/** * Add a form to create new comments * * @param \FrontendTemplate|object $objTemplate * @param \stdClass $objConfig * @param string $strSource * @param integer $intParent * @param mixed $varNotifies */ protected function renderCommentForm(\FrontendTemplate $objTemplate, \stdClass $objConfig, $strSource, $intParent, $varNotifies) { $this->import('FrontendUser', 'User'); // Access control if ($objConfig->requireLogin && !BE_USER_LOGGED_IN && !FE_USER_LOGGED_IN) { $objTemplate->requireLogin = true; $objTemplate->login = $GLOBALS['TL_LANG']['MSC']['com_login']; return; } // Confirm or remove a subscription if (\Input::get('token')) { static::changeSubscriptionStatus($objTemplate); return; } // Form fields $arrFields = array('name' => array('name' => 'name', 'label' => $GLOBALS['TL_LANG']['MSC']['com_name'], 'value' => trim($this->User->firstname . ' ' . $this->User->lastname), 'inputType' => 'text', 'eval' => array('mandatory' => true, 'maxlength' => 64)), 'email' => array('name' => 'email', 'label' => $GLOBALS['TL_LANG']['MSC']['com_email'], 'value' => $this->User->email, 'inputType' => 'text', 'eval' => array('rgxp' => 'email', 'mandatory' => true, 'maxlength' => 128, 'decodeEntities' => true)), 'website' => array('name' => 'website', 'label' => $GLOBALS['TL_LANG']['MSC']['com_website'], 'inputType' => 'text', 'eval' => array('rgxp' => 'url', 'maxlength' => 128, 'decodeEntities' => true))); // Captcha if (!$objConfig->disableCaptcha) { $arrFields['captcha'] = array('name' => 'captcha', 'inputType' => 'captcha', 'eval' => array('mandatory' => true)); } // Comment field $arrFields['comment'] = array('name' => 'comment', 'label' => $GLOBALS['TL_LANG']['MSC']['com_comment'], 'inputType' => 'textarea', 'eval' => array('mandatory' => true, 'rows' => 4, 'cols' => 40, 'preserveTags' => true)); // Notify me of new comments $arrFields['notify'] = array('name' => 'notify', 'label' => '', 'inputType' => 'checkbox', 'options' => array(1 => $GLOBALS['TL_LANG']['MSC']['com_notify'])); $doNotSubmit = false; $arrWidgets = array(); $strFormId = 'com_' . $strSource . '_' . $intParent; // Initialize the widgets foreach ($arrFields as $arrField) { /** @var \Widget $strClass */ $strClass = $GLOBALS['TL_FFL'][$arrField['inputType']]; // Continue if the class is not defined if (!class_exists($strClass)) { continue; } $arrField['eval']['required'] = $arrField['eval']['mandatory']; /** @var \Widget $objWidget */ $objWidget = new $strClass($strClass::getAttributesFromDca($arrField, $arrField['name'], $arrField['value'])); // Validate the widget if (\Input::post('FORM_SUBMIT') == $strFormId) { $objWidget->validate(); if ($objWidget->hasErrors()) { $doNotSubmit = true; } } $arrWidgets[$arrField['name']] = $objWidget; } $objTemplate->fields = $arrWidgets; $objTemplate->submit = $GLOBALS['TL_LANG']['MSC']['com_submit']; $objTemplate->action = ampersand(\Environment::get('request')); $objTemplate->messages = ''; // Backwards compatibility $objTemplate->formId = $strFormId; $objTemplate->hasError = $doNotSubmit; // Do not index or cache the page with the confirmation message if ($_SESSION['TL_COMMENT_ADDED']) { /** @var \PageModel $objPage */ global $objPage; $objPage->noSearch = 1; $objPage->cache = 0; $objTemplate->confirm = $GLOBALS['TL_LANG']['MSC']['com_confirm']; $_SESSION['TL_COMMENT_ADDED'] = false; } // Store the comment if (!