See also Fox-Comments
Summary: Form processor to add, replace, copy, delete content plus upload files and send email notifications using templates and
Input markup
Version: 2008-11-26
Prerequisites: pmwiki 2.2.0 beta 46 or later
Status: beta
Questions answered by this recipe
How can I set up comment and other forms to post to various pages?
How can I allow users to post comments and other forms, without giving them edit access?
How can I allow users to be able to delete their posts, without giving them edit access?
How can I build a forum, CMS, a blog, a contact list, an appointment list, an address book?
Overview top
Fox is a form processing extension, using PmWiki's built in Input forms. Fox will process the input from form controls such as text boxes, drop-down select boxes, radio buttons and check boxes etc and create output with use of templates, which can be saved to the current page or other target pages, even to several pages.
In its default mode Fox will not overwrite or delete any pages, but will add content at the bottom (the default), or the top, or other specific places in the target page(s), or an anchored page section. The template Fox uses can be a character string, or a section in a template page, or a whole page, including standad pmWiki markup for formating etc. Special replacement variables in the template will be replaced with values from the associated input control fields.
Fox can save input as PTVs (page text variables), and will add and update PTVs as required. PTVs can be saved in different formats, the default is a "hidden" markup format, other formats are as special text list (used by the recipeinfo box at the top in the cookbook group here), or as definition list, or as anchored section. Input from an array of controls (for instance checkboxes) will be saved as a comma separated list.
A special replace action can replace content on a target page or page section. Using marks and keywords Fox can be used as a string replacement tool (search and replace), even using regular expressions, or overwrite whole sections or pages with new content, again using a template to create formatted output.
The copy action will copy source page content (as template) to a target page, or a section from a source page to a section of a target page, without changing anything. This means that input from controls is ignored, no variable replacements are performed and no template is processed. Instead the template page content becomes the source for the copy action, and the target page content will be exactly the same.
Last but not least, by using a display action, Fox can direct the output to appear at a specific location on the page, without it actually been saved to the page. This is very useful to display content from other pages, to display search results, or data from PTVs selectable by a user through input form controls.
Fox has a number of extensions: special delete links or buttons can be added with FoxDelete, with which either single lines added by Fox or whole multi-line additions can be deleted. For this Fox uses special markup as spaceholders on the template. Edit links can be added with FoxEdit. Through such links can parts of a page like sections or PTVs, or a whole page, be loaded into custom Fox edit forms, for instance to edit PTV data with each PTV value in a text box. FoxNotify is an email notification extension integrated with Fox forms.
Fox has various security configuration to control which fox action shall be allowed for which pages or wiki groups, and what level of authorisation is needed for users to submit form input. Even users who do not have edit rights can be allowed to submit input, and some special security features help controlling misuse, for instance built-in Captcha support and disabling of posting markup directives or expressions.
Fox can be used to direct output to multiple pages, using multiple templates, with the possibility to mix different fox actions for different pages. Even pagelists can be used to set target pages, and wiki wildcard pagenames with the help of markup expressions from PowerTools.
Fox has grown substantially, out of modifications and improvements to AddDeleteLine2, combining most of its features and the best of CommentBoxPlus, and adding many new features.
Fox has a growing list of applications, and many application examples are documented in the cookbook.
Installation top
Requires PmWiki 2.2.0 beta.
Install by downloading, and copying fox.phpΔ to a (new) cookbook/fox/ directory and fox.cssΔ to a pub/fox/ directory, and adding to your local config file:
include_once("$FarmD/cookbook/fox/fox.php");
Page permissions need to be set, either in a local config file or on SiteAdmin.FoxConfig, before Fox can do any work! This measure has been added to provide full security, especially important if you want to enable Fox for form posting on edit-protected pages. Read below about security configuration settings.
Usage
Fox Form Markup top
Fox can be applied in numerous ways, but basically it provides special markup to replace the (:input form ..:) and (:input end:) directives while using all the other (:input:) directives (see Input), and processing the submitted form input for formatted output to some page(s) or location.
Start of form:
(:fox formname [foxaction=keyword] [put=keyword] [template=PageName]
....
[target=PageName] [ptvtarget=PageName] [redirect=1] :)
End of form:
The fox form name needs to be specified in the end directive.
In addition to the start and end fox markup you can use some special markups in between. Each of these can be used multiple times, and Fox will build a list of target pages with associated templates and other parameters included in each markup:
-
(:foxadd ''TemplatePage=>TargetPage'' ... :) - for adding content.
-
(:foxreplace ''TemplatePage=>TargetPage'' ... :) - for replacing content.
-
(:foxcopy ''TemplatePage=>TargetPage'' ... :) - for content copying (no variable replacements). Note that only the template gets copied as content. Any page attributes of the template page are ignored!
-
(:foxptv TargetPage ptvfields=.. ptvfmt=.. ptvclear=.. :) - for adding and updating PTVs (page text variables)
-
(:foxmail template=EMailTemplate target=EMailList :) - for sending email message to small group of recipients on EMailList (needs FoxNotify).
Page sections can be used for templates as well as targets, like DisplayTemplates#topic and TargetPage#section, and full page names can be used, as well as multiple TemplatePage=>TargetPage pairs (see more below on multiple targets).
-
(:foxtemplate "one line template string":) - for forms needing no multiline template. The foxtemplate markup will be used if no template pages are specified. You can only use it once in a form. It is convenient for a quick and short templates. Note that \n will create a line break.
-
(:foxpreviewtemplate "one line template string":) - optional alternative template for preview invoked by a 'Preview' button.
-
(:foxcheck name .... :) - setting input validation checking for inut field name. See Input Validation
Parameters: top
formname is a required unique name for the form, which needs to be specified as the first parameter in the fox and foxend markup.
Optional parameter foxaction
-
foxaction=display - the output will be displayed at the page location marked with the
(:foxdisplay:) or (:foxdisplay formname:) markup, and will not be saved to the page.
-
foxaction=copy - Instead of adding content, content will be copied, without any template processing.
-
foxaction=replace - Instead of adding content, existing content will be replaced with new content. The template will be processed and evaluated.
-
foxaction=mail - form output will create email message and sent to recipients listed on target page, with help of FoxNotify.
Options for adding content (the default) or the (:foxadd ....:) markup
-
put= - a keyword designating where Fox will add the new content on the page. It defaults to bottom of a page or section. (deprecated formerly place=).
