Closed (fixed)
Project:
Drupal.org security advisory coverage applications
Component:
module
Priority:
Normal
Category:
Task
Assigned:
Unassigned
Issue tags:
Reporter:
Created:
12 Dec 2015 at 05:56 UTC
Updated:
29 Oct 2016 at 10:44 UTC
Jump to comment: Most recent, Most recent file

Comments
Comment #2
PA robot commentedWe are currently quite busy with all the project applications and we prefer projects with a review bonus. Please help reviewing and put yourself on the high priority list, then we will take a look at your project right away :-)
Also, you should get your friends, colleagues or other community members involved to review this application. Let them go through the review checklist and post a comment that sets this issue to "needs work" (they found some problems with the project) or "reviewed & tested by the community" (they found no major flaws).
I'm a robot and this is an automated message from Project Applications Scraper.
Comment #3
adam_ commentedI like it. Phone numbers are always easier to remember as word.
Very straightforward code example for review.
Licensing looks good. Individual user account. Style and spacing looks good as well. It does what it's supposed to do, looks good. No 3rd party assets/code. Just hits the recommended 5 functions for minimum code length.
Marking as Reviewed & tested by the community.
Comment #4
inteja commentedThanks hook_awesome!
Comment #5
inteja commentedNow this is at RBTC I'm not sure what to do next. Do I just wait for a git admin to give me 'create full projects' permissions or should I change the status back to 'needs review', try to get some more reviews and participate in the review bonus program (happy to do anyway in a week or so when I'm more free)?
Comment #6
moshnoi commentedHi,
I found some problems:
1. Implement hook_uninstall() and delete the variables set in module(use variable_del());
2. Use Drupal.behaviors instead of $(document).ready().
Comment #7
inteja commentedThanks for the review moshnoi. I've made the suggested changes:
http://cgit.drupalcode.org/sandbox-inteja-2633760/commit/?id=74a861c
http://cgit.drupalcode.org/sandbox-inteja-2633760/commit/?id=0d2a19f
Comment #8
chanderbhushan commentedHi @inteja,
Thanks for your contribution
I found some issues
1.
$phoneword_tooltip = variable_get('phoneword_tooltip', 'Click to call us');use t() function for strings2.
can't we use l() instead of .
Comment #9
inteja commentedThanks chanderbhushan.
RE 1) I've changed to use t().
RE 2) Not sure about this one, given that the link wraps multiple nested divs.
Comment #10
inteja commentedChanging back to needs review. Not sure if using l() in this context would be an improvement, but happy for any advice or suggestions to the contrary.
Comment #11
Rahul Seth commentedAutomated Review
Review of the 7.x-1.x branch (commit 747d335):
No automated test cases were found, did you consider writing Simpletests or PHPUnit tests? This is not a requirement but encouraged for professional software development.
Note that perfect adherence to Drupal Coding Standard is NOT a reason to block an application, except for total disregard of them. However, modules should follow them as closely as possible.
Manual Review
Use more comments on module file.
The starred items (*) are fairly big issues and warrant going back to Needs Work. Items marked with a plus sign (+) are important and should be addressed before a stable project release. The rest of the comments in the code walkthrough are recommendations.
If added, please don't remove the security tag, we keep that for statistics and to show examples of security problems.
This review uses the Project Application Review Template.
Comment #12
Rahul Seth commentedComment #13
inteja commentedThanks Rahul Seth.
Comment #14
inteja commentedThanks Rahul Seth.
Comment #15
mlhess commentedThis module has security issues in it. You accept user input but don't filter it.
Comment #16
jthorson commentedComment #17
klausi@mlhess we use this tag to track security issues in project applications.
Could you also be a bit more specific so that the applicants know where exactly they need to fix something?
Comment #18
inteja commentedThanks for the feedback @mlhess @jthorson and @klausi.
I've wrapped all user-submitted variable output in check_plain() according to Handle text in a secure fashion.
http://cgit.drupalcode.org/sandbox-inteja-2633760/commit/?id=b25ad7c
Comment #19
romanblanyar commentedHello, I have installed and tested the functionality of the module. It works well and does not cause errors or failures. Your module is quite efficient and can be used at various sites. Thanks.
Comment #20
klausi@romanblanyar: looks like you forgot to change the status? I this now RTBC after your code review or are there any blockers left?
Comment #21
RavindraSingh commentedreviewing this module
Comment #22
RavindraSingh commented<a href="tel:' . $phoneword_link . '" title="' . $phoneword_tooltip . '">Needs to be wrapped in l() function.Javascript coding standard for Drupal 7 module is missing in JS file.
