FrontendEditingController.php

Go to the documentation of this file.

<?php
namespace ‪TYPO3\CMS\Core\FrontendEditing;
 
/*
 * This file is part of the TYPO3 CMS project.
 *
 * It is free software; you can redistribute it and/or modify it under
 * the terms of the GNU General Public License, either version 2
 * of the License, or any later version.
 *
 * For the full copyright and license information, please read the
 * LICENSE.txt file that was distributed with this source code.
 *
 * The TYPO3 project - inspiring people to share!
 */
 
use ‪TYPO3\CMS\Adminpanel\View\AdminPanelView;
use ‪TYPO3\CMS\Backend\FrontendBackendUserAuthentication;
use ‪TYPO3\CMS\Backend\Utility\BackendUtility;
use ‪TYPO3\CMS\Core\Context\Context;
use ‪TYPO3\CMS\Core\Context\LanguageAspect;
use ‪TYPO3\CMS\Core\Database\ConnectionPool;
use ‪TYPO3\CMS\Core\Database\Query\Restriction\EndTimeRestriction;
use ‪TYPO3\CMS\Core\Database\Query\Restriction\FrontendGroupRestriction;
use ‪TYPO3\CMS\Core\Database\Query\Restriction\HiddenRestriction;
use ‪TYPO3\CMS\Core\Database\Query\Restriction\StartTimeRestriction;
use ‪TYPO3\CMS\Core\DataHandling\DataHandler;
use ‪TYPO3\CMS\Core\Type\Bitmask\Permission;
use ‪TYPO3\CMS\Core\Utility\GeneralUtility;
use ‪TYPO3\CMS\Frontend\Controller\TypoScriptFrontendController;
 
class ‪FrontendEditingController
{
    public ‪$TSFE_EDIT;
 
    public function ‪__construct()
    {
        trigger_error(__CLASS__ . ' will be removed in TYPO3 v10.0. Functionality has been moved to EXT:feedit, FrontendBackendUserAuthentication and ContentObjectRenderer.', E_USER_DEPRECATED);
    }
 
    public function ‪initConfigOptions()
    {
        $this->TSFE_EDIT = GeneralUtility::_GP('TSFE_EDIT');
        // Include classes for editing IF editing module in Admin Panel is open
        if (((int)$this->‪getTypoScriptFrontendController()->‪displayEditIcons === 1
            || (int)$this->‪getTypoScriptFrontendController()->displayFieldEditIcons === 1)
            && $this->‪isEditAction()
        ) {
            $this->‪editAction();
        }
    }
 
    public function ‪displayEditPanel($content, array $conf, $currentRecord, array $dataArray)
    {
        if ($conf['newRecordFromTable']) {
            $currentRecord = $conf['newRecordFromTable'] . ':NEW';
            $conf['allow'] = 'new';
            $checkEditAccessInternals = false;
        } else {
            $checkEditAccessInternals = true;
        }
        list($table, $uid) = explode(':', $currentRecord);
        // Page ID for new records, 0 if not specified
        $newRecordPid = (int)$conf['newRecordInPid'];
        $newUid = null;
        if (!$conf['onlyCurrentPid'] || $dataArray['pid'] == $this->‪getTypoScriptFrontendController()->id) {
            if ($table === 'pages') {
                $newUid = $uid;
            } else {
                if ($conf['newRecordFromTable']) {
                    $newUid = $this->‪getTypoScriptFrontendController()->id;
                    if ($newRecordPid) {
                        $newUid = $newRecordPid;
                    }
                } else {
                    $newUid = -1 * $uid;
                }
            }
        }
        if ($this->‪getTypoScriptFrontendController()->‪displayEditIcons && $table && $this->‪allowedToEdit($table, $dataArray, $conf, $checkEditAccessInternals) && $this->‪allowedToEditLanguage($table, $dataArray)) {
            $editClass = ‪$GLOBALS['TYPO3_CONF_VARS']['SC_OPTIONS']['typo3/classes/class.frontendedit.php']['edit'];
            if ($editClass) {
                $edit = GeneralUtility::makeInstance($editClass);
                $allowedActions = $this->‪getAllowedEditActions($table, $conf, $dataArray['pid']);
                $content = $edit->editPanel($content, $conf, $currentRecord, $dataArray, $table, $allowedActions, $newUid, $this->‪getHiddenFields($dataArray));
            }
        }
        return $content;
    }
 
