Skip to content

EXTENDCOMM-52 : In back-office, add the possibility to modify an admi… #2

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
poirierje wants to merge 7 commits into
base: develop_core7
Choose a base branch
from
Open

EXTENDCOMM-52 : In back-office, add the possibility to modify an admi… #2

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
bca55c0
EXTENDCOMM-52 : In back-office, add the possibility to modify an admi…
Jan 18, 2018
5ed30b1
EXTENDCOMM-52 : In back-office, add the possibility to modify an admi…
Jan 18, 2018
66694df
EXTENDCOMM-53 : Add CSRF token protection to comment modification
Jan 22, 2018
cfbca93
EXTENDCOMM-53 : Add CSRF token protection to comment modification
Jan 22, 2018
7948271
EXTENDCOMM-53 : Add CSRF token protection to comment modification
Jan 22, 2018
3a2f135
Merge branch 'EXTENDCOMM-52' of https://github.com/lutece-platform/lu…
Jan 22, 2018
b083184
correcting property delete in previous commit
Jan 23, 2018
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 7 additions & 0 deletions ...java/fr/paris/lutece/plugins/extend/modules/comment/resources/comment_messages.properties
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,6 +18,7 @@ message.stop.genericMessage=You cannot perform this action because of the follow
message.error.badJcaptcha=The captcha is not validated !
message.notify.subject=A comment has been submitted to the resource {0}.
message.error.cannotDelete=You cannot delete the comment
message.error.cannotModifyUserComment=Only admin comments can be modified

##################################################
# Templates
Expand Down Expand Up @@ -106,6 +107,7 @@ comment_info.filterByPinnedAllNotPinned=Not Pinned
comment_info.filterByImportant=--Filter on important--
comment_info.filterByImportantAllFlagAsImportant=Flag as important
comment_info.filterByImportantAllNotFlagAsImportant=Not Flag as important

# manage_comments.html
manage_comments.labelManageComments=Manage comments

Expand All @@ -118,3 +120,8 @@ create_extender_from_resource.labelRemoveExtender=Remove comment extension
create_extender_from_resource.labelAddExtender=Add comment extension

create_comment.pageTitle=Add a comment

# modify_admin_comment.html
modify_admin_comment.pageTitle=Modify a comment
modify_admin_comment.labelName=Nickname
modify_admin_comment.labelComment=Comment
6 changes: 6 additions & 0 deletions ...a/fr/paris/lutece/plugins/extend/modules/comment/resources/comment_messages_fr.properties
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,6 +18,7 @@ message.stop.genericMessage=Vous ne pouvez pas faire cette op\u00e9raction pour
message.error.badJcaptcha=Le captcha n'est pas valide !
message.notify.subject=Un commentaire a \u00e9t\u00e9 ajout\u00e9 sur la ressource {0}.
message.error.cannotDelete=Vous ne pouvez pas supprimer le commentaire
message.error.cannotModifyUserComment=Seuls les commentaires post\u00e9s par les administrateurs peuvent \u00eatre modifi\u00e9s

##################################################
# Templates
Expand Down Expand Up @@ -71,6 +72,11 @@ add_comment.labelName=Pseudo
add_comment.labelComment=Commentaire
add_comment.messageModeratedComment=Les commentaires sont soumis \u00e0 approbation du webmestre.

# modify_admin_comment.html
modify_admin_comment.pageTitle=Modifier un commentaire
modify_admin_comment.labelName=Pseudo
modify_admin_comment.labelComment=Commentaire

# comment_info.html
comment_info.labelManageComments=G\u00e9rer les commentaires
comment_info.labelNoComment=Aucun commentaire
Expand Down
4 changes: 4 additions & 0 deletions src/java/fr/paris/lutece/plugins/extend/modules/comment/util/constants/CommentConstants.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -64,6 +64,8 @@ public final class CommentConstants
public static final String MESSAGE_CONFIRM_REMOVE_COMMENT = "module.extend.comment.message.confirm.removeComment";
public static final String MESSAGE_ERROR_GENERIC_MESSAGE = "module.extend.comment.message.error.genericMessage";
public static final String MESSAGE_NOTIFY_SUBJECT = "module.extend.comment.message.notify.subject";
public static final String MESSAGE_ERROR_CANNOT_MODIFY_USER_COMMENT = "module.extend.comment.message.error.cannotModifyUserComment";

public static final String MESSAGE_ERROR_CANNOT_DELETE = "module.extend.comment.message.error.cannotDelete";

