Module $serviceInfo Sanitization

[synologic]

Wonderful feature having the manage functions, however, i found a problem.
Im not quite sure if it's my code or not, but here's what happens.
I have the following manage function:

PHP Code:

public function changePassword($serviceInfo) {
global $mysqldb;

$pass = $serviceInfo["pass"];

if ($_GET['do'] == "chpass") {
 //do something here ...
 //if all goes well, the function ends with:
 $action = $_SERVER['REQUEST_URI'];
 $action = str_replace("&do=chpass","",$action);
 header("Location: $action");
 die;
}

//if not called with the DO parameter, just display the info:
$content = <<<END
<form method="POST" action="$action">
<table style="width: 300px">
<tr>
<td><label>Current Password</td>
<td><input type="text" value="$pass" disabled></td>
</tr>
<tr>
<td><label>New Password</td>
<td><input type="text" value="$pass" name="newpass"></td>
</tr>
<tr>
<td colspan="2"><center><input type="submit" value="Change Password"></td>
</tr>
</table>
</form>
END;
return $content;
} 


i add those actions in the constructor like this:
self::$module->addAction("Change Password", array($this, "changePassword"));
self::$module->addAction("Show Logs", array($this, "getLogs"));

where getLogs is a function that returns some dummy data.

Here's what happens, the Change Password ajax tab is shown first, as it's supposed to.
If i do my operations there, its no problem, i can change the password as many times as i want.

But, if i go to Show Logs, then back to Change Password and i click on change button, the browser is redirected to a different URL, like this:

a-center.php?uid=1500&action=servicestatus&sid=1008& ajax=manage&p=0&type=changePassword

and the manage contents are shown in the browser.
It appears to be a problem of $_SERVER['REQUEST_URI'] because if i "compose" the url manually it works just fine, except that in admin and user mode the URL seems to be different and take different parameters.

Any suggestions ?

Regards,
Viorel

LE: it would also be nice, to have manage functions visible only to admins, such as editing ip addresses and such ...

[Cody]

Hi Viorel,

The problem is you're doing a header redirect from an AJAX request. The manage section operates on AJAX requests to replace content within its body (which is comprised of a <div> section), so performing a header redirect here will only redirect the body of the AJAX window. In a way it acts much like an iframe.

Instead of doing a redirect you should render the HTML to cover the scenario being presented, and I recommend using the built-in template system to accomplish this task much easier.

Just create a directory called 'templates' in /inc/modules/your_module_name/, then load your template in your module using:

PHP Code:

$t = new Template(dirname(__FILE__) . "/templates/template_name.pdt");

// Set variables in the template
$t->set('variable_name', $variable);

// Then just remember to return the HTML from the template
return $t->fetch(); 


If you only want certain functions available to a group of people, admins or clients, use the 3rd parameter of Module::addAction(), like so:

self::$module->addAction("Overview", array($this, "getOverview"), "admin"); // for admins only
self::$module->addAction("Overview", array($this, "getOverview"), "client"); // for clients only

[synologic]

Hi,

thanks for the tips, i dropped the redirect within the module and all works fine.
However, i encountered another issue.

I have a second management function that needs to post data. Problem is, after the data is posted, how do i make sure the management tab for that function gets visible, and not the first tab ?

Im not very well versed in AJAX so throw me a bone here

Thanks,
Viorel