[D7] Ledger Reports

There are some errors reported by automated review tools, did you already check them? See http://pareview.sh/pareview/httpgitdrupalorgsandboxBeakerboy2623020git

We are currently quite busy with all the project applications and we prefer projects with a review bonus. Please help reviewing and put yourself on the high priority list, then we will take a look at your project right away :-)

Also, you should get your friends, colleagues or other community members involved to review this application. Let them go through the review checklist and post a comment that sets this issue to "needs work" (they found some problems with the project) or "reviewed & tested by the community" (they found no major flaws).

I'm a robot and this is an automated message from Project Applications Scraper.

Automated Review

http://pareview.sh/pareview/httpgitdrupalorgsandboxbeakerboy2623020git

Note that perfect adherence to Drupal Coding Standard is NOT a reason to block an application, except for total disregard of them. However, modules should follow them as closely as possible.

Manual Review

Individual user account

[Yes: Follows] the guidelines for individual user accounts.

No duplication

[Yes: Does not cause] module duplication and/or fragmentation.

Master Branch

[No: Does not follow] the guidelines for master branch.

Licensing

[Yes: Follows] the licensing requirements.

3rd party assets/code

[Yes: Follows] the guidelines for 3rd party assets/code.

README.txt/README.md

[No: Does not follow] the guidelines for in-project documentation and/or the README Template.

Code long/complex enough for review

[Yes: Follows] the guidelines for project length and complexity.

Secure code

[Yes: Meets the security requirements.]

Coding style & Drupal API usage

[List of identified issues in no particular order. Use (*) and (+) to indicate an issue importance. Replace the text below by the issues themselves:

1. README.md or README.txt is missing

The starred items (*) are fairly big issues and warrant going back to Needs Work. Items marked with a plus sign (+) are important and should be addressed before a stable project release. The rest of the comments in the code walkthrough are recommendations.

If added, please don't remove the security tag, we keep that for statistics and to show examples of security problems.

This review uses the Project Application Review Template.

Hi, why don't you declare ledger as a dependency as well? I don't know if this is important or not, but my drush 5.10.0 stating "Module ledger_reports cannot be enabled because it depends on the following modules which could not be found: ledger_transaction [error]."

If you declare ledger, drush also can install fraction needed by ledger_transaction.

But RTBC to how the module works.

manual review:

1. project page is too short, what is the Ledger module? Can you add a screenshot? See also https://www.drupal.org/node/997024
2. ledger_reports.info: why do you add your CSS to every single page in Drupal? Shouldn't you only add your CSS when the reports are displayed?
3. ledger_reports.module: the module file is quite long already. Can you split out page callbacks to a dedicated include file?
4. ledger_reports_page(): do not call theme() here, just return a render array. Drupal core will render it later for you.
5. ledger_reports_page(): why do you need to set the page title here? That is already done in hook_menu(), right? Can you add a comment explaining it or remove it? Also elsewhere.
6. "ledger_reports_print_account_total("Total Assets", $assets);": all user facing text such as "Total assets" here must run through t() for translation. Make sure to check all your strings.
7. ledger_reports_create_sql(): never concatenate variables directly into SQL to avoid SQL injection. Use placeholders in SQL queries with Drupal's database API. This is currently a security blocker. And please don't remove the security tag, we keep that for statistics and to show examples of security problems.
8. Warning: timezone_offset_get() expects exactly 2 parameters, 1 given in ledger_reports_create_sql() (line 502 of ledger_reports.module).
9. ledger_reports_menu_local_tasks_alter(): I thin this violates Drupal local task design guidelines: a local task should be an action to add something for example. You are only showing reports, so I think that should be a regular tab instead.
10. ledger_reports_income_statement(): looks a bit suspicious to XSS exploits. I could not reproduce because I was unable to setup/understand all the ledger module infrastructure to create a malicious account or transaction name that would show up here. Could you add a comment why $v->name does not have to be sanitized here? See also https://www.drupal.org/node/28984

Removing review bonus tag, you can add it again if you have done another 3 reviews of other projects.

Closing due to lack of activity. If you are still working on this application, you should fix all known problems and then set the status to "Needs review". (See also the project application workflow).

I'm a robot and this is an automated message from Project Applications Scraper.

Closing due to lack of activity. If you are still working on this application, you should fix all known problems and then set the status to "Needs review". (See also the project application workflow).

I'm a robot and this is an automated message from Project Applications Scraper.

Greetings all - I am the creator/maintainer of the Ledger module, which this project seeks to extend. I would love to see this module promoted to a full project - it provides a great set of reports on top of the Ledger module's double-entry bookkeeping data.

I spoke with @Beakerboy via email about point #9. I agree with @klausi that it is not the right way to go about it. For the time being I think it can just be removed. I will help @Beakerboy set up links to the reports in hook_menu() - but I don't think it needs to hold up further review - the module works as expected.

@Beakerboy: please remove the implementation of hook_menu_local_tasks_alter() and I will change to RTBC.

Thanks @Beakerboy! Looks good to me! I say this is ready for promotion.

Thanks for your contribution, Beakerboy!

I updated your account so you can promote this to a full project and also create new projects as either a sandbox or a "full" project.

Here are some recommended readings to help with excellent maintainership:

• Dries' post on Responsible maintainers
• Best practices for creating and maintaining projects
• Maintaining a drupal.org project with Git
• Commit messages - providing history and credit
• Release naming conventions.
• Helping maintainers in the issue queues

You can find lots more contributors chatting on IRC in #drupal-contribute. So, come hang out and stay involved!

Thanks, also, for your patience with the review process. Anyone is welcome to participate in the review process. Please consider reviewing other projects that are pending review. I encourage you to learn more about that process and join the group of reviewers.

Thanks to the dedicated reviewer(s) as well.