Newspublisher-3 without user login step, possible?

They also need the file_manager permission.

Thanks again! I am a bit stuck.

I checked a list of available access policies under ACL. Thereā€™s no File Manager option. While NewsPublisherEditor {policy} has file_manager policy and it is checked. And since my anonymous user group has NewsPublisherEditor as an access policyā€¦ where else I should add file_manager=yes? I am lost.

Now, all of a sudden an ideological question: what problems can be solved by user login/authorization? This is a shield against malware bots, but a human hacker can login and try to upload something nasty. How does login protect against that? As for bots wouldnā€™t it be sufficient to add capture to the NP form? Is it possible?

What youā€™ve described should work.

Does your anonymous group/NewsPublisherEditor ACL entry have ā€˜webā€™ as the context and member for the authority level? Did you flush permissions and log out all users before testing?

Captcha would help protect you from bots, especially if you use the Math option. Some bots can now solve regular Captcha.

If you use something like Subscribe (which wraps the Register snippet), youā€™ll have double-opt-in registration. That means you have the userā€™s real email address, since they have to respond to the registration email to complete registration. Itā€™s not perfect, since a hacker can create a bogus email account somewhere, but it does discourage bots and hackers to some extent since most donā€™t want to go to the trouble unless your site stores personal info like SSNs or credit card numbers.

Hmm, sorry, I had to step away from this project and our conversation altogether. Back, back. So, yes, It looks like all is set well Namespace, ACL. I have two language contexts - the NewsPublisher form is visible on both. All is good except one thing - ā€œSelect an imageā€ (image type field) still doesnā€™t launch the file browser. Click on the button has no effect. Though in source code I can see JS generating image browser popup.
Maybe you can look at my form Š ŠµŠ³ŠøстрŠ°Ń†ŠøŠ¾Š½Š½Š°Ń фŠ¾Ń€Š¼Š° учŠ°ŃŃ‚Š½ŠøŠŗŠ° / Š£Ń‡Š°ŃŃ‚Š½ŠøŠŗŠø / Master-Jam Fest (Russian version) or Registration of participants / Participants / Master-Jam Fest (English version)?

When I installed NewsPublisherEditor it created two resources npELFinder and npELFinderConnector in a website tree. I hid these resources from navigation, still weird, are they supposed to appear among site pages?

ā€¦ hopefully, this is something simple to fix. And then, the final question would be how to add captcha?

I think those two resources, npELFinder and npELFinderConnector, should be child pages of the page that has your NewsPublisher snippet call. Thatā€™s the way mine was installedā€¦

1 Like

Thank you, lucy! This makes more sense. I still canā€™t get it working. Console shows JS error:
TypeError: $(ā€¦).dialogelfinder is not a functionregistration.html:128:38
http://global.master-jam.com/en/registration.html:128
In the source code line 128:, I see:


ā€¦ this is not all source code of the scriptā€¦
Unfortunately, I donā€™t know how it should be (not a JS coder) and particularly how to fix it inside the plugin (the code appearing in a page source is generated elsewhere). Do you have an idea?

Can you show us your snippet calls for the newspublisher form page (registration.html) and the calls on the 2 child pages? I had to make changes to the npElFinderConnector properties to get image browser to work.

The image upload TV that is currently not working in the NP form: does it work if you use it directly on a resource from within the manager?

Yes, please. Here is a NewsPublisher call:
[[!NewsPublisher?
&show=`pagetitle,4,7,8,10,29,11,33,parent,12,13,14,15,9,21,16,17,18,19,24,25,26,35,34,content`
&initfilebrowser=`1`
&published=`0`
&templateid=`3`
&parents=`103,104`
&postid=`3`
&captions=`pagetitle:Full name and your instrument-nomination,content:A message for Master-Jam team,name_lat:First name,last_name_lat:Last name,about_lat:About me,city:City,country:Country,email:E-mail,phone:Phone number,post_code:Post code,street_addr:Street address,www_url:Website,vkontakte_url:VKontakte,video_1:Video link #1,video_2:Video link #2,video_3:Video link #3`,birth_date:Date of birth,lang:I speak,upload_img:Upload photo`
]]

npElFinder sub resource has: [[!npElFinderContent]]
npElFinderConnector has:
[[!npElFinderConnector
&disableCommands=archive, download, cut, copy, paste, duplicate, edit, open, mkdir, mkfile, netmount, netunmount, rm, rename, quicklook, view
&browserBasePath=[[++base_path]]assets/img/
&browserBaseURL=[[++base_url]]assets/img/
]]
I paid attention to make sure ā€œuploadā€ is not listed under disableCommands and assets/img/ directory exists. What else can be missing?

Yes, it works like a charm from the manager interface.

Sorry - can you put your snippet calls in code tags so nothing is stripped ?
This is how you show code:

type 3 backticks in a row, no spaces, on one line
then on a newline type or paste your code
then an another newline type 3 more backticks to close

if youā€™re doing it right youā€™ll see the code box highlighted in the message preview window as you type.

