mirror of
https://github.com/silverstripe/silverstripe-framework
synced 2024-10-22 14:05:37 +02:00
(merged from branches/roa. use "svn log -c <changeset> -g <module-svn-path>" for detailed commit message)
git-svn-id: svn://svn.silverstripe.com/silverstripe/open/modules/sapphire/trunk@60205 467b73ca-7a2a-4603-9d3b-597d59a354a9
This commit is contained in:
parent
9ac464cc57
commit
03fcc80e19
20
_config.php
20
_config.php
@ -17,6 +17,26 @@
|
||||
* @subpackage core
|
||||
*/
|
||||
|
||||
// Default director
|
||||
Director::addRules(10, array(
|
||||
'Security' => 'Security',
|
||||
//'Security/$Action/$ID' => 'Security',
|
||||
'db/$Action' => 'DatabaseAdmin',
|
||||
'$Controller' => array(
|
||||
),
|
||||
'images/$Action/$Class/$ID/$Field' => 'Image_Uploader',
|
||||
'' => 'RootURLController',
|
||||
'sitemap.xml' => 'GoogleSitemap',
|
||||
'api/v1' => 'RestfulServer',
|
||||
));
|
||||
|
||||
Director::addRules(1, array(
|
||||
'$URLSegment/$Action/$ID/$OtherID' => array(
|
||||
'_PopTokeniser' => 1,
|
||||
'Controller' => 'ModelAsController',
|
||||
),
|
||||
));
|
||||
|
||||
/**
|
||||
* PHP 5.2 has a namespace conflict with our datetime class,
|
||||
* for legacy support, we use this overload method.
|
||||
|
@ -28,7 +28,20 @@
|
||||
* @subpackage api
|
||||
*/
|
||||
class RestfulServer extends Controller {
|
||||
static $url_handlers = array(
|
||||
'$ClassName/#ID' => 'handleItem',
|
||||
'$ClassName' => 'handleList',
|
||||
);
|
||||
|
||||
protected static $api_base = "api/v1/";
|
||||
|
||||
function handleItem($params) {
|
||||
return new RestfulServer_Item(DataObject::get_by_id($params["ClassName"], $params["ID"]));
|
||||
}
|
||||
|
||||
function handleList($params) {
|
||||
return new RestfulServer_List(DataObject::get($params["ClassName"],""));
|
||||
}
|
||||
|
||||
/**
|
||||
* This handler acts as the switchboard for the controller.
|
||||
@ -318,4 +331,43 @@ class RestfulServer extends Controller {
|
||||
return "That object wasn't found";
|
||||
}
|
||||
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
/**
|
||||
* Restful server handler for a DataObjectSet
|
||||
*/
|
||||
class RestfulServer_List {
|
||||
static $url_handlers = array(
|
||||
'#ID' => 'handleItem',
|
||||
);
|
||||
|
||||
function __construct($list) {
|
||||
$this->list = $list;
|
||||
}
|
||||
|
||||
function handleItem($params) {
|
||||
return new RestulServer_Item($this->list->getById($params['ID']));
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Restful server handler for a single DataObject
|
||||
*/
|
||||
class RestfulServer_Item {
|
||||
static $url_handlers = array(
|
||||
'$Relation' => 'handleRelation',
|
||||
);
|
||||
|
||||
function __construct($item) {
|
||||
$this->item = $item;
|
||||
}
|
||||
|
||||
function handleRelation($params) {
|
||||
$funcName = $params['Relation'];
|
||||
$relation = $this->item->$funcName();
|
||||
|
||||
if($relation instanceof DataObjectSet) return new RestfulServer_List($relation);
|
||||
else return new RestfulServer_Item($relation)l
|
||||
}
|
||||
}
|
||||
|
@ -865,7 +865,6 @@ class ViewableData extends Object implements IteratorAggregate {
|
||||
return Convert::raw2att(implode(" ", $classes));
|
||||
}
|
||||
|
||||
|
||||
/**
|
||||
* Object-casting information for class methods
|
||||
* @var mixed
|
||||
|
@ -28,7 +28,6 @@ class ContentController extends Controller {
|
||||
public function __construct($dataRecord) {
|
||||
$this->dataRecord = $dataRecord;
|
||||
$this->failover = $this->dataRecord;
|
||||
|
||||
parent::__construct();
|
||||
}
|
||||
|
||||
|
@ -9,27 +9,12 @@
|
||||
* @package sapphire
|
||||
* @subpackage control
|
||||
*/
|
||||
class Controller extends ViewableData {
|
||||
|
||||
class Controller extends RequestHandlingData {
|
||||
/**
|
||||
* Define a list of actions that are allowed to be called on this controller.
|
||||
* The variable should be an array of action names. This sample shows the different values that it can contain:
|
||||
*
|
||||
* <code>
|
||||
* array(
|
||||
* 'someaction', // someaction can be accessed by anyone, any time
|
||||
* 'otheraction' => true, // So can otheraction
|
||||
* 'restrictedaction' => 'ADMIN', // restrictedaction can only be people with ADMIN privilege
|
||||
* 'complexaction' '->canComplexAction' // complexaction can only be accessed if $this->canComplexAction() returns true
|
||||
* );
|
||||
* </code>
|
||||
* An array of arguments extracted from the URL
|
||||
*/
|
||||
static $allowed_actions = null;
|
||||
|
||||
protected $urlParams;
|
||||
|
||||
protected $requestParams;
|
||||
|
||||
protected $action;
|
||||
|
||||
/**
|
||||
@ -50,6 +35,90 @@ class Controller extends ViewableData {
|
||||
*/
|
||||
protected $response;
|
||||
|
||||
/**
|
||||
* Default URL handlers - (Action)/(ID)/(OtherID)
|
||||
*/
|
||||
static $url_handlers = array(
|
||||
'$Action/$ID/$OtherID' => 'handleAction',
|
||||
);
|
||||
|
||||
static $allowed_actions = array(
|
||||
'handleAction',
|
||||
'handleIndex',
|
||||
);
|
||||
|
||||
/**
|
||||
* Handles HTTP requests.
|
||||
* @param $request The {@link HTTPRequest} object that is responsible for distributing request parsing.
|
||||
*/
|
||||
function handleRequest($request) {
|
||||
$this->pushCurrent();
|
||||
$this->urlParams = $request->allParams();
|
||||
$this->response = new HTTPResponse();
|
||||
|
||||
// Init
|
||||
$this->baseInitCalled = false;
|
||||
$this->init();
|
||||
if(!$this->baseInitCalled) user_error("init() method on class '$this->class' doesn't call Controller::init(). Make sure that you have parent::init() included.", E_USER_WARNING);
|
||||
|
||||
// If we had a redirection or something, halt processing.
|
||||
if($this->response->isFinished()) {
|
||||
$this->popCurrent();
|
||||
return $this->response;
|
||||
}
|
||||
|
||||
$body = parent::handleRequest($request);
|
||||
if($body instanceof HTTPResponse) {
|
||||
$this->response = $body;
|
||||
|
||||
} else {
|
||||
if(is_object($body)) $body = $body->getViewer($request->latestParam('Action'))->process($body);
|
||||
$this->response->setBody($body);
|
||||
}
|
||||
|
||||
|
||||
ContentNegotiator::process($this->response);
|
||||
HTTP::add_cache_headers($this->response);
|
||||
|
||||
$this->popCurrent();
|
||||
return $this->response;
|
||||
}
|
||||
|
||||
/**
|
||||
* Controller's default action handler. It will call the method named in $Action, if that method exists.
|
||||
* If $Action isn't given, it will use "index" as a default.