-
put=top - adding content to the top of the page (deprecated formerly #top).
-
put=bottom - adding content to the bottom of the page (default) (deprecated formerly #bottom).
-
put=aboveform - adding content above the form (deprecated formerly #append).
-
put=belowform - adding content below the form (deprecated formerly #prepend).
-
put=above and mark=STRING - adding content above the line with a marker given with parameter
mark=STRING.
-
put=below and mark=STRING - adding content below the line with a marker given with parameter
mark=STRING.
-
put=insert and mark=STRING - adding content after (right of) a marker given with parameter
mark=STRING.
-
put=insertbefore and mark=STRING - adding content before (left of) a marker given with parameter
mark=STRING.
Alternatively using markup as marker:
-
(:foxappend formname:) or (:foxprepend formname:) - two markups used as placement markers for posts to be appended or prepended; these take precedence over the above. Warning : this directive must have a text before the top of the page, either it did not work.
-
(:foxprepend formname #markername:) or (:foxappend... - extending the above by adding an anchor marker name. Using an input control to choose amongst options, and naming it foxplace, one can post to different markers according to the choosen option, as a way gather votes. See FoxVoting example.
Options for foxaction=replace, or the (:foxreplace ...:) markup:
-
put=string and mark=STRING - replace first occurrence of string given with
mark=STRING with new content.
Example :
(:fox ReplaceString foxaction=replace put=string target={$FullName} :)
(:foxtemplate "{$$newstring}":)
(:input text mark :)
(:input text newstring :)
(:input submit post 'Post':)
(:foxend ReplaceString :)
-
put=all and mark=STRING - replace all occurrences of string given with
mark=STRING with new content.
-
put=allplus and mark=STRING - replace all occurrences of string given with
mark=STRING with new content, even any STRING found in fox forms.
-
put=regex and mark=REGEX - replace all occurrences of regular expression given with
mark=REGEX with new content, even any REGEX match found in fox forms.
-
put=marktomark and mark=STRING and endmark=STRING - replace content between two markers in page specified with parameters
mark=STRING and endmark=STRING with new content.
-
put=overwrite - replace all content with new content.
More optional parameters:
-
template=TemplatePage - Fox will use TemplatePage to format the post. GroupName.TemplatePagename is allowed too. See about use of template below. Use template=0 if no template is required. Alternatively fox will use a one-line template string provided in a directive
(:foxtemplate "template string":). If used this needs to be put between form start and end. A template page specified has priority and overrides any template string given. The template string can be only a single line. For multi-line templates create a template page.
-
target=PageName - Fox will post to page PageName instead of the current page. GroupName.PageName is allowed too. If a list of page names is given Fox will post to each page, using a corresponding template. See below.
-
foxtemplate="String" - Fox will use template String.
-
uptarget=PageName and upload=1 - input from a file input box (or several) will be used to upload file(s) to target page. See Upload Files input form
-
redirect=PageName and redirect=1 - After posting Fox will redirect to page PageName. The default is to stay on the current page.
redirect=1 will redirect to targetpage, or last in list. redirect=URL will redirect to url string given. Note that you can specify also an anchor to redirect to a page section, and url arguments, if you want to pass on arguments or open a page with a certain action.
-
cancelredirect=PageName - When using a Cancel button (a submit button with 'cancel' instead of 'post' as the control name) Fox will redirect to PageName. All options of redirect= apply to cancelredirect as well.
-
foxfilter=filter1,filter2,filter3,.. - tells Fox to apply custom filters for preprocessing field values See below.
-
foxfields=name1,name2,name3,.. - can be used to tell Fox which fields may possibly be not set and empty, as happens when using checkboxes. Can also be used as
(:input hidden foxfields name1,name2 :).
-
formcheck=name1,name2,name3,.. - will enable javascript checking if any of the fields named are empty, display a warning message and prevent posting till fields have values.
-
keepinput=1 or keepinput=name1,name2,.. - After successful posting all input values or values of named fields will be redisplayed in the fields. Default is that entered values will be cleared from all fields if the post was successful. If the posting was aborted values will be redisplayed.
-
pagecheck=1 - Fox will not post if target page exists.
-
pagecheck=PageName1,PageName2,.. - Fox will not post if any of the named pages exist.
-
foxcheckmsg=String - Message displayed with markup
(:foxmessages:) after an input error raised by (:foxcheck ...:) markup. Default is an error message set by config variable $FoxCheckErrorMsg = 'Please enter valid input!';
-
foxsuccess=String - Message displayed with markup
(:foxmessages:) after successful posting. The target pagename can be added by using a replacement variable like {$$target} or as a link using [[{$$target}(?action=browse)]].
-
foxfailure=String - Message displayed with markup
(:foxmessages:) after failed posting. The target pagename can be added as for foxsuccess above.
Parameters for adding and updating PTVs :
-
ptvtarget=PageName - Fox will replace the value for any PTV on page PageName for which it has an input value from a field with the PTV name. If you need to restrict the PTV update to certain named PTVs, use the next parameter as well. See also Adding and Updating PTVs below.
-
ptvfields=name1,name2,name3,.. - If this is given Fox will only replace values for the PTVs named. ptvtarget=PageName needs to be specified as well.
-
ptvfmt=text or deflist, or section - Sets format of PTVs for adding new PTVs specified with ptvfields. Default is hidden PTV.
-
ptvclear=name1,name2,name3,.. - On form submission any named fields which are empty (with no value, but not 0) will clear the corresponding PTVs (erasing their values). This option allows empty input on specific input fields. Normally empty input will be ignored, and in order to clear a PTV a special keyword needs to be used. This is defined with variable $FoxClearPTVFmt and defaults to the keyword NULL: input of NULL will clear a PTV.
-
ptvclear=1 - as above, but effective for all input fields saving to PTVs.
-
ptvupdate=1 - Fox will use target page(s) given for ptvtargets, and update PTVs on the target page corresponding to input field names if the page exists, otherwise use a template supplied to create the page. ptvtarget= does not need to be specified.
Using Input controls top
Fox works fine with the standard PmWiki (:input type name .... :) controls. Standard input as well as array input can be processed. The name of the input control can be used as a replacement variable {$$name} in the template and in other form fields as value. When using controls for multiple selection or multiple inputs, for instance with (:input select ... :), use name[] in the form and {$$name[]} in the template to create an input array.
