| Age | Commit message (Collapse) | Author |
|---|
|
|
|
|
|
|
|
parameter and put in a message requiring a valid url. Fixes ticket
|
|
|
|
by the following rules:
1) An initial dialog or panel load can take either HTML or JSON, but
the mime type must accurately reflect its payload.
2) dialog form submits can handle a pure HTML response, but the mime
type must also be correct. This properly resolves the problem
where the reauth code gets a JSON response first from the reauth
code, and then an HTML response when you reauth and continue on to
a given form -- try it out with Admin > Settings > Advanced.
3) All JSON replies must set the mime type correctly. The json::reply
convenience function does this for us.
4) By default, any HTML content sent back in the JSON response should be
in the "html" field, no longer the "form" field.
The combination of these allows us to stop doing boilerplate code like
this in our controllers:
// Print our view, JSON encoded
json::reply(array("form" => (string) $view));
instead, controllers can just return HTML, eg:
// Print our view
print $view;
That's much more intuitive for developers.
|
|
method to set the content type header and encode the response as a json object
|
|
comments only to registered users. It's simplistic, but is better
than adding a permission since generally this setting will be used
Gallery-wide.
Fixes ticket #1002
|
|
|
|
|
|
|
|
* Remove the methods create, update, delete, get_edit_form as there are not used
* Change the return when a comment is created to return the html for the new comment.
This saves a second get request to down load the comment.
|
|
types, and a subtype for specifics. Currently the top level bucket
collection, item, other
Here are the core subtypes so far:
collection: album, search, tag
item: movie, photo
other: login, reset, comment-fragment, comment
It's legal to create new page_subtypes whenever you want. Use the
appropriate page_type to get the coarse grain behavior that you want.
|
|
Create a helper class called identity to simplify call the Identity Provider. Move the contents of MY_Session.php to the new helper class and remove the MY_Session class
|
|
MY_Session class to provide the user state changes in the session and a login.php helper that has the login form.
|
|
and group.php. Tried creating a identity helper, but the helper identity.php was confused with the library Identity.php. So got around this by making the methods on Identity static and calling the instance within the static methods. Also temporarily moved the user.php and group.php back into the user module.
|
|
instead of SafeString directly.
|
|
SafeString::purify().
Removing any p::clean() calls for arguments to t() and t2() since their args are wrapped in a SafeString anyway.
|
|
related events from within the model handling code. The only
exception to this currently is item_created which is challenging
because we have to save the item using ORM_MPTT::add_to_parent()
before the object itself is fully set up. When we get that down to
one call to save() we can publish that event from within the model
also.
|
|
item::description. In addition add p::clean or p::purify to places that
xss cleaning had missed (i.e. rss feeds)
|
|
approach using html::specialchars and purify uses HTMLPurifier to intelligently
cleanse the output fields. Use purifier for text and title fields where it is
likely that a user would enter html to format their data.
|
|
other data leaks.
|
|
and verifying user permissions, but there are several above-the-bar
changes:
1) Server add is now only available to admins. This is a hard
requirement because we have to limit server access (eg:
server_add::children) to a user subset and the current permission
model doesn't include that. Easiest fix is to restrict to admins.
Got rid of the server_add permission.
2) We now know check permissions at every level, which means in
controllers AND in helpers. This "belt and suspenders" approach will
give us defense in depth in case we overlook it in one area.
3) We now do CSRF checking in every controller method that changes the
code, in addition to the Forge auto-check. Again, defense in depth
and it makes scanning the code for security much simpler.
4) Moved Simple_Uploader_Controller::convert_filename_to_title to
item:convert_filename_to_title
5) Fixed a bug in sending notification emails.
6) Fixed the Organize code to verify that you only have access to your
own tasks. In general, added permission checks to organize which had
pretty much no validation code.
I did my best to verify every feature that I touched.
|
|
|
|
|
|
|
|
|
|
Fire off the appropriate item_related_update events as appropriate.
|
|
user modules.
* Don't delete vars when we delete a module. This makes
reinstalling a module a lot easier.
* Add user::lookup() as the preferred way to load a user, so that
other modules don't delve into the user module (that'd be a
problem when we swap out user modules)
* Notify site admins if Akismet is not fully configured
* Bundle all server variables into the comment so that if/when we
re-check the comment, we are not using the server info from the
site admin's request.