|
||||
*/
|
||||
function handleAction($request) {
|
||||
// urlParams, requestParams, and action are set for backward compatability
|
||||
$this->urlParams = array_merge($this->urlParams, $request->latestParams());
|
||||
$this->action = str_replace("-","_",$request->param('Action'));
|
||||
$this->requestParams = $request->requestVars();
|
||||
if(!$this->action) $this->action = 'index';
|
||||
$methodName = $this->action;
|
||||
|
||||
// run & init are manually disabled, because they create infinite loops and other dodgy situations
|
||||
if(!$this->checkAccessAction($this->action) || in_array(strtolower($this->action), array('run', 'init'))) {
|
||||
if($this->hasMethod($methodName)) {
|
||||
$result = $this->$methodName($request);
|
||||
|
||||
// Method returns an array, that is used to customise the object before rendering with a template
|
||||
if(is_array($result)) {
|
||||
return $this->getViewer($this->action)->process($this->customise($result));
|
||||
|
||||
// Method returns a string / object, in which case we just return that
|
||||
} else {
|
||||
return $result;
|
||||
}
|
||||
|
||||
// There is no method, in which case we just render this object using a (possibly alternate) template
|
||||
} else {
|
||||
return $this->getViewer($this->action)->process($this);
|
||||
}
|
||||
} else {
|
||||
return $this->httpError(403, "Action '$this->action' isn't allowed on class $this->class");
|
||||
}
|
||||
}
|
||||
|
||||
function setURLParams($urlParams) {
|
||||
$this->urlParams = $urlParams;
|
||||
}
|
||||
@ -99,185 +168,6 @@ class Controller extends ViewableData {
|
||||
* @param array $requestParams GET and POST variables.
|
||||
* @return HTTPResponse The response that this controller produces, including HTTP headers such as redirection info
|
||||
*/
|
||||
function run($requestParams) {
|
||||
if(isset($_GET['debug_profile'])) Profiler::mark("Controller", "run");
|
||||
$this->pushCurrent();
|
||||
|
||||
$this->response = new HTTPResponse();
|
||||
$this->requestParams = $requestParams;
|
||||
|
||||
$this->action = isset($this->urlParams['Action']) ? str_replace("-","_",$this->urlParams['Action']) : "";
|
||||
if(!$this->action) $this->action = 'index';
|
||||
|
||||
// Check security on the controller
|
||||
// run & init are manually disabled, because they create infinite loops and other dodgy situations
|
||||
if(!$this->checkAccessAction($this->action) || in_array(strtolower($this->action), array('run', 'init'))) {
|
||||
user_error("Disallowed action: '$this->action' on controller '$this->class'", E_USER_ERROR);
|
||||
}
|
||||
|
||||
// Init
|
||||
$this->baseInitCalled = false;
|
||||
$this->init();
|
||||
if(!$this->baseInitCalled) user_error("init() method on class '$this->class' doesn't call Controller::init(). Make sure that you have parent::init() included.", E_USER_WARNING);
|
||||
|
||||
// If we had a redirection or something, halt processing.
|
||||
if($this->response->isFinished()) {
|
||||
$this->popCurrent();
|
||||
return $this->response;
|
||||
}
|
||||
|
||||
// Look at the action variables for forms
|
||||
$funcName = null;
|
||||
foreach($this->requestParams as $paramName => $paramVal) {
|
||||
if(substr($paramName,0,7) == 'action_') {
|
||||
// Cleanup action_, _x and _y from image fields
|
||||
$funcName = preg_replace(array('/^action_/','/_x$|_y$/'),'',$paramName);
|
||||
break;
|
||||
}
|
||||
}
|
||||
|
||||
// Form handler
|
||||
if(isset($this->requestParams['executeForm']) && is_string($this->requestParams['executeForm'])) {
|
||||
if(isset($funcName)) {
|
||||
Form::set_current_action($funcName);
|
||||
}
|
||||
|
||||
$formOwner = $this->getFormOwner();
|
||||
|
||||
// Create the form object
|
||||
$form = $formOwner;
|
||||
|
||||
$formObjParts = explode('.', $this->requestParams['executeForm']);
|
||||
foreach($formObjParts as $formMethod){
|
||||
if(isset($_GET['debug_profile'])) Profiler::mark("Calling $formMethod", "on $form->class");
|
||||
$form = $form->$formMethod();
|
||||
if(isset($_GET['debug_profile'])) Profiler::unmark("Calling $formMethod", "on $form->class");
|
||||
if(!$form) break; //user_error("Form method '" . $this->requestParams['executeForm'] . "' returns null in controller class '$this->class' ($_SERVER[REQUEST_URI])", E_USER_ERROR);
|
||||
}
|
||||
|
||||
|
||||
// Populate the form
|
||||
if(isset($_GET['debug_profile'])) Profiler::mark("Controller", "populate form");
|
||||
if($form){
|
||||
$form->loadDataFrom($this->requestParams, true);
|
||||
// disregard validation if a single field is called
|
||||
|
||||
|
||||
if(!isset($_REQUEST['action_callfieldmethod'])) {
|
||||
$valid = $form->beforeProcessing();
|
||||
if(!$valid) {
|
||||
$this->popCurrent();
|
||||
return $this->response;
|
||||
}
|
||||
}else{
|
||||
$fieldcaller = $form->dataFieldByName($requestParams['fieldName']);
|
||||
if(is_a($fieldcaller, "TableListField")){
|
||||
if($fieldcaller->hasMethod('php')){
|
||||
$valid = $fieldcaller->php($requestParams);
|
||||
if(!$valid) exit();
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// If the action wasnt' set, choose the default on the form.
|
||||
if(!isset($funcName) && $defaultAction = $form->defaultAction()){
|
||||
$funcName = $defaultAction->actionName();
|
||||
}
|
||||
|
||||
if(isset($funcName)) {
|
||||
$form->setButtonClicked($funcName);
|
||||
}
|
||||
|
||||
}else{
|
||||
user_error("No form (" . Session::get('CMSMain.currentPage') . ") returned by $formOwner->class->$_REQUEST[executeForm]", E_USER_WARNING);
|
||||
}
|
||||
if(isset($_GET['debug_profile'])) Profiler::unmark("Controller", "populate form");
|
||||
|
||||
if(!isset($funcName)) {
|
||||
user_error("No action button has been clicked in this form executon, and no default has been allowed", E_USER_ERROR);
|
||||
}
|
||||
|
||||
// Protection against CSRF attacks
|
||||
if($form->securityTokenEnabled()) {
|
||||
$securityID = Session::get('SecurityID');
|
||||
|
||||
if(!$securityID || !isset($this->requestParams['SecurityID']) || $securityID != $this->requestParams['SecurityID']) {
|
||||
// Don't show error on live sites, as spammers create a million of these
|
||||
if(!Director::isLive()) {
|
||||
trigger_error("Security ID doesn't match, possible CRSF attack.", E_USER_ERROR);
|
||||
} else {
|
||||
die();
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
// First, try a handler method on the controller
|
||||
if($this->hasMethod($funcName) || !$form) {
|
||||
if(isset($_GET['debug_controller'])){
|
||||
Debug::show("Found function $funcName on the controller");
|
||||
}
|
||||
|
||||
if(isset($_GET['debug_profile'])) Profiler::mark("$this->class::$funcName (controller action)");
|
||||
$result = $this->$funcName($this->requestParams, $form);
|
||||
if(isset($_GET['debug_profile'])) Profiler::unmark("$this->class::$funcName (controller action)");
|
||||
|
||||
} else if(isset($formOwner) && $formOwner->hasMethod($funcName)) {
|
||||
$result = $formOwner->$funcName($this->requestParams, $form);
|
||||
|
||||
// Otherwise, try a handler method on the form object
|
||||
} else {
|
||||
if(isset($_GET['debug_controller'])) {
|
||||
Debug::show("Found function $funcName on the form object");
|
||||
}
|
||||
|
||||
if(isset($_GET['debug_profile'])) Profiler::mark("$form->class::$funcName (form action)");
|
||||
$result = $form->$funcName($this->requestParams, $form);
|
||||
if(isset($_GET['debug_profile'])) Profiler::unmark("$form->class::$funcName (form action)");
|
||||
}
|
||||
|
||||
// Normal action
|
||||
} else {
|
||||
if(!isset($funcName)) $funcName = $this->action;
|
||||
|
||||
if($this->hasMethod($funcName)) {
|
||||
if(isset($_GET['debug_controller'])) Debug::show("Found function $funcName on the $this->class controller");
|
||||
|
||||
if(isset($_GET['debug_profile'])) Profiler::mark("$this->class::$funcName (controller action)");
|
||||
|
||||
$result = $this->$funcName($this->urlParams);
|
||||
if(isset($_GET['debug_profile'])) Profiler::unmark("$this->class::$funcName (controller action)");
|
||||
|
||||
} else {
|
||||
if(isset($_GET['debug_controller'])) Debug::show("Running default action for $funcName on the $this->class controller" );
|
||||
if(isset($_GET['debug_profile'])) Profiler::mark("Controller::defaultAction($funcName)");
|
||||
$result = $this->defaultAction($funcName, $this->urlParams);
|
||||
if(isset($_GET['debug_profile'])) Profiler::unmark("Controller::defaultAction($funcName)");
|
||||
}
|
||||
}
|
||||
|
||||
// If your controller function returns an array, then add that data to the
|
||||
// default template
|
||||
|
||||
if(is_array($result)) {
|
||||
$extended = $this->customise($result);
|
||||
$viewer = $this->getViewer($funcName);
|
||||
|
||||
$result = $viewer->process($extended);
|
||||
}
|
||||
|
||||
$this->response->setBody($result);
|
||||
|
||||
if($result) ContentNegotiator::process($this->response);
|
||||
|
||||
// Set up HTTP cache headers
|
||||
HTTP::add_cache_headers($this->response);
|
||||
|
||||
if(isset($_GET['debug_profile'])) Profiler::unmark("Controller", "run");
|
||||
|
||||
$this->popCurrent();
|
||||
return $this->response;
|
||||
}
|
||||
|
||||
/**
|
||||
* Return the object that is going to own a form that's being processed, and handle its execution.