    public function ‪displayEditIcons($content, $params, array $conf = [], $currentRecord = '', array $dataArray = [], $addUrlParamStr = '')
    {
        // Check incoming params:
        list($currentRecordTable, $currentRecordUID) = explode(':', $currentRecord);
        list($fieldList, $table) = array_reverse(GeneralUtility::trimExplode(':', $params, true));
        // Reverse the array because table is optional
        if (!$table) {
            $table = $currentRecordTable;
        } elseif ($table != $currentRecordTable) {
            // If the table is set as the first parameter, and does not match the table of the current record, then just return.
            return $content;
        }
        $editUid = $dataArray['_LOCALIZED_UID'] ?: $currentRecordUID;
        // Edit icons imply that the editing action is generally allowed, assuming page and content element permissions permit it.
        if (!array_key_exists('allow', $conf)) {
            $conf['allow'] = 'edit';
        }
        if ($this->‪getTypoScriptFrontendController()->displayFieldEditIcons && $table && $this->‪allowedToEdit($table, $dataArray, $conf) && $fieldList && $this->‪allowedToEditLanguage($table, $dataArray)) {
            $editClass = ‪$GLOBALS['TYPO3_CONF_VARS']['SC_OPTIONS']['typo3/classes/class.frontendedit.php']['edit'];
            if ($editClass) {
                $edit = GeneralUtility::makeInstance($editClass);
                $content = $edit->editIcons($content, $params, $conf, $currentRecord, $dataArray, $addUrlParamStr, $table, $editUid, $fieldList);
            }
        }
        return $content;
    }
 
    /*****************************************************
     *
     * Frontend Editing
     *
     ****************************************************/
    public function ‪isEditAction()
    {
        if (is_array($this->TSFE_EDIT)) {
            if ($this->TSFE_EDIT['cancel']) {
                unset($this->TSFE_EDIT['cmd']);
            } else {
                $cmd = (string)$this->TSFE_EDIT['cmd'];
                if (($cmd !== 'edit' || is_array($this->TSFE_EDIT['data']) && ($this->TSFE_EDIT['doSave'] || $this->TSFE_EDIT['update'] || $this->TSFE_EDIT['update_close'])) && $cmd !== 'new') {
                    // $cmd can be a command like "hide" or "move". If $cmd is "edit" or "new" it's an indication to show the formfields. But if data is sent with update-flag then $cmd = edit is accepted because edit may be sent because of .keepGoing flag.
                    return true;
                }
            }
        }
        return false;
    }
 
    public function ‪isEditFormShown()
    {
        if (is_array($this->TSFE_EDIT)) {
            $cmd = (string)$this->TSFE_EDIT['cmd'];
            if ($cmd === 'edit' || $cmd === 'new') {
                return true;
            }
        }
    }
 
    public function ‪editAction()
    {
        // Commands
        list($table, $uid) = explode(':', $this->TSFE_EDIT['record']);
        $uid = (int)$uid;
        $cmd = $this->TSFE_EDIT['cmd'];
        // Look for some TSFE_EDIT data that indicates we should save.
        if (($this->TSFE_EDIT['doSave'] || $this->TSFE_EDIT['update'] || $this->TSFE_EDIT['update_close']) && is_array($this->TSFE_EDIT['data'])) {
            $cmd = 'save';
        }
        if ($cmd === 'save' || $cmd && $table && $uid && isset(‪$GLOBALS['TCA'][$table])) {
            // Hook for defining custom editing actions. Naming is incorrect, but preserves compatibility.
            $_params = [];
            foreach (‪$GLOBALS['TYPO3_CONF_VARS']['SC_OPTIONS']['t3lib/class.t3lib_tsfebeuserauth.php']['extEditAction'] ?? [] as $_funcRef) {
                GeneralUtility::callUserFunction($_funcRef, $_params, $this);
            }
            // Perform the requested editing command.
            $cmdAction = 'do' . ucwords($cmd);
            if (is_callable([$this, $cmdAction])) {
                $this->{$cmdAction}($table, $uid);
            } else {
                throw new \UnexpectedValueException('The specified frontend edit command (' . $cmd . ') is not valid.', 1225818120);
            }
        }
    }
 
