Add blog comments and CSRF protection
Sven Slootweg
12 years ago
parent
70d81e1b78
commit
061c32ac8b
@ -0,0 +1,78 @@
|
||||
<?php
|
||||
/*
|
||||
* Box is more free software. It is licensed under the WTFPL, which
|
||||
* allows you to do pretty much anything with it, without having to
|
||||
* ask permission. Commercial use is allowed, and no attribution is
|
||||
* required. We do politely request that you share your modifications
|
||||
* to benefit other developers, but you are under no enforced
|
||||
* obligation to do so :)
|
||||
*
|
||||
* Please read the accompanying LICENSE document for the full WTFPL
|
||||
* licensing text.
|
||||
*/
|
||||
|
||||
if(!isset($_APP)) { die("Unauthorized."); }
|
||||
|
||||
try
|
||||
{
|
||||
$sBlogPost = BlogPost::CreateFromQuery("SELECT * FROM blog_posts WHERE `Slug` = :Slug", array(":Slug" => $router->uParameters[1]), 60, true);
|
||||
}
|
||||
catch (NotFoundException $e)
|
||||
{
|
||||
throw new RouterException("No such blog post exists.");
|
||||
}
|
||||
|
||||
$sErrors = array();
|
||||
|
||||
if(empty($sCurrentUser) && (empty($_POST['name']) && empty($_POST['email'])))
|
||||
{
|
||||
$sErrors[] = "You did not enter a valid name and/or e-mail address.";
|
||||
}
|
||||
|
||||
if(empty($sCurrentUser) && !User::CheckIfEmailValid($_POST['email']))
|
||||
{
|
||||
$sErrors[] = "The e-mail address you entered is invalid.";
|
||||
}
|
||||
|
||||
if(empty($_POST['body']))
|
||||
{
|
||||
$sErrors[] = "You can't post an empty comment!";
|
||||
}
|
||||
|
||||
if(empty($sErrors))
|
||||
{
|
||||
$sBlogComment = new BlogComment(0);
|
||||
|
||||
$sBlogComment->uPostId = $sBlogPost->sId;
|
||||
$sBlogComment->uBody = $_POST['body'];
|
||||
$sBlogComment->uPostedDate = time();
|
||||
$sBlogComment->uVisible = true;
|
||||
|
||||
if(!empty($sCurrentUser))
|
||||
{
|
||||
$sBlogComment->uIsGuestPost = false;
|
||||
$sBlogComment->uName = "";
|
||||
$sBlogComment->uEmailAddress = "";
|
||||
$sBlogComment->uAuthorId = $sCurrentUser->sId;
|
||||
}
|
||||
else
|
||||
{
|
||||
$sBlogComment->uIsGuestPost = true;
|
||||
$sBlogComment->uName = $_POST['name'];
|
||||
$sBlogComment->uEmailAddress = $_POST['email'];
|
||||
$sBlogComment->uAuthorId = 0;
|
||||
}
|
||||
|
||||
$sBlogComment->InsertIntoDatabase();
|
||||
|
||||
redirect("/blog/{$sBlogPost->sSlug}/#comment_{$sBlogComment->sId}");
|
||||
}
|
||||
else
|
||||
{
|
||||
foreach($sErrors as $sError)
|
||||
{
|
||||
flash_error($sError);
|
||||
}
|
||||
|
||||
redirect("/blog/{$sBlogPost->sSlug}/");
|
||||
}
|
||||
@ -0,0 +1,68 @@
|
||||
<?php
|
||||
/*
|
||||
* Box is more free software. It is licensed under the WTFPL, which
|
||||
* allows you to do pretty much anything with it, without having to
|
||||
* ask permission. Commercial use is allowed, and no attribution is
|
||||
* required. We do politely request that you share your modifications
|
||||
* to benefit other developers, but you are under no enforced
|
||||
* obligation to do so :)
|
||||
*
|
||||
* Please read the accompanying LICENSE document for the full WTFPL
|
||||
* licensing text.
