We launched new forums in March 2019—join us there. In a hurry for help with your website? Get Help Now!
MODX Community Forums Archive

Does setContent check permissions?

    • 40735
    • 119 Posts
    David Reply #1, 13 years, 10 months ago
    I have a snippet that I've written and placed on a page with no template that I use as a service for updating pages from a front-end editor that I've built. Here's the code:
    <?php
$id = $_POST["id"];
$title = $_POST["title"];
$copy = $_POST["copy"];

$resource = $modx->getObject("modResource", $id);
if(is_null($resource)) return "Failed to get resource $id.";

$resource->setContent($copy);
$resource->set("pagetitle", $title);
$resource->save();

$cm = $modx->getCacheManager();
$cm->refresh();

return 1;
?>

    Does MODx assume that I have checked to see if the user that initiated the call has permission to update the requested resource or does it do that for me? Also, if there's a better way to accomplish this I'd love to hear suggestions.
    Thanks!
      • 3186 ☆ A M B ☆
      • 279 Posts
      bertoost Reply #2, 13 years, 10 months ago
      Dave,
      As far I can see, $resource->setContent($copy); is the same as $resource->set('content', $copy);
      So it will not check your permissions.

      However; modResource is extending from the cores' modAccessibleSimpleObject and as far my knowledge will go, is this a default interface that checks the permissions. So basically it should be checked I think.

      Near to that;
      Why do you not use FormIt and a hook to process the save of your resource? You can easily add validations to your form etc. because FormIt provides you that. smiley I mostly do it that way wink
        MODX Ambassador (NL) & Professional MODX developer
        Follow me on Twitter | Visit my page on Facebook | View my code on Github | View my script posts
        MODX e-commerce solution SimpleCart
        • 40735
        • 119 Posts
        David Reply #3, 13 years, 10 months ago
        Quote from: bertoost at Dec 13, 2012, 03:16 PM
        Dave,
        As far I can see, $resource->setContent($copy); is the same as $resource->set('content', $copy);
        So it will not check your permissions.

        However; modResource is extending from the cores' modAccessibleSimpleObject and as far my knowledge will go, is this a default interface that checks the permissions. So basically it should be checked I think.

        Near to that;
        Why do you not use FormIt and a hook to process the save of your resource? You can easily add validations to your form etc. because FormIt provides you that. smiley I mostly do it that way wink

        I have seen FormIt mentioned in a few places but I haven't really looked into it. It seems like it was made for working with forms and even though I know it will create resources and probably update them as well, I don't really want to hack it into doing something it wasn't intended to do so I decided to roll my own, purpose-built script. Maybe I should give FormIt a more serious look though?
          • 3186 ☆ A M B ☆
          • 279 Posts
          bertoost Reply #4, 13 years, 10 months ago
          I always use FormIt as base for my front-end forms.. Whether or not they need to email, redirect, save things etc.. It's my base for all type of forms. MODX == creative freedom ;-) so you can do whatever you want, I only like the way FormIt works and I think you should not re-invent the wheel a second time ;-)
            MODX Ambassador (NL) & Professional MODX developer
            Follow me on Twitter | Visit my page on Facebook | View my code on Github | View my script posts
            MODX e-commerce solution SimpleCart
            • 18373 ☆ A M B ☆
            • 3,141 Posts
            Mark Hamstra Reply #5, 13 years, 10 months ago
            As Bert says, setContent just sets the content field and ia a common way to set an objects' content.. even for things like chunks where the content field is named "snippet" for legacy reasons, setContent sets the snippet field in that case.

            The permissions of the user will be checked in retrieving the object (getObject) and calling the save method.
              Mark Hamstra • Developer spending his days working on Premium Extras and a MODX Site Dashboard with the ability to remotely upgrade MODX and extras to make the MODX world a little better.

              Tweet me @mark_hamstra, check my infrequent blog at markhamstra.com, my slightly more frequent ramblings at MODX.today or see code at Github.
              • 40735
              • 119 Posts
              David Reply #6, 13 years, 10 months ago
              Quote from: markh at Dec 13, 2012, 03:47 PM
              As Bert says, setContent just sets the content field and ia a common way to set an objects' content.. even for things like chunks where the content field is named "snippet" for legacy reasons, setContent sets the snippet field in that case.

              The permissions of the user will be checked in retrieving the object (getObject) and calling the save method.

              Yeah, I didn't word my question very well. So the long and short of it is that I don't need to do any permissions checking myself, yes?
                • 22303 MODX Staff
                • 10,725 Posts
                opengeek Reply #7, 13 years, 10 months ago
                setContent does not save the content. It only sets it to a new value in order to be updated when save() is called on the object. The save() method will check the save permission on a modAccessible*Object derivative like modResource.
                  Jason Coward
                  Chief Architect @ MODX
                  http://www.jasoncoward.com | http://twitter.com/drumshaman | https://github.com/opengeek
                  • 40735
                  • 119 Posts
                  David Reply #8, 13 years, 10 months ago
                  That is exactly what I needed to know. Thanks!