The module enables site-wide keyword searching as RESTful API for 3rd Party integration.

Project link

https://www.drupal.org/project/search_rest_api

Git instructions

git clone --branch 7.x-1.x https://git.drupal.org/project/search_rest_api.git

Comments

sheikh303 created an issue. See original summary.

avpaderno’s picture

Priority: Major » Normal
Issue summary: View changes
Status: Needs review » Needs work
Issue tags: -code review, -Needs security review
sheikh303’s picture

Priority: Normal » Major
Status: Needs work » Needs review
Issue tags: +code review, +PAreview: security, +Needs security review, +Security Advisory follow-up
avpaderno’s picture

Priority: Major » Normal
Issue tags: -code review, -PAreview: security, -Needs security review, -Security Advisory follow-up
avpaderno’s picture

Status: Needs review » Needs work

PAReview still reports some of the same errors it reported. The version, project, and datestamp keys were removed in a commit, but re-added in another one.

avpaderno’s picture

Also, from where are you copying this data, and why?

; Information added by  packaging script on 2013-11-06
version = "7.x-1.0"
core = "7.x"
project = "search_rest_api"
datestamp = "1383727115"
avpaderno’s picture

      if (module_exists('markdown')) {
        $filters = module_invoke('markdown', 'filter_info');
        $info = $filters['filter_markdown'];
        if (function_exists($info['process callback'])) {
          $output = $info['process callback']($readme, NULL);
        }
        else {
          $output = '<pre>' . $readme . '</pre>';
        }
      }
      else {
        $output = '<pre>' . $readme . '</pre>';
      }

When the Markdown module doesn't exist, the content of the file still need to be sanitized.

function search_restful_api_json($key = NULL) {
  $key_word = filter_xss($key);
  if (strlen($key_word) == 0) {
    // ...
  }

  // ...
}

Data are sanitized when output, not when being handled.

    try{
        $search_results = search_data($key_word, "node");
    }catch (Exception $e) {
        var_dump($e);
    }

search_data() doesn't throw any exception, and that would be a bad way to handle them, though.

The module isn't much complex to be used as application, considering that hook_help() is copied from another project and the content of the .info file has been copied from a different project. What left is a function that simply geta the output of a Drupal core function and returns it as JSON.

avpaderno’s picture

This project is too short to approve you as vetted user. Everything with less than 120 lines of code or less than 5 functions cannot be seriously reviewed. However, we can opt into security coverage for this project for you.

avpaderno’s picture

Keep also in mind that new projects must wait 10 days before opting into security advisory coverage.

avpaderno’s picture

Status: Needs work » Closed (won't fix)

If you are still working on this application, you should fix all known problems and set the status to Needs review. (See also the project application workflow.)
Please don't change status of this application if you aren't sure you have time to dedicate to this application, or it will be closed again as won't fix.

I am closing this application due to lack of activity.

avpaderno’s picture