smd_macro: Create custom virtual Txp tags that do stuff

Bloke · 2013-07-12 19:00:41

GugUser wrote:

Macro definition: <txp:file_download id="{datei}" form="datei-download" />

Must admit I’ve never tried overriding a built-in function with a macro. I’m surprised it worked at all and didn’t give you a parser error. Long shot: does it work if you rename the macro?

EDIT: failing that, it may be the parse() call that’s not working for some reason. Perhaps because of the quotes-in-quotes. My macro parser isn’t very smart. You could try:

<txp:php>echo pathinfo(file_download_name(array()), PATHINFO_EXTENSION);</txp:php>

Last edited by Bloke (2013-07-12 19:06:33)

GugUser · 2013-07-12 19:22:12

Thank you, Bloke.

I tried with file_download_name(array()) too, but it didn’t work.

None of the three suggestions helps.

Why you wrote “overriding a built-in function with a macro”? I don’t understand this.

GugUser · 2013-07-12 19:24:27

One more strange thing: In browsers, the file extension isn’t shown, but in the NetNewsWire news reader …

Bloke · 2013-07-12 19:39:35

GugUser wrote:

Why you wrote “overriding a built-in function with a macro”? I don’t understand this.

Because, according to what you wrote in the post above, your macro definition is called “file_download” which is the name of a built-in tag. Which maps to the file_download() function. Having two functions with the same name is illegal in PHP so perhaps the only reason it doesn’t error is because of the late-binding of the macro (or because your site is Live and the error is getting swallowed).

It might not be that at all, but before we investigate further, I’d eliminate the duplicate tag name by renaming the macro to something different (preferably with a gug_ prefix or something).

GugUser · 2013-07-12 19:42:28

No, no, this isn’t the tag name, it’s the macro definition. The tag name is “datei”, so the user can put the ID in <txp:datei id="1" />. This works fine, only the PHP thing don’t work.

Last edited by GugUser (2013-07-12 19:44:49)

Bloke · 2013-07-12 19:46:51

GugUser wrote:

No, no, this isn’t the tag name, it’s the macro definition.

Gotcha, sorry. I was being dim.

Bloke · 2013-07-12 19:55:57

GugUser

Weird, I just made a macro called datei with one attribute (id) which mapped to the replacement datei, put the definition of the macro in as you had it, with the form datei-download copy and pasted from your post above… and it worked. I got (txt, 17 Kb) displayed in the browser when I did <txp:datei id="21" /> inside an article.

I wonder why yours is not parsed. It’s not the value of your Allow PHP in Articles / Forms / Pages settings in Advanced Prefs?

EDIT: no it can’t be. Because it works outside the macro. Hmmm.

Last edited by Bloke (2013-07-12 20:00:08)

GugUser · 2013-07-12 20:01:21

Bloke wrote:

I wonder why yours is not parsed. It’s not the value of your Allow PHP in Articles / Forms / Pages settings in Advanced Prefs?

It’s all in “yes”.

GugUser · 2013-07-13 04:48:50

I found the reason for the problem. It has to do with the limited privileges of the “staff writer”. If an “staff writer” puts the smd_macro tag <txp:datei id="1" /> in an article, then the PHP in the form “datei-download” is not parsed, although is no PHP directly in the article. If I change the privileges of the author to “publisher”, then it works.

Unfortunately, this is not what I need. I need a solution for the “staff writer”. Any idea?

Last edited by GugUser (2013-07-13 04:50:33)

Gocom · 2013-07-13 11:56:03

GugUser wrote:

Unfortunately, this is not what I need. I need a solution for the “staff writer”. Any idea?

If you want the code work in an article, you will have to write your own tag and plugin then. These PHP limitations are a mandatory security feature.

This simple plugin could create a tag that executes the same code. E.g.

/**
 * Extracts file extension from the given statement.
 *
 * @param  array  $atts  Attributes
 * @param  string $thing Contained statement
 * @return string The file extension
 */

function gug_extension($atts, $thing)
{
     return (string) pathinfo(trim(parse($thing)), PATHINFO_EXTENSION);
}

You can then use the <txp:gug_extension /> tag to extract the extension instead of the PHP snippet:

<txp:gug_extension>
    <txp:file_download_name />
</txp:gug_extension>

PS. normally its very much not recommend to use Textpattern template tags inside an article. Stuff can change, makes updating site pretty hard and tags aren’t easy to use — they being server-side language, can end up being outright dangerous in wrong hands.

Last edited by Gocom (2013-07-13 11:59:19)

GugUser · 2013-07-14 02:19:45

Thank you Jukka for your helpful suggestion!

