comments only to registered users. It's simplistic, but is better
than adding a permission since generally this setting will be used
Gallery-wide.
Fixes ticket #1002
* Remove the methods create, update, delete, get_edit_form as there are not used
* Change the return when a comment is created to return the html for the new comment.
This saves a second get request to down load the comment.
types, and a subtype for specifics. Currently the top level bucket
collection, item, other
Here are the core subtypes so far:
collection: album, search, tag
item: movie, photo
other: login, reset, comment-fragment, comment
It's legal to create new page_subtypes whenever you want. Use the
appropriate page_type to get the coarse grain behavior that you want.
related events from within the model handling code. The only
exception to this currently is item_created which is challenging
because we have to save the item using ORM_MPTT::add_to_parent()
before the object itself is fully set up. When we get that down to
one call to save() we can publish that event from within the model
also.
approach using html::specialchars and purify uses HTMLPurifier to intelligently
cleanse the output fields. Use purifier for text and title fields where it is
likely that a user would enter html to format their data.
and verifying user permissions, but there are several above-the-bar
changes:
1) Server add is now only available to admins. This is a hard
requirement because we have to limit server access (eg:
server_add::children) to a user subset and the current permission
model doesn't include that. Easiest fix is to restrict to admins.
Got rid of the server_add permission.
2) We now know check permissions at every level, which means in
controllers AND in helpers. This "belt and suspenders" approach will
give us defense in depth in case we overlook it in one area.
3) We now do CSRF checking in every controller method that changes the
code, in addition to the Forge auto-check. Again, defense in depth
and it makes scanning the code for security much simpler.
4) Moved Simple_Uploader_Controller::convert_filename_to_title to
item:convert_filename_to_title
5) Fixed a bug in sending notification emails.
6) Fixed the Organize code to verify that you only have access to your
own tasks. In general, added permission checks to organize which had
pretty much no validation code.
I did my best to verify every feature that I touched.
user modules.
* Don't delete vars when we delete a module. This makes
reinstalling a module a lot easier.
* Add user::lookup() as the preferred way to load a user, so that
other modules don't delve into the user module (that'd be a
problem when we swap out user modules)
* Notify site admins if Akismet is not fully configured
* Bundle all server variables into the comment so that if/when we
re-check the comment, we are not using the server info from the
site admin's request.
* Update Akismet to grab request context data from the comment
* Pre-seed comment fields if we have a logged in user. Update
comment::create() API to clarify it for this.
* Delete comment::update(), that's a controller function.
* Add url to User_Model
* Add author_name() author_email() and author_url() to
Comment_Model. It'll return the appropriate values depending
on whether the comment was left by a logged in user or a guest.
* Use resetForm() instead of clearForm() when we reload the
comment form after ajax submit, this way we preserve the
pre-seeded values.
* In the user profile page, ignore blank passwords.
2) Replaced it with a string field (state) which contains the state of the comment. i.e. published, unpublished, spam. Unsure if we want to create constants in comments.php to standardize the valid values... thoughts?
3) synchronized the spamfilter and comment unit tests with the current functionality
The comment block has changed to only display comments that are visible.
And there is code added to call the spam_filter helper if the spam_filter module is installed.
communicate. Almost all controllers now use JSON to speak to the
theme when we're dealing with form processing. This means tht we only
send the form back and forth, but we use a JSON protocol to tell the
browser success/error status as well as the location of any newly
created resources, or where the browser should redirect the user.
Lots of small changes:
1) Admin -> Edit Profile is gone. Instead I fixed the "Modify Profile" link
in the top right corner to be a modal dialog
2) We use json_encode everywhere. No more Atom/XML for now. We can bring those
back later, though. For now there's a lot of code duplication but that'll be
easy to clean up.
3) REST_Controller is no longer abstract. All methods its subclasses should create
throw exceptions, which means that subclasses don't have to implement stubs for
those methods.
4) New pattern: helper method get_add_form calls take an Item_Model,
not an id since we have to load the Item_Model in the controller
anyway to check permissions.
5) User/Groups REST resources are separate from User/Group in the site
admin. They do different things, we should avoid confusing overlap.
and XML for now, we have no driver for those technologies so anything
we implement is not going to be sufficiently tested and therefore
it'll be broken.
Change all comment functions to return JSON and update the JS to deal
purely with JSON. This is our new protocol for talking to the browser
and it should be flexible and portable.
Create comments.html.php. This duplicates comment.html.php, but will
be more efficient for rendering comments since we won't be creating a
new View for every comment we render.
http://example.gallery.com/index.php/comments/{comment_id}?_format=atom
* Changed Content-Type of Atom feeds and entries to XML for easier debugging.
* Added an Atom helper class with some common functions and cleaned up entry and feed generation code a bit in the comment helper.
* Style fixes.
* HTTP header setting in comment module now going through REST helper API.
* Fixed items controller test.
* Fixed user installer test.
* Fixed _create() handling in the REST controller.
* Fixed routing for edit and add forms.
* Added some tests for the REST controller.
* Set svn:eol-style to LF on a bunch of files.
* Added preamble to MY_Forge.php.
1) We now use __call() in REST_Controller to handle any requests to a controller
that were not already handled. In the case of RESTful controllers, this should
be the only entry point (although they're free to break the model and add other
ones.. nothing stops them).
This means that we can remove all the catch-all routes in
routes.php which greatly simplifies it.
2) Move request_method() and output_format() out of REST_Controller and into the REST
helper in core/helpers/rest.php
3) Experiment with letting the various subclasses check the output_format and deal with
it themselves. This simplifies the API, but it might be a bad idea in that it might
push too much work to the individual controllers. It's a balancing act, time will tell,
I'm willing to change it back later.
GET /form/edit/{controller}/{resource_id} -> controller::_form_edit($resource)
GET /form/add/{controller}/{parameters} -> controller::_form_add($parameters)
* Updated comment, user and core modules to reflect the API changes
* Cleaned up routing and handling of requests to /{controller}
GET /controller -> controller::_index()
POST /controller -> controller::_create()
GET /controller/id -> controller::_show()
PUT /controller/id -> controller::_update()
DELETE /controller/id -> controller::_delete()
GET /form/edit/controller/resource_id -> controller::_form()
GET /form/add/controller/data -> controller::_form()
1) Changed the way that we get forms. Now, if you want to get a form
for a REST resource you prefix /form to the resource id. So:
/form/photo/1 : returns a form for editing photo id 1
/form/comments/1 : returns a form for adding a comment to photo id 1
/form/comment/1 : returns a form for editing comment id 1
2) Changed the comment module to have two controllers:
comment: deals with a single comment resource
comments: deal with collections of comments attached to an item
Related stuff:
- Moved the comments js into the theme
- Reworked Comment_Helper for clarity
- Moved form generation code down into Comment_Helper
- Cleaned up routes (eliminating new comment ones added in recent rev)
- Added form() function to all REST controllers
- Changed comment module to use a block instead of an arbitrary helper call from the theme
- Comment controller only returns HTML currently, but returns a 201 Created status
code when a new comment is added, which the Ajax code can catch and act upon.
- Got rid of a lot of extra views in comment module
