[buggy snippet] Front End Document Manager (FDM) v0.1b

ok np Good work !

I have been searching for a solution to the following problems.

I have a page with FDM 0.0.99 installed and I got it to work--no problems.

First Problem: I can’t get it to edit/save TVs. I have a tv "headline" that I want to use on the page. It is similar to the pagetitle but for the document headline of a landing page. If I use the following: FDM will display the Headline TV and I can edit it but it won’t save. I tried using the following:

This doesn’t work at all. Do I need to change something in one of the other files to make this work?

Second Problem: Every time I edit the document content in the the textarea it adds
elements. How do I make this stop.

Final and one of the more annoying problems: how do I keep this FDM from renaming my document’s alias to the pagetitle value. I am using this on landing pages that have URL’s pointing to them and when the URLs change the page 404’s on visitors (Actually sends visitors to Doc ID 1).

Bump.

Any help here would be appreciated.

Hi smashingred,

Usually, Soda, the author of this snippet, answers quickly so I think he is on holidays so we’ll have to wait for him before getting solution for our problem

Quote from: Perrine at Jul 18, 2007, 11:00 AM

Thank you Helio

swit4er, do you know how to correct this issue ? Don’t want to put my website online until this is not corrected

regular expressions will help you my brother! you just need little check for [’GET’] or [’POST’] for special characters, try to search in google i’m sure there’s a lot of example. i’m too lazy and too high to make it myself but it ain’t problem to give a piece of advice

Quote from: smashingred at Jul 22, 2007, 07:45 AM

Bump.

Any help here would be appreciated.

I’m working on FDM, trying to make it work and improve it partly.

I’m not really far yet, but for TV fields try like this:



So, add "tv" in front of the TV name, seems to be working. Like I said, I’m not really far yet (started today) but I’ll have a look on FDM code and try to fix all these little problems. I’m going to use FDM to make it easier for my users to add products and other stuff with semi-complicated structures.

I need help too, I’m a bit lost on how to add for example an input field where user could select an image from resource browser. Any ideas? Something like one does from the manager side with image TVs.

- Osku

Update - You’re better off using the earlier mentioned [[tvfields]] snippet. Just leave the ’for’ attribute on <label> like for="tvheadline"

Anyone got the &editorpageid and form rendering on a different page working? Documentation doesn’t really say much about it, just "... you must have correct FDM call on this page.". And that ’correct’ FDM call would be? Everything looks fine on the debug output, I can’t find the problem.

I currently use a call like this on my editor page:



I don’t want any buttons to show there, it’s just an editor page. The FDM call leading to my editor is simply:



Also, made a quick change to tvfields snippet. I made it look for FDM docid in session variables. This is necessary for example in my case as I want the editor page apart. Change the first few lines to look like this:



It’s probably not the most elegant solution but seems to be working for me. Now I just need to get FDM working correctly, or make myself understand how FDM works

- Osku

UPDATE!

Solved - Parameters on both of the FDM calls have to be exactly the same, because the md5 hash (seen on the urls), is generated from parameters string. Is this check really necessary?

For those who still don’t know what I’m talking about, FDM generates urls like...

... where fdmaction is composed of the actual action name and an md5 hash generated from FDM call parameters. Before rendering the editor form, FDM checks if the current FDM call md5 matches the one given in the url, + some action name. If not, nothing shows up. So a quick fix is: make sure your two fdm calls have exactly the same parameters.

@swit4er and Perrine

Quote from: swit4er at Jul 16, 2007, 01:49 PM

security issue

:) easy hack, just puting ’ or " in fdmid parametr in URL, like
?fdmaction=edit3906aaca2204bcbf366ebdb3aa1bc85a&fdmid=94’
and make any sql injection....

Are you sure this is a security issue? Did you try any injection? The fdm db class uses $modx->getPageInfo() function to get the document infos, and gives the fdmid directly there. I suppose modx functions are nowadays more or less safe.

Anyway, a quick fix for this would be to just use addslashes() on formid get variable? That way it’s safe for sql queries and only gives results if an existing document id was given. Correct me if I’m wrong, please.

I hope someone checks this topic soonish, as I’m posting a lot and am not sure about everything I’ve said

- Osku

Hi ojt,

In fact, I don’t know how to do a sql injection :p I’ve heard about it... I’ve had a phpnuke hacked with this but don’t know how to make one !

How and where to use addslashes() ?

Thanks !

Hi,

First of all thanks for this huge snippet.

I try to use FDM with the default chunk (FDMeFormTpl_FR) to edit the pub_date and unpub_date document variables.
But the value isn’t saved with the valid format, and when I edit the document again, it shows an integer value.
In the manager, I get wrong dates in 1970 so I guess it’s a date format problem.

I also use FDM in another document to edit dates in TVs (with a date formatter widget) without any problem.

Any idea?