Closed (fixed)
Project:
Drupal.org security advisory coverage applications
Component:
module
Priority:
Normal
Category:
Task
Assigned:
Issue tags:
Reporter:
Created:
21 Jan 2014 at 07:56 UTC
Updated:
16 Mar 2014 at 17:50 UTC
Jump to comment: Most recent, Most recent file
Comments
Comment #1
nitesh sethia commented@hayashi
Can you please delete master branch and port it on 7.x-1.x.
There are couple of issues with the module:
For the issues in detail refer to
http://pareview.sh/pareview/httpgitdrupalorgsandboxhayashi2073981git
Comment #2
hayashi commented@Nitesh Sethia
Thank you for reviewing.
I have fixed git repository and code issues. Please review again.
Comment #3
Kirschbaum commentedHi hayashi!
Nice module idea. The ability to provide access to specific pages by IP could be really useful. This module actually reminds me a lot of https://drupal.org/project/path_access . Have you checked that module out? Aside from filtering by IP they seem quite similar.
Upon installation I did get an error message on admin/config/people/access_filter/add page. See attached screenshot.
During manual code review I did see that the .install file does not include a hook_uninstall function that deletes database variables upon uninstall. Have you considered adding this? It really helps to avoid database cruft.Update: realized this is not correct as you are not storing any variables outside of the custom table as defined in the schema :)Comment #4
hayashi commented@Kirschbaum
Thank you for reviewing!
I didn't know Path Access module. I have checked that module.
Surely, filtering by path feature is similar. But I think my module is not duplicated because other features have differences. (Using request uri, regex, etc...)
I've fixed it. I'm developing using PHP 5.3, some E_STRICT warnings may be shown on newer version of PHP. I will check on PHP 5.4 soon.
Yes :). Module uses custom table only.
Comment #5
PA robot commentedWe are currently quite busy with all the project applications and we prefer projects with a review bonus. Please help reviewing and put yourself on the high priority list, then we will take a look at your project right away :-)
Also, you should get your friends, colleagues or other community members involved to review this application. Let them go through the review checklist and post a comment that sets this issue to "needs work" (they found some problems with the project) or "reviewed & tested by the community" (they found no major flaws).
I'm a robot and this is an automated message from Project Applications Scraper.
Comment #6
nitesh sethia commentedHi @hayashi,
I was testing your module and I really appreciate that you have created this kind of module.
But I find one small bug which you can solve by just putting below code:-
It will help you in deleting variable when uninstalling module.
Comment #7
hayashi commented@Nitesh Sethia
Thanks. I checked again to be sure, currently my module is not using any variables to be deleted. So I think it is not a bug.
Comment #8
hayashi commentedComment #9
hayashi commentedI've checked on PHP 5.4 and fixed some bugs.
Awating reviews :)
Comment #10
rmn commentedHi Tetsuya
Since, there's no separate statement under the parent if - the two if statement can be combined.
Thanks
Raman
PS: Not marking as 'Needs review' since it isn't a blocker.
Comment #11
hayashi commentedHi @rmn.
Thank you for reporting.
This nested if statements are necessary to avoid running else statement in case first is TRUE and second is FALSE.
But this code is unintelligible, I have fixed it.
Comment #12
hayashi commentedComment #13
vgalindus commentedHi hayashi,
I've tried your module and I get an Error in permissions page.
Regarding duplication of module "Path access" I think there is no stable module for D7 and last commit is 11 months ago so I guess its development status is not active.
\BR
Comment #14
klausiThis sounds like a feature that should live in the existing path_access project. Module duplication and fragmentation is a huge problem on drupal.org and we prefer collaboration over competition. Please open an issue in the path_access issue queue to discuss what you need. You should also get in contact with the maintainer(s) to offer your help to move the project forward. If you cannot reach the maintainer(s) please follow the abandoned project process.
If that fails for whatever reason please get back to us and set this back to "needs review".
Comment #15
hayashi commented@galindus_olidop
Thank you for reporting. I've fixed the issue.
@klausi
I already tried that module and read codes.
So I think it's difficult to integrate my module to them with keeping compatibility. Because basic concept does not match.
Path Access module is based on user roles and path, my module is based on path/request uri and IP address.
Comment #16
klausiSo please add the differences to the existing module to your project page. See also https://drupal.org/node/997024
Comment #17
hayashi commentedI updated project page. Please check it.
Comment #18
alinouman commentedHi Hayashi Thanks for module,There is a flaw in your module. You are restricting access on path(url alias) if i write some regex it surely works. But if i access same regex url through node nid it will not work. So you should have to look for nid too to make it complete secure. Thanks. Removing review tag you can add it again if you have done 3 more reviews.
Comment #19
hayashi commentedHi alinouman
It is by design. Some case I need to allow accessing node by aliased path and deny 'node/*'.
But surely this may cause not intended access. I'm going to add the option to check all aliases.
Thanks.
Comment #20
hayashi commentedI updated module. As default, all aliases are looked up.
Also added 'blind' option for each path patterns to disable looking up aliases.
Please check it works correctly.
(Note: Path and IP address format is changed. Existing filters will not work, please re-edit them.)
Comment #21
alinouman commentedhi hayashi, i have tested it and its working fine. Thanks for your contribution.
Comment #22
hayashi commentedComment #23
klausimanual review:
But otherwise looks RTBC to me.
Assigning to stBorchert as he might have time to take a final look at this.
Comment #24
hayashi commentedThank you for reviewing. I fixed issues.
Comment #25
stborchertaccess_filter_load()db_select()here.db_query('SELECT fid, af from {access_filter} WHERE fid = :fid', array(':fid' => $fid));will be much faster and gives you the same results.t()-functiont()its best practice to add a context so common strings used by multiple modules are not overriden with one translation.ACCESS_FILTER_DENY_ACTION_403 => t('Error') . ': 403 Access Forbidden',Why don't you include the last part in the translatable string? Currently the string is not translatable :(.Comment #26
hayashi commentedThank you for reviewing.
>You really don't need db_select() here.
I've understood. Fixed to use db_query().
>When using t() its best practice to add a context so common strings used by multiple modules are not overriden with one translation.
All right. But currently I want to use common strings.
>Why don't you include the last part in the translatable string?
Because it is HTTP status. I want to show it without translate.
('403 Access Forbidden' is wrong. fixed to '403 Forbidden'.)
Comment #27
klausino other objections for more than a week, so ...
Thanks for your contribution, hayashi!
I updated your account so you can promote this to a full project and also create new projects as either a sandbox or a "full" project.
Here are some recommended readings to help with excellent maintainership:
You can find lots more contributors chatting on IRC in #drupal-contribute. So, come hang out and stay involved!
Thanks, also, for your patience with the review process. Anyone is welcome to participate in the review process. Please consider reviewing other projects that are pending review. I encourage you to learn more about that process and join the group of reviewers.
Thanks to the dedicated reviewer(s) as well.