token/ form_sanitizer problem -. how i can merge post data: PHPFusion 9 Support

Home
Search

Oh no! Where's the JavaScript?
Your Web browser does not have JavaScript enabled or does not support JavaScript. Please enable JavaScript on your Web browser to properly view this Web site, or upgrade to a Web browser that does support JavaScript.

Hi sorry for post again from my problems

normaly all submit form data will be save so:

Code Download source

"submit_criteria" => addslashes(serialize($criteriaArray))

this works

but i want to add some photos and save this photos in a folder and in a other database table (not DB_SUBMISSIONS -- > DB_FIGURE_IMAGES
"submit_criteria" => addslashes(serialize($criteriaArray))
If the post data are all set to 0. So, everything that comes after that is not treated with form_sanitizer.
Each form gets a token and it will be removed. Defender comes with so false and can not execute and store the images.

im looking for a possibility to merge this

Code Download source

      // Form posted
      if (isset($_POST['submit_figure'])) {
         //$submit_info['figure_description'] = nl2br(parseubb(stripinput($_POST['figure_description'])));
         
         // Check Fields
         $criteriaArray = array(
            "figure_datestamp"    => form_sanitizer($_POST['figure_datestamp'],    "", "figure_datestamp"),         
            "figure_freigabe"     => form_sanitizer($_POST['figure_freigabe'],     0,  "figure_freigabe"),
            "figure_title"        => form_sanitizer($_POST['figure_title'],        "", "figure_title"),
            "figure_variant"      => form_sanitizer($_POST['figure_variant'],      "", "figure_variant"),
            "figure_manufacturer" => form_sanitizer($_POST['figure_manufacturer'], "", "figure_manufacturer"),
            "figure_artists"      => form_sanitizer($_POST['figure_artists'],      "", "figure_artists"),
            "figure_country"      => form_sanitizer($_POST['figure_country'],      "", "figure_country"),
            "figure_brand"        => form_sanitizer($_POST['figure_brand'],        "", "figure_brand"),
            "figure_series"       => form_sanitizer($_POST['figure_series'],       "", "figure_series"),
            "figure_scale"        => form_sanitizer($_POST['figure_scale'],        "", "figure_scale"),
            "figure_weight"       => form_sanitizer($_POST['figure_weight'],       "", "figure_weight"),
            "figure_height"       => form_sanitizer($_POST['figure_height'],       "", "figure_height"),
            "figure_width"        => form_sanitizer($_POST['figure_width'],        "", "figure_width"),
            "figure_depth"        => form_sanitizer($_POST['figure_depth'],        "", "figure_depth"),
            "figure_material"     => form_sanitizer($_POST['figure_material'],     "", "figure_material"),
            "figure_poa"          => form_sanitizer($_POST['figure_poa'],          "", "figure_poa"),
            "figure_packaging"    => form_sanitizer($_POST['figure_packaging'],    "", "figure_packaging"),
            "figure_retailprice"  => form_sanitizer($_POST['figure_retailprice'],  "", "figure_retailprice"),
            "figure_usedprice"    => form_sanitizer($_POST['figure_usedprice'],    "", "figure_usedprice"),
            "figure_limitation"   => form_sanitizer($_POST['figure_limitation'],   "", "figure_limitation"),
            "figure_cat"          => form_sanitizer($_POST['figure_cat'],          "", "figure_cat"),
            "figure_editionsize"  => form_sanitizer($_POST['figure_editionsize'],  "", "figure_editionsize"),
            "figure_pubdate"      => form_sanitizer($_POST['figure_pubdate'],      "", "figure_pubdate"),
            "figure_agb"          => form_sanitizer($_POST['figure_agb'],          0,  "figure_agb"),
            "figure_submitter"    => form_sanitizer($_POST['figure_submitter'],    "", "figure_submitter"), 
            "figure_description"  => addslash(nl2br(parseubb(stripinput($_POST['figure_description'])))),
            "figure_accessories"  => addslash(nl2br(parseubb(stripinput($_POST['figure_accessories'])))),         
         );
         
