Closed (fixed)
Project:
Drupal.org security advisory coverage applications
Component:
module
Priority:
Critical
Category:
Task
Assigned:
Unassigned
Reporter:
Created:
19 Mar 2013 at 00:40 UTC
Updated:
3 Sep 2014 at 21:14 UTC
Jump to comment: Most recent
Comments
Comment #1
ycshen commentedReview of the 7.x-1.x branch:
This automated report was generated with PAReview.sh, your friendly project application review script. You can also use the online version to check your project. You have to get a review bonus to get a review from me.
Source: http://ventral.org/pareview - PAReview.sh online service
Comment #2
ryan.armstrong commentedOk, I fixed most of the errors and warning except the following:
The reason being is that I used an core views plugin file (views_plugin_argument_default_raw.inc) as the starting point for my module and those remaining coding standard errors would be found in that views file as well. So I am moving this back to needs review with those errors still in place unless advised to fix them, regardless if they are contained in Views.
Comment #3
ibustosryan.armstrong,
Thank you for your interesting module. With the exception of the handler's method names, all other errors can be fixed, so it is my advise you do so.
Comment #4
ryan.armstrong commentedPushed a fix so that the module properly saves configuration. Exporting now works. Also, it's been 2 weeks so I am bumping up the priority to major. Also, in regards to the Coder messages, I am not going to fix the remaining ones. Instead I am going to leave it as the Views module has it to avoid any unexpected side effects.
Comment #4.0
ryan.armstrong commentedFixing my git URL to remove my user name.
Comment #5
ryan.armstrong commentedBumping this up to critical as it's now been 4 weeks.
Comment #6
kscheirerComment #7
kscheirerThe example in your image is incorrect - it says "if you wanted to use $_GET ['variable']['subvariable'], you would enter example" which doesn't look like it would work. That's in your help text in views_plugin_argument_default_superglobals::options_form().
Especially in the cases of _GET and _POST, you want to be running that through some sanitization, check_plain or filter_xss.
Setting to needs work for the security issue, otherwise this would be RTBC from me.
----
Top Shelf Modules - Enterprise modules from the community for the community.
Comment #8
PA robot commentedClosing due to lack of activity. Feel free to reopen if you are still working on this application.
I'm a robot and this is an automated message from Project Applications Scraper.
Comment #8.0
PA robot commentedUpdating description. I removed the error message if the variable wasn't found as there may be cases where that isn't an error.
Comment #9
ryan.armstrong commentedOk, I have updated the help text, as well as passed the $arg through filter_xss for security purposes.
Comment #10
ryan.armstrong commentedI also updated the screenshot on the project page.
Comment #11
ryan.armstrong commentedAdding D7 to the title and upping this to critical. This has been sitting in the queue for a long time. Need to get this through.
Comment #12
heddnAll feedback has been incorporated into the project. Marking as RTBC.
Comment #13
ryan.armstrong commented@heddn: Thanks!
Comment #14
ryan.armstrong commentedBeen in RTBC for 2 weeks. I know you guys have a huge backlog but since there have been no objections in 2 weeks, would it be possible to get this approved? Thanks!
Comment #15
heddnComment #16
heddnManual Review
drupal_map_assoc might be useful for these large (duplicate) arrays.
However, that isn't a blocker...
Thanks for your contribution, ryan.armstrong!
I updated your account so you can promote this to a full project and also create new projects as either a sandbox or a "full" project.
Here are some recommended readings to help with excellent maintainership:
You can find lots more contributors chatting on IRC in #drupal-contribute. So, come hang out and stay involved!
Thanks, also, for your patience with the review process. Anyone is welcome to participate in the review process. Please consider reviewing other projects that are pending review. I encourage you to learn more about that process and join the group of reviewers.
Thanks to the dedicated reviewer(s) as well.
Comment #18
ryan.armstrong commented@heddm: Thank you! That is really good feedback regarding drupal_map_assoc(), I'll look into that.