With this commit, some keyword groups can be displayed/hidden in specific sections. The customization can be done with autoriser_xxx_editermots($action,$what,$id,$who,$opts. $opts contains the id of the concerned keyword group, and also the fields of this group that can be displayed. By default, the function only checks if the author is authorized to this group.
So it works like this : - The action is the same url (and the form can display errors). - The form initially contains several hidden values that will make the submit action more secure. - When the focus is set to the password field, the form verifies that the encryption parameters are OK, and indicates it with a brown padlock. - Before been submitted, the password is encrypted into two md5+salt values, and the non-encrypted password field is erased : Therefore the password is never directly sent to the server, so it can't be catched by a bad guy. That makes the login form really secure ! - Finally, the server calculates the md5+salt values of the password in database. It compares these values to the encrypted received values. If the values match, the password that has been submitted is correct. Elsewhere it's bad and SPIP returns to the login form with an error.
3 new functions enable to create and delete views for PG, SQlite and MySQL :
sql_get_select() : same arguments as sql_select() but returns the query without evaluating it
sql_create_view($view_name, $select_request) : creates the view $view_name for the select request $select_request.
sql_drop_view($view_name) : drops the view.
/!\ Warning ! Yous must give an explicit name to every field prefixed with a table name or an alias. Elsewhere SQLite won't be able to read the view (which contains 'a.titre' instead of 'titre').
SQL views are known to be used like tables. They enable to : - mask the schema complexity ( -> simplification of queries) - give access to a limited number of fields ( -> security) - manipulate calculated fields (sum(), max(), avg(), ..)
Now you can avoid writing complexe loops by using views :
Example :
mysql> create view v AS
SELECT a.titre,a.id_article,b.id_rubrique,b.titre AS titre_rub
FROM spip_articles AS a
LEFT JOIN spip_rubriques AS b ON(a.id_rubrique=b.id_rubrique)
WHERE b.titre REGEXP '^A'
ORDER BY a.titre DESC;
Note that the {doublons} are transmitted from the main template to the included one. But it's not possible to transmit the information from the included template : Especially <INCLURE /> isn't always calculated at the same time that the main template - For this reason and to keep a coherent behavior, #INCLURE keeps the same restriction for {doublons}
During the normal execution of several commands, call-outs are made to optional scripts that allow a developer to add functionality or checking. Typically, the hooks allow for a command to change the values of function arguments before any other call, and allow for a post-processing treatment that will always change the function result.
Exemple :
function prefix_treatment($flow) {
/* add something to the flow */
$flow .= 'This is some html code';
return $flow;
}
plugin.xml defines the implemented hooks with a list of <pipeline> tags:
#ARRAY{key1,value1,key2,value2...} allows the creation of a variable length table (useful for constructing a table for a #SET and/or for use with a dynamic "IN" criterion )
Short but an exemple should be helpfull..
Here is an exemple extracted from the plugin SpipBB
#ARRAY{#COMPTEUR_BOUCLE,#ID_AUTEUR} creates an array containing the author's id at an index that isn't used yet. The standard PHP function array_merge() finally does it's job : this value is now stored on the last index of the array 'modos'.
Another loop completes this array with the other authors of articles that are in the same section.
Note that the PHP function is used as a filter : it's possible because it's first argument is the array to manipulate.
Of course all this can be done with PHP code inside the template. The advantage of using the tag #ARRAY is that your template is better managed by the cache.
With the revision [11350], any custom field can directly be used in templates with the tags #FOO and #EDIT{foo} (with the plugin "crayons" [fr]) You don't have to change inc/modifier or specify the structure of the table : the core directly manages them.
However the private interface actually doesn't integrate these fields. You have to custom it with hooks.
The value of any field 'foo' can be displayed in your templates with #FOO -- Even if this is a field of the 'official' tables. Much more, this value can be edited in the public area with an inline content editor (actually it's still not possible in the private area) :
sql_showtable() is used to describe the fields (that's better than the corresponding php descriptor in tables_principales, etc..)
inc/modifier now uses a list of private fields (instead of a fixed list of public fields)
includes the template and ajaxifies all it's links.
By default, the javascript variable "ajaxbloc_selecteur" is used. It transforms into ajax call each link that corresponds to the jquery selector '.pagination a,a.ajax'.