Comment #23
inteja commented@RavindraSingh can you please be a little more specific?
I addressed the same l() wrapping question in #9 above. Given the link wraps multiple nested divs, how would you suggest I use l() in this case or restructure the markup?
What exactly is missing in the JS file?
Comment #24
RavindraSingh commented@inteja, This is how you can optimize your code to use l().
Example:
For JS, commenting is very important thats why I have added JS link in #22
Follow #2183405: [Obsolete] JavaScript API documentation and comment standards and see the example for the coding standard.
Comment #25
inteja commented@RavindraSingh thanks. I've made the suggested changes. See a01ec36
As previously mentioned (#9 & #23), ideally I wanted the one link to wrap multiple divs (both the phone word and number) and I couldn't work out how to do that with l(). Your code example doesn't illustrate how I could do this with l(). However, I've changed it as per your suggestion and the code is definitely cleaner but with separate links on the phone word and number, if the user's pointer is hovering over a link, when it cross-fades to the other link, unless the user moves their pointer then the :hover pseudo-class is not updated. It's just a small cosmetic thing, but that's one reason why I wanted the link to wrap both divs and why I initially avoided the l() function.
Comment #26
RavindraSingh commented@inteja, Fantastic, I will review your changes.
I understand your concerns, But now it is more good approach. give a clear documentation to end module user so if they want to add they can.
For hovering effect you can add css for outer div??
Comment #27
PA robot commentedThere are some errors reported by automated review tools, did you already check them? See http://pareview.sh/pareview/httpgitdrupalorgsandboxinteja2633760git
I'm a robot and this is an automated message from Project Applications Scraper.
Comment #28
inteja commentedFixed code standards issues found by robot. See e8f1c27
Comment #29
RavindraSingh commentedI see very simple issue the the phone word is overlapping phone no.
And there is no animation.
If you this is happening because of l('phonewords', 'tel:' . $phoneword_link, $options); implemented. Please mentioned clearly in the description of the issue and take this to that old stage. So community can review your module.
Comment #30
inteja commentedWorks for me sorry. Will do some more testing.
Comment #31
inteja commented@RavindraSingh I just tried a fresh local install of Drupal 7.43 and latest phoneword and it works as expected for me.
Comment #32
inteja commented@RavindraSingh I've tested this on a handful of sites now and can't replicate what you are reporting. The only other thing that's changed are code style in response to new PA robot ESLint reported issues, namely double quotes " changed to single quotes ' in the JS file. I can't see how this would cause any problems.
Comment #33
saraswathi ravikumar commentedHi inteja,
Please add validation to the link field. Right now it is accepting even alphabets. Please refer to screenshot attached.
Thanks,
Sarah.
Comment #34
inteja commentedBumping in the hopes of getting some more reviews ...
Comment #35
inteja commentedRather than add numeric validation to the link field I've actually made it more generic by removing the hard-coded "tel:" prefix. This way people can link to either a phone number or for instance their "contact us" page, which is also a common use-case.
See issue https://www.drupal.org/node/2750481
Please review.
Comment #36
inteja commentedComment #37
inteja commentedComment #38
inteja commentedComment #39
abhishek.pareek commentedI guess you have not fixed all coding standard issue, you missed this one http://pareview.sh/pareview/httpgitdrupalorgsandboxinteja2633760git.
Comment #40
klausiMinor coding standard issues are surely not application blockers, anything else that you found or should this be RTBC instead?
Comment #41
inteja commentedFixed minor code standards issue.
Comment #42
inteja commentedCan anyone take another look at this? I think it's fundamentally sound, plus it's a quick, simple module to review.
Thanks in advance.
Comment #43
lionslair commentedAppears to be passing all automated tests
http://pareview.sh/pareview/httpgitdrupalorgsandboxinteja2633760git-7x-1x
Manual Review
Comment #44
inteja commented@lionslair thanks
Comment #45
chanderbhushan commentedComment #46
inteja commentedComment #47
misc commentedinteja, please don't remove PAReview: security - they are kept even after it is fixed.
With that said:
Thanks for your contribution, inteja!
I updated your account so you can promote this to a full project and also create new projects as either a sandbox or a "full" project.
Here are some recommended readings to help with excellent maintainership:
You can find lots more contributors chatting on IRC in #drupal-contribute. So, come hang out and stay involved!
Thanks, also, for your patience with the review process. Anyone is welcome to participate in the review process. Please consider reviewing other projects that are pending review. I encourage you to learn more about that process and join the group of reviewers.
Thanks to the dedicated reviewer(s) as well.
Comment #48
inteja commentedThanks very much MiSc!
Comment #49
chanderbhushan commented