Closed (fixed)
Project:
Drupal.org security advisory coverage applications
Component:
module
Priority:
Normal
Category:
Task
Assigned:
Issue tags:
Reporter:
Created:
16 Jun 2021 at 16:35 UTC
Updated:
8 Apr 2022 at 13:49 UTC
Jump to comment: Most recent
Comments
Comment #2
avpadernoThank you for applying! I added the Git instructions for non-maintainer users and the PAreview checklist link. Reviewers will check the project and post comments to list what should be changed.
If you haven't done it, yet, please check the PAreview report and fix what needs to be fixed. There could be some false positives; verify that what reported is correct, before making any change.
Comment #3
scott_earnest commentedthank you! i will review the PA report and update as necessary.
Comment #4
scott_earnest commentedHello! I have addressed the PAReview checklist items with the latest release 1.0.2. Please let me know what else is needed from me at this point. Thank you for your time!
Comment #5
rajeshreeputraPlease go through the PAreview checklist as it shows few issues are still there. Let me know if I can help.
http://pareview.net/r/227
Thanks,
Rajeshreeputra
Comment #6
avpadernoA review needs to be more than See this link for a list of issues to be resolved. That's why I didn't change status when I wrote my previous comment.
Comment #7
avpadernoI changed the issue priority as described on Review process for security advisory coverage: What to expect / Application Review Timelines.
To reviewers: Please change back the priority to Normal after reviewing the project.
Comment #8
avpadernoStrings shown in the user interface needs to be translated; this also sanitize values entered from users (in this case, the settings) when rendered inside HTML markup.
Comment #9
anoopjohn commented@scott_earnest - You might also want to delete the 1.x branch and follow the recommended branch naming conventions - https://www.drupal.org/node/1127732. I see that you already have proper branch names. So you might want to delete the 1.x branch and that should take care of the git issue related to the branch.
Comment #10
avpaderno1.x is a correct branch name, and it's show as release branch name in Release naming conventions / Release branches.
What is wrong is the 1.0.0 branch, as that is a tag name, not a branch name. That is not a tag name for a 1.x branch, though. The 1.0.0 branch needs to be removed.
Comment #11
scott_earnest commentedThank you for your assistance! I have updated the codebase to use the translate wrapper around the user input. Also I have removed the 1.0.0 branch from the server. Unfortunately seems that the PAReview link is no longer working. Please let me know of next steps.
Comment #12
scott_earnest commentedComment #13
bigbaldy commentedAutomated Review
Since the automated testing is not working, I ran the code through phpcs.
phpcs --standard=Drupal media_video_micromodal
FILE: media_video_micromodal/src/Plugin/Field/FieldFormatter/MicromodalFieldFormatter.php
------------------------------------------------------------------------------------------------------------------------
FOUND 0 ERRORS AND 1 WARNING AFFECTING 1 LINE
------------------------------------------------------------------------------------------------------------------------
431 | WARNING | [x] '@todo: this always returns "null", maybe b/c of this bug:' should match the format '@todo Fix
| | problem X here.'
phpcs --standard=DrupalPractice media_video_micromodal
FILE: /var/www/john/d5/test/web/modules/custom/media_video_micromodal/js/micromodal.min.js
------------------------------------------------------------------------------------------
FOUND 0 ERRORS AND 1 WARNING AFFECTING 1 LINE
------------------------------------------------------------------------------------------
1 | WARNING | File appears to be minified and cannot be processed
------------------------------------------------------------------------------------------
FILE: media_video_micromodal/src/Plugin/Field/FieldFormatter/MicromodalFieldFormatter.php
------------------------------------------------------------------------------------------------------------------------
FOUND 0 ERRORS AND 1 WARNING AFFECTING 1 LINE
------------------------------------------------------------------------------------------------------------------------
236 | WARNING | Media::load calls should be avoided in classes, use dependency injection instead
------------------------------------------------------------------------------------------------------------------------
FILE: media_video_micromodal/js/micromodal.min.js
------------------------------------------------------------------------------------------
FOUND 0 ERRORS AND 1 WARNING AFFECTING 1 LINE
------------------------------------------------------------------------------------------
1 | WARNING | File appears to be minified and cannot be processed
------------------------------------------------------------------------------------------
Since the minified file is a 3rd party library this shouldn't be an issue.
[Best practice issues identified by pareview.sh / drupalcs / coder. Please don't copy/paste all of the results unless they are short. If there are a lot, then post a link to the automated review and mention that problems should be addressed.]
Note that perfect adherence to Drupal Coding Standard is NOT a reason to block an application, except for total disregard of them. However, modules should follow them as closely as possible.
Manual Review
There are several video modules that provide some options for modal display. I did not look closely at all of them. This module does seem to provide some additional features.
The license information for the 3rd party asset is missing.
The t function should be used for static strings or strings that have known variables as they will be used for language translation. In #8 you would use t('Additional Classes: '). See Writing Secure Code for dealing with user entered variables that will be included in HTML
The starred items (*) are fairly big issues and warrant going back to Needs Work. Items marked with a plus sign (+) are important and should be addressed before a stable project release. The rest of the comments in the code walkthrough are recommendations.
If added, please don't remove the security tag, we keep that for statistics and to show examples of security problems.
This review uses the Project Application Review Template.
Comment #14
bigbaldy commentedComment #15
scott_earnest commentedThank you for your review and your comments @bigbaldy - I appreciate it and will address those issues.
Comment #16
avpadernoComment #17
scott_earnest commentedGreetings! I am submitting this for re-review. Please use version 1.0.6. Thank you for your time!
Comment #18
satbir.singh commentedComment #19
avpadernoThank you for your contribution! I am going to update your account.
These are some recommended readings to help with excellent maintainership:
You can find more contributors chatting on the IRC #drupal-contribute channel. So, come hang out and stay involved.
Thank you, also, for your patience with the review process.
Anyone is welcome to participate in the review process. Please consider reviewing other projects that are pending review. I encourage you to learn more about that process and join the group of reviewers.
I thank all the dedicated reviewers as well.
Comment #20
scott_earnest commentedThat's wonderful - thank you @apaderno! Yes and big shout out and thanks to the reviewers. I will check out those links and consider being part of the review process.