|
||||
@ -552,56 +442,6 @@ class Controller extends ViewableData {
|
||||
);
|
||||
}
|
||||
|
||||
/**
|
||||
* Check that the given action is allowed to be called on this controller.
|
||||
* This method is called by run() and makes use of {@link self::$allowed_actions}.
|
||||
*/
|
||||
function checkAccessAction($action) {
|
||||
$action = strtolower($action);
|
||||
|
||||
// Collate self::$allowed_actions from this class and all parent classes
|
||||
$access = null;
|
||||
$className = $this->class;
|
||||
while($className != 'Controller') {
|
||||
// Merge any non-null parts onto $access.
|
||||
$accessPart = eval("return $className::\$allowed_actions;");
|
||||
if($accessPart !== null) $access = array_merge((array)$access, $accessPart);
|
||||
|
||||
// Build an array of parts for checking if part[0] == part[1], which means that this class doesn't directly define it.
|
||||
$accessParts[] = $accessPart;
|
||||
|
||||
$className = get_parent_class($className);
|
||||
}
|
||||
|
||||
// Add $allowed_actions from extensions
|
||||
if($this->extension_instances) {
|
||||
foreach($this->extension_instances as $inst) {
|
||||
$accessPart = $inst->stat('allowed_actions');
|
||||
if($accessPart !== null) $access = array_merge((array)$access, $accessPart);
|
||||
}
|
||||
}
|
||||
|
||||
if($access === null || (isset($accessParts[1]) && $accessParts[0] === $accessParts[1])) {
|
||||
// user_error("Deprecated: please define static \$allowed_actions on your Controllers for security purposes", E_USER_NOTICE);
|
||||
return true;
|
||||
}
|
||||
|
||||
if($action == 'index') return true;
|
||||
|
||||
if(isset($access[$action])) {
|
||||
$test = $access[$action];
|
||||
if($test === true) return true;
|
||||
if(substr($test,0,2) == '->') {
|
||||
$funcName = substr($test,2);
|
||||
return $this->$funcName();
|
||||
}
|
||||
if(Permission::check($test)) return true;
|
||||
} else if((($key = array_search($action, $access)) !== false) && is_numeric($key)) {
|
||||
return true;
|
||||
}
|
||||
return false;
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
?>
|
||||
|
@ -71,41 +71,51 @@ class Director {
|
||||
/**
|
||||
* Process the given URL, creating the appropriate controller and executing it.
|
||||
*
|
||||
* This method will:
|
||||
* - iterate over all of the rules given in {@link Director::addRules()}, and find the first one that matches.
|
||||
* - instantiate the {@link Controller} object required by that rule, and call {@link Controller::setURLParams()} to give the URL paramters to the controller.
|
||||
* - link the Controller's session to PHP's main session, using {@link Controller::setSession()}.
|
||||
* - call {@link Controller::run()} on that controller
|
||||
* - save the Controller's session back into PHP's main session.
|
||||
* - output the response to the browser, using {@link HTTPResponse::output()}.
|
||||
* Request processing is handled as folows:
|
||||
* - Director::direct() creates a new HTTPResponse object and passes this to Director::handleRequest().
|
||||
* - Director::handleRequest($request) checks each of the Director rules and identifies a controller to handle this
|
||||
* request.
|
||||
* - Controller::handleRequest($request) is then called. This will find a rule to handle the URL, and call the rule
|
||||
* handling method.
|
||||
* - RequestHandlingData::handleRequest($request) is recursively called whenever a rule handling method returns a
|
||||
* RequestHandlingData object.
|
||||
*
|
||||
* In addition to request processing, Director will manage the session, and perform the output of the actual response
|
||||
* to the browser.
|
||||
*
|
||||
* @param $url String, the URL the user is visiting, without the querystring.
|
||||
* @uses getControllerForURL() rule-lookup logic is handled by this.
|
||||
* @uses handleRequest() rule-lookup logic is handled by this.
|
||||
* @uses Controller::run() Controller::run() handles the page logic for a Director::direct() call.
|
||||
*/
|
||||
function direct($url) {
|
||||
if(isset($_GET['debug_profile'])) Profiler::mark("Director","direct");
|
||||
$controllerObj = Director::getControllerForURL($url);
|
||||
|
||||
if(is_string($controllerObj) && substr($controllerObj,0,9) == 'redirect:') {
|
||||
$response = new HTTPResponse();
|
||||
$response->redirect(substr($controllerObj, 9));
|
||||
$response->output();
|
||||
} else if($controllerObj) {
|
||||
// Load the session into the controller
|
||||
$controllerObj->setSession(new Session($_SESSION));
|
||||
|
||||
$response = $controllerObj->run(array_merge((array)$_GET, (array)$_POST, (array)$_FILES));
|
||||
|
||||
|
||||
$controllerObj->getSession()->inst_save();
|
||||
$req = new HTTPRequest($_SERVER['REQUEST_METHOD'], $url, $_GET, array_merge((array)$_POST, (array)$_FILES));
|
||||
|
||||
if(isset($_GET['debug_profile'])) Profiler::mark("Outputting to browser");
|
||||
// Load the session into the controller
|
||||
$session = new Session($_SESSION);
|
||||
$result = Director::handleRequest($req, $session);
|
||||
$session->inst_save();
|
||||
|
||||
// Return code for a redirection request
|
||||
if(is_string($result) && substr($result,0,9) == 'redirect:') {
|
||||
$response = new HTTPResponse();
|
||||
$response->redirect(substr($result, 9));
|
||||
$response->output();
|
||||
if(isset($_GET['debug_profile'])) Profiler::unmark("Outputting to browser");
|
||||
|
||||
// Handle a controller
|
||||
} else if($result) {
|
||||
if($result instanceof HTTPResponse) {
|
||||
$response = $result;
|
||||
|
||||
} else {
|
||||
$response = new HTTPResponse();
|
||||
$response->setBody($result);
|
||||
}
|
||||
|
||||
$response->output();
|
||||
|
||||
//$controllerObj->getSession()->inst_save();
|
||||
|
||||
}
|
||||
if(isset($_GET['debug_profile'])) Profiler::unmark("Director","direct");
|
||||
}
|
||||
|
||||
/**
|
||||
@ -114,117 +124,79 @@ class Director {
|
||||
* This method is the counterpart of Director::direct() that is used in functional testing. It will execute the URL given,
|
||||
*
|
||||
* @param $url The URL to visit
|
||||
* @param $post The $_POST & $_FILES variables
|
||||
* @param $postVars The $_POST & $_FILES variables
|
||||
* @param $session The {@link Session} object representing the current session. By passing the same object to multiple
|
||||
* calls of Director::test(), you can simulate a peristed session.
|
||||
* @param $httpMethod The HTTP method, such as GET or POST. It will default to POST if postVars is set, GET otherwise
|
||||
*
|
||||
* @uses getControllerForURL() The rule-lookup logic is handled by this.
|
||||
* @uses Controller::run() Controller::run() handles the page logic for a Director::direct() call.