1 Like

Wondering if the file browser requires a logged in user. Does it work if you are logged in as admin when using the NP form?

Last thoughts - what are your context settings for RU and EN? What do the Context Access permissions look like for Anon user group?

Once you get this working, how will you prevent someone from opening the file browser and downloading or deleting all the images that have already been uploaded by other participants? Since no log in is required, anyone would be able to simply click the file upload button and have access to the entire image directory.

NewsPublisher call:

[[!NewsPublisher?
&show=`pagetitle,3,4,6,7,8,10,29,11,23,parent,12,13,14,15,9,20,21,16,17,18,19,24,25,26,27,28,content` 
&initfilebrowser=`1`
&published=`0`
&templateid=`3`
&parents=`33,34,35,36,37,38,39,40,41,42` 
&postid=`3`
&captions=`pagetitle:ŠŸŠ¾Š»Š½Š¾Šµ ŠøŠ¼Ń Šø Š²Š°Ńˆ ŠøŠ½ŃŃ‚Ń€ŃƒŠ¼ŠµŠ½Ń‚,content:ŠŸŠ°Ń€Š° сŠ»Š¾Š² Š“Š»Ń рŠµŠ“Š°ŠŗцŠøŠø`
]]

[[!npElFinderContent]]

and finally:

[[!npElFinderConnector
    &disableCommands=`archive, download, cut, copy, paste, duplicate, edit, open, mkdir, mkfile, netmount, netunmount, rm, rename, quicklook, view` 
    &browserBasePath=`[[++base_path]]assets/img/`   
    &browserBaseURL=`[[++base_url]]assets/img/`
]]

It doesnā€™t work when I am logged in either. I am always logged in another browser tab.

In Contexts it is:
web/EN/RU/ (anonymous) 9999 NewsPublisherEditor

In Access Policy: NewsPublisherEditor there are a lot of settings. But at least file_manager and file_upload are both checked.

OK, this is serious and perhaps my expectations are totally wrong. I expected that click on ā€œupload fileā€ will open file browser to select a file on a local machine (userā€™s computer). Once selected you just upload it. I donā€™t need/want anybody to browse folders on the serverā€¦ and this is very important for me/my project. Is there a way to just upload an image file with the rest of the form?

Basically I need something like a user profile form (to upload bio info, some links and an avatar). All should be saved to the database as a page that can be activated (set to ā€œpublishedā€) by website admins. We donā€™t want users to login repeatedly and change anything in the original submission. Once submitted, site admins take care of it and users donā€™t have access to modify the original input. So, maybe my plugin selection is totally wrong?

The image TV first opens the ElFinder browser / MODX file manager on the server. Your form user will see the images already uploaded, choose one already there or upload more images, and delete/rename/etc. It is significantly different from the standard file input type in an HTML form that allows uploading a file to submit with the form. But there may be some way to restrict the behavior, I know Bob Rayā€™s tutorial page talks about making it upload-only.

Thereā€™s an extra called Simple File Upload TV - itā€™s a custom TV that says it skips the MODX file manager and just directly uploads the file. Pretty old, No idea if itā€™s maintained or if it would work with NP form. https://modx.com/extras/package/simplefileuploadtv

Along those same lines thereā€™s tveasyupload, also says it uploads without the file manager, also very old: https://github.com/alanpich/tveasyupload

FormIt2db would be an alternative to NewsPublisher. All fields would be saved to a db, and then it would be a matter of creating the page from each record. (No idea how to do that but that would be a good new topic to ask here.)

There is also something called Formit2resource that sounds like if it works it would do exactly what you want. But it seems to be a snippet with no documentation (EDIT - may be a Formit hook?): https://gist.github.com/matdave/71a9e1355e598946b470
Hereā€™s a forum thread about it:
https://forums.modx.com/thread/69981/formit-formit2resource

1 Like

Thank you, lucy. I like the ease and efficiency of the NP. All is working fine other than file upload and basic security (still need to figure out whether it is possible to add captcha). Will see if an additional file upload field will do the trick.

You can create a Media Source and limit the users to that Media Source. That way they can only browse in a specific directory or those below it.

But is it possible to skip browsing server directories at all? Indeed this is not what I had in mind andā€¦ even from a usability point of view it would complicate things for our users (who are not modx admins).

If you want to keep using NP, then it seems you need a custom TV like one of the ones I mention above that will upload the file directly and skip the file manager.

Question for Bob: does NP work with custom TVs?

But is it possible to skip browsing server directories at all?

You could certainly limit them to a single directory as long as it had no children.

I think it would also work to just put a tag for the FileUpload snippet on the NewsPublisher page. It could go above or below the Newspublisher tag. You can designate a single directory where all the uploads would go.

I donā€™t think it would work with an Upload TV.

1 Like