1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
|
package api
import (
"context"
"fmt"
"log"
"net/http"
"strings"
"time"
"github.com/ponzu-cms/ponzu/system/admin/upload"
"github.com/ponzu-cms/ponzu/system/db"
"github.com/ponzu-cms/ponzu/system/item"
)
// Externalable accepts or rejects external POST requests to endpoints such as:
// /external/content?type=Review
type Externalable interface {
// Accept allows external content submissions of a specific type
Accept(req *http.Request) error
}
// Trustable allows external content to be auto-approved, meaning content sent
// as an Externalable will be stored in the public content bucket
type Trustable interface {
AutoApprove(req *http.Request) error
}
func externalContentHandler(res http.ResponseWriter, req *http.Request) {
if req.Method != http.MethodPost {
res.WriteHeader(http.StatusMethodNotAllowed)
return
}
err := req.ParseMultipartForm(1024 * 1024 * 4) // maxMemory 4MB
if err != nil {
log.Println("[External] error:", err)
res.WriteHeader(http.StatusInternalServerError)
return
}
t := req.URL.Query().Get("type")
if t == "" {
res.WriteHeader(http.StatusBadRequest)
return
}
p, found := item.Types[t]
if !found {
log.Println("[External] attempt to submit unknown type:", t, "from:", req.RemoteAddr)
res.WriteHeader(http.StatusNotFound)
return
}
post := p()
ext, ok := post.(Externalable)
if !ok {
log.Println("[External] rejected non-externalable type:", t, "from:", req.RemoteAddr)
res.WriteHeader(http.StatusBadRequest)
return
}
ts := fmt.Sprintf("%d", int64(time.Nanosecond)*time.Now().UnixNano()/int64(time.Millisecond))
req.PostForm.Set("timestamp", ts)
req.PostForm.Set("updated", ts)
urlPaths, err := upload.StoreFiles(req)
if err != nil {
log.Println(err)
res.WriteHeader(http.StatusInternalServerError)
return
}
for name, urlPath := range urlPaths {
req.PostForm.Set(name, urlPath)
}
// check for any multi-value fields (ex. checkbox fields)
// and correctly format for db storage. Essentially, we need
// fieldX.0: value1, fieldX.1: value2 => fieldX: []string{value1, value2}
var discardKeys []string
for k, v := range req.PostForm {
if strings.Contains(k, ".") {
key := strings.Split(k, ".")[0]
if req.PostForm.Get(key) == "" {
req.PostForm.Set(key, v[0])
} else {
req.PostForm.Add(key, v[0])
}
discardKeys = append(discardKeys, k)
}
}
for _, discardKey := range discardKeys {
req.PostForm.Del(discardKey)
}
// call Accept with the request, enabling developer to add or chack data
// before saving to DB
err = ext.Accept(req)
if err != nil {
log.Println(err)
res.WriteHeader(http.StatusInternalServerError)
return
}
hook, ok := post.(item.Hookable)
if !ok {
log.Println("[External] error: Type", t, "does not implement item.Hookable or embed item.Item.")
res.WriteHeader(http.StatusBadRequest)
return
}
err = hook.BeforeSave(req)
if err != nil {
log.Println("[External] error:", err)
res.WriteHeader(http.StatusInternalServerError)
return
}
// set specifier for db bucket in case content is/isn't Trustable
var spec string
// check if the content is Trustable should be auto-approved
trusted, ok := post.(Trustable)
if ok {
err := trusted.AutoApprove(req)
if err != nil {
log.Println("[External] error:", err)
res.WriteHeader(http.StatusInternalServerError)
return
}
} else {
spec = "__pending"
}
id, err := db.SetContent(t+spec+":-1", req.PostForm)
if err != nil {
log.Println("[External] error:", err)
res.WriteHeader(http.StatusInternalServerError)
return
}
// set the target in the context so user can get saved value from db in hook
ctx := context.WithValue(req.Context(), "target", fmt.Sprintf("%s:%d", t, id))
req = req.WithContext(ctx)
err = hook.AfterSave(req)
if err != nil {
log.Println("[External] error:", err)
res.WriteHeader(http.StatusInternalServerError)
return
}
}
|
