Follow-up to: #645468: Filter module no longer needs to be loaded by default

Problem

  • Filter module is marked as required = TRUE in its .info file, even though it is not required.

Details

  • Filter module was required at some point in the past, since it contained the essential filter_xss() functions. Those have been moved into common.inc though.
  • Some modules are calling into check_markup(), but since many/most use-cases have been converted into Text fields, these modules should just simply declare proper dependencies now.
  • In general, there are far more modules that depend on Text module's field now.
  • The list of callers to check_markup() is a testament of that. :)

Proposed solution

  1. Replace the required flag for Filter module with proper dependencies.

Related issues

Support from Acquia helps fund testing for Drupal Acquia logo

Comments

sun’s picture

Status: Active » Needs review
FileSize
2.04 KB

Status: Needs review » Needs work

The last submitted patch, drupal8.filter-required.1.patch, failed testing.

sun’s picture

Status: Needs work » Needs review
FileSize
7.21 KB

EnableDisableTest fails, because Filter module cannot be disabled/uninstalled, since User module depends on it.

However, that's an all-optional soft dependency for the user signatures feature only.

Thus, removed that dependency and wrapped the functional code for user signatures into module_exists('filter') conditions.

Status: Needs review » Needs work

The last submitted patch, drupal8.filter-required.3.patch, failed testing.

sun’s picture

Status: Needs work » Needs review
FileSize
6.64 KB

Same goes for Text module, which depends on Filter module, but is marked as required, for an unknown reason.

Status: Needs review » Needs work

The last submitted patch, drupal8.filter-required.5.patch, failed testing.

Wim Leers’s picture

+1

Looks like you just need to install the filter module for a whole bunch of tests that assume it? There's also a larger set of "The test did not complete due to a fatal error." failures though.

andypost’s picture

Issue summary: View changes
Status: Needs work » Needs review
FileSize
5.59 KB

re-roll, let's see how many test are broken now

Status: Needs review » Needs work

The last submitted patch, 8: 1934772_8.patch, failed testing.

tim.plunkett’s picture

Status: Needs work » Needs review
FileSize
6.84 KB
1.25 KB

Well, these should be in standard.info.yml.

But also, node_add_body_field assumes text is installed. And that is called pretty much indiscriminately...

The last submitted patch, 10: filter-1934772-10.patch, failed testing.

tim.plunkett’s picture

Oh, I guess that will still mask a lot of things since node is always installed in the testing profile... Hm.

andypost’s picture

So we could speed-up testing by making node optional

andypost’s picture

FileSize
319 bytes
6.87 KB

This fixed broken test

sun’s picture

Thanks for moving this forward! :)

  1. +++ b/core/modules/user/lib/Drupal/user/Tests/UserSignatureTest.php
    @@ -19,7 +19,7 @@ class UserSignatureTest extends WebTestBase {
    -  public static $modules = array('comment');
    +  public static $modules = array('comment', 'filter');
    

    This adjustment appears unnecessary, because comment module depends on text module already?

  2. +++ b/core/profiles/standard/standard.info.yml
    @@ -19,6 +19,7 @@ dependencies:
    +  - filter
    
    @@ -29,6 +30,7 @@ dependencies:
    +  - text
    

    Do we need to specify implicit dependencies in installation profiles?

    Hm. Looks like we're doing that already, so this patch just continues to do it.

    I don't really think that specifying implicit dependencies makes sense, as installation profiles should have to care about features only, so ideally we should create an issue to clean that up...

andypost’s picture

andypost’s picture

FileSize
1016 bytes
5.88 KB

let's see how it goes

sun’s picture

  1. +++ b/core/modules/text/text.info.yml
    @@ -6,4 +6,4 @@ version: VERSION
    -required: true
    

    It's great to see that the patch passed.

    However, I'm not sure whether we want to remove the required flag for Text module as part of this issue?

    TBH, I did not think about the consequences of that yet; just Filter module on its own is complex enough already...

    (adding the dependency is definitely within the scope though)

    Perhaps we should defer the removal of the required flag for Text module to a separate issue?

  2. +++ b/core/modules/user/lib/Drupal/user/AccountSettingsForm.php
    @@ -151,14 +151,17 @@ public function buildForm(array $form, array &$form_state) {
         // Account settings.
    +    $filter_exists = $this->moduleHandler->moduleExists('filter');
    ...
           '#title' => $this->t('Enable signatures.'),
    -      '#default_value' => $config->get('signatures'),
    +      '#default_value' => $filter_exists ? $config->get('signatures') : 0,
    +      '#access' => $filter_exists,
    

    I wonder whether we need to add a hook_modules_uninstalled() to User module, so as to automatically disable user signatures if Filter module is uninstalled?

    Thoughts?

Crell’s picture

Agree with #18.2: If user sigs are insecure without filter, they should be disabled. Let's also punt on dealing with text module. Small issues FTW.

sun’s picture

Restored "required: true" for Text module and enhanced user_modules_uninstalled() to disable user signatures if Filter module is uninstalled.

