[D7] Converse.js Integration (Most advanced chatroom for Drupal)

We are currently quite busy with all the project applications and we prefer projects with a review bonus. Please help reviewing and put yourself on the high priority list, then we will take a look at your project right away :-)

Also, you should get your friends, colleagues or other community members involved to review this application. Let them go through the review checklist and post a comment that sets this issue to "needs work" (they found some problems with the project) or "reviewed & tested by the community" (they found no major flaws).

I'm a robot and this is an automated message from Project Applications Scraper.

Just a quick fix needed to satisfy Drupal coding standards: function conversejs_prebind() defines 2 variables with a camelCase formatted name.
$sessionInfo --> $session_info
$xmppPrebind --> $xmpp_prebind

A suggestion to help translation: keep all the HTMLS tags and untranslatable text out of t() calls.
conversejs.admin.inc (302):

'#description' => t('Allow <a href="https://otr.cypherpunks.ca/">OTR (Off-the-record encryption)</a>'),

should read

'#description' => t('Allow !link', array('!link' => l(t('OTR (Off-the-record encryption)'), 'https://otr.cypherpunks.ca/'))),

This way:

• translators are not needed to know your code
• they cannot garble HTML tags
• changes to the URL does not require an translation update

Best wishes for your module.

I have reviewed the code, and feel that it falls within guidelines.

Coding Standards

I agree that the style variations reported are acceptable within this context.

Manual code review

I found some issues, but nothing warranting returning to "needs work"

• conversejs.admin.inc
  • I'd prefer to see the markup removed from the t() calls. You modified the specific one mentioned in comment #5, but there are several other instances of <a>, <strong>, <code>, <p> and <br>
  • The word 'Advanced' is misspelled at one point as 'Advaned'
• conversejs.install
  • Your method of clearing out the variables makes me nervous. I think I'd rather see an explicit clearing of variables by name, but that may be me being extra paranoid
• conversejs.module
  • The use of php_eval had me worried, but it looks like you've got that covered in a pretty explicit permission, so I'm OK with it
  • Even though all of the settings will be managed by an administrator, I'd still prefer to see the conversejs_get_params() function do a filter_xss() on the values, where appropriate.

Non-blocking issues:

• You can remove .gitignore
• It's highly unlikely that anything will go wrong in conversejs_uninstall(), but Drupal prefers calling variable_del() on each variable individually
• Because you are dependent on several libraries, consider using the Libraries API. This helps prevent a library from being included multiple times and makes it easier for the admin to know that everything is installed properly. Also consider a hook_requirements() in your install file to check that all libraries are loaded correctly when the module execute.
• In conversejs_tokens() Drupal's coding standards use && and || instead of and/or

Assigning to klausi for security check as noted in #9, and additionally for the user passwordhash token. Otherwise no issues found from me!

The execution of php_eval() should be wrapped with a module_exists('php_filter') condition, but since the admin config access is protected with a PHP permission this is not a security issue on its own.

The settings are passed to drupal_add_js() which will do proper escaping, so I see no XSS vulnerability there. Depends how the library then handles the conf strings, but I see no apparent vulnerability there either.

Thanks for the review klausi! Since no other issues were found...

Thanks for your contribution, hejazee!

I updated your account so you can promote this to a full project and also create new projects as either a sandbox or a "full" project.

Here are some recommended readings to help with excellent maintainership:

• Dries' post on Responsible maintainers
• Best practices for creating and maintaining projects
• Maintaining a drupal.org project with Git
• Commit messages - providing history and credit
• Release naming conventions.
• Helping maintainers in the issue queues

You can find lots more contributors chatting on IRC in #drupal-contribute. So, come hang out and stay involved!

Thanks, also, for your patience with the review process. Anyone is welcome to participate in the review process. Please consider reviewing other projects that are pending review. I encourage you to learn more about that process and join the group of reviewers.

Thanks to the dedicated reviewer(s) as well.

Welcome aboard, and good luck.