JED Checker and JDate

[JLinker]

Hi,
The JED checker extension throws a warning (compatibility issue) for the use of JFactory::getDate()->toSql();
However I can't seem to find a better way to do this.
Should I worry about this when submitting my listing? is there a replacement function in the Joomla 3 API?
Thanks a lot for your answers.

[pe7er]

Can't you use the following?

Code: Select all

JFactory::getDate()->format('%a %d %b %Y - %H:%M')

Source: https://docs.joomla.org/How_to_use_JDate

[JLinker]

ok, thanks a lot

[JLinker]

the JED Checker throws the following warning with your suggestion:

n/a in Joomla 3: JFactory::getDate()->format('%a %d %b %Y - %H:%M');

[deleted user]

I'd call it a bug in the JED Checker. That should not raise an error at all.

[JLinker]

ok thanks

[Tessa Mero]

Hi,
The JED checker extension throws a warning (compatibility issue) for the use of JFactory::getDate()->toSql();
However I can't seem to find a better way to do this.
Should I worry about this when submitting my listing? is there a replacement function in the Joomla 3 API?
Thanks a lot for your answers.

Hi JLinker,

The JEDChecker is created by a 3rd party extension developer company and we currently do not control that.

However, you are welcome to contribute to any bug fixes or make any suggestions here:
https://github.com/compojoom/jedchecker

In addition to that, we have a few JED team members who put together a google doc on how to improve the JEDChecker from top to bottom, so there will be a lot of changes, assuming we are having team members that will be contributing to it. :-)

Hope this helps :-)

[JLinker]

yes it does help, thank you very much

[Tessa Mero]

yes it does help, thank you very much

You are welcome.

[H13]

Hi,

The JEDChecker is created by a 3rd party extension developer company and we currently do not control that.

Some of my extensions were not accepted on JED because they included "errors" listed with help of JED checker.

I fixed it by small components. But now I am preparing large component and make it ready for latest Joomla! It includes over 2000 warnings in JED Checker.

For example:

JError::raiseError, JError::raiseWarning, etc. (btw: this is really funny because latest Joomla! is fully loaded with JError methods, so it is hard to understand that it will be removed - instead of making new features in Joomla! we only overwrite the code, like: JDate::toFormat() --> JDate::format() - not funny more :-( )

But of course, such types of warnings are OK to understand (if this is set in code - deprecated - it is deprecated) but I get the JFactory::getDate(); errors too. Or JError is deprecated in case of sring 'jerror' which is wrongly interpreted (example: JLog::add(JText::_('JTEXT_ERROR_MESSAGE'), JLog::WARNING, 'jerror');).

I use the latest version of JED checker - 1.6 - it was released on 26. October 2015 - it is almost one year old.

As these "errors" are marked as "Rule Framework - Joomla framework deprecated and unsafe" it will be hard to explain JED moderator, that everything is OK (the same like developers are not able to explain that false positive test made by e.g. Norton Antivirus means, there is no problem with the extension).

Are there any news regarding JED checker?

Thank you, Jan

[anibal_sanchez]

Hi Jan,

JEDChecker is our recommended tool to check your extension before submission.

However, extensions are not rejected by common practices like JError or JDate usage. Some rules have been enforced at a time when API deprecation seemed inminent. After some years and further definitions, this API is going to be with us for several more years ... until Joomla 4 release.

In practice, license errors, backlinks or usage of superglobals are more important issues.

Regards,
Anibal

[H13]

In practice, license errors, backlinks or usage of superglobals are more important issues.

Ok, thank you for the info,

Jan

[H13]

Code: Select all

defined('_JEXEC') or die;

==>
Rule Jamss - JAMSS - Joomla! Anti-Malware Scan Script
info code Pattern found#23 - shell command execution from POST/GET variables

Code: Select all

protected $fn = array();

==>
info code Pattern found#24 - PHP execution operator: backticks (``)

[H13]

Some info for developers about possible false warnings:

defined('_JEXEC') or die; --> info code Pattern found#23 - shell command execution from POST/GET variables

GIFs - for example loading gifs include `` --> info code Pattern found#24 - PHP execution operator: backticks (``)

$app->enqueueMessage(JText::_('JERROR_NO_ITEMS_SELECTED'), 'error'); --> JError is deprecated, you should use application->enqueueMessages() (JERROR string is interpreted as class/method/function)

