Overview

Allow users to add custom CSS to their site using an editor.

Dependencies

None

Project link

https://www.drupal.org/project/admincss

Git instructions

git clone --branch 8.x-2.x https://git.drupalcode.org/project/admincss.git

PAReview checklist

https://pareview.sh/pareview/https-git.drupal.org-project-admincss.git-8...

CommentFileSizeAuthor
#16 security-advisory-coverage.png9.5 KBcodebymikey

Comments

codebymikey created an issue. See original summary.

avpaderno’s picture

Thank you for applying! I added the Git instructions for non-maintainer users and the PAReview checklist link. Reviewers will check the project and post comments to list what should be changed.

If you haven't done it, yet, please check the PAReview report and fix what needs to be fixed. There could be some false positives; verify that what reported is correct, before making any change.

avpaderno’s picture

Status: Needs review » Needs work

There are some coding standards issues to be fixed in the editor.js, the editor.css, and the README.md files.

shaktik’s picture

Git errors:

Review of the 8.x-2.x branch (commit 5b5dae8):

  • The admincss.module does not implement hook_help(). See https://www.drupal.org/docs/develop/documenting-your-project/module-docu... .
  • Coder Sniffer has found some issues with your code (please check the Drupal coding standards). See attachment.
  • ESLint has found some issues with your code (please check the JavaScript coding standards).
    /var/vhosts/c214000000/site1101/web/vendor/drupal/pareviewsh/pareview_temp/js/editor.js: line 35, col 56, Error - Unexpected trailing comma. (comma-dangle)
    /var/vhosts/c214000000/site1101/web/vendor/drupal/pareviewsh/pareview_temp/js/editor.js: line 71, col 9, Error - Expected space or tab after '/*' in comment. (spaced-comment)
    /var/vhosts/c214000000/site1101/web/vendor/drupal/pareviewsh/pareview_temp/js/editor.js: line 96, col 25, Error - Missing space before function parentheses. (space-before-function-paren)
    
    3 problems
    
  • No automated test cases were found, did you consider writing PHPUnit tests? This is not a requirement but encouraged for professional software development.

This automated report was generated with PAReview.sh, your friendly project application review script.


FILE: ...0/site1101/web/vendor/drupal/pareviewsh/pareview_temp/css/editor.css
--------------------------------------------------------------------------
FOUND 10 ERRORS AFFECTING 10 LINES
--------------------------------------------------------------------------
  2 | ERROR | [x] Line indented incorrectly; expected 2 spaces, found 4
  3 | ERROR | [x] Line indented incorrectly; expected 2 spaces, found 4
  4 | ERROR | [x] Line indented incorrectly; expected 2 spaces, found 4
  5 | ERROR | [x] Line indented incorrectly; expected 2 spaces, found 4
  6 | ERROR | [x] Line indented incorrectly; expected 2 spaces, found 4
 10 | ERROR | [x] Line indented incorrectly; expected 2 spaces, found 4
 11 | ERROR | [x] Line indented incorrectly; expected 2 spaces, found 4
 12 | ERROR | [x] Line indented incorrectly; expected 2 spaces, found 4
 13 | ERROR | [x] Line indented incorrectly; expected 2 spaces, found 4
 14 | ERROR | [x] Line indented incorrectly; expected 2 spaces, found 4
--------------------------------------------------------------------------
PHPCBF CAN FIX THE 10 MARKED SNIFF VIOLATIONS AUTOMATICALLY
--------------------------------------------------------------------------


FILE: ...000000/site1101/web/vendor/drupal/pareviewsh/pareview_temp/README.md
--------------------------------------------------------------------------
FOUND 0 ERRORS AND 1 WARNING AFFECTING 1 LINE
--------------------------------------------------------------------------
 23 | WARNING | Line exceeds 80 characters; contains 97 characters
--------------------------------------------------------------------------

Time: 635ms; Memory: 4Mb
avpaderno’s picture

Given that the plan is fixing the code to use the machine name of the project where that is used, would not waiting you change/add more code be better? The more edits you do, the better is for this application.

codebymikey’s picture

Thanks @kiamlaluno and @shaktik, I've updated the code to meet the coding standards, added a more appropriate update hook to automate the migration process, as well as an appropriate change record for it.

