orasche
d496877a53
- Rebuild the widget server-backed: it renders only when GET state allows (logged-in FE user of the configured group), so the script tag is safe on public pages; form with mini rich text (bold/italic/ list), file attachment chips and Ctrl+V image paste - a paste lazily creates the draft feedback, uploads and inserts the image inline - Note pad badge mirrors the server item count; the pad button links to the overview page via new extension setting overviewPid, exposed as overviewUrl in GET state (slug lookup) - Embed /fileadmin images of notes into the feedback mail as CID parts: relative srcs are dead in mail clients and dev sits behind basic auth; attachment links stay absolute URLs - public/widget-test.html: dev test page, doubles as the reference implementation of the React login flow (fetch felogin JSON form incl. __RequestToken, urlencoded POST to /_json + form.action) - Docs section 5x (fe_comment v2 incl. CSRF login lesson, templateRootPaths.10 collision, cache:flush before extension:setup)
507 lines
23 KiB
PHP
507 lines
23 KiB
PHP
<?php
|
|
|
|
declare(strict_types=1);
|
|
|
|
namespace Evomedien\FeComment\Middleware;
|
|
|
|
use Evomedien\FeComment\Service\ExtensionSettings;
|
|
use Psr\Http\Message\ResponseInterface;
|
|
use Psr\Http\Message\ServerRequestInterface;
|
|
use Psr\Http\Server\MiddlewareInterface;
|
|
use Psr\Http\Server\RequestHandlerInterface;
|
|
use TYPO3\CMS\Core\Database\ConnectionPool;
|
|
use TYPO3\CMS\Core\Http\JsonResponse;
|
|
use TYPO3\CMS\Core\Mail\MailMessage;
|
|
use TYPO3\CMS\Core\Resource\Enum\DuplicationBehavior;
|
|
use TYPO3\CMS\Core\Resource\StorageRepository;
|
|
use TYPO3\CMS\Core\Utility\GeneralUtility;
|
|
use TYPO3\CMS\Frontend\Authentication\FrontendUserAuthentication;
|
|
|
|
/**
|
|
* fe_comment v2 API (2026-10-02): server-side feedback with FE-user
|
|
* ownership. Every route requires a logged-in frontend user who is a member
|
|
* of the configured group - that is how the ticket carries its author.
|
|
*
|
|
* GET /api/fe-comment/state widget bootstrap: am I
|
|
* allowed, who am I, recipients, my open summary with items
|
|
* POST /api/fe-comment/feedback create {url, note}
|
|
* POST /api/fe-comment/feedback/<uid> update {url?, note}
|
|
* POST /api/fe-comment/feedback/<uid>/delete remove item
|
|
* POST /api/fe-comment/upload multipart: file +
|
|
* feedback=<uid>; attaches via FAL, returns {id, name, url}
|
|
* POST /api/fe-comment/attachment/<refUid>/delete
|
|
* POST /api/fe-comment/summary {generalNotes, recipients}
|
|
* POST /api/fe-comment/submit mail + close the summary
|
|
*
|
|
* Registered AFTER typo3/cms-frontend/authentication - earlier in the stack
|
|
* the frontend.user attribute does not exist yet. Records are written with
|
|
* plain inserts (no DataHandler in FE context); the TCA gives the backend
|
|
* read access. Incoming note HTML is passed through TYPO3's HTML sanitizer.
|
|
*/
|
|
final class FeedbackApiMiddleware implements MiddlewareInterface
|
|
{
|
|
private const PREFIX = '/api/fe-comment/';
|
|
private const T_SUMMARY = 'tx_fecomment_summary';
|
|
private const T_FEEDBACK = 'tx_fecomment_feedback';
|
|
private const MAX_NOTE = 100000;
|
|
private const MAX_UPLOAD = 20971520; // 20 MB
|
|
|
|
private ExtensionSettings $settings;
|
|
|
|
public function process(ServerRequestInterface $request, RequestHandlerInterface $handler): ResponseInterface
|
|
{
|
|
$path = rtrim($request->getUri()->getPath(), '/');
|
|
if (!str_starts_with($path . '/', self::PREFIX) || in_array(substr($path, strlen(self::PREFIX)), ['widget.js', 'widget.css'], true)) {
|
|
return $handler->handle($request);
|
|
}
|
|
$route = substr($path, strlen(self::PREFIX));
|
|
|
|
try {
|
|
$this->settings = GeneralUtility::makeInstance(ExtensionSettings::class);
|
|
if (!$this->settings->enabled()) {
|
|
return new JsonResponse(['error' => 'disabled'], 403);
|
|
}
|
|
$user = $this->allowedUser($request);
|
|
if ($user === null) {
|
|
// The state route answers politely so the widget can hide
|
|
// itself; everything else refuses.
