[D7] TMGMT Translator Xplanation

There are some errors reported by automated review tools, did you already check them? See http://pareview.sh/pareview/httpgitdrupalorgsandboxtmgmt_xplanation23524...

We are currently quite busy with all the project applications and we prefer projects with a review bonus. Please help reviewing and put yourself on the high priority list, then we will take a look at your project right away :-)

Also, you should get your friends, colleagues or other community members involved to review this application. Let them go through the review checklist and post a comment that sets this issue to "needs work" (they found some problems with the project) or "reviewed & tested by the community" (they found no major flaws).

I'm a robot and this is an automated message from Project Applications Scraper.

Hi Mathias,
Thank you for this module.

Automated Review

Coder Sniffer has found some issues with your code (please check the Drupal coding standards)

Manual Review

Individual user account

Yes: Follows the guidelines for individual user accounts.

No duplication

Yes: Does not cause module duplication and/or fragmentation.

Master Branch

No: Does not follow the guidelines for master branch.

Licensing

Yes: Follows the licensing requirements.

3rd party assets/code

Yes: Follows the guidelines for 3rd party assets/code.

README.txt/README.md

Yes: Follows the guidelines for in-project documentation and/or the README Template.

Code long/complex enough for review

Yes: Follows the guidelines for project length and complexity.

Secure code

No: List of security issues identified.]

Coding style & Drupal API usage

1. (+)
   

   'access callback' => TRUE,
   

   I suggest to replace this code:

   'access arguments' => array('access content'),
   

   read more: http://drupal.stackexchange.com/questions/49955/how-to-give-anonymous-us...

2. $soap_client_msg = 'The PHP Soap module does not appear to be enabled in';
   $soap_client_msg .= ' this web server configuration. For more ';
   $soap_client_msg .= ' information, please see the <a href="';
   $soap_client_msg .= 'http://www.php.net/manual/en/soap.installation.php';
   $soap_client_msg .= '">php.net soap article</a>.';
   

   I suggest use function t() with placeholders. For example:

   $external_link = t('Look at Drupal documentation at <a href="@drupal-handbook">the Drupal Handbooks</a>.', array('@drupal-handbook' => 'http://drupal.org/handbooks'));
   
   $internal_link = t('To get an overview of your administration options, go to <a href="@administer-page">the Administer screen</a> in the main menu.', array('@administer-page' => url('admin')));
   

   read more: https://www.drupal.org/node/322774

3. (+)
   

   if (!defined('TMGMT_XPLANATION_SUPPORT')) {
     $support_mail = '<a href="mailto:support@xplanation.com">';
     $support_mail = 'Xplanation support';
     $support_mail = '</a>';
     define('TMGMT_XPLANATION_SUPPORT', $support_mail);
   }
   

   You forgot about the concatenation.

This review uses the Project Application Review Template.

There was indeed a master branch for a while but this was already removed by the time that the code got reviewed. Am I missing something here?

A git clone command. You can find the correct git clone command for your sandbox by clicking on the Version control tab, removing the checkbox in front of "Maintainer", and clicking Show. You can then copy-paste the git clone command from the codeblock below "Setting up repository for the first time".

List of security issues identified: Could you further enlighten this?

<?php
'access callback' => TRUE,
?>

It is security issues, because you not control to access

All is only my recomendations.

Hello mathiasve,

I've taken a look at your module. Nice work. Please see my review below:

Individual user account
Yes: Follows the guidelines for individual user accounts.
No duplication
Yes: Does not cause module duplication and/or fragmentation.
Master Branch
Yes: Follows the guidelines for master branch.
Licensing
Yes: Follows the licensing requirements.
3rd party assets/code
Yes: Follows the guidelines for 3rd party assets/code.
README.txt/README.md
Yes: Follows the guidelines for in-project documentation and/or the README Template.

However, on line 41 it says "A visual review can not provided." Did you mean
"can not be provided?" This text was a bit unclear to me.

Code long/complex enough for review
[Yes: Follows the guidelines for project length and complexity.
Secure code
Yes: Meets the security requirements.

Coding style & Drupal API usage
1. (+) filter_xss is being used on literal strings being passed to drupal_set_message. You don't need to sanitize these as you have written them yourself and they don't contain any HTML. They should be passed to the t() method instead.

tmgmt_xplanation.module lines 424, 431

tmgmt_xplanation.plugin.inc lines 917, 929, 949, 953, 959, 965, 971

2. (+) The t() method already sanitizes its arguments in the form of check_plain, so I think filter_xss is unnecessary here.

tmgmt_xplanation.module lines 41, 258, 269

3. Documentation typo: incomming should be incoming

tmgmt_xplanation.plugin.inc line 888

4. I see you are doing a manual decode of only five entities '<', '>', '&', '"', '''. Would the decode_entities method not work in this case? This is likely valid for your situation but I thought I would check.

tmgmt_xplanation.plugin.inc line 891

Hi mathiasve. You're most welcome. I looked over your changes and you're almost there. Your error and notice messages that you send out through drupal_set_message must all be wrapped in the t() method. This is not for sanitation purposes but allows those messages to be translated. You removed the filter_xss which is good, but it needed to be replaced with t().

This occurs on the following lines:

tmgmt_xplanation.module lines 424, 431

tmgmt_xplanation.plugin.inc lines 917, 929, 949, 953, 959, 965, 971

The reason the Code review is producing an error in that case is because you are passing in variables to the t() method and making the code sniffer suspicious that your message is not sanitized.

At line 91, for example, you have:

form_error($element, filter_xss(t($validator_err_msg, $validator_err_msg_arr)));

But it would also be fine, and slightly more efficient, to use the following:

form_error($element, t('The %title needs to be after the current date!', array('%title' => $element['#title'])));

Your error code is sanitized either way, so this is a minor issue and shouldn't block your module from release. I do not see any other issues so I'm setting this to RTBC.

Thanks for your contribution!

I updated your account so you can promote this to a full project and also create new projects as either a sandbox or a "full" project.

Here are some recommended readings to help with excellent maintainership:

• Dries' post on Responsible maintainers
• Best practices for creating and maintaining projects
• Maintaining a drupal.org project with Git
• Commit messages - providing history and credit
• Release naming conventions.
• Helping maintainers in the issue queues

You can find lots more contributors chatting on IRC in #drupal-contribute. So, come hang out and stay involved!

Thanks, also, for your patience with the review process. Anyone is welcome to participate in the review process. Please consider reviewing other projects that are pending review. I encourage you to learn more about that process and join the group of reviewers.

Thanks to the dedicated reviewer(s) as well.