    public function ‪doHide($table, $uid)
    {
        $hideField = ‪$GLOBALS['TCA'][$table]['ctrl']['enablecolumns']['disabled'];
        if ($hideField) {
            $recData = [];
            $recData[$table][$uid][$hideField] = 1;
            $dataHandler = GeneralUtility::makeInstance(DataHandler::class);
            $dataHandler->start($recData, []);
            $dataHandler->process_datamap();
        }
    }
 
    public function ‪doUnhide($table, $uid)
    {
        $hideField = ‪$GLOBALS['TCA'][$table]['ctrl']['enablecolumns']['disabled'];
        if ($hideField) {
            $recData = [];
            $recData[$table][$uid][$hideField] = 0;
            $dataHandler = GeneralUtility::makeInstance(DataHandler::class);
            $dataHandler->start($recData, []);
            $dataHandler->process_datamap();
        }
    }
 
    public function ‪doUp($table, $uid)
    {
        $this->‪move($table, $uid, 'up');
    }
 
    public function ‪doDown($table, $uid)
    {
        $this->‪move($table, $uid, 'down');
    }
 
    public function ‪doMoveAfter($table, $uid)
    {
        $afterUID = $this->TSFE_EDIT['moveAfter'];
        $this->‪move($table, $uid, '', $afterUID);
    }
 
    protected function ‪move($table, $uid, $direction = '', $afterUID = 0)
    {
        $dataHandlerCommands = [];
        $sortField = ‪$GLOBALS['TCA'][$table]['ctrl']['sortby'];
        if ($sortField) {
            // Get the current record
            // Only fetch uid, pid and the fields that are necessary to detect the sorting factors
            if (isset(‪$GLOBALS['TCA'][$table]['ctrl']['copyAfterDuplFields'])) {
                $copyAfterDuplicateFields = GeneralUtility::trimExplode(',', ‪$GLOBALS['TCA'][$table]['ctrl']['copyAfterDuplFields'], true);
            } else {
                $copyAfterDuplicateFields = [];
            }
 
            ‪$fields = $copyAfterDuplicateFields;
            ‪$fields[] = 'uid';
            ‪$fields[] = 'pid';
            ‪$fields[] = $sortField;
            ‪$fields = array_unique(‪$fields);
 
            $queryBuilder = GeneralUtility::makeInstance(ConnectionPool::class)
                ->getQueryBuilderForTable($table);
            $queryBuilder->getRestrictions()->removeAll();
 
            $currentRecord = $queryBuilder
                ->select(...‪$fields)
                ->from($table)
                ->where($queryBuilder->expr()->eq(
                    'uid',
                    $queryBuilder->createNamedParameter($uid, \PDO::PARAM_INT)
                ))
                ->execute()
                ->fetch();
 
            if (is_array($currentRecord)) {
                // Fetch the record before or after the current one
                // to define the data handler commands
                $queryBuilder = GeneralUtility::makeInstance(ConnectionPool::class)
                    ->getQueryBuilderForTable($table);
 
                $queryBuilder
                    ->select('uid', 'pid')
                    ->from($table)
                    ->where($queryBuilder->expr()->eq(
                        'pid',
                        $queryBuilder->createNamedParameter($currentRecord['pid'], \PDO::PARAM_INT)
                    ))
                    ->setMaxResults(2);
 