Status: Needs review » Needs work

The last submitted patch, 20: drupal8.filter-required.20.patch, failed testing.

tim.plunkett’s picture

Status: Needs work » Needs review
tstoeckler’s picture

+++ b/core/modules/user/user.module
@@ -1796,6 +1796,10 @@ function user_modules_installed($modules) {
+  }
...
+    \Drupal::config('user.settings')->set('signatures', FALSE)->save();
...
+  if (in_array('filter', $modules)) {
...
+  // User signatures require Filter module.

+++ b/core/modules/user/lib/Drupal/user/AccountSettingsForm.php
@@ -151,14 +151,17 @@ public function buildForm(array $form, array &$form_state) {
+      '#default_value' => $filter_exists ? $config->get('signatures') : 0,
...
-      '#default_value' => $config->get('signatures'),

Minor, but I think the extra check for filter module is unnecessary, since we set the config value to false anyway when the module is being uninstalled. Or am I missing something?

RTBC otherwise.

sun’s picture

Over in #1548204: Remove user signature and move it to contrib, that entire conditional code is moved into a new user_signature module, which, by itself, removes User module's dependency on Filter/Text modules (which presents a circular dependency on its own, because Filter depends on User).

That user_signature issue is a very interesting issue and piece of code, because it is a very typical example of a bridge/glue module use-case commonly found in contrib or on custom sites, so I'm (ab)using that issue to some extent to figure out how such modules will architecturally work in D8. — It already has the attention of Entity/Field API maintainers, but I bet you're interested, too; feedback is highly appreciated! :)

That should not prevent this patch from getting in first though — I'm just "offended" by the ugly conditional code and management logic that is required here. ;)

@tstoeckler: The additional condition in AccountSettingsForm is required, because unlike in the user account form, the form element(s) are only hidden via #access (which makes sense, because the "Personalization" container can be extended to contain further personalization settings by contrib modules).

sun’s picture

sun’s picture

To my surprise, this patch still applies + passes. :)

Let's move forward here?

Wim Leers’s picture

Status: Needs review » Reviewed & tested by the community
catch’s picture

Do we not render signatures anywhere in core any more?

sun’s picture

As of now, signatures are rendered in template_preprocess_comment(), but the code is wrapped in a condition that checks whether user signatures are enabled. This patch here ensures to disable that setting in case Filter module is uninstalled.

After this patch, I'd like to proceed with #1548204: Remove user signature and move it to contrib, which is going to turn the signature text field into a base field on the User entity + removes all conditional rendering from Comment and User modules.

catch’s picture

Status: Reviewed & tested by the community » Needs review

So that's reasonable, but could we use #access on the user-facing forms as well instead of conditionally defining the form element? Similar to what happens in admin.

I'm thinking of modules that alter the signature form in some way. Also the patch doesn't make me 100% confident about what happens to existing signatures in the db when users are edited.

sun’s picture

Adjusted and clarified the code on both aspects.

I think this is ready now.

Note: The change won't have an immediate effect (primarily with respect to test suite performance), since Text module was marked as required for any reason, and Text module depends on Filter module. Resolving that is a separate follow-up issue.

sun’s picture

Created that follow-up issue, as mentioned in #18.1 already:

#2191285: Text module is not required, but is marked as required

Status: Needs review » Needs work

The last submitted patch, 31: drupal8.filter-required.31.patch, failed testing.

Berdir’s picture

Status: Needs work » Needs review
Berdir’s picture

Status: Needs review » Reviewed & tested by the community

The signature stuff is a bit weird, but hardly anyone will ever see that, and if we can make text optional too and node not required for testing.module, then that will save us 3 modules that we currently have to enable for every test.

Status: Reviewed & tested by the community » Needs work

The last submitted patch, 31: drupal8.filter-required.31.patch, failed testing.

sun’s picture

Status: Needs work » Needs review
sun’s picture

Status: Needs review » Reviewed & tested by the community
catch’s picture

Title: Filter module is not required, but is marked as required » Change record: Filter module is not required, but is marked as required
Status: Reviewed & tested by the community » Active
Issue tags: +Missing change record

OK. Committed/pushed to 8.x. I couldn't find the issue for 'signature as a field' on a quick search, if someone knows where that is please link it.

Needs a change notice so contrib modules can add the dependency if they need it.

Berdir’s picture

The issue for that is #1548204: Remove user signature and move it to contrib, you created it :)

Edit, fixed issue link, dropped a number

xjm’s picture

Issue tags: +Needs change record
xjm’s picture

Maybe we could expand the scope of https://drupal.org/node/1397856 ?

Berdir’s picture

Title: Change record: Filter module is not required, but is marked as required » Filter module is not required, but is marked as required
Assigned: sun » Unassigned
Status: Active » Postponed
Issue tags: -Missing change record, -Needs change record

As long as text.module isn't optional too, nothing has actually changed, so there's no point in updating the documentation yet, we just need to add both modules to that change notice after #2191285: Text module is not required, but is marked as required.

Berdir’s picture

Status: Postponed » Fixed

Hm, I meant fixed.

sun’s picture

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.