Closed (won't fix)
Project:
Drupal.org security advisory coverage applications
Component:
module
Priority:
Normal
Category:
Task
Assigned:
Unassigned
Reporter:
Created:
25 Aug 2012 at 10:59 UTC
Updated:
26 Mar 2013 at 17:27 UTC
This Drupal 6 module can be used to send discount coupons for best customers in Ubercart stores.
To use this module coupon code should be configured and generated using any suitable ubercart discount modules (eg: Ubercart Discount Coupons or Ubercart Discounts (Alternative) etc).
This module list out, stores best customers based on their purchased order. From there admin can enter the coupon code and can send to selected users.
![]()
Project Page: http://drupal.org/sandbox/josephanoop/1752834
| Comment | File | Size | Author |
|---|---|---|---|
| screenshot.png | 44.05 KB | josephanoop |
Comments
Comment #1
mayank-kamothi commentedHi,josephanoop
I have checked your module code and find some issue with code like
For more review of your module you can see it here :
http://ventral.org/pareview/httpgitdrupalorgsandboxjosephanoop1752834git
Mayank Kamothi
Comment #2
josephanoop commentedHi mayank-kamothi ,
Thank you for reviewing this module, I have created the 6.x branch and cleanup the code according to http://ventral.org.
http://ventral.org/pareview/httpgitdrupalorgsandboxjosephanoop1752834git
thanks
Comment #3
suhani.jain commentedHi josephanoop,
1)Please correct git link it should be 'http://git.drupal.org/sandbox/josephanoop/1752834.git' in the issue summary.
Manual review
Always use user-facing text in t()
1)In .module file - use t() with drupal_set_message .Please refer http://api.drupal.org/api/drupal/includes!bootstrap.inc/function/drupal_...
2)Variable name should start with module name.eg 'site_name' variable that you have used without module name in the file
3)You havn't set the variable 'site_name' anywhere in your file.So please set it.
4)Variables used in the .module file must be uninstalled in .install file
5)Please use placeholders like %s,%d in query instead of directly using string name like 'ou.$first_name' like on line no 71
6)I cant see function name '_uc_reports_order_statuses' defined in your file.
Comment #4
josephanoop commentedHi suhani.jain ,
Thanks for your review,
1) t() function added for texts
2) variable_get('site_name', '') is used for getting the drupal sitename, i think it is drupals default variable no need to set and unset.
3) The queries are used from ubercart 's uc_reports module. The same code i used here.
4) The module has a dependency for uc_cart, mensioned in .info file
5) uc_reports_order_statuses(); is the function of ubercart module, just called here.
Please correct me, if anything wrong
thanks
Comment #4.0
josephanoop commenteddescription updated
Comment #5
josephanoop commentedComment #6
josephanoop commentedComment #7
bradtanner commentedNice module.
Manual Review
- Theme functions should have your module name. 'my_form_theme' should be something like 'uc_coupon_best_customers_form'. If you name your theme function this, you don't have to set $form['#theme'] as Drupal will discover it by default.
- Do not place $order_statuses into your query directly. I realize Ubercart may do it, but it's a security flaw and opens your site to sql injection. Use db_placeholders() along with passing arguments in to pager_query().
- Line 175: Do not place variables directly in to the string. This will not be translatable. Use replacements %name or @name. See t(). Same issue on line 179.
- Line 183: Do not hard code info@sitename.com in to the headers. I'm not sure it's required at all, but if you think that it is, then either provide a variable to set this or implement drupal_mail version.
- Line 190: Message should end with a period and no space.
Comment #8
MakeOnlineShop commentedHello,
If using this module can I easily get a list of best customers ?
Thanks.
Comment #9
josephanoop commentedThis module utilizes ubercart s default report, and added additional functionality to send coupons. The page contain all customers details, their total no of orders, total amount etc: Best customers in the sense, customers are listed based on their purchase. All columns can be sortable
Comment #10
PA robot commentedClosing due to lack of activity. Feel free to reopen if you are still working on this application.
I'm a robot and this is an automated message from Project Applications Scraper.
Comment #10.0
PA robot commentedupdated git link