orasche
872c6e715c
- Replace the v1 submit endpoint with a full JSON API under
/api/fe-comment/ (state, feedback create/update/delete, uploads,
summary notes/recipients, submit), guarded by frontend login and a
configurable FE user group; unauthorized callers get {"allowed":false}
- New models: tx_fecomment_summary (one open ticket per user, status
open/sent) and tx_fecomment_feedback (url, RTE note, FAL attachments),
both editable in the backend on the ticket storage page
- FeedbackApiMiddleware registered after frontend authentication (the
frontend.user attribute does not exist earlier); uploads land in
fileadmin/fe_comment/summary-<uid>/ with mime/extension check, 20 MB cap
- Submit sends one HTML mail (author block, items with attachment links,
reply-to = FE user mail) to selected recipients with mailTo fallback,
then closes the summary
- felogin wired React-compatible: felogin.pid=520 plus headless FeLogin
JSON templates via site settings - felogin v14 and EXT:headless both
claim templateRootPaths.10, the felogin.view.* settings feed exactly
that index, so the structured JSON form (incl. __RequestToken) wins
- Read the sys_file_reference insert id before syncAttachmentCount():
DBAL throws "no identity value" once the count UPDATE has run
- migrations: drop_fecomment_tables.php (repairs the no-uid tables,
only drops when empty), check_feuser.php (login diagnosis),
fec_login_test.sh / fec_api_test.sh (curl chains incl. CSRF token flow)
54 lines
1.8 KiB
Bash
54 lines
1.8 KiB
Bash
#!/bin/bash
|
|
# fe_comment Login-Testkette: GET (Nonce+Token) -> Login-POST -> state
|
|
# Aufruf: bash migrations/fec_login_test.sh (fragt das Passwort unsichtbar ab)
|
|
set -e
|
|
cd /usr/www/users/vitecevo/live
|
|
BASE=https://dev.vitec.com
|
|
|
|
read -rsp "Passwort fuer joe: " PASS; echo
|
|
|
|
rm -f /tmp/fec.jar
|
|
curl -sS -c /tmp/fec.jar -o /tmp/fec_form.json "$BASE/_json/fe-user-profile"
|
|
|
|
TOKEN=$(php -r '
|
|
$j = json_decode(file_get_contents("/tmp/fec_form.json"), true);
|
|
$f = "";
|
|
$w = function ($n) use (&$w, &$f) {
|
|
if (is_array($n)) {
|
|
// Variante 1: strukturiertes headless-Formular {name: "__RequestToken", value: "..."}
|
|
if (($n["name"] ?? "") === "__RequestToken" && isset($n["value"])) {
|
|
$f = (string)$n["value"];
|
|
}
|
|
foreach ($n as $c) { $w($c); }
|
|
} elseif (is_string($n) && $f === "") {
|
|
// Variante 2: felogin rendert klassisches HTML als String im JSON
|
|
if (preg_match("/name=\"__RequestToken\" value=\"([^\"]+)\"/", $n, $m)) {
|
|
$f = $m[1];
|
|
}
|
|
}
|
|
};
|
|
$w($j);
|
|
echo $f;
|
|
')
|
|
|
|
echo "Nonce-Cookies im Jar: $(grep -c typo3nonce /tmp/fec.jar || true)"
|
|
echo "Token-Laenge: ${#TOKEN}"
|
|
if [ -z "$TOKEN" ]; then
|
|
echo "KEIN __RequestToken im Seiten-JSON gefunden."
|
|
echo "Vorkommen von 'RequestToken' im JSON (zur Diagnose):"
|
|
grep -o 'RequestToken[^"]*"[^"]*"' /tmp/fec_form.json | head -n 3 || echo "(keine)"
|
|
exit 1
|
|
fi
|
|
|
|
curl -sS -b /tmp/fec.jar -c /tmp/fec.jar -o /tmp/fec_login.json \
|
|
--data-urlencode "user=joe" \
|
|
--data-urlencode "pass=$PASS" \
|
|
--data-urlencode "logintype=login" \
|
|
--data-urlencode "pid=520" \
|
|
--data-urlencode "__RequestToken=$TOKEN" \
|
|
"$BASE/_json/fe-user-profile"
|
|
|
|
echo "Session-Cookies (fe_typo_user): $(grep -c fe_typo_user /tmp/fec.jar || true)"
|
|
echo '--- state ---'
|
|
curl -sS -b /tmp/fec.jar "$BASE/api/fe-comment/state"; echo
|