[D8] Kompakkt

Git clone command for the sandbox is missing in the issue summary, please add it.

We are currently quite busy with all the project applications and we prefer projects with a review bonus. Please help reviewing and put yourself on the high priority list, then we will take a look at your project right away :-)

Also, you should get your friends, colleagues or other community members involved to review this application. Let them go through the review checklist and post a comment that sets this issue to "needs work" (they found some problems with the project) or "reviewed & tested by the community" (they found no major flaws).

I'm a robot and this is an automated message from Project Applications Scraper.

Closing due to lack of activity. If you are still working on this application, you should fix all known problems and then set the status to "Needs review". (See also the project application workflow).

I'm a robot and this is an automated message from Project Applications Scraper.

Knurg could you please follow this guideline to update this post for easier reviewing?
https://www.drupal.org/docs/develop/documenting-your-project/project-pag...
Further more the git command to clone your project is missing as well. See the PA robot comments.

Individual user account: Yes: Follows the guidelines for individual user accounts.
Master Branch: Yes: Follows the guidelines for master branch.
Licensing: Yes: Follows the licensing requirements.
3rd party assets/code: Yes: Follows the guidelines for 3rd party assets/code.
Secure code: Yes: Meets the security requirements.
Code long/complex enough for review: Yes: Follows the guidelines for project length and complexity.
No duplication: Yes: Does not cause module duplication and/or fragmentation.

README.txt/README.md
No: Does not follow the guidelines for in-project documentation and/or the README Template. There is no README, see https://www.drupal.org/node/2181737 .

Coding style & Drupal API usage
(*) This project needs more documentation, because its quite big. So for someone new to use this properly the first time its kinda impossible.
(+) Remove not used code, instead of commenting it out. Git will store the old code for you.

Closing due to lack of activity. If you are still working on this application, you should fix all known problems and then set the status to "Needs review". (See also the project application workflow).

I'm a robot and this is an automated message from Project Applications Scraper.

You should review the warnings that appear in the pareview review.

If you are still working on this application, you should fix all known problems and set the status to Needs review. (See also the project application workflow.)
Please don't change status of this application if you aren't sure you have time to dedicate to this application, or it will be closed again as won't fix.

I do not believe this application can be processed as submitted.

Reviewing the commit logs there is an active mix of multiple committers in this branch and does not appear to be any way to easily review the project based solely on the applicants contributions.

Attaching a current pareview.sh output as a historical baseline.

I agree with cmlara: There are commits from other users and it's not possible to know what Knurg understands about writing secure code that follows Drupal coding standards and correctly uses the Drupal APIs.

This application can continue with a different project with at least a branch where the majority of the commits have been done by Knurg. It would preferable that all the commits are done by Knurg; in the case the majority of the commits are done by Knurg, it's preferable they are the last commits.

Thanks for your contribution!

• Your README.md does not follow best practices (headings need to be uppercase). See https://www.drupal.org/node/2181737 .
  • The INTRODUCTION section is missing.
  • The REQUIREMENTS section is missing.
  • The INSTALLATION section is missing.
  • The CONFIGURATION section is missing.
• Remove LICENSE.txt, it will be added by drupal.org packaging automatically.
• Coder Sniffer has found some issues with your code (please check the Drupal coding standards). See attachment.
• DrupalPractice has found some issues with your code, but could be false positives.
  

  FILE: ...dules/kompakkt/src/Plugin/Field/FieldFormatter/KompakktFormatter.php
  --------------------------------------------------------------------------
  FOUND 0 ERRORS AND 3 WARNINGS AFFECTING 3 LINES
  --------------------------------------------------------------------------
   27 | WARNING | Unused variable $settings.
   29 | WARNING | t() calls should be avoided in classes, use
      |         | \Drupal\Core\StringTranslation\StringTranslationTrait and
      |         | $this->t() instead
   43 | WARNING | \Drupal calls should be avoided in classes, use
      |         | dependency injection instead
  --------------------------------------------------------------------------
  

• No automated test cases were found, did you consider writing Simpletests or PHPUnit tests? This is not a requirement but encouraged for professional software development.

This automated report was generated with PAReview.sh, your friendly project application review script.

manual review:

1. Project page: what is Kompakkt? What is teh sue case of this module? Please describe that on the project page.
2. KompakktApiController: there are dpm() calls for debugging that will cause fatal errors on production sites, please remove them.
3. KompakktApiController::pushAnno(): this will throw PHP fatal errors if the received JSON is not in the format you are expecting. Please add some error handling here.
4. KompakktItem: almost all code is commented out. Can this be cleaned up?
5. route kompakkt.api.pushAnno: this looks vulnerable to CSRF exploits. You need to a CSRF protection to data changing routes like this. You could use _csrf_request_header_token on the route like JSONAPI module does, see https://www.drupal.org/docs/drupal-apis/routing-system/structure-of-routes and https://www.drupal.org/node/2772399 . It is a bit hard to exploit CSRF vulnerabilities with JSON, but it works from old browsers that have Flash for example. This is currently a security blocker.
6. KompakktApiController::getEntity(): this looks vulnerable to file access bypass exploits. An attacker with the permission "Kompakkt Get Entity" can retrieve file information for all managed files in Drupal. You need to check file entity access before handing out information about the arbitrary file in question. This is also a security blocker.

Thank you for your contribution! I am going to update your account.

These are some recommended readings to help with excellent maintainership:

• Dries' post on Responsible maintainers
• Best practices for creating and maintaining projects
• Maintaining a drupal.org project with Git
• Commit messages - providing history and credit
• Release naming conventions.
• Helping maintainers in the issue queues

You can find more contributors chatting on the IRC #drupal-contribute channel. So, come hang out and stay involved.
Thank you, also, for your patience with the review process.
Anyone is welcome to participate in the review process. Please consider reviewing other projects that are pending review. I encourage you to learn more about that process and join the group of reviewers.

I thank all the dedicated reviewers as well.