Topic: Adding "add image form" on add articles?

[processor]

As seen in attachment.

Below the dropdown for category selection I would like to add a form where users would add a url to the picture which would be used as a thumbnail for the article. So when i would call the articles with the portal "article" block to pull the thumnail too.
 
How difficult would that be to code? i looked up and should i be editing PortalAdminArticles.php for that or?

[processor]

I'm guessing i should be tweaking the next two files and these codes inside right?


PortalArticles.php

Code: [Select]

function sportal_add_article()
{
global $smcFunc, $context, $scripturl, $sourcedir, $txt;

if (!allowedTo(array('sp_add_article', 'sp_manage_articles', 'sp_admin')))
fatal_lang_error('error_sp_cannot_add_article');

require_once($sourcedir . '/Subs-PortalAdmin.php');
loadLanguage('SPortalAdmin', sp_languageSelect('SPortalAdmin'));
loadTemplate('PortalArticles');

if (!empty($_POST['add_article']))
{
$article_options = array(
'id_category' => !empty($_POST['category']) ? (int) $_POST['category'] : 0,
'id_message' => !empty($_POST['message']) ? (int) $_POST['message'] : 0,
'approved' => allowedTo(array('sp_admin', 'sp_manage_articles', 'sp_auto_article_approval')) ? 1 : 0,
);
createArticle($article_options);

redirectexit('topic=' . $_POST['return']);
}

$context['message'] = !empty($_REQUEST['message']) ? (int) $_REQUEST['message'] : 0;
$context['return'] = !empty($_REQUEST['return']) ? $_REQUEST['return'] : '';

if (empty($context['message']))
fatal_lang_error('error_sp_no_message_id');

$request = $smcFunc['db_query']('','
SELECT id_message
FROM {db_prefix}sp_articles
WHERE id_message = {int:message}',
array(
'message' => $context['message'],
)
);
list ($exists) = $smcFunc['db_fetch_row']($request);
$smcFunc['db_free_result']($request);

if ($exists)
fatal_lang_error('error_sp_article_exists');

$context['list_categories'] = getCategoryInfo(null, true);

if (empty($context['list_categories']))
fatal_error(allowedTo(array('sp_admin', 'sp_manage_articles')) ? $txt['error_sp_no_category'] . '<br />' . sprintf($txt['error_sp_no_category_sp_moderator'], $scripturl . '?action=admin;area=portalarticles;sa=addcategory') : $txt['error_sp_no_category_normaluser'], false);

$context['sub_template'] = 'add_article';
}
Subs-PortalAdmin.php

Code: [Select]

function createArticle($articleOptions)
{
global $smcFunc;

$articleOptions['id_category'] = !empty($articleOptions['id_category']) ? (int) $articleOptions['id_category'] : 0;
$articleOptions['id_message'] = !empty($articleOptions['id_message']) ? (int) $articleOptions['id_message'] : 0;
$articleOptions['approved'] = !empty($articleOptions['approved']) ? (int) $articleOptions['approved'] : 0;

$request = $smcFunc['db_query']('','
SELECT id_message
FROM {db_prefix}sp_articles
WHERE id_message = {int:id_message}',
array(
'id_message' => $articleOptions['id_message'],
)
);
list ($exists) = $smcFunc['db_fetch_row']($request);
$smcFunc['db_free_result']($request);

if (empty($articleOptions['id_category']) || empty($articleOptions['id_message']) || $exists)
return false;

$smcFunc['db_insert']('normal', '{db_prefix}sp_articles',
array('id_category' => 'int', 'id_message' => 'int', 'approved' => 'int'),
array($articleOptions['id_category'], $articleOptions['id_message'], $articleOptions['approved']),
array('id_article')
);

$smcFunc['db_query']('','
UPDATE {db_prefix}sp_categories
SET articles = articles + 1
WHERE id_category = {int:id_category}',
array(
'id_category' => $articleOptions['id_category'],
)
);
}
Should i be let's say adding a new option in $article_options = array(); such as 'id_message_picture'  that would be proccessed in subs-portaladmin.php or?
         

