Closed (fixed)
Project:
Drupal.org security advisory coverage applications
Component:
module
Priority:
Normal
Category:
Task
Assigned:
Unassigned
Reporter:
Created:
11 Jun 2012 at 06:49 UTC
Updated:
10 Aug 2012 at 06:41 UTC
Jump to comment: Most recent file
Comments
Comment #1
rogical commentedManual review:
Comment #2
Jeffrey C. commented1. This module allows redirects based on URL parameter, for example, user/login?redirect=http://www.google.com, not sure if LoginToboggan provides this function.
2. No, I believe there are many users out there who just want a simple and easy way of achieving non-Drupal redirects, not a whole lot module with fancy functions.
3. Should I provide instructions in README.txt or should I implement hook_help()?
4. Done. Also removed 7.x-1.0 branch.
Thanks for your quick review :)
Comment #3
Jeffrey C. commentedComment #4
rogical commentedinstructions on your project and a README.txt is always very good, hook_help() ofcourse is welcome.
Comment #5
Jeffrey C. commentedThank you. Working on it. Btw I made a few commits and now I've deleted 7.x-1.x branch these commits still appear in my sandbox "View all commits". I'm a beginner to Git, so wondering if there's a Git command that could be used to delete those commits on Drupal.org?
Comment #6
Jeffrey C. commentedComment #7
rogical commentedI think you've misunderstood, you can remove version in info file, because it will be added automatically when release.
You should put your code into a branch, Moving from a master to a major version branch.
Old commits history is no harm, just leave it.
Comment #8
Jeffrey C. commentedGot it.
Comment #9
Jeffrey C. commentedFinished on commit 2cc8f5c. Added hook_help() implementation and README.txt. Also moved from master to 7.x-1.x. Anything now?
Comment #10
skipyT commentedHi,
I think this module is too short. I tried once with a similar module 2 weeks ago and it wasn't accepted. You should have at least 120 lines of code.
Some things are in plus there: you don't need to implement hook_install only to show the message that module was enabled. Drupal is doing that for you.
Also I don't understand why you need the status setting there. I think you should redirect the page automatically if and only if the redirect is not empty.
Also I would filter the _GET parameter for xss attacks. It is now a big security problem, cause it will not affect your site but the external one could be affected.
Also you should modify the module's weight to be a huge number (else all the user login form submits added by other modules with a bigger weight wil not be executed due to your drupal_goto.) Or another way to do this I think is to register a drupal shutdown function during your submit, which will make the redirect for you.
Comment #11
skipyT commentedAlso I forgot to mention, that your project page is only one line long. You should try to follow the tips for a great project page: http://drupal.org/node/997024.
Comment #12
Jeffrey C. commentedHi,
Thanks for your quick reply. Yes this module is very short, that's why I would like to publish it. It is lightweight and is useful for users that only want this simple function not a whole lot module, like I've mentioned earlier. The reason I added "status" option is to prevent the module from functioning when the parameter name is illegal (contains numeric, or left empty), like the SMTP Authentication Support module. As for the XSS concern, I will add a few lines to make sure XSS will be filtered. I will also remove the hook_install() implementation. And, can you please elaborate the "module weight" thing a little? I don't quite understand what you mean.
Comment #13
skipyT commentedHi,
Drupal is calling the implemented hooks from the modules depending on the module weight. Every module is having a numeric weight, stored in the 'system' table in the database. If you have several modules implementing the same hook, the hook calls are ordered by the module's weight.
Anyway, this is one of the solutions, I think the solution to register a Drupal shutdown function is better.
Comment #14
Jeffrey C. commentedThank you. Working on it.
Comment #15
Jeffrey C. commentedSorry, but could you explain how to implement the drupal_register_shutdown_function function? Should I call it in my submission function, where now I'm using to perform the redirect?
Comment #16
skipyT commentedYes, and you should send the url as a parameter to that function.
You should write something like: drupal_register_shutdown_function('my_shutdown_function_for_redirect',$url);
and you write that function to make the drupal_goto.
Comment #17
Jeffrey C. commentedOk got it. Working on it.
Comment #18
Jeffrey C. commentedAll done. Anything else?
Comment #19
Jeffrey C. commentedAnyone there?
Comment #20
Rahul Singh commentedManual Review:
In manual review I found only one issue.
1) Please remove t() from login_redirect_menu() function it is not neccessary to use t() in hook_menu().
