in the "master" branch in git. You should really be working in a version specific branch. The most direct documentation on this is Moving from a master branch to a version branch. For additional resources please see the documentation about release naming conventions and creating a branch in git.
As installation and usage instructions are quite important for us to review, please take a moment to make your project page follow the tips for a great project page. Also create a README.txt that follows the guidelines for in-project documentation.
All functions should be prefixed with your module/theme name to avoid name clashes!
while waiting for an in-depht review of your module you can start out fixing some coding style issues detected by automated tools:
http://ventral.org/pareview/httpgitdrupalorgsandboxstuchl4n3k1443930git
We do really need more hands in the application queue and highly recommend to get a review bonus so we can come back to your application sooner.
regards
Comment #2
stuchl4n3k commentedThank you very much for your review - I'm new to this system, but I'm gonna' fix all ASAP.
EDIT:
Comment #3
pgogy commentedHello
Ventral says
You need to switch to the master tag in git, delete everything, then resubmit just a nice Readme.txt
Lots of code issues (from ventral) - see later comment attachment.
Code comments
Some of the #value in site_diff_form could be #default_value
in site_diff_form_submit use form_state['values'] not form_state['input'] (values is checked as safe)
Comment #4
patrickd commentedPlease do not paste the full results into the issue, as giant ‘wall-of-wrong’ posts are extremely demotivating to applicants.
Also note that many of the issues found are minor and should not be required for approval, therefore please do not insist on having them fixed and do not switch the issue to needs work if there are no major issues found.
Automated reviews may point you to possible security issues - what does not mean they are really security issues - note that it´s a common case that automated reviews can have false positives.
@pgogy as you can still edit your comment, please short it. A link or attachment with the report is enough. Although I've already outlined the issues of the automated report in #1.
Comment #5
pgogy commentedThe use of form_state['input'] is surely needing a fix? Isn't that insecure?
Sorry for posting the entire list, but it is what I've seen elsewhere, so I didn't know there was a netiquette for it.
Comment #6
stuchl4n3k commentedOK, branch master cleared as suggested.
Thank you pgogy for pointing out the form_state['input'] issue - it was a nasty debugging relict - although not a security issue IMO since no data are being persisted. Fixed.
As for the form #value cases - I really don't want users to change anything in there, so this option seems a right call to me.
Comment #7
pgogy commentedIt's hard to tell from any code, just being cautious :)
Comment #8
liam morlandThe Drupal Code Sniffer still finds many issues. I suggest you ensure a clean report from that at Coder Review module before submitting again for review.
Many of your files have trailing whitespace. Some text editors can be configured to remove this automatically on every save. Consider setting up your environment this way.
In theme_site_diff_form(), you have some hardcoded style attributes to set the background color. Please use a semantic class attribute and include a CSS file in your module.
In this code, only the info field is used, so only that field should be selected.
In site_diff_local_extract_variables(), I think you can use a regular placeholder for the IN() statement and pass an array of the values into that placeholder.
In site_diff_rest_connect(), $remote_user is always returned. $http_message is set with an error message, but nothing is done with it.
In site_diff_rest_extract_modules(), there is no need to set $data. Just return site_diff_rest_get(). Other functions similarly.
Comment #9
klausiClosing due to lack of activity. Feel free to reopen if you are still working on this application.
Comment #9.0
klausiProviding GIT clone cmd with proper branch.