|
||||
*/
|
||||
function test($url, $post = null, $session = null) {
|
||||
function test($url, $postVars = null, $session = null, $httpMethod = null) {
|
||||
if(!$httpMethod) $httpMethod = $postVars ? "POST" : "GET";
|
||||
|
||||
$getVars = array();
|
||||
if(strpos($url,'?') !== false) {
|
||||
list($url, $getVarsEncoded) = explode('?', $url, 2);
|
||||
parse_str($getVarsEncoded, $getVars);
|
||||
}
|
||||
|
||||
$existingRequestVars = $_REQUEST;
|
||||
$existingGetVars = $_GET;
|
||||
$existingPostVars = $_POST;
|
||||
$existingSessionVars = $_SESSION;
|
||||
|
||||
$_REQUEST = $existingRequestVars;
|
||||
$_GET = $existingGetVars;
|
||||
$_POST = $existingPostVars;
|
||||
$_SESSION = $existingSessionVars;
|
||||
|
||||
$_REQUEST = array_merge((array)$getVars, (array)$post);
|
||||
$_GET = (array)$getVars;
|
||||
$_POST = (array)$post;
|
||||
$_SESSION = $session ? $session->inst_getAll() : array();
|
||||
if(!$session) $session = new Session(null);
|
||||
|
||||
$controllerObj = Director::getControllerForURL($url);
|
||||
$req = new HTTPRequest($httpMethod, $url, $getVars, $postVars);
|
||||
$result = Director::handleRequest($req, $session);
|
||||
|
||||
// Load the session into the controller
|
||||
$controllerObj->setSession($session ? $session : new Session(null));
|
||||
|
||||
if(is_string($controllerObj) && substr($controllerObj,0,9) == 'redirect:') {
|
||||
user_error("Redirection not implemented in Director::test", E_USER_ERROR);
|
||||
|
||||
} else if($controllerObj) {
|
||||
$response = $controllerObj->run( array_merge($getVars, (array)$post) );
|
||||
$_REQUEST = $existingRequestVars;
|
||||
$_GET = $existingGetVars;
|
||||
$_POST = $existingPostVars;
|
||||
$_SESSION = $existingSessionVars;
|
||||
return $response;
|
||||
}
|
||||
return $result;
|
||||
}
|
||||
|
||||
|
||||
/**
|
||||
* Returns the controller that should be used to handle the given URL.
|
||||
* @todo More information about director rules.
|
||||
* Handle an HTTP request, defined with a HTTPRequest object.
|
||||
*/
|
||||
static function getControllerForURL($url) {
|
||||
if(isset($_GET['debug_profile'])) Profiler::mark("Director","getControllerForURL");
|
||||
$url = preg_replace( array( '/\/+/','/^\//', '/\/$/'),array('/','',''),$url);
|
||||
$urlParts = split('/+', $url);
|
||||
|
||||
protected static function handleRequest(HTTPRequest $request, Session $session) {
|
||||
krsort(Director::$rules);
|
||||
|
||||
if(isset($_REQUEST['debug'])) Debug::show(Director::$rules);
|
||||
|
||||
foreach(Director::$rules as $priority => $rules) {
|
||||
foreach($rules as $pattern => $controller) {
|
||||
$patternParts = explode('/', $pattern);
|
||||
$matched = true;
|
||||
$arguments = array();
|
||||
foreach($patternParts as $i => $part) {
|
||||
$part = trim($part);
|
||||
if(isset($part[0]) && $part[0] == '$') {
|
||||
$arguments[substr($part,1)] = isset($urlParts[$i]) ? $urlParts[$i] : null;
|
||||
if($part == '$Controller' && !class_exists($arguments['Controller'])) {
|
||||
$matched = false;
|
||||
break;
|
||||
}
|
||||
|
||||
} else if(!isset($urlParts[$i]) || $urlParts[$i] != $part) {
|
||||
$matched = false;
|
||||
break;
|
||||
}
|
||||
foreach($rules as $pattern => $controllerOptions) {
|
||||
if(is_string($controllerOptions)) {
|
||||
if(substr($controllerOptions,0,2) == '->') $controllerOptions = array('Redirect' => substr($controllerOptions,2));
|
||||
else $controllerOptions = array('Controller' => $controllerOptions);
|
||||
}
|
||||
if($matched) {
|
||||
|
||||
if(substr($controller,0,2) == '->') {
|
||||
if(isset($_REQUEST['debug']) && $_REQUEST['debug'] == 1) Debug::message("Redirecting to $controller");
|
||||
|
||||
if(isset($_GET['debug_profile'])) Profiler::unmark("Director","getControllerForURL");
|
||||
|
||||
return "redirect:" . Director::absoluteURL(substr($controller,2), true);
|
||||
|
||||
if(($arguments = $request->match($pattern, true)) !== false) {
|
||||
// controllerOptions provide some default arguments
|
||||
$arguments = array_merge($controllerOptions, $arguments);
|
||||
|
||||
// Find the controller name
|
||||
if(isset($arguments['Controller'])) $controller = $arguments['Controller'];
|
||||
|
||||
// Pop additional tokens from the tokeniser if necessary
|
||||
if(isset($controllerOptions['_PopTokeniser'])) {
|
||||
$request->shift($controllerOptions['_PopTokeniser']);
|
||||
}
|
||||
|
||||
// Handle redirections
|
||||
if(isset($arguments['Redirect'])) {
|
||||
return "redirect:" . Director::absoluteURL($arguments['Redirect'], true);
|
||||
|
||||
} else {
|
||||
if(isset($arguments['Controller']) && $controller == "*") {
|
||||
$controller = $arguments['Controller'];
|
||||
}
|
||||
|
||||
if(isset($_REQUEST['debug'])) Debug::message("Using controller $controller");
|
||||
/*
|
||||
if(isset($arguments['Action'])) {
|
||||
$arguments['Action'] = str_replace('-','',$arguments['Action']);
|
||||
}
|
||||
|
||||
if(isset($arguments['Action']) && ClassInfo::exists($controller.'_'.$arguments['Action']))
|
||||
$controller = $controller.'_'.$arguments['Action'];
|
||||
|
||||
Director::$urlParams = $arguments;
|
||||
$controllerObj = new $controller();
|
||||
|
||||
$controllerObj->setURLParams($arguments);
|
||||
*/
|
||||
|
||||
if(isset($arguments['URLSegment'])) self::$urlSegment = $arguments['URLSegment'] . "/";
|
||||
|
||||
if(isset($_GET['debug_profile'])) Profiler::unmark("Director","getControllerForURL");
|
||||
|
||||
return $controllerObj;
|
||||
Director::$urlParams = $arguments;
|
||||
|
||||
$controllerObj = new $controller();
|
||||
$controllerObj->setSession($session);
|
||||
|
||||
return $controllerObj->handleRequest($request);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
225
core/control/HTTPRequest.php
Normal file
225
core/control/HTTPRequest.php
Normal file
@ -0,0 +1,225 @@
|
||||
<?php
|
||||
|
||||
/**
|
||||
* Represents a HTTP-request, including a URL that is tokenised for parsing, and a request method (GET/POST/PUT/DELETE).
|
||||
* This is used by {@link RequestHandlingData} objects to decide what to do.
|
||||
*
|
||||
* The intention is that a single HTTPRequest object can be passed from one object to another, each object calling
|
||||
* match() to get the information that they need out of the URL. This is generally handled by
|
||||
* {@link RequestHandlingData::handleRequest()}.
|
||||
*/
|
||||
class HTTPRequest extends Object {
|
||||
/**
|
||||
* The non-extension parts of the URL, separated by "/"
|
||||
*/
|
||||
protected $dirParts;
|
||||
|
||||
/**
|
||||
* The URL extension
|
||||
*/
|
||||
protected $extension;
|
||||
|
||||
/**
|
||||
* The HTTP method
|
||||
*/
|
||||
protected $httpMethod;
|
||||
|
||||
protected $getVars = array();
|
||||
protected $postVars = array();
|
||||
|
||||
protected $allParams = array();
|
||||
protected $latestParams = array();
|
||||
|
||||
protected $unshiftedButParsedParts = 0;
|
||||
|
||||
function getVars() {
|
||||
return $this->getVars;
|
||||
}
|
||||
function postVars() {
|
||||
return $this->postVars;
|
||||
}
|
||||
function requestVars() {
|
||||
return array_merge($this->getVars, $this->postVars);
|
||||
}
|
||||
|
||||
function getVar($name) {
|
||||
if(isset($this->getVars[$name])) return $this->getVars[$name];
|
||||
}
|
||||
function postVar($name) {
|
||||
if(isset($this->postVars[$name])) return $this->postVars[$name];
|
||||
}
|
||||
function requestVar($name) {
|
||||
if(isset($this->postVars[$name])) return $this->postVars[$name];
|
||||
if(isset($this->getVars[$name])) return $this->getVars[$name];
|
||||
}
|
||||
|
||||
/**
|
||||
* Construct a HTTPRequest from a URL relative to the site root.
