Add blog comments and CSRF protection
Sven Slootweg
12 years ago
parent
70d81e1b78
commit
061c32ac8b
@ -0,0 +1,78 @@
|
|||||||
|
<?php
|
||||||
|
/*
|
||||||
|
* Box is more free software. It is licensed under the WTFPL, which
|
||||||
|
* allows you to do pretty much anything with it, without having to
|
||||||
|
* ask permission. Commercial use is allowed, and no attribution is
|
||||||
|
* required. We do politely request that you share your modifications
|
||||||
|
* to benefit other developers, but you are under no enforced
|
||||||
|
* obligation to do so :)
|
||||||
|
*
|
||||||
|
* Please read the accompanying LICENSE document for the full WTFPL
|
||||||
|
* licensing text.
|
||||||
|
*/
|
||||||
|
|
||||||
|
if(!isset($_APP)) { die("Unauthorized."); }
|
||||||
|
|
||||||
|
try
|
||||||
|
{
|
||||||
|
$sBlogPost = BlogPost::CreateFromQuery("SELECT * FROM blog_posts WHERE `Slug` = :Slug", array(":Slug" => $router->uParameters[1]), 60, true);
|
||||||
|
}
|
||||||
|
catch (NotFoundException $e)
|
||||||
|
{
|
||||||
|
throw new RouterException("No such blog post exists.");
|
||||||
|
}
|
||||||
|
|
||||||
|
$sErrors = array();
|
||||||
|
|
||||||
|
if(empty($sCurrentUser) && (empty($_POST['name']) && empty($_POST['email'])))
|
||||||
|
{
|
||||||
|
$sErrors[] = "You did not enter a valid name and/or e-mail address.";
|
||||||
|
}
|
||||||
|
|
||||||
|
if(empty($sCurrentUser) && !User::CheckIfEmailValid($_POST['email']))
|
||||||
|
{
|
||||||
|
$sErrors[] = "The e-mail address you entered is invalid.";
|
||||||
|
}
|
||||||
|
|
||||||
|
if(empty($_POST['body']))
|
||||||
|
{
|
||||||
|
$sErrors[] = "You can't post an empty comment!";
|
||||||
|
}
|
||||||
|
|
||||||
|
if(empty($sErrors))
|
||||||
|
{
|
||||||
|
$sBlogComment = new BlogComment(0);
|
||||||
|
|
||||||
|
$sBlogComment->uPostId = $sBlogPost->sId;
|
||||||
|
$sBlogComment->uBody = $_POST['body'];
|
||||||
|
$sBlogComment->uPostedDate = time();
|
||||||
|
$sBlogComment->uVisible = true;
|
||||||
|
|
||||||
|
if(!empty($sCurrentUser))
|
||||||
|
{
|
||||||
|
$sBlogComment->uIsGuestPost = false;
|
||||||
|
$sBlogComment->uName = "";
|
||||||
|
$sBlogComment->uEmailAddress = "";
|
||||||
|
$sBlogComment->uAuthorId = $sCurrentUser->sId;
|
||||||
|
}
|
||||||
|
else
|
||||||
|
{
|
||||||
|
$sBlogComment->uIsGuestPost = true;
|
||||||
|
$sBlogComment->uName = $_POST['name'];
|
||||||
|
$sBlogComment->uEmailAddress = $_POST['email'];
|
||||||
|
$sBlogComment->uAuthorId = 0;
|
||||||
|
}
|
||||||
|
|
||||||
|
$sBlogComment->InsertIntoDatabase();
|
||||||
|
|
||||||
|
redirect("/blog/{$sBlogPost->sSlug}/#comment_{$sBlogComment->sId}");
|
||||||
|
}
|
||||||
|
else
|
||||||
|
{
|
||||||
|
foreach($sErrors as $sError)
|
||||||
|
{
|
||||||
|
flash_error($sError);
|
||||||
|
}
|
||||||
|
|
||||||
|
redirect("/blog/{$sBlogPost->sSlug}/");
|
||||||
|
}
|
||||||
@ -0,0 +1,68 @@
|
|||||||
|
<?php
|
||||||
|
/*
|
||||||
|
* Box is more free software. It is licensed under the WTFPL, which
|
||||||
|
* allows you to do pretty much anything with it, without having to
|
||||||
|
* ask permission. Commercial use is allowed, and no attribution is
|
||||||
|
* required. We do politely request that you share your modifications
|
||||||
|
* to benefit other developers, but you are under no enforced
|
||||||
|
* obligation to do so :)
|
||||||
|
*
|
||||||
|
* Please read the accompanying LICENSE document for the full WTFPL
|
||||||
|
* licensing text.
