smd_macro: Create custom virtual Txp tags that do stuff

Gocom · 2013-07-13 11:56:03

GugUser wrote:

Unfortunately, this is not what I need. I need a solution for the “staff writer”. Any idea?

If you want the code work in an article, you will have to write your own tag and plugin then. These PHP limitations are a mandatory security feature.

This simple plugin could create a tag that executes the same code. E.g.

/**
 * Extracts file extension from the given statement.
 *
 * @param  array  $atts  Attributes
 * @param  string $thing Contained statement
 * @return string The file extension
 */

function gug_extension($atts, $thing)
{
     return (string) pathinfo(trim(parse($thing)), PATHINFO_EXTENSION);
}

You can then use the <txp:gug_extension /> tag to extract the extension instead of the PHP snippet:

<txp:gug_extension>
    <txp:file_download_name />
</txp:gug_extension>

PS. normally its very much not recommend to use Textpattern template tags inside an article. Stuff can change, makes updating site pretty hard and tags aren’t easy to use — they being server-side language, can end up being outright dangerous in wrong hands.

Last edited by Gocom (2013-07-13 11:59:19)

GugUser · 2013-07-14 02:19:45

Thank you Jukka for your helpful suggestion!

With this shortest plugin in the world all what I needed works now.

Here the plugin, if someone would like it:

# Name: gug_extension v0.1 
# Type: Public side plugin
# Extracts file extension from the given statement.
# Author: Jukka Svahn
# URL: http://rahforum.biz/plugins/
# Recommended load order: 5

# .....................................................................
# This is a plugin for Textpattern CMS - http://textpattern.com/
# To install: textpattern > admin > plugins
# Paste the following text into the 'Install plugin' box:
# .....................................................................

YToxMTp7czo0OiJuYW1lIjtzOjEzOiJndWdfZXh0ZW5zaW9uIjtzOjY6ImF1dGhvciI7czox
MToiSnVra2EgU3ZhaG4iO3M6MTA6ImF1dGhvcl91cmkiO3M6Mjg6Imh0dHA6Ly9yYWhmb3J1
bS5iaXovcGx1Z2lucy8iO3M6NzoidmVyc2lvbiI7czozOiIwLjEiO3M6MTE6ImRlc2NyaXB0
aW9uIjtzOjQ5OiJFeHRyYWN0cyBmaWxlIGV4dGVuc2lvbiBmcm9tIHRoZSBnaXZlbiBzdGF0
ZW1lbnQuIjtzOjQ6ImNvZGUiO3M6MjQ5OiIvKioNCiAqIEBwYXJhbSAgYXJyYXkgICRhdHRz
ICBBdHRyaWJ1dGVzDQogKiBAcGFyYW0gIHN0cmluZyAkdGhpbmcgQ29udGFpbmVkIHN0YXRl
bWVudA0KICogQHJldHVybiBzdHJpbmcgVGhlIGZpbGUgZXh0ZW5zaW9uDQogKi8NCg0KZnVu
Y3Rpb24gZ3VnX2V4dGVuc2lvbigkYXR0cywgJHRoaW5nKQ0Kew0KICAgICByZXR1cm4gKHN0
cmluZykgcGF0aGluZm8odHJpbShwYXJzZSgkdGhpbmcpKSwgUEFUSElORk9fRVhURU5TSU9O
KTsNCn0iO3M6NDoidHlwZSI7czoxOiIwIjtzOjU6Im9yZGVyIjtzOjE6IjUiO3M6NToiZmxh
Z3MiO3M6MToiMCI7czo0OiJoZWxwIjtzOjQ0MjoiPHA+U3VnZ2VzdGlvbiBieSBKdWtrYSBT
dmFobiBpbiB0aGUgPGEgaHJlZj0iaHR0cDovL2ZvcnVtLnRleHRwYXR0ZXJuLmNvbS92aWV3
dG9waWMucGhwP3BpZD0yNzQwMzcjcDI3NDAzNyI+VGV4dHBhdHRlcm4gZm9ydW08L2E+PC9w
PgoKPHA+SXQgcmVwbGFjZXMgdGhlIGZvbGxvd2luZyBzbmlwcGV0OjwvcD4KCjxwcmU+PGNv
ZGU+Jmx0O3R4cDpwaHAmZ3Q7CgllY2hvIHBhdGhpbmZvKHBhcnNlKCcmbHQ7dHhwOmZpbGVf
ZG93bmxvYWRfbmFtZSAvJmd0OycpLCBQQVRISU5GT19FWFRFTlNJT04pOwombHQ7L3R4cDpw
aHAmZ3Q7PC9wcmU+PC9jb2RlPgoKPHA+RXhhbXBsZTo8L3A+Cgo8cHJlPjxjb2RlPiZsdDt0
eHA6Z3VnX2V4dGVuc2lvbiZndDsKCSZsdDt0eHA6ZmlsZV9kb3dubG9hZF9uYW1lIC8mZ3Q7
CiZsdDsvdHhwOmd1Z19leHRlbnNpb24mZ3Q7PC9wcmU+PC9jb2RlPiI7czozOiJtZDUiO3M6
MzI6IjY3ZjgzZTZhMzU4MTgyOWE4YTU0ZWI0NjgwZjdkM2VkIjt9

