Changeset 54 for branches/ajax_post_edit

Timestamp:

02/16/09 21:00:11 (3 years ago)

Author:

daris

Message:

ajax post edit: better error reporting, crsf confirmation and some other changes + release 1.7.1

Location:

branches/ajax_post_edit

Files:

• ajax_post_edit.js (modified) (6 diffs)
• edit.php (modified) (5 diffs)
• manifest.xml (modified) (2 diffs)

branches/ajax_post_edit/ajax_post_edit.js

@@ -37 +37 @@
                         ape_show_loading_info();
 
-                        sendRequest('action=get&id=' + ape_id + '&utf=1&csrf_token=' + ape['crsf_token'], function() {ape_on_ready_get_post()});
+                        sendRequest('action=get&id=' + ape_id + '&csrf_token=' + ape['crsf_token'], function() {ape_on_ready_get_post()});
                 }
         }
@@ -50 +50 @@
         var parsed_message = match(http.responseText, 'parsed_message');
 
-        if (parsed_message == '')
-        {
-                // if it's a security token error
-                error = match(http.responseText.substring(http.responseText.indexOf('<div class="frm-info">')), 'p');
-                if (error != '')
-                        alert(error.substring(0, error.indexOf('.')));
-                else
-                        alert(http.responseText);
-                
-                $('post' + ape_id).innerHTML = ape_temp_post;
-                id = -1;
-                return false;
-        }
-
-        var entry_content_html = http.responseText.substring(0, http.responseText.indexOf('<!-- END FORM -->'));
-        $('post' + ape_id).innerHTML = entry_content_html;
-
-        $('postedit').style.height = textAreaHeight + 'px';
-        $('postedit').focus();
+        // If there aren't any errors
+        if (parsed_message != '')
+        {
+                var entry_content_html = http.responseText.substring(0, http.responseText.indexOf('<!-- END FORM -->'));
+                $('post' + ape_id).innerHTML = entry_content_html;
+
+                $('postedit').style.height = textAreaHeight + 'px';
+                $('postedit').focus();
+                return 1;
+        }
+
+        if (http.responseText.substring(0, 12) == 'csrf_confirm')
+        {
+                response = http.responseText.split(':');
+                if (confirm(response[1]))
+                {
+                        ape['crsf_token'] = response[2];
+                        sendRequest('action=get&id=' + ape_id + '&csrf_token=' + response[2], function() {ape_on_ready_get_post()});
+                }
+        }
+        else
+                alert(http.responseText);
+        
+        $('post' + ape_id).innerHTML = ape_temp_post;
+        id = -1;
 }
 
@@ -79 +85 @@
         ape_enable(false);
 
-        var silent = '';
+        ape_update_url = 'action=update&id=' + ape_id + '&req_message=' + encodeURIComponent($('postedit').value) + '&utf=1';
         if ($('fldsilent'))
-                silent = '&silent=' + ($('fldsilent').checked ? 1 : 0);
-
-        var subject = '';
+                ape_update_url += '&silent=' + ($('fldsilent').checked ? 1 : 0);
+
         if ($('req_subject'))
-                subject = '&req_subject=' + encodeURIComponent($('req_subject').value);
-
-        sendRequest('action=update&id=' + ape_id + '&req_message=' + encodeURIComponent($('postedit').value) + subject + silent + '&utf=1&csrf_token=' + ape['crsf_token'], function() {ape_on_ready_update_post()});
+                ape_update_url += '&req_subject=' + encodeURIComponent($('req_subject').value);
+        
+        ape_update_url += '&csrf_token=' + ape['crsf_token'];
+
+        sendRequest(ape_update_url, function() {ape_on_ready_update_post()});
         ape_show_saving_info();
 }
@@ -97 +104 @@
 function ape_on_ready_update_post()
 {
-        
         var message = match(http.responseText, 'message');
         if (message != '')
         {
+                // Update post message for pun_quote extension
+                try
+                {
+                        pun_quote_posts[ape_id] = $('postedit').value;
+                }
+                catch (e) {}
+        
                 var last_edit = match(http.responseText, 'last_edit');
 
@@ -146 +159 @@
         }
         else
-                alert(http.responseText);
+        {
+                if (http.responseText.substring(0, 12) == 'csrf_confirm')
+                {
+                        response = http.responseText.split(':');
+                        if (confirm(response[1]))
+                        {
+                                ape['crsf_token'] = response[2];
+                                sendRequest(ape_update_url.substring(0, ape_update_url.indexOf('&csrf_token=') + 12) + response[2], function() {ape_on_ready_update_post()});
+                        }
+                        else
+                        {
+                                ape_enable(true);
+                                ape_hide_saving_info();
+                        }
+                }
+                else
+                        alert(http.responseText);
+        }
 }
 
@@ -360 +390 @@
 var ape_menu_hovered = false;   // if menu is hovered
 var ape;
+var ape_update_url = '';

branches/ajax_post_edit/edit.php

@@ -7 +7 @@
 
 if ($forum_user['g_read_board'] == '0')
-        exit('<error>'.$lang_common['No view'].'</error>');
-
+        message($lang_common['No view']);
 
 require_once FORUM_ROOT.'include/parser.php';
@@ -25 +24 @@
 
 if (!isset($id))
-        exit('<error>'.$lang_common['Bad request'].'</error>');
-
+        message($lang_common['Bad request']);
 
 $query = array(
@@ -51 +49 @@
 $result = $forum_db->query_build($query) or error(__FILE__, __LINE__);
 if (!$forum_db->num_rows($result))
-        exit('<error>'.$lang_common['Bad request'].'</error>');
+        message($lang_common['Bad request']);
 
 $cur_post = $forum_db->fetch_assoc($result);
@@ -64 +62 @@
         $cur_post['closed'] == '1') &&
         !$forum_page['is_admmod'])
-        exit('<error>'.$lang_common['No permission'].'</error>');
-
+        message($lang_common['No permission']);
 
 $can_edit_subject = $id == $cur_post['first_post_id'];
 
-
 // it's a request for get post message
-if ($action == "get")
+if ($action == 'get')
 {
         ($hook = get_hook('ape_pre_message_box')) ? eval($hook) : null;
@@ -117 +113 @@
 
 // it's a request for update post in database
-elseif ($action == "update")
+elseif ($action == 'update')
 {
         // If it is a topic it must contain a subject

branches/ajax_post_edit/manifest.xml

@@ -4 +4 @@
         <id>ajax_post_edit</id>
         <title>Ajax Post Edit</title>
-        <version>1.7</version>
+        <version>1.7.1</version>
         <description>This extension allows quickly edit post</description>
         <author>Daris</author>
@@ -56 +56 @@
 }
                                               ]]></hook>
+
+                <hook id="fn_message_start"><![CDATA[
+
+if (strpos($_SERVER['SCRIPT_FILENAME'], 'extensions/ajax_post_edit/edit.php') !== false)
+        exit($message);
+
+                ]]></hook>
+                
+                <hook id="fn_csrf_confirm_form_start"><![CDATA[
+                
+if (strpos($_SERVER['SCRIPT_FILENAME'], 'extensions/ajax_post_edit/edit.php') !== false)
+        exit('csrf_confirm:'.$lang_common['CSRF token mismatch'].':'.generate_form_token($ext_info['url'].'/edit.php'));
+                ]]></hook>
+
         </hooks>
 </extension>