[AngelinaBelle]

I think you are barking up the right tree, processor.  You want the
And also , if you are going to display this image some place, you will have to alter how the block is displayed.
So I would suggest you begin in PortalArticles.php.  Decide how to display some new image, then work backwords to how you are going to get that image in there.
1) Add something to the article display that shows a "stock" image.  The same one each time.  When you have that working...
2) hard-code something into $articleOptions, like $articleOptions['image_thumbnail'] = "http://www.google.com/images/srpr/logo11w.png"    If you can set that in createArticles, and use it in PortalArticles, then you are really getting somewhere
3) If you can then create the interface for a user to specify an image, you will be mostly there
4) Remember, if the user attaches an image to a topic, they can copy the URL right from the topic and paste that into your input box.
5) Every time you allow users to enter information that will go on the database, remember to use the proper input-sanitation routines.  See how other parts of SMF do this.

Good Luck!

[processor]

I think you are barking up the right tree, processor.  You want the
And also , if you are going to display this image some place, you will have to alter how the block is displayed.
So I would suggest you begin in PortalArticles.php.  Decide how to display some new image, then work backwords to how you are going to get that image in there.
1) Add something to the article display that shows a "stock" image.  The same one each time.  When you have that working...
2) hard-code something into $articleOptions, like $articleOptions['image_thumbnail'] = "http://www.google.com/images/srpr/logo11w.png"    If you can set that in createArticles, and use it in PortalArticles, then you are really getting somewhere
3) If you can then create the interface for a user to specify an image, you will be mostly there
4) Remember, if the user attaches an image to a topic, they can copy the URL right from the topic and paste that into your input box.
5) Every time you allow users to enter information that will go on the database, remember to use the proper input-sanitation routines.  See how other parts of SMF do this.

Good Luck!

Yeah i thought something like that should be going in. I have already changed the way "article block" displays things...so it should be fairly easy to incorporate. Was wondering about if i am free to hardcode right away into $articleOptions or is there something before that has to be followed. Thanks for clearing some things up AngelinaBelle!



p.s. don't close/lock this thread as i will be back with few other questions along the way

[AngelinaBelle]

Well, see, you've made a good start, and you don't actually need me

In php, as soon as you say

$articleOptions['some_new_array_index'] then, bingo, you have created a brand new part to your array.
Just make sure you don't "collide" with something already in $articleOptions.  Which you won't, as long as you use some array index name that is completely unique.

Maybe you are asking something else, though, and I just have not figured out what it is?

[processor]

You understood it all right AngelinaBelle

Btw i did it...everything works as a charm. Just dunno about input url sanitation...i just used mysql_real_escape_string()...not sure is that enough in smf environment?

This is what i did, re-defined $_post by escaping received $_post and then there goes the article options thing

Code: [Select]



$_POST['thumbnail'] = mysql_real_escape_string($_POST['thumbnail']);

$article_options = array(
'id_category' => !empty($_POST['category']) ? (int) $_POST['category'] : 0,
'id_message' => !empty($_POST['message']) ? (int) $_POST['message'] : 0,
'url_thumbnail' => !empty($_POST['thumbnail']) ? $_POST['thumbnail'] : 0,
'approved' => allowedTo(array('sp_admin', 'sp_manage_articles', 'sp_auto_article_approval')) ? 1 : 0,
);

[processor]

I am wondering if these two sanitizers (for user url imput) would be enough. Real escape for sql injections and strip tags for xss? so far i haven't found anything that smf uses built in...so do you guys think this would be safe enough?