With this shortest plugin in the world all what I needed works now.

Here the plugin, if someone would like it:

# Name: gug_extension v0.1 
# Type: Public side plugin
# Extracts file extension from the given statement.
# Author: Jukka Svahn
# URL: http://rahforum.biz/plugins/
# Recommended load order: 5

# .....................................................................
# This is a plugin for Textpattern CMS - http://textpattern.com/
# To install: textpattern > admin > plugins
# Paste the following text into the 'Install plugin' box:
# .....................................................................

YToxMTp7czo0OiJuYW1lIjtzOjEzOiJndWdfZXh0ZW5zaW9uIjtzOjY6ImF1dGhvciI7czox
MToiSnVra2EgU3ZhaG4iO3M6MTA6ImF1dGhvcl91cmkiO3M6Mjg6Imh0dHA6Ly9yYWhmb3J1
bS5iaXovcGx1Z2lucy8iO3M6NzoidmVyc2lvbiI7czozOiIwLjEiO3M6MTE6ImRlc2NyaXB0
aW9uIjtzOjQ5OiJFeHRyYWN0cyBmaWxlIGV4dGVuc2lvbiBmcm9tIHRoZSBnaXZlbiBzdGF0
ZW1lbnQuIjtzOjQ6ImNvZGUiO3M6MjQ5OiIvKioNCiAqIEBwYXJhbSAgYXJyYXkgICRhdHRz
ICBBdHRyaWJ1dGVzDQogKiBAcGFyYW0gIHN0cmluZyAkdGhpbmcgQ29udGFpbmVkIHN0YXRl
bWVudA0KICogQHJldHVybiBzdHJpbmcgVGhlIGZpbGUgZXh0ZW5zaW9uDQogKi8NCg0KZnVu
Y3Rpb24gZ3VnX2V4dGVuc2lvbigkYXR0cywgJHRoaW5nKQ0Kew0KICAgICByZXR1cm4gKHN0
cmluZykgcGF0aGluZm8odHJpbShwYXJzZSgkdGhpbmcpKSwgUEFUSElORk9fRVhURU5TSU9O
KTsNCn0iO3M6NDoidHlwZSI7czoxOiIwIjtzOjU6Im9yZGVyIjtzOjE6IjUiO3M6NToiZmxh
Z3MiO3M6MToiMCI7czo0OiJoZWxwIjtzOjQ0MjoiPHA+U3VnZ2VzdGlvbiBieSBKdWtrYSBT
dmFobiBpbiB0aGUgPGEgaHJlZj0iaHR0cDovL2ZvcnVtLnRleHRwYXR0ZXJuLmNvbS92aWV3
dG9waWMucGhwP3BpZD0yNzQwMzcjcDI3NDAzNyI+VGV4dHBhdHRlcm4gZm9ydW08L2E+PC9w
PgoKPHA+SXQgcmVwbGFjZXMgdGhlIGZvbGxvd2luZyBzbmlwcGV0OjwvcD4KCjxwcmU+PGNv
ZGU+Jmx0O3R4cDpwaHAmZ3Q7CgllY2hvIHBhdGhpbmZvKHBhcnNlKCcmbHQ7dHhwOmZpbGVf
ZG93bmxvYWRfbmFtZSAvJmd0OycpLCBQQVRISU5GT19FWFRFTlNJT04pOwombHQ7L3R4cDpw
aHAmZ3Q7PC9wcmU+PC9jb2RlPgoKPHA+RXhhbXBsZTo8L3A+Cgo8cHJlPjxjb2RlPiZsdDt0
eHA6Z3VnX2V4dGVuc2lvbiZndDsKCSZsdDt0eHA6ZmlsZV9kb3dubG9hZF9uYW1lIC8mZ3Q7
CiZsdDsvdHhwOmd1Z19leHRlbnNpb24mZ3Q7PC9wcmU+PC9jb2RlPiI7czozOiJtZDUiO3M6
MzI6IjY3ZjgzZTZhMzU4MTgyOWE4YTU0ZWI0NjgwZjdkM2VkIjt9

GugUser · 2013-07-14 03:02:39

Gocom wrote:

PS: Normally its very much not recommend to use Textpattern template tags inside an article. Stuff can change, makes updating site pretty hard and tags aren’t easy to use — they being server-side language, can end up being outright dangerous in wrong hands.

I know. However, the only way in Textile to put a download link inside a text is basically "Flyer":/file_download/1. Other things like file type or file size must be added manually.

For this reason I createt with smd_macro a <txp:datei id="" /> tag. The staff writer only needs to insert the file ID number.

