$url .= $urladd;
my $image = $images->[$$rindex];
- my $down_url;
+ my $csrfp = $req->get_csrf_token("admin_move_image");
+ my $baseurl = "$ENV{SCRIPT_NAME}?id=$article->{id}&imageid=$image->{id}&";
+ $baseurl .= "_csrfp=$csrfp&";
+ my $down_url = "";
if ($$rindex < $#$images) {
- $down_url = "$ENV{SCRIPT_NAME}?id=$article->{id}&moveimgdown=1&imageid=$image->{id}";
+ $down_url = $baseurl . "moveimgdown=1";
}
- my $up_url = '';
+ my $up_url = "";
if ($$rindex > 0) {
- $up_url = "$ENV{SCRIPT_NAME}?id=$article->{id}&moveimgup=1&imageid=$image->{id}";
+ $up_url = $baseurl . "moveimgup=1";
}
return make_arrows($req->cfg, $down_url, $up_url, $url, $img_prefix);
}
}
my $down_url = "";
+ my $csrfp = $req->get_csrf_token("admin_move_file");
+ my $baseurl = "$ENV{SCRIPT_NAME}?fileswap=1&id=$article->{id}&";
+ $baseurl .= "_csrfp=$csrfp&";
if ($$rindex < $#$files) {
- $down_url = "$ENV{SCRIPT_NAME}?fileswap=1&id=$article->{id}&file1=$files->[$$rindex]{id}&file2=$files->[$$rindex+1]{id}";
+ $down_url = $baseurl . "file1=$files->[$$rindex]{id}&file2=$files->[$$rindex+1]{id}";
}
my $up_url = "";
if ($$rindex > 0) {
- $up_url = "$ENV{SCRIPT_NAME}?fileswap=1&id=$article->{id}&file1=$files->[$$rindex]{id}&file2=$files->[$$rindex-1]{id}";
+ $up_url = $baseurl . "file1=$files->[$$rindex]{id}&file2=$files->[$$rindex-1]{id}";
}
return make_arrows($req->cfg, $down_url, $up_url, $url, $img_prefix);
return $self->low_edit_form($request, $article, $articles, $msg, $errors);
}
-sub add_form {
- my ($self, $req, $articles, $msg, $errors) = @_;
+sub _dummy_article {
+ my ($self, $req, $articles, $rmsg) = @_;
my $level;
my $cgi = $req->cgi;
my ($values, $labels) = $self->possible_parents(\%article, $articles, $req);
unless (@$values) {
+ $$rmsg = "You can't add children to any article at that level";
+ return;
+ }
+
+ return \%article;
+}
+
+sub add_form {
+ my ($self, $req, $articles, $msg, $errors) = @_;
+
+ my $mymsg;
+ my $article = $self->_dummy_article($req, $articles, \$mymsg);
+ unless ($article) {
require BSE::Edit::Site;
my $site = BSE::Edit::Site->new(cfg=>$req->cfg, db=> BSE::DB->single);
- return $site->edit_sections($req, $articles,
- "You can't add children to any article at that level");
+ return $site->edit_sections($req, $articles, $mymsg);
}
- return $self->low_edit_form($req, \%article, $articles, $msg, $errors);
+ return $self->low_edit_form($req, $article, $articles, $msg, $errors);
}
sub generator { 'Generate::Article' }
sub save_new {
my ($self, $req, $articles) = @_;
+
+ $req->check_csrf("admin_add_article")
+ or return $self->csrf_error($req, undef, "admin_add_article", "Add Article");
my $cgi = $req->cgi;
my %data;
sub save {
my ($self, $req, $article, $articles) = @_;
+ $req->check_csrf("admin_save_article")
+ or return $self->csrf_error($req, $article, "admin_save_article", "Save Article");
+
$req->user_can(edit_save => $article)
or return $self->edit_form($req, $article, $articles,
"You don't have access to save this article");
sub add_stepkid {
my ($self, $req, $article, $articles) = @_;
+ $req->check_csrf("admin_add_stepkid")
+ or return $self->csrf_error($req, $article, "admin_add_stepkid", "Add Stepkid");
+
$req->user_can(edit_stepkid_add => $article)
or return $self->edit_form($req, $article, $articles,
"You don't have access to add step children to this article");
sub del_stepkid {
my ($self, $req, $article, $articles) = @_;
+ $req->check_csrf("admin_remove_stepkid")
+ or return $self->csrf_error($req, $article, "admin_del_stepkid", "Delete Stepkid");
$req->user_can(edit_stepkid_delete => $article)
or return $self->edit_form($req, $article, $articles,
"You don't have access to delete stepchildren from this article");
sub save_stepkids {
my ($self, $req, $article, $articles) = @_;
+ $req->check_csrf("admin_save_stepkids")
+ or return $self->csrf_error($req, $article, "admin_save_stepkids", "Save Stepkids");
+
$req->user_can(edit_stepkid_save => $article)
or return $self->edit_form($req, $article, $articles,
"No access to save stepkid data for this article");
sub add_stepparent {
my ($self, $req, $article, $articles) = @_;
+ $req->check_csrf("admin_add_stepparent")
+ or return $self->csrf_error($req, $article, "admin_add_stepparent", "Add Stepparent");
+
$req->user_can(edit_stepparent_add => $article)
or return $self->edit_form($req, $article, $articles,
"You don't have access to add stepparents to this article");
sub del_stepparent {
my ($self, $req, $article, $articles) = @_;
+ $req->check_csrf("admin_remove_stepparent")
+ or return $self->csrf_error($req, $article, "admin_del_stepparent", "Delete Stepparent");
+
$req->user_can(edit_stepparent_delete => $article)
or return $self->edit_form($req, $article, $articles,
"You cannot remove stepparents from that article");
