[D7] Staging Widget

1: Found XSS Issue : If I enter <script>alert('XSS');</script> in Widget Text , its getting executed. You need to sanitize data before printing. For more information about sanitizing, please read https://www.drupal.org/node/28984.

function staging_widget_page_build(&$page) {

  $markup = '
    <div id="testing" aria-label="Staging Site Indicator">
      <span>'.variable_get('staging_widget_text','STAGING SITE').'</span>
    </div>';

  $page['page_bottom']['staging_widget'] = array(
    '#attached' => array(),
    '#markup' => $markup,
  );

2: Please delete all variable used in module under hook_uninstall();
Example :

variable_set('staging_widget_text',$form_state['values']['staging_text']);
variable_set('staging_widget_top_position',$form_state['values']['staging_top_position']);
  

3: Please use t() for all user facing text.
Example :

drupal_set_message('Widget settings updated!');

There are some errors reported by automated review tools, did you already check them? See http://pareview.sh/pareview/httpsgitdrupalorgsandboxjfurnas2842452git

We are currently quite busy with all the project applications and we prefer projects with a review bonus. Please help reviewing and put yourself on the high priority list, then we will take a look at your project right away :-)

Also, you should get your friends, colleagues or other community members involved to review this application. Let them go through the review checklist and post a comment that sets this issue to "needs work" (they found some problems with the project) or "reviewed & tested by the community" (they found no major flaws).

I'm a robot and this is an automated message from Project Applications Scraper.

Please don't remove the security tag, we keep that for statistics and to show examples of security problems.

Hi jfurnas,

1. Fix the #2 that is found by @visabhishek this is still getting executed like https://www.screencast.com/t/Y2vMcHJOu
2. Update (div id="testing") with some meaningful #id see this https://www.screencast.com/t/DR0OKbfN

Regards
Satyam

manual review:

1. project page: what are the differences to existing projects such as https://www.drupal.org/project/environment_indicator ? Can you provide a screenshot how your widget looks like? See also https://www.drupal.org/node/997024
2. "package = CEN Modules": what are CEN modules? Why this package?
3. staging_widget_menu(): why the permission "administer users"? That does not seem to really fit? Did you mean "administer site configuration" instead?
4. staging_widget_page(): this function can be removed if you use drupal_get_form as page callback in hook_menu(). See node_menu() for examples.

Otherwise looks good to me.

Thanks for your contribution, Justin!

I updated your account so you can promote this to a full project and also create new projects as either a sandbox or a "full" project.

Here are some recommended readings to help with excellent maintainership:

• Dries' post on Responsible maintainers
• Best practices for creating and maintaining projects
• Maintaining a drupal.org project with Git
• Commit messages - providing history and credit
• Release naming conventions.
• Helping maintainers in the issue queues

You can find lots more contributors chatting on IRC in #drupal-contribute. So, come hang out and stay involved!

Thanks, also, for your patience with the review process. Anyone is welcome to participate in the review process. Please consider reviewing other projects that are pending review. I encourage you to learn more about that process and join the group of reviewers.

Thanks to the dedicated reviewer(s) as well.