                // Disable the default restrictions (but not all) if the admin panel is in preview mode
                if ($this->‪getBackendUser()->adminPanel instanceof AdminPanelView && $this->‪getBackendUser()->adminPanel->extGetFeAdminValue('preview')) {
                    $queryBuilder->getRestrictions()
                        ->removeByType(StartTimeRestriction::class)
                        ->removeByType(EndTimeRestriction::class)
                        ->removeByType(HiddenRestriction::class)
                        ->removeByType(FrontendGroupRestriction::class);
                }
 
                if (!empty($copyAfterDuplicateFields)) {
                    foreach ($copyAfterDuplicateFields as $fieldName) {
                        $queryBuilder->andWhere($queryBuilder->expr()->eq(
                            $fieldName,
                            $queryBuilder->createNamedParameter($currentRecord[$fieldName], \PDO::PARAM_STR)
                        ));
                    }
                }
                if (!empty($direction)) {
                    if ($direction === 'up') {
                        $queryBuilder->andWhere(
                            $queryBuilder->expr()->lt(
                                $sortField,
                                $queryBuilder->createNamedParameter($currentRecord[$sortField], \PDO::PARAM_INT)
                            )
                        );
                        $queryBuilder->orderBy($sortField, 'DESC');
                    } else {
                        $queryBuilder->andWhere(
                            $queryBuilder->expr()->gt(
                                $sortField,
                                $queryBuilder->createNamedParameter($currentRecord[$sortField], \PDO::PARAM_INT)
                            )
                        );
                        $queryBuilder->orderBy($sortField, 'ASC');
                    }
                }
 
                $result = $queryBuilder->execute();
                if ($recordBefore = $result->fetch()) {
                    if ($afterUID) {
                        $dataHandlerCommands[$table][$uid]['move'] = -$afterUID;
                    } elseif ($direction === 'down') {
                        $dataHandlerCommands[$table][$uid]['move'] = -$recordBefore['uid'];
                    } elseif ($recordAfter = $result->fetch()) {
                        // Must take the second record above...
                        $dataHandlerCommands[$table][$uid]['move'] = -$recordAfter['uid'];
                    } else {
                        // ... and if that does not exist, use pid
                        $dataHandlerCommands[$table][$uid]['move'] = $currentRecord['pid'];
                    }
                } elseif ($direction === 'up') {
                    $dataHandlerCommands[$table][$uid]['move'] = $currentRecord['pid'];
                }
            }
 
            // If any data handler commands were set, execute the data handler command
            if (!empty($dataHandlerCommands)) {
                $dataHandler = GeneralUtility::makeInstance(DataHandler::class);
                $dataHandler->start([], $dataHandlerCommands);
                $dataHandler->process_cmdmap();
            }
        }
    }
 
    public function ‪doDelete($table, $uid)
    {
        $cmdData[$table][$uid]['delete'] = 1;
        if (!empty($cmdData)) {
            $dataHandler = GeneralUtility::makeInstance(DataHandler::class);
            $dataHandler->start([], $cmdData);
            $dataHandler->process_cmdmap();
        }
    }
 
    public function ‪doSave($table, $uid)
    {
        $data = $this->TSFE_EDIT['data'];
        if (!empty($data)) {
            $dataHandler = GeneralUtility::makeInstance(DataHandler::class);
            $dataHandler->start($data, []);
            $dataHandler->process_uploads($_FILES);
            $dataHandler->process_datamap();
            // Save the new UID back into TSFE_EDIT
            $newUID = $dataHandler->substNEWwithIDs['NEW'];
            if ($newUID) {
                $this->TSFE_EDIT['newUID'] = $newUID;
            }
        }
    }
 
    public function ‪doSaveAndClose($table, $uid)
    {
        $this->‪doSave($table, $uid);
    }
 
    public function ‪doClose($table, $uid)
    {
    }
 
    protected function ‪allowedToEditLanguage($table, array $currentRecord)
    {
        // If no access right to record languages, return immediately
        $languageAspect = GeneralUtility::makeInstance(Context::class)->getAspect('language');
        if ($table === 'pages') {
            $lang = $languageAspect->getId();
        } elseif ($table === 'tt_content') {
            $lang = $languageAspect->getContentId();
        } elseif (‪$GLOBALS['TCA'][$table]['ctrl']['languageField']) {
            $lang = $currentRecord[‪$GLOBALS['TCA'][$table]['ctrl']['languageField']];
        } else {
            $lang = -1;
        }
        return $this->‪getBackendUser()->‪checkLanguageAccess($lang);
    }
 
