dolibarr/htdocs/ecm/tpl/enablefiletreeajax.tpl.php
Frédéric FRANCE 585afa14de
Qual: Use dolBuildUrl() instead of manual urlencode() concatenation in ecm (#39557)
* Qual: Use dolBuildUrl() instead of manual urlencode() concatenation in ecm

Replaces manual '?key='.urlencode($val).'&key2='.urlencode($val2)
string-building with dolBuildUrl($path, $params) across the ECM
directory-tree/file-manager code, for consistency with the rest of
the codebase (see htdocs/core/lib/ecm.lib.php, which already uses
this pattern for the same page) and to benefit from dolBuildUrl()'s
buildurl hook.

- core/ajax/ajaxdirtree.php: the dir_card.php edit link built from
  the sql tree loop.
- ecm/dir_card.php: the edit/add-section action buttons and the two
  delete confirmation URLs. Also switches the three buttons that used
  to manually concatenate '&token='.newToken() to dolBuildUrl()'s own
  $addtoken parameter.
- ecm/class/ecmfiles.class.php: EcmFiles::getNomUrl()'s document.php
  and file_card.php URLs.
- ecm/tpl/enablefiletreeajax.tpl.php: the ajaxdirtree.php script URL
  and the ajaxdirpreview.php URL. The token here intentionally stays
  currentToken() (not dolBuildUrl()'s own newToken()-based
  $addtoken), per the existing comment: ajaxdirtree.php has
  NOTOKENRENEWAL defined, so the token must match the one already
  valid on the calling page. $paramwithoutsection is a pre-built raw
  query-string fragment from an external caller and is appended as-is
  after the dolBuildUrl() result rather than folded into it.

Verified all five refactored URL-building expressions produce byte-
identical output to the original code for representative inputs
(including values with '/', '&' and spaces), except for query
parameter order (which has no effect) and one real, minor pre-
existing bug this incidentally fixes: the delete-section confirm URL
in dir_card.php was building '&module='.$module without urlencode(),
now correctly encoded by dolBuildUrl()/http_build_query().

Could not do a live browser check (no Chrome available for Playwright
in this environment) - verified via php -l, phpcs, and a standalone
script comparing old vs new output for each call site instead.

* Qual: Use dolBuildUrl() instead of manual urlencode() concatenation in filemanager.tpl.php

Same refactor as the previous commit, applied to the 7 remaining
manually-concatenated URLs in core/tpl/filemanager.tpl.php (used by
the ECM/medias file manager): the delete-file/delete-section/
convert-to-webp confirm URLs, the create-directory and refresh-list
toolbar buttons (now using dolBuildUrl()'s $addtoken instead of a
manual '&token='.newToken()), the two generate-webp buttons, and the
"Root" link.

$websitekeyandpageid is kept as a helper to build the raw sub-query
string embedded once (single-encoded) as the create-directory
button's 'backtopage' value - it is not itself passed to dolBuildUrl.

Verified all 7 refactored URL-building expressions produce the same
query parameters as the original code for representative inputs
(compared as parsed, order-independent query strings, since
http_build_query() does not preserve insertion order the same way as
the original manual concatenation), including one case
(convertimgwebp confirm with sortfield/sortorder) where the original
code had a harmless but sloppy leading '?&' that dolBuildUrl() no
longer produces.

* fix

* Qual: Use dolBuildUrl() instead of manual urlencode() concatenation in index_auto.php

Same refactor as the previous commits, applied to the 4 manually-
concatenated URLs in ecm/index_auto.php: the delete-file and
delete-section confirm URLs, the refresh-list toolbar link, and the
per-directory link in the auto-directories list.

Verified all 4 refactored URL-building expressions produce the same
query parameters as the original code for representative inputs
(including an empty-module/empty-section case for the refresh link,
and values with '/' and spaces for the others).

* Qual: Use dolBuildUrl() instead of manual urlencode() concatenation in ecm (file_card, dir_add_card, index_medias)

Same refactor as the previous commits, applied to the remaining
manually-concatenated URLs in:
- ecm/file_card.php: the cancel and rename-file redirects, the
  internal download link (document.php), the delete-file confirm URL
  and the edit button.
- ecm/dir_add_card.php: the delete-section confirm URL and the delete
  button (now using dolBuildUrl()'s $addtoken instead of a manual
  '&token='.newToken()).
- ecm/index_medias.php: the $backtopage URL used by
  core/actions_linkedfiles.inc.php after a confirm_deletefile.

Left ecm/search.php's '$param = "&section=".urlencode($section)'
alone: it is a raw query-string fragment (starting with '&', no
leading path) passed into FormFile::list_of_documents(), not a
base+params URL build, so it does not fit the dolBuildUrl($path,
$params) shape - same reasoning as $paramwithoutsection in the
already-refactored enablefiletreeajax.tpl.php.