There are other special considerations to be made:
- As an enhancement to security the submit button needs to be named post.
- If you want to prevent the posting of empty multi-line textarea fields, name the control text.
- Do not use template as name for an input control.
- target and newedit are reserved names for target pagenames. An input text box can be used to set a pagename value. If this control is named target, Fox will post to the pagename entered, if the control name is newedit, Fox will open the target page in edit mode.
- foxgroup is a reserved name for a target group. A GroupName for the target page can be specified using an input control of name foxgroup, for instance a
(:input text foxgroup:) or (:input select foxgroup GROUP1:) etc.
- Error messages can be displayed by putting markup
(:foxmessage:) into the page, best just above the Fox form (recommended, as often page posting permissions are not set properly). See also use with Input Validation
- To retain input values after posting use keepinput=1 as parameter. Use keepinput=name1,name2,name3 etc. to keep the input values for fields name1, name2, name3 etc.
Upload Files input control
(:input file upfile size=60:) can be used for uploading (attaching) files. upfile in this example is the name of the control. One or several (with different names) can be used inside a fox form, in addition to other input controls. Fox will do the usual posting plus the file upload on form submission. In the (:fox formname ...:) markup either upload=1 or uptarget=TargetPageName needs to be set.
- upload=1 will direct upload attached to current page or target page set with target=PageName.
- uptarget=TargetPageName will attach upload file(s) to the page specified. Only one upload target can be specified.
To optionally rename the file use a text input box like (:input text upfile_name :) for instance. Note that it's upfile_name corresponds to the input file box name of upfile, the new name box needs to use the file box name with an added _name postfix.
The following replacement variables can be used in the template to post file attributes file name, file extension, file type and file size, or to use for input validation in (:foxcheck ...:) markup. upfile is the name of the input file control, i.e (:input file upfile:). Change it for different file controls.
{$$upfile_name} holds the file name.
{$$upfile_ext} holds the file extension.
{$$upfile_type} holds the file type.
{$$upfile_size} holds the filesize in bytes.
Upload Security: In order to successfully upload files the user needs PmWiki upload authorisation. $FoxAuth is not used.
Fox has two levels for input checking, simple client-side javascript and server-side php:
-
(:fox formname ... formcheck=name1,name2..:) - a simple client-side (instant) java script check to alert if a named input field is left empty. This is only effective if user has a javascript enabled browser. A more effective method is the following php validation.
(:foxcheck name ... :)
-
(:foxcheck name [match='STRING'] [regex='PATTERN'] [if='CONDITION'] [msg='ERROR MSG']:) - PHP input validation check on input from field name. You can also use a list of names; name1,name2,.. etc.
Parameters:
- name is the first argument. Or name=name1,name2,.. - There need to be input from named fields. If a named field is left empty the check fails. If the field is named by
name=$:Var, use as name ptv_Var.
- match is the second argument. Or use match='STRING'. Input has to match STRING. Wiki wildcard characters are allowed.
- regex='pattern' - Input has to match regex pattern. Use this to create more precise pattern masks than match.
- if='condition' - Input has to fulfill condition. Conditions for use are the same as with the
(:if ...:) conditional markup.
- msg='error message' - If the input check fails error message will be displayed using
(:foxmessage ..:) markup. If msg is not set a default error message will be used instead.
(:foxmessage ... :)
-
(:foxmessage [formname] [name] [list=nocheck]:) - Markup to display Fox error and success messages. Output is inline text and can by styled with wiki markup, for instance like
%red%'''(:foxmessage:)''' giving a red bold message.
Usage:
(:foxmessage:) will display all Fox messages.
(:foxmessage formname:) will display all Fox messages resulting from submission of form formname.
(:foxmessage formname list=nocheck:) will display Fox messages from form formname but exclude all messages resulting from input checks set with (:foxcheck name ..:).
(:foxmessage formname list=check:) will display messages resulting from input checks set with (:foxcheck name ..:), but exclude all other messages.
(:foxmessage formname name:) will display fox error message resulting from input check set with (:foxcheck name ..:). Use this markup for instance beside each input field, to give field specific error messages right next to the field causing the error.
- If the field to be checked is named by
name=$:Var (for PTVs when using (:input default source ....:)), use as name ptv_Var.
Using page variables top
You can use page and page text variables normally. You can also use them in templates. Fox provides some special page variables:
{$FoxPostCount} will give counted number of posts on the page (use for displaying total number of posts).
{$AccessCode} will give a three digit random number, which Fox can check against an entry in a field named access, to require users entering a random code, as a measure against robot postings. To have fox checking for a match of accesscode and access-post, the admin needs to set $EnableAccessCode to true.
Template Markup top
Any content on the template page will become part of the new page entry. PmWiki page variables are allowed. Special replacement variables are used to mark where content from input fields are placed.
-
{$$name} - is replaced by the value of the form input field named name
-
{$$name[]} - is replaced by the array values of the form input fields named name[]
-
{$$(expr ... )} - Markup expressions with this syntax (two $ dollar signs after the initial curly bracket ) are evaluated when the template gets processed.
-
{$$(ftime 'format' 'when')} - is replaced with a formatted date or time string, using MarkupExpressions#ftime (this utilises the PHP strftime function). The
{$$(strftime:format)} markup is deprecated. Example for a timestamp: {$$(ftime "%A %d %B %Y %H:%M:%S")}
-
{$$(date:format)} - is replaced with a formatted date or time string, according to the PHP date function. Example:
{$${date:d.m.Y - H:i)}
-
\n - is converted into a new line.
-
{$$foxgrouptitle} - this is created early and takes the value from a foxgroup field or parameter. It is for use where special characters and spaces may want to be preserved, as
{$$foxgroup} will be replaced by a sanitised WikiWord valid for full pagenames. Use for instance to create a target group link: [[{$foxgroup}/| {$$foxgrouptitle}]]
To post replacement variables without them being replaced by a value, in order for instance to post a fox form defined as a template, use {$$$...} instead of {$$...}, i.e. {$$$name} instead of {$$name} etc.
delete links and buttons template markup
Install foxdelete.phpΔ and use the following template markup to generate delete links and buttons for deleting single lines or ranges.
