CVS edit link for tdway

I work for a digital agency that uses Drupal to build CMS sites. I have experience building custom themes and modules for both Drupal 5 and 6.

I'd like to contribute a module called EazyEdit. It provides in-place edit links when hovering over blocks, nodes, or comments, and provides a view field for adding EazyEdit links to nodes in views. It also includes a sub-module called EazyLaunch which is a fast text-based launcher for instantly navigating the entire menu system of a Drupal site. On any page, hit Ctrl+Z and start typing to see suggestions, then press Enter to launch.

I don't see a way to attach source code to this application, but some of the documentation elsewhere on your site indicates it is required for approval so here is a link to a zip archive of the module I've described: http://www.toddway.com/files/eazyedit.zip. Please let me know if you need any more information. Thanks for your time.

Todd

CommentFileSizeAuthor
#4 eazyedit.zip14.59 KBtdway
#1 eazyedit.zip14.58 KBtdway

Comments

tdway’s picture

tdway commented
Status: Postponed (maintainer needs more info) » Needs review
StatusFileSize
new eazyedit.zip14.58 KB
mr.baileys’s picture

mr.baileys
Primary language Dutch
Location 🇧🇪 (Ghent)
commented
Status: Needs review » Needs work 
function eazy_edit_menu() {
  $items['eazy-edit/switch/%/%/%'] = array(
    'page callback' => 'eazy_edit_switch_attribute',
    'page arguments' => array(2, 3, 4),
    'access arguments' => array('access content'),
    'type' => MENU_CALLBACK,
  );
  return $items;
}

function eazy_edit_switch_attribute($attribute, $obj_type, $obj_id) {
  if ($obj_type == 'node') {
    //we load and save instead of a direct db update so proper node_save hooks get fired
    $obj = node_load($obj_id);
    $obj->{$attribute} = $obj->{$attribute} == 1 ? 0 : 1;
    node_save($obj);
  }
// snip

So what happens if a user with just "access content" permissions (basically anyone) browses to eazy-edit/switch/status/node/1? Not to mention someone visiting easy-edit/switch/body/node/<nid>...

This looks like a security vulnerability to me...

avpaderno’s picture

avpaderno
he/him
Primary language Italian
Location Brescia, 🇮🇹 🇪🇺
commented
Issue tags: +Module review

Hello, and thanks for applying for a CVS account. I am adding the review tags, and some volunteers will review your code, pointing out what needs to be changed.

As per http://drupal.org/cvs-application/requirements, the motivation message should be expanded to contain more details about the features of the proposed module, and it should include also a comparison with the existing solutions.

tdway’s picture

tdway commented
Status: Needs work » Needs review
StatusFileSize
new eazyedit.zip14.59 KB

Good catch. Thanks. Should be fixed now.

avpaderno’s picture

avpaderno
he/him
Primary language Italian
Location Brescia, 🇮🇹 🇪🇺
commented
Status: Needs review » Needs work

I am changing the status as per comment #3.

tdway’s picture

tdway commented
Status: Needs work » Needs review

Description
EazyEdit provides in-place edit links when hovering over objects like blocks, nodes, or comments, and provides a view field for adding EazyEdit links to nodes in views. Features include:

  • in-place links for blocks - edit block, edit menu, edit view
  • in-place links for nodes - edit node, edit node type, publish/unpublish node
  • in-place links for comments - edit comment, publish/unpublish comment
  • views field integration - EazyEdit links can be made to appear for each node in a view simply by adding the EazyEdit field to your view
  • clicking a link takes your directly to the edit page and returns you to your previous destination on submit
  • disable EazyEdit on individual blocks or node types by checkbox on edit pages
  • hide EazyEdit temporarily on a page by clicking the 'x' link. Sometimes hover links appear over other things you need to click. This gets EazyEdit out of your way.
  • EazyEdit attaches itself to the $content variable of nodes and blocks which makes it automatically appear in most themes. If for some reason you don't use $content in your theme, you can inject EazyEdit directly using $node->eazyedit or $block->eazyedit


EazyLaunch is a fast text-based launcher for instantly navigating the entire menu system of a Drupal site. On any page, hit Ctrl+Z and start typing to see suggestions, then press Enter to launch. Features include:

  • navigate your site without using your mouse
  • go directly to sub-pages without needing to drill down into menus
  • pop-up launcher - hit Ctrl+Z to open
  • fast autocomplete while typing
  • all menu items are available from the launcher including Administer, Primary Links, Secondary Links, and any other menus you create
  • additional admin shortcuts for clearing cache, running cron.php, and running update.php
  • devel integration - the devel module's switch user list is available from the launcher


Module Comparisions
EazyEdit is similar to the Block Edit module, but aims to be more flexible, which allows it to integrate with nodes and view items no matter what kind of theming markup is built by the user. It tries to avoid some of the glitches that occur with the way Block Edit (and Views) handle the hover event. It also offers an extended set of edit links.

EazyLaunch is similar to the Teleport module, but aims for better performance. Teleport makes asynchronous requests to the server as you type to populate the suggestion dropdown. This allows Teleport to include all site nodes - even nodes that aren't in the menu - but usually means the user waits many seconds before seeing any results. EazyLaunch displays results instantly as you type. Since the menu system usually encompasses the pages you would need to jump to, it can leverage a client-side menu cache for a significant boost in speed. EazyLaunch can also be a speedier and less intrusive alternative to other Drupal admin menus since it doesn't interfere with the page presentation and doesn't involve drilling down into menus with your mouse.

avpaderno’s picture

avpaderno
he/him
Primary language Italian
Location Brescia, 🇮🇹 🇪🇺
commented

Thanks for the reply.

tdway’s picture

tdway commented

Is there anything else I can do to get this approved?

iLLin’s picture

iLLin commented

This is works as advertised. Great Job tdway! I didn't find any issues.

iLLin’s picture

iLLin commented
Status: Needs review » Reviewed & tested by the community

I also ran it through the coder module, looks clean good commenting... etc.

avpaderno’s picture

avpaderno
he/him
Primary language Italian
Location Brescia, 🇮🇹 🇪🇺
commented
Status: Reviewed & tested by the community » Fixed

Thank you for your contribution! I am going to update your account.
These are some recommended readings to help with excellent maintainership:

You can find more contributors chatting on the IRC #drupal-contribute channel. So, come hang out and stay involved.
Thank you, also, for your patience with the review process.
Anyone is welcome to participate in the review process. Please consider reviewing other projects that are pending review. I encourage you to learn more about that process and join the group of reviewers.

I thank all the dedicated reviewers as well.

Status: Fixed » Closed (fixed)
Issue tags: -Module review

Automatically closed -- issue fixed for 2 weeks with no activity.

Issue tags: +Module review

Restoring issue tags, see #2125755: System messages removed all issue tags during D7 upgrade.

avpaderno’s picture

avpaderno
he/him
Primary language Italian
Location Brescia, 🇮🇹 🇪🇺
commented
Component: Miscellaneous » new project application
Assigned: Unassigned » avpaderno
Issue summary: View changes