Tocbot makes it easy to add an automatic table of contents to Drupal sites via a block. This module is a wrapper around the Tocbot javascript library https://tscanlin.github.io/tocbot/ (MIT license) and has a Drupal configuration page to adjust the Tocbot javascript settings.

Project link

https://www.drupal.org/project/tocbot

Git instructions

git clone --branch 7.x-1.x https://git.drupalcode.org/project/tocbot.git

PAReview checklist

https://pareview.sh/pareview/https-git.drupal.org-project-tocbot.git

CommentFileSizeAuthor
#9 pareview.txt3.19 KBklausi
Support from Acquia helps fund testing for Drupal Acquia logo

Comments

NicholasS created an issue. See original summary.

nickonom’s picture

Status: Needs review » Needs work

The Coder Review module reveals the following inconsistencies that need to be addressed:

sites/all/modules/tocbot/tocbot.module
tocbot.module
severity: normalreview: comment_docblock_fileFile: @file block missing (Drupal Docs) [comment_docblock_file]
severity: normalreview: style_paren_spacingLine 27: use a space between the closing parenthesis and the open bracket [style_paren_spacing]
function tocbot_config_form($form, $form_state){
severity: normalreview: style_paren_spacingLine 202: use a space between the closing parenthesis and the open bracket [style_paren_spacing]
function tocbot_config_form_submit($form, $form_state){
severity: normalreview: style_camel_caseLine 204: do not use mixed case (camelCase), use lower case and _ [style_camel_case]
  $fieldsToSave = [
severity: normalreview: style_camel_caseLine 230: do not use mixed case (camelCase), use lower case and _ [style_camel_case]
  foreach ($fieldsToSave as $value) {
severity: normalreview: style_camel_caseLine 231: do not use mixed case (camelCase), use lower case and _ [style_camel_case]
    $formValue = $form_state['values'][$value];
severity: normalreview: style_camel_caseLine 232: do not use mixed case (camelCase), use lower case and _ [style_camel_case]
    variable_set($value, $formValue);
severity: normalreview: style_string_spacingLine 315: String concatenation should be formatted with a space separating the operators (dot .) and the surrounding terms [style_string_spacing]
    $attached['js'] = array(libraries_get_path('tocbot').'/sites/all/libraries/tocbot/js/tocbot.min.js' => array(
severity: normalreview: style_comma_spacingLine 320: missing space after comma [style_comma_spacing]
    $attached['js'] = array("https://cdnjs.cloudflare.com/ajax/libs/tocbot/4.4.2/tocbot.min.js" => array('type' => 'external', 'weight' => -20,));
severity: normalreview: style_string_spacingLine 324: String concatenation should be formatted with a space separating the operators (dot .) and the surrounding terms [style_string_spacing]
    $attached['css'] = array(libraries_get_path('tocbot').'/sites/all/libraries/tocbot/css/tocbot.css' => array(
severity: normalreview: style_control_spacingLine 346: Control statements should have one space between the control keyword and opening parenthesis [style_control_spacing]
  switch($delta) {

and

sites/all/modules/tocbot/js/tocbot-init.js
tocbot-init.js
severity: normalreview: comment_docblock_fileFile: @file block missing (Drupal Docs) [comment_docblock_file]
severity: normalreview: style_camel_caseLine 5: do not use mixed case (camelCase), use lower case and _ [style_camel_case]
    attach: function attachTocBot(context, settings) {
apaderno’s picture

Issue summary: View changes

Thank you for applying! I added the PAReview checklist link. Reviewers will check the project and post comments to list what should be changed.

If you haven't done it, yet, please check the PAReview report and fix what needs to be fixed. There could be some false positives; verify that what reported is correct, before making any change.

apaderno’s picture

  • What follows is a quick review of the project; it doesn't mean to be complete
  • For every point, I didn't make a complete list of where the code should be fixed, but an example of what is wrong in the code
  • Not all the points are application stoppers; some of them describe changes that would be preferable to make
  1. The name of the persistent variables set with variable_set() must be prefixed by the module machine name
  2. The route for admin/config/content/default doesn't define any page callback; Drupal will use the one set for admin/config/content, which is not the desired one
  3. Drupal doesn't use any hook_content() hook, so tocbot_content() is not a hook implementation
apaderno’s picture

Status: Needs work » Closed (won't fix)

If you are still working on this application, you should fix all known problems and set the status to Needs review. (See also the project application workflow.)
Please don't change status of this application if you aren't sure you have time to dedicate to this application, or it will be closed again as won't fix.

I am closing this issue due to lack of replies.

NicholasS’s picture

Sorry for the late reply I pushed changes to the branch and I believe worked through most of the issues identified. How do I trigger a new automated test to see if all those issues were corrected properly?

NicholasS’s picture

Status: Closed (won't fix) » Needs review

Pushed changes and would like another automated test to see if everything was corrected appropriately.

seroton’s picture

Hi,

You just need to click repeat review, or submit the branch again from homepage. Latest review:
https://pareview.sh/pareview/https-git.drupal.org-project-tocbot.git-7.x... looks ok now

Thanks for your module!

klausi’s picture

Status: Needs review » Needs work
FileSize
3.19 KB

Thanks for your contribution!

* Error: Call to undefined function libraries_get_path() in tocbot_block_view() (line 357 of tocbot.module). Looks like you forgot to declare a dependency tot he libraries API module in the info file? Please alsways test your module on a clean drupal installation.
* JS error: Uncaught TypeError: Cannot read property 'className' of null. Please test your module's JS, it does not seem to work.
* hook_uninstall() is missing to remove all your variables, please add that.

I wanted to test the title display of the block for XSS security issues, but the Javascript breaks. Can you fix the errors from above? Then I can take another look.

Attached are some Coder errors that you should also fix.

NicholasS’s picture

@klausi thanks for looking at it in more detail, the uninstall makes sense I didn't think about that. I will work through these new issues.

I was looking over Drupal docs and couldn't find a clear answer but during the security review should I just be pushing updates onto the branch? Wasn't clear on that.

NicholasS’s picture

A Big thank you for everyone who has reviewed this so far. I tested this a lot more in a fresh D7 site, made the module not depend on the Libraries module, made it more presentable out of the box. I also finally got phpcs working with VSCODE (on windows everything seems harder) so I think I got all the errors and comments corrected identified in the reports.

NicholasS’s picture

Status: Needs work » Needs review
vuil’s picture

Thank you for the contribution!

I have not found any security related issues into the code.
Good work!

klausi’s picture

Status: Needs review » Reviewed & tested by the community

Thank you, yes you just push all new changes to the branch.

All looking good to me now as well. I tried a couple of XSS attacks in the config options but it seems everything is sanitized correctly.

apaderno’s picture

Assigned: Unassigned » apaderno
Status: Reviewed & tested by the community » Fixed

Thank you for your contribution! I am going to update your account.

These are some recommended readings to help with excellent maintainership:

You can find more contributors chatting on the IRC #drupal-contribute channel. So, come hang out and stay involved.
Thank you, also, for your patience with the review process.
Anyone is welcome to participate in the review process. Please consider reviewing other projects that are pending review. I encourage you to learn more about that process and join the group of reviewers.

I thank all the dedicated reviewers as well.

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.