-
{[foxdelline]} - is replaced by a delete link which can be used to delete the line it is part of.
-
{[foxdelline button]} - is replaced by a delete button for deleting a single line, as the link above.
-
{[foxdelrange]} - is replaced by a delete link which can be used to delete a range of lines, marked with special
#foxbegin# and #foxend# markers. Any lines between these invisible markers, including a range delte link or button, will be deleted by clicking the link or button
-
{[foxdelrange button]} - is replaced by a delete button for deleting a range of lines, as the link above.
- Delete link label and tooltip
- a custom delete label for link or button can be specified inside the markup like for instance:
{[foxdelrange 'Delete Post']} : Delete Post will be the label for new delete links.
{[foxdelrange label='Delete Post' tooltip='delete section: abc']}: delete link with added tooltip.
Config Security Settings top
An admin can set a number of variables to control some posting permissions, as local configurations, sitewide in config.php or restricted to groups or pages. All fox configuration variables need to be set before including the fox.php script. Do not use local/Group.php or local/group/Name.php files for setting configuration variables, if you use include_once(.....fox.php...) in config.php, as such customisation files will only be loaded after config.php! Use conditionals in config.php instead. See the example below.
-
$FoxAuth = 'edit'; - By default users with edit permission are allowed to post. Set
$FoxAuth = 'read'; to open posting to pages which are edit protected. Set $FoxAuth = 'ALWAYS'; to allow posting even to pages which are read protected (private pages). Consider setting $FoxAuth to the right level for just the pages you need, using conditionals in config.php, before including fox.php.
-
$EnablePostDirectives = false; - By default users are not allowed to post directives of form
(:...:). Set $EnablePostDirectives = true; to allow posting of directives.
-
$EnableFoxUrlInput = false; - By default input via url parameters is not permitted. Setting it to 'true' will allow such input.
-
$EnableAccessCode = false; - By default a special random generated access code is not required. Set
$EnableAccessCode = true; to require use of access code. You need to provide also a hidden accesscode field and a text field named access for a user to enter the access code displayed, via a page variable {$AccessCode}.
-
$EnableFoxDeleteMsg = false; - Set to true if you want a delete confirmation message displayed when clicking any delete links or buttons. If desired, change $FoxDeleteMsg, the default confirmation message, which is:
$FoxDeleteMsg = 'Please confirm: Do you want to delete this post?';
-
$FoxPagePermissions['namepattern'] = 'action'; - This is an array of page name patterns and allowed or disallowed Fox actions. By default it is prohibited to post to any pages in the Site and SiteAdmin groups and in the PmWiki group. The admin needs to add patterns and associated actions in order for Fox to be permitted posting or deleting posts etc. Page name patterns can be added to
SiteAdmin.FoxConfig (you need to create this page, see example below) or to a local config file (for instance config.php) using
$FoxPagePermissions['namepattern'] = "actionname,actionname,..";. Action names are
add,
replace,
copy,
newedit,
delete,
mail,
all,
none.
all meaning all Fox actions are allowed,
none meaning no Fox actions are allowed. See examples in box below.
It is also allowed to post to the page which contains the form (current page) and to other pages if certain string patterns are present in the page. Fox looks for strings (:foxprepend, (:foxappend or (:foxallow and for (:fox formname .
-
$FoxConfigPageFmt = '$SiteAdminGroup.FoxConfig'; - Default page for page permission patterns (you need to create it if you want it, alternatively add to the
FoxPagePermissions array). Add each patterns on a new line, like Test.*: add,delete (this will allow posting and deleting of posts (via Fox delete links) to any page in the Test group). These patterns are read as part of $FoxPagePermissions.
Configuration example for config.php:
# allow comment posting for all visitors in group 'Public'
$group = PageVar($pagename, '$Group');
if ($group=='Public') {
$FoxAuth = 'read';
$FoxPagePermissions['Public.*'] = 'add';
}
# allow all foxactions on all pages for admin
# (Site and SiteAdmin groups remain excluded)
if (CondAuth($pagename,'admin')) {
$EnableFoxUrlInput = 'true';
$FoxPagePermissions['*.*'] = 'all';
}
Page permission example using SiteAdmin.FoxConfig:
# allow adding or deleting posts for pages in Test group:
Test.*: add,delete
# allow adding but deny deleting posts for pages in Data group:
Data.*: add,-delete
# Deny any Fox actions in Main group:
Main.*: none
# Allow all actions on all pages (if you can trust all editors)
*.*: all
Field Substitutions top
Values from various fields can be combined in another field. For instance the target page name can be created with input from a number of input controls:
(:input hidden target "{$$name}-{$$surname}":)
Name: (:input text name "":)
Surname (:input text surname "":)
Fox Filter Functions (for developers) top
You can preprocess (filter) the posted field values using custom filters. A recipe script can define its own filter function and add it to the $FoxFilterFunctions array like this:
$FoxFilterFunctions['mycustomfilter'] = 'MyCustomFilterFunction';
function MyCustomFilterFunction($pagename, $fields) {
...process any field values here....
return $fields;
}
Then a Fox form can call the filter function with parameter foxfilter=mycustomfilter or as a hidden input control of form (:input hidden foxfilter mycustomfilter :)
Fox will use a series of filters in the specified order if several filter function names are given, like
foxfilter="filterA,filterB,filterC"
You can find use of foxfilters in FoxForum.
Additional examples of filters can be found in Fox-FilterExamples
Multiple Target Pages top
If a list of page names is supplied Fox will post to each page, using a corresponding template page.
Use either this syntax:
(:fox formname ... target=TargetPage1,TargetPage2,TargetPage3
template=TemplatePage1,TemplatePage2,TemplatePage3:)
etc.
or for more flexibility use special markup (:foxadd ...:), (:foxptv ...:), (:foxreplace ... :) and (:foxcopy .... :), for example:
(:fox formname :)
(:foxadd TemplatePage1=>TargetPage1 ...parameters... :)
(:foxadd template=TemplatePage target=TargetPage ...parameters... :)
(:foxadd TemplatePage3=>TargetPage3 ...parameters.. :)
(:foxptv PTVTarget1,Target2,Target3 ..ptv parameters...:)
(:foxreplace TemplatePage3=>TargetPage3 ...parameters.. :)
(:foxcopy TemplatePage1=>TargetPage1 TemplatePage2=>TargetPage2 .... :)
....other input controls and submit button...
