Closed (fixed)
Project:
Drupal.org security advisory coverage applications
Component:
module
Priority:
Normal
Category:
Task
Assigned:
Unassigned
Issue tags:
Reporter:
Created:
17 May 2013 at 18:31 UTC
Updated:
4 Jan 2014 at 03:28 UTC
Jump to comment: Most recent
Comments
Comment #1
molenick commentedI did a cursory read through the code, and on first glance I don't see any major issues. This is a good idea for a module, a colleague and I built something similar for a custom site in D6, it's good to see someone make something reusable for D7.
A few things about functionality (maybe the documentation could clear this up?):
1) Token replace. It's not clear to me what this should be doing. I'd assume that it allows for text patterns to be replaced by token values, but I don't see anything after I check the box.
2) Display / Filtering. This part is a little confusing to me as well, as it deviates a bit from how I've seen it handled elsewhere. Isn't the Display setting redundant since filtering should control whether it's outputted as plain text/HTML?
Also, I don't understand the purpose of PHP Strip Tags - shouldn't the text filter itself control what is and isn't stripped? Perhaps your goal is to give a bit more control on the fly? Either way, it would be good to give it a more user-friendly name.
Thanks for the code and good luck with the application process! Looks like this will be a great contrib module.
Comment #2
PA robot commentedWe are currently quite busy with all the project applications and we prefer projects with a review bonus. Please help reviewing and put yourself on the high priority list, then we will take a look at your project right away :-)
Also, you should get your friends, colleagues or other community members involved to review this application. Let them go through the review checklist and post a comment that sets this issue to "needs work" (they found some problems with the project) or "reviewed & tested by the community" (they found no major flaws).
I'm a robot and this is an automated message from Project Applications Scraper.
Comment #3
thmnhat commentedThanks molenick for your feeback, about your questions:
1) Yes, the Token Replace is about replace text pattern with token values. For example:
Send <a href="mailto:[node:author:mail]">me</a> an emailwill be displayed as
Send <a href="mailto:author@example.com">me</a> an email2) You are right, I remove the Display option, Filter is enough.
3) About the strip tags, I know how flexible Drupal's filters are. But sometimes, we don't have to create a new filter for just a small function or sometimes, we just want to control the filter on the field directly. Anyway, I renamed it as you said.
Thank you again for your feedback.
Comment #4
molenick commentedHello thmnhat, one last thing from me then - if you do include a token replace, maybe you could display a collapsible table of available tokens (like other modules do) so users know what tokens are available?
Comment #5
thmnhat commentedHi molenick
Do you mean in the editing form or in manage display? I already made a link "Browse available tokens" in manage display.
Comment #6
thmnhat commentedHi molenick,
Thanks for your feedback, now available tokens is displayed in the editing form.
Comment #6.0
thmnhat commentedEdit git clone command
Comment #7
thmnhat commentedComment #8
ayesh commentedFew minor suggestions:
advanced_text_formatter.module
- Line 12: text.info (which requires field.module) has
required = TRUEwhich means the module will always be enabled. It won't be necessary to checkmodule_exists('text')- Line 159:
t('Replace text pattern. e.g [node:title] or [node:author:name], by token values.'). This text is not very translation-friendly.You could rewrite to use some patterns so tokens are excluded from the translation string.
EX:
t('Replace text pattern. e.g %node-title-token or %node-author-token, by token values.', array('%node-title-token' => '[node:title]', '%node-author-token' => '[node:author:name]'))- Line 198: Use
@linkinstead of!link.Good job, and this module looks like a really useful and handy one.
Comment #9
thmnhat commentedThank Ayesh,
I have pushed my fixes :-)
Comment #10
myvo commentedGood job!
Comment #11
klausimanual review:
advanced_text_formatter_field_formatter_view(): strip_tags() is not considered secure (for old browsers and PHP versions), you need to use filter_xss() instead. This is a security blocker. See also http://drupal.org/node/28984 . And please don't remove the security tag, we keep that for statistics and to show examples of security problems.
But otherwise looks nearly ready to me. Removing review bonus tag, you can add it again if you have done another 3 reviews of other projects.
Comment #11.0
klausiAdd Review links
Comment #12
thmnhat commentedHi klausi
I have fixed the security issue.
Thank you for your review.
Comment #13
dydave commentedHi Nhat,
Thanks again very much for contributing this very nice module and I'm sorry for this late review/reply/comment.
You've really done a great work on this project application:
Very complete module page, clean code, nice inline comments, coding standards, etc... and promptly following up with all comments/suggestions posted by other reviewers in this ticket, while kindly participating to the Review Bonus program.
At this point, It seems there is not much left anymore for me to comment on or complain about your application, and I certainly didn't expect you would get RTBC as quickly as that :) (and get so many helpful reviews).
I guess the preparation you did before submitting the application (by getting at least all the automated checklist out of the way) really helped speeding up the reviewing process.
Just a very minor suggestion, you might want to wait for another user to set the application again RTBC and I would assume it might have been a bit better if you had changed the status to needs review in #12, instead of RTBC yourself.
Usually, after the application has been marked RTBC, you should be about a week close to getting it fixed and seeing the module promoted to full project (if no other objections or issues are reported during that time).
Thank you very much for your efforts going through this process and we will certainly keep watching this very nice module with a lot of interest.
Cheers!
Comment #14
klausiThanks for your contribution, thmnhat!
I updated your account to let you promote this to a full project and also create new projects as either a sandbox or a "full" project.
Here are some recommended readings to help with excellent maintainership:
You can find lots more contributors chatting on IRC in #drupal-contribute. So, come hang out and get involved!
Thanks, also, for your patience with the review process. Anyone is welcome to participate in the review process. Please consider reviewing other projects that are pending review. I encourage you to learn more about that process and join the group of reviewers.
Thanks to the dedicated reviewer(s) as well.
Comment #15
thmnhat commentedThank you molenick, Ayesh, myvo, klausi and DYdave for reviewing my code.
@DYdave: I will keep your notice in mind, thanks :-)
Comment #16.0
(not verified) commentedAdd review bonus