* Update Akismet to grab request context data from the comment
* Pre-seed comment fields if we have a logged in user. Update
comment::create() API to clarify it for this.
* Delete comment::update(), that's a controller function.
* Add url to User_Model
* Add author_name() author_email() and author_url() to
Comment_Model. It'll return the appropriate values depending
on whether the comment was left by a logged in user or a guest.
* Use resetForm() instead of clearForm() when we reload the
comment form after ajax submit, this way we preserve the
pre-seeded values.
* In the user profile page, ignore blank passwords.
|
|
published. Fix _form_add to take an item id. Oh and email address is
no longer required.
|
|
themed page.
|
|
2) Replaced it with a string field (state) which contains the state of the comment. i.e. published, unpublished, spam. Unsure if we want to create constants in comments.php to standardize the valid values... thoughts?
3) synchronized the spamfilter and comment unit tests with the current functionality
|
|
|
|
directly help since text/html works just as well for our JSON communications
|
|
the spam_filter module
|
|
two columns to the comment table. The url of the author's web site(default null) and a flag to indicate that the comment is visible (default true).
The comment block has changed to only display comments that are visible.
And there is code added to call the spam_filter helper if the spam_filter module is installed.
|
|
communicate. Almost all controllers now use JSON to speak to the
theme when we're dealing with form processing. This means tht we only
send the form back and forth, but we use a JSON protocol to tell the
browser success/error status as well as the location of any newly
created resources, or where the browser should redirect the user.
Lots of small changes:
1) Admin -> Edit Profile is gone. Instead I fixed the "Modify Profile" link
in the top right corner to be a modal dialog
2) We use json_encode everywhere. No more Atom/XML for now. We can bring those
back later, though. For now there's a lot of code duplication but that'll be
easy to clean up.
3) REST_Controller is no longer abstract. All methods its subclasses should create
throw exceptions, which means that subclasses don't have to implement stubs for
those methods.
4) New pattern: helper method get_add_form calls take an Item_Model,
not an id since we have to load the Item_Model in the controller
anyway to check permissions.
5) User/Groups REST resources are separate from User/Group in the site
admin. They do different things, we should avoid confusing overlap.
|
|
|
|
|
|
|
|
and XML for now, we have no driver for those technologies so anything
we implement is not going to be sufficiently tested and therefore
it'll be broken.
Change all comment functions to return JSON and update the JS to deal
purely with JSON. This is our new protocol for talking to the browser
and it should be flexible and portable.
Create comments.html.php. This duplicates comment.html.php, but will
be more efficient for rendering comments since we won't be creating a
new View for every comment we render.
|
|
|
|
|
|
|
|
entries and feeds has been considerably simplified and reduced.
|
|
http://example.gallery.com/index.php/comments/{comment_id}?_format=atom
* Changed Content-Type of Atom feeds and entries to XML for easier debugging.
* Added an Atom helper class with some common functions and cleaned up entry and feed generation code a bit in the comment helper.
* Style fixes.
|
|
their proper parents.
* Added valid Atom 1.0 feeds for comments. They can be seen at:
http://gallery.example.com/index.php/comments?item_id={photo_id}&_format=atom
|
|
* Implemented delete in comment.
|
|
* HTTP header setting in comment module now going through REST helper API.
* Fixed items controller test.
* Fixed user installer test.
* Fixed _create() handling in the REST controller.
* Fixed routing for edit and add forms.
* Added some tests for the REST controller.
* Set svn:eol-style to LF on a bunch of files.
* Added preamble to MY_Forge.php.
|
|
1) We now use __call() in REST_Controller to handle any requests to a controller
that were not already handled. In the case of RESTful controllers, this should
be the only entry point (although they're free to break the model and add other
ones.. nothing stops them).
This means that we can remove all the catch-all routes in
routes.php which greatly simplifies it.
2) Move request_method() and output_format() out of REST_Controller and into the REST
helper in core/helpers/rest.php
3) Experiment with letting the various subclasses check the output_format and deal with
it themselves. This simplifies the API, but it might be a bad idea in that it might
push too much work to the individual controllers. It's a balancing act, time will tell,
I'm willing to change it back later.
|