(:foxend formname:)
Specify either a TemplatePage=>TargetPage pair (or several), or template=TemplatePage target=TargetPage parameters.
- foxcopy will not process any replacement variables, just copy the page without change.
- You can use full page names:
Group.Template=>GroupA.TargetA, and use a template section:
Template#section=>GroupA.TargetA and a section on a target page: target=TargetPage#section.
(:foxptv ...:) does not use or require a template parameter.
- If the
foxgroup=TargetGroup parameter is used to define a target group, do not use group names for your target pages. Otherwise they will become part of the name!
- If you use foxgroup and need some page target to be in a different target group, you can use a \backslash to "escape" the merging of the group part with the name:
TemplatePage=\GroupB.TargetPage
Fox generates a list of template and target pairs, processing any (:foxadd ... :), (:foxptv ...:), (:foxreplace ... :) and (:foxcopy ... :) markup first, as found in sequence, and assigns actions and placements and parameters to each, using defaults if necessary. If no parameter is given, Fox will use the previous one used in the markup.
If redirect=1 is set, Fox will, after posting to all the pages, redirect to the last target page. To redirect to another page use redirect=PageName.
By setting several target-template pairs Fox can post different field values to different pages. Field substitutions will be applied generally.
To see behind the scenes how Fox assigns parameters to targets and in what order targets are processed you can set temporarily in fox.php near the beginning: $FoxDebug = 3;
On form submission Fox will echo the target array. Make sure you don't use redirect= though!
Fox can add content and also update PTVs on a target page. Content will be added first, PTVs updated last in Fox's processing.
By using the parameter ptvtarget=PageName Fox will update any PTV on page PageName with new input from an input field with the name of the PTV. Fox will update all PTVs it finds matching input field names. It will use whatever format the PTVs got, just replacing the values. It will not create new PTVs automatically, unless the ptvfields= parameter is used, specifying target PTVs.
Using parameter ptvfields=name1,name2,name3,.. will restrict the PTV update to the named PTVs. If the target page has not got a PTV named with ptvfields, it will be created as a hidden PTV.
Using parameter ptvfmt=keyword will create PTVs named with ptvfields and not existing in the target page according to the keyword format:
-
ptvfmt=text - text list format, as used in the recipeinfo section. Syntax is Name: Value, starting on a new line.
-
ptvfmt=deflist - definition list format, syntax is : Name : Value , starting on a new line.
-
ptvfmt=section - anchored section format, syntax is ''
[[#name]] multi line value... [[#nameend]]
-
ptvfmt=hidden - (default, no need to specify this) hidden PTV format with syntax
(:Name: Value:)
-
ptvfmt=extra - custom hidden PTV format defined in foxforum.php with syntax
(::Name: Value::)
By default if a field is empty when the form gets submitted, Fox will ignore this field and will not clear any existing value of a PTV with the field name. Instead to clear a PTV you need to input a special string defined with config variable $FoxClearPTVFmt, which is by default NULL. This default behaviour can be changed with the ptvclear parameter:
-
ptvclear=1 - any empty field when submitted will clear a corresponding PTV.
-
ptvclear=name1,name2,name3,.. - any empty field named will clear the corresponding PTV.
To add or update PTVs on more than one target page,
- either provide a target page list for ptvtarget: ptvtarget=Target1,Target2,Target3 etc. Any ptv parmeters given will be applied to processing for all target pages.
- or use one or several markups
(:foxptv Target options...:). Any ptv parameters used in each markup will be applied for the specific Target page process.
Parameter ptvupdate=1 used in the (:fox formname ..:) markup is for special cases to avoid duplicating target and ptvtarget parameters: With target=PageName template=Template ptvupdate=1 a new page can be created according to the template provided, with PTVs being created through the template and input values. But if such a form submits again to the same page, the template will be ignored and only existing PTVs will be updated. No new PTVs will be added.
Adding a 'Preview' top
Fox output can be previewed by adding a 'Preview' button to the form, plus a (:foxpreview:) markup to display the preview:
-
(:input submit preview 'Preview':) - Add a submit button with exact name preview and button label 'Preview' (substitute text of your choice).
-
(:foxpreview:) or (:foxdisplay:) - Add directive at the place in the page where you would like the preview to be shown.
-
(:if foxpreview:) - Optional - conditional markup to show text only when 'Preview' is clicked.
-
(:foxpreviewtemplate "...":) - Optional - Alternative template markup used for the preview instead of the standard
(:foxtemplate "....":) or other template page.
-
previewtemplate=PAGENAME - Optional - Alternative template parameter used for preview instead of template=... parameter.
Fox is also specially configured to work in conjunction with FoxEdit links, so FoxEdit forms can use a 'Preview' button.
Custom conditional author
Note that I am using also a custom conditional in some templates in my examples, to check an author name against an author field value previously set. It is defined like this in config.php:
# add conditional markup: (:if author AUTHORNAME:)
->$Conditions['author'] = "\$GLOBALS['Author']==\$condparm";
Hide Delete Links with Conditonal Markup
Adding a delete link to the template like this
(:if author {$$author}{[foxdelrange]}(:if:)
will display the link only if the author name entered or previously entered and stored in the author cookie matches a value for author set previously in an author field. - This is not a foolproof secure method to prevent deletions of posts since someone else can use the same author name! The only safe way is to use (:if auth admin:){[foxdelrange]}(:if:) if $FoxAuth level is set to 'read', and to prevent viewing of th epage source by adding to the local config:
$HandleAuth['source'] = 'edit';
which then requires edit permission to view the source.
Or set it to 'admin' if you can't trust editors.
More on Security Considerations
If you add any line or range delete buttons or links in a template, Fox will generate special linekeys, made up of a timestamp and a random number element, to provide unique identifiers for each range of lines, or each line carrying a line delete link or button. Clicking a delete button or link will send the unique linekey attached to it, and Fox will look for the line or range of lines and delete it. I have used conditional markup in my examples to hide all delete links not associated with the author name. And generally I have not been able to delete any posts, if I could not see a delete link or button (and the opposite I find to be true: if a user sees delete links he/she can delete posts). But I am not sure how secure this is. It may be advisable to prevent action=source for users without edit permission, since the pmwiki source will carry all the linekeys. I am curious about other people's experiences regards the delete action, so I can revise it as necessary.