Verified all 8 refactored URL-building expressions produce the same
query parameters as the original code for representative inputs
(order-independent comparison, since http_build_query() does not
preserve the original insertion order).
2026-08-17 04:41:05 +02:00

151 lines
5.5 KiB
PHP

<?php
/* Copyright (C) 2012 Regis Houssin <regis.houssin@inodbox.com>
* Copyright (C) 2018 Laurent Destailleur <eldy@users.sourceforge.net>
* Copyright (C) 2025-2026 Frédéric France <frederic.france@free.fr>
* Copyright (C) 2026 MDW <mdeweerd@users.noreply.github.com>
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation; either version 3 of the License, or
* (at your option) any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with this program. If not, see <https://www.gnu.org/licenses/>.
*
* Output javascript for interactions code of ecm module
* $conf, $module, $param, $preopened, $nameforformuserfile may be defined
*/
/**
* @var ?Conf $conf
* @var Translate $langs
* @var string $param
*/
'
@phan-var-force string $param
';
// Protection to avoid direct call of template
if (empty($conf) || !is_object($conf)) {
print "Error, template enablefiletreeajax.tpl.php can't be called as URL";
exit;
}
// Must have set $module, $nameforformuserfile, $preopened
?>
<!-- BEGIN PHP TEMPLATE ecm/tpl/enablefiletreeajax.tpl.php -->
<!-- Doc of fileTree plugin at https://www.abeautifulsite.net/jquery-file-tree -->
<script type="text/javascript">
<?php
if (empty($module)) {
$module = 'ecm';
}
if (empty($nameforformuserfile)) {
$nameforformuserfile = '';
}
$paramwithoutsection = preg_replace('/&?section=(\d+)/', '', $param);
$openeddir = '/'; // The root directory shown
// $preopened // The dir to have preopened
// We must use token=currentToken() and not newToken() here because ajaxdirtree has NOTOKENRENEWAL define so there
// is no rollup of token so we must compare with the one valid on main page.
$paramsdirtree = array(
'token' => currentToken(),
'modulepart' => $module,
'openeddir' => $openeddir,
);
if (!empty($preopened)) {
$paramsdirtree['preopened'] = $preopened;
}
// $paramwithoutsection is a raw, already-built query string fragment (starting with '&' when not empty), so it is
// appended as-is after the encoded params above, not merged into $paramsdirtree.
$dirtreeurl = dolBuildUrl(DOL_URL_ROOT.'/core/ajax/ajaxdirtree.php', $paramsdirtree).(empty($paramwithoutsection) ? '' : $paramwithoutsection);
?>
$(document).ready(function() {
$('#filetree').fileTree({
root: '<?php print dol_escape_js($openeddir); ?>',
// Ajax called if we click to expand a dir (not a file). Parameter 'dir' is provided as a POST parameter by fileTree code to this following URL.
script: '<?php echo $dirtreeurl; ?>',
folderEvent: 'click', // 'dblclick'
multiFolder: false },
// Called if we click on a file (not a dir)
function(file) {
console.log("We click on a file "+file);
$("#mesg").hide();
loadandshowpreview(file,0);
},
// Called if we click on a dir (not a file)
function(elem) {
id=elem.attr('id').substr(12); // We get id that is 'fmdirlia_id_xxx' (id we want is xxx)
rel=elem.attr('rel')
console.log("We click on a dir id="+id+", we call the ajaxdirtree.php with modulepart=<?php echo $module; ?>, param=<?php echo $paramwithoutsection; ?>");
console.log("We also save id and dir name into <?php echo $nameforformuserfile ?>_section_id|dir (vars into form to attach new file in filemanager.tpl.php) with id="+id+" and rel="+rel);
jQuery("#<?php echo $nameforformuserfile ?>_section_dir").val(rel);
jQuery("#<?php echo $nameforformuserfile ?>_section_id").val(id);
jQuery("#section_dir").val(rel);
jQuery("#section_id").val(id);
jQuery("#section").val(id);
jQuery('#<?php echo $nameforformuserfile ?>').show();
console.log("We also execute the loadandshowpreview() that is on the onclick of each li defined by ajaxdirtree");
}
// The loadanshowpreview is also call by the 'onclick' set on each li return by ajaxdirtree
);
$('#refreshbutton').click( function() {
console.log("Click on refreshbutton");
dolBlockUI("<?php echo $langs->transnoentities('PleaseBePatient'); ?>");
$.get("<?php echo DOL_URL_ROOT.'/ecm/ajax/ecmdatabase.php'; ?>", {
action: 'build',
token: '<?php echo newToken(); ?>',
element: 'ecm'
}, function(response) {
setTimeout(() => {
dolUnblockUI();
location.href='<?php echo $_SERVER['PHP_SELF']; ?>';
}, 1000); // delai 1s
});
});
});
function loadandshowpreview(filedirname,section)
{
//alert('filedirname='+filedirname);
//console.log(filedirname);
//console.log('loadandshowpreview for section='+section);
$('#ecmfileview').empty();
var url = '<?php echo dol_escape_js(dolBuildUrl(dol_buildpath('/core/ajax/ajaxdirpreview.php', 1), array('action' => 'preview', 'module' => $module))); ?>&section='+urlencode(section)+'&file='+urlencode(filedirname)<?php echo (empty($paramwithoutsection) ? '' : "+'".dol_escape_js($paramwithoutsection)."'"); ?>;
$.get(url, function(data) {
//alert('Load of url '+url+' was performed : '+data);
pos=data.indexOf("TYPE=directory",0);
//alert(pos);
if ((pos > 0) && (pos < 20))
{
filediractive=filedirname; // Save current dirname
filetypeactive='directory';
}
else
{
filediractive=filedirname; // Save current dirname
filetypeactive='file';
}
$('#ecmfileview').append(data);
});
}
</script>
<!-- END PHP TEMPLATE ecm/tpl/enablefiletreeajax.tpl.php -->