Support for Drupal 7 is ending on 5 January 2025—it’s time to migrate to Drupal 10! Learn about the many benefits of Drupal 10 and find migration tools in our resource center.
Follow-up to: #645468: Filter module no longer needs to be loaded by default
Problem
- Filter module is marked as
required = TRUE
in its .info file, even though it is not required.
Details
- Filter module was required at some point in the past, since it contained the essential
filter_xss()
functions. Those have been moved into common.inc though. - Some modules are calling into
check_markup()
, but since many/most use-cases have been converted into Text fields, these modules should just simply declare proper dependencies now. - In general, there are far more modules that depend on Text module's field now.
- The list of callers to check_markup() is a testament of that. :)
Proposed solution
- Replace the required flag for Filter module with proper dependencies.
Related issues
Comment | File | Size | Author |
---|---|---|---|
#31 | drupal8.filter-required.31.patch | 6.48 KB | sun |
#20 | drupal8.filter-required.20.patch | 6.53 KB | sun |
#17 | 1934772-filter-17.patch | 5.88 KB | andypost |
#17 | interdiff.txt | 1016 bytes | andypost |
#14 | 1934772-filter-14.patch | 6.87 KB | andypost |
Comments
Comment #1
sunRelated: #1548204: Remove user signature and move it to contrib
Comment #3
sunEnableDisableTest fails, because Filter module cannot be disabled/uninstalled, since User module depends on it.
However, that's an all-optional soft dependency for the user signatures feature only.
Thus, removed that dependency and wrapped the functional code for user signatures into
module_exists('filter')
conditions.Comment #5
sunSame goes for Text module, which depends on Filter module, but is marked as required, for an unknown reason.
Comment #7
Wim Leers+1
Looks like you just need to install the filter module for a whole bunch of tests that assume it? There's also a larger set of "The test did not complete due to a fatal error." failures though.
Comment #8
andypostre-roll, let's see how many test are broken now
Comment #10
tim.plunkettWell, these should be in standard.info.yml.
But also, node_add_body_field assumes text is installed. And that is called pretty much indiscriminately...
Comment #12
tim.plunkettOh, I guess that will still mask a lot of things since node is always installed in the testing profile... Hm.
Comment #13
andypostSo we could speed-up testing by making node optional
Comment #14
andypostThis fixed broken test
Comment #15
sunThanks for moving this forward! :)
This adjustment appears unnecessary, because comment module depends on text module already?
Do we need to specify implicit dependencies in installation profiles?
Hm. Looks like we're doing that already, so this patch just continues to do it.
I don't really think that specifying implicit dependencies makes sense, as installation profiles should have to care about features only, so ideally we should create an issue to clean that up...
Comment #16
andypost@sun, seems #1688162: Replace required flag of modules with proper dependencies declares hard dependencies
Comment #17
andypostlet's see how it goes
Comment #18
sunIt's great to see that the patch passed.
However, I'm not sure whether we want to remove the required flag for Text module as part of this issue?
TBH, I did not think about the consequences of that yet; just Filter module on its own is complex enough already...
(adding the dependency is definitely within the scope though)
Perhaps we should defer the removal of the required flag for Text module to a separate issue?
I wonder whether we need to add a hook_modules_uninstalled() to User module, so as to automatically disable user signatures if Filter module is uninstalled?
Thoughts?
Comment #19
Crell CreditAttribution: Crell commentedAgree with #18.2: If user sigs are insecure without filter, they should be disabled. Let's also punt on dealing with text module. Small issues FTW.
Comment #20
sunRestored "required: true" for Text module and enhanced
user_modules_uninstalled()
to disable user signatures if Filter module is uninstalled.Comment #22
tim.plunkett20: drupal8.filter-required.20.patch queued for re-testing.
Comment #23
tstoecklerMinor, but I think the extra check for filter module is unnecessary, since we set the config value to false anyway when the module is being uninstalled. Or am I missing something?
RTBC otherwise.
Comment #24
sunOver in #1548204: Remove user signature and move it to contrib, that entire conditional code is moved into a new user_signature module, which, by itself, removes User module's dependency on Filter/Text modules (which presents a circular dependency on its own, because Filter depends on User).
That user_signature issue is a very interesting issue and piece of code, because it is a very typical example of a bridge/glue module use-case commonly found in contrib or on custom sites, so I'm (ab)using that issue to some extent to figure out how such modules will architecturally work in D8. — It already has the attention of Entity/Field API maintainers, but I bet you're interested, too; feedback is highly appreciated! :)
That should not prevent this patch from getting in first though — I'm just "offended" by the ugly conditional code and management logic that is required here. ;)
@tstoeckler: The additional condition in AccountSettingsForm is required, because unlike in the user account form, the form element(s) are only hidden via #access (which makes sense, because the "Personalization" container can be extended to contain further personalization settings by contrib modules).
Comment #25
sun20: drupal8.filter-required.20.patch queued for re-testing.
Comment #26
sunTo my surprise, this patch still applies + passes. :)
Let's move forward here?
Comment #27
Wim LeersComment #28
catchDo we not render signatures anywhere in core any more?
Comment #29
sunAs of now, signatures are rendered in
template_preprocess_comment()
, but the code is wrapped in a condition that checks whether user signatures are enabled. This patch here ensures to disable that setting in case Filter module is uninstalled.After this patch, I'd like to proceed with #1548204: Remove user signature and move it to contrib, which is going to turn the signature text field into a base field on the User entity + removes all conditional rendering from Comment and User modules.
Comment #30
catchSo that's reasonable, but could we use #access on the user-facing forms as well instead of conditionally defining the form element? Similar to what happens in admin.
I'm thinking of modules that alter the signature form in some way. Also the patch doesn't make me 100% confident about what happens to existing signatures in the db when users are edited.
Comment #31
sunAdjusted and clarified the code on both aspects.
I think this is ready now.
Note: The change won't have an immediate effect (primarily with respect to test suite performance), since Text module was marked as required for any reason, and Text module depends on Filter module. Resolving that is a separate follow-up issue.
Comment #32
sunCreated that follow-up issue, as mentioned in #18.1 already:
#2191285: Text module is not required, but is marked as required
Comment #34
Berdir31: drupal8.filter-required.31.patch queued for re-testing.
Comment #35
BerdirThe signature stuff is a bit weird, but hardly anyone will ever see that, and if we can make text optional too and node not required for testing.module, then that will save us 3 modules that we currently have to enable for every test.
Comment #37
sun31: drupal8.filter-required.31.patch queued for re-testing.
Comment #38
sunComment #39
catchOK. Committed/pushed to 8.x. I couldn't find the issue for 'signature as a field' on a quick search, if someone knows where that is please link it.
Needs a change notice so contrib modules can add the dependency if they need it.
Comment #40
BerdirThe issue for that is #1548204: Remove user signature and move it to contrib, you created it :)
Edit, fixed issue link, dropped a number
Comment #41
xjmComment #42
xjmMaybe we could expand the scope of https://drupal.org/node/1397856 ?
Comment #43
BerdirAs long as text.module isn't optional too, nothing has actually changed, so there's no point in updating the documentation yet, we just need to add both modules to that change notice after #2191285: Text module is not required, but is marked as required.
Comment #44
BerdirHm, I meant fixed.
Comment #45
sun