Problem/Motivation
The About section in the hook_help text is not quite correct. The filter module filters the output of a text field, what or how the text in the text field is displayed. It does not restrict the input into the field.
Getting this wrong can have security implications if administrators are unaware of it.
Proposed resolution
Check the hook_help text and change it accordingly.
Remaining tasks
Update hook_help text
User interface changes
This is a UI text change.
API changes
None.
Data model changes
None.
Beta phase evaluation
| Issue category | Bug because the module description in the hook_help text and on the module admin page was incorrect. |
|---|---|
| Unfrozen changes | Unfrozen because it only changes strings in the documentation: in the hook_help text and in the UI text of the Filter module. |
| Comment | File | Size | Author |
|---|---|---|---|
| #30 | 2570359-filter-help-30.patch | 7.18 KB | jhodgdon |
Comments
Comment #2
ifrikComment #3
ifrikComment #4
ekes commentedSuggested changes to make it clear that it is output, not input, filtering - that can cover multiple filters for the text.
Comment #6
ifrikThanks ekes, that looks good.
Just one small change in the About section: Could we add an emphasize around "displayed" in "and other text will be displayed in the site." Just to make it really obvious.
And one thing that we had overlooked previously: in "see the online documentation for the Filter module." the "the" should not be part of the link. Do you mind changing that at the same time?
Comment #7
ekes commentedThose two textual changes, both on the same line.
Comment #8
ifrikComment #11
ifrikThanks Ekes, that looks good.
Comment #12
ifrikComment #13
ifrikAdded beta evaluation
Comment #15
ekes commentedRe-roll to account for 7a25f513f5b74d7fbc29b95b7de2fc88334533f4
Comment #16
ekes commentedComment #18
ifrikThanks ekes for the patch and re-rolling it.
Patch #15 looks all good.
Beta evaluation is already added.
Comment #21
ifrikThe test that had failed yesterday on some mysql issue, now passed.
Comment #23
jhodgdonrandom failure again... However, there's a problem in this patch. In the case 'filter.admin_overview', there is a sentence that isn't a sentence:
How HTML tags, code, and other formatting will be shown, replaced or removed.
Please fix this. It was introduced by this patch.
Comment #24
ifrikAh yes.
That would make more sense pulled together as one sentence.
I've fixed that.
This patch also fixes the reference to the online documentation, which fails #2488032: Integrate help test into module uninstall test
Comment #26
jhodgdonYeah, this patch is going to conflict with that other patch. I personally would rather get that other issue finished finally and then reroll this one, but no one has reviewed the other patch.
OK. So I am giving this help a careful read... sorry I guess I didn't do that in my previous review... There are a couple of other things that we could make better now rather than having to do this again:
a) in About:
"Text formats change how HTML tags, codes, and other text"
Um. What are "codes"? If this means "programming code", then it should be singular not plural. I cannot think of another meaning... if it does mean programming code, probably we should say "programming code" because I wasn't sure what it meant. Maybe we should just say "HTML tags and other text" anyway?
Note: it says "code" in the filter.admin_overview case lower down. So if we decide to remove "code" or change it to "programming code", we should do it there too.
b) Speaking of that case...
" how HTML tags, code, and other formatting is displayed, replaced or removed."
We need a comma after "replaced".
c) In the edit_form case:
"change the display of user input, for example stripping out "
The punctuation here should be:
change the display of user input; for example, stripping out
d) Same case, last word: re-arranged should be rearranged (no hyphen)
Comment #27
jhodgdonApparently this needs to be "rc deadline" because it changes translatable UI text strings. See https://groups.drupal.org/node/484788
Comment #28
jhodgdonHere is a new patch. The interdiff is: every line from the previous patch has changed. So I didn't make an interdiff file as it is pointless. I applied the suggestions in #26 and fixed up wording in a couple of other places.
Comment #29
wim leers"programming code" sounds very strange to me. I honestly don't know how to interpret that.
I think "codes" before referred to BBCode.
The wording also makes it seem like it's primarily about defending, whereas it's both defending and transforming for presentation that are the crucial features.
"instead how" -> I know "change" is implied here, but it still reads strangely to me.
</strong>.The period belongs inside, not outside?Nit:
:filterhelp, whereas in the first hunk it's:editor_help. This should be consistent.Comment #30
jhodgdonRegarding the nit, in the first hunk :editor_help is referring to the editor module. In the later hunk, :filterhelp is for the filter module. Oh, maybe both should have _ in them, I'll fix that.
Anyway, these are great comments! I've made an update; again I don't think the interdiff is helpful as most lines in the patch are changed.
Comment #31
wim leers"damaging" is accurate at a high level, but could be interpreted as "damaging the site itself". Which is kinda true. But it's also about protecting the end user against malicious HTML. But you also have "malicious users" immediately after. Hrm… I don't see how this can be further improved, I think it's good/clear enough. If you see how to improve that part further though, that'd be splendid.
Comment #32
webchickTo me that reads ok ("input" of type "damaging")
This is a big improvement over the old text. Let's get this in.
Committed and pushed to 8.0.x. Thanks!
Comment #34
ifrikThanks for fixing this is time!