|
|
return $route === 'state'
|
|
? new JsonResponse(['allowed' => false])
|
|
: new JsonResponse(['error' => 'not allowed'], 403);
|
|
}
|
|
|
|
return match (true) {
|
|
$route === 'state' && $request->getMethod() === 'GET' => $this->state($user),
|
|
$route === 'feedback' => $this->createFeedback($request, $user),
|
|
(bool)preg_match('#^feedback/(\d+)$#', $route, $m) => $this->updateFeedback($request, $user, (int)$m[1]),
|
|
(bool)preg_match('#^feedback/(\d+)/delete$#', $route, $m) => $this->deleteFeedback($user, (int)$m[1]),
|
|
$route === 'upload' => $this->upload($request, $user),
|
|
(bool)preg_match('#^attachment/(\d+)/delete$#', $route, $m) => $this->deleteAttachment($user, (int)$m[1]),
|
|
$route === 'summary' => $this->updateSummary($request, $user),
|
|
$route === 'submit' => $this->submit($user),
|
|
default => new JsonResponse(['error' => 'unknown route'], 404),
|
|
};
|
|
} catch (\Throwable $e) {
|
|
return new JsonResponse(['error' => $e->getMessage()], 500);
|
|
}
|
|
}
|
|
|
|
// ---- auth ---------------------------------------------------------------
|
|
|
|
/** @return array{uid:int,username:string,name:string,email:string}|null */
|
|
private function allowedUser(ServerRequestInterface $request): ?array
|
|
{
|
|
$frontendUser = $request->getAttribute('frontend.user');
|
|
if (!$frontendUser instanceof FrontendUserAuthentication || empty($frontendUser->user['uid'])) {
|
|
return null;
|
|
}
|
|
$requiredGroup = $this->settings->feUserGroup();
|
|
if ($requiredGroup > 0) {
|
|
$groups = GeneralUtility::intExplode(',', (string)($frontendUser->user['usergroup'] ?? ''), true);
|
|
if (!in_array($requiredGroup, $groups, true)) {
|
|
return null;
|
|
}
|
|
}
|
|
return [
|
|
'uid' => (int)$frontendUser->user['uid'],
|
|
'username' => (string)($frontendUser->user['username'] ?? ''),
|
|
'name' => trim((string)($frontendUser->user['name'] ?? '')) ?: (string)($frontendUser->user['username'] ?? ''),
|
|
'email' => (string)($frontendUser->user['email'] ?? ''),
|
|
];
|
|
}
|
|
|
|
// ---- routes -------------------------------------------------------------
|
|
|
|
/** @param array{uid:int,username:string,name:string,email:string} $user */
|
|
private function state(array $user): ResponseInterface
|
|
{
|
|
$summary = $this->openSummary($user['uid'], false);
|
|
return new JsonResponse([
|
|
'allowed' => true,
|
|
'user' => ['name' => $user['name'], 'email' => $user['email']],
|
|
'recipients' => $this->recipientOptions(),
|
|
'overviewUrl' => $this->overviewUrl(),
|
|
'summary' => $summary === null ? null : $this->summaryPayload($summary),
|
|
]);
|
|
}
|
|
|
|
/**
|
|
* Visitor-facing URL of the feedback overview page (extension setting
|
|
* overviewPid), resolved via the page slug. Empty string when unset.
