[D7] Privy

We are currently quite busy with all the project applications and we prefer projects with a review bonus. Please help reviewing and put yourself on the high priority list, then we will take a look at your project right away :-)

Also, you should get your friends, colleagues or other community members involved to review this application. Let them go through the review checklist and post a comment that sets this issue to "needs work" (they found some problems with the project) or "reviewed & tested by the community" (they found no major flaws).

I'm a robot and this is an automated message from Project Applications Scraper.

Hi pcai,

I had a quick look at your module and I could find a security issue in the menu callback (pviy_menu function).

You have given 'access callback' => TRUE,, so even a anonymous user can access this page and that shouldn't happen

Create your own permission or use an existing permission for it. Read through this (https://www.drupal.org/node/109157) for more about access control.

Please don't remove the security tag, we just use it for learning purpose.

Hi Pcai,

system_settings_form has a auto validate for required => true.
If you do any custom validate it to be fine. Else, don't want to call hook_admin_settings_form_validate

Kindly remove the following code from privy.admin.inc

/**
 * Implements _form_validate().
 */
function privy_admin_settings_form_validate($form, &$form_state) {
}

@gaja_daran: that sounds like a good improvement, but on its own it is not an application blocker. Anything else that you found or should this be RTBC instead?

HI klausi,

There is no major blocker in this module.

Manual review commands:

1. If I didn't configure the Privy Account Identifier in admin configuration page, then also hook_page_alter calling a privy JS, and the inline JS (http://widget.privy.com/assets/widget.js) gets appended on the page. It should be validated.

2. There is no help file (hook_help). It is not mandatory.

3. Variable 'privy_identifier' not removed from the site when the module has un-install.

Basic application checks:

1. Project page/repository: Pass
2. No duplication: Pass

Basic repository checks: Pass

Security: Pass

License: Pass

Documentation: Looks good Pass

Code style: No major issues, Pass

API: Pass

I can't see the point to keep empty privy_admin_settings_form_validate() in code.

Thanks for your contribution, Peter!

I updated your account so you can promote this to a full project and also create new projects as either a sandbox or a "full" project.

Here are some recommended readings to help with excellent maintainership:

• Dries' post on Responsible maintainers
• Best practices for creating and maintaining projects
• Maintaining a drupal.org project with Git
• Commit messages - providing history and credit
• Release naming conventions.
• Helping maintainers in the issue queues

You can find lots more contributors chatting on IRC in #drupal-contribute. So, come hang out and stay involved!

Thanks, also, for your patience with the review process. Anyone is welcome to participate in the review process. Please consider reviewing other projects that are pending review. I encourage you to learn more about that process and join the group of reviewers.

Thanks to the dedicated reviewer(s) as well.