Closed (fixed)
Project:
Drupal.org security advisory coverage applications
Component:
module
Priority:
Normal
Category:
Task
Assigned:
Unassigned
Issue tags:
Reporter:
Created:
23 Jul 2013 at 07:22 UTC
Updated:
4 Jan 2014 at 03:57 UTC
Jump to comment: Most recent
Comments
Comment #1
PA robot commentedWe are currently quite busy with all the project applications and we prefer projects with a review bonus. Please help reviewing and put yourself on the high priority list, then we will take a look at your project right away :-)
Also, you should get your friends, colleagues or other community members involved to review this application. Let them go through the review checklist and post a comment that sets this issue to "needs work" (they found some problems with the project) or "reviewed & tested by the community" (they found no major flaws).
I'm a robot and this is an automated message from Project Applications Scraper.
Comment #2
sn_idea_engineer commentedHi Pgautam,
- Please consider providing blank line before and after every conditional and control statements block.
- If an array is increasing 80 characters in a single then consider each array key/value as a separate line.
- URLs like "https://graph.facebook.com/testsocialbank?access_token" should be a part of admin configuration to make future changes to URL without modifying the code.
- die("Access token couldn't be acquired."), is something which strictly should not be a part of your code however you may use drupal message API or watchdog to make aware with what happened with the request.
sn_fb_dynamic_cover_photo.admin.inc
- sn_fb_dynamic_cover_photo_admin_settings_form(), please parse #description in t() method.
- dropdown_first_value and dropdown_second_value, please change field names to something more understandable.
- Do not user CURL instead use drupal_http_request method to call remote URL.
- Watchdog message is without parsing using t() method.
.module file
- remove MENU_NORMAL_ITEM as this is default in drupal 7.
- Any HTML tag like "P" should not be there in code.
Please resolve these issues.
Thanks
Comment #3
sn_idea_engineer commentedComment #4
gaurav.pahuja commentedSome of the code review comments:
sn_fb_dynamic_cover_photo.install:
• Line #44, 51 and 58: Field descriptions should be different
sn_fb_dynamic_cover_photo.module:
• Line #12 and 13: As per developer API, image dimensions should be 851px by 315px but MACROs that we used defined width as 850px and height as 316px.
• Lie # 100: Can we have a wrapper function for all curl requests
• Line # 292: We should have an error scenario handling in case json /result is not proper i.e. json_decode fails
• Line # 157: Unused variable
• Line # 236: Where are we using variable $dir_images_type
• Line # 268: Unused variable $album_name
sn_fb_dynamic_cover_photo.admin.inc:
• Line # 14: Unused variable
• Line # 83: Don’t share app id and secret as default value
• Line # 50: Instead of using text-field with readonly attribute, try to use markup. Readonly attribute can be a security issue
• Line #96: is it possible to show only those content type which have image field associated with them
Comment #5
pgautam commentedHi sn_idea_engineers,
Thanks for your review comments I have incorporated most of the comments given by you. But I would like to make your attention towards some of the comments which you have given:
@sn_idea_engineers: URLs like "https://graph.facebook.com/testsocialbank?access_token" should be a part of admin configuration to make future changes to URL without modifying the code.
@pgautam: We can not expose facebook graph url to admin user as it's standard facebook url not something admin should configure.
@sn_idea_engineers: Do not user CURL instead use drupal_http_request method to call remote URL.
@pgautam: File upload using drupal_http_request creating issue. some other facebook related modules which are already in stable state are using CURL for their facebook url request.
example : https://drupal.org/project/facebook_pull
Comment #6
pgautam commentedHi gaurav.pahuja,
Thanks for your review comments I have incorporated most of the comments given by you also please find my comment on specific comment given by you below:
sn_fb_dynamic_cover_photo.admin.inc:
@gaurav.pahuja : Line # 50: Instead of using text-field with readonly attribute, try to use markup. Readonly attribute can be a security issue
@pgautam: I would like to show this information to site administrator and in future release I will expose this as editable filed. Also I don't see any security issue with read only as this form only available to site administrator with secure admin url.
Thanks.
Paritosh Gautam
Comment #7
gaurav.pahuja commentedI can see most of my review comments as fixed in latest checkin.
Comment #8
klausiThis issue is not fixed? See https://drupal.org/node/532400
Comment #9
PA robot commentedThere are some errors reported by automated review tools, did you already check them? See http://pareview.sh/pareview/httpgitdrupalorgsandboxpgautam2047401git
I'm a robot and this is an automated message from Project Applications Scraper.
Comment #10
pgautam commentedHi klausi,
Thanks for sharing link.
@gaurav.pahuja can you please create corrected status for your review comments if you find satisfactory changes from my end.
Thanks,
Paritosh Gautam
Comment #11
gaurav.pahuja commentedMy Review comments have been incorporated. Changing status to 'reviewed & tested by the community'
Thanks,
Gaurav
Comment #12
kscheirerThe Libraries API module is a recommended method for adding 3rd party dependencies without directly including the code on Drupal.org.
Or perhaps you could integrate with one of the many existing Facebook modules, I would assume at least one of these would provide the kind of FB connectivity code you're looking for?
If you require curl to be installed, please implement a hook_requirements() to check for that. I'm not sure about image_gd_save() - not all servers have GD installed and may have imagemagick instead? Not sure if that function would fail.
Don't use die() if possible, just return from the function, log an error with watchdog() and perhaps give the user a nice message.
----
Top Shelf Modules - Crafted, Curated, Contributed.
Comment #13
madhusudanmca commentedHi,
Manual review:
1) Function getaccesstokenfromdb() on line #204 in "sn_fb_dynamic_cover_photo.module" doesn't exist.
2) After removing above function error, I got below warning:
"Warning: imagejpeg(): Invalid 2nd parameter, it must a filename or a stream in image_gd_save() (line 272 of D:\xampp\htdocs\drupal\modules\system\image.gd.inc)."
Thanks
Comment #13.0
madhusudanmca commentedAdded git repository and sand box link
Comment #14
pgautam commentedAll review comments incorporated.
Adding review bonus tag.
Comment #15
kscheirerAwesome!
----
Top Shelf Modules - Crafted, Curated, Contributed.
Comment #16
klausimanual review:
Although you should definitely fix those issues they are not critical application blockers, so ...
Thanks for your contribution, pgautam!
I updated your account so you can promote this to a full project and also create new projects as either a sandbox or a "full" project.
Here are some recommended readings to help with excellent maintainership:
You can find lots more contributors chatting on IRC in #drupal-contribute. So, come hang out and stay involved!
Thanks, also, for your patience with the review process. Anyone is welcome to participate in the review process. Please consider reviewing other projects that are pending review. I encourage you to learn more about that process and join the group of reviewers.
Thanks to the dedicated reviewer(s) as well.
Comment #17.0
(not verified) commentedList of modules reviewed.