// PARAMETERS
Expand All @@ -72,6 +74,7 @@ public final class CommentConstants
public static final String PARAMETER_ID_EXTENDABLE_RESOURCE = "idExtendableResource";
public static final String PARAMETER_EXTENDABLE_RESOURCE_TYPE = "extendableResourceType";
public static final String PARAMETER_ID_COMMENT = "idComment";
public static final String PARAMETER_ID_PARENT_COMMENT = "idParentComment";
public static final String PARAMETER_REFERER = "referer";
public static final String PARAMETER_FROM_URL = "from_url";
public static final String PARAMETER_AUTHORIZE_SUB_COMMENTS = "authorizeSubComments";
Expand All @@ -94,6 +97,7 @@ public final class CommentConstants
public static final String MARK_MYLUTECE_USER = "myLuteceUser";
public static final String MARK_LIST_IDS_MAILING_LIST = "listIdsMailingList";
public static final String MARK_COMMENT = "comment";
public static final String MARK_ID_PARENT_COMMENT = "idParentComment";
public static final String MARK_RESOURCE_EXTENDER = "resourceExtender";
public static final String MARK_RESOURCE_EXTENDER_MAP = "resourceExtenderMap";
public static final String MARK_RESOURCE_EXTENDER_NAME = "resourceExtenderName";
Expand Down
133 changes: 130 additions & 3 deletions src/java/fr/paris/lutece/plugins/extend/modules/comment/web/CommentJspBean.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -36,15 +36,13 @@
import java.sql.Timestamp;
import java.util.Date;
import java.util.HashMap;
import java.util.List;
import java.util.Map;

import javax.servlet.http.HttpServletRequest;

import org.apache.commons.lang.StringUtils;

import fr.paris.lutece.plugins.extend.modules.comment.business.Comment;
import fr.paris.lutece.plugins.extend.modules.comment.business.CommentFilter;
import fr.paris.lutece.plugins.extend.modules.comment.service.CommentPlugin;
import fr.paris.lutece.plugins.extend.modules.comment.service.CommentService;
import fr.paris.lutece.plugins.extend.modules.comment.service.ICommentService;
Expand All @@ -53,15 +51,19 @@
import fr.paris.lutece.plugins.extend.service.extender.history.IResourceExtenderHistoryService;
import fr.paris.lutece.plugins.extend.service.extender.history.ResourceExtenderHistoryService;
import fr.paris.lutece.portal.business.user.AdminUser;
import fr.paris.lutece.portal.service.admin.AccessDeniedException;
import fr.paris.lutece.portal.service.admin.AdminUserService;
import fr.paris.lutece.portal.service.message.AdminMessage;
import fr.paris.lutece.portal.service.message.AdminMessageService;
import fr.paris.lutece.portal.service.security.SecurityTokenService;
import fr.paris.lutece.portal.service.spring.SpringContextService;
import fr.paris.lutece.portal.service.template.AppTemplateService;
import fr.paris.lutece.portal.service.util.AppLogService;
import fr.paris.lutece.portal.service.util.AppPathService;
import fr.paris.lutece.portal.web.admin.PluginAdminPageJspBean;
import fr.paris.lutece.portal.web.constants.Messages;
import fr.paris.lutece.portal.web.pluginaction.DefaultPluginActionResult;
import fr.paris.lutece.portal.web.pluginaction.IPluginActionResult;
import fr.paris.lutece.util.html.HtmlTemplate;
import fr.paris.lutece.util.http.SecurityUtil;
import fr.paris.lutece.util.url.UrlItem;
Expand All @@ -86,9 +88,12 @@ public class CommentJspBean extends PluginAdminPageJspBean
// MESSAGES
private static final String MESSAGE_MANDATORY_FIELD = "portal.util.message.mandatoryField";
private static final String MESSAGE_TITLE_CREATE_COMMENT = "module.extend.comment.create_comment.pageTitle";
private static final String MESSAGE_TITLE_MODIFY_ADMIN_COMMENT = "module.extend.comment.modify_admin_comment.pageTitle";
private static final String MESSAGE_ERROR_ = "module.extend.comment.modify_admin_comment.pageTitle";