$doNotSubmit && \Input::post('FORM_SUBMIT') == $strFormId) { $strWebsite = $arrWidgets['website']->value; // Add http:// to the website if ($strWebsite != '' && !preg_match('@^(https?://|ftp://|mailto:|#)@i', $strWebsite)) { $strWebsite = 'http://' . $strWebsite; } // Do not parse any tags in the comment $strComment = specialchars(trim($arrWidgets['comment']->value)); $strComment = str_replace(array('&', '<', '>'), array('[&]', '[lt]', '[gt]'), $strComment); // Remove multiple line feeds $strComment = preg_replace('@\\n\\n+@', "\n\n", $strComment); // Parse BBCode if ($objConfig->bbcode) { $strComment = $this->parseBbCode($strComment); } // Prevent cross-site request forgeries $strComment = preg_replace('/(href|src|on[a-z]+)="[^"]*(contao\\/main\\.php|typolight\\/main\\.php|javascript|vbscri?pt|script|alert|document|cookie|window)[^"]*"+/i', '$1="#"', $strComment); $time = time(); // Prepare the record $arrSet = array('tstamp' => $time, 'source' => $strSource, 'parent' => $intParent, 'name' => $arrWidgets['name']->value, 'email' => $arrWidgets['email']->value, 'website' => $strWebsite, 'comment' => $this->convertLineFeeds($strComment), 'ip' => $this->anonymizeIp(\Environment::get('ip')), 'date' => $time, 'published' => $objConfig->moderate ? '' : 1); // Store the comment $objComment = new \CommentsModel(); $objComment->setRow($arrSet)->save(); // Store the subscription if ($arrWidgets['notify']->value) { static::addCommentsSubscription($objComment); } // HOOK: add custom logic if (isset($GLOBALS['TL_HOOKS']['addComment']) && is_array($GLOBALS['TL_HOOKS']['addComment'])) { foreach ($GLOBALS['TL_HOOKS']['addComment'] as $callback) { $this->import($callback[0]); $this->{$callback[0]}->{$callback[1]}($objComment->id, $arrSet, $this); } } // Prepare the notification mail $objEmail = new \Email(); $objEmail->from = $GLOBALS['TL_ADMIN_EMAIL']; $objEmail->fromName = $GLOBALS['TL_ADMIN_NAME']; $objEmail->subject = sprintf($GLOBALS['TL_LANG']['MSC']['com_subject'], \Idna::decode(\Environment::get('host'))); // Convert the comment to plain text $strComment = strip_tags($strComment); $strComment = \StringUtil::decodeEntities($strComment); $strComment = str_replace(array('[&]', '[lt]', '[gt]'), array('&', '<', '>'), $strComment); // Add the comment details $objEmail->text = sprintf($GLOBALS['TL_LANG']['MSC']['com_message'], $arrSet['name'] . ' (' . $arrSet['email'] . ')', $strComment, \Idna::decode(\Environment::get('base')) . \Environment::get('request'), \Idna::decode(\Environment::get('base')) . 'contao/main.php?do=comments&act=edit&id=' . $objComment->id); // Do not send notifications twice if (is_array($varNotifies)) { $objEmail->sendTo(array_unique($varNotifies)); } elseif ($varNotifies != '') { $objEmail->sendTo($varNotifies); // see #5443 } // Pending for approval if ($objConfig->moderate) { $_SESSION['TL_COMMENT_ADDED'] = true; } else { static::notifyCommentsSubscribers($objComment); } $this->reload(); } }
/** * Add comments to a template * @param \FrontendTemplate * @param \stdClass * @param string * @param integer * @param array */ public function addCommentsToTemplate(\FrontendTemplate $objTemplate, \stdClass $objConfig, $strSource, $intParent, $arrNotifies) { global $objPage; $limit = 0; $offset = 0; $total = 0; $gtotal = 0; $arrComments = array(); $objTemplate->comments = array(); // see #4064 // Pagination if ($objConfig->perPage > 0) { // Get the total number of comments $intTotal = \CommentsModel::countPublishedBySourceAndParent($strSource, $intParent); $total = $gtotal = $intTotal; // Get the current page $id = 'page_c' . $this->id; $page = \Input::get($id) ?: 1; // Do not index or cache the page if the page number is outside the range if ($page < 1 || $page > max(ceil($total / $objConfig->perPage), 1)) { global $objPage; $objPage->noSearch = 1; $objPage->cache = 0; // Send a 404 header header('HTTP/1.1 404 Not