Closed (won't fix)
Project:
Drupal.org security advisory coverage applications
Component:
module
Priority:
Normal
Category:
Task
Assigned:
Unassigned
Reporter:
Created:
10 Sep 2012 at 09:33 UTC
Updated:
18 Jan 2013 at 12:22 UTC
Do not waste paper displays a message on the print page in browser. Our days there is no need to print a whole website with all its graphics, sidebars and colors. If you like to print data from a website, copy and paste the needed data to an office text editor.
Link to project:
http://drupal.org/sandbox/sense/1779656
The git repo:
git clone http://git.drupal.org/sandbox/sense/1779656.git do_not_waste_paper
This module is for Drupal 7.
Co-maintainer:
Comments
Comment #1
fabioknoedt commentedHi,
I found some problems in your sandbox, but first of all I have a question: your intention in this project was to replace the whole printing page content for a simple message or to append a message in the top of the page?
Some problems:
1. you're working with the MASTER branch, you should change for your first version branch. More details: "There is still a master branch, make sure to set the correct default branch: http://drupal.org/node/1659588 . Then remove the master branch, see also step 6 and 7 in http://drupal.org/node/1127732"
2. your project page is too poor, you should explain in details what the module does, with screenshots. Otherwise, if someone goes to your project page he won't understand and also the search engines won't display results for someone that is looking for a module like that. More details: create a good project/module description page.
3. your readme.txt is poor as well. Please fill it with more information.
4. you should add a link in .info file to your settings page. Just add a new line in .info file:
configure = admin/config/system/donotwastepaper5. all the admintrative functions (settings page) should go into a file which is named as .admin.inc according to convention
Your sandbox looks good! Thanks for the contribution to Drupal community and to the environment.
Comment #2
sense-designThanks for the feedback
Comment #3
fabioknoedt commentedWorks for me now!
I would recommend to implement a new feature that the user can choose in which content types he wants to "disable" the print function. For example, all content types or only for articles + the rest of the pages (including pages built by Views, etc). But just a suggestion.
To get your project promoted as full project fast, it would be great in case you could get review bonus so that reviewers can come back to your application sooner.
Comment #3.0
fabioknoedt commentedChanged git command
Comment #4
cubeinspire commentedProblems
1. This module doesn't have enough content (120 lines and 5 functions is the minimum) to grant access to unlimited full project permissions. http://groups.drupal.org/node/195848. This could be released as a
Security problem.
On line 25 the module outputs an user entered variable donotwastepaper without cheking the value. I know this doesn't look dangerous in this particular case because the value is inside a css content property but its my task as reviewer to inform about dangerous practices.
In this case its important to advise the possibility of using this before adding this variable.
$secured_data = check_plain(variable_get('variable_name'));Comment #5
klausidonotwastepaper_init(): as logicdesign already indicated this is a security problem. We have an XSS vulnerability here, because if I enter
";}/*]]>*/--></style><script>alert('XSS')</script>on admin/config/system/donotwastepaper I get a nasty javascript popup. That message is user provided input and needs to be sanitized before printing. Please read http://drupal.org/node/28984 again.Security issues are application blockers.
@logicdesign: Thanks for spotting this in the first place. I'll remove the admin mentoring tag as well, you can add it again to any application that is RTBC in your opinion.
Comment #6
sense-designSorry for not spotting that, fixed with http://drupalcode.org/sandbox/sense/1779656.git/commit/7a75462
Comment #7
klausiClosing due to lack of activity. Feel free to reopen if you are still working on this application.
If you reopen this please keep in mind that we are currently quite busy with all the project applications and I can only review projects with a review bonus. Please help me reviewing and I'll take a look at your project right away :-)
Comment #7.0
klausiAdded co-maintainer