Closed (fixed)
Project:
Drupal.org security advisory coverage applications
Component:
module
Priority:
Normal
Category:
Task
Assigned:
Unassigned
Issue tags:
Reporter:
Created:
6 May 2014 at 01:34 UTC
Updated:
15 Jun 2014 at 10:20 UTC
Jump to comment: Most recent
Comments
Comment #1
PA robot commentedThere are some errors reported by automated review tools, did you already check them? See http://pareview.sh/pareview/httpgitdrupalorgsandboxchtombleson2259321git
We are currently quite busy with all the project applications and we prefer projects with a review bonus. Please help reviewing and put yourself on the high priority list, then we will take a look at your project right away :-)
Also, you should get your friends, colleagues or other community members involved to review this application. Let them go through the review checklist and post a comment that sets this issue to "needs work" (they found some problems with the project) or "reviewed & tested by the community" (they found no major flaws).
I'm a robot and this is an automated message from Project Applications Scraper.
Comment #2
chtombleson commentedI have fixed these issues.
Comment #3
chtombleson commentedComment #4
heddnReviewed D7 project.
Javascript should follow https://drupal.org/node/121997 & https://drupal.org/node/172169
Move your admin UI stuff into a new file
mobi2go.admin.incand update your hook_menu() to reference it from there. This reduces the amount of stuff that must be loaded by Drupal and therefore saves memory.mobi2go_block_view()The site and container variables aren't passed through sanitization. This could cause XSS or other bad things. I've added PAReview: security. When you fix the issue, please don't remove the tag. It is used for trending purposes.
Comment #5
chtombleson commentedI have made the changes to both D6 & D7 and is ready for review again.
Comment #6
heddnFor D7, can you also use a js behavior and a closure?
Rather than using filter_var, consider using Drupal's sanitization functions, specifically check_plain.
Admin config form for Mobi2GoThis code comment should end in a full stop i.e. a period.
Comment #7
chtombleson commentedI have changed from using filter_var to check_plain and have added fullstop where need to comments.
I don't see a reason for using a JS behaviour as it may cause my javascript not to work as intended.
Comment #8
chtombleson commentedComment #9
sleepingmonkI think that since your module sets variables in mobi2go.admin.inc via system_settings_form() you need to delete the variables on uninstall using hook_uninstall in mobi2go.install
Comment #10
chtombleson commentedI have added the uninstall hook to mobi2go.install
Comment #11
mpdonadioManual review, as I don't have a Mobi2Go account.
You still have a master branch in the repo; this should be removed.
Drupal 7 branch:
You should really line wrap your README.txt to 70 columns.
mobi2go_uninstall() uses the wrong number of spaces for indentation; should be two
Javascript indentation should use two spaces and not four.
Other small formatting issues, http://pareview.sh/pareview/httpgitdrupalorgsandboxchtombleson2259321git
I would implement a hook_requirements() that warns when the proper variables aren't set.
mobi2go_block_view(), line 78, you probably want to run the ID through drupal_html_class() to ensure that it is valid.
Rather than using drupal_add_js() in mobi2go_block_view(), you should use the #attached property, especially since drupal_add_js() is now deprecated in D8.
In mobi2go_block_view(), you may want to change $block['content'] = ... to $block['content']['container']['#markup'] = ... This will help if anyone needs to hook_block_view_alter() it.
I also agree with @heddn about not using a behavior. For example, this won't work if someone wants to use it where the order form gets AJAXed in.
Pretty much all of this also applies to the Drupal 6 branch.
I'm leaving this as Needs Review, as I can't actually test w/o a Mobi2Go account, and I don't know if the behavior thing is a show stopper. Otherwise, the things above are rather small.
Comment #12
izus commentedchanging status as of #11
Comment #13
chtombleson commentedI have made the changes and is ready for review again.
Comment #14
heddnActually, a small correction to #2259343-11: [D6][D7] Mobi2Go. HTML ids should be passed through drupal_html_id(). drupal_html_class only formats a valid html class. drupal_html_id will ensure a unique HTML id.
I'm going to say that isn't a release blocker an can easily be fixed. This project is RTBCed. The next step is to wait for a git admin to review and grant access.
Comment #15
mpdonadioYeah, drupal_html_id() is correct. If nobody else thinks that not using a behavior is a blocker, then I am also fine with RBTC.
Comment #16
heddnre: #2259343-15: [D6][D7] Mobi2Go, this project is now using a JS behaviour.
Comment #17
mpdonadioYes, @heddn is correct. I am going to crawl off for a little while and write myself a note to not to do anything important on Monday mornings...
Comment #18
klausiIt appears you are working in the "7.x" branch in git. You should really be working in a version specific branch. The most direct documentation on this is Moving from a master branch to a version branch. For additional resources please see the documentation about release naming conventions and creating a branch in git.
Review of the 7.x branch:
This automated report was generated with PAReview.sh, your friendly project application review script. You can also use the online version to check your project. You have to get a review bonus to get a review from me.
manual review:
But otherwise looks good to me, so ...
Thanks for your contribution, chtombleson!
I updated your account so you can promote this to a full project and also create new projects as either a sandbox or a "full" project.
Here are some recommended readings to help with excellent maintainership:
You can find lots more contributors chatting on IRC in #drupal-contribute. So, come hang out and stay involved!
Thanks, also, for your patience with the review process. Anyone is welcome to participate in the review process. Please consider reviewing other projects that are pending review. I encourage you to learn more about that process and join the group of reviewers.
Thanks to the dedicated reviewer(s) as well.