RFI JFN [jfn]

1. The file LICENSE.txt needs to be removed, because Drupal.org CVS doesn't allow to commit it.
2. Files available from third-party site should not be included in Drupal.org CVS.
3. Files licensed under a license different from GPL cannot be included in the repository; see Why drupal.org doesn't host GPL-"compatible" code.

1.     return t("Remote File Inclusion (RFI) is a technique often used to attack Internet websites from a remote computer. With malicious intent, it can be combined with the usage of a cross-server-attack to harm a webserver. Remote File Inclusion attacks allow malicious users to run their own PHP code on a vulnerable website. The attacker is allowed to include his own (malicious) code in the space provided for PHP programs on a web page. For more information visit the <a href=\"@rfireport-website\">RFI Report</a> website.",
   

   It should be better to avoid to escape the quote character on strings that needs to be translated; the script to extract those strings would probably extract the escape character too

2.   $url=explode('http://',trim(str_replace('HTTP','http',$rfilog->location),'http://'));
   

   The code doesn't seem correct. trim() is removing any h, t, p, :, and /; then explode() should create an array item each time it finds an occurrence of http://, which cannot be found as those characters have been removed. See the examples in http://it2.php.net/manual/en/function.trim.php, where it is clear that the last parameter of trim() is a list of characters to be removed.

1.     $url=explode('http://',trim(str_replace('HTTP','http',$rfilog->location),'http://'));
       $page='';$script='';
       if (is_array($url)) {
         if(key_exists(0,$url) && key_exists(1,$url)) {
           $domain=parse_url('http://'.$url[1], PHP_URL_HOST);
           $script=trim($url[1],'?');
   

   The coding standards say that a space should be added before and after a =, or after a comma in the parameter list of a function.

2.   $caption = t('A total of ') . $totalrfi . t(' RFI attempts have been logged over the past ') . $totalday . t(' days');
   

   Rather than concatenating translatable strings, the code should use placeholders. In this way, people who create the translation for the module have a context that allow them to better translate the string (as a translation can be context-dependend).

3.   header('Content-Type: text/xml');
   

   The code should use Drupal functions, when available. In this case the function to call should be drupal_set_header().

There is no need to close a fixed issue. They are automatically closed after 14 days.