Security module for webClinic Pro subscribers.
https://www.drupal.org/sandbox/anttix/2581971
git clone --branch 7.x-1.x http://git.drupal.org/sandbox/anttix/2581971.git webclinicpro
Security module for webClinic Pro subscribers.
https://www.drupal.org/sandbox/anttix/2581971
git clone --branch 7.x-1.x http://git.drupal.org/sandbox/anttix/2581971.git webclinicpro
Comments
Comment #2
PA robot commentedProject 1: https://www.drupal.org/node/2673664
Project 2: https://www.drupal.org/node/2582131
As successful completion of the project application process results in the applicant being granted the 'Create Full Projects' permission, there is no need to take multiple applications through the process. Once the first application has been successfully approved, then the applicant can promote other projects without review. Because of this, posting multiple applications is not necessary, and results in additional workload for reviewers ... which in turn results in longer wait times for everyone in the queue. With this in mind, your secondary applications have been marked as 'closed(duplicate)', with only one application left open (chosen at random).
If you prefer that we proceed through this review process with a different application than the one which was left open, then feel free to close the 'open' application as a duplicate, and re-open one of the project applications which had been closed.
I'm a robot and this is an automated message from Project Applications Scraper.
Comment #3
PA robot commentedFixed the git clone URL in the issue summary for non-maintainer users.
We are currently quite busy with all the project applications and we prefer projects with a review bonus. Please help reviewing and put yourself on the high priority list, then we will take a look at your project right away :-)
Also, you should get your friends, colleagues or other community members involved to review this application. Let them go through the review checklist and post a comment that sets this issue to "needs work" (they found some problems with the project) or "reviewed & tested by the community" (they found no major flaws).
I'm a robot and this is an automated message from Project Applications Scraper.
Comment #4
sourabhutani commentedAutomated Review
There is some coding standard errors to fix : http://pareview.sh/pareview/httpgitdrupalorgsandboxe-mailit2667034git
Individual user account
Yes
Duplication
No
Master Branch
Yes. Branch 7.x-1.x
Licensing
Yes. Follow
3rd party assets/code
Yes follow. Do not contains any 3dr party.
README.txt/README.md
Yes :
Code long/complex enough for review
Yes. Well documented. Extending views sort, fields and argument.
Secure code
None security issue found. Looks good.
Coding style & Drupal API usage
After a manuel Review, everything seems to be ok. Perhaps, just some recommandations :
1. (*) In webclinicpro.module file function webclinicpro_flush_caches() has if condition with else. if no use of else (line 205) ,should be removed.
The starred items (*) are fairly big issues and warrant going back to Needs Work. Items marked with a plus sign (+) are important and should be addressed before a stable project release. The rest of the comments in the code walkthrough are recommendations.
If added, please don't remove the security tag, we keep that for statistics and to show examples of security problems.
This review uses the Project Application Review Template.
Comment #5
arunkumark@jdrichmond
some of suggestions from manual review of your module
1. You have set some of variables in variables table Ex: webclinicpro_block_seal, webclinicpro_forced_ssl, webclinicpro_subscriber_key.. So you need to remove those variables while module Un install. By implementing hook_uninstall().
2. You need to pass default value for variable_get() while it enters first time in your function webclinicpro_admin_settings() on line 35 and 55. By default variable get have the value NULL, in your module
Refer : https://api.drupal.org/api/drupal/includes!bootstrap.inc/function/variab...
3. Line 56 $options should have key and values.
Refer : https://www.drupal.org/node/325766
4. In function webclinicpro_admin_settings_submit() you have used Curl function. Need to use curl time out function may remote server down your application wont affect its failure.
curl_setopt($ch, CURLOPT_CONNECTTIMEOUT , TIME_IN_SECOND); // For connection establish.
curl_setopt($ch, CURLOPT_TIMEOUT, TIME_IN_SECOND); // For fetch data.
5. In webclinicpro_block_info(), can use description it help to additional block details.
6. Line 138 hook_block_info() implemented but hook_block_view() and block render data not used.
Comment #6
jyotisankar commentedHi
I found the following issues/suggestion in your module.
Issues
1. Variable used in the application like webclinicpro_subscriber_key not getting deleted from the variable table when we uninstall the module. You can create a .install file in your module and can use variable_del() where required.