|
|
*/
|
|
private function overviewUrl(): string
|
|
{
|
|
$pid = $this->settings->overviewPid();
|
|
if ($pid <= 0) {
|
|
return '';
|
|
}
|
|
$queryBuilder = GeneralUtility::makeInstance(ConnectionPool::class)->getQueryBuilderForTable('pages');
|
|
$slug = $queryBuilder->select('slug')->from('pages')
|
|
->where($queryBuilder->expr()->eq('uid', $queryBuilder->createNamedParameter($pid, \Doctrine\DBAL\ParameterType::INTEGER)))
|
|
->executeQuery()->fetchOne();
|
|
return is_string($slug) ? $slug : '';
|
|
}
|
|
|
|
/** @param array{uid:int,username:string,name:string,email:string} $user */
|
|
private function createFeedback(ServerRequestInterface $request, array $user): ResponseInterface
|
|
{
|
|
$body = $this->jsonBody($request);
|
|
$summary = $this->openSummary($user['uid'], true);
|
|
$connection = GeneralUtility::makeInstance(ConnectionPool::class)->getConnectionForTable(self::T_FEEDBACK);
|
|
$connection->insert(self::T_FEEDBACK, [
|
|
'pid' => $this->settings->storagePid(),
|
|
'tstamp' => time(),
|
|
'crdate' => time(),
|
|
'summary' => (int)$summary['uid'],
|
|
'fe_user' => $user['uid'],
|
|
'url' => mb_substr(trim((string)($body['url'] ?? '')), 0, 2048),
|
|
'note' => $this->sanitize((string)($body['note'] ?? '')),
|
|
'sorting' => time(),
|
|
]);
|
|
$uid = (int)$connection->lastInsertId();
|
|
return new JsonResponse(['ok' => true, 'uid' => $uid, 'summary' => $this->summaryPayload($this->openSummary($user['uid'], true))]);
|
|
}
|
|
|
|
/** @param array{uid:int,username:string,name:string,email:string} $user */
|
|
private function updateFeedback(ServerRequestInterface $request, array $user, int $uid): ResponseInterface
|
|
{
|
|
$this->ownFeedback($user['uid'], $uid);
|
|
$body = $this->jsonBody($request);
|
|
$update = ['tstamp' => time()];
|
|
if (array_key_exists('note', $body)) {
|
|
$update['note'] = $this->sanitize((string)$body['note']);
|
|
}
|
|
if (array_key_exists('url', $body)) {
|
|
$update['url'] = mb_substr(trim((string)$body['url']), 0, 2048);
|
|
}
|
|
GeneralUtility::makeInstance(ConnectionPool::class)->getConnectionForTable(self::T_FEEDBACK)
|
|
->update(self::T_FEEDBACK, $update, ['uid' => $uid]);
|
|
return new JsonResponse(['ok' => true]);
|
|
}
|
|
|
|
/** @param array{uid:int,username:string,name:string,email:string} $user */
|
|
private function deleteFeedback(array $user, int $uid): ResponseInterface
|
|
{
|
|
$this->ownFeedback($user['uid'], $uid);
|
|
$connection = GeneralUtility::makeInstance(ConnectionPool::class)->getConnectionForTable(self::T_FEEDBACK);
|
|
$connection->update(self::T_FEEDBACK, ['deleted' => 1, 'tstamp' => time()], ['uid' => $uid]);
|
|
return new JsonResponse(['ok' => true]);
|
|
}
|
|
|
|
/** @param array{uid:int,username:string,name:string,email:string} $user */
|
|
private function upload(ServerRequestInterface $request, array $user): ResponseInterface
|
|
{
|
|
$files = $request->getUploadedFiles();
|
|
$file = $files['file'] ?? null;
|
|
$feedbackUid = (int)($request->getParsedBody()['feedback'] ?? 0);
|
|
$feedback = $this->ownFeedback($user['uid'], $feedbackUid);
|
|
if ($file === null || $file->getError() !== UPLOAD_ERR_OK) {
|
|
return new JsonResponse(['error' => 'no file'], 400);
|
|
}
|
|
if ($file->getSize() > self::MAX_UPLOAD) {
|
|
return new JsonResponse(['error' => 'file too large (max 20 MB)'], 400);
|
|
}
|
|
|
|
$storage = GeneralUtility::makeInstance(StorageRepository::class)->getDefaultStorage();