In any case all page modifications are recorded in the page history, and changes to a page are appearing in RecentChanges pages.
Extensions top
- FoxDelete - add delete links
- FoxEdit - add edit links to edit page sections and single or sets of PTVs
- Fox Notify - add email notification capability to Fox forms
Example Applications top
See also some example applications explained:
Release Notes top
- 2008-11-26: improved handling of foxsuccess and foxfailure parameters.
- 2008-11-11: fixed bug which did not save page attributes when using foxcopy.
- 2008-09-17: added name=formname to the fox <form ... > tag generated by
(:fox formname ...:) markup.
- 2008-09-10: fix to target list (added 'sort') to prevent erronous no-target! error from some forms.
- 2008-09-09: fixed bug in ptv updating. Fixed preview bug.
- 2008-07-19: changed decoding of HTML entities because of problems with php4 systems.
- 2008-07-15a: Fixed bug which brought up wrong edit form when foxcheck and on form page. Rewrote code to check for page load after foxedit call.
- 2008-07-15: Corrected a number of bugs introduced inadvertently with yesterdays version, which mainly broke preview.
- 2008-07-14: Added handling of validation errors from foxedit forms. Trimmed adding new lines at anchor ptv section.
- 2008-07-11: Fixed bug in preventing posting of directives introduced in previous release.
- 2008-07-04: Modified initial security check to allow preview without having to enter captcha or accesscode. Added modified InputDefault function to accomodate input controls with names as array elements (see PITS.01032).
- 2008-07-03: Added 'Preview' capability, in coordination with latest foxedit.php.
- 2008-06-16: Fixed bug which prevented page update when there was a ptv update on the same page.
- 2008-05-19: Added foxnotify input check, eliminating the need to set a foxfilter FoxNotify when using FoxNotify. Restricted 'mail' target pages (FoxNotify list pages) to FoxNotifyListsGroup, for safer management.
- 2008-05-17: Added markup
(:foxmail template=EMailTemplate target=EMailTargetList :) for use with FoxNotify
- 2008-05-07a: Fixed broken javascript formcheck
- 2008-05-07: Changed security check to occur after cancel check, so a 'Cancel' can work without need of 'Captcha' etc entry. Changed htmlspecialchars_decode back to html_entity_decode, to please php 4 users.
- 2008-05-06: Improved redirect and cancelredirect options. Both can redirect to a page section (anchor), and can use a full url string, or a page name. Removed the safety feature that input from an input control named 'text' cannot be empty. Use
(:foxcheck text:) to add this feature to a form, for instance to prevent posting of empty messages. Reason to remove this is chiefly to allow foxedit forms to submit empty text for deleting existing text.
- 2008-05-01: Fixed bugs in line break processing. Fixed input from foxtemplate (add html_entity_decode). Fixed error processing for foxaction add (stopped erronous additions).
- 2008-04-28: Fixed bug in processing ptvclear parameter.
- 2008-04-24: Fixed insertion of extra line with put=top.
- 2008-04-20: Added target=#section option to post to #section on current page. Fixed extra empty line at page bottom. Deprecated
{$$(strftime:...)}.
- 2008-04-19: Reversed fixes from previous update, because they caused more problems elsewhere. Redone fix for foxdelete link crippling. Fixed issue with section edit/section loading. Added trimming of spurious new lines.
- 2008-04-18: Fixed bug which crippled foxdelete links if posted again. Fixed bug in handling html special characters. Added extra XSS input security measure.
- 2008-04-01: Added $FoxCheckErrorMsg variable and foxcheckmsg='input error string' option. Added
{uploadfile_ext} to capture the upload file extension. Can be used by foxcheck to validate proper file extension input.
- 2008-03-31: Added arguments from file input as
{$$uploadfile_type} variables.
- 2008-03-29: Added option to upload files via input file control. Fixed check if target exists when ptvupdate=1 causing duplication of posts.
- 2008-03-26: Fixed bug in redirect when foxgroup is specified.
- 2008-03-25: Added removal of CR character from input. Added foxtemplate= parameter. Added list=check option to
(:foxmessage:) markup. Changed input variable replacing to replace array input with comma separated list of array elements. Changed Abort behaviour on errors during add/replace: error message will be shown, but processing of pages continues. Changed bug in function FoxVarRepRecursive which triggered Abort on exceeding max iterations too early.
- 2008-03-18: Fixed error warning caused by foxcheck and user required to log in. Fixed posting to current page if no target specified, but template given.
- 2008-03-16: Changed handling of $FoxAuth so customisations applied after fox.php is included will be honoured. Removed delete messages from fox.php and put them into foxdelete.phpΔ. Please update also FoxDelete.
- 2008-03-15: Removed forced inclusion of target name in foxsuccess='Message String' and focfailure='Message String' messages (can be done with replacement variables instead).
- 2008-03-11: Code review: fixed many 'Notice missing index' etc. errors.
- 2008-03-10a: Modifications to function FoxTemplateVarReplace, which fixes Apache crashes/reloads reported on some systems running Apache 2 and php 5.
- 2008-03-10: Changed function FoxTemplateVarReplace to not use php 'create_function', but a distinct function instead.
- 2008-03-08: Fixed bug which destroyed the page history (introduced in 2008-02-22).
- 2008-03-07a: Fixed bug in variable replacements which added empty vars as code (introduced in 2008-03-01).
- 2008-03-07: Fixed bug which displayed form validaion error on Cancel action.
- 2008-03-06b: Fixed bug in selective display of fox messages.
- 2008-03-06a: Improved keeping and discarding of input values. Added parameter keepinput= to keep selected or all input values after successful posting.
- 2008-03-06: Added input validation set with
(:foxcheck fieldname ...:). Added individualised (:foxmessage ...:). Changed message output from using (:messages:) to using (:foxmessage:). Abort error messages will continue to output to (:messages:) as well.
- 2008-03-03: Fixed a bug in parameter assignments for multiple targets. Improved target assignments. Fixed potential error situations for bad target assignments. Having no target assigned (due to a markup expression evaluation for instance) will no longer lead to disruptive errors.
- 2008-03-02: SECURITY UPDATE. Changed default location for FoxConfig page from $Site group to $SiteAdmin group. Added parameter cancelredirect=PageName. Fixed bug in assigning parameters for multiple targets.
