Description:
This module provides support for Sendgrid's Inbound Parse webhook. It allows you to trigger rules based on incoming emails to your site.

A submodule provides support for using Sendgrid inbound messages to allow users to reply to messages from the privatemsg module via email.

This is essentially much of the same functionality that is found in the mandrill_inbound module and submodule, but translated for use with Sendgrid.

Project Page:
https://www.drupal.org/sandbox/skulegirl/2705021

Git:
git clone --branch 7.x-1.x https://git.drupal.org/sandbox/skulegirl/2705021.git sendgrid_inbound

CommentFileSizeAuthor
#13 pareview-fix-2706799-13.patch12.14 KBdevaraj johnson

Comments

skulegirl created an issue. See original summary.

PA robot’s picture

We are currently quite busy with all the project applications and we prefer projects with a review bonus. Please help reviewing and put yourself on the high priority list, then we will take a look at your project right away :-)

Also, you should get your friends, colleagues or other community members involved to review this application. Let them go through the review checklist and post a comment that sets this issue to "needs work" (they found some problems with the project) or "reviewed & tested by the community" (they found no major flaws).

I'm a robot and this is an automated message from Project Applications Scraper.

sanjayk’s picture

Status: Needs review » Needs work

Automated Review
http://pareview.sh/pareview/httpgitdrupalorgsandboxskulegirl2705021git

FILE: /var/www/drupal-7-pareview/pareview_temp/README.txt
----------------------------------------------------------------------
FOUND 0 ERRORS AND 1 WARNING AFFECTING 1 LINE
----------------------------------------------------------------------
24 | WARNING | Line exceeds 80 characters; contains 81 characters
----------------------------------------------------------------------

Manual Review

File sendgrid_inbound.api.php line no 14 use t()

braindrift’s picture

Status: Needs work » Needs review

@sanjayk
I realy don't think that one character in README is an application blocker.
Also a string in sendgrid_inbound.api.php that is not passed through t() is not an application blocker. This file is only for documentation.

dkolarevic’s picture

Hi, skulegirl

it's not recommended to delete variables using db_delete like you did in your hook_uninstall. Please use variable_del instead.
Great articles can be found here:
https://www.drupal.org/node/2274697
http://www.cocomore.com/blog/how-not-delete-drupal-variables-your-module...

skulegirl’s picture

I've made all the recommended changes, thanks for taking the time to review it guys!

braindrift’s picture

Hi skulegirl,

You should sanitize the $_POST values in sendgrid_inbound_callback().

I've just seen that your main module as well as your submodule depends on privatemsg_rules. Is this what you realy wanted?
You should implement hook_help() where you print the content of your README.

Best regards

braindrift’s picture

Status: Needs review » Needs work
braindrift’s picture

Issue tags: +PAreview: security

As per #7 this should be tagged as security vulnerability.

braindrift’s picture

Status: Needs work » Needs review
Issue tags: -PAreview: security

Not sure if my comment #7 is really a security issue, so I remove the tag and maybe another could review it.

skulegirl’s picture

Regarding santizing the input, my understanding from the documentation on writing secure code is that the onus is on the user of the data to sanitize it before outputting it, and that data should be stored exactly as it is received. In this case, the data is stored (in a variable, not the database) as-is, and then made available for use by the rules module. The modules that use the data are then responsible for sanitizing it - e.g. the privatemsg_rules module does sanitize the subject and text before outputting it in a privatmsg.

skulegirl’s picture

Added hook_help, removed unneeded dependency on privatemsg_rules in main module.

devaraj johnson’s picture

StatusFileSize
new12.14 KB

Automated Review

Please fix the Automated issues provided by the PAreview.sh added is the patch for the same apply it in your repo

Manual Review

Individual user account
[Yes: Follows] the guidelines for individual user accounts.
No duplication
[Yes: Does not cause] module duplication and/or fragmentation.
Master Branch
[Yes: Follows] the guidelines for master branch.
Licensing
[Yes: Follows] the licensing requirements.
3rd party assets/code
[Yes: Follows] the guidelines for 3rd party assets/code.
README.txt/README.md
[Yes: Follows] the guidelines for in-project documentation and/or the README Template.
But follow the https://www.drupal.org/docs/develop/documenting-your-project/module-docu... to add more weightage to your module for documentation for other user to get easy understanding
Code long/complex enough for review
[Yes: Follows] the guidelines for project length and complexity.
Secure code
[Yes: Meets the security requirements]
Coding style & Drupal API usage
[List of identified issues in no particular order. Use (*) and (+) to indicate an issue importance. Replace the text below by the issues themselves:
  1. (*) Major finding, needs work
  2. (+) Release blocker
  3. Add module Documentation following some of the tips mentioned in the link https://www.drupal.org/docs/develop/documenting-your-project/module-docu...
  4. Implement hook_enable to direct user to the configuration page after enabling the module like below
    Example:
    --------
    /**
    * Implements hook_enable().
    */
    function sendgrid_inbound_enable() {
    $t = get_t();
    $config_link = url() . 'admin/config/services/sendgrid/inbound';
    drupal_set_message($t("Sendgrid configuration settings are available under Admin > Configuration", array('@link' => $config_link)));
    }

    So that it will be user friendly to do go to the configuration and user know there are some configuration need to be done

The starred items (*) are fairly big issues and warrant going back to Needs Work. Items marked with a plus sign (+) are important and should be addressed before a stable project release. The rest of the comments in the code walkthrough are recommendations.

If added, please don't remove the security tag, we keep that for statistics and to show examples of security problems.

This review uses the Project Application Review Template.

devaraj johnson’s picture

Status: Needs review » Reviewed & tested by the community
avpaderno’s picture

Assigned: Unassigned » avpaderno
Status: Reviewed & tested by the community » Fixed

Thank you for your contribution!
I am going to update your account so you can opt into security advisory coverage now.
These are some recommended readings to help with excellent maintainership:

You can find more contributors chatting on the IRC #drupal-contribute channel. So, come hang out and stay involved.
Thank you, also, for your patience with the review process.
Anyone is welcome to participate in the review process. Please consider reviewing other projects that are pending review. I encourage you to learn more about that process and join the group of reviewers.

I thank all the dedicated reviewers as well.

avpaderno’s picture

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.