Closed (fixed)
Project:
Drupal.org security advisory coverage applications
Component:
module
Priority:
Normal
Category:
Task
Assigned:
Unassigned
Reporter:
Created:
6 Mar 2014 at 21:42 UTC
Updated:
12 Jul 2014 at 12:40 UTC
Jump to comment: Most recent, Most recent file
Comments
Comment #1
gaetanp commentedComment #2
gaetanp commentedComment #3
PA robot commentedWe are currently quite busy with all the project applications and we prefer projects with a review bonus. Please help reviewing and put yourself on the high priority list, then we will take a look at your project right away :-)
Also, you should get your friends, colleagues or other community members involved to review this application. Let them go through the review checklist and post a comment that sets this issue to "needs work" (they found some problems with the project) or "reviewed & tested by the community" (they found no major flaws).
I'm a robot and this is an automated message from Project Applications Scraper.
Comment #4
nicoloye commentedNice work ! :)
Comment #5
anatalsceo commentedGreat module !
Comment #6
gaetanp commentedReview :
Comment #7
gaetanp commentedComment #8
gaetanp commentedComment #9
gaetanp commentedComment #10
gaetanp commentedComment #11
Garrett Albright commentedSince $_GET['q'] will be set on every page load (including if clean URLs are enabled), this if clause will never fire. Perhaps you should check if particular $_GET parameters are empty instead.
…what.
Later in hour hook_requirements implementation, you check for
function_exists('curl_init');. Why are you checking for the existence of the cURL library if your code uses drupal_http_request() anyway?Comment #12
gaetanp commentedHello Garret :)
Thanks for your review, you are totally right for the .install requirements, curl is not necessary I totally forgot to remove it.
For the $_GET, this function is only triggered for the url defined in the hook menu : commerce_moolah/ipn. It is basically testing that the URL is accessed by GET method and not POST.
This is why I'm checking other parameters just below (ipn_secret, status, tx).
Comment #13
gaetanp commentedComment #14
Garrett Albright commented$_GET will still contain values on a POST request on a Drupal site. If you really want to confirm that a request was made using the GET request method, the most correct way is to check
$_SERVER['REQUEST_METHOD'] === 'GET'.Comment #15
gaetanp commentedRemoved unecessary check on $_GET.
Made some DRY refactoring.
Raising priority as it's been already 2 weeks.
Comment #16
Garrett Albright commentedI think this looks good. If I had the capabilities to approve you, I would. :D
Two more minor nitpicks I may have missed before:
One, in _commerce_moolah_get_currencies(), the currency names should probably be translable (use the t() function).
Two, regarding…
Generally, with URLs, you should use !placeholder instead of @placeholder (so !url instead of @url), since you probably don't want them escaped. Check out the documentation for format_string() for the difference between the three different kinds of placeholders.
To the moon!
Comment #17
gaetanp commentedYou are right for the placeholder, I fixed it ;)
The currencies names is not meant to be translatable so I made no change.
Hope this will be approved soon :-/
Thanks Garret !
Edit : I just sent you a little something ;)
Comment #18
gillisig commentedI am getting the following two errors multiple times at /admin/commerce/config/payment-methods/manage/commerce_payment_moolah/edit/3:
Notice: Undefined variable: settings in commerce_moolah_default_settings() (line 52 of /home/galaxy/public_html/sites/all/modules/commerce_moolah/commerce_moolah.module).
Notice: Undefined index: bitcoin_guid in commerce_moolah_settings_form() (line 80 of /home/galaxy/public_html/sites/all/modules/commerce_moolah/commerce_moolah.module). (except one for each coin for this error)
It seems to cause the guid not to save when I try to.
Let me know if you need any more info.
I look forward to using this module :)
Comment #19
gaetanp commentedOops my latest refactoring was wrong.
Everything is fixed now.
Comment #20
gillisig commentedGreat your fix solved it :)
However when I was making a test payment I got stuck at where it says "Please wait while you are redirected to the payment server. If nothing happens within 10 seconds, please click on the button below." and there was no button to press.
Comment #21
gaetanp commentedDid you set you merchant settings correctly?
I have no problem on my side.
Comment #22
gillisig commentedI tried again and it seems to be working this time. However that button the message refers to was nowhere to be seen though so that might be something to look at.
Also slightly off topic but related, the button on the page that appears at moolah.io that says "Pay with Auroracoin/Bitcoin/etc..", what is it supposed to do exactly? I am paying with auroracoin but it is unclear to me what it is supposed to do.