- 2008-03-01: Reworked functions FoxTargetList and FoxTargetDefaults and target array process, adding multi-page PTV add&update for processing ptvtargets with ptv parameters set per target. Added
(:foxptv ..:) markup. Added var $EnableFoxPTVDelete (default is false) to allow PTV deletion by saving a keyword to the PTV. Keyword is 'ERASEPTV', set with new var $FoxPTVDeleteKey. Fixed bug which prevented posting to the form page without need to set special page permission.
- 2008-02-22: Enhanced PTV Add & Update. Added addition of new PTVs if PTVs do not exists on target page but are specified with the ptvfields parameter. Added ptvfmt option. Added
$FoxClearPTVFmt variable. Added ptvclear= option. Added conversion of array input for PTV fields to comma separated values. Added {$FoxVersion} page variable. Fixed bug which made it possible that text from the previous page processing got used if target had no text.
- 2008-02-16: Corrected erroneous introduction of a php5 function with last update, which broke Fox on php4 systems.
- 2008-02-15a: Fixed bug preventing target opening in normal edit mode (option 'newedit'). Modified process if no target is specified. Added message options 'foxsuccess' and 'foxfailure'. Improved FoxDefuseMarkup process. Removed some redundant code.
- 2008-02-15: SECURITY UPDATE Added config var $EnableFoxUrlInput. Default is 'false'. Setting it to 'true' will enable input for Fox from url parameters with action=foxpost. Fixed addition of extra new lines when PTV updating.
- 2008-02-14: Added option ptvupdate=1. Fixed bug in ptvtarget allocation. Fixed PtvUpdate to use FoxDefuseMarkup when
$EnablePostDirectives = false;.
- 2008-02-13a: Added function FoxDefuseMarkup for handling of posted markup directives and expressions when
$EnablePostDirectives = false; (the default): directives and expressions will be rendered as code. Special care is taken if the markup is surrounded by escape markup (to show code).
- 2008-02-13: Removed code added with last update which deals with
TargetPage..#section syntax, as it is not legitimate syntax (my misconception, thanks Petko!).
- 2008-02-12: Fixed bug in handling additions of newlines for various put options. Improved placing of post in section targets. Modified foxdisplay markup to take formname as an argument, so display can be directed to a specific location, if several are needed. Stripped enclosing
<p> tags from output for foxdisplay so output can appear inline. Added :) to be replaced with HTML charcters when $EnablePostDirectives = false; (default), to prevent accidentally closing a PTV when updating PTVs.
- 2008-02-09: Fixed bug in missing template handling (Fox will abort now if template page specified does not exist). Improved missing template error messages.
- 2008-02-07: Modification to which of the EditFunctions Fox uses, using now standard functions except some which are not needed.
- 2008-02-05: Small change: for foxaction=display to display on current page with no target parameter being set.
- 2008-01-29: Adjusted urlfmt for redirect to target page.
- 2008-01-26: Corrected redirection bug fix, so redirection to current page will work for 'Cancel'.
- 2008-01-25: Added markup
(:foxdisplay:) and foxaction=display. Using foxaction=display will direct the output to the (:foxdisplay:) markup, and will not be written into a page. Fixed bug in final page redirecting.
- 2008-01-22: Added handling of $ChangeSummary, so any value from an input field named 'csum' will be written into the page attributes and be available for the page history.
- 2008-01-16: Added redirection handling for cancel button of form
(:input submit cancel Cancel:)
- 2008-01-12a: Added missing array_walk_recursive() function for php4 usage. Deleted some debug echo statements.
- 2008-01-12: Added to PTV updating the ability to prevent posting of directives of form
(:... :), if $EnablePostDirectives = false; (which is the default).
- 2008-01-09: Major Upgrade. Major script rewrite. Added 'replace' foxaction. Removed foxdelete link markup, this needs to be installed separately, download foxdelete.phpΔ (see FoxDelete), like FoxEdit. Fox can now handle true multipage actions.
Because this is a major upgrade, the previous version can still be downloaded as fox-1.phpΔ.
- 2007-12-22: Fixed bug in foxdelete links and buttons introduced with previous attempt to fix.
- 2007-12-20: Fixed bug in foxdelete links, which may have given wrong links when using standard (not clean) URLs.
- 2007-12-07: Fixed bug which prevented Fox functioning with normal ?n=pagename urls. Reverted allowed input back to form input ($_POST).
- 2007-12-03: Undone the last change: removed htmlspecialcharacter encoding. But left intact the new function FoxRequireArgs, which will both get POST and GET input.
- 2007-12-01: Added htmlspecialcharacter encoding for all input as precautionary security measure.
- 2007-11-27: Added Blocklist support, so all posts can be checked by Blocklist (if enabled), without extra configurations.
- 2007-11-19: Added pre-processing of fields with ptv_ prefix, to strip the prefix. This makes Fox capable to process fields which are named as a PTV, and in conjunction with add-on FoxEdit (which provides edit link markup and calls an edit form) edit forms can be designed and processed which can handle specific sets of PTVs for editing. Update to fox.css to add foxeditlink class.
- 2007-11-13a: Changed order of field substitutions to process markup expressions last.
- 2007-11-13: Added processing of markup expressions when posted as field values in form
{$$(expr ... )}. Added {$$(timestamp)} replacement variable, which when used in a template will output the Unix timestamp of the posting time. Subsequently such timestamps could be handled via display templates using {(ftime ...)}.
- 2007-11-11: Fixed bug in handling templates with ptv targets.
- 2007-11-03: Fixed bugs in handling some process cases introduced with foxcopy and foxpost v.20007-11-02.
- 2007-11-02a: Fixed bug when loading fox.css (it produced one invalid HTML Header entry).
- 2007-11-02: Added markup
(:foxcopy args:) and (:foxpost args :) for passing on multiple TemplatePage=TargetPage pairs. Fox can now process both page copy and page addition for multiple pages in one go. The parameters target= and template= etc stay valid. The {$$foxgroup} parameter will be replaced early with a valid WikiWord name, and a {$$foxgrouptitle} created which preserves any original special input characters and spaces.
- 2007-10-30: Added call to Lock() to FoxAddEntry function, to prevent file write conflicts.
