The module provides a way to create custom and complex drop down menus that combines Drupal menu items with rich media content that is fully accessible and responsive. Users also have the ability to insert custom blocks within a menu item and arrange items into columns. Each dropdown, each individual menu item can easily be treated as snowflakes. Users create a TB Megamenu, which is linked to the menu tree of their choice and then can be fully customized. TB is rendered on the Front End as a block. We believe TB is unique in how it offers its users complete control over each individual menu item.

This is the first module have I have owned and thus first application for security advisory coverage. We are not the original creators of the module but rescued an abandoned module back in August of 2020. Myself (@themodularlab), @quondam, @knaffles, and @andrewozone have all worked tirelessly to bring this module back to life in order to give back to the community and to a module that our company has relied on the past few years.

We have added complete documentation for our module: 8.x Documentation.

Project link

https://www.drupal.org/project/tb_megamenu

Git instructions

git clone --branch 8.x-1.x-dev https://git.drupalcode.org/project/tb_megamenu.git

PAReview checklist

http://pareview.net/r/36

Comments

themodularlab created an issue. See original summary.

themodularlab’s picture

themodularlab
He/Him
Primary language English
commented
Status: Needs review » Needs work

We have discovered a bug with our 1st release candidate. Marking as needs work until addressed.

themodularlab’s picture

themodularlab
He/Him
Primary language English
commented
Status: Needs work » Needs review

Bug from our first release candidate has been addressed. We have released a 2nd RC version. We are ready to resume the security advisory policy application.

themodularlab’s picture

themodularlab
He/Him
Primary language English
commented
Title: [D8] The Better Megamenu » [D8] The Better Mega Menu
themodularlab’s picture

themodularlab
He/Him
Primary language English
commented
Issue summary: View changes
avpaderno’s picture

avpaderno
he/him
Primary language Italian
Location Brescia, 🇮🇹 🇪🇺
commented
Issue summary: View changes
Related issues: -#3186616: Security Advisory Coverage
themodularlab’s picture

themodularlab
He/Him
Primary language English
commented
Issue summary: View changes

Updates

We have released a 3rd release candidate that includes a couple of bug fixes and some improvements to admin UI error messaging: https://www.drupal.org/project/tb_megamenu/releases/8.x-1.0-rc3

avpaderno’s picture

avpaderno
he/him
Primary language Italian
Location Brescia, 🇮🇹 🇪🇺
commented
Issue summary: View changes
Status: Needs review » Needs work

I added the PAreview checklist link. Reviewers will check the project and post comments to list what should be changed.

If you haven't done it, yet, please check the PAreview report and fix what needs to be fixed. There could be some false positives; verify that what reported is correct, before making any change.

themodularlab’s picture

themodularlab
He/Him
Primary language English
commented
Status: Needs work » Needs review

Most of the reported errors were actually false flags.

  • TBMegaMenuController.php: the comment-related issues reference an inherited docblock that actually comes from Drupal code - so it wouldn't be fixed in this module.
  • All of the CSS issues stem from the use of the filter property (progid:DXImageTransform); those lines actually do end in a semicolon.
  • Branch / release names updated.
  • https://www.drupal.org/project/tb_megamenu/issues/3186612 addresses Unknown type hint "object" found for $item issue.
themodularlab’s picture

themodularlab
He/Him
Primary language English
commented

Also did a new PAreview: http://pareview.net/r/36/revisions/254/view. Only issues showing now are the false flag CSS issues and the doc block issues that comes from core.

klausi’s picture

klausi
he/him||they/them
Primary language German
Location 🇦🇹 Vienna
commented
Status: Needs review » Fixed

automated review:

FILE: ...upal-9/modules/tb_megamenu/src/Plugin/Derivative/TBMegaMenuBlock.php
--------------------------------------------------------------------------
FOUND 0 ERRORS AND 1 WARNING AFFECTING 1 LINE
--------------------------------------------------------------------------
 46 | WARNING | Menu::loadMultiple calls should be avoided in classes,
    |         | use dependency injection instead
--------------------------------------------------------------------------


FILE: ...me/klausi/workspace/drupal-9/modules/tb_megamenu/tb_megamenu.install
--------------------------------------------------------------------------
FOUND 0 ERRORS AND 1 WARNING AFFECTING 1 LINE
--------------------------------------------------------------------------
 43 | WARNING | Exceptions should not be translated
--------------------------------------------------------------------------

manual review:

  1. Fatal error: Declaration of Drupal\tb_megamenu\TBMegaMenuBuilder::insertTbMenuItem(array &$item_config, $row, $col, object $item) must be compatible with Drupal\tb_megamenu\TBMegaMenuBuilderInterface::insertTbMenuItem(array &$item_config, $row, $col, $item) in src/TBMegaMenuBuilder.php on line 514
  2. Found a suspicious Twig raw usage in tb-megamenu-item.html.twig, but that just prints a variable that was auto-escaped before. So no XSS security issue here, good!

Otherwise looks good to me.

Thanks for your contribution, Wade!

I updated your account so you can opt into security advisory coverage now.

Here are some recommended readings to help with excellent maintainership:

You can find lots more contributors chatting on Slack or IRC in #drupal-contribute. So, come hang out and stay involved!

Thanks, also, for your patience with the review process. Anyone is welcome to participate in the review process. Please consider reviewing other projects that are pending review. I encourage you to learn more about that process and join the group of reviewers.

Thanks to the dedicated reviewer(s) as well.

themodularlab’s picture

themodularlab
He/Him
Primary language English
commented

Thank you!!!

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.