GugUser · 2013-07-14 03:02:39

Gocom wrote:

PS: Normally its very much not recommend to use Textpattern template tags inside an article. Stuff can change, makes updating site pretty hard and tags aren’t easy to use — they being server-side language, can end up being outright dangerous in wrong hands.

I know. However, the only way in Textile to put a download link inside a text is basically "Flyer":/file_download/1. Other things like file type or file size must be added manually.

For this reason I createt with smd_macro a <txp:datei id="" /> tag. The staff writer only needs to insert the file ID number.

This ID is passed in smd_macro to <txp:file_download id="{datei}" form="datei-download" />, nothing more than the number. I have no idea what could be the security risk. The form “datei-download” then does the rest.

Form “datei-download” (now with the gug_extension plugin tag included):

<a href="<txp:file_download_link />"><txp:file_download_name title="1" /></a> 
(<span class="dateiformat"><txp:gug_extension><txp:file_download_name /></txp:gug_extension></span>, 
<span class="eng">
<txp:rah_replace delimiter="|" from=".|,|kB|MB" to=" |.| <abbr>KB</abbr>| <abbr>MB</abbr>">
	<txp:file_download_size decimals="0" />
</txp:rah_replace>
</span>)

By the way: In the same website, the staff writer has the option to add the file ID in a custom field, so that the download link will be shown on a fixed defined place. The file ID is passed to:

<txp:if_custom_field name="Flyer">
	<p>Flyer: <txp:file_download id='<txp:custom_field name="Flyer" />' form="datei-download" /></p>
</txp:if_custom_field>

Then the same form “datei-download” does the rest. And in this context, the part <txp:php>echo pathinfo(parse('<txp:file_download_name />'), PATHINFO_EXTENSION);</txp:php> of the earlier form “datei-download” worked perfectly. That seems a bit strange to me. What is the difference between pass the ID number via custom field or via <txp:datei id="" />?

Last edited by GugUser (2013-07-14 03:06:22)

Gocom · 2013-07-14 09:58:09

GugUser wrote:

That seems a bit strange to me. What is the difference between

The purpose is to prevent malicious PHP execution from lower-tier user accounts, using articles as the vector to get the malicious PHP in the templates and to executed.

This is what the tag would be doing, and why it will not work. The tag would include PHP to the article body from a form, so it does its thing to prevent the execution of the PHP block — its a PHP block within the article.

The custom field on the other hand, will not be containing PHP, and there is no executed code in the article itself. The custom field just contains an integer that will be responsible of changing how your templates work. This on the other hand is completely safe. The PHP itself is in the template.

sacripant · 2014-04-10 17:24:05

Hi Bloke,

I’m play with your plugin in one project.
It’s cool. Thanks

I’m a request :
I would love to code my macros from my text editor. It is possible for a future version that works with misc forms?
In the same way rah_external_output works: with a prefix in the name of forms: smd_macros_form-name.

Thanks :)

Bloke · 2014-04-10 20:33:18

sacripant wrote #280177:

future version that works with misc forms?

Glad you like the plugin. Sadly, it’s not written in such a way that it’d be easy to just swap a Form for the macro code.

I initially thought maybe the code portion could be put in a Form named smd_macro_name-of-your-macro and have it automatically read the definition from there, but when you define the macro and save it from the Macros panel, it is “compiled” into a proper function at that point so it is faster to execute when you need it. If I changed the system so the macros were compiled on-the-fly when you rendered the front side website, things would be slower.

sacripant · 2014-04-11 14:11:39

Thank you for the reply, I understand

unfortunately it excluded the possibility of including coding macros in a workflow with a version code system (using GIT with cnk_versionning or rah_flat).

It is not possible to compile a form with a callback when it is modified / saved in the database?

