Closed (fixed)
Project:
Drupal.org security advisory coverage applications
Component:
module
Priority:
Normal
Category:
Task
Assigned:
Unassigned
Issue tags:
Reporter:
Created:
31 Oct 2014 at 16:06 UTC
Updated:
1 Dec 2014 at 16:17 UTC
Jump to comment: Most recent
Comments
Comment #1
PA robot commentedWe are currently quite busy with all the project applications and we prefer projects with a review bonus. Please help reviewing and put yourself on the high priority list, then we will take a look at your project right away :-)
Also, you should get your friends, colleagues or other community members involved to review this application. Let them go through the review checklist and post a comment that sets this issue to "needs work" (they found some problems with the project) or "reviewed & tested by the community" (they found no major flaws).
I'm a robot and this is an automated message from Project Applications Scraper.
Comment #2
albertski commenteddrupal_set_message(t('Answer has been transformed to a comment !'));Comment #3
fabulous commentedOK I fixed it.
Comment #4
fabulous commentedUpdate for the validation please ?
Comment #5
Growiel commentedAutomated Review
No issues identified by the automated review.
Manual Review
The comment should be updated and the function doc comment should let people know that the "transform_to_answer" property exists in case they want to use it in the provided answers_to_comment_done.
The starred items (*) are fairly big issues and warrant going back to Needs Work. Items marked with a plus sign (+) are important and should be addressed before a stable project release. The rest of the comments in the code walkthrough are recommendations.
Nothing blocking for me, changing to RTBC.
Comment #6
rgkimball commentedFunctionality Review
I installed the module on a fresh D7 setup with the Answers 7.x-4.x dev branch, and when I click the "transform to comment" on an answer, I got WSoD'd. Here's the output in the PHP error log:
Being that this is part of core, I tried a registry rebuild at first just to make sure it wasn't something odd happening on my end. This is happening during the answers_to_comment_to_comment page callback when you're calling that helper function in your .module @ line 115.
It's possible since this is a fresh install that there's a dependency that I don't know about, in which case that ought to be added to your .info.
Code Review
answers_to_comment.module
Everything else I saw looked fairly standard, you're not using any weird hooks or doing anything unnecessarily strange.
This may be ignorant but I have to ask, why are you requiring Answers 4.x? Since it hasn't been released yet, you should think about supporting 3.x+ instead if possible.
Comment #7
Growiel commented@rgkimball I also tried on a fresh 7.32 install and I can't seem to get the same error. I used a "standard" install, did you use minimal ?
What action were you doing exactly ?
Here's my module list:
Answers
Answers to comment
ctools
entity
entityreference
views
Everything is running with the latests STABLE, except Answers of course.
Comment #8
rgkimball commented@growiel
I'm not sure exactly what the conflict was, but I was using a custom install profile with a few extra contrib modules enabled. Fresh Standard install with the dependencies you mentioned and everything runs smoothly now. Working now to try to figure out where the conflict is occurring.
Update: I've narrowed it down to text formats, though I don't know exactly what sorts of format settings are breaking the transition to comments yet.
Comment #9
fabulous commented@rgkimball
I added a dependency on the comment module because your Call to undefined function comment_save() in seems that you don't have the comment module :S .
Else I added a answers_to_comment_preprocess hook executed before any transform and I change a little bit my db_select. I don't touch my object creation because for a so little module I don't think it's necessary.
For your question we choose to use the Answers 4.x branch, because we have a Q&A website at work and we are migrating on it. The goal is to help the community to stabilize the module and suggest patch for possible features. We prefer to help to have the most advanced module.
Thanks for you help guys !
Comment #10
Growiel commentedI reviewed the latest commit, the added hook seems to work fine, the comment were modified as I requested.
I think this can go live, I change to RTBC.
Comment #11
fabulous commentedHi,
A git administrator can put my project live please ?
Comment #12
fabulous commentedComment #13
fabulous commentedComment #14
fabulous commentedComment #15
fabulous commentedComment #16
mpdonadioAssigning to myself for next review.
Comment #17
mpdonadioAutomated Review
Review of the 7.x-1.x branch (commit ba7f045):
This automated report was generated with PAReview.sh, your friendly project application review script. You can also use the online version to check your project. You have to get a review bonus to get a review from me.
Manual Review
(*) answers_to_comment_choose_node_form(), the $target['name'] appears to go straight from database (which is user-input) to output unescaped via the !placeholder. This will be XSS prone. Use the @placeholder here. You may also want to use format_username(), but this still needs to be plained.
(*) answers_to_comment_to_comment() has an access bypass problem. In general all queries against {node} should use db_select() with ->addtag('node_access'). You may be revealing
nodes that the current user doesn't have access to (even revealing just the title is a problem). You be need to reword this query so that {node} is the base table, and then join the rest.
(*) answers_to_comment_to_comment_access() should also check node_access('delete') to make sure the current user can delete the node.