Found'); $objTemplate->allowComments = false; return; } // Set limit and offset $limit = $objConfig->perPage; $offset = ($page - 1) * $objConfig->perPage; // Initialize the pagination menu $objPagination = new \Pagination($total, $objConfig->perPage, 7, $id); $objTemplate->pagination = $objPagination->generate("\n "); } $objTemplate->allowComments = true; // Get all published comments if ($limit) { $objComments = \CommentsModel::findPublishedBySourceAndParent($strSource, $intParent, $limit, $offset); } else { $objComments = \CommentsModel::findPublishedBySourceAndParent($strSource, $intParent); } if ($objComments !== null && ($total = $objComments->count()) > 0) { $count = 0; if ($objConfig->template == '') { $objConfig->template = 'com_default'; } $objPartial = new \FrontendTemplate($objConfig->template); while ($objComments->next()) { $objPartial->setData($objComments->row()); // Clean the RTE output if ($objPage->outputFormat == 'xhtml') { $objComments->comment = \String::toXhtml($objComments->comment); } else { $objComments->comment = \String::toHtml5($objComments->comment); } $objPartial->comment = trim(str_replace(array('{{', '}}'), array('{{', '}}'), $objComments->comment)); $objPartial->datim = $this->parseDate($objPage->datimFormat, $objComments->date); $objPartial->date = $this->parseDate($objPage->dateFormat, $objComments->date); $objPartial->class = ($count < 1 ? ' first' : '') . ($count >= $total - 1 ? ' last' : '') . ($count % 2 == 0 ? ' even' : ' odd'); $objPartial->by = $GLOBALS['TL_LANG']['MSC']['comment_by']; $objPartial->id = 'c' . $objComments->id; $objPartial->timestamp = $objComments->date; $objPartial->datetime = date('Y-m-d\\TH:i:sP', $objComments->date); $objPartial->addReply = false; // Reply if ($objComments->addReply && $objComments->reply != '') { if (($objAuthor = $objComments->getRelated('author')) !== null) { $objPartial->addReply = true; $objPartial->rby = $GLOBALS['TL_LANG']['MSC']['reply_by']; $objPartial->reply = $this->replaceInsertTags($objComments->reply); $objPartial->author = $objAuthor; // Clean the RTE output if ($objPage->outputFormat == 'xhtml') { $objPartial->reply = \String::toXhtml($objPartial->reply); } else { $objPartial->reply = \String::toHtml5($objPartial->reply); } } } $arrComments[] = $objPartial->parse(); ++$count; } } $objTemplate->comments = $arrComments; $objTemplate->addComment = $GLOBALS['TL_LANG']['MSC']['addComment']; $objTemplate->name = $GLOBALS['TL_LANG']['MSC']['com_name']; $objTemplate->email = $GLOBALS['TL_LANG']['MSC']['com_email']; $objTemplate->website = $GLOBALS['TL_LANG']['MSC']['com_website']; $objTemplate->commentsTotal = $limit ? $gtotal : $total; // Get the front end user object $this->import('FrontendUser', 'User'); // Access control if ($objConfig->requireLogin && !BE_USER_LOGGED_IN && !FE_USER_LOGGED_IN) { $objTemplate->requireLogin = true; return; } // Form fields $arrFields = array('name' => array('name' => 'name', 'label' => $GLOBALS['TL_LANG']['MSC']['com_name'], 'value' => trim($this->User->firstname . ' ' . $this->User->lastname), 'inputType' => 'text', 'eval' => array('mandatory' => true, 'maxlength' => 64)), 'email' => array('name' => 'email', 'label' => $GLOBALS['TL_LANG']['MSC']['com_email'], 'value' => $this->User->email, 'inputType' => 'text', 'eval' => array('rgxp' => 'email', 'mandatory' => true, 'maxlength' => 128, 'decodeEntities' => true)), 'website' => array('name' => 'website', 'label' => $GLOBALS['TL_LANG']['MSC']['com_website'], 'inputType' => 'text', 'eval' => array('rgxp' => 'url', 'maxlength' => 128, 'decodeEntities' => true))); // Captcha if (!