Automated Review:
There are still files other than README.txt in the master branch, make sure to remove them. See also step 5 in http://drupal.org/node/1127732
Review of the 7.x-1.x branch:
This automated report was generated with PAReview.sh, your friendly project application review script. You can also use the online version to check your project. You have to get a review bonus to get a review from me.
Please try to resolve http://ventral.org/pareview/httpgitdrupalorgsandboxlegendm330661626862git
Comment #21
Jeffrey C. commentedThank you. I'm a little busy these days, will try to meet the above standards and get back as soon as possible.
Comment #22
Jeffrey C. commentedAll done. Any other things now?
Comment #23
dev001 commentedManual review - issues in login_redirect.module file:
1. You don't have description for the hooks you created, follow the link below and add description.
http://drupal.org/node/1354#hookimpl
2. In function login_redirect_help($path, $arg) - Use theme('item_list', ...) to create list markup, instead of ul, li.
Comment #24
mondrakeHello legendm33066,
I am a fellow applicant and have been reviewing your project towards geeting a review bonus for my application.
It's my first review so please take the following in this perspective.
Automatic review:
- ventral PAreview is clean
Manual review:
'needs work' from my POV:
- lines 10 and 19: menu items 'admin/login_redirect' and 'admin/login_redirect/settings' are too high level within the administration menu. In particular, 'admin/login_redirect' just presents a page with a link to the settings form - it seems redundant to me.
You may consider to remove the first menu item (and its callback login_redirect_main_page() ), and change the
second to 'admin/config/system/login_redirect'. This would place your configuration under a more appropriate section.
- follow up placing a
configure = admin/config/system/login_redirectline entry in your login_redirect.info file- instead of
$_GET[$parameter_name], you may want to use Drupal functiondrupal_get_query_parameters(), which returns an array of elements you can then check against- implement hook_install and hook_uninstall in a separate login_redirect.install file:
In the hook_install implementation you can place a drupal_message() with recommendation to visit configuration (waht you're currently doing in login_redirect_main_page())
In the hook_uninstall, mind about deleting the variables that you set via the configuration.
- in README.txt
This will be managed by the installation process once your project is full, so you may instead consider just
Food for thought
- you may consider to implement hook_permission() and create a role that administrators could use to identify which users could or could not use the feature
- you may consider to extent the logic so to pass additional values to your destination - e.g. destination is something like
?destination=http://www.mydomain.com&passthrough_user=!!DrupalUserId!!becomes a call to
http://www.mydomain.com?passthrough_user=1Just an idea though.
Just for curiosity - what would be the practical usage of this? Maybe some example in the project page would help.
Overall, looks like 'needs work' for me.
Regards
mondrake
Comment #25
Jeffrey C. commentedThank you so much for both of your detailed reviews. I consider my hooks rather standard so did not add any description. As for the rest, all done.
Comment #26
Jeffrey C. commentedSeems there's no tasks left. Should I report this to a moderator or someone to get the application approved or something?
Comment #27
skipyT commentedI think you should make some review for the other projects applications to get some review bonus. You shouldn't wait for help from others if you not provide any :).
Comment #28
Jeffrey C. commentedOk thank you new here don't know anything :)
Comment #29
mitchell commented> 1. This module allows redirects based on URL parameter, for example, user/login?redirect=http://www.google.com, not sure if LoginToboggan provides this function.
It probably does, but no problem. It's your first contribution. :)
> 2. No, I believe there are many users out there who just want a simple and easy way of achieving non-Drupal redirects, not a whole lot module with fancy functions.
I agree with this logic for the most part, except I'm personally a Rules fan (and a maintainer along with klausi), so I personally would have went with Rules. And for you, I did! :) See the attached example that accomplishes the goal of your module with only 1 dependency.. Rules! ...well, it has a dependency on Entity API, but that doesn't count ;)
All you need to do is import each one (in the component and rule import pages). The reaction rule is configurable to take any path, and it currently redirects to drupal.org by default. It doesn't force the redirect if the user has a predefined destination parameter, however that can be changed in the component configuration screen.
While I acknowledge that this submission uses Drupal's API well, I would personally prefer not to have this as a full project. There are already a lot of projects and at some point we should clean out the obsolete, deprecated, abandoned, etc projects. I'm not saying yours would end up becoming one if this became a full project, but if you could hold off on full project permissions, I would be happy to review your next project. Thank you for contributing!!
Please let us know how you would like to move forward with your application, and if you have any questions about the attached code, check out the Rules handbook or request support in Rules' issue queue. Thanks again!