|
|
$folderPath = 'fe_comment/summary-' . (int)$feedback['summary'];
|
|
$folder = $storage->hasFolder($folderPath) ? $storage->getFolder($folderPath) : $storage->createFolder($folderPath);
|
|
$temp = GeneralUtility::tempnam('fecomment_');
|
|
$file->moveTo($temp);
|
|
$clientName = $file->getClientFilename() ?: 'upload.bin';
|
|
$falFile = $storage->addFile($temp, $folder, $clientName, DuplicationBehavior::RENAME);
|
|
|
|
$connection = GeneralUtility::makeInstance(ConnectionPool::class)->getConnectionForTable('sys_file_reference');
|
|
$connection->insert('sys_file_reference', [
|
|
'pid' => $this->settings->storagePid(),
|
|
'tstamp' => time(),
|
|
'crdate' => time(),
|
|
'uid_local' => $falFile->getUid(),
|
|
'uid_foreign' => $feedbackUid,
|
|
'tablenames' => self::T_FEEDBACK,
|
|
'fieldname' => 'attachments',
|
|
]);
|
|
// lastInsertId() must be read BEFORE any further statement on this
|
|
// connection - syncAttachmentCount() runs an UPDATE and DBAL then
|
|
// throws "No identity value was generated".
|
|
$refUid = (int)$connection->lastInsertId();
|
|
$this->syncAttachmentCount($feedbackUid);
|
|
|
|
return new JsonResponse(['ok' => true, 'attachment' => [
|
|
'refUid' => $refUid,
|
|
'name' => $falFile->getName(),
|
|
'url' => '/fileadmin' . $falFile->getIdentifier(),
|
|
]]);
|
|
}
|
|
|
|
/** @param array{uid:int,username:string,name:string,email:string} $user */
|
|
private function deleteAttachment(array $user, int $refUid): ResponseInterface
|
|
{
|
|
$connection = GeneralUtility::makeInstance(ConnectionPool::class)->getConnectionForTable('sys_file_reference');
|
|
$reference = $connection->fetchAssociative(
|
|
'SELECT uid, uid_foreign FROM sys_file_reference WHERE uid = ? AND deleted = 0 AND tablenames = ?',
|
|
[$refUid, self::T_FEEDBACK]
|
|
);
|
|
if (!$reference) {
|
|
return new JsonResponse(['error' => 'not found'], 404);
|
|
}
|
|
$this->ownFeedback($user['uid'], (int)$reference['uid_foreign']);
|
|
$connection->update('sys_file_reference', ['deleted' => 1, 'tstamp' => time()], ['uid' => $refUid]);
|
|
$this->syncAttachmentCount((int)$reference['uid_foreign']);
|
|
return new JsonResponse(['ok' => true]);
|
|
}
|
|
|
|
/** @param array{uid:int,username:string,name:string,email:string} $user */
|
|
private function updateSummary(ServerRequestInterface $request, array $user): ResponseInterface
|
|
{
|
|
$body = $this->jsonBody($request);
|
|
$summary = $this->openSummary($user['uid'], true);
|
|
$update = ['tstamp' => time()];
|
|
if (array_key_exists('generalNotes', $body)) {
|
|
$update['general_notes'] = $this->sanitize((string)$body['generalNotes']);
|
|
}
|
|
if (array_key_exists('recipients', $body) && is_array($body['recipients'])) {
|
|
$valid = array_keys($this->recipientMap());
|
|
$chosen = array_values(array_intersect(array_map('intval', $body['recipients']), $valid));
|
|
$update['recipients'] = implode(',', $chosen);
|
|
}
|
|
GeneralUtility::makeInstance(ConnectionPool::class)->getConnectionForTable(self::T_SUMMARY)
|
|
->update(self::T_SUMMARY, $update, ['uid' => (int)$summary['uid']]);
|
|
return new JsonResponse(['ok' => true]);
|
|
}
|
|
|
|
/** @param array{uid:int,username:string,name:string,email:string} $user */
|
|
private function submit(array $user): ResponseInterface
|
|
{
|
|
$summary = $this->openSummary($user['uid'], false);
|
|
if ($summary === null) {
