NewsPublisher Delete Button Question

[wpicotte]

In a site’s front end, I build a nested menu comprising NewsPublisher-created resources.

I have a custom context menu to enable front-end node management (adding / editing) by the user.

The menu includes resources from multiple templates, with each managed via discrete NewsPublisher forms. Therefore, I create the NpEditThisButton forms manually in order to insert the correct form action URL string, as well as parameters used to set field values in the NP form itself.

The form code sent from the content menu for existing resources (i.e. “edit node”):

<form action=' formURLEdit_29 ' method='post' class='np_button_form' style='right:auto; bottom: auto;'>
    <input type='hidden' name='np_existing' value='true'>
    <input type='hidden' name='np_doc_id' value=' dataID '>
    <input type='submit' class='np_edit_this_button' name='submit' value='Edit Category'>
</form>

where formURLEdit_29 is the URL string + parameters and dataID is relevant the resource ID.

(The HTML above uses ticks, not quotes, because I’m currently concentrating strings and variables. I’ll construct this differently eventually, just an FYI for now.)

NP forms used to edit these resources can accessed either via the context menu or the resource itself.

In the latter scenario, I use an NP form with a call that includes the &deletebutton=1, and the button renders as expected.

This issue I seek to solve is that in the former scenario, I use a different NP form with virtually the same NP form and snippet, but in this case the &deletebutton=1 is somehow ignored.

The snippet call for the form accessed via the context menu:

[[!NewsPublisher? 
 &initrte=`1`
 &published=`1`
 &hidemenu=`0`
 &deletebutton=`1`
 &cssfile=`c_newspublisher.css`
 &postid=`553`
 &parent=`[[!getUrlParam? name=`parent`]]`
 &template=`[[!getUrlParam? name=`template`]]`
 &listboxmax=`1`
 &show=`pagetitle,parent,menuindex,template,content`
 &presets=`content:pattern-library-[[!+nowdate:default=`now`:strtotime:date=`%Y-%m-%d`]],pagetitle:[[!getUrlParam? name=`title`]],menuindex:[[!getUrlParam? name=`index`]]`
 &captions=`pagetitle:Pattern Category,parent:Parent Resource: `
 &outertpl=`c_npOuterTpl-patterns`
]]

And the call for the form accessed via the resource itself:

[[!NewsPublisher? 
 &initrte=`1`
 &published=`1`
 &hidemenu=`0`
 &deletebutton=`1`
 &cssfile=`c_newspublisher.css`
 &postid=`553`
 &parents=`[[+tpl_ids]]`
 &templates=`26,29`
 &listboxmax=`1`
 &show=`pagetitle,template,parent,menuindex,content`
 &presets=`content:pattern-library-[[!+nowdate:default=`now`:strtotime:date=`%Y-%m-%d`]]`
 &captions=`pagetitle:Pattern Category,parent:Parent Resource: ,template:Select template: `
 &outertpl=`c_npOuterTpl-patterns`
]]

(In this second form, parent IDs are generated with a getResource call.

[bobray]

@wpicotte

<input type='hidden' name='np_doc_id' value=' dataID '>

The problem could be that the value of np_doc_id has to be numeric, otherwise $this->existing in the code will be false, and the edit button won’t appear.

if (isset($_POST['np_existing']) &&
   $_POST['np_existing'] == 'true') {
         $this->existing = is_numeric($_POST['np_doc_id'])
             ? $_POST['np_doc_id']
             : false;
   }

[wpicotte]

Thanks for pointing that out. I’ve confirmed the passed value is type number.

You may have meant this when you responded, but to clarify, the delete button does not render.

In any event, if you have other ideas, let me know (and Happy Thanksgiving!).

[bobray]

Are you sure it’s numeric when it reaches SPForm? You could put a log message inside the if statement I posted to make sure. I can’t think of anything else that would cause what you’re seeing, unless the user viewing the page doesn’t have permission to delete that document.

If you’re viewing the page in the front end from the Manager, remember that you’re not logged in to the front end unless you go through a front-end Login form before viewing it, so you don’t have your manager permissions until you do that.

[wpicotte]

There are checks prior to form submission, including not executing HTML injection if variables that should be integers are not, but yours definitely is the simplest explanation.

Another issue is that edits to an existing resource accessed via the context menu creates a new resource, which seems to indicate that the np_existing check also fails?

Would the inclusion of a log message look like this?

/* see if we're editing an existing doc */
        $this->existing = false;
        if (isset($_POST['np_existing']) &&
                $_POST['np_existing'] == 'true') {
            $this->existing = is_numeric($_POST['np_doc_id'])
               
                ? $_POST['np_doc_id']
                : false . $this->modx->log(modX::LOG_LEVEL_ERROR, 'Doc ID is not an integer');
        }

[bobray]

@wpicotte

: false . $this->modx->log(modX::LOG_LEVEL_ERROR, 'Doc ID is not an integer');

It’s not a good idea to set $this->existing to a function, which is what you’re doing.

I would do it this way:

if (isset($_POST['np_existing']) &&
        $_POST['np_existing'] == 'true') {
              $this->existing = is_numeric($_POST['np_doc_id']);

    If (is_numeric($_POST['np_doc_id'])) {
        $this->modx->log(modX::LOG_LEVEL_ERROR, 
            'Doc ID is an integer');
    } else {
        $this->modx->log(modX::LOG_LEVEL_ERROR, 
            'Doc ID is NOT an  integer');
    }
}

If no message error message appears, it means the $_POST variable are not set or not true.

[wpicotte]

Thanks very much for the pointers. The issue is with the front end. I’ll have to reassess the approach.