         //Save               
         if (defender::safe()) {
            $inputArray = array(
               "submit_type" => "f",
               "submit_user" => $userdata['user_id'],
               "submit_datestamp" => time(),
               "submit_criteria" => addslashes(serialize($criteriaArray))
            );
            dbquery_insert(DB_SUBMISSIONS, $inputArray, "save", array(
                           'keep_session' => TRUE));

with this but i cant get find a resolution for this

Code Download source

            // Image Upload
            
            $upload = form_sanitizer($_FILES['figure_image'], '', 'figure_image');
            if (!empty($upload)) {
               $totalFiles = count($upload);
               for ($i = 0; $i < $totalFiles; $i++) {
                  $currentUpload = $upload[$i];
                  if ($currentUpload['error'] == 0) {
                     $imageArray = array(
                        'figure_images_figure_id' => $figureID,
                        'figure_images_image' => $currentUpload['image_name'],
                        'figure_images_thumb' => $currentUpload['thumb1_name']
                     );
                     dbquery_insert(DB_FIGURE_IMAGES, $imageArray, "save");

can anyone help please?

0 replies

Falk

answered 25 Jun 2016 at 08:54 AM

Super Admin

You must first create the database with correct tables in it, a minimum of all entries in $criteriaArray().
Then define it in infusion_db.php, just changing the insert query is not enough.

0 replies

Hi thanx for your answer.

i have do that at first .. i guess its not the problem.

look here this is from my infsuion.db.php

Code Download source


................
if (!defined("DB_FIGURE_USERFIGURES")) {
   define("DB_FIGURE_USERFIGURES", DB_PREFIX."figure_userfigures");
}
if (!defined("DB_FIGURE_IMAGES")) {
   define("DB_FIGURE_IMAGES", DB_PREFIX."figure_images");

$inf_folder = "figurelib";
   
   // FOLDERS
if (!defined("FIGURES")) {
   define("FIGURES", INFUSIONS.$inf_folder."/figures/");
}
if (!defined("IMAGES_FIGURES")) {
   define("IMAGES_FIGURES", INFUSIONS.$inf_folder."/figures/images/");
}
if (!defined("THUMBS_FIGURES")) {
   define("THUMBS_FIGURES", INFUSIONS.$inf_folder."/figures/images/thumbs/");
}
..............

and the database for DB_FIGURE_IMAGES i have defined in infusions.php

Code Download source

$inf_newtable[] = DB_FIGURE_IMAGES." (
figure_images_image_id mediumint(8) unsigned NOT NULL AUTO_INCREMENT, 
figure_images_figure_id varchar(100) NOT NULL DEFAULT '',
figure_images_image varchar(100) NOT NULL DEFAULT '',
figure_images_thumb varchar(100) NOT NULL DEFAULT '',
figure_images_sorting varchar(50) NOT NULL DEFAULT '',
figure_images_language VARCHAR(50) NOT NULL DEFAULT '".LANGUAGE."',
PRIMARY KEY (figure_images_image_id)
   ) ENGINE=MyISAM DEFAULT CHARSET=UTF8 COLLATE=utf8_unicode_ci";

I did not manage that both sets of data are stored. There are only stored the data in the DB_SUBMISSION. Neither the images are stored in the folder, nor the associated data in the DB_FIGURES_IMAGES. And no one can help why this is so.

The data that enter into the DB_SUBMISSIONS are later stored in the admin_submissions.php from DB_SUBMISSIONS into DB_FIGURE_ITEMS. This happens when the figure of the admin will be published. That works just fine

Since weeks we are looking for a solution how to save both data sets in a single operation.

all my files you find here:

Code Download source

https://github.com/Catzenjaeger/FigureLib_3

0 replies

Falk

answered 25 Jun 2016 at 03:32 PM

Super Admin

ah, you are on the track track then ,
On your prev post it still saves to submission

Code Download source

            dbquery_insert(DB_SUBMISSIONS, $inputArray, "save", array(

that need to be changed

0 replies

BUT HOW? non have do that is php fusion before and none can tell it to me. All german give up on tis problem :)

0 replies

I strive very hard to help developers at all times whenever i see seriousness on the question.

Lets take it step by step. Its always communication error.

How about uploading your work here and let us run a quick check?

0 replies

Hi thanx for response.

I explain the problem once again complete with new words. I have developed an infusion for Version 9 installation. The base is up and running well. The infusion is a database of action figures. Members of the site are using Submit Form will have the opportunity to submit new figures. The form works only partially.

In this form I let the data coming from the dropdowns and textboxes and save this in the DB_SUBMISSIONS. But the should exist in this form has the chance to upload pictures. Totally I want to limit the upload to 10 images.

The problem at this Submit now is, that the routine that does the upload image, does not work. In the file everything breaks after the entry of the normal data in the DB_SUBMISSION. However, the images should be saved into the DB_FIGURES_IMAGES. There, however, makes a nothing and in the Folder on the FTP comes to nothing.

in file figurelib/admin/figurelib_figure submission, I would then see the images again, to upload a picture or delete existing. There, too, does not work.