|
||||||
|
*/
|
||||||
|
|
||||||
|
if(!isset($_APP)) { die("Unauthorized."); }
|
||||||
|
|
||||||
|
try
|
||||||
|
{
|
||||||
|
$sBlogPost = BlogPost::CreateFromQuery("SELECT * FROM blog_posts WHERE `Slug` = :Slug", array(":Slug" => $router->uParameters[1]), 60, true);
|
||||||
|
}
|
||||||
|
catch (NotFoundException $e)
|
||||||
|
{
|
||||||
|
throw new RouterException("No such blog post exists.");
|
||||||
|
}
|
||||||
|
|
||||||
|
try
|
||||||
|
{
|
||||||
|
$result = BlogComment::CreateFromQuery("SELECT * FROM blog_comments WHERE `PostId` = :PostId AND `Visible` = 1 ORDER BY `Posted` ASC", array(":PostId" => $sBlogPost->sId));
|
||||||
|
}
|
||||||
|
catch (NotFoundException $e)
|
||||||
|
{
|
||||||
|
$result = array();
|
||||||
|
}
|
||||||
|
|
||||||
|
$sComments = array();
|
||||||
|
|
||||||
|
foreach($result as $sComment)
|
||||||
|
{
|
||||||
|
if($sComment->sIsGuestPost)
|
||||||
|
{
|
||||||
|
$sAuthorName = $sComment->sName;
|
||||||
|
$sEmailAddress = $sComment->sEmailAddress;
|
||||||
|
}
|
||||||
|
else
|
||||||
|
{
|
||||||
|
$sAuthorName = $sComment->sAuthor->sUsername;
|
||||||
|
$sEmailAddress = $sComment->sAuthor->sEmailAddress;
|
||||||
|
}
|
||||||
|
|
||||||
|
$sComments[] = array(
|
||||||
|
"author" => $sAuthorName,
|
||||||
|
"relative-date" => time_ago($sComment->sPostedDate, $locale),
|
||||||
|
"body" => Markdown($sComment->sBody),
|
||||||
|
"gravatar" => "https://secure.gravatar.com/avatar/" . md5(strtolower(trim($sEmailAddress))) . ".jpg?d=retro&s=40",
|
||||||
|
"id" => $sComment->sId
|
||||||
|
);
|
||||||
|
}
|
||||||
|
|
||||||
|
$sPageTitle = $sBlogPost->sTitle;
|
||||||
|
$sPageContents = NewTemplater::Render("blog/post", $locale->strings, array(
|
||||||
|
"title" => $sBlogPost->sTitle,
|
||||||
|
"body" => Markdown($sBlogPost->sBody),
|
||||||
|
"author" => $sBlogPost->sAuthor->sUsername,
|
||||||
|
"relative-date" => time_ago($sBlogPost->sPostedDate, $locale),
|
||||||
|
"thumbnail" => $sBlogPost->sThumbnail,
|
||||||
|
"tags" => "test1, test2, test3",
|
||||||
|
"comments" => $sComments,
|
||||||
|
"slug" => $sBlogPost->sSlug
|
||||||
|
));
|
||||||
@ -0,0 +1,56 @@
|
|||||||
|
<div class="entry">
|
||||||
|
<h1>{%?title}</h1>
|
||||||
|
<img src="{%?thumbnail}">
|
||||||
|
<div class="metadata">
|
||||||
|
<span class="date">{%?relative-date}</span>, by
|
||||||
|
<span class="author">{%?author}</span>
|
||||||
|
<span class="tags">Tags: {%?tags}</span>
|
||||||
|
</div>
|
||||||
|
{%?body}
|
||||||
|
</div>
|
||||||
|
|
||||||
|
<div class="comments">
|
||||||
|
<h2>Comments</h2>
|
||||||
|
{%if isempty|comments == true}
|
||||||
|
No comments have been posted yet.
|
||||||
|
{%else}
|
||||||
|
{%foreach comment in comments}
|
||||||
|
<div class="comment">
|
||||||
|
<a name="comment_{%?comment[id]}"></a>
|
||||||
|
<img src="{%?comment[gravatar]}" class="gravatar">
|
||||||
|
<div class="metadata">
|
||||||
|
<span class="author">{%?comment[author]}</span>
|
||||||
|
<span class="date">{%?comment[relative-date]}</span>
|
||||||
|
</div>
|
||||||
|
{%?comment[body]}
|
||||||
|
</div>
|
||||||
|
{%/foreach}
|
||||||
|
{%/if}
|
||||||
|
|
||||||
|
<h2>Post a new comment</h2>
|
||||||
|
<div class="commentform">
|
||||||
|
<form method="post" action="/blog/{%?slug}/comment">
|
||||||
|
{%if logged-in == false}
|
||||||
|
<label>Name</label>
|
||||||
|
<input type="text" name="name">
|
||||||
|
|
||||||
|
<label>E-mail address</label>
|
||||||
|
<input type="text" name="email">
|
||||||
|
|
||||||
|
<div class="clear"></div>
|
||||||
|
{%/if}
|
||||||
|
|
||||||
|
<div class="field">
|
||||||
|
<textarea class="body" name="body"></textarea>
|
||||||
|
</div>
|
||||||
|
|
||||||
|
<div class="subtext">
|
||||||
|
You can use <a href="http://static.squarespace.com/static/50060af484ae2a1f638413cb/5025cecce4b0922760c3c438/5025cecce4b0922760c3c43a/1304275182573/">Markdown</a>.
|
||||||
|
</div>
|
||||||
|
|
||||||
|
<button class="submit" type="submit" name="submit">Post comment</button>
|
||||||
|
<button class="submit preview" type="submit" name="submit">Preview</button>
|
||||||
|
<div class="clear"></div>
|
||||||
|
</form>
|
||||||
|
</div>
|
||||||
|
</div>
|
||||||
Loading…
Reference in New Issue