Commit Graph

103 Commits

Author SHA1 Message Date
Luke Towers d56dded458 Restore middleware support in backend controllers.
Reverts f73d8e6d49.  While there are other ways to achieve some of the same end results, this code existed in the code base for 8 months without issues and is included in the official docs. This means that there could be devs that are depending on this behavior. Additionally, while this may make the internal logic to the BackendController class more complex, it simplifies the developer experience by bringing the Backend\Classes\Controller base class more in line with the standard Laravel controller class.
2019-11-07 11:59:00 -06:00
Samuel Georges 8da798a5cd Remove XSRF cookie
This was a contentious change is generally a bad idea to blanket all requests with a dependant cookie. We will try something else.

Revert enableXsrfCookies setting. Fixes UX issue introduced where the token expires. This should be replaced by a CSRF policy that determines whether this is needed on the front end.
2019-11-04 09:06:05 +11:00
Samuel Georges c5bd5f0e0a Apply ResponseMaker to backend AJAX and cms.page.display event 2019-11-03 08:02:28 +11:00
Samuel Georges 63f65a3f25 Add XSRF to backend, simplify CMS controller run() method
runInternal has been removed because we do not want to blanket our response logic over every single response, only the happy path. This is because it is impossible to remove. So it is better to take the inverted approach, where if you want the CMS' headers in your custom response, add them yourself. This becomes easy via the new makeResponse() method
2019-11-02 19:14:45 +11:00
Samuel Georges ff8f899fbe Move response common functions to ResponseMaker trait 2019-11-02 18:21:22 +11:00
Samuel Georges f269901d72
Merge pull request #4732 from octobercms/remove_double_middleware
Remove double middleware
2019-11-02 18:06:50 +11:00
Samuel Georges 92bd8360b9 Fixes issue where behaviors are not booting 2019-11-02 16:30:33 +11:00
Samuel Georges f73d8e6d49 Removes double middleware layer
For some reason it was decided to allow October controllers to support Laravel middleware, this has been reverted because it is a convoluted solution that doesn't respect the original architecture. There are other ways to handle middleware requirements

The original use case appeared to be to simply allow backend controllers to inject headers. This is something easily solvable whilst keeping the simple and original workflow
2019-11-02 16:16:32 +11:00
Samuel Georges b1fa45ee3a Combine common CSRF logic to a trait 2019-11-02 15:15:18 +11:00
Luke Towers d31006ae1a Return 403 response on CSRF fail instead of silently failing
Also moved backend::lang.page.invalid_token.label to system::lang.page.invalid_token.label. Fixes
2019-10-06 23:21:08 -06:00
Ben Thomson 0240c21af6 Fail CSRF token checks if the session expires. (#4598)
Fixes #4595. Credit to @bennothommo
2019-09-04 21:33:10 -06:00
Dan Harrin 9521dd795c Minor Formatting Corrections in Usage Comments (#4541)
Credit to @DanHarrin
2019-08-15 09:14:54 -06:00
Ben Thomson a59d3b83eb Code quality clean up (#4449)
Credit to @bennothommo
2019-07-18 08:50:37 -06:00
Samuel Georges 5190c8177b Avoid terminating the app using exit() or die()
Refs #3783
Refs #3746
2019-03-29 07:10:07 +11:00
Ben Thomson a89f1f1c3a Add Closure use declaration (#4170) 2019-02-28 14:54:00 +02:00
Ben Thomson 57a074364e Allow controller middleware in backend controllers (#4106)
Credit to @bennothommo Related: https://github.com/octobercms/october/pull/4088
2019-02-27 14:27:41 -06:00
Luke Towers d6e680799f Reduce reliance on CMS module from Backend module
added backend 404 view, fixed return to backend URL in the access denied view on backend only instances
2019-01-15 11:46:48 -06:00
Luke Towers 2c82b05062 Added backend.ajax.beforeRunHandler event 2018-10-14 10:32:47 -06:00
Nathan van der Werf 0f0d108da0
Remove unused imports 2018-08-24 19:51:59 +02:00
Nathan van der Werf a3d7a028b4 Replace is_null with "=== null" comparison 2018-08-15 18:54:46 +02:00
Nathan van der Werf 123145fd54 Remove unnecessary parentheses 2018-08-15 18:49:52 +02:00
Samuel Georges fb2aa1730c Fixes security issue
Refs #3604
2018-06-22 22:57:38 +10:00
Luke Towers 08d8b33fc6 Whitespace 2018-04-19 10:21:25 -06:00
Samuel Georges e6de2a5521 Fixes exception on empty token 2017-11-02 19:53:20 +11:00
Luke Towers c7a3354dfd
Move backend.page.beforeDisplay after auth check
Fixes #3215. Related: 47cd204686 (diff-6cdbb280344f40eebe758cf8e8e5f7d9)
2017-10-31 08:45:11 -06:00
Luke Towers 4203e65549 Deprecated Cms\Controllers\Media in favour of the backend one. Fixed other references to moved pieces of the Media Manager. Finally a proper fix for https://github.com/octobercms/october/pull/2604 2017-10-08 23:12:04 -06:00
Samuel Georges 96d0535d09 Add generic onAjax handler that does nothing 2017-07-29 22:55:58 +10:00
Samuel Georges c0aa03a400 Create an error making trait
Widgets can throw fatal errors too
2017-06-11 22:38:03 +10:00
Samuel Georges 04f89dc5bb getToken -> token 2017-05-20 13:19:51 +10:00
Samuel Georges 7e76f39e6c Add app.name config
Various other refittings
2017-05-16 18:50:41 +10:00
Samuel Georges 015b34fe88 Block media manager entirely if user lacks access 2017-04-11 08:40:39 +10:00
Samuel Georges 5b5e23bfb8 Minor touch up from #2604 2017-01-26 11:30:26 +11:00
Samuel Georges 5e729f9978 Merge pull request #2604 from dubcanada/patch-1
If CMS module is loaded (and MediaManager exists) bind it
2017-01-26 11:27:56 +11:00
dubcanada 0a4390b4d9 If CMS module is loaded (and MediaManager exists) bind it
I am using OctoberCMS without the CMS module (removed from modules directory and turned off in cms.php) and I am getting an error in the backend regarding missing `MediaManager` class. I wrapped this in a class_exists to check that MediaManager exists before binding it.

