[D7] Exam Spider

We are currently quite busy with all the project applications and we prefer projects with a review bonus. Please help reviewing and put yourself on the high priority list, then we will take a look at your project right away :-)

Also, you should get your friends, colleagues or other community members involved to review this application. Let them go through the review checklist and post a comment that sets this issue to "needs work" (they found some problems with the project) or "reviewed & tested by the community" (they found no major flaws).

I'm a robot and this is an automated message from Project Applications Scraper.

Hi,

I have reviewed module. Below are my mentioned points

1:- Implement hook_help
2:- Your comments should contain Implements hook_hookname. See line 722 exam.inc your comment Should be Implements hook_form_submit.
Below url is given of Drupal API documentation standards for functions
https://www.drupal.org/node/1354

@rajveergang : Looks like you forgot to change the status. Is this now RTBC after your review or are there application blockers left and this should be "needs work"?

Hi,

1.

drupal_add_css(drupal_get_path('module', 'exam_spider') . '/css/exam_spider.css');

May be better define constant EXAM_SLIDER_MODULE_NAME in module file and to use it everywhere.

2. Move $('.answer.form-checkbox') in variable.

Hi @sachintyagi99,

As a part of module review process on drupal.org you need to do some manual reviews of projects posted by community members at https://www.drupal.org/project/issues/projectapplications

Once you reviewed some projects, you need to add URLs of reviews in this post as part of review bonus system.

For more information please check How it works and Summary section at below URL -

https://www.drupal.org/node/1975228

Thanks

@sachintyagi99,

Also update module REAdME.md file with more details. You can review README Template format to update the file.

This will help users who will be using this module to understand and configured it easily.

Thanks

Closing due to lack of activity. If you are still working on this application, you should fix all known problems and then set the status to "Needs review". (See also the project application workflow).

I'm a robot and this is an automated message from Project Applications Scraper.

Hi @Sachin,

Please look into the below mentioned comments :

File: exams.inc

• In function exam_spider_dashboard() : Please sanitize the text while displaying, use check_plain/filter_xss function.
• In function exam_spider_exam_results() & exam_spider_dashboard() : Instead of using user_load($row->uid) function you can write a query to fetch username as user_load fetches all the user related data which seems not to be required by your function and that to user_load() has been written inside a foreach loop.

File: questions.inc

• In function exam_spider_get_questions() : Please sanitize the text while displaying, use check_plain/filter_xss function.
• use $form['#redirect'] instead of drupal_goto() as a best practice

Thanks,
Nisith

Under Exam settings,
Exam Duration & Re-attempt exam Time allows negative values. I did check the code. Despite respective validations, this happens. Am I the only one facing this issue? Even in the database negative values are stored.

Hi Sachintyagi,

After looking into the code, I think I have found out the reason why it doesn't validate against negative values.

File: exams.inc

function exam_spider_add_exam_validate($form, &$form_state) {
if (!is_numeric($form_state['values']['exam_duration'])) {
form_set_error('exam_duration', t('You must enter a positive integer value for @examSpiderExamTitle duration.', array('@examSpiderExamTitle' => EXAM_SPIDER_EXAM_TITLE)));
}

is_numeric will only validate whether it's a number or a number string. It will not validate against negative values. However You have used

Line no. 254,
'#element_validate' => array('element_validate_integer_positive'), for only one form field(total_marks)

Please use the same for Exam Duration & Re-attempt exam Time fields.

Below are my reviews :

1) use t() for Next in function exam_spider_exam_continue line 345 exam.inc

Hi sachintyagi99,

Sanitize user entered values before displaying in front-end. If enter javascript inside Examname field, it is getting executed while displaying on admin/structure/examspider/results page. To replicate the issue give this value
";} /*]]>*/--> </style><script>alert('hacked')</script>"
inside Examname field. It seems like XSS vulnerability and an application blocker. Use check_plain()/filter_xss() function to sanitize data before displaying. In admin pages you can use filter_xss_admin() to sanitize values.

+1 visabhishek

I am attaching the screenshot.

Everything is working fine. I have got a issue create the exam with filling all the fields, edit the exam and remove re-exam and submit. You will get DB error.

Suggestion:
Its better to have admin interface for mail body and subject.

Closing due to lack of activity. If you are still working on this application, you should fix all known problems and then set the status to "Needs review". (See also the project application workflow).

I'm a robot and this is an automated message from Project Applications Scraper.

Hi sachin ,

Please make configuration for EXAM_SPIDER_EXAM_URL,EXAM_SPIDER_EXAM_TITLE,EXAM_SPIDER_EXAM_SPIDER
define('EXAM_SPIDER_EXAM_URL', 'examspider');
define('EXAM_SPIDER_EXAM_TITLE', 'Exam');
define('EXAM_SPIDER_EXAM_SPIDER', 'exam_spider');

Closing due to lack of activity. If you are still working on this application, you should fix all known problems and then set the status to "Needs review". (See also the project application workflow).

I'm a robot and this is an automated message from Project Applications Scraper.

PAReview: security is kept for statistics purposes.

@sachintyagi99 We just need the reviewers to make their task.

Automated Review

Pareview details: https://pareview.sh/pareview/https-git.drupal.org-project-exam_spider.gi...

Review of the 8.x-3.x branch (commit 5c6af3c):

• Remove LICENSE.txt, it will be added by drupal.org packaging automatically.
• Coder Sniffer has found some issues with your code (please check the Drupal coding standards). See attachment.
• DrupalPractice has found some issues with your code, but could be false positives.
• No automated test cases were found, did you consider writing PHPUnit tests? This is not a requirement but encouraged for professional software development.

This automated report was generated with PAReview.sh, your friendly project application review script.

Manual Review 8.x-3.x

Individual user account

Yes: Follows the guidelines for individual user accounts.

No duplication

Yes: Does not cause module duplication and/or fragmentation.

Master Branch

Yes: Follows the guidelines for master branch.

Licensing

Yes: Follows the licensing requirements.

3rd party assets/code

Yes: Follows the guidelines for 3rd party assets/code.

README.txt/README.md

Yes: Follows the guidelines for in-project documentation and/or the README Template.

Code long/complex enough for review

Yes: Follows the guidelines for project length and complexity.

Secure code

[Yes: Meets the security requirements. / No: List of security issues identified.]

Coding style & Drupal API usage

1. (*) add package: Education in exam_spider.info.yml
2. (*) Do not use $_GET in ExamSpiderResultsForm.php, it is not secure
3. (*) pareview issues above
4. (*) 8.x-3.x does not install in simplytest.me

The starred items (*) are fairly big issues and warrant going back to Needs Work. Items marked with a plus sign (+) are important and should be addressed before a stable project release. The rest of the comments in the code walkthrough are recommendations.

If added, please don't remove the security tag, we keep that for statistics and to show examples of security problems.

This review uses the Project Application Review Template.

If you are still working on this application, you should fix all known problems and set the status to Needs review. (See also the project application workflow.)
Please don't change status of this application if you aren't sure you have time to dedicate to this application, or it will be closed again as won't fix.

I am closing this application due to lack of activity.