[D7] Commerce Pay With Amazon

Fixed the git clone URL in the issue summary for non-maintainer users.

We are currently quite busy with all the project applications and we prefer projects with a review bonus. Please help reviewing and put yourself on the high priority list, then we will take a look at your project right away :-)

Also, you should get your friends, colleagues or other community members involved to review this application. Let them go through the review checklist and post a comment that sets this issue to "needs work" (they found some problems with the project) or "reviewed & tested by the community" (they found no major flaws).

I'm a robot and this is an automated message from Project Applications Scraper.

Hi Marko,

Automated Review
http://pareview.sh/pareview/httpsgitdrupalorgsandboxmarkobx2662436git

Manual Review

Individual user account
Yes: Follows the guidelines for individual user accounts.

No duplication
No: Causes module duplication and/or fragmentation.

Master Branch
Yes: Follows the guidelines for the master branch.

Licensing
Yes: Follows the licensing requirements.

3rd party assets/code
Yes: Follows the guidelines for 3rd party assets/code.

README.txt/README.md
No: Follows the guidelines for in-project documentation and/or the README Template.
Please refer to this link https://www.drupal.org/node/2181737 for README Template

Code long/complex enough for review
Yes: Follows the guidelines for project length and complexity.

Secure code
No: Meets the security requirements.

Coding style & Drupal API usage
Nothing.

Thanks,
Arulan Pari

@Marko B : I think you forget to change the status. See the workflow https://www.drupal.org/node/532400

Please fix the issue reported on http://pareview.sh/pareview/httpsgitdrupalorgsandboxmarkobx2662436git

Found menu callback with 'access callback' => TRUE. Give proper permission for menu callbacks in hook_menu().

  // Add a menu callback for Pay with Amazon's notification on operation processing.
  $items['commerce_pwa/getdetails'] = array(
    'page callback' => 'commerce_pwa_getdetails',
    'access callback' => TRUE,
    'type' => MENU_CALLBACK,
    'file' => 'includes/commerce_pwa.getdetails.inc',
  );

  // Add a menu callback for Pay with Amazon's notification on operation processing.
  $items['commerce_pwa/ipn'] = array(
    'page callback' => 'commerce_pwa_ipn',
    'access callback' => TRUE,
    'type' => MENU_CALLBACK,
    'file' => 'includes/commerce_pwa.ipn.inc',
  );

Regarding security you can check following posts :
https://www.drupal.org/node/28984
https://www.drupal.org/node/178896

Open page callbacks are standard in payment modules. Could you describe how you are able to exploit a vulnerability there?

@klausi: I tried with several ways but I am not able to exploit.

I added in my learnings doc. I will take care in future.

Thanks.

Went to review as part of my required bonus reviews, but it seems this is waiting on a number of formatting problems, setting to "needs work" to reflect that.

Closing due to lack of activity. If you are still working on this application, you should fix all known problems and then set the status to "Needs review". (See also the project application workflow).

I'm a robot and this is an automated message from Project Applications Scraper.