|
||||
*/
|
||||
function __construct($httpMethod, $url, $getVars = array(), $postVars = array()) {
|
||||
$this->httpMethod = $httpMethod;
|
||||
|
||||
$url = preg_replace(array('/\/+/','/^\//', '/\/$/'),array('/','',''), $url);
|
||||
|
||||
if(preg_match('/^(.*)\.([A-Za-z][A-Za-z0-9]*)$/', $url, $matches)) {
|
||||
$url = $matches[1];
|
||||
$this->extension = $matches[2];
|
||||
}
|
||||
if($url) $this->dirParts = split('/+', $url);
|
||||
else $this->dirParts = array();
|
||||
|
||||
$this->getVars = (array)$getVars;
|
||||
$this->postVars = (array)$postVars;
|
||||
|
||||
parent::__construct();
|
||||
}
|
||||
|
||||
/**
|
||||
* Matches a URL pattern
|
||||
* The pattern can contain a number of segments, separted by / (and an extension indicated by a .)
|
||||
*
|
||||
* The parts can be either literals, or, if they start with a $ they are interpreted as variables.
|
||||
* - Literals must be provided in order to match
|
||||
* - $Variables are optional
|
||||
* - However, if you put ! at the end of a variable, then it becomes mandatory.
|
||||
*
|
||||
* For example:
|
||||
* - admin/crm/list will match admin/crm/$Action/$ID/$OtherID, but it won't match admin/crm/$Action!/$ClassName!
|
||||
*
|
||||
* The pattern can optionally start with an HTTP method and a space. For example, "POST $Controller/$Action".
|
||||
* This is used to define a rule that only matches on a specific HTTP method.
|
||||
*/
|
||||
function match($pattern, $shiftOnSuccess = false) {
|
||||
// Check if a specific method is required
|
||||
if(preg_match('/^([A-Za-z]+) +(.*)$/', $pattern, $matches)) {
|
||||
$requiredMethod = $matches[1];
|
||||
if($requiredMethod != $this->httpMethod) return false;
|
||||
|
||||
// If we get this far, we can match the URL pattern as usual.
|
||||
$pattern = $matches[2];
|
||||
}
|
||||
|
||||
// Special case for the root URL controller
|
||||
if(!$pattern) {
|
||||
return ($this->dirParts == array()) ? array('Matched' => true) : false;
|
||||
}
|
||||
|
||||
// Check for the '//' marker that represents the "shifting point"
|
||||
$doubleSlashPoint = strpos($pattern, '//');
|
||||
if($doubleSlashPoint !== false) {
|
||||
$shiftCount = substr_count($pattern, '/', 0, $doubleSlashPoint) + 1;
|
||||
$pattern = str_replace('//', '/', $pattern);
|
||||
$patternParts = explode('/', $pattern);
|
||||
|
||||
} else {
|
||||
$patternParts = explode('/', $pattern);
|
||||
$shiftCount = sizeof($patternParts);
|
||||
}
|
||||
|
||||
$matched = true;
|
||||
$arguments = array();
|
||||
|
||||
foreach($patternParts as $i => $part) {
|
||||
$part = trim($part);
|
||||
|
||||
// Match a variable
|
||||
if(isset($part[0]) && $part[0] == '$') {
|
||||
// A variable ending in ! is required
|
||||
if(substr($part,-1) == '!') {
|
||||
$varRequired = true;
|
||||
$varName = substr($part,1,-1);
|
||||
} else {
|
||||
$varRequired = false;
|
||||
$varName = substr($part,1);
|
||||
}
|
||||
|
||||
// Fail if a required variable isn't populated
|
||||
if($varRequired && !isset($this->dirParts[$i])) return false;
|
||||
|
||||
$arguments[$varName] = isset($this->dirParts[$i]) ? $this->dirParts[$i] : null;
|
||||
if($part == '$Controller' && !class_exists($arguments['Controller'])) {
|
||||
return false;
|
||||
}
|
||||
|
||||
// Literal parts must always be there
|
||||
} else if(!isset($this->dirParts[$i]) || $this->dirParts[$i] != $part) {
|
||||
return false;
|
||||
}
|
||||
}
|
||||
|
||||
if($shiftOnSuccess) {
|
||||
$this->shift($shiftCount);
|
||||
// We keep track of pattern parts that we looked at but didn't shift off.
|
||||
// This lets us say that we have *parsed* the whole URL even when we haven't *shifted* it all
|
||||
$this->unshiftedButParsedParts = sizeof($patternParts) - $shiftCount;
|
||||
}
|
||||
|
||||
$this->latestParams = $arguments;
|
||||
|
||||
// Load the arguments that actually have a value into $this->allParams
|
||||
// This ensures that previous values aren't overridden with blanks
|
||||
foreach($arguments as $k => $v) {
|
||||
if($v) $this->allParams[$k] = $v;
|
||||
}
|
||||
|
||||
return $arguments;
|
||||
}
|
||||
|
||||
function allParams() {
|
||||
return $this->allParams;
|
||||
}
|
||||
function latestParams() {
|
||||
return $this->latestParams;
|
||||
}
|
||||
function latestParam($name) {
|
||||
if(isset($this->latestParams[$name]))
|
||||
return $this->latestParams[$name];
|
||||
else
|
||||
return null;
|
||||
}
|
||||
function param($name) {
|
||||
if(isset($this->allParams[$name]))
|
||||
return $this->allParams[$name];
|
||||
else
|
||||
return null;
|
||||
}
|
||||
|
||||
function remaining() {
|
||||
return implode("/", $this->dirParts);
|
||||
}
|
||||
|
||||
/**
|
||||
* Returns true if the give pattern is an empty pattern - that is, one that only matches completely parsed
|
||||
* URLs. It will also return true if this is a completely parsed URL and the pattern contains only variable
|
||||
* references.
|
||||
*/
|
||||
function isEmptyPattern($pattern) {
|
||||
if(preg_match('/^([A-Za-z]+) +(.*)$/', $pattern, $matches)) {
|
||||
$pattern = $matches[2];
|
||||
}
|
||||
|
||||
if(trim($pattern) == "") return true;
|
||||
|
||||
if(!$this->dirParts) {
|
||||
return preg_replace('/\$[A-Za-z][A-Za-z0-9]*(\/|$)/','',$pattern) == "";
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Shift one or more parts off the beginning of the URL.
|
||||
* If you specify shifting more than 1 item off, then the items will be returned as an array
|
||||
*/
|
||||
function shift($count = 1) {
|
||||
if($count == 1) return array_shift($this->dirParts);
|
||||
else for($i=0;$i<$count;$i++) $return[] = array_shift($this->dirParts);
|
||||
}
|
||||
|
||||
/**
|
||||
* Returns true if the URL has been completely parsed.
|
||||
* This will respect parsed but unshifted directory parts.
|
||||
*/
|
||||
function allParsed() {
|
||||
return sizeof($this->dirParts) <= $this->unshiftedButParsedParts;
|
||||
|
||||
}
|
||||
}
|
@ -8,13 +8,14 @@
|
||||
*/
|
||||
class ModelAsController extends Controller implements NestedController {
|
||||
|
||||
public function run($requestParams) {
|
||||
public function handleRequest($request) {
|
||||
$this->pushCurrent();
|
||||
$this->urlParams = $request->allParams();
|
||||
|
||||
$this->init();
|
||||
$nested = $this->getNestedController();
|
||||
if(is_object($nested)) {
|
||||
$result = $nested->run($requestParams);
|
||||
$result = $nested->handleRequest($requestParams);
|
||||
} else {
|
||||
$result = $nested;
|
||||
}
|
||||
@ -55,7 +56,6 @@ class ModelAsController extends Controller implements NestedController {
|
||||
} else {
|
||||
$controller = $child;
|
||||
}
|
||||
$controller->setURLParams($this->urlParams);
|
||||
|
||||
return $controller;
|
||||
} else {
|
||||
|
169
core/control/RequestHandlingData.php
Normal file
169
core/control/RequestHandlingData.php
Normal file
@ -0,0 +1,169 @@
|
||||
<?php
|
||||
|
||||
/**
|
||||
* This class is the base class of any Sapphire object that can be used to handle HTTP requests.