|
|
return new JsonResponse(['error' => 'nothing to submit'], 400);
|
|
}
|
|
$payload = $this->summaryPayload($summary);
|
|
if ($payload['items'] === [] && trim(strip_tags((string)$payload['generalNotes'])) === '') {
|
|
return new JsonResponse(['error' => 'nothing to submit'], 400);
|
|
}
|
|
|
|
$recipientMap = $this->recipientMap();
|
|
$chosen = GeneralUtility::intExplode(',', (string)$summary['recipients'], true);
|
|
$to = [];
|
|
foreach ($chosen as $id) {
|
|
if (isset($recipientMap[$id])) {
|
|
$to[] = $recipientMap[$id]['email'];
|
|
}
|
|
}
|
|
if ($to === []) {
|
|
$to = $this->settings->mailTo();
|
|
}
|
|
if ($to === []) {
|
|
return new JsonResponse(['error' => 'no recipient configured'], 503);
|
|
}
|
|
|
|
// Inline images (Ctrl+V pastes) are embedded into the mail itself:
|
|
// the notes reference /fileadmin/... which a mail client cannot load
|
|
// (relative, and dev sits behind basic auth). $embeds collects
|
|
// cid => absolute file path while the HTML is assembled.
|
|
$embeds = [];
|
|
$base = 'https://' . ($_SERVER['HTTP_HOST'] ?? 'dev.vitec.com');
|
|
$html = '<h2>Page feedback from ' . htmlspecialchars($user['name']) . '</h2>'
|
|
. '<p><strong>Author:</strong> ' . htmlspecialchars($user['name'])
|
|
. ' <' . htmlspecialchars($user['email']) . '></p>';
|
|
if (trim(strip_tags((string)$payload['generalNotes'])) !== '') {
|
|
$html .= '<h3>General notes</h3>' . $this->embedNoteImages((string)$payload['generalNotes'], $embeds);
|
|
}
|
|
foreach ($payload['items'] as $i => $item) {
|
|
$html .= '<hr><h3>' . ($i + 1) . ') ' . htmlspecialchars($item['url'] ?: '(no url)') . '</h3>'
|
|
. $this->embedNoteImages((string)$item['note'], $embeds);
|
|
if ($item['attachments'] !== []) {
|
|
$html .= '<p><strong>Attachments:</strong></p><ul>';
|
|
foreach ($item['attachments'] as $attachment) {
|
|
$html .= '<li><a href="' . htmlspecialchars($base . $attachment['url']) . '">' . htmlspecialchars($attachment['name']) . '</a></li>';
|
|
}
|
|
$html .= '</ul>';
|
|
}
|
|
}
|
|
|
|
$mail = GeneralUtility::makeInstance(MailMessage::class);
|
|
foreach ($embeds as $cid => $absolutePath) {
|
|
$mail->embedFromPath($absolutePath, $cid);
|
|
}
|
|
$mail->to(...$to)
|
|
->subject($this->settings->subject() . ' — ' . $user['name'] . ' (' . count($payload['items']) . ' item' . (count($payload['items']) === 1 ? '' : 's') . ')')
|
|
->html($html);
|
|
if ($this->settings->mailCc() !== []) {
|
|
$mail->cc(...$this->settings->mailCc());
|
|
}
|
|
if ($this->settings->mailBcc() !== []) {
|
|
$mail->bcc(...$this->settings->mailBcc());
|
|
}
|
|
if (GeneralUtility::validEmail($user['email'])) {
|
|
$mail->replyTo($user['email']);
|
|
}
|
|
GeneralUtility::makeInstance(\TYPO3\CMS\Core\Mail\Mailer::class)->send($mail);
|
|
|
|
GeneralUtility::makeInstance(ConnectionPool::class)->getConnectionForTable(self::T_SUMMARY)
|
|
->update(self::T_SUMMARY, ['status' => 'sent', 'sent_at' => time(), 'tstamp' => time()], ['uid' => (int)$summary['uid']]);
|
|
return new JsonResponse(['ok' => true, 'sent' => count($payload['items'])]);
|
|
}
|
|
|
|
// ---- helpers ------------------------------------------------------------
|
|
|
|
/**
|
|
* Rewrites <img src="/fileadmin/..."> in a note to cid: references and
|
|
* collects the embeds (cid => absolute path) for the mail. Images whose
|
|
* file is gone keep their URL made absolute, so at least the link works.