(*) The menu $item for 'comment/%/to_answer' needs a custom callback which also does
a _node_add_access()node_access('create', 'answers_answer') check to make sure a user can create nodes of that type.Read https://api.drupal.org/api/drupal/modules!node!node.module/group/node_ac... for more info
The additional comments on 'Implements ...' comments are superfluous, especially for the really common hooks, unless you need to explain why you are implementing it (eg, .
(+) The $role argument to answers_to_comment_to_comment_access() is really the $permission to check. This function should also have a proper docblock.
Does 'html' really have to be TRUE in answers_to_comment_comment_view() and answers_to_comment_node_view()?
answers_to_comment_to_comment() should use NODE_PUBLISHED instead of the value.
(+) answers_to_comment_to_comment(), avoid directly poking into a $node like that. Use the Field API; see field_get_items(). Also elsewhere.
(+) All of your custom functions need proper docblocks. See https://www.drupal.org/node/1354
The starred items (*) are fairly big issues and warrant going back to Needs Work. Items marked with a plus sign (+) are important and should be addressed before a stable project release. The rest of the comments in the code walkthrough are recommendations.
If added, please don't remove the security tag, we keep that for statistics and to show examples of security problems.
This review uses the Project Application Review Template.
Comment #18
fabulous commented@mpdonadio thanks for your review.
I fixed all of your points and I used the entity wrapper and the function field_get_items instead of directly poking into $node or $comment. Of course I added the dependency on the entity module and also add it in requirements section of my README.
Currently I don't have the time to write tests, I will do it later.
Please check my changes and if it's ok for you, put in RTBC .
Comment #19
mpdonadioAssigning to myself for next review, which should be tonight.
Comment #20
mpdonadioAutomated Review
Review of the 7.x-1.x branch (commit 69762db):
This automated report was generated with PAReview.sh, your friendly project application review script. You can also use the online version to check your project. You have to get a review bonus to get a review from me.
Manual Review
Did a quick read of `git diff ba7f045..` and didn't see any problems.
My four blockers are addressed, as are the strong recomendations.
Not seeing anything to hold up RTBC. Assigning to @er.pushpinderrana for a second look, if he has time.
Comment #21
pushpinderchauhan commentedAutomated Review
Best practice issues identified by pareview.sh / drupalcs / coder. None
Review of the 7.x-1.x branch (commit 69762db):
This automated report was generated with PAReview.sh, your friendly project application review script. You can also use the online version to check your project. You have to get a review bonus to get a review from me.
Manual Review
'title' => 'transform to comment'that is user facing text and should be wrapped with t(), same applies with answers_to_comment_comment_view().Implements hook_FORMID_form_submit, doc block is wrong, this is not a hook. See https://www.drupal.org/coding-standards/docs#forms.The starred items (*) are fairly big issues and warrant going back to Needs Work. Items marked with a plus sign (+) are important and should be addressed before a stable project release. The rest of the comments in the code walkthrough are recommendations.
Comment #22
fabulous commentedThanks for the review er.pushpinderrana .
I fixed and pushed.
Comment #23
gaurav.pahuja commentedI am not able to install this module using Drush.
Answer module 4.x has not a stable release and just a alpha version is available.
Also, 4.x version has not all the features available specially search functionality is missing.
You already provided some reason for using 4.x branch so I am not changing status of this issue.
Comment #24
fabulous commented@gaurav.pahuja can you tell me what can I do in my code to force drush to download the 4.X version instead of the stable ?
Comment #25
gaurav.pahuja commentedI am not getting any way to download dependency's dev version through drush.
Rest everything looks good.
Moving this module to RTBC.
Comment #26
pushpinderchauhan commentedAutomated Review
Best practice issues identified by pareview.sh / drupalcs / coder. None.
Review of the 7.x-1.x branch (commit 5e72852):
This automated report was generated with PAReview.sh, your friendly project application review script. You can also use the online version to check your project. You have to get a review bonus to get a review from me.
Manual Review
(+) answers_to_comment_help(): Wrong path
case 'node/%/to_comment', instead it should becase 'admin/help#answers_to_comment':Project Page: Extend this little bit more, better to go through Tips for a great project page again.
The starred items (*) are fairly big issues and warrant going back to Needs Work. Items marked with a plus sign (+) are important and should be addressed before a stable project release. The rest of the comments in the code walkthrough are recommendations.
My blocking issues from #21 have been addressed and nothing major jumped out at me when I read `git diff 5e72852..` so...
Thanks for your contribution, Fabulous!
I updated your account so you can promote this to a full project and also create new projects as either a sandbox or a "full" project.
Here are some recommended readings to help with excellent maintainership:
You can find lots more contributors chatting on IRC in #drupal-contribute. So, come hang out and stay involved!
Thanks, also, for your patience with the review process. Anyone is welcome to participate in the review process. Please consider reviewing other projects that are pending review. I encourage you to learn more about that process and join the group of reviewers.
Thanks to the dedicated reviewer(s) as well.
Comment #27
fabulous commentedThank you guys !
Comment #28
fabulous commented