Overview
----------

When uploading files to the local file store on the server Drupal defaults to
disallowing symlinked locations outside of the document root.

This module creates a new streamwrapper based on the core
DrupalPublicStreamWrapper and overrides the function getLocalPath($uri=null)

This is a critical issue when you have a requirement to store documents outside of the document root

https://www.drupal.org/sandbox/developerchris/2644230

Clone
------
git clone --branch 7.x-1.x http://git.drupal.org/sandbox/DeveloperChris/2644230.git symlink_paths

Research
----------

This module deals with the issue discussed here..
https://www.drupal.org/node/1008402

Rather than modify core code I decided to create a small module that resolved a long standing issue

The bulk of the working code is based on the patch here...
https://www.drupal.org/node/1008402#comment-9065341

Reviews of other projects:
https://www.drupal.org/node/2570713 => YNot module
https://www.drupal.org/node/2643140 => Patchinfo module

pareview link
http://pareview.sh/pareview/httpgitdrupalorgsandboxDeveloperChris2644230git

Comments

DeveloperChris created an issue. See original summary.

PA robot’s picture

Status: Needs review » Needs work

There are some errors reported by automated review tools, did you already check them? See http://pareview.sh/pareview/httpgitdrupalorgsandboxDeveloperChris2644230git

We are currently quite busy with all the project applications and we prefer projects with a review bonus. Please help reviewing and put yourself on the high priority list, then we will take a look at your project right away :-)

Also, you should get your friends, colleagues or other community members involved to review this application. Let them go through the review checklist and post a comment that sets this issue to "needs work" (they found some problems with the project) or "reviewed & tested by the community" (they found no major flaws).

I'm a robot and this is an automated message from Project Applications Scraper.

developerchris’s picture

Status: Needs work » Needs review
developerchris’s picture

Issue summary: View changes
developerchris’s picture

Issue summary: View changes
andypost’s picture

Status: Needs review » Needs work
30 | WARNING | Class name must be prefixed with the project name
| | "SymlinkPaths"
developerchris’s picture

Hi Andy

Thanks for taking the time to review this project.

Unfortunately the pareview bot was not reading the correct branch. Even though I set the "working version" to the correct branch pareview was reading the old branch

I have merged my working branch into 7.x-1.x so pareview will always get the latest commits

developerchris’s picture

Issue summary: View changes
Status: Needs work » Needs review
id.tarzanych’s picture

Hi Chris,

I've reviewed your code, and have next remarks:

  1. You put symlink:// schema in class description, but declared symlink_paths:// in hook_stream_wrappers()
  2. Can you put class code into separated .inc file and implement autoload by adding files[] = .inc?
  3. There is no UI way to change file_symlink_path variable. Can you add it by altering system_file_system_settings form or other way?

Other looks good for me
Thanks for your work!

developerchris’s picture

Thanks Serge for taking the time and your suggestions.

I have implemented them as best I understand it. If I have not clearly understood you please add a little example or some further clarification.

developerchris’s picture

Issue summary: View changes
hesnvabr’s picture

Some minor issues.
FILE: ...var/www/drupal-7-pareview/pareview_temp/SymlinkPathsStreamWrapper.inc
---------------------------------------------------------------------------
FOUND 1 ERROR AND 1 WARNING AFFECTING 1 LINE
---------------------------------------------------------------------------
42 | WARNING | [ ] Line exceeds 80 characters; contains 82 characters
42 | ERROR | [x] Inline comments must end in full-stops, exclamation
| | marks, colons, or question marks
---------------------------------------------------------------------------
PHPCBF CAN FIX THE 1 MARKED SNIFF VIOLATIONS AUTOMATICALLY
---------------------------------------------------------------------------

developerchris’s picture

Thanks. I have fixed the long line.

John Lawter’s picture

Automated Review

By PAReview.sh:
http://pareview.sh/pareview/httpgitdrupalorgsandboxDeveloperChris2644230git

By Coder / Coder Tough Love, with the review set to "minor.":
In symlink_paths.module: Line 38: Use sentence case, not title case, for end-user strings.
The string is "Symlinked Document Store Path." I think this can safely be considered a false positive.

Manual Review

Individual user account
Yes: Follows the guidelines for individual user accounts.
No duplication
Yes: Does not cause module duplication and/or fragmentation.
Master Branch
Yes: Follows the guidelines for master branch.
Licensing
Yes: Follows the licensing requirements.
3rd party assets/code
Yes: Follows the guidelines for 3rd party assets/code. It does not rely on 3rd party assets/code.
README.txt/README.md
Yes: Follows the guidelines for in-project documentation and/or the README Template.

Recommendation: Add the following line to README.txt as step 2 under HOW TO USE:
"Navigate to admin/config/media/file-system to configure the Symlinked Document Store Path."

Code long/complex enough for review
No: Does not follow the guidelines for project length and complexity. I count a total of 4 functions class method definitions.

The source code, on the other hand, exceeds the 120 lines minimum recommedend (I count 148 lines. This excludes the .info file). That requirement has been met.

I feel that this should be left up to the final reviewer's descretion.

Secure code
Yes: Meets the security requirements.
Coding style & Drupal API usage
  1. Add hook_help
  2. Looks good and working fine form me.

The starred items (*) are fairly big issues and warrant going back to Needs Work. Items marked with a plus sign (+) are important and should be addressed before a stable project release. The rest of the comments in the code walkthrough are recommendations.

If added, please don't remove the security tag, we keep that for statistics and to show examples of security problems.

This review uses the Project Application Review Template.

John Lawter’s picture

Status: Needs review » Needs work

I am moving this to Needs work in order to allow the developer to address my small suggestion regarding the README.txt file. Whatever his response may be, I feel that once he has changed the status back to "Needs Review," it should be marked RTBC. If I happen to notive his response first, I will be happy to move to RTBC.

developerchris’s picture

Thanks for your suggestions. I am off for the next few days and will look at this when I return to work next week.

developerchris’s picture

I have updated the readme. I added in the suggested text and re-arranged the install / how to use sections. hopefully it is more readable (and logical) now.

I refrained from adding superfluous code just to raise the complexity level.

developerchris’s picture

Assigned: Unassigned » developerchris
Status: Needs work » Needs review
warped’s picture

Status: Needs review » Postponed (maintainer needs more info)

Thank you for your contribution!

After 2017 March 7 everyone can promote a project to a full project.  A full project has a short project name and a drupal.org/project URL.  It can also have releases (like alpha1 or 1.0).  Edit your sandbox project, and then choose the 'Promote' tab.

https://www.drupal.org/docs/8/understanding-drupal-version-numbers/drupa...
https://www.drupal.org/docs/8/choosing-a-drupal-version/what-do-version-...
https://www.drupal.org/docs/8/understanding-drupal-version-numbers/what-...
https://www.drupal.org/docs/8/choosing-a-drupal-version/release-stable-v...

If you'd like to opt into security coverage, please ensure your module is ready for a full release, and then set this issue back to 'needs review'

Immense apologies for how long it took to get to this review completed.

avpaderno’s picture

Assigned: developerchris » Unassigned
avpaderno’s picture

Status: Postponed (maintainer needs more info) » Closed (won't fix)

I am closing this application since there have not been replies in the past two months.

Please re-open it if you need to be able to apply for security code review in the projects you maintain.