Very simple "friend" module built upon Flag module. Install as you would any other Drupal module and you'll have 'friend' flag and a block you can place via your block layout area. The block is a table with two columns: Friend Requests (with a link to add the user as a friend), and a Friends column. The basic principle is a user clicks the flag on another user, that is a friend request. If two users each click the friend flag on the other's profile page or via the Friend Block, they are friends.

Project Page

https://www.drupal.org/project/friend_flag

Project User Guide

Screenshots and instructions on project page
https://www.drupal.org/project/friend_flag

Git Instructions

git clone --branch 8.x-1.x https://git.drupalcode.org/project/friend_flag.git

PAReview Checklist

https://pareview.sh/pareview/https-git.drupal.org-project-friend_flag

Comments

bryantt created an issue. See original summary.

bryantt’s picture

bryantt commented
Title: Friend Flag [D8] » [D8] Friend Flag
klausi’s picture

klausi
he/him||they/them
Primary language German
Location 🇦🇹 Vienna
commented
Status: Needs review » Needs work

Thanks for your contribution!

Manual review:
* info file: dependencies are wrong, flag is not part of drupal core. Should be "flag:flag".
* "Friend Requests Received": all user facing text must run through t() for translation. Also elsewhere, please check all your strings.
* FriendFlagBlock: do not create markup yourself, use a twig template and render arrays instead. This is important for security reasons to prevent XSS issues right from the start. I could not exploit this because you have an Xss::filter() at the end that looks mostly secure. Anyway I think this is not something the security team can support, so changing to proper templates/render arrays is a blocker right now.
* FriendFlagBlock: do not concatenate $home_url with other strings, always use Url::fromRoute() for all URLs so that URL aliases and other URL alterations are respected.
* do not directly query the database, use the FlagService from the flag module instead.
* same for user names: do not directly query the database, load the users that you need instead to allow other module to override the user/entity label for example.

bryantt’s picture

bryantt commented

Thanks for the review!

Info file is fixed
All strings run through t() in the twig file.
Users and Flag links generated using FlagService and FlagLinkBuilder.
Links to user profile generated using variables in twig.
No direct querying of the database.

bryantt’s picture

bryantt commented
Status: Needs work » Needs review
bryantt’s picture

bryantt commented
klausi’s picture

klausi
he/him||they/them
Primary language German
Location 🇦🇹 Vienna
commented
Status: Needs review » Reviewed & tested by the community

Thanks!

manual review:
* FriendFlagBlock: do not call \Drupal in classes, use ContainerFactoryPluginInterface and dependency injection instead.

Otherwise looks good to me!

avpaderno’s picture

avpaderno
he/him
Primary language Italian
Location Brescia, 🇮🇹 🇪🇺
commented
Assigned: Unassigned » avpaderno
Status: Reviewed & tested by the community » Fixed

Thank you for your contribution! I am going to update your account.

These are some recommended readings to help with excellent maintainership:

You can find more contributors chatting on the IRC #drupal-contribute channel. So, come hang out and stay involved.
Thank you, also, for your patience with the review process.
Anyone is welcome to participate in the review process. Please consider reviewing other projects that are pending review. I encourage you to learn more about that process and join the group of reviewers.

I thank all the dedicated reviewers as well.

bryantt’s picture

bryantt commented

Thank you very much, I'll check out the reading and make the last change.

Thanks again, Klausi, very informative.

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.