Closed (fixed)
Project:
Drupal.org security advisory coverage applications
Component:
module
Priority:
Normal
Category:
Task
Assigned:
Issue tags:
Reporter:
Created:
13 Mar 2019 at 00:55 UTC
Updated:
4 Apr 2019 at 22:59 UTC
Jump to comment: Most recent, Most recent file
Comments
Comment #2
avpadernoThank you for your contribution! Reviewers will check the code and report here what they found out.
8.x-2.0 is a wrong branch name. The branch should be removed.
Comment #3
mingsongHi @kiamlaluno,
Thanks for your response.
I just deleted the 8.x-2.0 branch as required.
I also set the 8.x-2.x as the default branch.
Comment #4
mingsongComment #5
klausiReview of the 8.x-2.x branch (commit 243fdaa):
This automated report was generated with PAReview.sh, your friendly project application review script.
js folder: why do you need all the JS libraries here when you load them remotely in fullcalendar_view.libraries.yml?
CalendarEventController: this is vulnerable to CSRF exploits. You are saving entities without a form and without checking a CSRF token. So I think in template_preprocess_views_view_fullcalendar() you have to add a CSRF token that you then need to verify in the controller. CsrfTokenGenerator service can create and validate that for you.
"$this->loggerFactory->get('content')->notice($entity->getType() . ': updated ' . $entity->getTitle());": do not concatenate variables into log messages, use placeholders instead.
"return new Response($entity->getTitle() . ' is updated to from ' . $start_date . ' to ' . $end_date);": all user facing text must run through the Drupal translation system, and you should use placeholders for the variables.
And please don't remove the security tag, we keep that for statistics and to show examples of security problems.
Comment #6
mingsongHi @klausi,
Thank you so much for reviewing the module for me.
I have fixed following issues with the latest commit :
FullCalendar.jsRegarding the JS coding standards, I use ESLint 5.13 with the .eslintrc.json file from core. So the result I saw is different from yours. But I think I have fixed all issues for the fullcalendar_view.js file.
Unfortunately, I haven't written the automated test yet. I might do that in the future.
It is ready for review again.
Appreciate all your work on reviewing this module for me.
Cheers,
Comment #7
mingsongComment #8
klausiLooks good now, thanks!
Comment #9
mingsongHi fellows,
Next step, is there anything I need to do to get this module covered by Drupal's security advisory policy?
Cheers,
Comment #10
avpadernoThank you for your contribution! I am going to update your account.
These are some recommended readings to help with excellent maintainership:
You can find more contributors chatting on the IRC #drupal-contribute channel. So, come hang out and stay involved.
Thank you, also, for your patience with the review process.
Anyone is welcome to participate in the review process. Please consider reviewing other projects that are pending review. I encourage you to learn more about that process and join the group of reviewers.
I thank all the dedicated reviewers as well.
Comment #11
mingsongYou guys are champions!
Cheers,