Closed (fixed)
Project:
Drupal.org security advisory coverage applications
Component:
module
Priority:
Normal
Category:
Task
Assigned:
Unassigned
Reporter:
Created:
19 Mar 2013 at 22:09 UTC
Updated:
13 Aug 2013 at 04:01 UTC
Commerce Klarna Checkout provides a payment method for Drupal Commerce using Klarna Checkout. This method is different than Commerce Klarna, in the way that it uses a totally different payment integration and offers credit cards, invoice and bank transfer as payment methods.
http://drupal.org/sandbox/MaxOne/1943442
git clone http://git.drupal.org/sandbox/MaxOne/1943442.git commerce_klarna_checkout
Using Drupal 7
A review of an earlier project i made: http://drupal.org/node/1178092
Testing credentials:
Comments
Comment #1
PA robot commentedThere are some errors reported by automated review tools, did you already check them? See http://ventral.org/pareview/httpgitdrupalorgsandboxMaxOne1943442git
We are currently quite busy with all the project applications and I can only review projects with a review bonus. Please help me reviewing and put yourself on the PAReview: review bonus high priority list. Then I'll take a look at your project right away :-)
I'm a robot and this is an automated message from Project Applications Scraper.
Comment #2
MaxOne commentedCorrected the issues from the automated review
Comment #3
likebtn commented1. Please provide more details on the project page (see http://drupal.org/node/997024). You can copy details from your README.txt file.
2. Provide correct Git clone instruction in the Issue:
git clone http://git.drupal.org/sandbox/MaxOne/1943442.git commerce_klarna_checkout3. Consider justifying tabs and indent in order to keep code well formatted. For example, in commerce_klarna_checkout.module on line 13:
replace with
3. commerce_klarna_checkout.install:
- line 35: remove $t(), leave just:
Comment #3.0
likebtn commentedadded testing credentials
Comment #4
MaxOne commentedHi likebtn,
Thank you for reviewing this.
1. I updated the project page with the text from the readme file.
2. Fixed.
3. All arrays are now justified.
4. PAReview warned about not translating text in the $text parameter, but since it is a URL i agree with you. This is corrected.
Comment #5
MaxOne commentedChanging priority to major as it has been awaiting review more for than two weeks.
Comment #6
MaxOne commentedComment #7
kscheirerComment #8
kscheirerI'm not sure why there's a sleep() in commerce_klarna_checkout_redirect_form_validate(). In commerce_klarna_checkout_process_payment() you should sanitize/validate any values from the _GET string.
I'm not sure why Mobile-Detect would be required - you seem to be using it just to determine layouts and gui information. Perhaps this should be an optional component instead? If not present you could let the admin choose a default 'desktop' or 'mobile'.
Otherwise looks good, setting to needs work for the security problem.
----
Top Shelf Modules - Enterprise modules from the community for the community.
Comment #9
MaxOne commentedThanks kscheirer.
The $_GET string is now sanitized.
When the order is accepted by Klarna, a request is made to the URL specified in commerce_klarna_checkout_menu(). The reason for the sleep() is to wait for this request. Usually this request is made before the user is redirected to the accept page, but not always.
Mobile Detect is no longer required. If not installed, the admin can choose layout in settings.
Best,
Max
Comment #10
MaxOne commentedComment #11
kscheirerThanks for the updates, looks good. There are a few minor issues still reported at http://ventral.org/pareview/httpgitdrupalorgsandboxmaxone1943442git.
----
Top Shelf Modules - Enterprise modules from the community for the community.
Comment #12
MaxOne commentedThanks again kscheirer. It's corrected with one remaining issue which is addressed here https://drupal.org/node/1947286#comment-7213862
Regards,
Max
Comment #13
MaxOne commentedComment #14
kscheirerCode still looks good. Consider integrating with the Payment module - it will make your payment processor compatible with Commerce, Ubercart, and Webform all in one go.
Thanks for your contribution, MaxOne!
I updated your account to let you promote this to a full project and also create new projects as either a sandbox or a "full" project.
Here are some recommended readings to help with excellent maintainership:
You can find lots more contributors chatting on IRC in #drupal-contribute. So, come hang out and get involved!
Thanks, also, for your patience with the review process. Anyone is welcome to participate in the review process. Please consider reviewing other projects that are pending review. I encourage you to learn more about that process and join the group of reviewers.
Thanks to the dedicated reviewer(s) as well.
----
Top Shelf Modules - Crafted, Curated, Contributed.
Comment #15
MaxOne commentedThank you for your effort kscheirer.
Comment #16.0
(not verified) commentedUpdated git clone instructions according to http://drupal.org/node/1947286#comment-7213300