The current module code is more or less stable now, with the only change left to make is removing the admin_css module from the code to free up the https://www.drupal.org/project/admin_css name.

I was planning to make that change after receiving the security advisory coverage, and pushing it as the final stable release for the foreseeable future.

rksyravi’s picture

Status: Needs work » Needs review

Hi @codebymikey,

Thank you for contribution!!!

Please make sure to change the status, after you made the fixes. Then only the reviewer can give you the feedback for any other changes.

avpaderno’s picture

To make it clear: These applications are for giving users the Drupal role that allows them to opt into security coverage for every project they created or they will create. With another user who made 12 commits, we cannot give that Drupal role to a single user, nor do we give that Drupal role for more than one user and for the same project.

That's why I said that the more code you commit the better is for this application.

codebymikey’s picture

Thanks @rksyravi, forgot to update it.

@kiamlaluno, I wasn't aware of the amount of commits limitation, and thought it was solely on the quality of the contributions themselves.

How would you suggest we move forward as the module itself is now feature complete and uses all the appropriate APIs; also once this issue is closed, does that mean I can no longer apply?

I do have work on other projects that I just haven't had time to clean up and push up yet that might be used to gauge my ability to write stable code.

One being a major refactor the Gutenberg module and the other a bug-fix and coding standards update for Commerce Secure Hosting.

With another user who made 12 commits, we cannot give that Drupal role to a single user, nor do we give that Drupal role for more than one user and for the same project.

Is my thinking correct:
Because damodharan is also a maintainer and doesn't currently have the role, I can't apply under the project? Also wasn't aware of this limitation.

I was under the impression that the application was solely for me, and I'd be the one to specify whether the release/code was stable rather than him.

avpaderno’s picture

The purpose of these applications is reviewing the code written from a user to check what that user understands about writing secure code that follows the coding standards and that correctly uses the Drupal API.
In this project, the only changes you have done are for using the project machine name where that should be used, which is fine, as that means you understand that aspect of Drupal programming, but it doesn't say much about the rest, as the code has been written by another user.

Many users misunderstand this: These applications aren't about projects, but users. We give users a Drupal role that allows them a higher participation on Drupal.org. It's similar to become webmasters on Drupal.org. Everybody can ask for that Drupal role, but they are given the role of webmasters for their activity on drupal.org, not another user's activity on drupal.org.

If these applications were for projects, we would not give any Drupal role to users, but we would change the settings for each project used in the applications. This is what we do when the code has been written from more than a user, or when the project contains few code lines, but these are exceptions to what these applications serve.

rohitrajputsahab’s picture

you need to flush CSS cache after saving your configuration. Because supposed I'm enabled " Aggregate CSS files". Your config CSS is not reflecting. Please check it.

rohitrajputsahab’s picture

Status: Needs review » Needs work
codebymikey’s picture

Hi @rohit-rajput-sahab, that's a good spot. I thought I had tested for that scenario, but I guess I must've had $config['system.performance']['css']['preprocess'] = FALSE; in my local settings.local.php or something.

I've pushed a new commit addressing the issue. It now adds the appropriate cache tags so that the anonymous page cache is cleared when the CSS on the config page is changed.

Hi @kiamlaluno,
Thanks for the clarification.
For the Admin CSS module, the main changes made was migrating the module name as well as adding Ace Editor integration, while enforcing Subresource Integrity.

I've now pushed a couple new commits up on various projects that might be a better judge of my ability to write secure code:

  1. Commerce securehosting - Drupal 8 module was written by myself from scratch and should now fully adhere to Drupal coding standards - I wasn't aware of the DrupalPractice coding standards until pareview.sh, I just always used Drupal.
  2. Gutenberg - Major API changes to improve code quality, maintenance and integration with third party modules.

