Closed (fixed)
Project:
Drupal.org security advisory coverage applications
Component:
module
Priority:
Normal
Category:
Task
Assigned:
Unassigned
Reporter:
Created:
20 Dec 2012 at 21:04 UTC
Updated:
21 Feb 2013 at 08:40 UTC
Jump to comment: Most recent file


Comments
Comment #1
klausiWelcome,
you need to set the status to "needs review" if you want to get a review. See http://drupal.org/node/532400
Please get a review bonus first. Then try to fix issues raised by automated review tools: http://ventral.org/pareview/httpgitdrupalorgsandboxwuleinj1665746git
Comment #2
maciej lukianski commentedOther things to consider:
Module description in the info file should be as short and descriptive as possible. Common pattern "Changes default pagination to 'x of yy' " od somethins along the lines.
Your Readme.txt file has lines longer than 80 characters which is the suggested maximum length.
In your js file you declare ppsubmit function which is not yousing your modules namespace. Best practice is to start all functions with your modules namespace.
When I enter numbers into the input, console log in Firebug (FF) trhows an error "ReferenceError: ppnosubmit is not defined". This is because on line 172 of your module file you have
onkeyup='return ppnosubmit($params,1)'and this function is not defined.Comment #3
wuinfo - bill wu commentedThanks MagicMcj, Fix was done and committed. I have attached the patch as well.
Comment #3.0
wuinfo - bill wu commentedUpdated issue summary.
Comment #4
wuinfo - bill wu commentedThanks @klausi, I have reviewed one project this morning, will continue do some more this afternoon.
Have fixed all the outstanding format issues. listed in http://ventral.org/pareview/httpgitdrupalorgsandboxwuleinj1665746git .
Comment #4.0
wuinfo - bill wu commentedAdd list of Reviews of other projects
Comment #4.1
wuinfo - bill wu commentedUpdated issue summary.
Comment #5
wuinfo - bill wu commentedComment #5.0
wuinfo - bill wu commentedUpdate the review bonus part.
Comment #5.1
wuinfo - bill wu commentedUpdated issue summary.
Comment #5.2
wuinfo - bill wu commentedUpdated issue summary.
Comment #6
anwar_maxHi zbabtkis,
This is a nice module and great work done by you.
Automated Review:
There is still a master branch, make sure to set the correct default branch: http://drupal.org/node/1659588 . Then remove the master branch, see also step 6 and 7 in http://drupal.org/node/1127732
Review of the 7.x-1.x branch:
This automated report was generated with PAReview.sh, your friendly project application review script. You can also use the online version to check your project. You have to get a review bonus to get a review from me.
Source: http://ventral.org/pareview - PAReview.sh online service
Manual Review:
1) Please use proper sanitization function if you want to use query strings on line no 181 in prettypagination.module you have written
$urllink = $_GET['q'];2) You should not generate html by youself prettypagination.module has below code on line 362 instead of usig anchor tag you should use l() function.
return '<a' . drupal_attributes($attributes) . '><i>' . check_plain($text) . '</i></a>';Removing review bonus tag you can review other application and add review bonus tag again.
Comment #7
jnicola commentedInstalled and reviewed the code. I'm still new to all of this myself so I saw nothing that stuck out as bad to me in the code itself.
I did notice the sandbox project page has no description? What exactly does this change? What can be customized? What does it do? It's a stylized pager... but is that it?
Also, as a stylized pager, it's visually broken in firefox for me on a base D7 install with Bartik for the theme. I imagine this is meant as a tool to themers though? Again, describing this in the project would be helpful.
Lastly, the << and < on the first page that do nothing is a bit awkward. Not sure if it's broken in a sense but... I'm not sure I'm finding that particularly intuitive.
Comment #8
wuinfo - bill wu commentedThanks @anwar_max. Fixed accordingly.
Comment #9
anwar_maxHi,
Manual Review:
1) This prettypagination_pager_link() function has security issue you should not directly use $_GET['page'], use proper sanitization function.
2) I have a suggestion if you can provide a template for pager it will be helpful for users so that anyone can override it.
Comment #10
wuinfo - bill wu commentedThanks @anwar_max,
Fixed the first issue and commited. Good idea to put a template. I will take a close look of it and see if I can do it this time or leave it for next version.
Comment #11
anwar_maxHi wuinfo,
I think you forgot to change the status.
Comment #12
wuinfo - bill wu commentedHi @anwar_max, providing template is a quite big operation for this project. I would like to leave it for next version.
Comment #13
stborchert* You include your js and css file both in prettypagination.info. This way both files are loaded on every site (even those without a pager). Therefore it would be much better to load the files using drupal_add_css() and drupal_add_js() in the function
<?php prettypagination_pager() ?>.* Its best practise to use Drupal behaviors for custom javascript functions (see The Drupal Javascript API. So its better to rewrite your submit-function to "Drupal.behavior" and remove "onkeyup", "onkeydown" and such "old-fashioned" markup ...
Comment #14
wuinfo - bill wu commentedThank you @stBorchert.
Code was changed and committed according to your comment.
Comment #15
rickumali commentedHi @wuinfo,
I like this functionality! I downloaded and enabled your module (using Drush), and was able to see the new pagination. The links work, however, on my particular browser, the JavaScript produced errors when I tried to use the textbox (id=prettypagination). I was on the first page, and I entered "3" in the text box, and pressed the ENTER key.
Accessing my browser's console showed:
See attached screen shot.
