Checklist for the Drupal security advisory review
This aims to distribute the Framaforms module on Drupal.org to allow releases to be accessible via drush.
Based on the following tips :
- Description of the review process
- Security advisory coverage application checklist
- Tips for a smooth review (along with common isues, etc).
Changes to make to the code (prior to the application)
-
remove Bootstrap and all other 3rd-party libraries from the module, as per the 3rd party policy => !138 (merged) -
implement hook_help -
check for XSS vulns : add check_plain
or so to user-defined fields => !137 (merged) sanitizes admin-side inputs. User-side ones should be OK as defined fields are already sanitized. -
remove global variables on uninstall=> automatic in D7.
Steps
-
open a sandbox project on Drupal.org => see the project -
add extensive README.md -
add licensing to the module -
Follow tips for the project page -
ask for promotion to full-grown project.
Edited by theo lem