The complete Infusion you find in GITHUB HERE

i attach the submit always here.

Quote

figurelib/infuison.php
$inf_newtable[] = DB_FIGURE_IMAGES." (
figure_images_image_id mediumint(8) unsigned NOT NULL AUTO_INCREMENT,
figure_images_figure_id varchar(100) NOT NULL DEFAULT '',
figure_images_image varchar(100) NOT NULL DEFAULT '',
figure_images_thumb varchar(100) NOT NULL DEFAULT '',
figure_images_sorting varchar(50) NOT NULL DEFAULT '',
figure_images_language VARCHAR(50) NOT NULL DEFAULT '".LANGUAGE."',
PRIMARY KEY (figure_images_image_id)
) ENGINE=MyISAM DEFAULT CHARSET=UTF8 COLLATE=utf8_unicode_ci";

Quote

figurelib/infusion.db.php
if (!defined("DB_FIGURE_USERFIGURES") {
define("DB_FIGURE_USERFIGURES", DB_PREFIX."figure_userfigures";
}
// FOLDERS
if (!defined("FIGURES") {
define("FIGURES", INFUSIONS.$inf_folder."/figures/";
}
if (!defined("IMAGES_FIGURES") {
define("IMAGES_FIGURES", INFUSIONS.$inf_folder."/figures/images/";
}
if (!defined("THUMBS_FIGURES") {
define("THUMBS_FIGURES", INFUSIONS.$inf_folder."/figures/images/thumbs/";
}

Quote

figurelib/submit.php --> plz take a look in attachment

Catzenjaeger attached the following file:

submit.zip [No information available / 203 Downloads]

0 replies

I have revised some codes on your git and submitted a pull request for your testing.

The problem was:

1. You used a file upload DOM (i.e form_fileinput) API but you did not open up enctype in openform( ..... array('enctype'=>true);

2. The upload codes are submitted for your reference.

3. You have a separate DB for your figurine image database, you should bear in mind that when using dbquery_insert more than once, you should make sure you keep the "keep_session" to true in the earlier ones. The last one can be set to false so it will remove the field sessions for defender as a security measure. I designed this to prevent value tampering through browser proxy injection to keep DB safe from alteration unless your server permits it specifically. When you keep_session as true, it opens up values as 'reusable' and when the last one is false, it will instantly kill all values to NULL. Then you should redirect immediately at script end $_POST. Then it will refresh the token and generate a new one to prevent Cross Site Reference Script Injection Forgery (CSRF). I want to explain to you how defender/dynamic works for security.

4. There are many samples in our provided infusions, although still being nitpicked a thousands times all over again. Haha. You can copy the codes in the infusions around if you feel comfortable with them.

5. The PHPFusion 9 was created so your work can be edited easily as long as you understand what you are doing. It's a long fetch to say it will be 'stable' at any time soon, because it needs to be tweak overtime, just as all OS need to.

OK, my request in return, please guide the German community with your knowledge by telling them your solutions.

Edited by Chan on 02-07-2016 14:23, 8 y

0 replies

ok many thanx for your help. I worked hard for this infusions since week but im a beginner .. i have never before coding so a big project.
i have change some files now -- plz take a look to GITHUB

as is currently submit.php it can not work. How can the be used to connect with the images? The data is stored in DB_SUBMISSION and the images into the DB_FIGURE_IMAGES. But how can I find the right picture to Figure again later?

thanx thanx thanx

Edited by Catzenjaeger on 02-07-2016 18:51, 8 y

0 replies

Thank you for the interest in holding up a project with us. It's really cool.

I won't go to using submissions if I were you. The codes you developed for figure admin is much more advanced, and therefore I advise you open the same form to users, however, alter the current figure adding admin something like ---

Code Download source


if (iMEMBER) {
echo form_hidden("item_status", 0);
} elseif (iADMIN && checkrights("FI)) {
echo form_select("item_status", .....);
}

I have tried the figure admin items last night, and the figure admin definitely store uploaded photos. So, if you finish the last part of the script, you can open that script for your users. Remove checkrights("FI"); on the top so your registered users can use it too. This way you save time, and just need to maintain 1 page of code.