|
||||
*
|
||||
* Any RequestHandlingData object can be made responsible for handling its own segment of the URL namespace.
|
||||
* The {@link Director} begins the URL parsing process; it will parse the beginning of the URL to identify which
|
||||
* controller is being used. It will then call handleRequest on that Controller, passing it the parameters that it
|
||||
* parsed from the URL, and the HTTPRequest that contains the remainder of the URL to be parsed.
|
||||
*
|
||||
* In Sapphire, URL parsing is distributed throughout the object graph. For example, suppose that we have a search form
|
||||
* that contains a {@link TreeMultiSelectField}, Groups. We want to use ajax to load segments of this tree as they are needed
|
||||
* rather than downloading the tree right at the beginning. We could use this URL to get the tree segment that appears underneath
|
||||
* Group #36:
|
||||
*
|
||||
* admin/crm/SearchForm/fields/Groups/treesegment/36
|
||||
*
|
||||
* - Director will determine that admin/crm is controlled by a new ModelAdmin object, and pass control to that.
|
||||
* - ModelAdmin will determine that SearchForm is controlled by a Form object returned by $this->SearchForm(), and pass control to that.
|
||||
* - Form will determine that fields/Groups is controlled by the Groups field, a TreeMultiselectField, and pass control to that.
|
||||
* - TreeMultiselectField will determine that treesegment/36 is handled by its treesegment() method. This method will return an HTML fragment that is output to the screen.
|
||||
*
|
||||
* {@link RequestHandlingData::handleRequest()} is where this behaviour is implemented.
|
||||
*/
|
||||
class RequestHandlingData extends ViewableData {
|
||||
/**
|
||||
* The default URL handling rules. This specifies that the next component of the URL corresponds to a method to
|
||||
* be called on this RequestHandlingData object.
|
||||
*
|
||||
* The keys of this array are parse rules. See {@link HTTPRequest::match()} for a description of the rules available.
|
||||
*
|
||||
* The values of the array are the method to be called if the rule matches. If this value starts with a '$', then the
|
||||
* named parameter of the parsed URL wil be used to determine the method name.
|
||||
*/
|
||||
static $url_handlers = array(
|
||||
'$Action' => '$Action',
|
||||
);
|
||||
|
||||
|
||||
/**
|
||||
* Define a list of action handling methods that are allowed to be called directly by URLs.
|
||||
* The variable should be an array of action names. This sample shows the different values that it can contain:
|
||||
*
|
||||
* <code>
|
||||
* array(
|
||||
* 'someaction', // someaction can be accessed by anyone, any time
|
||||
* 'otheraction' => true, // So can otheraction
|
||||
* 'restrictedaction' => 'ADMIN', // restrictedaction can only be people with ADMIN privilege
|
||||
* 'complexaction' '->canComplexAction' // complexaction can only be accessed if $this->canComplexAction() returns true
|
||||
* );
|
||||
* </code>
|
||||
*/
|
||||
static $allowed_actions = null;
|
||||
/**
|
||||
* Handles URL requests.
|
||||
*
|
||||
* - ViewableData::handleRequest() iterates through each rule in {@link self::$url_handlers}.
|
||||
* - If the rule matches, the named method will be called.
|
||||
* - If there is still more URL to be processed, then handleRequest() is called on the object that that method returns.
|
||||
*
|
||||
* Once all of the URL has been processed, the final result is returned. However, if the final result is an array, this
|
||||
* array is interpreted as being additional template data to customise the 2nd to last result with, rather than an object
|
||||
* in its own right. This is most frequently used when a Controller's action will return an array of data with which to
|
||||
* customise the controller.
|
||||
*
|
||||
* @param $params The parameters taken from the parsed URL of the parent url handler
|
||||
* @param $request The {@link HTTPRequest} object that is reponsible for distributing URL parsing
|
||||
* @uses HTTPRequest
|
||||
*/
|
||||
function handleRequest($request) {
|
||||
foreach($this->stat('url_handlers') as $rule => $action) {
|
||||
if($params = $request->match($rule, true)) {
|
||||
|
||||
// Actions can reference URL parameters, eg, '$Action/$ID/$OtherID' => '$Action',
|
||||
if($action[0] == '$') $action = $params[substr($action,1)];
|
||||
|
||||
if($this->checkAccessAction($action)) {
|
||||
$result = $this->$action($request);
|
||||
} else {
|
||||
return $this->httpError(403, "Action '$action' isn't allowed on class $this->class");
|
||||
}
|
||||
|
||||
// If we return a RequestHandlingData, call handleRequest() on that, even if there is no more URL to parse.
|
||||
// It might have its own handler. However, we only do this if we haven't just parsed an empty rule ourselves,
|
||||
// to prevent infinite loops
|
||||
if(!$request->isEmptyPattern($rule) && is_object($result) && $result instanceof RequestHandlingData) {
|
||||
$returnValue = $result->handleRequest($request);
|
||||
|
||||
// Array results can be used to handle
|
||||
if(is_array($returnValue)) $returnValue = $this->customise($returnValue);
|
||||
|
||||
return $returnValue;
|
||||
|
||||
// If we return some other data, and all the URL is parsed, then return that
|
||||
} else if($request->allParsed()) {
|
||||
return $result;
|
||||
|
||||
// But if we have more content on the URL and we don't know what to do with it, return an error.
|
||||
} else {
|
||||
return $this->httpError(400, "I can't handle sub-URLs of a $this->class object.");
|
||||
}
|
||||
|
||||
break;
|
||||
}
|
||||
}
|
||||
|
||||
// If nothing matches, return this object
|
||||
return $this;
|
||||
}
|
||||
|
||||
/**
|
||||
* Check that the given action is allowed to be called from a URL.
|
||||
* It will interrogate {@link self::$allowed_actions} to determine this.
|
||||
*/
|
||||
function checkAccessAction($action) {
|
||||
// Collate self::$allowed_actions from this class and all parent classes
|
||||
$access = null;
|
||||
$className = $this->class;
|
||||
while($className != 'RequestHandlingData') {
|
||||
// Merge any non-null parts onto $access.
|
||||
$accessPart = eval("return $className::\$allowed_actions;");
|
||||
if($accessPart !== null) $access = array_merge((array)$access, $accessPart);
|
||||
|
||||
// Build an array of parts for checking if part[0] == part[1], which means that this class doesn't directly define it.
