Better handling for check timeouts

It sounds like there is something about your site that the Security Review module hangs on reviewing. Have you tried setting checks to skipped to narrow down what check(s) could be taking so long? If not I recommend doing so. I would disable the file system check to start.

Update:
The checks happen over one HTTP request. A feature would be to use batch processing, or integrate with drush.

tranquille, on the main security review page (admin/reports/security-review) you should have an option besides "Details" called "Skip". See the screenshot on the project page: http://drupal.org/project/security_review Do you have that option?

Also, be sure you have the permissions set for the module at admin/user/permissions.

I think this could be handled by processing the checklist using Batch API.

Moving to a feature request.

I've begun on some code but its not near completion enough to post.

The attached patch splits out the check running into its own function and provides a batch that makes an operation for each check. This provides a whole cycle for each check. A followup patch could provide an argument for checks to run their own batch operations.

Minor update to #7 patch corrects some comments and adds some output for the user during batch processing.

Minor but CNW now that http://drupal.org/cvs?commit=458548

Updated.

Fixed http://drupal.org/cvs?commit=458684

I have more than 300k nodes, a white screen of death always there after running for a few minutes.

@tutube, are you running the dev release of Security Review?

I am running 6.x-1.0

@tutube, try the dev release, or if you're OK waiting there should be a 1.1 release in the next month or two

I tried the dev release, it stopped with error at /batch?op=start&id=4, when I tried 'Run checklist' again, it stopped at batch?op=start&id=5, then 6,7,8... but never finished its job.

Ok, I'll test after having devel create 300k nodes, it may be that a batch for the node body check is needed. Thanks for testing it out.

Re-opening.

@tutube in the mean time to be able to use the rest of the Security Review checklist you could skip the node check.

may I ask how to skip the node check? I looked at this page:
/admin/reports/security-review/settings
but can not find setting for 'node check'.

@tutube I just realized something, if the checklist is unable to complete the first time there will be no option to skip a check (it appears alongside the check results on admin/reports/security-review). Has the checklist ever completed for you?

never, it stopped with err after running for a few minutes.

it will be better if you could provide an option to enable node check, or date range such as 'only check nodes from 2010-10-01 to 2010-12-31'.

Here's a patch against 6.x-1.x-dev that provides an advanced option for specifying a date to search content from. The format is Y-m-d or 2010-01-01. Please give it a try tutube. (To apply a patch see http://drupal.org/node/367392)

This also provides a fix for #1007294: Node check fails then passes

I'd still like to provide per check batch operations, which I'll look into now.

And the patch

Here's another approach which provides check skipping in the Security Review Settings form, so you can mark a check for skipping before the checklist has been run. I prefer this over the method in #24.

This was committed http://drupalcode.org/project/security_review.git/commit/bcf04d4