An ajax call refreshes the template's result by restauring it's #ENV, plus some parameters in the url. When a refresh occurs, the bloc's opacity is changed to 50% and it's class to 'loading' (this div is automatically created) The loaded part is cached on the browser with javascript. It also can be preloaded by adding the class 'preload' to the corresponding links.
Combined with a filter like |parametre_url, you can do whatever you want :
For example :
<a href="#URL_PAGE{identifiants,focus=nom_inscription}&mode=(#URL_SITE_SPIP|tester_config{1comite})" (in dist/login.html) that returns <a href="spip.php?page=identifiants&focus=nom_inscription&mode=.."
It should possible to write #URL_ECRIRE{forum_envoi,statut=prive&id=363&script=articles#formulaire}
but you can also use this : [(#URL_PAGE{my_backend}|parametre_url{id_mot,#ID_MOT}|parametre_url{id_rubrique,#_:ID_RUBRIQUE})] to generate <a href="spip.php?page=my_backend&id_mot=32&id_rubrique&..
when a title of an article is changed, the url isn't automatically recalculated.
It's interresting if you don't want to lost backlinks, but it can be disturbing because the url may not correspond to the content of the linked page.
Here is the trick : Just clic on the link 'See online' when you display the article inside the private area. It will not only clear the cached content for this page, but it will also force the url to be recalculated according to the title field.
1.9.2d is a bug-fix update. It is advisable to upgrade to this version which should not have any visible impact for the visitors to your site if you are already using a version 1.9.2 (a,b or c). You can download this version at http://www.spip.net/en_article3103.html.
The changes are:
For authors and admins:
correction of an inconsistency in the managing of the date of attached documents (date/time on creation, but only date thereafter);
correction of a bug on the sections menu which hid some of them (bug #1113);
avoid javascript error when loading a page and the mouse was moved too quickly;
the graphic configuration and site address are no longer overwritten when restoring a backup, as they are linked to the server;
the correct display of successive screenshots in the statistics;
updated Indonesian translation;
correction of a bug on the permissions on modification of sites syndicated by restricted admins;
correction of several bugs to do with the permissions on logos;
correction of an SQL bug on the section selector which made it unusable on big sites (sections are now sorted {par num titre, titre};
correction of a bug which could allow a restricted admin to move a published article to a section of which he/she is not an administrator.
For developers of plugins:
$GLOBALS['_INC_PUBLIC'] replaces the constant _INC_PUBLIC.
It is incremented in each template inclusion. This is used in the plugin "balise_session" that reproduces a new session mechanism introduced in the development version of SPIP: Tipically, if you want to create templates which results depend on the user, you actually needn't include session.php: a specific tag, #SESSION, automatically handles the cleaning process of the cached files -- even in statical includes like models --
Correction of the cache cleaning process in CRON (it sometimes failed when a bot visited the site)
url_de_base() can now be used in mes_options.php
This release Fixes a missing inclusion which could make the function autoriser_voir_dist() crash.
recuperer_page() properly takes care of https uri (If php was compiled with the support of ssl)
Thanks Paolo for this translation of the original announcement by Cédric.
When the cron doesn't manage to empty correctly the cache, the site crashes rapidly. The only solution then is to empty completly the cache directory.
It's what does this commit, but it's a poor patch with a huge side effect : the cache delay specified in a template isn't really taken into account because the cached file is erased rapidly
There is no doubt that a better solution will come soon
note : Cache explosion was also partially corrected in :
afficher_contenu_objet() is simplified and know uses a customizable template for every (standard?) table. The result of this template uses a pipeline ('afficher_contenu_objet'), and so plugins can modify it .
This commit creates a directory 'dist/contenu/' that contains article.html, breve.html, etc. Really usefull for customisation of the private area, no ?
Scaffolding is a great feature that enables to view the content of the non-standard spip tables. When you are the website admin (member of _ID_WEBMESTRES), you can write : http...?page=table:tableName
Actually, it's still minimal but quite functionnal : - a table with as many columns as of the SQL table fields - The tag #PAGINATION enables to scroll lines per block of ten - The first (or last) row of a table enables the table to be sorted depending on the selected column, either ascending or descending order. The field type is taken into account in this order. - The url can filter one or more values for every field, simply by specifying "&fieldname=.." - For each field described in SQL as a reference to another table, a link to another scaffolding for this table is specified.
Empty loops are no longer tested since the result is known. It's really helpful for loops that calculate only 'doublons' or counters : they return nothing, so the generated code is better.
