Closed (won't fix)
Project:
Drupal.org security advisory coverage applications
Component:
module
Priority:
Normal
Category:
Task
Assigned:
Unassigned
Issue tags:
Reporter:
Created:
16 Oct 2012 at 18:34 UTC
Updated:
3 Oct 2013 at 21:43 UTC
Two aspects of this module work together to give you a seamless MediaCore experience from within Drupal 7. WYSIWYG integration (supports TinyMCE and CKEditor) gives you a new button while editing content; click it and your videos are right there! Just select which one you'd like to embed, and we'll insert a shortcode for it in your content. The content filter turns these shortcodes into the appropriate code so that your video appears right within your page.
Project page: http://drupal.org/sandbox/mediacore/1708680
Git repo: http://git.drupal.org:sandbox/mediacore/1708680.git
Comments
Comment #1
cubeinspire commentedHi,
You are still working on the master branch, please look how to create and name git branches.
Automatic review
There are too many errors on the automatic review, please find and correct this before other reviews.
http://ventral.org/pareview/httpgitdrupalorgsandboxmediacore1708680git
README.txt
readme.txt file should be renamed as README.txt
Manual review
Master branch
You are working on master branch, please switch to a 7.x-1.x branch and delete the master.
mediacoreinsert.file:
You can remove all this.
"
mediacoreinsert.module
There many are security issues!
1. The $_GET parameters are printed on the template without checking its values. Please check all dynamic urls with check_url() (like $variables['next'] and ['previous']).
Verify that all entered data from users that is shown on the template has been sanitized.
You can have more info on this page: http://drupal.org/node/28984
2. You shouldn't create forms on the template to prevent against CSRF attacks. Use Form API instead.
You are creating variables that are not deleted. Those should be erased on using hook_uninstall() on an .install file with variable_del();
mediacoreinsert_dashboard.tpl.php
Declaring functions inside a tpl.php is not the standard way.
Please send variables to the template instead using hook_preprocess_HOOK().
Is this REALLY necessary ? :-) Please remove...
Comment #2
klausiClosing due to lack of activity. Feel free to reopen if you are still working on this application.
Comment #2.0
mediacore commentedchanging supported editors