[D7] OpenID Connect Single Sign-On (SSO) Module by Gluu

Git clone command for the sandbox is missing in the issue summary, please add it.

We are currently quite busy with all the project applications and we prefer projects with a review bonus. Please help reviewing and put yourself on the high priority list, then we will take a look at your project right away :-)

Also, you should get your friends, colleagues or other community members involved to review this application. Let them go through the review checklist and post a comment that sets this issue to "needs work" (they found some problems with the project) or "reviewed & tested by the community" (they found no major flaws).

I'm a robot and this is an automated message from Project Applications Scraper.

Hello,

I think you need to complete your project so you we can review it .. this will help you:

https://www.drupal.org/contribute-projects

Thank you

Hello dollar007,

to get your project to 'full project' you need this post to get reviewed and tested by community then admins here will decide what next .. I suggest you start by adding your sandbox and git link in the original post so people can see it ,,

Anyway here is my review:

Automated Review

You have a lot of errors there my friend you need to fix .. try to get them fixed:
http://pareview.sh/pareview/httpsgitdrupalorgsandboxdollar0072760809git

Manual Review

Individual user account

[Yes: Follows] the guidelines for individual user accounts.

No duplication

[Yes: Does not cause] module duplication and/or fragmentation.

Master Branch

[Yes: Follows] the guidelines for master branch.

Licensing

[Yes: Follows] the licensing requirements.

3rd party assets/code

[Yes: Follows] the guidelines for 3rd party assets/code.

README.txt/README.md

[No] the guidelines for in-project documentation and/or the README Template.

Code long/complex enough for review

[Yes] the guidelines for project length and complexity.

I'd recommend a second opinion on this to decide if the code long/complex meets the guidline here!

Secure code

[No: Doesn't Meets the security requirements.]

Coding style & Drupal API usage

[List of identified issues in no particular order. Use (*) and (+) to indicate an issue importance. Replace the text below by the issues themselves:

1. (*) XSS: Your configuration form items are vulnerable to XSS. In your gluu_sso_general_setup for gluu_sso_general_setup.inc, you are working with the raw input from the user without properly filtering the variables first. This is a serious security issue! You should use either check_plain(), filter_xss() or filter_xss_admin() to sanitize any input from users before you show it on the admin page and this goes for all variable_get() inside your project.
2. (*) Please add README.txt/README.md

The starred items (*) are fairly big issues and warrant going back to Needs Work. Items marked with a plus sign (+) are important and should be addressed before a stable project release. The rest of the comments in the code walkthrough are recommendations.

If added, please don't remove the security tag, we keep that for statistics and to show examples of security problems.

This review uses the Project Application Review Template.

Multiple Applications

It appears that there have been multiple project applications opened under your username:

Project 1: https://www.drupal.org/node/2767463

Project 2: https://www.drupal.org/node/2775987

As successful completion of the project application process results in the applicant being granted the 'Create Full Projects' permission, there is no need to take multiple applications through the process. Once the first application has been successfully approved, then the applicant can promote other projects without review. Because of this, posting multiple applications is not necessary, and results in additional workload for reviewers ... which in turn results in longer wait times for everyone in the queue. With this in mind, your secondary applications have been marked as 'closed(duplicate)', with only one application left open (chosen at random).

If you prefer that we proceed through this review process with a different application than the one which was left open, then feel free to close the 'open' application as a duplicate, and re-open one of the project applications which had been closed.

I'm a robot and this is an automated message from Project Applications Scraper.

Thank you for your contribution!

Notice that users can now promote their projects to full project, but they will not be covered by the security review. If you need to opt into security coverage, you still need to end the application, but since this application is not anymore in the application queue, nobody is going to review it.