Let me know your thoughts.
2017-01-10 13:45:59 -04:00
Samuel Georges 6af6ebe733 Added config backendForceSecure used to force HTTPS
Refs https://security.googleblog.com/2016/09/moving-towards-more-secure-web.html
2016-12-17 10:16:02 +11:00
Samuel Georges 0a2b343047 Simplify system events
This pipes all event calls through a new EventEmitter trait, which substitutes the October Rain event emitter trait. The view event has been moved to this trait also.
Pass some variables by reference to allow multi-extension.
Fixes #2420
2016-12-10 09:02:06 +11:00
Samuel Georges 6173ff177b Typo in variable name 2016-11-02 08:58:07 +11:00
Samuel Georges 0aadcc6675 Merge paths and vars when calling widget handler
When an AJAX handler is called for a widget, the view paths and specified variables should be merged in to the controller. This sets the appropriate context:

1) Look at the widget first
2) Fall back to the controller

Fixes #2432
2016-11-02 08:50:15 +11:00
soulshockers e10c162667 Fixed calling dynamic methods for dynamically extended widgets. 2016-08-05 18:51:27 +03:00
Samuel Georges 78a4067564 Make logic more explicit
This tightens up the rules of 7baea87068
2016-07-23 15:50:48 +10:00
Samuel Georges 7baea87068 Allow AJAX handlers to pipe objects to Laravel
Treat non scalar, non array, non RedirectResponse, non null as a Laravel compatible response
This brings AJAX handlers in line with page cycles, which do the same thing if the response is not a string. However in AJAX we should treat any scalar as a "result", not just a string. For all else (where not null), let Laravel handle it as a custom response object -- could be a model for serialization, or anything compatible.
Importantly to note when a custom redirect is sent, October's workflow is completely wiped out, so any partial updates, redirects, etc. will not occur. This is a normal and fair expectation.
Fixes #1784
2016-07-23 11:57:15 +10:00
Samuel Georges e970d80443 Align AJAX logic: merge custom response last
This is to allow overriding the standard values
Refs #2209
2016-07-16 13:11:10 +10:00
Luke Towers b73811fefc Moves AJAX handler response handling
Fixes octobercms/october#2208
2016-07-13 09:51:18 -06:00
Samuel Georges e9be15cc15 Preferences -> Preference
Rename brandsetting config folder
2016-05-27 07:46:50 +10:00
Samuel Georges cdb35f5070 UserPreferences -> UserPreference
(Models should be singular)
2016-05-27 07:35:32 +10:00
Samuel Georges 6c081d9265 Combine editor preferences and backend preferences
Add backend timezone setting used for converting display dates
2016-04-23 05:31:05 +10:00
Pásztor Gábor 31457bd2ee Cleanup 2016-01-15 10:20:57 +01:00
Samuel Georges 2213c6f28c Fix string comparison function
Flush stray output on view errors
2016-01-02 16:13:30 +11:00
flynsarmy 98e1d0fe4d Add getPublicActions controller method 2015-09-07 14:17:09 +10:00
Samuel Georges 48b4a137fa Allow passing explicit content to hints 2015-07-25 09:34:47 +10:00