sub save_stepparents {
my ($self, $req, $article, $articles) = @_;
+ $req->check_csrf("admin_save_stepparents")
+ or return $self->csrf_error($req, $article, "admin_save_stepparents", "Save Stepparents");
$req->user_can(edit_stepparent_save => $article)
or return $self->edit_form($req, $article, $articles,
"No access to save stepparent data for this artice");
sub save_image_changes {
my ($self, $req, $article, $articles) = @_;
+ $req->check_csrf("admin_save_images")
+ or return $self->csrf_error($req, $article, "admin_save_images", "Save Images");
+
$req->user_can(edit_images_save => $article)
or return $self->edit_form($req, $article, $articles,
"You don't have access to save image information for this article");
sub add_image {
my ($self, $req, $article, $articles) = @_;
+ $req->check_csrf("admin_add_image")
+ or return $self->csrf_error($req, $article, "admin_add_image", "Add Image");
$req->user_can(edit_images_add => $article)
or return $self->_service_error($req, $article, $articles,
"You don't have access to add new images to this article");
sub remove_img {
my ($self, $req, $article, $articles, $imageid) = @_;
+ $req->check_csrf("admin_remove_image")
+ or return $self->csrf_error($req, $article, "admin_remove_image", "Remove Image");
+
$req->user_can(edit_images_delete => $article)
or return $self->edit_form($req, $article, $articles,
"You don't have access to delete images from this article");
sub move_img_up {
my ($self, $req, $article, $articles) = @_;
+ $req->check_csrf("admin_move_image")
+ or return $self->csrf_error($req, $article, "admin_move_image", "Move Image");
$req->user_can(edit_images_reorder => $article)
or return $self->edit_form($req, $article, $articles,
"You don't have access to reorder images in this article");
sub move_img_down {
my ($self, $req, $article, $articles) = @_;
+ $req->check_csrf("admin_move_image")
+ or return $self->csrf_error($req, $article, "admin_move_image", "Move Image");
$req->user_can(edit_images_reorder => $article)
or return $self->edit_form($req, $article, $articles,
"You don't have access to reorder images in this article");
sub req_save_image {
my ($self, $req, $article, $articles) = @_;
+ $req->check_csrf("admin_save_image")
+ or return $self->csrf_error($req, $article, "admin_save_image", "Save Image");
my $cgi = $req->cgi;
my $id = $cgi->param('image_id');
sub fileadd {
my ($self, $req, $article, $articles) = @_;
+ $req->check_csrf("admin_add_file")
+ or return $self->csrf_error($req, $article, "admin_add_file", "Add File");
$req->user_can(edit_files_add => $article)
or return $self->edit_form($req, $article, $articles,
"You don't have access to add files to this article");
sub fileswap {
my ($self, $req, $article, $articles) = @_;
+ $req->check_csrf("admin_move_file")
+ or return $self->csrf_error($req, $article, "admin_move_file", "Move File");
+
$req->user_can('edit_files_reorder', $article)
or return $self->edit_form($req, $article, $articles,
"You don't have access to reorder files in this article");
sub filedel {
my ($self, $req, $article, $articles) = @_;
+ $req->check_csrf("admin_remove_file")
+ or return $self->csrf_error($req, $article, "admin_remove_file", "Delete File");
$req->user_can('edit_files_delete', $article)
or return $self->edit_form($req, $article, $articles,
"You don't have access to delete files from this article");
sub filesave {
my ($self, $req, $article, $articles) = @_;
+ $req->check_csrf("admin_save_files")
+ or return $self->csrf_error($req, $article, "admin_save_files", "Save Files");
+
$req->user_can('edit_files_save', $article)
or return $self->edit_form($req, $article, $articles,
"You don't have access to save file information for this article");
sub req_save_file {
my ($self, $req, $article, $articles) = @_;
+ $req->check_csrf("admin_save_file")
+ or return $self->csrf_error($req, $article, "admin_save_file", "Save File");
+
my $cgi = $req->cgi;
my @files = $self->get_files($article);
sub remove {
my ($self, $req, $article, $articles) = @_;
+ $req->check_csrf("admin_remove_article")
+ or return $self->csrf_error($req, $article, "admin_remove_article", "Remove Article");
+
my $why_not;
unless ($self->can_remove($req, $article, $articles, \$why_not)) {
return $self->edit_form($req, $article, $articles, $why_not);
my %errors;
my $msg = $req->csrf_error;
$errors{_csrfp} = $msg;
+ my $mymsg;
+ $article ||= $self->_dummy_article($req, 'Articles', \$mymsg);
+ unless ($article) {
+ require BSE::Edit::Site;
+ my $site = BSE::Edit::Site->new(cfg=>$req->cfg, db=> BSE::DB->single);
+ return $site->edit_sections($req, 'Articles', $mymsg);
+ }
return $self->_service_error($req, $article, 'Articles', $msg, \%errors);
}
projects / bse.git / commitdiff