Commit Graph

25 Commits

Author SHA1 Message Date
Bharat Mediratta
bf3282cb3c Don't do ORM::factory() lookups on non-ints (thanks Romain LE DISEZ) 2009-05-08 19:01:45 +00:00
Tim Almdal
bf6c814e81 Undo... pass any additional parameters to the _edit_form method 2009-03-08 07:55:37 +00:00
Tim Almdal
186eeb8e20 Pass any additional parameters to the _edit_form method 2009-03-08 07:42:06 +00:00
Bharat Mediratta
3c768e1c59 Require CSRF for any non-"get" action. 2009-01-04 01:27:24 +00:00
Bharat Mediratta
fdc0f83024 Big round of normalization of the way that our controllers
communicate.  Almost all controllers now use JSON to speak to the
theme when we're dealing with form processing.  This means tht we only
send the form back and forth, but we use a JSON protocol to tell the
browser success/error status as well as the location of any newly
created resources, or where the browser should redirect the user.

Lots of small changes:
1) Admin -> Edit Profile is gone.  Instead I fixed the "Modify Profile" link
   in the top right corner to be a modal dialog

2) We use json_encode everywhere.  No more Atom/XML for now.  We can bring those
   back later, though.  For now there's a lot of code duplication but that'll be
   easy to clean up.

3) REST_Controller is no longer abstract.   All methods its subclasses should create
   throw exceptions, which means that subclasses don't have to implement stubs for
   those methods.

4) New pattern: helper method get_add_form calls take an Item_Model,
   not an id since we have to load the Item_Model in the controller
   anyway to check permissions.

5) User/Groups REST resources are separate from User/Group in the site
   admin.  They do different things, we should avoid confusing overlap.
2008-12-25 05:12:46 +00:00
Bharat Mediratta
672eca5337 Lots of deltas rolled up into a bigger change. Sorry for the mess.
1) Deleted in-place-editing.  We'll be replacing this with a real edit
   system that groups settings together and is more coherent.

2) Tweaked the way that dialog boxes work to get the ajax stuff working
   again.  It's imperfect and does not work properly for uploading images.
   This is going to get redone also, but this is a good resting point.

3) Created edit forms for albums and photos.  Moved _update and _create out
   of Items_Controller and into the individual subclasses.

4) Created access::required which is a shorthand for:
    if (!access::can(...)) {
      access::forbidden();
    }

5) Added validation rules to Items_Model

6) Converted login to use the regular modal dialog approach in the theme.
2008-12-24 00:20:26 +00:00
Bharat Mediratta
4a0e4b798e Check view permissions before allowing view access to albums/photos. 2008-12-09 10:14:09 +00:00
Jozef Selesi
88f799be6f Fixed a bug in the REST controller dispatcher and added a test case that excercises it. 2008-11-21 21:07:36 +00:00
Jozef Selesi
c3fc1cb7ec * Added HTTP status constants and helper functions to REST helper.
* HTTP header setting in comment module now going through REST helper API.
* Fixed items controller test.
* Fixed user installer test.
* Fixed _create() handling in the REST controller.
* Fixed routing for edit and add forms.
* Added some tests for the REST controller.
* Set svn:eol-style to LF on a bunch of files.
* Added preamble to MY_Forge.php.
2008-11-20 01:25:29 +00:00
Bharat Mediratta
5638fc5fb6 Change the way that we do RESTful routing.
1) We now use __call() in REST_Controller to handle any requests to a controller
   that were not already handled.  In the case of RESTful controllers, this should
   be the only entry point (although they're free to break the model and add other
   ones.. nothing stops them).

   This means that we can remove all the catch-all routes in
   routes.php which greatly simplifies it.

2) Move request_method() and output_format() out of REST_Controller and into the REST
   helper in core/helpers/rest.php

