Aggregator module allows deletion of feed without confirmation. To reproduce this bug

1. Go to feed admin page admin/config/services/aggregator
2. Edit one of the feed
3. Click Delete button, the feed get deleted without any confirmation.

Support from Acquia helps fund testing for Drupal Acquia logo

Comments

Sivaji_Ganesh_Jojodae’s picture

Status: Active » Needs review
FileSize
5.3 KB

Attached patch adds confirm form and it works same as #750290: Add a confirm form for role deletion

Georg’s picture

Status: Needs review » Needs work

Indeed, without the patch it's possible to simply click the wrong button on the edit page and the feed is gone.

After applying the patch, nothing happens at all, when I click on "Delete". I only return to the Feed aggregator controllpanel and the feed is still there.

Sivaji_Ganesh_Jojodae’s picture

Status: Needs work » Needs review

This patch adds a new menu item so you need to clear the cache to see the effect of this patch.

Georg’s picture

thank you, sivaji. You'r right, clearing cache helps.

Patch works for me.

Georg’s picture

#1: 767894_feed_delete_confirm_1.patch queued for re-testing.

sun’s picture

Status: Needs review » Needs work

Looks mostly good.

+++ modules/aggregator/aggregator.admin.inc	11 Apr 2010 16:44:35 -0000
@@ -157,8 +159,6 @@ function aggregator_form_feed_validate($
   if ($form_state['values']['op'] == t('Delete')) {

There's more delete-related code in the submit handler.

+++ modules/aggregator/aggregator.admin.inc	11 Apr 2010 16:44:35 -0000
@@ -198,6 +186,39 @@ function aggregator_form_feed_submit($fo
+  $path = (arg(0) == 'admin') ? 'admin/config/services/aggregator' : 'aggregator/sources';
...
+  $form_state['redirect'] = (arg(0) == 'admin') ? 'admin/config/services/aggregator/' : 'aggregator/sources/';

We should default to the administrative path here, and pass the 'destination' query parameter in the other (front-end) case.

+++ modules/aggregator/aggregator.admin.inc	11 Apr 2010 16:44:35 -0000
@@ -198,6 +186,39 @@ function aggregator_form_feed_submit($fo
+  return confirm_form($form, t('Are you sure you want to delete the feed %name ?', array('%name' => $feed->title)), $path, t('This action cannot be undone.'), t('Delete'));

Can we write the confirm_form() function arguments on multiple lines, like elsewhere?

+++ modules/aggregator/aggregator.test	11 Apr 2010 16:44:36 -0000
@@ -41,6 +41,7 @@ class AggregatorTestCase extends DrupalW
+    $this->drupalPost(NULL, NULL, t('Delete'));

Second NULL should be array().

Powered by Dreditor.

Sivaji_Ganesh_Jojodae’s picture

Status: Needs work » Needs review
FileSize
6.18 KB

@sun, thank you for reviewing the patch.

Attached patch introduces the changes mentioned above, except

We should default to the administrative path here, and pass the 'destination' query parameter in the other (front-end) case.

which is not clear for me.

Additionally it replaces (arg(0) == 'admin') check with user_access('administer news feeds').

Jody Lynn’s picture

Version: 7.x-dev » 8.x-dev
Sivaji_Ganesh_Jojodae’s picture

Status: Needs review » Needs work

The last submitted patch, 767894_feed_delete_confirm_form_7.patch, failed testing.

bfroehle’s picture

Status: Needs work » Needs review
paranojik’s picture

Rerolled.

sascher’s picture

When trying to apply this patch I get an error

git apply 767894-feed_delete_confirm_form-12.patch
error: patch failed: core/modules/aggregator/aggregator.admin.inc:68
error: core/modules/aggregator/aggregator.admin.inc: patch does not apply
error: patch failed: core/modules/aggregator/lib/Drupal/aggregator/Tests/AggregatorTestBase.php:61
error: core/modules/aggregator/lib/Drupal/aggregator/Tests/AggregatorTestBase.php: patch does not apply

I tested this on the build from 3/28/13. The problem still exists

tim.plunkett’s picture

#1946324: Convert confirm_form() in aggregator.admin.inc to the new form interface just completely redid aggregator confirm_forms(). Please use that as a guide, with routes and ConfirmFormBase

ParisLiakos’s picture

Status: Needs review » Needs work
kim.pepper’s picture

Assigned: Sivaji_Ganesh_Jojodae » kim.pepper
FileSize
61.92 KB
80.13 KB

I'm happy to push this ahead.

I propose to:

  • Use the new ConfirmFormBase
  • Add a new operation on the feed 'Delete' (see attached)
  • Remove the 'Delete' link from the Feed edit page (see attached)

feed-edit.png

feed-delete.png

ParisLiakos’s picture

why remove delete button? we should keep it and just redirect to confirm page deletion route, like in most places in core

kim.pepper’s picture

@rootatwc Much better idea!

Looking through the EntityFormController to work out where this link gets rendered, and how to change it...

kim.pepper’s picture

Status: Needs work » Needs review
FileSize
5.1 KB

Changes as per #16. except did not remove delete link from edit form as per #17.

Note, this mostly a rewrite from #12 as it uses the new FormInterface.

Kim

ParisLiakos’s picture

good job! just two things and i think this is ready

+++ b/core/modules/aggregator/lib/Drupal/aggregator/FeedFormController.phpundefined
@@ -139,15 +139,7 @@ public function save(array $form, array &$form_state) {
+    $form_state['redirect'] = array('/admin/config/services/aggregator/delete/feed/' . $feed->id());

this does not have to be array since you are not passing additional stuff like query.
Also preceding slash should be removed

+++ b/core/modules/aggregator/lib/Drupal/aggregator/Form/FeedDelete.phpundefined
@@ -0,0 +1,74 @@
+use Drupal\Core\Form\ConfirmFormBase;
+
...
+  public function buildForm(array $form, array &$form_state, Feed $aggregator_feed = NULL) {

you forgot use-ing the Feed object, typehint will fail

kim.pepper’s picture

Fixes as per #20

Status: Needs review » Needs work

The last submitted patch, 767894-aggregator-confirm-form-21.patch, failed testing.

kim.pepper’s picture

Status: Needs work » Needs review
FileSize
876 bytes
153.53 KB

Updated tests to use new delete path.

kim.pepper’s picture

Woah. That last patch included stuff it wasn't supposed to. Probably because it wasn't rebased of the latest 8.x branch. Let's try this one. Interdiff is the same.

ParisLiakos’s picture

+++ b/core/modules/aggregator/lib/Drupal/aggregator/FeedFormController.phpundefined
@@ -139,15 +139,7 @@ public function save(array $form, array &$form_state) {
+    $form_state['redirect'] = '/admin/config/services/aggregator/delete/feed/' . $feed->id();

this should be
'admin/config/services/aggregator/delete/feed/' . $feed->id()
:)

kim.pepper’s picture

Status: Needs review » Needs work
Issue tags: -FormInterface, -WSCCI-conversion

The last submitted patch, 767894-aggregator-confirm-form-26.patch, failed testing.

ParisLiakos’s picture

Status: Needs work » Needs review
Issue tags: +FormInterface, +WSCCI-conversion
ParisLiakos’s picture

Status: Needs review » Reviewed & tested by the community

looks good to go now, failure was random
thanks!

webchick’s picture

Status: Reviewed & tested by the community » Fixed

Looks great, thanks!

Committed and pushed to 8.x.

Status: Fixed » Closed (fixed)
Issue tags: -FormInterface, -WSCCI-conversion

Automatically closed -- issue fixed for 2 weeks with no activity.