Closed (won't fix)
Project:
Drupal.org security advisory coverage applications
Component:
module
Priority:
Normal
Category:
Task
Assigned:
Unassigned
Issue tags:
Reporter:
Created:
19 Aug 2014 at 22:27 UTC
Updated:
2 Apr 2015 at 10:26 UTC
Jump to comment: Most recent, Most recent file
Comments
Comment #1
PA robot commentedThere are some errors reported by automated review tools, did you already check them? See http://pareview.sh/pareview/httpgitdrupalorgsandboxkladrian2324283git
We are currently quite busy with all the project applications and we prefer projects with a review bonus. Please help reviewing and put yourself on the high priority list, then we will take a look at your project right away :-)
Also, you should get your friends, colleagues or other community members involved to review this application. Let them go through the review checklist and post a comment that sets this issue to "needs work" (they found some problems with the project) or "reviewed & tested by the community" (they found no major flaws).
I'm a robot and this is an automated message from Project Applications Scraper.
Comment #2
kladrian commentedComment #3
kladrian commentedComment #4
kladrian commentedComment #5
pushpinderchauhan commentedComment #6
pushpinderchauhan commented@kladrian, thankyou for your contribution.
Automated Review
Best practice issues identified by pareview.sh / drupalcs / coder. None.
Manual Review
Please add your comment how your module is different from above modules.
"'access arguments' => array('administer users'),": that permission is not defined by your module in hook_permission()? Also the permission name does not really fit?
@used with@$field_instance['settings']['user_profile_form_by_role'], add your comment on this. Same with$show_in_profile_form = @$context['instance']['settings']['user_profile_form'];and$allowed_roles = @$context['instance']['settings']['user_profile_form_by_role'];.$base_img_path = '';is empty as you are using it further to retrieve image that make your help page so terrible.The starred items (*) are fairly big issues and warrant going back to Needs Work. Items marked with a plus sign (+) are important and should be addressed before a stable project release. The rest of the comments in the code walkthrough are recommendations.
Please don't remove the security tag, we keep that for statistics and to show examples of security problems.
However I am unable to review your complete module code and functionality as it producing fatal error, better to fix these first. One more thing, I am not a git administrator, so I would recommend you, please help to review other project applications to get a review bonus. This will put you on the high priority list, then git administrators will take a look at your project right away :-)
Thanks Again!
Comment #7
kladrian commentedThank you a lot for the great review and for all effort you put on it. I (think) I've solved all issues you've reported.
I'll write down a list of all changes/fix I've made.
No duplication
Differences between User Profile Override module and Profile Privacy and User Field Privacy:
- only site administrators can decide which field can be viewd/edited by user
- only user with selected roles can be able to edit field
This can be useful when you need to add more information to user and you don't want user to see them or edit them.
README.txt/README.md
Rewritten using README Template. as you suggested
Secure code
- Changed permission name to administer site configuration as suggested by pareview
- Now calling both menu URLs give correctly "Access denied" page.
Coding style & Drupal API usage
Thank you again, I hope this is better now.
Comment #8
kladrian commentedComment #9
kladrian commentedAdded tests with simpletest framework.
Comment #10
kladrian commentedComment #11
kladrian commentedComment #12
sumitmadan commentedHi kladrian,
Great efforts and cool module... But I feel that this needs a little change.
Suppose, I have a "editor" role. I have selected the "Display in user edit profile form" option for editor role for a field. The fields should be hidden for simple authenticated or other type of user, but it showing disabled field. I am saying it because what if admin doesn't want to display the field for other user.
Comment #13
kladrian commentedComment #14
kladrian commentedHi sumitmadan,
thank you so much for your review and your suggestions.
I've made a significant change in my module following your idea.
Now you can grant view and/or edit permissions for each system role.
After this change I've found useless all ajax icons in overview page, so I've replaced them with just an overview of which roles are allowed to view and edit each field.
Thanks again for your effort.
Comment #15
ankitgarg commentedHello,
Please review at least 3 projects and add the urls of reviews on your issue page so that community members will consider reviewing your code.
Module works fine for me. Just one little change. Indefined index notice are there, check first whether index exist or not. See attached image.
Comment #16
PA robot commentedClosing due to lack of activity. If you are still working on this application, you should fix all known problems and then set the status to "Needs review". (See also the project application workflow).
I'm a robot and this is an automated message from Project Applications Scraper.