|
||||
*/
|
||||
|
||||
if(!isset($_APP)) { die("Unauthorized."); }
|
||||
|
||||
try
|
||||
{
|
||||
$sBlogPost = BlogPost::CreateFromQuery("SELECT * FROM blog_posts WHERE `Slug` = :Slug", array(":Slug" => $router->uParameters[1]), 60, true);
|
||||
}
|
||||
catch (NotFoundException $e)
|
||||
{
|
||||
throw new RouterException("No such blog post exists.");
|
||||
}
|
||||
|
||||
try
|
||||
{
|
||||
$result = BlogComment::CreateFromQuery("SELECT * FROM blog_comments WHERE `PostId` = :PostId AND `Visible` = 1 ORDER BY `Posted` ASC", array(":PostId" => $sBlogPost->sId));
|
||||
}
|
||||
catch (NotFoundException $e)
|
||||
{
|
||||
$result = array();
|
||||
}
|
||||
|
||||
$sComments = array();
|
||||
|
||||
foreach($result as $sComment)
|
||||
{
|
||||
if($sComment->sIsGuestPost)
|
||||
{
|
||||
$sAuthorName = $sComment->sName;
|
||||
$sEmailAddress = $sComment->sEmailAddress;
|
||||
}
|
||||
else
|
||||
{
|
||||
$sAuthorName = $sComment->sAuthor->sUsername;
|
||||
$sEmailAddress = $sComment->sAuthor->sEmailAddress;
|
||||
}
|
||||
|
||||
$sComments[] = array(
|
||||
"author" => $sAuthorName,
|
||||
"relative-date" => time_ago($sComment->sPostedDate, $locale),
|
||||
"body" => Markdown($sComment->sBody),
|
||||
"gravatar" => "https://secure.gravatar.com/avatar/" . md5(strtolower(trim($sEmailAddress))) . ".jpg?d=retro&s=40",
|
||||
"id" => $sComment->sId
|
||||
);
|
||||
}
|
||||
|
||||
$sPageTitle = $sBlogPost->sTitle;
|
||||
$sPageContents = NewTemplater::Render("blog/post", $locale->strings, array(
|
||||
"title" => $sBlogPost->sTitle,
|
||||
"body" => Markdown($sBlogPost->sBody),
|
||||
"author" => $sBlogPost->sAuthor->sUsername,
|
||||
"relative-date" => time_ago($sBlogPost->sPostedDate, $locale),
|
||||
"thumbnail" => $sBlogPost->sThumbnail,
|
||||
"tags" => "test1, test2, test3",
|
||||
"comments" => $sComments,
|
||||
"slug" => $sBlogPost->sSlug
|
||||
));
|
||||
@ -0,0 +1,56 @@
|
||||
<div class="entry">
|
||||
<h1>{%?title}</h1>
|
||||
<img src="{%?thumbnail}">
|
||||
<div class="metadata">
|
||||
<span class="date">{%?relative-date}</span>, by
|
||||
<span class="author">{%?author}</span>
|
||||
<span class="tags">Tags: {%?tags}</span>
|
||||
</div>
|
||||
{%?body}
|
||||
</div>
|
||||
|
||||
<div class="comments">
|
||||
<h2>Comments</h2>
|
||||
{%if isempty|comments == true}
|
||||
No comments have been posted yet.
|
||||
{%else}
|
||||
{%foreach comment in comments}
|
||||
<div class="comment">
|
||||
<a name="comment_{%?comment[id]}"></a>
|
||||
<img src="{%?comment[gravatar]}" class="gravatar">
|
||||
<div class="metadata">
|
||||
<span class="author">{%?comment[author]}</span>
|
||||
<span class="date">{%?comment[relative-date]}</span>
|
||||
</div>
|
||||
{%?comment[body]}
|
||||
</div>
|
||||
{%/foreach}
|
||||
{%/if}
|
||||
|
||||
<h2>Post a new comment</h2>
|
||||
<div class="commentform">
|
||||
<form method="post" action="/blog/{%?slug}/comment">
|
||||
{%if logged-in == false}
|
||||
<label>Name</label>
|
||||
<input type="text" name="name">
|
||||
|
||||
<label>E-mail address</label>
|
||||
<input type="text" name="email">
|
||||
|
||||
<div class="clear"></div>
|
||||
{%/if}
|
||||
|
||||
<div class="field">
|
||||
<textarea class="body" name="body"></textarea>
|
||||
</div>
|
||||
|
||||
<div class="subtext">
|
||||
You can use <a href="http://static.squarespace.com/static/50060af484ae2a1f638413cb/5025cecce4b0922760c3c438/5025cecce4b0922760c3c43a/1304275182573/">Markdown</a>.
|
||||
</div>
|
||||
|
||||
<button class="submit" type="submit" name="submit">Post comment</button>
|
||||
<button class="submit preview" type="submit" name="submit">Preview</button>
|
||||
<div class="clear"></div>
|
||||
</form>
|
||||
</div>
|
||||
</div>
|
||||
Loading…
Reference in New Issue