|
||||
$accessParts[] = $accessPart;
|
||||
|
||||
$className = get_parent_class($className);
|
||||
}
|
||||
|
||||
// Add $allowed_actions from extensions
|
||||
if($this->extension_instances) {
|
||||
foreach($this->extension_instances as $inst) {
|
||||
$accessPart = $inst->stat('allowed_actions');
|
||||
if($accessPart !== null) $access = array_merge((array)$access, $accessPart);
|
||||
}
|
||||
}
|
||||
|
||||
if($access === null || (isset($accessParts[1]) && $accessParts[0] === $accessParts[1])) {
|
||||
// user_error("Deprecated: please define static \$allowed_actions on your Controllers for security purposes", E_USER_NOTICE);
|
||||
return true;
|
||||
}
|
||||
|
||||
if($action == 'index') return true;
|
||||
|
||||
if(isset($access[$action])) {
|
||||
$test = $access[$action];
|
||||
if($test === true) return true;
|
||||
if(substr($test,0,2) == '->') {
|
||||
$funcName = substr($test,2);
|
||||
return $this->$funcName();
|
||||
}
|
||||
if(Permission::check($test)) return true;
|
||||
} else if((($key = array_search($action, $access)) !== false) && is_numeric($key)) {
|
||||
return true;
|
||||
}
|
||||
return false;
|
||||
}
|
||||
|
||||
/**
|
||||
* Throw an HTTP error instead of performing the normal processing
|
||||
* @todo This doesn't work properly right now. :-(
|
||||
*/
|
||||
function httpError($errorCode, $errorMessage = null) {
|
||||
$r = new HTTPResponse();
|
||||
$r->setBody($errorMessage);
|
||||
$r->setStatuscode($errorCode);
|
||||
return $r;
|
||||
}
|
||||
}
|
@ -15,7 +15,7 @@
|
||||
* @package forms
|
||||
* @subpackage core
|
||||
*/
|
||||
class Form extends ViewableData {
|
||||
class Form extends RequestHandlingData {
|
||||
|
||||
public static $backup_post_data = false;
|
||||
|
||||
@ -115,6 +115,80 @@ class Form extends ViewableData {
|
||||
$this->setMessage($errorInfo['message'],$errorInfo['type']);
|
||||
}
|
||||
}
|
||||
|
||||
static $url_handlers = array(
|
||||
'POST ' => 'httpSubmission',
|
||||
'GET ' => 'httpSubmission',
|
||||
);
|
||||
|
||||
/**
|
||||
* Handle a form submission. GET and POST requests behave identically
|
||||
*/
|
||||
function httpSubmission($request) {
|
||||
$vars = $request->requestVars();
|
||||
|
||||
if(isset($funcName)) {
|
||||
Form::set_current_action($funcName);
|
||||
}
|
||||
|
||||
// Populate the form
|
||||
$this->loadDataFrom($vars, true);
|
||||
|
||||
// Validate the form
|
||||
if(!$this->validate()) {
|
||||
if(Director::is_ajax()) {
|
||||
return FormResponse::respond();
|
||||
} else {
|
||||
Director::redirectBack();
|
||||
return;
|
||||
}
|
||||
}
|
||||
|
||||
// Protection against CSRF attacks
|
||||
if($this->securityTokenEnabled()) {
|
||||
$securityID = Session::get('SecurityID');
|
||||
|
||||
if(!$securityID || !isset($vars['SecurityID']) || $securityID != $vars['SecurityID']) {
|
||||
$this->httpError(400, "SecurityID doesn't match, possible CRSF attack.");
|
||||
}
|
||||
}
|
||||
|
||||
// Determine the action button clicked
|
||||
$funcName = null;
|
||||
foreach($vars as $paramName => $paramVal) {
|
||||
if(substr($paramName,0,7) == 'action_') {
|
||||
// Break off querystring arguments included in the action
|
||||
if(strpos($paramName,'?') !== false) {
|
||||
list($paramName, $paramVars) = explode('?', $paramName, 2);
|
||||
$newRequestParams = array();
|
||||
parse_str($paramVars, $newRequestParams);
|
||||
$vars = array_merge((array)$vars, (array)$newRequestParams);
|
||||
}
|
||||
|
||||
// Cleanup action_, _x and _y from image fields
|
||||
$funcName = preg_replace(array('/^action_/','/_x$|_y$/'),'',$paramName);
|
||||
break;
|
||||
}
|
||||
}
|
||||
|
||||
// If the action wasnt' set, choose the default on the form.
|
||||
if(!isset($funcName) && $defaultAction = $this->defaultAction()){
|
||||
$funcName = $defaultAction->actionName();
|
||||
}
|
||||
|
||||
if(isset($funcName)) {
|
||||
$this->setButtonClicked($funcName);
|
||||
}
|
||||
|
||||
// First, try a handler method on the controller
|
||||
if($this->controller->hasMethod($funcName)) {
|
||||
return $this->controller->$funcName($vars, $this);
|
||||
|
||||
// Otherwise, try a handler method on the form object
|
||||
} else {
|
||||
return $this->$funcName($vars, $this);
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Convert this form into a readonly form
|
||||
@ -385,15 +459,10 @@ class Form extends ViewableData {
|
||||
* @return string
|
||||
*/
|
||||
function FormAction() {
|
||||
// "get" form needs ?executeForm added as a hidden field
|
||||
if($this->formMethod == 'post') {
|
||||
if($this->controller->hasMethod("FormObjectLink")) {
|
||||
return $this->controller->FormObjectLink($this->name);
|
||||
} else {
|
||||
return $this->controller->Link() . "?executeForm=" . $this->name;
|
||||
}
|
||||
if($this->controller->hasMethod("FormObjectLink")) {
|
||||
return $this->controller->FormObjectLink($this->name);
|
||||
} else {
|
||||
return $this->controller->Link();
|
||||
return $this->controller->Link() . $this->name;
|
||||
}
|
||||
}
|
||||
|
||||
@ -509,7 +578,7 @@ class Form extends ViewableData {
|
||||
* This includes form validation, if it fails, we redirect back
|
||||
* to the form with appropriate error messages
|
||||
*/
|
||||
function beforeProcessing(){
|
||||
function validate(){
|
||||
if($this->validator){
|
||||
$errors = $this->validator->validate();
|
||||
|
||||
@ -526,7 +595,6 @@ class Form extends ViewableData {
|
||||
Convert::raw2js($error['messageType'])
|
||||
));
|
||||
}
|
||||
echo FormResponse::respond();
|
||||
return false;
|
||||
} else {
|
||||
$data = $this->getData();
|
||||
@ -541,7 +609,6 @@ class Form extends ViewableData {
|
||||
'data' => $data,
|
||||
));
|
||||
|
||||
Director::redirectBack();
|
||||
}
|
||||
return false;
|
||||
}
|
||||
|
@ -7,7 +7,7 @@
|
||||
* @package forms
|
||||
* @subpackage core
|
||||
*/
|
||||
class FormField extends ViewableData {
|
||||
class FormField extends RequestHandlingData {
|
||||
protected $form;
|
||||
protected $name, $title, $value ,$message, $messageType, $extraClass;
|
||||
|
||||
|
@ -542,6 +542,7 @@ class Member extends DataObject {
|
||||
parent::onAfterWrite();
|
||||
|
||||
if(isset($this->changed['Password']) && $this->changed['Password']) {
|
||||
$_REQUEST['showqueries'] = 1;
|
||||
MemberPassword::log($this);
|
||||
}
|
||||
}
|
||||
|
@ -269,7 +269,7 @@ class Security extends Controller {
|
||||
$tmpPage->URLSegment = "Security";
|
||||
$tmpPage->ID = -1; // Set the page ID to -1 so we dont get the top level pages as its children
|
||||
|
||||
$controller = new Page_Controller($tmpPage);
|
||||
$controller = new Page_Controller($this->urlParams, $this->urlTokeniser, $tmpPage);
|
||||
$controller->init();
|
||||
//Controller::$currentController = $controller;
|
||||
|
||||
|
82
tests/ControllerTest.php
Normal file
82
tests/ControllerTest.php
Normal file
@ -0,0 +1,82 @@
|
||||
<?php
|
||||
|
||||
class ControllerTest extends SapphireTest {
|
||||
static $fixture_file = null;
|
||||
|
||||
function testDefaultAction() {
|
||||
/* For a controller with a template, the default action will simple run that template. */
|
||||
$response = Director::test("ControllerTest_Controller/");
|
||||
$this->assertEquals("This is the main template. Content is 'default content'.", $response->getBody());
|
||||
}
|
||||
|
||||
function testMethodActions() {
|
||||
/* The Action can refer to a method that is called on the object. If a method returns an array, then it will be
|
||||
used to customise the template data */
|
||||
$response = Director::test("ControllerTest_Controller/methodaction");
|
||||
$this->assertEquals("This is the main template. Content is 'methodaction content'.", $response->getBody());
|
||||
|
||||
/* If the method just returns a string, then that will be used as the response */
|
||||
$response = Director::test("ControllerTest_Controller/stringaction");
|
||||
$this->assertEquals("stringaction was called.", $response->getBody());
|
||||
}
|
||||
|
||||
function testTemplateActions() {
|
||||
/* If there is no method, it can be used to point to an alternative template. */
|
||||
$response = Director::test("ControllerTest_Controller/templateaction");
|
||||
$this->assertEquals("This is the template for templateaction. Content is 'default content'.", $response->getBody());
|
||||
}
|
||||
|
||||
function testAllowedActions() {
|
||||
$response = Director::test("ControllerTest_SecuredController/methodaction");
|
||||
$this->assertEquals(200, $response->getStatusCode());
|
||||
|
||||
$response = Director::test("ControllerTest_SecuredController/stringaction");
|
||||
$this->assertEquals(403, $response->getStatusCode());
|
||||
|
||||
$response = Director::test("ControllerTest_SecuredController/adminonly");
|
||||
$this->assertEquals(403, $response->getStatusCode());
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Simple controller for testing
|
||||
*/
|
||||
class ControllerTest_Controller extends Controller {
|
||||
public $Content = "default content";
|
||||
|
||||
function methodaction() {
|
||||
return array(
|
||||
"Content" => "methodaction content"
|
||||
);
|
||||
}
|
||||
|
||||
function stringaction() {
|
||||
return "stringaction was called.";
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Controller with an $allowed_actions value
|
||||
*/
|
||||
class ControllerTest_SecuredController extends Controller {
|
||||
static $allowed_actions = array(
|
||||
"methodaction",
|
||||
"adminonly" => "ADMIN",
|
||||
);
|
||||
|
||||
public $Content = "default content";
|
||||
|
||||
function methodaction() {
|
||||
return array(
|
||||
"Content" => "methodaction content"
|
||||
);
|
||||
}
|
||||
|
||||
function stringaction() {
|
||||
return "stringaction was called.";
|
||||
}
|
||||
|
||||
function adminonly() {
|
||||
return "You must be an admin!";
|
||||
}
|
||||
}
|
154
tests/RequestHandlingTest.php
Normal file
154
tests/RequestHandlingTest.php
Normal file
@ -0,0 +1,154 @@
|
||||
<?php
|
||||
|
||||
/**
|
||||
* Tests for RequestHandlingData and HTTPRequest.
