Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Validate the ID target for symlinks #14041

Merged
merged 4 commits into from Nov 13, 2018
Merged

Conversation

OptimusCrime
Copy link
Contributor

@OptimusCrime OptimusCrime commented Aug 11, 2018

What does it do?

This PR attempts to introduce validation for symlink targets. The symlinks needs to specify an existing resource in the system, and it is fairly easy to check if the user misspelled their target value.

The check is implemented for both update and create processors.

Note: I have left out the validation when you change the class type. If you have a modDocument, and then decide to change it into a modSymLink, we would attempt to validate the value of the content field. This can be anything, and would most likely produce a lot of errors and problems for the developers. Because of that, we only validate resources that are NEW modSymLinks, or when the user attempts to save an existing modSymLink. Also note that we do not validate that the field has any values, as this has previously not been required.

symlink-validation

Why is it needed?

It adds a sanity check that I think only improves usability.

Related issue(s)/PR(s)

#10141

@JoshuaLuckers
Copy link
Contributor

JoshuaLuckers commented Aug 11, 2018

The current symlink_help lexicon entry needs to be modified to reflect this change:

The address of the object you wish to reference with this Symlink. If you want to point to an existing MODX Resource, enter the ID here.

Another thing I noticed. If I have an existing resource with id 2 and I enter 2 0 (resource with ID 20 does not exist and notice the space in the field) I'm able to save the resource without an error.

@OptimusCrime
Copy link
Contributor Author

OptimusCrime commented Aug 11, 2018

Thank you for feedback @JoshuaLuckers. I agree, the text needs to be adjusted. I am still a bit unsure if this is an enhancement we want though. I'll wait to see what Jason and Mark says :)

I can also expand the validation by adding a check that validates that the input is a number.

@JoshuaLuckers
Copy link
Contributor

Maybe it should be a warning instead of an error.

@Jako
Copy link
Collaborator

Jako commented Aug 12, 2018

A few thoughts:

  • modWeblink could be regarded too.
  • Maybe it is an option to check the target id with filter_var($target, FILTER_VALIDATE_INT) before passing it to $this->modx->getObject('modResource', $target).
  • Is the symlink content parsed and could it contain a snippet? Then the validation has to be completely changed.
  • The validation during changing a modResource to modSymLink/modWebLink should run, but it should just log an error for an invalid content.

@OptimusCrime
Copy link
Contributor Author

Good points, I'll try to implement this!

@Jako Jako added type-frontend Issues related to UI/UX issues, mostly about styles and frontend implementations on JavaScript. proposal Proposal about improvement aka RFC. Need to be discussed before start implementation. state/in-progress blocked Active participation around the pull request or issue required. Consensus is not reached. labels Aug 27, 2018
Copy link
Collaborator

@Mark-H Mark-H left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Minor tweak - as @Jako also mentioned, this is an alternative way to require the provided content to be an integer ID. Makes it a bit more explicit than the filter_var approach imo.

@alroniks
Copy link
Collaborator

alroniks commented Nov 8, 2018

I wondering is it possible to use traits here to avoid code duplication?

@Mark-H Mark-H added this to the v2.7.0 milestone Nov 9, 2018
@Jako Jako added pr/review-needed Pull request requires review and testing. and removed blocked Active participation around the pull request or issue required. Consensus is not reached. state/in-progress labels Nov 12, 2018
@Jako
Copy link
Collaborator

Jako commented Nov 12, 2018

My issues with this PR should be fixed with these changes.

Copy link
Collaborator

@Mark-H Mark-H left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

👍

@alroniks alroniks added pr/ready-for-merging Pull request reviewed and tested and ready for merging. and removed pr/review-needed Pull request requires review and testing. labels Nov 13, 2018
@alroniks alroniks self-assigned this Nov 13, 2018
@alroniks alroniks merged commit 1989afa into modxcms:2.x Nov 13, 2018
alroniks added a commit that referenced this pull request Nov 13, 2018
* upstream/pr/14041:
  Add lexicon entries
  Check integer value & add modWebLink check
  Check integer value & add modWebLink check
  Validate the ID target for symlinks
@OptimusCrime
Copy link
Contributor Author

@Jako awesome work man :) Thanks for taking the time to fix it.

@opengeek
Copy link
Member

This is a problem unfortunately as this PR causes a significant BC break. The target of a symlink or weblink can be a MODX tag that is evaluated at runtime and this destroys the ability to maintain those.

@OptimusCrime
Copy link
Contributor Author

OptimusCrime commented Nov 13, 2018

@opengeek What do you mean? @Jako added a filter, so it only tries to validate integer values. It will skip any MODX tags.

@opengeek
Copy link
Member

opengeek commented Nov 13, 2018

I mean that the target value can be [[SnippetToReturnAnIntegerValueAtRuntime]], or any other valid tag expression that can be parsed by MODX.

@OptimusCrime
Copy link
Contributor Author

Yes, and those will be ignored, because there is not really any good way to validate them. This PR only validates if the user enters an integer value.

@opengeek
Copy link
Member

Not according to my testing…

new_document___jasoncoward_com

@OptimusCrime
Copy link
Contributor Author

I tried to look at the code, but I do not have the time to properly investigate this now. I suspect one of the filters is incorrect.

@Jako
Copy link
Collaborator

Jako commented Nov 13, 2018

The weblink code checks for an integer and validates afterwards, since it could be an external link. The Symlink code validates only, if it is an integer. Thats the issue here.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
pr/ready-for-merging Pull request reviewed and tested and ready for merging. proposal Proposal about improvement aka RFC. Need to be discussed before start implementation. type-frontend Issues related to UI/UX issues, mostly about styles and frontend implementations on JavaScript.
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

6 participants