Fullcalendar View is a lightweight View plugin module that provides a calendar view format powered by FullCalendar JavaScript library.

Features:

Day, week, month view
Creating a new event by double clicking
Event colors based on taxonomy or content type
In-Place editing
Event drag and drop
Resize event (Only available for all day event)
Create a new event via Drupal Off-Canvas dialog
Recurring (Repeated) event
Support Multilingual
Popup Tooltip for event description

Project link

https://www.drupal.org/project/fullcalendar_view

Git instructions

git clone --branch 8.x-2.x https://git.drupal.org/project/fullcalendar_view.git

CommentFileSizeAuthor
#6 CSRF-token.txt9.06 KBmingsong
#5 review.txt21.07 KBklausi

Comments

Mingsong created an issue. See original summary.

avpaderno’s picture

Title: [D8]Fullcalendar View » [D8] Fullcalendar View
Issue summary: View changes
Status: Needs review » Needs work

Thank you for your contribution! Reviewers will check the code and report here what they found out.

8.x-2.0 is a wrong branch name. The branch should be removed.

mingsong’s picture

Hi @kiamlaluno,

Thanks for your response.

I just deleted the 8.x-2.0 branch as required.

I also set the 8.x-2.x as the default branch.

mingsong’s picture

Status: Needs work » Needs review
klausi’s picture

Status: Needs review » Needs work
Issue tags: +PAreview: security
StatusFileSize
new21.07 KB

Review of the 8.x-2.x branch (commit 243fdaa):

  • Coder Sniffer has found some issues with your code (please check the Drupal coding standards). See attachment.
  • ESLint has found some issues with your code (please check the JavaScript coding standards). See attachment.
  • DrupalPractice has found some issues with your code, but could be false positives.
    
    FILE: ...p/modules/calendar_recurring_event/calendar_recurring_event.info.yml
    --------------------------------------------------------------------------
    FOUND 0 ERRORS AND 1 WARNING AFFECTING 1 LINE
    --------------------------------------------------------------------------
     8 | WARNING | All dependencies must be prefixed with the project name,
       |         | for example "drupal:"
    --------------------------------------------------------------------------
    
  • No automated test cases were found, did you consider writing PHPUnit tests? This is not a requirement but encouraged for professional software development.

This automated report was generated with PAReview.sh, your friendly project application review script.

js folder: why do you need all the JS libraries here when you load them remotely in fullcalendar_view.libraries.yml?
CalendarEventController: this is vulnerable to CSRF exploits. You are saving entities without a form and without checking a CSRF token. So I think in template_preprocess_views_view_fullcalendar() you have to add a CSRF token that you then need to verify in the controller. CsrfTokenGenerator service can create and validate that for you.
"$this->loggerFactory->get('content')->notice($entity->getType() . ': updated ' . $entity->getTitle());": do not concatenate variables into log messages, use placeholders instead.
"return new Response($entity->getTitle() . ' is updated to from ' . $start_date . ' to ' . $end_date);": all user facing text must run through the Drupal translation system, and you should use placeholders for the variables.

And please don't remove the security tag, we keep that for statistics and to show examples of security problems.

mingsong’s picture

StatusFileSize
new9.06 KB

Hi @klausi,

Thank you so much for reviewing the module for me.

I have fixed following issues with the latest commit :

  • Delete local FullCalendar.js
  • CalendarEventController: Fixed the CSRF vulnerability. See the attached file or the commit
  • Log message text issue
  • Translation for user facing text
  • Drupal coding standards issues by using PHP Code Sniffer

Regarding the JS coding standards, I use ESLint 5.13 with the .eslintrc.json file from core. So the result I saw is different from yours. But I think I have fixed all issues for the fullcalendar_view.js file.

Unfortunately, I haven't written the automated test yet. I might do that in the future.

It is ready for review again.

Appreciate all your work on reviewing this module for me.

Cheers,

mingsong’s picture

Status: Needs work » Needs review
klausi’s picture

Status: Needs review » Reviewed & tested by the community

Looks good now, thanks!

mingsong’s picture

Hi fellows,

Next step, is there anything I need to do to get this module covered by Drupal's security advisory policy?

Cheers,

avpaderno’s picture

Assigned: Unassigned » avpaderno
Status: Reviewed & tested by the community » Fixed

Thank you for your contribution! I am going to update your account.

These are some recommended readings to help with excellent maintainership:

You can find more contributors chatting on the IRC #drupal-contribute channel. So, come hang out and stay involved.
Thank you, also, for your patience with the review process.
Anyone is welcome to participate in the review process. Please consider reviewing other projects that are pending review. I encourage you to learn more about that process and join the group of reviewers.

I thank all the dedicated reviewers as well.

mingsong’s picture

You guys are champions!

Cheers,

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.