If that still isn't enough, then what's your recommended suggestion moving forward?

codebymikey’s picture

Status: Needs work » Needs review
klausi’s picture

Status: Needs review » Fixed
Issue tags: -PAreview: single application approval

The code of the module looks good! Then I looked at other drupal.org commits by codebymikey and they also look good and indicate that they have a good understanding how to write Drupal code. Even the admincss commits are quite substantial on their own. Therefore I think we can directly promote codebymikey.

Thanks for your contribution, codebymikey!

I updated your account so you can opt into security advisory coverage now.

Here are some recommended readings to help with excellent maintainership:

You can find lots more contributors chatting on Slack or IRC in #drupal-contribute. So, come hang out and stay involved!

Thanks, also, for your patience with the review process. Anyone is welcome to participate in the review process. Please consider reviewing other projects that are pending review. I encourage you to learn more about that process and join the group of reviewers.

Thanks to the dedicated reviewer(s) as well.

codebymikey’s picture

StatusFileSize
new9.5 KB

Hi @klausi,

I appreciate it, and have given the linked articles a read.

Unfortunately I don't think I have the may opt into security advisory coverage role as this is the option I see when trying to create a new release and opt my Commerce Secure Hosting module in for coverage:

Security advisory coverage settings

avpaderno’s picture

klausi’s picture

@kiamlaluno: hm, why did you add the "PAReview: single application approval" again? Please don't undo my approvals without giving a reason. As I said in #15: I looked at other drupal.org commits by codebymikey and they also look good and indicate that they have a good understanding how to write Drupal code. Even the admincss commits are quite substantial on their own. Therefore I think we can directly promote codebymikey.

Any reason why we should not grant codebymikey the security coverage role?

avpaderno’s picture

@klausi Then you should do the same with my reviews.

None of the points you mentioned change the result of an application, since:

  • How many projects a user created is irrelevant, since we just review a project chosen by the user who applies
  • These applications aren't for group work, since we review what a single user wrote and we give a Drupal role to that user
  • To review what a single user understands about writing secure code that follows the coding standards and correctly uses the Drupal API, the code must provide a link to a project containing the code they wrote alone because it's difficult, or long, to check what a single user understands about writing Drupal code when the code has been written from more than a user; most importantly, it would make the task of reviewer harder, and we depend from the review other users do

The right question would be: Why should codebymikey get the role when users who wrote alone a project that contained less code don't get it?

codebymikey’s picture

@kiamlaluno

Do you mind responding to my point on #13?

What's your recommended suggestion moving forward as the Admin CSS module is now stable and feature complete.

avpaderno’s picture

The module is already set to opt into security coverage, as the project page says.

Stable releases for this project are covered by the security advisory policy.

codebymikey’s picture

Yes I'm aware of that, I'm actually talking about the Drupal role itself, and what the necessary steps are to move forward with that.

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.

klausi’s picture

Status: Closed (fixed) » Reviewed & tested by the community

@kiamlaluno

  • The goal of this process is to evaluate if a user can write secure code and is able to contribute meaningful projects on drupal.org. codebymikey has demonstrated that and has written enough code in multiple projects to demonstrate that.
  • We don't evaluate group work, we evaluate the contributions of a single user. codebymikey has made enough meaningful code contributions to demonstrate that.
  • I put in the hard reviewer work to go trough codebymikey's visible contributions and found that they all add up to a meaningful understanding that allows us to give them the security coverage role.

To answer your question: codebymikey should get this role because they have enough meaningful contributions and understand how to publish a module on drupal.org. Other users that write a module alone have no disadvantage because of that, we will also approve them. In fact we will approve anybody that demonstrates their knowledge in this process.

Setting this back to RTBC to get feedback from kiamlaluno.

avpaderno’s picture

Status: Reviewed & tested by the community » Fixed

codebymikey already has the vetted role, since he created a new application and got it.

avpaderno’s picture

Status: Fixed » Closed (fixed)
klausi’s picture

Ah, even better. Thank you!