[D7] Lagotto services

We are currently quite busy with all the project applications and we prefer projects with a review bonus. Please help reviewing and put yourself on the high priority list, then we will take a look at your project right away :-)

Also, you should get your friends, colleagues or other community members involved to review this application. Let them go through the review checklist and post a comment that sets this issue to "needs work" (they found some problems with the project) or "reviewed & tested by the community" (they found no major flaws).

I'm a robot and this is an automated message from Project Applications Scraper.

Manual Review :
1)Update the Readme.txt how to setup the Lagotto service
2)lagotto_services.info : "Lagotto services" is the better name than Lagotto service API access
3)
Got the error on the status page admin/reports/status while testing the module : Fatal error: Call to undefined function lagotto_services_submit_service_creds()
not able to review the module completely.

P.S.:
I have seen that the commits are not linked with your account.you should configure git so that you will get the credits of the commits.
https://www.drupal.org/node/2392395/commits

Hi rivimey,

Thanks for contributing this module.
I went through the module and I saw that you have put lot of works in it that is you followed good coding standards with proper comments.

Please work on the comments added by @naveenvalecha.

* Also if possible add any screenshot on project page. Its easy to understand
* Yeah the same said by @naveenvalecha, add more description on readme.txt that where and how to view the output
* I got one Fatel error when entering into the admin configuration page. "Call to undefined function lagotto_services_submit_service_creds()".

Please fix these all, then will do proper manual review.

Automated Review

Manual Review

Individual user account

Yes: Follows the guidelines for individual user accounts.

No duplication

Yes: Does not cause module duplication and/or fragmentation.

Master Branch

Yes : follows the guidelines for master branch.

Licensing

Yes : Follows the licensing requirements.

3rd party assets/code

Yes: Follows the guidelines for 3rd party assets/code.

README.txt/README.md

Yes: Follows the guidelines for in-project documentation and/or the README Template.

Code long/complex enough for review

Yes: Follows the guidelines for project length and complexity.

Secure code

Yes: Meets the security requirements.

I don't have the account on the logotto so its a visual review.

Coding style & Drupal API usage

1. (+) lagotto_services_admin_get_readme : As the readme.md is not user provided text, its added by the module authoer. So we don't need the filter_xss_admin, check_plain on its text.

2. define('LAGOTTO_SERVICES_API_FETCH', 5);
   define('LAGOTTO_SERVICES_API_POST', 4);

   Please add a comment what's are the usage of these constants and their default magic values.

3. lagotto_services_service_url : Please add a comment above $service_uri = preg_replace('/\%version\%/', $version, LAGOTTO_SERVICES_SERVICE_URI); for the developer experiance.
4. lagotto_services_sanitise_doi_cache : Please add a comment above
   

   $patterns = array(
         '/^https?:\/\/dx\.doi\.org\/(10\.\d+\/.+)$/',
         '/^doi:(10\.\d+\/.+)$/',
       );
   
       $clean_doi = preg_replace($patterns, '$1', $doi);

   for the developer experiance.

5. lagotto_services_records : Use drupal_json_decode over json_decode
6. lagotto_services_example.info : The package should be Testing instead of "Services"

The starred items (*) are fairly big issues and warrant going back to Needs Work. Items marked with a plus sign (+) are important and should be addressed before a stable project release. The rest of the comments in the code walkthrough are recommendations.

If added, please don't remove the security tag, we keep that for statistics and to show examples of security problems.

This review uses the Project Application Review Template.

@rivimey,

Would it be better perhaps to set the package to 'Lagotto services' for both?

The above is a suggestion only.Yup you can.

@rivimey,
As the above was only visual review.So I kept it in "Needs Review". Just wait for someone to do complete review it. :)

manual review:

1. lagotto_services_fetch_doi_enabled(): @return in the doc block is wrong.
2. lagotto_services_example_render(): this looks vulnerable to XSS exploits. $title is directly coming from the third party webservice, correct? Then it needs to be sanitized before printing to #markup because we consider it user provided input. l() will sanitize the link title automatically for you, but if you use the title alone without canonical_url then it needs to be sanitized. Same for the provider name. Make sure to read https://www.drupal.org/node/28984 again. And please don't remove the security tag, we keep that for statistics and to show examples of security problems.

Removing review bonus tag, you can add it again if you have done another 3 reviews of other projects.

if you are done your changes,make sure to change the status to "needs review" so that you will get the review from another reviewer.

correcting tag.
Assigning myself for next review, it may in tonight.

Sorry for the delay was busy with the drupal camp mumbai stuffs.
Some Minors :

/Applications/MAMP/htdocs/d7vulberable.dev/sites/all/modules/pa/lagotto_services/lagotto_services.module:561:1: error - Parameter comment indentation must be 2 additional spaces at position 1
/Applications/MAMP/htdocs/d7vulberable.dev/sites/all/modules/pa/lagotto_services/lagotto_services.module:564:1: error - Return comment indentation must be 2 additional spaces

Manual Review :
You are not included the ctools_include function in the lagotto_services_example_block_view.Please add a dependency on the ctools module.
The "Lagotto services block" blocks will display the error if the ctools is not found.
You are near RTBC..

Automated Review :
There are lot of warnings addressed by the pareview that needs to be fixed http://pareview.sh/pareview/httpgitdrupalorgsandboxrivimey2392395git

Manual Review :
Not found any Major api problem, security issue and licensing issue.

But otherwise looks RTBC to me.

Assigning to klausi as he might have time to review.

Yes, Coder sniffer had a false positive with nested array/function line indentation. Fixed here: http://cgit.drupalcode.org/coder/commit/?id=fff5c12

manual review:

• lagotto_services_example_render(): what about "$name_link = $provider['name'];" here? Where is the provider name sanitized? Looks like it is also coming from the external service? Same for "$value = $provider['value'];"?

Otherwise looks almost ready.

Cool!

Thanks for your contribution, rivimey!

I updated your account so you can promote this to a full project and also create new projects as either a sandbox or a "full" project.

Here are some recommended readings to help with excellent maintainership:

• Dries' post on Responsible maintainers
• Best practices for creating and maintaining projects
• Maintaining a drupal.org project with Git
• Commit messages - providing history and credit
• Release naming conventions.
• Helping maintainers in the issue queues

You can find lots more contributors chatting on IRC in #drupal-contribute. So, come hang out and stay involved!

Thanks, also, for your patience with the review process. Anyone is welcome to participate in the review process. Please consider reviewing other projects that are pending review. I encourage you to learn more about that process and join the group of reviewers.

Thanks to the dedicated reviewer(s) as well.