|
|
*
|
|
* @param array<string,string> $embeds
|
|
*/
|
|
private function embedNoteImages(string $noteHtml, array &$embeds): string
|
|
{
|
|
return (string)preg_replace_callback(
|
|
'/src="(\/fileadmin\/[^"]+)"/',
|
|
function (array $match) use (&$embeds): string {
|
|
$absolute = \TYPO3\CMS\Core\Core\Environment::getPublicPath() . rawurldecode($match[1]);
|
|
if (!is_file($absolute)) {
|
|
return 'src="https://' . ($_SERVER['HTTP_HOST'] ?? 'dev.vitec.com') . $match[1] . '"';
|
|
}
|
|
$cid = array_search($absolute, $embeds, true);
|
|
if ($cid === false) {
|
|
$cid = 'fecimg' . (count($embeds) + 1);
|
|
$embeds[$cid] = $absolute;
|
|
}
|
|
return 'src="cid:' . $cid . '"';
|
|
},
|
|
$noteHtml
|
|
);
|
|
}
|
|
|
|
/** @return array<string,mixed>|null */
|
|
private function openSummary(int $userUid, bool $createIfMissing): ?array
|
|
{
|
|
$connection = GeneralUtility::makeInstance(ConnectionPool::class)->getConnectionForTable(self::T_SUMMARY);
|
|
$summary = $connection->fetchAssociative(
|
|
'SELECT * FROM ' . self::T_SUMMARY . " WHERE deleted = 0 AND status = 'open' AND fe_user = ? ORDER BY uid DESC",
|
|
[$userUid]
|
|
);
|
|
if ($summary) {
|
|
return $summary;
|
|
}
|
|
if (!$createIfMissing) {
|
|
return null;
|
|
}
|
|
$connection->insert(self::T_SUMMARY, [
|
|
'pid' => $this->settings->storagePid(),
|
|
'tstamp' => time(),
|
|
'crdate' => time(),
|
|
'fe_user' => $userUid,
|
|
'status' => 'open',
|
|
]);
|
|
return $this->openSummary($userUid, false);
|
|
}
|
|
|
|
/**
|
|
* @param array<string,mixed> $summary
|
|
* @return array{uid:int,generalNotes:string,recipients:int[],items:array<int,array{uid:int,url:string,note:string,attachments:array<int,array{refUid:int,name:string,url:string}>}>}
|
|
*/
|
|
private function summaryPayload(array $summary): array
|
|
{
|
|
$connection = GeneralUtility::makeInstance(ConnectionPool::class)->getConnectionForTable(self::T_FEEDBACK);
|
|
$items = [];
|
|
foreach ($connection->fetchAllAssociative(
|
|
'SELECT uid, url, note FROM ' . self::T_FEEDBACK . ' WHERE deleted = 0 AND summary = ? ORDER BY sorting',
|
|
[(int)$summary['uid']]
|
|
) as $row) {
|
|
$items[] = [
|
|
'uid' => (int)$row['uid'],
|
|
'url' => (string)$row['url'],
|
|
'note' => (string)$row['note'],
|
|
'attachments' => $this->attachments((int)$row['uid']),
|
|
];
|
|
}
|
|
return [
|
|
'uid' => (int)$summary['uid'],
|
|
'generalNotes' => (string)($summary['general_notes'] ?? ''),
|
|
'recipients' => GeneralUtility::intExplode(',', (string)($summary['recipients'] ?? ''), true),
|
|
'items' => $items,
|
|
];
|
|
}
|
|
|
|
/** @return array<int,array{refUid:int,name:string,url:string}> */
|
|
private function attachments(int $feedbackUid): array
|
|
{
|
|
$connection = GeneralUtility::makeInstance(ConnectionPool::class)->getConnectionForTable('sys_file_reference');
|
|
$rows = $connection->fetchAllAssociative(
|
|
'SELECT r.uid AS ref_uid, f.name, f.identifier FROM sys_file_reference r
