316 Commits

Author SHA1 Message Date
Marc Jauvin
6c391b5e82
Add config for throttling login attempts into Backend (#4974) 2020-03-11 10:57:19 +08:00
Samuel Georges
aff120fcec Remove return types
These can be added back in post-Laravel 6 era (> PHP 7.2)
Also removed the defaults since they are no longer needed, supplied by the new objects

Refs #4929
2020-03-01 18:15:44 +11:00
Klaas Poortinga
bf8ab3612e
Modify menu structure to objects (#4929)
* Modify menu structure to objects
2020-03-01 17:10:37 +10:00
Ayumi
56eab50260 Documented session.http_only (#4743)
Credit to @ayumi-cloud
2019-12-14 11:14:23 -06:00
Tobias Kündig
4704f85096 Added lazy loading for backend form tabs (#4658)
* Added lazy loading for backend form tabs
2019-12-09 20:45:26 +11:00
Marc Jauvin
992e84e602 Add missing documentation comment blocks for fired events (#4788)
Credit to @mjauvin.
2019-11-24 23:59:00 -06:00
Luke Towers
70107c6376 Initial WIP on implementing dependsOn support for filter scopes.
Still need to resolve an issue where if the slave filter has values set when the master filter updates, thus triggering a change of the available options to the slave, the original values are still set on the slave but not actually visible in the popup as options because they're no longer valid options. To fix this we'll need the ability to get the browser to refresh the slave filter's selected values (count icon basically since it already forces the options popup to refresh) when its masters update; while at the same rechecking the slave's scope values set on the server to ensure that they're all valid and there aren't values left over from the previous request that are no longer valid but are still being applied to the query.
2019-11-12 17:02:25 -06:00
Luke Towers
07ac19f7b3 cleanup from last commit 2019-11-07 12:03:10 -06:00
Luke Towers
d56dded458 Restore middleware support in backend controllers.
Reverts f73d8e6d49.  While there are other ways to achieve some of the same end results, this code existed in the code base for 8 months without issues and is included in the official docs. This means that there could be devs that are depending on this behavior. Additionally, while this may make the internal logic to the BackendController class more complex, it simplifies the developer experience by bringing the Backend\Classes\Controller base class more in line with the standard Laravel controller class.
2019-11-07 11:59:00 -06:00
Luke Towers
490b1d6b00 minor formatting fix 2019-11-06 16:56:46 -06:00
Samuel Georges
8da798a5cd Remove XSRF cookie
This was a contentious change is generally a bad idea to blanket all requests with a dependant cookie. We will try something else.

Revert enableXsrfCookies setting. Fixes UX issue introduced where the token expires. This should be replaced by a CSRF policy that determines whether this is needed on the front end.
2019-11-04 09:06:05 +11:00
Samuel Georges
c5bd5f0e0a Apply ResponseMaker to backend AJAX and cms.page.display event 2019-11-03 08:02:28 +11:00
Samuel Georges
63f65a3f25 Add XSRF to backend, simplify CMS controller run() method
runInternal has been removed because we do not want to blanket our response logic over every single response, only the happy path. This is because it is impossible to remove. So it is better to take the inverted approach, where if you want the CMS' headers in your custom response, add them yourself. This becomes easy via the new makeResponse() method
2019-11-02 19:14:45 +11:00
Samuel Georges
ff8f899fbe Move response common functions to ResponseMaker trait 2019-11-02 18:21:22 +11:00
Samuel Georges
f269901d72
Merge pull request #4732 from octobercms/remove_double_middleware
Remove double middleware
2019-11-02 18:06:50 +11:00
Samuel Georges
92bd8360b9 Fixes issue where behaviors are not booting 2019-11-02 16:30:33 +11:00
Samuel Georges
f73d8e6d49 Removes double middleware layer
For some reason it was decided to allow October controllers to support Laravel middleware, this has been reverted because it is a convoluted solution that doesn't respect the original architecture. There are other ways to handle middleware requirements

The original use case appeared to be to simply allow backend controllers to inject headers. This is something easily solvable whilst keeping the simple and original workflow
2019-11-02 16:16:32 +11:00
Samuel Georges
b1fa45ee3a Combine common CSRF logic to a trait 2019-11-02 15:15:18 +11:00
Luke Towers
d31006ae1a Return 403 response on CSRF fail instead of silently failing
Also moved backend::lang.page.invalid_token.label to system::lang.page.invalid_token.label. Fixes
2019-10-06 23:21:08 -06:00
Saifur Rahman Mohsin
f6c789f716 Added getConfig helper method to get config values (#4653)
Credit to @SaifurRahmanMohsin 

Added getConfig to make it easier for developers to fetch the config data from a list column while overriding the list items through extension. This also makes the class more compatible with [FormField](https://github.com/octobercms/october/blob/master/modules/backend/classes/FormField.php) which already has the same helper function.
2019-10-02 16:33:14 -06:00
Dan Harrin
919835e5de Add method removePermission() for AuthManager (#4522)
Allows programmatic removal of permissions being listed in Permission selection widget.

