Permalink
Browse files

API Escape form validation messages (SS-2013-008)

  • Loading branch information...
1 parent 114fb59 commit c243418597c58da98d6a35f28140e553cc6bfe61 @chillu chillu committed Sep 24, 2013
Showing with 16 additions and 8 deletions.
  1. +12 −8 forms/Form.php
  2. +4 −0 forms/FormField.php
View
@@ -65,7 +65,7 @@ class Form extends RequestHandler {
protected $validator;
protected $formMethod = "post";
-
+
protected static $current_action;
/**
@@ -144,6 +144,10 @@ class Form extends RequestHandler {
*/
protected $attributes = array();
+ public static $casting = array(
+ 'Message' => 'Text'
+ );
+
/**
* Create a new form, with the given fields an action buttons.
*
@@ -203,7 +207,7 @@ public function __construct($controller, $name, FieldList $fields, FieldList $ac
'GET ' => 'httpSubmission',
'HEAD ' => 'httpSubmission',
);
-
+
/**
* Set up current form errors in session to
* the current form if appropriate.
@@ -239,7 +243,7 @@ public function setupFormErrors() {
* if the form is valid.
*/
public function httpSubmission($request) {
- $vars = $request->requestVars();
+ $vars = $request->requestVars();
if(isset($funcName)) {
Form::set_current_action($funcName);
}
@@ -281,7 +285,7 @@ public function httpSubmission($request) {
if(isset($funcName)) {
$this->setButtonClicked($funcName);
}
-
+
// Permission checks (first on controller, then falling back to form)
if(
// Ensure that the action is actually a button or method on the form,
@@ -355,8 +359,8 @@ public function httpSubmission($request) {
}
return $this->controller->redirectBack();
}
- }
-
+ }
+
// First, try a handler method on the controller (has been checked for allowed_actions above already)
if($this->controller->hasMethod($funcName)) {
return $this->controller->$funcName($vars, $this, $request);
@@ -439,7 +443,7 @@ public function getRedirectToFormOnValidationError() {
}
/**
- * Add an error message to a field on this form. It will be saved into the session
+ * Add a plain text error message to a field on this form. It will be saved into the session
* and used the next time this form is displayed.
*/
public function addErrorMessage($fieldName, $message, $messageType) {
@@ -865,7 +869,7 @@ public function setFormMethod($method) {
$this->formMethod = strtolower($method);
return $this;
}
-
+
/**
* Return the form's action attribute.
* This is build by adding an executeForm get variable to the parent controller's Link() value
View
@@ -93,6 +93,10 @@ class FormField extends RequestHandler {
*/
protected $attributes = array();
+ public static $casting = array(
+ 'Message' => 'Text'
+ );
+
/**
* Takes a fieldname and converts camelcase to spaced
* words. Also resolves combined fieldnames with dot syntax

0 comments on commit c243418

Please sign in to comment.