    protected function ‪allowedToEdit($table, array $dataArray, array $conf, $checkEditAccessInternals = true)
    {
        // Unless permissions specifically allow it, editing is not allowed.
        $mayEdit = false;
        if ($checkEditAccessInternals) {
            $editAccessInternals = $this->‪getBackendUser()->‪recordEditAccessInternals($table, $dataArray, false, false);
        } else {
            $editAccessInternals = true;
        }
        if ($editAccessInternals) {
            if ($table === 'pages') {
                if ($this->‪getBackendUser()->isAdmin() || $this->‪getBackendUser()->doesUserHaveAccess($dataArray, ‪Permission::PAGE_EDIT)) {
                    $mayEdit = true;
                }
            } else {
                if ($this->‪getBackendUser()->isAdmin() || $this->‪getBackendUser()->doesUserHaveAccess(‪BackendUtility::getRecord('pages', $dataArray['pid']), ‪Permission::CONTENT_EDIT)) {
                    $mayEdit = true;
                }
            }
            if (!$conf['onlyCurrentPid'] || $dataArray['pid'] == $this->‪getTypoScriptFrontendController()->id) {
                // Permissions:
                $types = GeneralUtility::trimExplode(',', strtolower($conf['allow']), true);
                $allow = array_flip($types);
                $perms = $this->‪getBackendUser()->‪calcPerms($this->‪getTypoScriptFrontendController()->page);
                if ($table === 'pages') {
                    $allow = $this->‪getAllowedEditActions($table, $conf, $dataArray['pid'], $allow);
                    // Can only display editbox if there are options in the menu
                    if (!empty($allow)) {
                        $mayEdit = true;
                    }
                } else {
                    $mayEdit = !empty($allow) && $perms & ‪Permission::CONTENT_EDIT;
                }
            }
        }
        return $mayEdit;
    }
 
    protected function ‪getAllowedEditActions($table, array $conf, $pid, $allow = '')
    {
        if (!$allow) {
            $types = GeneralUtility::trimExplode(',', strtolower($conf['allow']), true);
            $allow = array_flip($types);
        }
        if (!$conf['onlyCurrentPid'] || $pid == $this->‪getTypoScriptFrontendController()->id) {
            // Permissions
            $types = GeneralUtility::trimExplode(',', strtolower($conf['allow']), true);
            $allow = array_flip($types);
            $perms = $this->‪getBackendUser()->‪calcPerms($this->‪getTypoScriptFrontendController()->page);
            if ($table === 'pages') {
                // Rootpage
                if (count($this->‪getTypoScriptFrontendController()->config['rootLine']) === 1) {
                    unset($allow['move']);
                    unset($allow['hide']);
                    unset($allow['delete']);
                }
                if (!($perms & ‪Permission::PAGE_EDIT) || !$this->‪getBackendUser()->checkLanguageAccess(0)) {
                    unset($allow['edit']);
                    unset($allow['move']);
                    unset($allow['hide']);
                }
                if (!($perms & ‪Permission::PAGE_DELETE)) {
                    unset($allow['delete']);
                }
                if (!($perms & ‪Permission::PAGE_NEW)) {
                    unset($allow['new']);
                }
            }
        }
        return $allow;
    }
 
    public function ‪getJavascriptIncludes()
    {
        // No extra JS includes needed
        return '';
    }
 
    public function ‪getHiddenFields(array $dataArray)
    {
        // No special hidden fields needed.
        return [];
    }
 
    protected function ‪getBackendUser(): ?FrontendBackendUserAuthentication
    {
        return ‪$GLOBALS['BE_USER'] instanceof FrontendBackendUserAuthentication ? ‪$GLOBALS['BE_USER'] : null;
    }
 
    protected function ‪getTypoScriptFrontendController(): TypoScriptFrontendController
    {
        return ‪$GLOBALS['TSFE'];
    }
}