Code: [Select]


$_POST['thumbnail'] = mysql_real_escape_string($_POST['thumbnail']);
$_POST['thumbnail'] = strip_tags($_POST['thumbnail']);

$article_options = array(
'id_category' => !empty($_POST['category']) ? (int) $_POST['category'] : 0,
'id_message' => !empty($_POST['message']) ? (int) $_POST['message'] : 0,
'url_thumbnail' => !empty($_POST['thumbnail']) ? $_POST['thumbnail'] : 0,
'approved' => allowedTo(array('sp_admin', 'sp_manage_articles', 'sp_auto_article_approval')) ? 1 : 0,
);

createArticle($article_options);


[AngelinaBelle]

Typically, what you see in SMF code is something like:

Code: [Select]

$smcFunc['htmltrim']($smcFunc['htmlspecialchars']($_POST['whatever']), or else

Code: [Select]

$_POST = htmltrim__recursive($_POST);
$_POST = htmlspecialchars__recursive($_POST);
Just search for $_POST and you will see a bunch of examples in the files that deal with user input.

[processor]

Typically, what you see in SMF code is something like:

Code: [Select]

$smcFunc['htmltrim']($smcFunc['htmlspecialchars']($_POST['whatever']), or else

Code: [Select]

$_POST = htmltrim__recursive($_POST);
$_POST = htmlspecialchars__recursive($_POST);
Just search for $_POST and you will see a bunch of examples in the files that deal with user input.

So the current strip string and escape wouldn't do?

[AngelinaBelle]

Unfortunately, I am not an expert in these matters, and I have not looked through the $smcFunc functions to compare them to the MySQL library functions.

Therefore, when I do some coding in SMF, I simply follow the advice of the most experienced devs on the SMF team.


In some cases, the choices they make are dictated by the fact that they must support several different versions of php, and several different databases, and so they sometimes write custom code.  As php and the database libraries change, successive versions of SMF will use different stuff in those $smcFunc functions. This saves  me having to reinvent things the devs have already thought through, tested, and implemented, and saves me having to think about the differences between the database I use and the ones I don't use. It means I put a lot of faith in the SMF developers.  Which is necessary, as I am using SMF to begin with.

[processor]

Unfortunately, I am not an expert in these matters, and I have not looked through the $smcFunc functions to compare them to the MySQL library functions.

Therefore, when I do some coding in SMF, I simply follow the advice of the most experienced devs on the SMF team.


In some cases, the choices they make are dictated by the fact that they must support several different versions of php, and several different databases, and so they sometimes write custom code.  As php and the database libraries change, successive versions of SMF will use different stuff in those $smcFunc functions. This saves  me having to reinvent things the devs have already thought through, tested, and implemented, and saves me having to think about the differences between the database I use and the ones I don't use. It means I put a lot of faith in the SMF developers.  Which is necessary, as I am using SMF to begin with.

Thanks anyway AngelinaBelle. I've tested this as i wrote, it works, and since in sql query there's no LIKE or REVOKE statements i have no worries with escaping % and _ ...

I understand your thoughts, following their developed practice is just being on the safer side...thought i guess this works...or at least works untill someone hacks me

[AngelinaBelle]

You might be right.  the difference may never matter to you if you stick to MySQL and not-to-distant-future versions of php and SMF.

Congratulations on making your customization to SMF.  You might take a couple of screen shots of the "choose your image" interface and the end result on your portal page, just to show off.  I know others have wished to do the same thing (in English and in other languages), so others might be very interested in this little customization.

Cheers!

[processor]

You might be right.  the difference may never matter to you if you stick to MySQL and not-to-distant-future versions of php and SMF.

Congratulations on making your customization to SMF.  You might take a couple of screen shots of the "choose your image" interface and the end result on your portal page, just to show off.  I know others have wished to do the same thing (in English and in other languages), so others might be very interested in this little customization.

Cheers!

Of course, i will as soon as i finish it up i've considered packing it all in a install addon but if i'll have time i'll do it. 

For now i have made a large customization of the article display blocks and the things under the hub so the complete result now is that i don't use default articles but rather i use only "Article block" to show articles sorted by categories that users wishes.

news
[article][article][article]
culture
[article][article][article]
miscellaneous
[article][article][article]

[AngelinaBelle]

I do the same, with a customized article block -- one that is, by now, very ancient.
The layout is different, the idea is the same

Bravo!