[D7] Recovery Password

There are some errors reported by automated review tools, did you already check them? See http://pareview.sh/pareview/httpgitdrupalorgsandboxpurushotamrai2563295git

We are currently quite busy with all the project applications and we prefer projects with a review bonus. Please help reviewing and put yourself on the high priority list, then we will take a look at your project right away :-)

Also, you should get your friends, colleagues or other community members involved to review this application. Let them go through the review checklist and post a comment that sets this issue to "needs work" (they found some problems with the project) or "reviewed & tested by the community" (they found no major flaws).

I'm a robot and this is an automated message from Project Applications Scraper.

Thanks for your contribution, here are my observations:

1. There is some contradiction to have the module name as "recovery_password" while the use case of the module to auto reset the password. I would suggest the name should be like "auto_reset_password".
2. As per recommendation, .module and .info should match with module directory name.
3. t() function should be used in

// Menu item for module configurations.
  $items['admin/config/people/recovery-pass'] = array(
    'title' => 'Recovery Password Configuration',

, which is required for translation purpose.
4. Configure setting link should be highlighted in module listing page for the ease of new users to reach at setting page.

* I agree with, not to use t() in menu hook as per the referred doc.
* As per my interpretation, Module use case says, if any user wants to reset his/her password, will have to click on reset password link and redirect to reset password form, once he/she enters email address and then submit. they will get email with random password which can be used to login into the drupal site. It means, he/she doesn't need click the link to reset the password from the system (as per default functionality) instead will get auto reset password sent by your module through module. That's why i assume it should auto reset password because it doesn't recover old password.
* As per my local machine view i don't see configure link on module list ref. attachment.

Hi,

Automated Review

No Bug found in automation testing

Manual Review

Individual user account

[Yes: Follows]

No duplication

No duplication found

Master Branch

[Yes: Follows ]

3rd party assets/code

[Yes: Follows]

README.txt/README.md

[Yes: Follows ]

Code long/complex enough for review

[Yes: Follows]

Secure code

[Yes: Meets the security requirements]

Coding style & Drupal API usage

Coding standards are properly maintained

This review uses the Project Application Review Template.

Thanks.

Works fine for me.

Automated Review

Review of the 7.x-1.x branch (commit 2ea69ab):

• No automated test cases were found, did you consider writing Simpletests or PHPUnit tests? This is not a requirement but encouraged for professional software development.

This automated report was generated with PAReview.sh, your friendly project application review script. You can also use the online version to check your project. You have to get a review bonus to get a review from me.

Manual Review

Individual user account

Yes: Follows the guidelines for individual user accounts.

No duplication

Yes: Does not cause module duplication and/or fragmentation.

Master Branch

Yes: Follows the guidelines for master branch.

Licensing

Yes: Follows the licensing requirements.

3rd party assets/code

Yes: Follows the guidelines for 3rd party assets/code.

README.txt/README.md

Yes: Follows the guidelines for in-project documentation and/or the README Template.

Code long/complex enough for review

Yes: Follows the guidelines for project length and complexity.

Secure code

Yes: Meets the security requirements

Coding style & Drupal API usage

1. Readme.txt is nice.
2. recovery_pass_help : Remove the filter_xss_admin and check_plain from here .Readme is trusted source and provided by the module maintainer, so there is no need of sanitzation family functions here.
3. recovery_pass_cron : Its just a recommendation to make the expiry period configurable.

The starred items (*) are fairly big issues and warrant going back to Needs Work. Items marked with a plus sign (+) are important and should be addressed before a stable project release. The rest of the comments in the code walkthrough are recommendations.

If added, please don't remove the security tag, we keep that for statistics and to show examples of security problems.

This review uses the Project Application Review Template.

Nothing major jumps at me .Assigning to klausi to give a final look if he has time.

Review of the 7.x-1.x branch (commit 233927f):

• Coder Sniffer has found some issues with your code (please check the Drupal coding standards).
  

  FILE: /home/klausi/pareview_temp/recovery_pass.module
  ---------------------------------------------------------------------------
  FOUND 2 ERRORS AFFECTING 2 LINES
  ---------------------------------------------------------------------------
    55 | ERROR | Concatenating translatable strings is not allowed, use
       |       | placeholders instead and only one string literal
   228 | ERROR | Concatenating translatable strings is not allowed, use
       |       | placeholders instead and only one string literal
  ---------------------------------------------------------------------------
  

• DrupalPractice has found some issues with your code, but could be false positives.
  

  FILE: /home/klausi/pareview_temp/recovery_pass.admin.inc
  ---------------------------------------------------------------------------
  FOUND 0 ERRORS AND 1 WARNING AFFECTING 1 LINE
  ---------------------------------------------------------------------------
   77 | WARNING | All variables defined by your module must be prefixed with
      |         | your module's name to avoid name collisions with others.
      |         | Expected start with "recovery_pass" but found
      |         | "recover_pass_expiry_period"
  ---------------------------------------------------------------------------
  

• No automated test cases were found, did you consider writing Simpletests or PHPUnit tests? This is not a requirement but encouraged for professional software development.

This automated report was generated with PAReview.sh, your friendly project application review script. You can also use the online version to check your project. You have to get a review bonus to get a review from me.

manual review:

• recovery_pass_forgot_password_submit(): hm, you are setting a new password for any user account here. So if I know your user name or email address I can overwrite your password all the time. This could be used as a denial of service attack: As anonymous user I just send a POST request every second to reset your password all the time, which means you can never login because your password will already be invalid again when you copy it from your email inbox. I would only allow overwriting the password every 10 minutes or similar, which is also no real solution. It feels wrong to me that any random anonymous user can overwrite the password of my user account as soon as they know my user name or email. Not sure if this should be a security blocker or not, but could you add a warning to the project page that describes this problem?

I have another idea: what if you do not overwrite the user password directly but rather leave it as is and store a second password in a separate table? You send out the second password per email and alter the login form to also accept that second password. That way users can still login with their old password, but also with the new password and the account is not changed. That should mitigate the security problem of attackers overwriting your password all the time. You could expire the second password after one day if it is not used.

Still, I don't understand the use case of this module, since password reset links are just so much better. Easier to use - just click a link, more secure: no passwords that can be stolen from emails.

Anyway, you seem to understand Drupal APIs otherwise, so ...

Thanks for your contribution, purushotam.rai!

I updated your account so you can promote this to a full project and also create new projects as either a sandbox or a "full" project.

Here are some recommended readings to help with excellent maintainership:

• Dries' post on Responsible maintainers
• Best practices for creating and maintaining projects
• Maintaining a drupal.org project with Git
• Commit messages - providing history and credit
• Release naming conventions.
• Helping maintainers in the issue queues

You can find lots more contributors chatting on IRC in #drupal-contribute. So, come hang out and stay involved!

Thanks, also, for your patience with the review process. Anyone is welcome to participate in the review process. Please consider reviewing other projects that are pending review. I encourage you to learn more about that process and join the group of reviewers.

Thanks to the dedicated reviewer(s) as well.