$objConfig->disableCaptcha) { $arrFields['captcha'] = array('name' => 'captcha', 'inputType' => 'captcha', 'eval' => array('mandatory' => true)); } // Comment field $arrFields['comment'] = array('name' => 'comment', 'label' => $GLOBALS['TL_LANG']['MSC']['com_comment'], 'inputType' => 'textarea', 'eval' => array('mandatory' => true, 'rows' => 4, 'cols' => 40, 'preserveTags' => true)); $doNotSubmit = false; $arrWidgets = array(); $strFormId = 'com_' . $strSource . '_' . $intParent; // Initialize widgets foreach ($arrFields as $arrField) { $strClass = $GLOBALS['TL_FFL'][$arrField['inputType']]; // Continue if the class is not defined if (!$this->classFileExists($strClass)) { continue; } $arrField['eval']['required'] = $arrField['eval']['mandatory']; $objWidget = new $strClass($this->prepareForWidget($arrField, $arrField['name'], $arrField['value'])); // Validate the widget if (\Input::post('FORM_SUBMIT') == $strFormId) { $objWidget->validate(); if ($objWidget->hasErrors()) { $doNotSubmit = true; } } $arrWidgets[$arrField['name']] = $objWidget; } $objTemplate->fields = $arrWidgets; $objTemplate->submit = $GLOBALS['TL_LANG']['MSC']['com_submit']; $objTemplate->action = ampersand(\Environment::get('request')); $objTemplate->messages = ''; // Backwards compatibility $objTemplate->formId = $strFormId; $objTemplate->hasError = $doNotSubmit; // Do not index or cache the page with the confirmation message if ($_SESSION['TL_COMMENT_ADDED']) { global $objPage; $objPage->noSearch = 1; $objPage->cache = 0; $objTemplate->confirm = $GLOBALS['TL_LANG']['MSC']['com_confirm']; $_SESSION['TL_COMMENT_ADDED'] = false; } // Add the comment if (!$doNotSubmit && \Input::post('FORM_SUBMIT') == $strFormId) { $strWebsite = $arrWidgets['website']->value; // Add http:// to the website if ($strWebsite != '' && !preg_match('@^(https?://|ftp://|mailto:|#)@i', $strWebsite)) { $strWebsite = 'http://' . $strWebsite; } // Do not parse any tags in the comment $strComment = htmlspecialchars(trim($arrWidgets['comment']->value)); $strComment = str_replace(array('&', '<', '>'), array('[&]', '[lt]', '[gt]'), $strComment); // Remove multiple line feeds $strComment = preg_replace('@\\n\\n+@', "\n\n", $strComment); // Parse BBCode if ($objConfig->bbcode) { $strComment = $this->parseBbCode($strComment); } // Prevent cross-site request forgeries $strComment = preg_replace('/(href|src|on[a-z]+)="[^"]*(contao\\/main\\.php|typolight\\/main\\.php|javascript|vbscri?pt|script|alert|document|cookie|window)[^"]*"+/i', '$1="#"', $strComment); $time = time(); // Prepare the record $arrSet = array('source' => $strSource, 'parent' => $intParent, 'tstamp' => $time, 'name' => $arrWidgets['name']->value, 'email' => $arrWidgets['email']->value, 'website' => $strWebsite, 'comment' => $this->convertLineFeeds($strComment), 'ip' => $this->anonymizeIp(\Environment::get('ip')), 'date' => $time, 'published' => $objConfig->moderate ? '' : 1); $objComment = new \CommentsModel(); $objComment->setRow($arrSet); $objComment->save(); $insertId = $objComment->id; // HOOK: add custom logic if (isset($GLOBALS['TL_HOOKS']['addComment']) && is_array($GLOBALS['TL_HOOKS']['addComment'])) { foreach ($GLOBALS['TL_HOOKS']['addComment'] as $callback) { $this->import($callback[0]); $this->{$callback}[0]->{$callback}[1]($insertId, $arrSet, $this); } } // Notification $objEmail = new \Email(); $objEmail->from = $GLOBALS['TL_ADMIN_EMAIL']; $objEmail->fromName = $GLOBALS['TL_ADMIN_NAME']; $objEmail->subject = sprintf($GLOBALS['TL_LANG']['MSC']['com_subject'], \Environment::get('host')); // Convert the comment to plain text $strComment = strip_tags($strComment); $strComment = \String::decodeEntities($strComment); $strComment = str_replace(array('[&]', '[lt]', '[gt]'), array('&', '<', '>'), $strComment); // Add comment details $objEmail->text = sprintf($GLOBALS['TL_LANG']['MSC']['com_message'], $arrSet['name'] . ' (' . $arrSet['email'] . ')', $strComment, \Environment::get('base') . \Environment::get('request'), \Environment::get('base') . 