|
||||
* We've set up a simple URL handling model based on
|
||||
*/
|
||||
class RequestHandlingTest extends SapphireTest {
|
||||
static $fixture_file = null;
|
||||
|
||||
function testMethodCallingOnController() {
|
||||
/* Calling a controller works just like it always has */
|
||||
$response = Director::test("testGoodBase1");
|
||||
$this->assertEquals("This is the controller", $response->getBody());
|
||||
|
||||
/* ID and OtherID are extracted from the URL and passed in $request->params. */
|
||||
$response = Director::test("testGoodBase1/method/1/2");
|
||||
$this->assertEquals("This is a method on the controller: 1, 2", $response->getBody());
|
||||
|
||||
/* In addition, these values are availalbe in $controller->urlParams. This is mainly for backward compatability. */
|
||||
$response = Director::test("testGoodBase1/legacymethod/3/4");
|
||||
$this->assertEquals("\$this->urlParams can be used, for backward compatibility: 3, 4", $response->getBody());
|
||||
}
|
||||
|
||||
function testPostRequests() {
|
||||
/* The HTTP Request handler can trigger special behaviour for GET and POST. */
|
||||
$response = Director::test("testGoodBase1/TestForm", array("MyField" => 3), null, "POST");
|
||||
$this->assertEquals("Form posted", $response->getBody());
|
||||
|
||||
$response = Director::test("testGoodBase1/TestForm");
|
||||
$this->assertEquals("Get request on form", $response->getBody());
|
||||
}
|
||||
|
||||
function testRequestHandlerChaining() {
|
||||
/* Request handlers can be chained, from Director to Controller to Form to FormField. Here, we can make a get
|
||||
request on a FormField. */
|
||||
$response = Director::test("testGoodBase1/TestForm/fields/MyField");
|
||||
$this->assertEquals("MyField requested", $response->getBody());
|
||||
|
||||
/* We can also make a POST request on a form field, which could be used for in-place editing, for example. */
|
||||
$response = Director::test("testGoodBase1/TestForm/fields/MyField" ,array("MyField" => 5));
|
||||
$this->assertEquals("MyField posted, update to 5", $response->getBody());
|
||||
}
|
||||
|
||||
function testBadBase() {
|
||||
/* Without a double-slash indicator in the URL, the entire URL is popped off the stack. The controller's default
|
||||
action handlers have been designed for this to an extend: simple actions can still be called. This is the set-up
|
||||
of URL rules written before this new request handler. */
|
||||
$response = Director::test("testBadBase/method/1/2");
|
||||
$this->assertEquals("This is a method on the controller: 1, 2", $response->getBody());
|
||||
|
||||
$response = Director::test("testBadBase/TestForm", array("MyField" => 3), null, "POST");
|
||||
$this->assertEquals("Form posted", $response->getBody());
|
||||
|
||||
/* It won't, however, let you chain requests to access methods on forms, or form fields. In order to do that,
|
||||
you need to have a // marker in your URL parsing rule */
|
||||
$response = Director::test("testBadBase/TestForm/fields/MyField");
|
||||
$this->assertNotEquals("MyField requested", $response->getBody());
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Director rules for the test
|
||||
*/
|
||||
Director::addRules(50, array(
|
||||
// If we don't request any variables, then the whole URL will get shifted off. This is fine, but it means that the
|
||||
// controller will have to parse the Action from the URL itself.
|
||||
'testGoodBase1' => "RequestHandlingTest_Controller",
|
||||
|
||||
// The double-slash indicates how much of the URL should be shifted off the stack. This is important for dealing
|
||||
// with nested request handlers appropriately.
|
||||
'testGoodBase2//$Action/$ID/$OtherID' => "RequestHandlingTest_Controller",
|
||||
|
||||
// By default, the entire URL will be shifted off. This creates a bit of backward-incompatability, but makes the
|
||||
// URL rules much more explicit.
|
||||
'testBadBase/$Action/$ID/$OtherID' => "RequestHandlingTest_Controller",
|
||||
));
|
||||
|
||||
/**
|
||||
* Controller for the test
|
||||
*/
|
||||
class RequestHandlingTest_Controller extends Controller {
|
||||
static $url_handlers = array(
|
||||
// The double-slash is need here to ensure that
|
||||
'$Action//$ID/$OtherID' => "handleAction",
|
||||
);
|
||||
|
||||
function index($request) {
|
||||
return "This is the controller";
|
||||
}
|
||||
|
||||
function method($request) {
|
||||
return "This is a method on the controller: " . $request->param('ID') . ', ' . $request->param('OtherID');
|
||||
}
|
||||
|
||||
function legacymethod($request) {
|
||||
return "\$this->urlParams can be used, for backward compatibility: " . $this->urlParams['ID'] . ', ' . $this->urlParams['OtherID'];
|
||||
}
|
||||
|
||||
function TestForm() {
|
||||
return new RequestHandlingTest_Form($this, "TestForm", new FieldSet(
|
||||
new RequestHandlingTest_FormField("MyField")
|
||||
), new FieldSet(
|
||||
new FormAction("myAction")
|
||||
));
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Form for the test
|
||||
*/
|
||||
class RequestHandlingTest_Form extends Form {
|
||||
static $url_handlers = array(
|
||||
'fields/$FieldName' => 'handleField',
|
||||
"POST " => "handleSubmission",
|
||||
"GET " => "handleGet",
|
||||
);
|
||||
|
||||
function handleField($request) {
|
||||
return $this->dataFieldByName($request->param('FieldName'));
|
||||
}
|
||||
|
||||
function handleSubmission($request) {
|
||||
return "Form posted";
|
||||
}
|
||||
|
||||
function handleGet($request) {
|
||||
return "Get request on form";
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
/**
|
||||
* Form field for the test
|
||||
*/
|
||||
class RequestHandlingTest_FormField extends FormField {
|
||||
static $url_handlers = array(
|
||||
"POST " => "handleInPlaceEdit",
|
||||
'' => 'handleField',
|
||||
'$Action' => '$Action',
|
||||
);
|
||||
|
||||
function test() {
|
||||
return "Test method on $this->name";
|
||||
}
|
||||
|
||||
function handleField() {
|
||||
return "$this->name requested";
|
||||
}
|
||||
|
||||
function handleInPlaceEdit($request) {
|
||||
return "$this->name posted, update to " . $request->postVar($this->name);
|
||||
}
|
||||
}
|
||||
|
@ -21,7 +21,7 @@ class MemberTest extends SapphireTest {
|
||||
|
||||
$member->Password = "test3";
|
||||
$member->write();
|
||||
|
||||
|
||||
$passwords = DataObject::get("MemberPassword", "MemberID = $member->ID", "Created DESC, ID DESC")->getIterator();
|
||||
$this->assertNotNull($passwords);
|
||||
$record = $passwords->rewind();
|
||||
|
1
tests/templates/ControllerTest.ss
Normal file
1
tests/templates/ControllerTest.ss
Normal file
@ -0,0 +1 @@
|
||||
This is the main template. Content is '$Content'.
|
1
tests/templates/ControllerTest_templateaction.ss
Normal file
1
tests/templates/ControllerTest_templateaction.ss
Normal file
@ -0,0 +1 @@
|
||||
This is the template for templateaction. Content is '$Content'.
|
Loading…
Reference in New Issue
Block a user