3) Experiment with letting the various subclasses check the output_format and deal with
   it themselves.  This simplifies the API, but it might be a bad idea in that it might
   push too much work to the individual controllers.  It's a balancing act, time will tell,
   I'm willing to change it back later.
2008-11-19 04:20:35 +00:00
Bharat Mediratta
c0aa61787c Change output_format() to autodetect for html / xml / json 2008-11-19 03:42:43 +00:00
Jozef Selesi
1992343c2e * Changed REST API. Now there are two separate methods for forms:
GET /form/edit/{controller}/{resource_id} -> controller::_form_edit($resource)
  GET /form/add/{controller}/{parameters}   -> controller::_form_add($parameters)
* Updated comment, user and core modules to reflect the API changes
* Cleaned up routing and handling of requests to /{controller}
2008-11-18 23:40:47 +00:00
Jozef Selesi
b63ea2cdbf - All comments of an item can now be seen /comments?item_id=
- Return proper Content-Type header for GET /comments requests
- Got rid of the query processing for index() in REST_Controller()
- Small misc fixes
2008-11-18 15:48:08 +00:00
Jozef Selesi
3ebb751cda First iteration of REST controller refactoring. RESTful controllers that refer to collections should now have plural names and there should be only one controller per resource. Updated existing classes that implement REST_Controller. The routing now works like this:
GET    /controller    -> controller::_index()
POST   /controller    -> controller::_create()
GET    /controller/id -> controller::_show()
PUT    /controller/id -> controller::_update()
DELETE /controller/id -> controller::_delete()
GET    /form/edit/controller/resource_id -> controller::_form()
GET    /form/add/controller/data         -> controller::_form()
2008-11-18 08:28:32 +00:00
Bharat Mediratta
c91e90406b Add output formats to our REST controllers. Add support for JSON and
XML to the comment controllers as a proof of concept.  It's not fully
baked; we should examine ways to create helpers to make this process
easier.
2008-11-17 00:30:18 +00:00
Bharat Mediratta
b6de985922 Handle _method in either GET or POST 2008-11-16 19:22:27 +00:00
Bharat Mediratta
5d14531af9 Drop the call to render() and just use the View's __toString method to
print it out.
2008-11-16 19:12:01 +00:00
Bharat Mediratta
140736a1e4 Several large changes:
1) Changed the way that we get forms.  Now, if you want to get a form
   for a REST resource you prefix /form to the resource id.  So:
    /form/photo/1    : returns a form for editing photo id 1
    /form/comments/1 : returns a form for adding a comment to photo id 1
    /form/comment/1  : returns a form for editing comment id 1

2) Changed the comment module to have two controllers:
    comment:  deals with a single comment resource
    comments: deal with collections of comments attached to an item

Related stuff:
- Moved the comments js into the theme
- Reworked Comment_Helper for clarity
- Moved form generation code down into Comment_Helper
- Cleaned up routes (eliminating new comment ones added in recent rev)
- Added form() function to all REST controllers
- Changed comment module to use a block instead of an arbitrary helper call from the theme
- Comment controller only returns HTML currently, but returns a 201 Created status
  code when a new comment is added, which the Ajax code can catch and act upon.
- Got rid of a lot of extra views in comment module
2008-11-16 07:14:12 +00:00
Bharat Mediratta
ae7839ffaa Revise the user login code.
* Remove user registration link and popup from the theme; this
  shouldn't be done in a popup. Use ajaxform to simplify the way
  that we load the login popup.

* Create form.html.php, this is a template for Forge based forms.

* Move user validation rules into User_Model and let forms
  populate the rules into their forms as useful.

* Undo r18688's changes regarding the REST code.  We should never
  accept a null resource, this breaks the REST abstraction.

* Change login and user controllers to use Forge which lets us delete
  login.html.php and user.html.php since those now are generated by
  the theme-owned form template
2008-11-15 06:23:09 +00:00
Tim Almdal
e0ec9dd76a Allow the HTTP get method to be called without an id to create any empty template. 2008-11-14 16:51:11 +00:00
Tim Almdal
b5f48e4ab3 Use the shortform to load the resource. 2008-11-14 07:30:47 +00:00
Bharat Mediratta
a15c7cb11f Change the PUT/DELETE tunneling param from __action to _method
to be like Rails.
2008-11-11 13:11:20 +00:00
Bharat Mediratta
87f1115113 Change REST API to use non-routable functions: _get(), _post(),
_put(), _delete().

This should make it more obvious that these are not your typical
routes, simplifies overall routing by removing a rule and removes the
possibility of accidentally leaking information if we route to one of
them by accident.
2008-11-11 07:29:48 +00:00
Bharat Mediratta
d35f337b7b Add phpdocs to explain how to use REST_Controller 2008-11-11 06:24:30 +00:00
Bharat Mediratta
dae36c2aa4 Create REST_Controller abstract base class for all REST based resource
controllers.  Any controller that wants to act RESTful can extend this
class and implement get/post/put/delete.

Tweak default routes to disallow direct access to the REST controller
and direct access to any REST methods.
2008-11-11 06:18:45 +00:00