[D7] Last login time

We are currently quite busy with all the project applications and we prefer projects with a review bonus. Please help reviewing and put yourself on the high priority list, then we will take a look at your project right away :-)

Also, you should get your friends, colleagues or other community members involved to review this application. Let them go through the review checklist and post a comment that sets this issue to "needs work" (they found some problems with the project) or "reviewed & tested by the community" (they found no major flaws).

I'm a robot and this is an automated message from Project Applications Scraper.

Hi,
I have reviewed this module. Works good..! and also checked pa review, there are no errors

Thanks

Hello, after my review and tests, this module was checked and has no errors.

Thank you.

Hi munishsharma,

Automated Review

[Best practice issues identified by pareview.sh]

Manual Review

Individual user account
[Yes: Follows] the guidelines for individual user accounts.

No duplication
[Yes: Does not cause] module duplication and/or fragmentation.

Master Branch
[Yes: Follows] the guidelines for master branch.

Licensing
[Yes: Follows] the licensing requirements.

3rd party assets/code
[Yes: Follows] the guidelines for 3rd party assets/code.

README.txt/README.md
[Yes: Follows] the guidelines for in-project documentation and/or the README Template.

Code long/complex enough for review
[No: Does not follow] the guidelines for project length and complexity.

Secure code
[No: List of security issues identified.]

If added, please don't remove the security tag, we keep that for statistics and to show examples of security problems.

Hi,

Can you specify why you are using hook_form_alter. You have added custom form validation but not validating anything. You are just setting the $_SESSION['user_last_login'] variable. The better way is use of hook_user_login

Thanks, Munish for explaination. Your module looks good to go. +1 from me.

Hello,

I reviewed the module and found no errors. It works perfectly for me. +1 from me.

Good idea to display user last login time...

Hello munishsharma,
Nice module +1, I am sure it will be useful for drupal community. It is light weight and easy to use. I tested the module and everything is working good.

Nice module. It seems to work fine and the code looks good. The only thing I found was a couple of small issues regarding global variable placement and translation. I added a very small patch to resolve these issues. Aside from this I don't see any reason not to mark this as RTBC.

Automated Review

Pareview does not report any error or warnings.

Manual Review

Individual user account
Yes: Follows
No duplication
Yes: Does not cause
Master Branch
Yes: Follows
Licensing
Yes: Follows
3rd party assets/code
Yes: Follows
README.txt/README.md
Yes: Follows
Code long/complex enough for review
Yes: Follows
Secure code
Yes: Follows
Coding style & Drupal API usage
(*) Major finding, needs work
(+) Release blocker
Rekommendations:
1. I would keep any global and static variables used at the top of each function.
2. Added a patch for untranslated string in block content.

There is a security finding in the module's code.

$content = isset($_SESSION['user_last_login']) ? '<div class="last-access">' . $label . ' : ' . $_SESSION['user_last_login'] . '</div>' : '';

Please go through the https://www.drupal.org/docs/7/security/writing-secure-code/handle-text-in-a-secure-fashion to handle the text in secure fashion.

Hi @munishsharma,

Please use check_plain() function to print the session variable as it can be changed/updated with any malicious code.

Thanks!

I do not see any reason not to use check_plain() to process the session variables? In my opinion it would not hurt.

Assigning this issue for Drupal Mumbai Code Sprint Dec 2017.

Closing due to lack of activity. If you are still working on this application, you should fix all known problems and then set the status to "Needs review". (See also the project application workflow).

I'm a robot and this is an automated message from Project Applications Scraper.

/**
 * Implements hook_block_view().
 */
function last_login_block_view($delta = '') {
  $block = array();
  global $user;
  $label = t('Last Login');
  $content = isset($_SESSION['user_last_login']) ? '<div class="last-access">' . $label . ' : ' . $_SESSION['user_last_login'] . '</div>' : '';

  switch ($delta) {
    case 'last_login_block':
      if ($user->uid) {
        $block['content'] = $content;
      }
      else {
        $block['content'] = '';
      }
      break;
  }

  return $block;
}

check_plain() should be used when outputting a value that is supposed not to contain HTML markup, but as Writing secure code says, it should be used on user-submitted content. It is true the code I am showing could output <script src="http://malicious.site.com/crack.js" /> if a malicious module alter the value of $_SESSION['user_last_login'], but in that case the malicious code could do worse things.

In short, the code used from the module and that I shown is correctly not using check_plain() because it is not outputting any user-submitted value.

Thank you for your contribution!
I am going to update your account so you can opt into security advisory coverage now.
These are some recommended readings to help with excellent maintainership:

• Dries' post on Responsible maintainers
• Best practices for creating and maintaining projects
• Maintaining a drupal.org project with Git
• Commit messages - providing history and credit
• Release naming conventions.
• Helping maintainers in the issue queues

You can find more contributors chatting on the IRC #drupal-contribute channel. So, come hang out and stay involved.
Thank you, also, for your patience with the review process.
Anyone is welcome to participate in the review process. Please consider reviewing other projects that are pending review. I encourage you to learn more about that process and join the group of reviewers.

I thank all the dedicated reviewers as well.