// TEMPLATE
private static final String TEMPLATE_CREATE_COMMENT = "admin/plugins/extend/modules/comment/create_comment.html";
private static final String TEMPLATE_MODIFY_ADMIN_COMMENT = "admin/plugins/extend/modules/comment/modify_admin_comment.html";

// CONSTANT
private static final String CONSTANT_SPACE = " ";
Expand Down Expand Up @@ -474,7 +479,129 @@ public String doCreateComment( HttpServletRequest request )
return url.getUrl( );
}


/**
* Get the modify creation page, only for admin comments
*
* @param request The request
* @return The HTML content to display
*/
public String getModifyAdminComment( HttpServletRequest request ) throws AccessDeniedException
{
setPageTitleProperty( MESSAGE_TITLE_MODIFY_ADMIN_COMMENT );

String strExtendableResourceType = request.getParameter( CommentConstants.PARAMETER_EXTENDABLE_RESOURCE_TYPE );
String strIdExtendableResource = request.getParameter( CommentConstants.PARAMETER_ID_EXTENDABLE_RESOURCE );
String strIdComment = request.getParameter( CommentConstants.PARAMETER_ID_COMMENT );
String strIdParentComment = request.getParameter( CommentConstants.PARAMETER_ID_PARENT_COMMENT );
String strViewAllResources = request.getParameter( CommentConstants.PARAMETER_VIEW_ALL_RESOURCES);

// AdminUser user = AdminUserService.getAdminUser( request );

// Getting the comment to modify
int nIdComment = Integer.parseInt( strIdComment );
Comment comment = _commentService.findByPrimaryKey( nIdComment );

// Only admin comment can be modified
if ( !comment.getIsAdminComment( ) )
{
throw new AccessDeniedException(CommentConstants.MESSAGE_ERROR_CANNOT_MODIFY_USER_COMMENT);
}

Map<String, Object> model = new HashMap<String, Object>( );

model.put( CommentConstants.MARK_ALL_RESOURCES, !StringUtils.isEmpty(strViewAllResources) && new Boolean(strViewAllResources) );
model.put( CommentConstants.MARK_EXTENDABLE_RESOURCE_TYPE, strExtendableResourceType );
model.put( CommentConstants.MARK_ID_EXTENDABLE_RESOURCE, strIdExtendableResource );
model.put( CommentConstants.MARK_ID_PARENT_COMMENT, strIdParentComment );

model.put( CommentConstants.MARK_COMMENT, comment );

model.put( CommentConstants.MARK_WEBAPP_URL, AppPathService.getBaseUrl( request ) );
model.put( CommentConstants.MARK_LOCALE, AdminUserService.getLocale( request ) );
model.put( CommentConstants.PARAMETER_FROM_URL, StringUtils.replace( request.getParameter( CommentConstants.PARAMETER_FROM_URL ), CommentConstants.CONSTANT_AND, CommentConstants.CONSTANT_AND_HTML ) );

// Token for CSRF security
model.put( SecurityTokenService.MARK_TOKEN, SecurityTokenService.getInstance( ).getToken( request, TEMPLATE_MODIFY_ADMIN_COMMENT ) );

HtmlTemplate template = AppTemplateService.getTemplate( TEMPLATE_MODIFY_ADMIN_COMMENT, AdminUserService.getLocale( request ), model );

return getAdminPage( template.getHtml( ) );
}

/**
* Do modify an admin comment
* @param request The request
* @return The URL to redirect to
*/
public String doModifyAdminComment( HttpServletRequest request ) throws AccessDeniedException
{

