[D7]hapity

Git clone command for the sandbox is missing in the issue summary, please add it.

We are currently quite busy with all the project applications and we prefer projects with a review bonus. Please help reviewing and put yourself on the high priority list, then we will take a look at your project right away :-)

Also, you should get your friends, colleagues or other community members involved to review this application. Let them go through the review checklist and post a comment that sets this issue to "needs work" (they found some problems with the project) or "reviewed & tested by the community" (they found no major flaws).

I'm a robot and this is an automated message from Project Applications Scraper.

There are some errors reported by automated review tools, did you already check them? See http://pareview.sh/pareview/httpsgitdrupalorgsandboxkhurramawan2838160git

I'm a robot and this is an automated message from Project Applications Scraper.

Hello

Add @file at hapity-list.tpl.php and any other file if missing.

Remove this information from .info file version, core, project, datestamp .

Declared file is not in directory
line no 8 : files[] = views/hapity.views.inc
in info file

And I also find some of the issues in https://pareview.sh/node/492

please check and resolve it.

no reviews from you listed in the issue summary, make sure to read the review bonus page again https://www.drupal.org/node/1975228

Hi,

1) Your README.txt file doesnt have proper content.

Please read document for REDAME

2) Please remove ; Information added by Drupal.org packaging script on 2015-09-08 from your info file.

Please read document for INFO

Hi khurram_awan,

I taken clone of your module and configured as you mentioned in readme.txt:
While reviewing your code and adding a hapity by node/add/hapity with these fields values http://www.screencast.com/t/moGQJxAY0KNo i received some PDO error like this http://www.screencast.com/t/ObOqgfa5iG

Note: If i am filling some wrong data to node let me know how to fill values to the form for node/add/hapity else fix this error.

Regards
Satyam

Works for me.

Hello,
A little code review:

* hapity_node_access
Unused variable $account
Unused variable $node

* hapity_menu
Variables should start with a module name to prevent 1 variable usage by several modules. Check https://www.drupal.org/docs/develop/standards/coding-standards#naming

* hapity_menu
access callback key could be skipped if user_access function used.

* hapity_node_info
When this hook called, $path variable passes to the function. There is no reason to use drupal_get_path function.

* hapity_form_alter
No t() function used for drupal_set_message.
I'd better use $form['actions']['#access'] = FALSE; unstead of unset();

* _hapity_create_hapity_node
Security vulnerability. Get params wasn't check by check_plain() or strip_tags() functions

Better to use REQUEST_TIME instead of time();
Please use LANGUAGE_NONE instead of 'und' string

* Remove die() from the end of the _hapity_create_hapity_node. Please let the Drupal decide when to stop working with the data.
As I see, in your case it will be better to create empty delivery callback and return URL using it.

* Global variables must be defined at the first line of the function.

* _hapity_build_embed_code
Security vulnerability. Get params wasn't check by check_plain() or strip_tags() functions

* hapity_settings_page
Please consider using drupal_get_form intead of this callback function.

* hapity-list.tpl.php
Why should we put node title into translation? such modules as i18n and entity_translate should handle it themself.

Also check your module with pareview.sh tool, there are much mistakes with drupal code style.

Needs work.

@zvse: _hapity_create_hapity_node(): does not print $_GET parameters to HTML, so how would you exploit the security vulnerability you describe? Remember: "When handling data, the golden rule is to store exactly what the user typed. When a user edits a post they created earlier, the form should contain the same things as it did when they first submitted it. This means that conversions are performed when content is output, not when saved to the database" from https://www.drupal.org/node/28984

Ah sorry, just saw that _hapity_create_hapity_node() stores the data unsanitized as full HTML content. That means the content will not be filtered on output, which is an XSS vulnerability. If the output needs full HTML because of the iframe then you need to be super careful to correctly sanitize the inserted parameters.

And please don't remove the security tag, we keep that for statistics and to show examples of security problems.

Removing review bonus tag, you have not listed any reviews in the issue summary? Make sure to read https://www.drupal.org/node/1975228 again.

- Could you add module's usage guide in the readme file? Like when the hapity nodes will be created. How to view hapity nodes.
I installed and configured the module, and then created two broadcasts, No hapity nodes were created? Don't know what to do next.

- hapity-list.tpl.php file could have an if condition (if (!empty($broadcasts))) before foreach loop.

- Could you change the content type name to "Hapity" instead of "HAPITY"?

-- Thanks

Thank you for your contribution!

I will update your account so you can opt into security advisory coverage now.

Here are some recommended readings to help with excellent maintainership:

• Dries' post on Responsible maintainers
• Best practices for creating and maintaining projects
• Maintaining a drupal.org project with Git
• Commit messages - providing history and credit
• Release naming conventions.
• Helping maintainers in the issue queues

You can find lots more contributors chatting on IRC in #drupal-contribute. So, come hang out and stay involved!

Thank you, also, for your patience with the review process. Anyone is welcome to participate in the review process. Please consider reviewing other projects that are pending review. I encourage you to learn more about that process and join the group of reviewers.

Thanks go the dedicated reviewer(s) as well.