Credit to @DanHarrin.
2019-09-21 23:42:11 +08:00
Ben Thomson
0240c21af6 Fail CSRF token checks if the session expires. (#4598)
Fixes #4595. Credit to @bennothommo
2019-09-04 21:33:10 -06:00
Dan Harrin
f7539b2c32 Added getReportWidgets() method (#4525)
Credit to @DanHarrin
2019-08-15 09:36:15 -06:00
Dan Harrin
9521dd795c Minor Formatting Corrections in Usage Comments (#4541)
Credit to @DanHarrin
2019-08-15 09:14:54 -06:00
Ben Thomson
f190f7a347
Fix exception on middleware loader
An exception was thrown when loading middleware if a requested controller is from a disabled plugin, as the `getRequestedController` method returns a Response object in this scenario.

Hat tip to @w20k.
2019-08-15 16:52:24 +08:00
Samuell
9b8974b003 Add validator for plugin navigation items (#4497)
This will detect invalid navigation item configuration in installed plugins. In debug mode, this will throw an error, otherwise, it will simply log the error.

Credit to @Samuell1. Fixes #4491.
2019-08-15 11:47:13 +08:00
Ben Thomson
a59d3b83eb Code quality clean up (#4449)
Credit to @bennothommo
2019-07-18 08:50:37 -06:00
Luke Towers
9fa7cbf70e Hide backend controller behavior public methods from controller actions.
Fixes #3762, replaces #3764
2019-04-19 14:01:01 -06:00
Samuel Georges
5190c8177b Avoid terminating the app using exit() or die()
Refs #3783
Refs #3746
2019-03-29 07:10:07 +11:00
Ben Thomson
8c1106f027 Allow list configs to add class to head row cell (#4207)
Credit to @bennothommo. Documented by https://github.com/octobercms/docs/pull/367
2019-03-25 13:37:32 -06:00
Ben Thomson
3363b219f6 Delay backend controller middleware until after request is processed (#4190)
Credit to @bennothommo. Fixes #4183.
2019-03-21 01:19:28 -06:00
Larry Barker
5c15687032 Support CMS module being present but disabled (#4202)
Credit to @LarBearrr
2019-03-19 16:31:14 -06:00
Luke Towers
f168c1a601 Fix support for main menu items having a numeric value for counter 2019-03-16 13:53:25 -06:00
Ben Thomson
a89f1f1c3a Add Closure use declaration (#4170) 2019-02-28 14:54:00 +02:00
Ben Thomson
57a074364e Allow controller middleware in backend controllers (#4106)
Credit to @bennothommo Related: https://github.com/octobercms/october/pull/4088
2019-02-27 14:27:41 -06:00
Luke Towers
b39eb03336 Defaulted the main menu counter to sum it's side menu counters 2019-02-21 11:55:43 -06:00
Luke Towers
d6f8cc179d Support abort(404) in the backend module 2019-02-21 10:44:58 -06:00
Luke Towers
bbf398133e Fix issues with AJAX handlers on dashboard widgets. Replaces #4132 2019-02-13 15:05:18 -06:00
Luke Towers
cb87802080 Added support for counter and counterLabel to main menu.
Refs: #16, Refs: 7bcec1bd99a813a2fda8dfdc9f25ce51ed663bf8, Replaces: #4061
2019-02-13 14:54:13 -06:00
Luke Towers
1fc8dc6fd4 Added ability to require permissions use ReportWidgets 2019-02-11 16:02:30 -06:00
Luke Towers
78e68ed632 Support nested jsonable values in List columns, refs: #2990, #2995, #3088, 2019-02-01 15:11:57 -06:00
Tobias Kündig
67ee2229a5 Added manual deleted_at checks (#4051)
Fixes #4046 

It is possible that the user model gets fetched using the SoftDelete
trait before the relevant migrations were applied during an update.
To fix this edge case the user model is always fetched using the
withTrashed scope and the deleted_at check is done manually afterwards.

@see https://github.com/octobercms/october/issues/3999
2019-01-18 14:42:25 -06:00
Luke Towers
d6e680799f Reduce reliance on CMS module from Backend module
added backend 404 view, fixed return to backend URL in the access denied view on backend only instances
2019-01-15 11:46:48 -06:00
Luke Towers
6c0a77c064 Fix broken tests 2019-01-10 20:49:15 -06:00
Luke Towers
1c0fd1b419 Yet another change to perfect the getParentForm() method 2019-01-10 18:59:29 -06:00
Luke Towers
39987677f0 Peer review of 1b3263d4c7004c7b036ab8ae8b8fee3cfb6928b5 2019-01-10 17:57:32 -06:00
Luke Towers
1b3263d4c7 Pass the containing Form widget to the FormFields that it generates.
This enables complex FormWidgets that need to know what Form widget they belong to to access that information with $this->formField->form; This also enables a fix for: https://github.com/rainlab/location-plugin/issues/48
2019-01-10 10:22:59 -06:00
Luke Towers
064daa2d2e Compiled assets, minor docblock update 2019-01-03 16:26:30 -06:00
fansaien
2dcd84c4f2 Fix the input trigger API where a form element doesn't exist (#4033)
There are no `form` elements in the preview context of a form, so this adds an alternative selector to use when no common `form` elements are found for the Input Trigger API to use. Credit to @fansaien
2019-01-03 16:24:43 -06:00
Denis Denisov
2b16bad0fe Ignore controllers of disabled plugins (#3923)
Fixes #3905. Credit to @w20k
2018-11-15 13:51:11 -06:00