String strExtendableResourceType = request.getParameter( CommentConstants.PARAMETER_EXTENDABLE_RESOURCE_TYPE );
String strIdExtendableResource = request.getParameter( CommentConstants.PARAMETER_ID_EXTENDABLE_RESOURCE );
String strIdComment = request.getParameter( CommentConstants.PARAMETER_ID_COMMENT );
String strIdParentComment = request.getParameter( CommentConstants.PARAMETER_ID_PARENT_COMMENT );
String strName = request.getParameter( CommentConstants.PARAMETER_NAME );
String strComment = request.getParameter( CommentConstants.MARK_COMMENT );

int nIdComment = Integer.parseInt( strIdComment );
Comment comment = _commentService.findByPrimaryKey( nIdComment );

// Only admin comment can be modified
if ( !comment.getIsAdminComment( ) )
{
return AdminMessageService.getMessageUrl( request, CommentConstants.MESSAGE_ERROR_CANNOT_MODIFY_USER_COMMENT, AdminMessage.TYPE_STOP );
}

if ( StringUtils.isEmpty( strComment ) )
{
Object[] tabRequiredFields = { CommentConstants.MARK_COMMENT };
return AdminMessageService.getMessageUrl( request, MESSAGE_MANDATORY_FIELD, tabRequiredFields, AdminMessage.TYPE_STOP );
}

if ( StringUtils.isEmpty( strName ) )
{
Object[] tabRequiredFields = { CommentConstants.PARAMETER_NAME };
return AdminMessageService.getMessageUrl( request, MESSAGE_MANDATORY_FIELD, tabRequiredFields, AdminMessage.TYPE_STOP );
}

// Validating CSRF token
if ( !SecurityTokenService.getInstance( ).validate( request, TEMPLATE_MODIFY_ADMIN_COMMENT ) )
{
throw new AccessDeniedException( "Invalid security token" );
}

AdminUser user = AdminUserService.getAdminUser( request );

comment.setName ( strName );
comment.setComment( strComment );

_commentService.update( comment );

// we redirect the user to the manage comment page
String strPostBackUrl = (String) request.getSession( ).getAttribute(
CommentPlugin.PLUGIN_NAME + CommentConstants.SESSION_COMMENT_ADMIN_POST_BACK_URL );
request.getSession( ).setAttribute(
CommentPlugin.PLUGIN_NAME + CommentConstants.SESSION_COMMENT_ADMIN_POST_BACK_URL, null );
if ( StringUtils.isEmpty( strPostBackUrl ) )
{
strPostBackUrl = JSP_VIEW_EXTENDER_INFO;
}
UrlItem url = new UrlItem( strPostBackUrl );
url.addParameter( CommentConstants.PARAMETER_EXTENDER_TYPE, CommentResourceExtender.EXTENDER_TYPE_COMMENT );
addIdExtendableResourceInUrl(strIdExtendableResource, request, url);
url.addParameter( CommentConstants.PARAMETER_EXTENDABLE_RESOURCE_TYPE, strExtendableResourceType );

if ( StringUtils.isNotEmpty( strIdParentComment ) )
{
url.addParameter( CommentConstants.PARAMETER_ID_COMMENT, strIdParentComment );
}
url.addParameter( CommentConstants.PARAMETER_FROM_URL, StringUtils.replace(
request.getParameter( CommentConstants.PARAMETER_FROM_URL ), CommentConstants.CONSTANT_AND,
CommentConstants.CONSTANT_AND_HTML ) );

return url.getUrl( );
}

private void addIdExtendableResourceInUrl(String strIdExtendableResource,HttpServletRequest request,UrlItem url )
{
String strViewAllResources = request.getParameter( CommentConstants.PARAMETER_VIEW_ALL_RESOURCES);
Expand Down
5 changes: 5 additions & 0 deletions webapp/WEB-INF/templates/admin/plugins/extend/modules/comment/comment_info.html
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -236,6 +236,11 @@ <h3 class="box-title">
</a>