---

For callback on the images that you have linked to the figure item, you can try -

Use this SQL

Code Download source


$query = "
SELECT a.*, b.* 
FROM ".YOUR_ITEM_TABLE." a
LEFT JOIN ".DB_FIGURE_IMAGE." b ON a.item_id = b. item_id
GROUP BY a.item_id
";
$result = dbquery($query);

Please see Album to Photo relations in gallery infusion. They are quite simple to understand.

I hope the rest of the community can guide you to it. And yes, your project is very big and ambitious. I really hope you can complete it.
Please get another seasoned developer to engage in your project. This way, you can figure out the blank part out twice faster, (my fav project partner is Falk), thats how we forged good friendship and manage to bring a 8 years project down to 2 years ^^

Edited by N/A on 03-07-2016 09:44, 8 y

0 replies

Thanks for the invested time and help ) thanx thanx thanx

to the image upload :
Just as already mentioned, how should I assign the images clearly a figure?
At the moment (about the Submissions system) the data of the figures are stored in the DB_SUBMISSIONS. The images are stored in another table. But they have no clear relation. Figures ID is only awarded if the figure of the Submission is stored into the area FIGURE_ITEMS. I have the submit.ph customized with your code fragment that the images are stored. However, I can not do it, a relationship between the images and the submitted Figures. This is my big problem

If I do that Submitting via the admin area then I can simply assign the figures the pictures because the ID's available and both are stored in the same moment in the database. Although this is a good idea for submissions to use the form (admin_figurelib.php), but then ..... all my adjustments i made for the submitting system were then for nothing. I would have to make everything new.
Currently my submissions are indeed analogous to submissions of news, blogs, articles, etc. What should I do now? Dont foget im a beginner in PHP!!!!

The submit.php form and the form admin / admin figurelib.php work completely differently. The first stores only in the DB_SUBMISSIONS the other equal in FIGURE_ITEMS.

I tried to write in a first version before the submissions directly into the FIGURE_ITEMS. The problem is that the submission system as the moment will not work, as suggested when I make the entries directly from the admin area. The Submission System PHP FUSION's is cool (catalog list of all entries, activate and modify the entries) I would not give up.

Another open issue ... the processing of the images. In the Edit area, you can edit the Figure. But at the moment not the images. The images should be read again from the database and display to delete it or replace it.

I am with my skills at the end. There is not much to do really but I have to give up now.

Edited by Catzenjaeger on 03-07-2016 14:50, 8 y

0 replies

-------------------------------------------------------------------------

Update:
i need a little bit help please .... i have change following:

In submit.php i have change that the figure data now will be stored in the DB_FIGURE_ITEMS and the image in DB_FIGURES_IMAGES.
this works but i have no unique id ... how should I assign the pictures later?

here is the file on github --> https://github.com/Catzenjaeger/Figur...submit.php

i change the following files too:
admin/admin_figurelib.php --> https://github.com/Catzenjaeger/Figur...p --> here i have the problem that the figure not will save when i try to publish the figure
admin/admin_figurelib_submissions --> works perfect atm --> transfered all data to file /admin_figurelib_submissions.php for publish, delete and editing a figure (before it was inside the same file)

Edited by Catzenjaeger on 04-07-2016 15:26, 8 y

0 replies

I have submitted to you my proposed changes for the image saving data.

https://github.com/Catzenjaeger/FigureLib_3/pull/16/files

Your answer was dblastid(); function that is both compatible with PDO and MySQL mode.

As a word of encouragement, your work is relatively huge with the fields, so it is harder than normally it should be. Take your time, finish and review as much as you can. You're doing everything just fine and according to the pace it should be during your learning curve coding in 9.

The previous development team spent really a lot of effort creating the defender+dynamics to create a globally secure approach for everyone. Bugs such as the forms can be terminated through core repository, and once that is done, all PF sites updated can be secured instantly, instead of relying on 3rd party infusions developer's best effort. That is one of the primary goal for version 9. It's a very big step towards intuitive and smart factor we try to design into Php-Fusion. I do get awry if it falls short at times, but I'll do my best to make sure it's top notch.

There were bugs around still, but those are non-fatal. We'll be patching forever from here. Don't let the name Stable stop you from your development, and don't wait. Just go ahead with what you do best.

Edited by Chan on 06-07-2016 06:59, 8 y

0 replies

Thanx for your words and your help on my project.
I like php fusion and works with it since many years but have never coded a so big addon. But i need this so fast as possible.
I work every day on it but is really heavy as coding beginner to make it. I want help yes ... its not a secret

i have checked and try your GitHub entrie but it dosent work