2. When I tried to set the webClinic Pro Subscriber KEY I got a warning message saying "Notice: Undefined index: webclinicpro_block_seal in webclinicpro_admin_settings_submit() (line 102 of /var/www/iclick_test7/drupal/sites/all/modules/custom/2581971/webclinicpro.module).
3. In your .module file Line 130 : you can add an entry to watchdog, same on Line 206.
Suggestion
1. Please use hook_help in your .module file, and you can add the admin configuration link from there.
Comment #7
jdrichmond commentedThank you sourabhutani, arunkumark, and jyotisankar for your reviews!
We have made changes to the module code in response to the issues you raised and merged them into the 7.x-1.x branch.
Comment #8
braindrift commentedHi jdrichmond,
you should consider to move the admin settings form to a separate webclinicpro.admin.inc file. Please delete your variables used as settings storage in your hook_uninstall() (that you have already implemented). You should print the content of your README.txt in your hook_help().
Your webclinicpro.install must begin with
<?phpto be php executableBest regards
Comment #9
jdrichmond commentedHi Braindrift, thanks for your review! We have made the changes you pointed out.
Comment #10
jdrichmond commentedComment #11
nitinsp commentedHi Jdrichmond
In .install file for variable delete have you also read the comments on Proper way to bulk-delete variables on module uninstall? You should not delete variables directly from db.
You should do something like this:
Comment #12
nitinsp commentedHi
Please don't create a package just for your module in your info file
Thanks
Nitin
Comment #13
jdrichmond commentedThanks for your review, NitinSP! We have implemented the changes you suggested.
Comment #14
nitinsp commentedHi jdrichmond
Manual Review:
I reviewed your module, following thing have need to fixed.
1. Please add configure link to the module in .info file.
2. remove .css file from .info file and only add it where it needed.
3. if user submit blank setting form it do not show any error, Please add validation to the setting .
Thanks
Nitin
Comment #15
nitinsp commentedComment #16
klausi@NitinSP: why should check_url() not be used? It is perfectly fine as sanitization function when you output a URL? Or did you see a special situation here where it should not be used?
Comment #17
jdrichmond commentedHello all,
Thank you again for reviewing the module.
We have made the 3 changes NitinSP suggested.
We have also added a check_url call as klausi suggested, for the dynamically generated URL in the footer function.
If there is anything we did not get right, please let us know.
Comment #18
yogeshmpawarComment #19
aryashreep commentedThere is some coding standard errors to fix :
EDIT: removed long pareview.sh dump.
Source: http://pareview.sh/ - PAReview.sh online service
Comment #20
aryashreep commented@jdrichmond Please ignore previous comment.
Comment #21
jdrichmond commentedChanged status back to "Needs Review" (see previous 2 comments by aryashreep)
Comment #22
visabhishek commentedPlease wrap user facing things in t() not the key :
Ex :
To
Also fix the issue reported on https://pareview.sh/node/90
Comment #23
PA robot commentedClosing due to lack of activity. If you are still working on this application, you should fix all known problems and then set the status to "Needs review". (See also the project application workflow).
I'm a robot and this is an automated message from Project Applications Scraper.
Comment #24
jdrichmond commentedHi visabhishek,
Thank you for your review. We found and fixed an example of the issue you pointed out in webclinicpro_admin_settings() in webclinicpro.admin.inc.
Comment #25
tessa bakkerhttps://www.drupal.org/project/securepages does the same job.
Comment #26
avpadernoWe don't close applications as duplicates of existing projects. Duplication is not an application stopper.
Comment #27
sleitner commentedAutomated Review
Review of the 7.x-1.x branch (commit d5240f2):
This automated report was generated with PAReview.sh, your friendly project application review script.
Manual Review
The starred items (*) are fairly big issues and warrant going back to Needs Work. Items marked with a plus sign (+) are important and should be addressed before a stable project release. The rest of the comments in the code walkthrough are recommendations.
If added, please don't remove the security tag, we keep that for statistics and to show examples of security problems.
This review uses the Project Application Review Template.
Comment #28
avpadernoIf you are still working on this application, you should fix all known problems and set the status to Needs review. (See also the project application workflow.)
Please don't change status of this application if you aren't sure you have time to dedicate to this application, or it will be closed again as won't fix.
I am closing this application due to lack of activity.
Comment #29
avpadernoI also see that many commits are done from Michael Redman, not the user who applied. In this case, this project cannot be use for this application.