My browser is running in Ubuntu, and in my web server logs, I see this for my USER_AGENT:
"Mozilla/5.0 (X11; Linux i686) AppleWebKit/535.19 (KHTML, like Gecko) Ubuntu/11.10 Chromium/18.0.1025.168 Chrome/18.0.1025.168 Safari/535.19"
This would be a blocking issue for me, but I can appreciate it would take some time getting an Ubuntu environment up and running. If this issue is difficult to get past, then perhaps it can be called out in the README.
Good luck!
Comment #16
wuinfo - bill wu commentedThanks @rickumali,
You have written a very detail description with screen capture. It helps me understand the problem quickly.
I have committed new code for this issue.
Code was tested with Firefox 3.0 which I had downloaded for this issue.
Pagination is working on Firefox 3.0 now. Except there is an small issue for admin overlay page. Even through the page was changed, the current page address will not be updated on admin overlay. README.txt document was updated accordingly.
Comment #17
rickumali commentedHi @wuinfo
I confirmed that the fix you made now works for my environment! (I did a 'git pull' in the prettypagination directory, then reloaded my home page.)
I'm not experienced enough to mark this issue as "RTBC" (Reviewed & Tested by the Community), but I feel it's very close. Good luck with the rest of the process. I like this module for sure, and look forward to seeing it become a full project.
Comment #18
hhhc commentedHi.
I like the module. The site I tested it with makes intensive use of SOLR as "navigation" with 10000+ nodes.
So, this would probably be a typical use case.
1)
Installation went well and works as described, did not try layouting it, though.
2)
It does not work with SOLR.
On the SOLR search result page the link looks like http://mysite.com/search/site/searchterm?page=1 => pagination works
When adding a facet to the search the link looks like http://mysite.com/search/site/searchterm?f[0]=im_field_type%3A2011
Using the arrows works but when entering a page numberand pressing return the URL changes to http://mysite.com/search/site/searchterm?page=13 and all selections are lost.
Hope you can fix this quickly because it looks really useful.
Comment #19
wuinfo - bill wu commentedHello @hhhc,
Fixed the bug and the code was committed.
Comment #20
20th commentedManual review
A CSS-stylesheet should not be executable as a program.
You must remove execution permission from all files in this module. On Linux, you can do this by running chmod a-x *. I have no idea how you do this in Windows.
This module is not fully functional with disabled JavaScript. For example, page cannot be changed by inputting a new page number into the textfield. User is forced to navigate using prev/next links. Other people may disagree, but for me it a very serious issue. Do you plan to fix it?
Besides, your JavaScript code does not check what has been inputed into that textfield. Try typing 'xyz' and hit enter: you will be redirected to page NaN.
Overall, I am not happy to see that theming hooks defined in this module are 90% identical to Drupal pager's default hooks.
Here is a proposal. Instead of duplicating pager's functionality and markup, do not override theming hooks and let Drupal generate the default pager. And then you can completely override pager's markup with you JavaScript on the client-side. I see three advantages of this approach:
It is possible to generate perfectly themable markup with JavaScript, and if you provide a detailed theming guide with your module, other developers will know what to do.
Edit: spelling.
Comment #21
wuinfo - bill wu commentedCheck what has been inputed is not necessary here. Other than for security reason, who will input xyz as page number?
1) Value of this field will become part of next page's URL. Anyway, we are not able to prevent people putting xyz in url directly.
2) Value of this field will not touch any database on server side.
3) URL is parsed in core bootstrap. Any security risk will be eliminated there. It is not the best spot to prevent cross site attack in javascript.
Comment #22
jnicola commentedHey there! I took a gander through what you have written (again), and installed it on a local D7 install. Still working, I reviewed your code and obviously it's come a really long way. I feel your pain, mine is going similiar!
Anyways, good work. I have no issues I can spot... but I'm a noob :)
Comment #23
hhhc commentedHi,
regards
hhhc
Comment #24
wuinfo - bill wu commentedI am still working on #20. It is a major change and will take some time.
Comment #25
wuinfo - bill wu commentedA major code change was done according to #20, thanks 20th.
Changes:
1) Javascript disabled browser will use old pagination.
2) Reduced code with no duplicated code.
3) Pagination Work with views' AJAX feature.
4) Removed executable property from all files.
5) Pretty pagination function can be enabled in each theme setting. So you can enable prettypagination in main theme and disable it in administration theme.
Comment #26
20th commentedWow, thanks for fixing everything, wuinfo.
Few minor things:
I think, these are not major issues, and for me this module is clearly RTBC.
Comment #27
wuinfo - bill wu commentedSandbox project page description was added (http://drupal.org/sandbox/wuleinj/1665746). Minor code fixes was done and committed.
Comment #28
klausimanual review:
Although you should definitively fix those issues they are not critical application blockers, so ...
Thanks for your contribution, wuinfo!
I updated your account to let you promote this to a full project and also create new projects as either a sandbox or a "full" project.
Here are some recommended readings to help with excellent maintainership:
You can find lots more contributors chatting on IRC in #drupal-contribute. So, come hang out and get involved!
Thanks, also, for your patience with the review process. Anyone is welcome to participate in the review process. Please consider reviewing other projects that are pending review. I encourage you to learn more about that process and join the group of reviewers.
Thanks to the dedicated reviewer(s) as well.
Comment #29
wuinfo - bill wu commentedThanks @klausi.
Thanks everyone who have tested this module and given feedback.
I would specially thank @20th and @stBorchert together with @klausi.
Without you, Pretty Pagination would not get passed.
Comment #30
wuinfo - bill wu commentedComment #31
klausiJust leave it at fixed, the issue will close automatically in two weeks.
Comment #32.0
(not verified) commentedUpdated issue summary.