'contao/main.php?do=comments&act=edit&id=' . $insertId); // Do not send notifications twice if (is_array($arrNotifies)) { $arrNotifies = array_unique($arrNotifies); } $objEmail->sendTo($arrNotifies); // Pending for approval if ($objConfig->moderate) { $_SESSION['TL_COMMENT_ADDED'] = true; } $this->reload(); } }
/** * Neueintag bearbeiten * * Neueingetragenen Eintrag bearbeiten, * speichern und Benachrichtigungsmail senden * * @param int $intId ID des neu eingetragenen Gästebucheintrages * @param array $arrComment Array mit neuem Gästebucheintrag * * @return void */ public function nlshAddComment($intId, $arrComment) { $this->import('Input'); /* Step by step $tl_article = $this->Database ->prepare("SELECT * FROM tl_article WHERE `pid` = ? " ) ->execute($arrComment['parent']); $tl_content = $this->Database ->prepare("SELECT * FROM tl_content WHERE `pid` = ? AND `type` = 'module'" ) ->execute($tl_article->id); $tlModule = $this->Database ->prepare("SELECT * FROM tl_module WHERE `id` = ?" ) ->execute($tl_content->module); End Step by step */ // Dank an thkuhn #23 $this->tlModule = $this->Database->prepare("SELECT m.*\n FROM tl_module m\n INNER JOIN tl_content c ON (m.id=c.`module`)\n INNER JOIN tl_article a ON (c.pid=a.id)\n WHERE c.`type`=? AND m.`type`=? AND a.pid=?")->limit(1)->execute('module', 'nlsh_guestbook', $arrComment['parent']); // nur wenn Eintrag vom Modul 'nlsh_guestbook' if ($this->tlModule->type == 'nlsh_guestbook') { // Löschen, da es Probleme beim purem Update des Eintrages gab // es ging weder über die Models, noch über ein einfaches // UPDATE des SQL- Eintrages, diese wurden ignoriert // siehe #20 $this->Database->prepare("DELETE FROM `tl_comments` WHERE `tl_comments` . `id` = ?")->execute($intId); // Smilies außerhalb der Extension hinzufügen $source = 'system/modules/nlsh_guestbook/html/smilies/'; $arrSmilies = $this->arrSmilies; $arrSmilies[] = array(':-)', '', 'smile.gif'); $arrSmilies[] = array(':-(', '', 'sad.gif'); $arrSmilies[] = array(';-)', '', 'wink.gif'); // Smilies ersetzen for ($b = 0, $count = count($arrSmilies); $b < $count; $b++) { $imageTag = sprintf('<img src="%s%s" title="%s" alt="Smile" />', $source, $arrSmilies[$b][2], $arrSmilies[$b][0]); $arrComment['comment'] = str_replace($arrSmilies[$b][0], $imageTag, $arrComment['comment']); } // Überschrift zum Kommentar hinzufügen if ($this->Input->post('headline')) { $headline = $this->checkString($this->Input->post('headline')); $arrComment['comment'] = '[h]' . $headline . '[/h]' . $arrComment['comment']; } // Datensatz in Datenbank eintragen $objComment = new \CommentsModel(); $objComment->setRow($arrComment)->save(); // Benachrichtigungs- Mail erstellen und senden, wenn gewünscht if ($this->tlModule->com_nlsh_gb_bolMail == TRUE) { $this->import('Email'); $email = new \email(); $email->subject = $GLOBALS['TL_LANG']['nlsh_guestbook']['email_subject']; $email->html = str_replace('[h]', '<h1>', $arrComment['comment']); $email->html = str_replace('[/h]', '</h1>', $email->html); $email->sendTo($this->tlModule->com_nlsh_gb_email); } } }
