This module allows you to connect your DALIM ES to Drupal - enabling you to directly browse, and place your assets straight into your content with a custom field. This can be done with a dynamic link so your data is never out of date, or it can be directly uploaded into Drupal.

Project link

https://www.drupal.org/project/dalim_es

Comments

dalimService created an issue. See original summary.

dalimService’s picture

Issue summary: View changes
apaderno’s picture

Priority: Normal » Major

Thank you for applying! Reviewers will review the project files, describing what needs to be changed.

Please read Review process for security advisory coverage: What to expect for more details and Security advisory coverage application checklist to understand what reviewers look for. Tips for ensuring a smooth review gives some hints for a smother review.

To reviewers: Please read How to review security advisory coverage applications, What to cover in an application review, and Drupal.org security advisory coverage application workflow.

Since the project is being used for this application, for the time this application is open, only the user who created the application can commit code.

apaderno’s picture

Title: [D9] DALIM ES CMS Connector » [1.0.x] DALIM ES CMS Connector
Issue summary: View changes
klausi’s picture

Priority: Major » Normal
Status: Needs review » Needs work
Issue tags: +PAreview: security

manual review:

  1. config schema is missing for your settings, see https://www.drupal.org/docs/drupal-apis/configuration-api/configuration-...
  2. "path: '/dalim_es/updateAssets'": this is vulnerable to CSRF exploits as you are executing a data changing operation there. I think adding _csrf_token sghould be enough for your use case https://www.drupal.org/docs/8/api/routing-system/access-checking-on-rout...
  3. route dalim_es.updateAssets: I think the permission "access content" is wrong here. Only admins should be able to update the assets, right? Please check all permissions in the routing file, I think "access content" is too permissive for most of them and could be abused by an attacker.

The last 2 points are security blockers right now. And please don't remove the security tag, we keep that for statistics and to show examples of security problems.

apaderno’s picture

Priority: Normal » Minor
Rassoni’s picture

Please check PHPCS issues.

command :

phpcs --standard=Drupal,DrupalPractice --extensions=php,module,inc,install,test,profile,theme,css,info,txt,md,yml dalim_es    
FILE: ~/projects/drupal-d10/modules/contrib/dalim_es/css/dalim-es-style.css
----------------------------------------------------------------------------------------------------
FOUND 6 ERRORS AFFECTING 6 LINES
----------------------------------------------------------------------------------------------------
 156 | ERROR | [x] Expected 1 space after colon in style definition; 0 found
 157 | ERROR | [x] Blank lines are not allowed in class definitions
 194 | ERROR | [x] Expected 1 space after colon in style definition; 0 found
 195 | ERROR | [x] Expected 1 space after colon in style definition; 0 found
 196 | ERROR | [x] Expected 1 space after colon in style definition; 0 found
 206 | ERROR | [x] Expected 1 space after colon in style definition; 0 found
----------------------------------------------------------------------------------------------------
PHPCBF CAN FIX THE 6 MARKED SNIFF VIOLATIONS AUTOMATICALLY
----------------------------------------------------------------------------------------------------


FILE: ~/projects/drupal-d10/modules/contrib/dalim_es/css/dalim-es-field-style.css
----------------------------------------------------------------------------------------------------------
FOUND 2 ERRORS AFFECTING 1 LINE
----------------------------------------------------------------------------------------------------------
 21 | ERROR | [x] Spaces must be used to indent lines; tabs are not allowed
 21 | ERROR | [x] Line indented incorrectly; expected 2 spaces, found 1
----------------------------------------------------------------------------------------------------------
PHPCBF CAN FIX THE 2 MARKED SNIFF VIOLATIONS AUTOMATICALLY
----------------------------------------------------------------------------------------------------------


FILE: ~/projects/drupal-d10/modules/contrib/dalim_es/README.md
---------------------------------------------------------------------------------------
FOUND 0 ERRORS AND 11 WARNINGS AFFECTING 11 LINES
---------------------------------------------------------------------------------------
 13 | WARNING | Line exceeds 80 characters; contains 204 characters
 15 | WARNING | Line exceeds 80 characters; contains 173 characters
 17 | WARNING | Line exceeds 80 characters; contains 98 characters
 37 | WARNING | Line exceeds 80 characters; contains 90 characters
 49 | WARNING | Line exceeds 80 characters; contains 123 characters
 58 | WARNING | Line exceeds 80 characters; contains 133 characters
 59 | WARNING | Line exceeds 80 characters; contains 129 characters
 67 | WARNING | Line exceeds 80 characters; contains 135 characters
 71 | WARNING | Line exceeds 80 characters; contains 104 characters
 75 | WARNING | Line exceeds 80 characters; contains 272 characters
 77 | WARNING | Line exceeds 80 characters; contains 302 characters
---------------------------------------------------------------------------------------

Time: 452ms; Memory: 18MB
apaderno’s picture

I am closing this application, since there haven't been replies in more than six months and the application has been created eight months ago or more.
Feel free to re-open it, once the project has been changed basing on what reported in the last review.

apaderno’s picture

Status: Needs work » Closed (won't fix)