Applying for the opt-in to security coverage permission.

Module description

The module provides a custom block that will show a list of related nodes. At the moment all content types will be displayed in the block.

The related content for the current node is calculated by checking taxonomy terms coincidences. All terms associated with a node are checked, from all vocabularies.
The nodes with the most coincidences in taxonomy terms with the current one will be showing up first in the list.

There is also a configuration page available for the module, where you can set:

  • Block title
  • Number of elements to be displayed
  • Display type to use for rendering the nodes (i.e. Teaser, Full, etc.)

Project information

Project page: https://www.drupal.org/project/relatedbyterms
Git clone: git clone --branch 7.x-1.x https://git.drupal.org/project/relatedbyterms.git
PAReview: https://pareview.sh/node/2669

Comments

ccarrascal created an issue. See original summary.

PA robot’s picture

We are currently quite busy with all the project applications and we prefer projects with a review bonus. Please help reviewing and put yourself on the high priority list, then we will take a look at your project right away :-)

Also, you should get your friends, colleagues or other community members involved to review this application. Let them go through the review checklist and post a comment that sets this issue to "needs work" (they found some problems with the project) or "reviewed & tested by the community" (they found no major flaws).

I'm a robot and this is an automated message from Project Applications Scraper.

Stevel’s picture

Manual Review

1. Basic application checks

1.1 Ensure your application contains a repository and project page link.

OK: Project and git clone link are present.

2. Basic repository checks

2.1 Ensure the repository actually contains code.

OK: The repository contains code in the 7.x-1.x branch.

3. Security review

3.1 Ensure the project does not contain any security issues.

Not OK:

  • Possible access bypass: the list of nodes to be shown is not filtered for node access.

    When adding a node listing to your module, be sure to use a dynamic query created by db_select() and add a tag of "node_access". This will allow modules dealing with node access to ensure only nodes to which the user has access are retrieved, through the use of hook_query_TAG_alter(). Tagging a query with "node_access" does not check the published/unpublished status of nodes, so the base query is responsible for ensuring that unpublished nodes are not displayed to inappropriate users.

    (source: https://api.drupal.org/api/drupal/modules!node!node.module/group/node_ac...)

4. Licensing checks

4.1 Ensure the top directory of the repository does not contain a ‘LICENSE.txt’ (or similar) file.

OK: No LICENSE.txt or license information present in repository.

4.2 Ensure the repository does not contain any 3rd party files or non-GPLv2+ materials.

OK: No third party code and assets present.

5. Documentation checks

5.1 Ensure the project page contains detailed information.

OK: The project page contains precise information about what this module does.

5.2 Ensure the repository contains a detailed README.txt or README.md.

OK: A README.txt is available.

5.3 Ensure the code contains a well-balanced amount of inline-comments.

OK: All functions are documented and easily understandable.

6. Coding standards and style

6.1 Run an automated review and ensure there are no major issues.

Not OK:

FILE: /root/repos/pareviewsh/pareview_temp/relatedbyterms.module
--------------------------------------------------------------------------
FOUND 0 ERRORS AND 1 WARNING AFFECTING 1 LINE
--------------------------------------------------------------------------
168 | WARNING | Only string literals should be passed to t() where
| | possible

Don't translate variable when using it, have users use 'Variable Translation' instead.

7. API and best practices Review

7.1 Ensure you are using Drupal's API correctly.

Not OK:

  • relatedbyterms.module line 67: Remove parameter $delta from function call
  • relatedbyterms_config_form: Use variable_get for the block title default value. The function gets a translated value instead of the originally value. Also, all fields seem to be required, but are not marked as such.
Stevel’s picture

Status: Needs review » Needs work

Setting to 'Needs work'.

ccarrascal’s picture

Status: Needs work » Needs review

Thanks Stevel, I think I have fixed all your comments.
Great feedback, by the way, specially about the node_access tag in the query, loved that one.

As a summary:

* Made admin form fields mandatory
* Add node_access tag in the query
* Removed t function for the title block.
* Fixed parameter $delta from function call

Thank you very much

Stevel’s picture

Status: Needs review » Needs work

Some further issues:

  • Add a check for unpublished nodes in the query if the user doesn't have permission to view unpublished content
  • I believe the 'Related content' default should be translatable, but that causes the issue mentioned in the last bullet of #3, so some refacturing there might be useful.
ccarrascal’s picture

Status: Needs work » Needs review

Hi again Stevel,

Add a check for unpublished nodes in the query if the user doesn't have permission to view unpublished content

Sorry but I am afraid that I cannot display unpublished nodes in this query because when a node is unpublished, there are no entries for it in the taxonomy_index table that I am using for the query. The entries in this table are created when the node is published and deleted when unpublished.

Regarding the translation of the block title, i cannot use a t() function as per coding standards, but the value can be translated using variable translation module (inside i18n), so I am thinking about adding hook_variable_info() implementation, and add that info in the project description and readme file, and suggest to install i18n if you need translations.

Any feedback will be appreciated here!

ccarrascal’s picture

Implemented:

* relatedbyterms_variable_info
* relatedbyterms_variable_group_info

For i18n_variable support to be able to translate block title via variable.

apaderno’s picture

Priority: Normal » Critical

Please change back the priority to Normal after doing a review.

sleitner’s picture

Priority: Critical » Normal
Status: Needs review » Needs work

Automated Review

Pareview details: https://pareview.sh/pareview/https-git.drupal.org-project-relatedbyterms...

Review of the 8.x-1.x branch (commit 78afd5f):

  • Your README.md does not follow best practices (headings need to be uppercase). See https://www.drupal.org/node/2181737 .
  • No automated test cases were found, did you consider writing PHPUnit tests? This is not a requirement but encouraged for professional software development.

This automated report was generated with PAReview.sh, your friendly project application review script.

Manual Review

Individual user account
Yes: Follows the guidelines for individual user accounts.
No duplication
Yes: Does not cause module duplication and/or fragmentation.
Master Branch
Yes: Follows the guidelines for master branch.
Licensing
Yes: Follows the licensing requirements.
3rd party assets/code
Yes: Follows the guidelines for 3rd party assets/code.
README.txt/README.md
No: Does not follow the guidelines for in-project documentation and/or the README Template. See pareview issues
Code long/complex enough for review
Yes: Follows the guidelines for project length and complexity.
Secure code
Yes: Meets the security requirements.
Coding style & Drupal API usage
  1. (*) add drupal:node and drupal:language module as requirement in relatedbyterms.info.yml
  2. (*) add core: 8.x to relatedbyterms.info.yml

The starred items (*) are fairly big issues and warrant going back to Needs Work. Items marked with a plus sign (+) are important and should be addressed before a stable project release. The rest of the comments in the code walkthrough are recommendations.

If added, please don't remove the security tag, we keep that for statistics and to show examples of security problems.

This review uses the Project Application Review Template.

apaderno’s picture

Status: Needs work » Closed (won't fix)

If you are still working on this application, you should fix all known problems and set the status to Needs review. (See also the project application workflow.)
Please don't change status of this application if you aren't sure you have time to dedicate to this application, or it will be closed again as won't fix.

I am closing this application due to lack of activity.