Comment #30
Jeffrey C. commentedHello! Thank you for your review. Just a quick question, though, does the export you provide allows redirects to actually the URL parameter supplied? Haven't really test it out but it seems that it only works with a predefined URL.
Comment #31
Jeffrey C. commentedLet me just state my intention with this module here. I'm using Drupal as an authentication system, or to be exact, a user control system. I'm pulling all the user data and storing it as well into Drupal, thanks to its complete and powerful structure. So just trying to build a quick solution to this, and some other day I woke up with this thought, "hey if I can find a lot of similar questions online like for instance StackExchange, but no one is actually giving solution, doesn't that mean there's a bunch lot guys out there who's thinking the exact same thing as me and getting stuck?", there, that's why I'm posting a project application here. Not sure if your Rules thing work, though, at least so far I've tested, it only works with a predefined URL.
Comment #32
mitchell commented> does the export you provide allows redirects to actually the URL parameter supplied?
You're right, it's predefined.. But it is configurable and also easily extendable. So, I'll change it to get the URL parameter and let you know.
Until then, other reviews requested.
Comment #33
Jeffrey C. commentedDid some reviews and commenting. Not sure if those could earn a review bonus tag, though. Please remove it if I didn't do it right.
http://drupal.org/node/1673410#comment-6206284
http://drupal.org/node/1673988#comment-6206282
http://drupal.org/node/1513202#comment-6206294
http://drupal.org/node/1611782#comment-6206306
http://drupal.org/node/1502880#comment-6206316
http://drupal.org/node/1672796#comment-6209132
Comment #34
mitchell commented@legendm33066: Adding URL and session header parameters to Entity API has been in the back of my mind for a little while, but this motivated me at least to file an issue to #1675020: Add query string property for the current page request. That'd be a direction worth investigating, or alternatively, the Rules URL Arguement. What do you think?
The review bonus tag will put this on klausi's list; he's a good person to get feedback from, especially on stuff like this.
Comment #35
Jeffrey C. commentedThat'd be good. However I still insist on this module being reviewed and hopefully it will be approved and published on Drupal.org. You might want to take a look at Require Login, which I believe can also be done with Rules, but Rules, in both that case and this case, seems like a more complex solution.
What I want to say is, sure this of course can be done using Rules, but is it really necessary while you can just use a few lines of code and be done with it? Furthermore, I'm planning to add some more features like token validation and session implementation, which I believe can be easily done with a custom module not a non-specific module like Rules with limited extendability.
That's what I figured so far and it doesn't make much sense, at least from my point of view, to, again, use a whole lot module like Rules, since it actually gives a easy start but makes it very difficult to extend later. If you have a different idea, well, I'm all ears.
Comment #36
Jeffrey C. commentedIf there's no more activity, review or comments within 5 days, starting from the last reply was added, I shall put the status to RTBC. Thank you all for your helpful reviews.
Comment #37
klausiRemoving review bonus tag, you have not done any manual review, you just posted the output of an automated review tool. Please read through the source code of other projects and report any issues you find. And don't forget to add your manual reviews to your issue summary.
Comment #38
Jeffrey C. commentedComment #39
klausiDon't RTBC your own issues, see http://drupal.org/node/532400
Comment #40
varunmishra2006 commentedThere are some errors according to http://ventral.org.
Make sure you have all of the things are as mentoined in
http://ventral.org/pachecklist
Please check the review i had done here
http://ventral.org/pareview/httpgitdrupalorgsandboxlegendm330661626862git
Comment #41
klausiMinor coding standards are not application blockers, please do a full review.
Comment #42
iamwinner001 commentedManual Review
It seems that everything is done with this module. Marking this as RTBC. But please also make sure you create a documentation page for this module, and even better correct the minor coding inconformity as per #40.
Comment #43
iamwinner001 commentedForgot to change the status.
Comment #44
mitchell commentedThanks again for your contribution, legendm33066!
I updated your account to let you promote this to a full project and also create new projects as either a sandbox or a "full" project.
Here are some recommended readings to help with excellent maintainership:
You can find lots more contributors chatting on irc in #drupal-contribute. So, come hang out and stay involved! Thanks again, and good luck! :)
Edit: Removed accidental, bad irc channel recommendation.
Comment #45
iamwinner001 commentedIf you're looking for a maintainer, let me know ;)
Comment #46
Jeffrey C. commentedThank you! And thank everyone who has posted reviews and opinions here!