Code: Select all

JERROR_ALERTNOAUTHOR="You are not authorised to view this resource."
JERROR_ALERTNOTEMPLATE="The template for this display is not available."
JERROR_AN_ERROR_HAS_OCCURRED="An error has occurred."
JERROR_CORE_CREATE_NOT_PERMITTED="Create not permitted."
JERROR_CORE_DELETE_NOT_PERMITTED="Delete not permitted."
JERROR_COULD_NOT_FIND_TEMPLATE="Could not find template "_QQ_"%s"_QQ_"."
JERROR_INVALID_CONTROLLER="Invalid controller"
JERROR_INVALID_CONTROLLER_CLASS="Invalid controller class"
JERROR_LOADFILE_FAILED="Error loading form file"
JERROR_LOADING_MENUS="Error loading Menus: %s"
JERROR_LOGIN_DENIED="You do not have access to the Administrator section of this site."
JERROR_MAGIC_QUOTES="Your host needs to disable magic_quotes_gpc to run this version of Joomla!"
JERROR_NO_ITEMS_SELECTED="No item(s) selected."
JERROR_NOLOGIN_BLOCKED="Login denied! Your account has either been blocked or you have not activated it yet."
JERROR_SENDING_EMAIL="Email could not be sent."
JERROR_SESSION_STARTUP="Error initialising the session."
JERROR_SAVE_FAILED="Could not save data. Error: %s"

$date = JFactory::getDate(); --> seems like false warning for now


JLog::addLogger( array('text_file' => 'com_extension_error_log.php'), JLog::ALL, array('com_extension'));
--> error_log and var_dump (error_log inside string wrongly interpreted)

Even PHP comments (for example: you comment obsolete code and add new one) are not ignored but they cause false warning.


Pattern found#17 - PHP: multiple encoded, most probably obfuscated code found - I get many warnings without finding the problematic code, seems like this #17 is really not 100%

Code: Select all

array('(?:(?:eval|gzuncompress|gzinflate|base64_decode|str_rot13|strrev|strtr|preg_replace|rawurldecode|' .
						'str_replace|assert|unpack|urldecode)[\s/\*\w\W\(]*){2,}',
						'PHP: multiple encoded, most probably obfuscated code found',
						'17',
						'This pattern could be used in highly encoded, malicious code hidden under a loop of code obfuscation function ' .
						'calls. In most cases the decoded hacker code goes through an eval call to execute it. ' .
						'This pattern is also often used for legitimate purposes, e.g. storing configuration information or ' .
						'serialised object data. ' .
						'Please inspect the file manually and compare it with the one in the original extension or ' .
						'Joomla package to verify that this is not a false positive.',
						'Thanks to Dario Pintarić (dario.pintaric[et}orion-web.hr for this report!'),

Not sure if I read the code correctly, but testing for example str_replace and marking it as dangerous is like marking all cars dangerous like guns are because using car can get the same result as using gun. :idea:

[anibal_sanchez]

Hi,

Your analysis is totally valid. JEDChecker has been created and it is mantained by Daniel Dimitrov / Compojoom.

You can give your feedback here: https://compojoom.com/forum/134-jedchecker

You can also submit issues or send PR in Github: https://github.com/compojoom/jedchecker

Feel free to submit improvements or request enhancements.

Best regards,

[H13]

Hi, thank you for the links.

Jan

[H13]

https://compojoom.com/forum/134-jedchec ... cker#34942

Anyway, I hope, it can be useful for JED moderators too, to know, there are some false warnings.

[THE_AI]

Note: I haven't done anything with JEDChecker for over a year now. I opened the github repository and saw that we have a lot of commits from Jaz Parkyn. Some of the mentioned errors such as JFactory::getDate seem to be already fixed. We'll have to just make a new release.

Other "errors" mentioned here are not meant to be interpreted as errors, but as guidelines to new joomla developers. With this commit https://github.com/compojoom/jedchecker ... cc1a7b6dba we've added the JAMSS script: https://github.com/btoplak/Joomla-Anti- ... pt--JAMSS-

As you can see the latest commit for it was 4 years ago, so by today's standard it might behave crazy.

JEDChecker is a community effort. The idea for it came around 2010-11, when getting an extension on JED was pain in the ***. At JAB, I was talking to Javier Gomez about the pains developers had and since I didn't have any access to the JED code I decided to create an extension that would help developers find common errors before submitting to the JED. After the first few commits, other people commited rules as well. Now 5 years later it is way easier to get an extension in the JED and JEDChecker should be viewed more as a tool to raise the quality of Joomla extensions and not just as a tool to get you in the JED.

As usual common sense is necessary to interpret the errors & the JED team I believe is having this common sense when validating extensions.

JEDChecker is a tool for developers - so if something doesn't behave as it should, make a pull request!

[H13]

Hi, thank you for the answer.