|
|
JOIN sys_file f ON f.uid = r.uid_local
|
|
WHERE r.deleted = 0 AND r.tablenames = ? AND r.fieldname = ? AND r.uid_foreign = ? ORDER BY r.uid',
|
|
[self::T_FEEDBACK, 'attachments', $feedbackUid]
|
|
);
|
|
return array_map(static fn(array $r): array => [
|
|
'refUid' => (int)$r['ref_uid'],
|
|
'name' => (string)$r['name'],
|
|
'url' => '/fileadmin' . $r['identifier'],
|
|
], $rows);
|
|
}
|
|
|
|
/** @return array<string,mixed> the feedback row - throws when not the user's */
|
|
private function ownFeedback(int $userUid, int $feedbackUid): array
|
|
{
|
|
$connection = GeneralUtility::makeInstance(ConnectionPool::class)->getConnectionForTable(self::T_FEEDBACK);
|
|
$row = $connection->fetchAssociative(
|
|
'SELECT * FROM ' . self::T_FEEDBACK . ' WHERE deleted = 0 AND uid = ? AND fe_user = ?',
|
|
[$feedbackUid, $userUid]
|
|
);
|
|
if (!$row) {
|
|
throw new \RuntimeException('feedback not found or not yours', 1764600000);
|
|
}
|
|
return $row;
|
|
}
|
|
|
|
private function syncAttachmentCount(int $feedbackUid): void
|
|
{
|
|
$connection = GeneralUtility::makeInstance(ConnectionPool::class)->getConnectionForTable('sys_file_reference');
|
|
$count = (int)$connection->fetchOne(
|
|
'SELECT COUNT(*) FROM sys_file_reference WHERE deleted = 0 AND tablenames = ? AND fieldname = ? AND uid_foreign = ?',
|
|
[self::T_FEEDBACK, 'attachments', $feedbackUid]
|
|
);
|
|
GeneralUtility::makeInstance(ConnectionPool::class)->getConnectionForTable(self::T_FEEDBACK)
|
|
->update(self::T_FEEDBACK, ['attachments' => $count, 'tstamp' => time()], ['uid' => $feedbackUid]);
|
|
}
|
|
|
|
/** @return array<int,array{label:string,email:string}> id => recipient */
|
|
private function recipientMap(): array
|
|
{
|
|
return $this->settings->recipients();
|
|
}
|
|
|
|
/** @return array<int,array{id:int,label:string}> */
|
|
private function recipientOptions(): array
|
|
{
|
|
$options = [];
|
|
foreach ($this->recipientMap() as $id => $recipient) {
|
|
$options[] = ['id' => $id, 'label' => $recipient['label']];
|
|
}
|
|
return $options;
|
|
}
|
|
|
|
/** @return array<string,mixed> */
|
|
private function jsonBody(ServerRequestInterface $request): array
|
|
{
|
|
$parsed = $request->getParsedBody();
|
|
if (is_array($parsed) && $parsed !== []) {
|
|
return $parsed;
|
|
}
|
|
$decoded = json_decode((string)$request->getBody(), true);
|
|
return is_array($decoded) ? $decoded : [];
|
|
}
|
|
|
|
/** TYPO3 HTML sanitizer; falls back to a hard strip when unavailable. */
|
|
private function sanitize(string $html): string
|
|
{
|
|
$html = mb_substr($html, 0, self::MAX_NOTE);
|
|
try {
|
|
$builder = GeneralUtility::makeInstance(\TYPO3\CMS\Core\Html\SanitizerBuilderFactory::class)->build('default');
|
|
return $builder->sanitize($html);
|
|
} catch (\Throwable) {
|
|
return strip_tags($html, '<p><br><b><strong><i><em><u><ul><ol><li><a><img><h3><h4>');
|
|
}
|
|
}
|
|
}
|