With this type of form markup I would have been happy :

/*
[macros_name]
description = "macros description"
attributes[] = "attr|default-val|"
*/

<h1>macros-code</h1>

I don’t like coding in the back office of Textpattern

Bloke · 2014-04-11 14:57:48

sacripant wrote #280191:

It is not possible to compile a form with a callback when it is modified / saved in the database?

Yes, it’s possible but I couldn’t think of a neat way to represent the attributes and stuff. Your suggestion might work, though all that extra typing is hardly intuitive and may be prone to error. Ideally the format would mimic the import/export ini format so I wouldn’t have to write much extra code, but the macro content is BASE64 encoded which is not very user friendly! Leave it with me and I’ll see if I can make it create/update macros on Form save.

Presumably with cnk_versioning, when you save a Form outside Txp, it magically calls the actual internal Textpattern function to save the Form to the database, so I can just hook into the regular admin-side Form->Save callback? Not sure how that plugin works as I’ve never used it.

sacripant · 2014-04-11 19:52:02

Cool, hope is back.

Advantages to use Form for compose macros:

For users who codes from the back-office

Use the Tag builder to compose macros.
Better experience with use a plugin like spf_codemirror to compose macros.

For users who want to use a text editor

To code macros using cnk_versionning or rah_flat.
be able versioning macro code.

For you

Simplify the plugin: no longer need to maintain a specific tab in the back office

Disadvantages:

Lose Export/Import Functionnality, but Import But can be replaced by a simple copy/past in a form.
Need to learn the Header syntax for defining attribut, but a simple explanation and exemple in plugin Help…

I hope I have finally convinced you ^^

Bloke · 2014-04-11 21:44:14

sacripant wrote #280195:

Simplify the plugin: no longer need to maintain a specific tab in the back office

Well I wasn’t going to remove the existing functionality. I was hoping to have the two run side-by-side. If you save a Form named smd_macro_megatag and it conforms to the right format, it’ll insert that as a macro into the database. If you then visit Content->Macros, you’ll see megatag there too and it can be edited there if you wish. Any changes you make there will be reflected in the smd_macro_megatag Form.

I might have to think about some preference (or something) to enable this facility because otherwise people who prefer editing in the admin interface and don’t want to clutter their Forms with macros would be able to continue to work as they do now. My current thinking is that deleting a macro from the Forms panel would delete it from the database and therefore also from the Content->Macros panel. I think a preference for governing whether macros are edited inside Forms, from an admin panel, or both would suffice.

sacripant · 2014-04-14 12:22:10

Personally, if you want to offer users to keep editing and creation of macros from a specific tag, I think it’s a bad idea to propose two systems simultaneously.
This could be quite confusing to the user and subject to errors.

In my opinion, a preference that allows the user to choose one or the other method would be less disruptive.

But what does happen if the user decides to switch from one system to another while macros already exist?

GugUser · 2014-07-06 00:28:57

An observation:

When I use smd_macro and the specified language in Textpattern is German, then under “Content“ (“Inhalt”) I see “Macros” and all the labels are in English (no problem). But, if I specified the language to Spanish, then under “Content“ (“Contenido”) I see “smd_macro_tab_name” and many labels are different as for example “smd_macro_tag_definition”. Where can I change this?

Textpattern CMS

Textpattern CMS support forum

#85 2013-07-13 11:56:03

Re: smd_macro: Create custom virtual Txp tags that do stuff

#86 2013-07-14 02:19:45

Re: smd_macro: Create custom virtual Txp tags that do stuff

#87 2013-07-14 03:02:39

Re: smd_macro: Create custom virtual Txp tags that do stuff

#88 2013-07-14 09:58:09

Re: smd_macro: Create custom virtual Txp tags that do stuff

#89 2014-04-10 17:24:05

Re: smd_macro: Create custom virtual Txp tags that do stuff

#90 2014-04-10 20:33:18

Re: smd_macro: Create custom virtual Txp tags that do stuff

sacripant wrote #280177:

#91 2014-04-11 14:11:39

Re: smd_macro: Create custom virtual Txp tags that do stuff

#92 2014-04-11 14:57:48

Re: smd_macro: Create custom virtual Txp tags that do stuff

sacripant wrote #280191:

#93 2014-04-11 19:52:02

Re: smd_macro: Create custom virtual Txp tags that do stuff

#94 2014-04-11 21:44:14

Re: smd_macro: Create custom virtual Txp tags that do stuff

sacripant wrote #280195:

#95 2014-04-14 12:22:10

Re: smd_macro: Create custom virtual Txp tags that do stuff

#96 2014-07-06 00:28:57

Re: smd_macro: Create custom virtual Txp tags that do stuff

Board footer