Closed (fixed)
Project:
Drupal.org security advisory coverage applications
Component:
new project application
Priority:
Normal
Category:
Task
Assigned:
Reporter:
Created:
10 Apr 2011 at 09:32 UTC
Updated:
25 Apr 2011 at 22:31 UTC
Jump to comment: Most recent file
Comments
Comment #1
dave reidFYI it might be considered a security issue since the 'access administration pages' is a very loose permission and probably should not be used to control access to being able to perform database operations. Consider adding your own permission so that you can add a warning in the description that it should only be given to trusted administrators.
Looks like the line
$rows[] = array($key, $info['driver'], $info['database']);output un-escaped variables, although one would have to put the XSS in the settings.php file, it still is a good practice to escape variables on output.Same goes with using statements like
drupal_set_message("$name was successfully created.");in dbtng_migrator.batch.inc - it should be using t('@name was sucessfully created') both to enable that the string can be translated, and to ensure that $name is escaped properly.Again with
t("Processing !table successful", array('!table' => $table));should be using @table to check_plain().This pattern of not escaping variables continues in dbtng_migrator.batch.inc, although minor, they still could be considered security issues, so it would be good to see the above addressed before approving this application. In general the code looks good and looks very useful as well, so nice work!
Comment #2
josh waihi commentedThe attached patch was committed to fix the translation errors and address the security issues outlined. Thanks Dave!
I coded rather quickly cause people were asking for this functionality. I worked under the assumption that only people who knew what they were doing would be using this module and wasn't thinking about translations TBH.
Anyways, hope that does the trick. I wanna blog about this once I've got a proper URL To reference :)
Comment #3
josh waihi commentedComment #4
rfayI am so *YAY* about this project. Don't have time this afternoon to take a look at the code for review, but will look forward to giving it another go.
Comment #5
rfayJust gave this fantastically important module another quick test drive. It's not perfect yet, but fields work. I think it's going to need some good tests, because it's going to become a mainstay of the community when it's reliable.
My current results: Migrating from a sqlite to mysql and back to a new sqlite db using drush: Some parts of the db were lost, and there was quite a lot of difference in the drush sql-dump result. But it nearly worked.
Comment #6
dave reidCool I'm satisified that Josh knows what he's doing at this point and impressed with the quick response to the changes. As such, I'm approving this Project application. Josh, enjoy promoting your sandbox to a full module project! Be sure to subscribe to your modules' issue queues to always be alerted to issues that other users file. Now that you have the ability to create full projects without review, make sure to take a little bit of time before each project to check to see if you can coordinate with an existing effort, or maybe put code in a sandbox first and ask for peer review. It is a pleasure to have you has an official contributor to Drupal.org!
Comment #7
josh waihi commentedYay! thanks very much!
Comment #8
rfayYay! And I was wrong about the migration failing.
I did a migration from sqlite to mysql to sqlite again and the resulting database worked as expected, which I think is absolutely amazing. I'd really like to see a test (not necessarily simpletest) that does a number of migrations of this type and comes up with an identical result. I'll open an issue.