</#if>
<#if comment.isAdminComment>
<a class="btn btn-xs btn-warning" href="jsp/admin/plugins/extend/modules/comment/GetModifyAdminComment.jsp?idExtendableResource=${idExtendableResource}&extendableResourceType=${extendableResourceType}&idComment=${comment.idComment!}<#if from_url?? && from_url?has_content && from_url != "null">&from_url=${from_url}</#if>" title="#i18n{portal.util.labelModify}">
<i class="fa fa-pencil"></i>
</a>
</#if>
</div>
</form>
</td>
Expand Down
41 changes: 41 additions & 0 deletions webapp/WEB-INF/templates/admin/plugins/extend/modules/comment/modify_admin_comment.html
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,41 @@
<#include "/admin/util/editor/editor.html" />
<div>
<form class="form-horizontal" action="jsp/admin/plugins/extend/modules/comment/DoModifyAdminComment.jsp">

<input type="hidden" name="token" value="${token}">

<fieldset>
<div class="control-group">
<label class="control-label" for="name">#i18n{module.extend.comment.modify_admin_comment.labelName}</label>
<div class="controls">
<input type="text" name="name" value="<#if comment??>${comment.name!}</#if>" >
</div>
</div>
<div class="control-group">
<label class="control-label" for="comment">#i18n{module.extend.comment.modify_admin_comment.labelComment}</label>
<div class="controls">
<textarea class="richtext" name="comment" ><#if comment??>${comment.comment!}</#if></textarea>
</div>
</div>
<div class="form-actions">
<input type="hidden" name="idExtendableResource" value="${idExtendableResource}">
<input type="hidden" name="extendableResourceType" value="${extendableResourceType}">

<input type="hidden" name="viewAllResources" value="${allResources?c}">
<#if from_url?? && from_url?has_content && from_url != "null">
<input type="hidden" name="from_url" value="${from_url!}" />
</#if>
<input type="hidden" name="idComment" value="<#if comment??>${comment.idComment!}</#if>">
<input type="hidden" name="idParentComment" value="${idParentComment!}">
<button class="btn btn-primary btn-small">
<i class="icon-white icon-ok"></i>&nbsp;#i18n{portal.util.labelValidate}
</button>
<button class="btn btn-small" type="button" onClick="javascript:history.go(-1);">
#i18n{portal.util.labelCancel}
</button>
</div>
</fieldset>
</form>
</div>

<@initEditor />
7 changes: 7 additions & 0 deletions webapp/jsp/admin/plugins/extend/modules/comment/DoModifyAdminComment.jsp
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,7 @@
<%@page import="fr.paris.lutece.plugins.extend.web.ResourceExtenderJspBean"%>
<%@ page errorPage="../../../../ErrorPage.jsp" %>
<jsp:useBean id="extendComment" scope="session" class="fr.paris.lutece.plugins.extend.modules.comment.web.CommentJspBean" />
<%
extendComment.init( request, ResourceExtenderJspBean.RIGHT_MANAGE_RESOURCE_EXTENDER );
response.sendRedirect( extendComment.doModifyAdminComment( request ) );
%>
11 changes: 11 additions & 0 deletions webapp/jsp/admin/plugins/extend/modules/comment/GetModifyAdminComment.jsp
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,11 @@
<%@page import="fr.paris.lutece.plugins.extend.web.ResourceExtenderJspBean"%>
<%@ page errorPage="../../../../ErrorPage.jsp" %>
<jsp:useBean id="extendComment" scope="session" class="fr.paris.lutece.plugins.extend.modules.comment.web.CommentJspBean" />
<%
extendComment.init( request, ResourceExtenderJspBean.RIGHT_MANAGE_RESOURCE_EXTENDER );
String pageContent = extendComment.getModifyAdminComment( request );
%>

<jsp:include page="../../../../AdminHeader.jsp" />
<%= pageContent %>
<%@ include file="../../../../AdminFooter.jsp" %>