Skip to content

Commit 349d7a2

Browse files
yurabakhtinyurabakhtin
committed
Check widgets for actual loaded data on reordering in back-office
1 parent ff55fa5 commit 349d7a2

1 file changed

Lines changed: 51 additions & 19 deletions

File tree

‎inc/widgets/widgets.ctrl.php‎

Lines changed: 51 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -115,9 +115,23 @@
115115
param( 'container_list', 'string', true );
116116
$containers_list = explode( ',', trim( $container_list, ',' ) );
117117
$containers = array();
118+
$passed_widget_IDs = array(); // Store here all passed IDs in order to compare them with current DB
118119
foreach( $containers_list as $a_container )
119-
{ // add each container and grab its widgets:
120-
$containers[substr( $a_container, 10 )] = explode( ',', param( trim( $a_container, ',' ), 'string', true ) );
120+
{ // Add each container and grab its widgets:
121+
$a_container_widgets = explode( ',', param( trim( $a_container, ',' ), 'string', true ) );
122+
foreach( $a_container_widgets as $a => $a_container_widget )
123+
{
124+
if( $a_container_widget_ID = preg_replace( '~[^0-9]~', '', $a_container_widget ) )
125+
{ // Use only correct widget ID for reordering:
126+
$a_container_widgets[ $a ] = $a_container_widget_ID;
127+
$passed_widget_IDs[] = $a_container_widget_ID;
128+
}
129+
else
130+
{ // Skip wrong passed widget ID:
131+
unset( $a_container_widgets[ $a ] );
132+
}
133+
}
134+
$containers[substr( $a_container, 10 )] = $a_container_widgets;
121135
}
122136
break;
123137

@@ -666,7 +680,26 @@
666680
$blog_container_IDs = $DB->get_col( $SQL );
667681
}
668682

669-
if( $blog_container_IDs )
683+
// Check if current reordering contains all actual widgets from DB:
684+
if( empty( $blog_container_IDs ) )
685+
{
686+
$server_widget_IDs = array();
687+
}
688+
else
689+
{
690+
$SQL = new SQL( 'Get all widget IDs for checking correct re-order request' );
691+
$SQL->SELECT( 'wi_ID' );
692+
$SQL->FROM( 'T_widget__widget' );
693+
$SQL->WHERE( 'wi_wico_ID IN ( '.implode( ',', $blog_container_IDs ).' )' );
694+
$server_widget_IDs = $DB->get_col( $SQL );
695+
}
696+
$checked_new_widgets = array_diff( $server_widget_IDs, $passed_widget_IDs );
697+
$checked_old_widgets = array_diff( $passed_widget_IDs, $server_widget_IDs );
698+
699+
// Don't allow to reorder if at least one widget was added or deleted in DB since after last page refresh:
700+
$result = empty( $checked_new_widgets ) && empty( $checked_old_widgets );
701+
702+
if( $result && $blog_container_IDs )
670703
{
671704
$blog_container_IDs = $DB->quote( $blog_container_IDs );
672705

@@ -685,26 +718,25 @@
685718
$order = 0; // reset counter for this container
686719
foreach( $widgets as $widget )
687720
{ // loop through each widget
688-
if( $widget = preg_replace( '~[^0-9]~', '', $widget ) )
689-
{ // valid widget id
690-
$order++;
691-
$DB->query( 'UPDATE T_widget__widget
692-
SET wi_order = '.$order.',
693-
wi_wico_ID = '.$WidgetContainer->ID.'
694-
WHERE wi_ID = '.$widget.' AND wi_wico_ID IN ( '.$blog_container_IDs.' )' ); // Doh! Don't trust the client request!!
695-
}
721+
$order++;
722+
$DB->query( 'UPDATE T_widget__widget
723+
SET wi_order = '.$order.',
724+
wi_wico_ID = '.$WidgetContainer->ID.'
725+
WHERE wi_ID = '.$widget.' AND wi_wico_ID IN ( '.$blog_container_IDs.' )' ); // Doh! Don't trust the client request!!
696726
}
697727
}
698-
699-
// Cleanup deleted widgets and empty temp containers
700-
$DB->query( 'DELETE FROM T_widget__widget
701-
WHERE wi_order < 1
702-
AND wi_wico_ID IN ( '.$blog_container_IDs.' )' ); // Doh! Don't touch other blogs!
703728
}
704729

705-
$DB->commit();
706-
707-
$Messages->add( TB_( 'Widgets updated' ), 'success' );
730+
if( $result )
731+
{ // Send success message:
732+
$DB->commit();
733+
$Messages->add( TB_( 'Widgets updated' ), 'success' );
734+
}
735+
else
736+
{ // Send error message if widgets cannot be reordered:
737+
$DB->rollback();
738+
$Messages->add( T_('The widgets have been changed since you last loaded this page.').' '.T_('Please reload the page to be in sync with the server.').' '.T_('If the problem persists, check the widgets in the backoffice.'), 'error' );
739+
}
708740
send_javascript_message( array( 'sendWidgetOrderCallback' => array( 'blog='.$Blog->ID ) ) ); // exits() automatically
709741
break;
710742

0 commit comments

Comments
 (0)