protected function commentsController() { $returnarray['error'] = $this->errorcode(0); $returnarray['changes'] = 1; $getTs = \Input::get($this->request['ts']); $getId = \Input::get($this->request['id']); $returnarray['ts'] = isset($getTs) ? $getTs : 0; if (isset($getId)) { if (\Input::get($this->request['action']) == 'add') { $comment = $_REQUEST[$this->request['comment']]; $name = $_REQUEST[$this->request['name']]; $email = $_REQUEST[$this->request['email']]; $key = $_REQUEST[$this->request['key']]; if (!$comment || $comment == "" || !$name || !$email) { $returnarray['error'] = $this->errorcode(30); } elseif (!\Validator::isEmail($email)) { $returnarray['error'] = $this->errorcode(31); } else { $ts = time(); $arrInsert = array('tstamp' => $ts, 'source' => 'tl_news', 'parent' => $getId, 'date' => $ts, 'name' => $name, 'email' => $email, 'comment' => trim($comment), 'published' => $this->settings['news_moderate'] == 1 ? 0 : 1, 'ip' => \Environment::get('remote_addr')); $objComment = new \CommentsModel(); $objComment->setRow($arrInsert)->save(); if ($objComment->id) { $strComment = $_REQUEST[$this->request['comment']]; $strComment = strip_tags($strComment); $strComment = \String::decodeEntities($strComment); $strComment = str_replace(array('[&]', '[lt]', '[gt]'), array('&', '<', '>'), $strComment); $objTemplate = new \FrontendTemplate('kommentar_email'); $objTemplate->name = $arrInsert['name'] . ' (' . $arrInsert['email'] . ')'; $objTemplate->comment = $strComment; $objTemplate->edit = \Idna::decode(\Environment::get('base')) . 'contao/main.php?do=comments&act=edit&id=' . $objComment->id; $objEmail = new \Email(); $objEmail->from = $GLOBALS['TL_ADMIN_EMAIL']; $objEmail->fromName = $GLOBALS['TL_ADMIN_NAME']; $objEmail->subject = sprintf($GLOBALS['TL_LANG']['MSC']['com_subject'], \Idna::decode(\Environment::get('host'))); $objEmail->text = $objTemplate->parse(); if ($GLOBALS['TL_ADMIN_EMAIL'] != '') { $objEmail->sendTo($GLOBALS['TL_ADMIN_EMAIL']); } $returnarray['error'] = $this->errorcode(0); $returnarray['ts'] = $ts; $returnarray['comment_id'] = $objComment->id; $returnarray['changes'] = 1; $returnarray['status'] = $this->settings['news_moderate'] == 1 ? 'Kommentar wird geprüft.' : "Kommentar veröffentlicht."; } else { $returnarray['error'] = $this->errorcode(31); } } } else { $post = $this->getComment($getId); if ($post['commentStatus'] == 'open') { $returnarray['comment_status'] = $post['commentStatus']; $returnarray['comments_count'] = $post['commentsCount']; $returnarray['REQUEST_TOKEN'] = REQUEST_TOKEN; if ($post['commentsCount'] > 0) { $pos = 0; foreach ($post['items'] as $comment) { $tempArray = array(); $tempArray['pos'] = ++$pos; $tempArray['id'] = $comment->id; $tempArray['text'] = strip_tags($comment->comment); $tempArray['timestamp'] = (int) $comment->date; if ($tempArray['timestamp'] > $returnarray['ts']) { $returnarray['ts'] = $tempArray['timestamp']; $returnarray['changes'] = 1; } $tempArray['datum'] = date('d.m.Y, H:i', $tempArray['timestamp']); $tempArray['author']['name'] = $comment->name; $tempArray['author']['id'] = "0"; $tempArray['author']['email'] = $comment->email; $tempArray['author']['img'] = ""; if ($comment->addReply) { $objUser = \UserModel::findByPk($comment->author); $tempArray['subitems'] = array(array('pos' => 1, 'id' => 1, 'parent_id' => $comment->id, 'text' => strip_tags($comment->reply), 'timestamp' => (int) $comment->tstamp, 'datum' => date('d.m.Y, H:i', $comment->tstamp), 'author' => array('name' => $objUser->name, 'id' => $objUser->id, 'email' => $objUser->email, 'img' => ""))); } $returnarray['items'][] = $tempArray; } if ($returnarray['changes'] != 1) { unset($returnarray['items']); } } } else { $returnarray['error'] = $this->errorcode(29); } } } else { $returnarray['error'] = $this->errorcode(15); } return array('comments' => $returnarray); }