Comments (4)
Sorry, I would do a PR but that would take me quite longer.
I don't think it's enough.
It should clearly state that they should download the MR patch after review, and then have it applied with cweagans/composer-patches
with a local reference like: patches/core-1234567-33.patch
.
Ideally, this should be done with any patch, but it's really important with MRs.
For MRs: the .patch url thingy will include whatever is on the MR at the request time. If there were any new commits since you reviewed, you are getting those. That's dangerous, and that's what chx was referring to. First, maybe there are commits you didn't test. Second and most important, a malicious user could have committed something with a bad intent, and now you are giving them the keys to your castle voluntarily.
For drupal issue patches: even if not a security issue, your composer install (or deployment) now depends on drupal.org. If you are building your site and drupal.org has a temp outage, you can't complete it. That's undesired.
EDIT: also recently knew that when new d.org is released, issues will be moved to gitlab. Those file urls will stop working at some point, and if they do your project won't build. Be future proof, use local patches.
from d9book.
Yes, this need to be changed to say to download that locally and apply it after careful review.
from d9book.
Thanks folks. I added a big red danger note.
from d9book.
Thanks for the clarification. I updated the description to make those points. btw @penyaskito It is super easy to suggest edits. Just click the Edit this page on Github
at the bottom of the page.
from d9book.
Related Issues (20)
- Page counter is broken HOT 6
- Action Plugins HOT 11
- Derivatives Example Missing HOT 9
- Add Breadcrumb Example
- Add example for Hook Form alter in OOPS way HOT 1
- Add LocalTask Example
- Add Constraint Example
- Add Example for How to Use Entity Reference Views
- Add views examples HOT 3
- Standard white background and black text? HOT 11
- Add a LICENSE file? HOT 2
- Analytics not reporting anything HOT 5
- Typo at https://selwynpolit.github.io/d9book/twig#which-template-which-variables HOT 1
- Add accessibility section to https://selwynpolit.github.io/d9book/modules HOT 1
- We need a page on how to contribute HOT 6
- Build errors HOT 7
- Multilingual sites and APIs HOT 1
- Custom domain HOT 6
- Side Navigation Not Sorted Correctly
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from d9book.