Thanks for your hard work on this module though.
EDIT: After finishing the payment by clicking the "Click here to return to the merchant." moolah.io gives me I am returned back to the page that redirects me to moolah.io causing a loop. I also get the following error on that page:
Notice: Undefined index: payment in theme_commerce_checkout_progress_list() (line 173 of public_html/profiles/commerce_kickstart/modules/contrib/commerce_checkout_progress/commerce_checkout_progress.module).
I should note that I am running Drupal commerce 1.4 if that changes anything.
Comment #23
gaetanp commentedRaising priority to critical as it's been here for 4+ weeks :-/
Comment #24
gaetanp commentedIs the review queue still used, is anyone is even reviewing modules?
What I am supposed to do?
Comment #25
mpdonadiogaetanp, sorry for the delay. The review queue got backed up. I can't approve your project, but can do a thorough review, bu
Automated Review
Nothing major, but linewrap these.
Manual Review
1. Project page looks OK.
2. README.txt mentions curl, but you aren't using any curl functions.
3. The module uses entity_metadata_wrapper(), but you are not declaring a dependency on entity. Commerce does require this, but you should really add this to the .info file in case something changes with Commerce.
4. Your code doesn't use proper docblocks.
5. Can you add element validation to $form['api_key'] and $form['ipn_secret']?
6. In commerce_moolah_submit_form_submit, line 150, you shouldn't combine the logic like that. The default value that core uses is 'Drupal'.
7. On commerce_moolah_submit_form_submit, line 142, use REQUEST_TIME.
8. In commerce_moolah_submit_form_submit, you should have a comment to the Moola.io API docs for reference.
9. In commerce_moolah_submit_form_submit, line 172, you don't need to call url(). drupal_http_request() can take the query options.
10. You should also check the $response->code to make sure it is 200 before proceeding, and handle the error if it isn't.
11. In commerce_moolah_get_transaction_from_remote(), you don't need all the fields from the table, just transaction_id.
12. In commerce_moolah_settings_form, build the link outside of t() with l() and pass it in via a placeholder.
I'm sending this back to Needs Work for 2, 3, 6, 8, 9, 12. These aren't major issues, but I think there are enough small things before a project administrator takes a look. I am doing a lot of reviews, and once you take care of these I can give you a prompt review and RBTC if nothing else comes up.
Comment #26
mpdonadioComment #27
gaetanp commented2. FIXED.
3. Fixed.
4. I format it as pareview adviced me.
5. Actually I can't.
6. It's just for logging on Moolah side. I'm not mixing logic, I print the site name, if none found the webiste URL.
7. Fixed.
8. Fixed.
9. Fixed.
10. Fixed.
11. Fixed.
12. Fixed.
Comment #28
mpdonadioI changed the status so it gets in the queue. Also, I was wrong about #12. Sorry about that. See https://api.drupal.org/api/drupal/includes!common.inc/function/l/7 That won't be a show stopper, though, if it doesn't get changed before another review.
Comment #29
klausiReview of the 7.x-1.x branch:
This automated report was generated with PAReview.sh, your friendly project application review script. You can also use the online version to check your project. You have to get a review bonus to get a review from me.
But otherwise looks RTBC to me. Assigning to mpdonadio as he might have time to take a final look at this.
Removing review bonus tag, you can add it again if you have done another 3 reviews of other projects.
Comment #30
mpdonadioAutomated Review
Review of the 7.x-1.x branch:
This automated report was generated with PAReview.sh, your friendly project application review script. You can also use the online version to check your project. You have to get a review bonus to get a review from me.
Manual Review
You can use drupal_http_build_query instead of http_build_query (line 175), or use the second paramter to drupal_http_request (line 180).
Use drupal_json_decode() instead of json_decode (line 187).
You need to translate the titles for 'api_key' and 'ipn_secret' in commerce_moolah_settings_form(). Long term, will there be any way to validate these?
No blocking issues. Agree with @klausi that this is ready for prime time.
Comment #31
mpdonadioThanks for your contribution, gaetanp!
I updated your account so you can promote this to a full project and also create new projects as either a sandbox or a "full" project.
Here are some recommended readings to help with excellent maintainership:
You can find lots more contributors chatting on IRC in #drupal-contribute. So, come hang out and stay involved!
Thanks, also, for your patience with the review process. Anyone is welcome to participate in the review process. Please consider reviewing other projects that are pending review. I encourage you to learn more about that process and join the group of reviewers.
Thanks to the dedicated reviewer(s) as well.