Module filter circumvents paranoias blocking of PHP and Paranoia itself in the modules list [#1811928]

The Paranoia module removes the php module, and itself, from the module list as a way to harden the site.

While the correct form alter hook still gets invoked, paranoia_form_system_modules_alter, the modules are shown in the list anyway.

It would be awesome if MF could not override Paranoia. :)

Comments

Comment #1

greenskin commented 15 October 2012 at 18:24

Hmm, Module Filter shouldn't affect that. The module simply themes the form. If Paranoia's form alter is in fact running, the module should be unset and not ever seen by Module Filter.

Comment #2

Letharion commented 15 October 2012 at 19:29

I tried to add a dpm in the hook_alter. Loaded the module page, examined the output, ran drush dis module_filter -y (which didn't disable any other modules), and re-examined the same url.

The problem is that with MF turned on, the entire array is flattened, so that all modules are a the top level, whereas without MF, the module categories are top level, and the modules themselves are a level deeper.

Paranoia "fails", because the level $package on line 22 in the link from the OP, doesn't exist anymore.

Without digging very deeply, I'm assuming the flattening happens in module filters own hook_form_system_modules_alter.

Comment #3

greenskin commented 15 October 2012 at 20:09

Ahh, you are correct. I was evaluating the 2.x branch rather than the 1.x. The 2.x branch does not restructure the form array. Changing the weight of either module should remedy the issue, allowing Paranoia to alter the form before Module Filter. This should be tasked to Module Filter.