action.php File Reference

General framework for handling user input and performing actions. More...

Go to the source code of this file.

Functions
	do_action ()
	Perform actions based on user input.

---

Detailed Description

General framework for handling user input and performing actions.

Definition in file action.php.

---

Function Documentation

do_action

(

)

Perform actions based on user input.

This function is the central hub for performing operations on data. Any operation - creation, deletion or editing of users, books, document collections, etc., is handled by - or rather, through - this script.

Parameters:

	$_GET['action']	-- the action (e.g. new, edit, delete, ...)
	$_GET['item']	-- the item type (e.g. book, user, ...)
	$_GET['id']	-- the item's numeric identifier
	$_GET['b_ok']	-- "OK" button was clicked
	$_GET['b_cancel']	-- "Cancel" button was clicked

Parameters passed via POST requests are understood, too.

Parameters that are not used by action.php, are nevertheless passed to the appropriate backend function via the $INPUT parameter.

This script is responsible for:

1. handling any data submitted by the user via HTML forms (for example handling any submit buttons pressed by the user)
2. performing validity checks on user input ($_GET, $_POST)
3. verifying that the user has the necessary access privileges to perform the requested action
4. asking the user for confirmation for certain actions (where required)
5. calling a backend function that implements the desired functionality

Being merely an application framework, this script does not perform any data operations by itself. Instead, it calls a backend function that implements the desired functionality (e.g. del_item() or edit_item()).

All the necessary information on handling data objects (items) and calling the supported actions is gathered from the variables $actions_info[] and $item_info[].

To add a new item or a new action, it should be sufficient to provide an appropriate entry in $actions_info[] and/or $item_info[]. No code in action.php needs to be modified.

Examples of use:

http://yourserver/semapp/action.php?action=edit&item=book&id=123 -- edit the book with id 123

http://yourserver/semapp/action.php?action=new&item=user -- create a new user account

http://yourserver/semapp/action.php?action=delete&item=collection&id=123 -- delete the collection with id 123

Definition at line 76 of file action.php.

References $actions_info, $item_info, $validation_info, check_acl(), check_input(), expire(), redirect(), smarty_init(), sql_exit(), and sql_init().

                     {

global $_GET, $_POST, $_SESSION;
global $actions_info, $item_info, $validation_info;

if (session_id() == "") { session_start(); }

$smarty =& smarty_init();

# syntax
# action.php?action=xxx&item=yyy&id=zz
$INPUT = array_merge($_GET,$_POST);

## validation of user input

$errors = check_input($INPUT, $validation_info); 

if (!empty($errors)) {
        user_error("Missing or malformed input parameter(s): " . join($errors, ", "), E_USER_ERROR); 
}

$item   = $INPUT['item'];
$id     = $INPUT['id'];

## xxx prevent multiple invocations of the same form

## xxx ugly hack

if(isset($INPUT['b_ok_x'])) {
        $INPUT['b_ok'] = "yes";
        unset($INPUT['b_ok_x']); 
        unset($INPUT['b_ok_y']);
}

## "cancel" button pressed?
$action = "";   # action

if (isset($INPUT['action'])) {
        # action specified as part of URL

        $action = $INPUT['action'];
        unset($INPUT['action']);

}  else {

        # button pressed?

        foreach ($actions_info as $k => $v) {
        $btn = $v['button'];

        if (isset($INPUT[$btn])) {
                $action = $k; 
                unset($INPUT[$btn]);
        }
        }
}

# suppress confirmation question (because user told us to shut up)

if (isset($INPUT['c_dontask'])) {
        $_SESSION['noconfirm'][$action][$item] = TRUE;
}

# user pressed "cancel" button

if (($action == "cancel") or isset($INPUT['b_cancel'])) {

        if (isset($INPUT['redirect'])) {
                $url = $INPUT['redirect'];
        } else {
                $url = $_SESSION['last_page'];
                if (isset($INPUT['document_id']))  {
                        $url .= "#id_" .$INPUT['document_id']; 
                } else if (isset($INPUT['id'])) {
                        $url .= "#id_" .$INPUT['id']; 
                }
        }


        redirect($url);
        exit(0);
}

$db = sql_init();

# may the user do what he intends to do? 

if (!check_acl($actions_info[$action]['acl'],$item,$INPUT['id'],$db)) {
        user_error("Permission denied: action '$action' on item type '$item'", 
                E_USER_ERROR); 
}

# ask the user for confirmation (e.g. when deleting something)

if (($actions_info[$action]['confirm']) and !isset($INPUT['b_ok'])
        and !isset($_SESSION['noconfirm'][$action][$item]) ) {

        $smarty->assign('item', $INPUT['item']);
        $smarty->assign('id', $INPUT['id']);
        $smarty->assign('action', $action);
        $smarty->assign('file', $INPUT['file']);
        $smarty->assign('redirect', $INPUT['redirect']);

        $smarty->display("header.tpl");
        $smarty->display("confirm.tpl");
        $smarty->display("footer.tpl");

        exit(0);
}



# execute the action

foreach ($actions_info as $v) {
        $b = $v['button'];
        unset($INPUT[$b]);
}


unset($INPUT['action']);

## override of $INPUT[] by $actions_info[$action['input'] 

$INPUT = array_merge($INPUT, $actions_info[$action]['input']);


if (isset($actions_info[$action]['url'])) {

        # action is an url --> redirect

        $url = $actions_info[$action]['url'];

        foreach ($INPUT as $k => $v) {
                $url .= urlencode($k) .  "=" . urlencode($v) . "&";
        }

        $url = rtrim($url,'&?');

        redirect($url);
        exit(0);

} else if (isset( $actions_info[$action]['eval'])) {

        # action is php code --> eval()

        expire($smarty, $db);

        eval($actions_info[$action]['eval']);


} else {
        user_error("Unknown action:  $action", E_USER_ERROR); 
}

# cleanup, go to last_page

sql_exit($db);

if (isset($INPUT['redirect']))  {
        $url = $INPUT['redirect'];
} else {
        $url = $_SESSION['last_page'];
        if (isset($INPUT['document_id']))  {
                $url .= "#id_" .$INPUT['document_id']; 
        } else if (isset($INPUT['id'])) {
                $url .= "#id_" .$INPUT['id']; 
        }
}


redirect($url);

}

Here is the call graph for this function:

---