This ID is passed in smd_macro to <txp:file_download id="{datei}" form="datei-download" />, nothing more than the number. I have no idea what could be the security risk. The form “datei-download” then does the rest.

Form “datei-download” (now with the gug_extension plugin tag included):

<a href="<txp:file_download_link />"><txp:file_download_name title="1" /></a> 
(<span class="dateiformat"><txp:gug_extension><txp:file_download_name /></txp:gug_extension></span>, 
<span class="eng">
<txp:rah_replace delimiter="|" from=".|,|kB|MB" to=" |.| <abbr>KB</abbr>| <abbr>MB</abbr>">
	<txp:file_download_size decimals="0" />
</txp:rah_replace>
</span>)

By the way: In the same website, the staff writer has the option to add the file ID in a custom field, so that the download link will be shown on a fixed defined place. The file ID is passed to:

<txp:if_custom_field name="Flyer">
	<p>Flyer: <txp:file_download id='<txp:custom_field name="Flyer" />' form="datei-download" /></p>
</txp:if_custom_field>

Then the same form “datei-download” does the rest. And in this context, the part <txp:php>echo pathinfo(parse('<txp:file_download_name />'), PATHINFO_EXTENSION);</txp:php> of the earlier form “datei-download” worked perfectly. That seems a bit strange to me. What is the difference between pass the ID number via custom field or via <txp:datei id="" />?

Last edited by GugUser (2013-07-14 03:06:22)

Gocom · 2013-07-14 09:58:09

GugUser wrote:

That seems a bit strange to me. What is the difference between

The purpose is to prevent malicious PHP execution from lower-tier user accounts, using articles as the vector to get the malicious PHP in the templates and to executed.

This is what the tag would be doing, and why it will not work. The tag would include PHP to the article body from a form, so it does its thing to prevent the execution of the PHP block — its a PHP block within the article.

The custom field on the other hand, will not be containing PHP, and there is no executed code in the article itself. The custom field just contains an integer that will be responsible of changing how your templates work. This on the other hand is completely safe. The PHP itself is in the template.

sacripant · 2014-04-10 17:24:05

Hi Bloke,

I’m play with your plugin in one project.
It’s cool. Thanks

I’m a request :
I would love to code my macros from my text editor. It is possible for a future version that works with misc forms?
In the same way rah_external_output works: with a prefix in the name of forms: smd_macros_form-name.

Thanks :)

Bloke · 2014-04-10 20:33:18

sacripant wrote #280177:

future version that works with misc forms?

Glad you like the plugin. Sadly, it’s not written in such a way that it’d be easy to just swap a Form for the macro code.

I initially thought maybe the code portion could be put in a Form named smd_macro_name-of-your-macro and have it automatically read the definition from there, but when you define the macro and save it from the Macros panel, it is “compiled” into a proper function at that point so it is faster to execute when you need it. If I changed the system so the macros were compiled on-the-fly when you rendered the front side website, things would be slower.

Textpattern CMS

Textpattern CMS support forum

#76 2013-07-12 19:00:41

Re: smd_macro: Create custom virtual Txp tags that do stuff

#77 2013-07-12 19:22:12

Re: smd_macro: Create custom virtual Txp tags that do stuff

#78 2013-07-12 19:24:27

Re: smd_macro: Create custom virtual Txp tags that do stuff

#79 2013-07-12 19:39:35

Re: smd_macro: Create custom virtual Txp tags that do stuff

#80 2013-07-12 19:42:28

Re: smd_macro: Create custom virtual Txp tags that do stuff

#81 2013-07-12 19:46:51

Re: smd_macro: Create custom virtual Txp tags that do stuff

#82 2013-07-12 19:55:57

Re: smd_macro: Create custom virtual Txp tags that do stuff

#83 2013-07-12 20:01:21

Re: smd_macro: Create custom virtual Txp tags that do stuff

#84 2013-07-13 04:48:50

Re: smd_macro: Create custom virtual Txp tags that do stuff

#85 2013-07-13 11:56:03

Re: smd_macro: Create custom virtual Txp tags that do stuff

#86 2013-07-14 02:19:45

Re: smd_macro: Create custom virtual Txp tags that do stuff

#87 2013-07-14 03:02:39

Re: smd_macro: Create custom virtual Txp tags that do stuff

#88 2013-07-14 09:58:09

Re: smd_macro: Create custom virtual Txp tags that do stuff

#89 2014-04-10 17:24:05

Re: smd_macro: Create custom virtual Txp tags that do stuff

#90 2014-04-10 20:33:18

Re: smd_macro: Create custom virtual Txp tags that do stuff

sacripant wrote #280177:

Board footer