Closed (fixed)
Project:
Drupal.org security advisory coverage applications
Component:
module
Priority:
Normal
Category:
Task
Assigned:
Unassigned
Reporter:
Created:
12 Dec 2012 at 19:02 UTC
Updated:
10 Sep 2018 at 07:41 UTC
Jump to comment: Most recent
Comments
Comment #1
balintcsaba commentedHi danmatthews,
I cant access your git , please edit version control access at this page with the following:
Go to your project page , at the Version control menu select the version 7.x-1.x , check the Non-maintainer? checkbox and click Show.
Copy that and edit this page.
Also edit the description page of your module , is hard to have a code review without to know how and what does your module exactly.
Comment #2
jhaskins commentedPAReview.sh comes up clean (http://ventral.org/pareview/httpgitdrupalorgsandboxdanmatthews1864818git).
I did spot one issue: in several locations, you are using
db_query("DELETE.... You should be using a query builder object withdb_deleteinstead (see http://drupal.org/node/310081).Also, one nitpick on your README.txt; you say
Perhaps you should also indicate that it will also return false if the key doesn't exist (just a thought; not a big deal).
Comment #3
danmatthews commentedThanks, nitpicks and query builder objects taken care of :)
Comment #4
klausiWe are currently quite busy with all the project applications and I can only review projects with a review bonus. Please help me reviewing and I'll take a look at your project right away :-)
Comment #5
anwar_maxProject 1: http://drupal.org/sandbox/danmatthews/1728120
Project 2: http://drupal.org/sandbox/danmatthews/1864818
As successful completion of the project application process results in the applicant being granted the 'Create Full Projects' permission, there is no need to take multiple applications through the process. Once the first application has been successfully approved, then the applicant can promote other projects without review. Because of this, posting multiple applications is not necessary, and results in additional workload for reviewers ... which in turn results in longer wait times for everyone in the queue. With this in mind, your secondary applications have been marked as 'closed(duplicate)', with only one application left open (chosen at random).
If you prefer that we proceed through this review process with a different application than the one which was left open, then feel free to close the 'open' application as a duplicate, and re-open one of the project applications which had been closed.
Please take a moment to make your project page follow tips for a great project page.
Manual Review:
1) Table name is wrong in dx_cache_cron() function.
$results = db_query("DELETE FROM {ox_cache} WHERE expires < %d", time());Comment #6
danmatthews commentedHi,
I've cleaned up all of the mistakes pointed out, thanks for that. And i'll leave this one open for review.
Thanks very much.
Dan.
Comment #7
sadashiv commentedTable names should be enclosed in {curly_brackets} in db_query in dx_cache_has function. Ideally you should use db_select() instead of db_query.
Will be good if you also write hook_help.
Regards,
Sadashiv.
Comment #8
danmatthews commentedHook help written, and field names enclosed in curly braces, i'm going to stick with db_query and placeholders for now - i find them more readable to maintain, and they're just as safe when using placeholders.
Thanks.
Dan.
Comment #9
hhhc commentedNice little tool.
Comment #10
danmatthews commentedThanks,
Fixed!
Comment #11
ain commentedAutomated review
Everything in order, no errors.
Manual review
Comment #12
klausiDo NOT run check_plain() on data that you are storing, only run it when you output things.
"When handling data, the golden rule is to store exactly what the user typed. When a user edits a post they created earlier, the form should contain the same things as it did when they first submitted it. This means that conversions are performed when content is output, not when saved to the database." http://drupal.org/node/28984
Comment #13
danmatthews commentedHi Both,
Is check_plain not completely obsolete unless the person is storing a string? And what if they don't want the information they retrieve from the database to be HTML-encoded? For example to be passed into something like a markdown parser.
I"m loathed to put something like that in there that alters the output of the original data stored in any way, but i can definitely add a paragraph to the README that states that you should treat information from the table as you would any other unsafe input? Or rather, you should do that before inserting data.
Comment #14
ain commentedGood idea Re README, but I think the module is generally RTBC.
Comment #15
danmatthews commentedThere we go, i've updated the readme with an advisory section on sanitisation, and also updated the project page with usage examples.
http://drupal.org/sandbox/danmatthews/1864818
Thanks.
Comment #16
danmatthews commentedChanging status to try and bump up.
Comment #17
sadashiv commentedI think you should change the priority to bump up and the status should remain needs review.
Refer application prioriy on http://drupal.org/node/894256
Comment #18
danmatthews commentedComment #19
tenken commentedProject Review:
Automated Test results:
Manual Review:
consider defining time() somewhere once before you set the values in the array. This way time() is atomically used once in this function and there is no chance that expires vs created_at are off by a second or two when using this library with alot of data, or lots of calls at once.
Eg,
... you're not doing any big work between these two time() calls, but this approach is more futureproof and atomic.
Comment #20
tenken commentedoops forgot to change status in #19.
Comment #21
danmatthews commentedComment #22
snufkin commentedWhat I would add is to use http://api.drupal.org/api/drupal/includes%21bootstrap.inc/constant/REQUE... instead of time(), however this is a really minor issue, plus the module is fairly simple.
I'd say this is ready to be published, marking it as RTBC.
Comment #23
klausiGit default branch is not set, see the documentation on setting a default branch.
Sorry for the delay, but you have not listed any reviews of other project applications in your issue summary as strongly recommended in the application documentation.
manual review:
But that are not application blockers, so ...
Thanks for your contribution, danmatthews!
I updated your account to let you promote this to a full project and also create new projects as either a sandbox or a "full" project.
Here are some recommended readings to help with excellent maintainership:
You can find lots more contributors chatting on IRC in #drupal-contribute. So, come hang out and get involved!
Thanks, also, for your patience with the review process. Anyone is welcome to participate in the review process. Please consider reviewing other projects that are pending review. I encourage you to learn more about that process and join the group of reviewers.
Thanks to the dedicated reviewer(s) as well.
Comment #24.0
(not verified) commentedChanged git clone URL to be for non-maintainers.
Comment #25
avpaderno