I just started playing around with varnish and noticed this module was using setCookie in user_alert_init(). This was causing some issues so I decided to switch this module over to use jStorage instead of cookies to remember which user alerts have been closed. A lot of the PHP code was no longer needed since a lot of the logic has been moved to the browser and is done with JS.

This patch will also fix a very mild denial of service that fills up the user alert table if you spam the /js/user-alert/close-message path with something like apache bench while having a cookie set. This patch fixes this issue because there is no longer a user_alert table or close path.

This patch has a bunch of changes, I've tried to outline most of them.

  • A README.txt file with instructions for setting up jStorage. Copied README from Splashify (http://cgit.drupalcode.org/splashify/tree/README.txt) and changed out some stuff.
  • Changed user-alert.js file to no longer use Drupal Javascript behaviors since this functionality only needs to run once per page, not every time behaviors are called. This could also be done with .once(). Right now it's just a self executing function user_alert_check_alerts() that runs when the DOM is ready.
  • First it loads closed nids from jStorage. Next it loops through results from json response, checking if the nid of the user alerts is in the closed nids. If it is not or jStorage is null it adds the user alert to an array. Once the loop is done it joins the array and adds it to the page. The close click event changed a little. It checks if user_alert_closed_nids is an array if it is, add the new nid to the array and updates jStorage. if not set the user_alert_closed_nids to an array with the user alert nid and updates jStorage. jStorage TTL is set to 1 year. Same as the old cookie.
  • TPL file was updated to use data-user-alert-nid attribute with the user alert NID as the value.
  • Copied code from Splash Block module to make user_alert.drush.inc to allow downloading the jStorage plugin with Drush.
  • Updated user_alert.info file to no longer include JS and CSS files since we add those to the block using #attached.
  • Added libraries module to the dependencies.
  • Changed user_alert.install file for new requirements.
  • Removed user_alert_schema since it was no longer needed.
  • Added user_alert_update_7000 to remove the table from the DB.
  • Removed the user_alert_init function since JS and CSS files are added to the block and we no longer use cookies.
  • Updated user_alert_menu function - removed delivery callback so varnish can cache the result.
  • Updated user_alert_display_alert function to set cache-control response header to allow varnish to cache the result.
  • Now that the menu item uses the default callback the response will get saved in cache_page table if you have caching turned on.
  • I had to add user_alert_insert, user_alert_update & user_alert_delete functions that clear the js/user-alert/get-message page from cache_page table.
  • Modified user_alert_block_view to add jStorage plugin, JS settings, user-alert JS, & CSS files.
  • Updated user_alert_display_alert function to use new SQL that no longer checks for cookie.
  • Removed user_alert_close_message(), user_alert_cookie_is_valid(), & _user_alert_uuid_generate_php() functions. Not needed anymore.
  • Added functions needed for library stuff. user_alert_libraries_info() & _user_alert_jstorage_version()

I also added some jQuery triggers in the JS so you can react to different events in your theme or module. We use this to add some extra JS logic to make the user alerts cover the whole page and prevent scrolling. To use the jQuery triggers look in the README for some example code.

Some things could be cleaned up a little but this is a good start.

Support from Acquia helps fund testing for Drupal Acquia logo

Comments

gooddesignusa’s picture

Patch applies to 7.x-1.x

gooddesignusa’s picture

Issue summary: View changes
kevinquillen’s picture

Assigned: Unassigned » kevinquillen
Status: Active » Needs review

Sounds good. I'll review your changes.

Daltyn’s picture

I applied the patch provided and the module seems to be working correctly.