- 2007-10-28: Added PTV update (replacement) to fox.php, so calling FoxPTVReplace filter is no longer needed. Revised code: Integrated page targets for PTV update with the other page targets. Improved handling of array inputs. Changed default location for fox.php to cookbook/fox/, so all fox depended files can go into one directory. Added a file search for handling loading of fox.css to check locations in pub/ or a farm pub/ directory.
- 2007-10-25: Improved template handling. Fox can now extract template sections from pages with multiple templates marked with anchors. Added $FoxTemplatePageFmt for page with lists of common templates. Changed order of template allocation: for multiple targets the last template is used if no corresponding template is given (it was the first). Added $FoxDeleteSummaryMsg to supply a messag used as summary in RecentChanges, default is: 'Post deleted'.
- 2007-10-21: Fixed bug with stripmagic(). Arrays as input values are now preserved, and normal values are processed with stripmagic, to preserve quotes etc in input fields when page reloads on errors.
- 2007-10-15: Reintroduced stripmagic() for input values.
- 2007-10-15: slight code tidy up
- 2007-09-29a: Fixed bug in handling multiple target=>templates parameters introduced by changes in 2007-09-24
- 2007-09-29: Changes to template engine to allow posting of fox forms and templates:
{$$$...} will be posted as {$$...}
- 2007-09-24: Changes to template engine to properly process input arrays (
name[] as name in input form, {$$name[]} as replacement variable in template).
- 2007-08-29: Added
$SiteAdminGroup.* to prohibited targets.
- 2007-06-03: Added support for Captcha recipe (as alternative to EnableAccessCode).
- 2007-05-24: Added option to specify custom delete link or button label. Fixed bug in delete confirmation.
- 2007-05-06: Fixed action for delete buttons and links. Fixed markup and delete code for delete buttons.
- 2007-05-05: Discontinued $FoxNameFmt. Replaced with $FoxPagePermissions. New syntax for setting page permissions for Fox postings and other Fox actions.
- 2007-05-02: Removed current page and current group posting permission from $FoxNameFmt because of possible misuse. Added string check for posting permission, checking for presence of ":fox formname" or ":foxprepend" or ":foxappend" in the target page. Otherwise page permissions can be added to $FoxNameFmt, or to a new Site.FoxConfig page. Fixed a bug in handling
{$$var} in foxtemplate string. Fixed form action=PageUrl. Fixed handling of (:foxtemplate "":), added template=0 option for use with new empty page creation.
- 2007-04-21: Changed default FoxAuth level to 'edit'. Removed options for foxfilter=1 and foxfilter=all.
- 2007-04-13: Removed breakpage support. This is handled now with a filter function and special markup (included in foxforum.zipΔ). Removed support for automatic FoxCount variable. This is handled now with a FoxCount PTV and a FoxPTV filter function (also in foxforum.php). Removed automatic insertion of id anchors. These need to be inserted now in the template (also in foxforum template pages).
- 2007-04-11: Took out styles from fox.php and added pub/fox.css for style support. Fox is now bundled in a zip file.
- 2007-04-08: Added foxcopy parameter for straight page copying, without template var substitutions. Simplified fox form markup. Change to FoxFilter function hook. A filter function needs $pagename and fields as parameters.
- 2007-04-06: Improved pagecheck.
- 2007-04-05: Removed stripmagic to preserve backslashes.
- 2007-04-05: Added option pagecheck to prohibit posting to existing pages. Added $MessageFmt support and a FoxAbort function for exits and return to the page with a friendly error message. To show it, markup
(:messages:) needs to be included in the page.
- 2007-04-03a: New date and strftime substitution syntax:
{$$(date ..)} {$$(strftime ..)}. This is to avoid clashes with future function markup and other markup using braces. Apologies to twice changing this!
- 2007-04-03: Major update: This update requires all templates and forms to be modified. Change from
{var} to {$$var} syntax to avoid conflicts with other markup using braces, and in line with a proposed future PmWiki core substitution variable syntax. Change to {date: ...} and {strftime: ...} syntax. Better replacement pattern for Fox's core engine.
- 2007-04-01: Added javascript field validation checking empty fields declared with formcheck=
- 2007-03-31b: Fixed bug in foxgroup targetname creation.
- 2007-03-31a: Fixed bugs in template handling and in target naming for mixed cases of target= and newedit=.
- 2007-03-31: Added ability to post to multiple pages, using multiple templates. Tidied up field replacements. Restructured code functions. Added redirect=PageName to redirect to specific page.
- 2007-03-28a: Fixed form action of fox form to use
$ScriptUrl.
- 2007-03-28: Changed field replacements so empty fields may not be replaced by {fieldname}. Added foxfields as optional parameter or (hidden) field to tell Fox to check any field names which may be empty. This is important when using checkbox controls. Made markup
(:foxtemplate ..:) more liberal allowing spaces and allowing not using " " around template string.
- 2007-03-26: Added hook for $FoxFilterFunctions for external preprocessing of field values. Added preservation of non-fieldname {var} items (like smileys). Restructured code into more functions. Changed 'newedit' handling to get the processed new page template into the edit window, instead of the raw template.
- 2007-03-22: Added field substitution. Values from different input fields can be combined now. Thanks Feral!
- 2007-03-13a: Important security update, to fix security issues since pmwiki 2.2.0 beta32 broke $FoxNameFmt.
- 2007-03-13: Removed some code which was not needed but seemed to cause problems for some.
- 2007-03-10: Added 'foxgroup' for optional input field for target group, to be able to specify target name and group separately.
- 2006-12-26: Fixed bug in #top and #bottom posting. Fixed bug in page history.
- 2006-12-20: Improved delete pattern matching
- 2006-12-19a: Bugfix which prevented page history creation
- 2006-12-19: Changed PV $FoxCount, $FoxCountInc, $FoxCountDec to be set by an incrementing foxcount index number, saved into page attributes, instead of counting posts each time. Added action=foxinit to reset to zero (needs authlevel 'attr'). Added back automatic anchor insertion, with new auto incrementing post count.
- 2006-12-18: Added page variables $FoxCount (to replace $FoxPostCount), $FoxCountInc, $FoxCountDec. Added breakpage option using breakpage2.phpΔ (seeBreakPage). Removed anchor insertion, to be done in template instead.
- 2006-12-17b: Added option to have a number of placement markers on a page, to have posts placed to different markers (appended or prepended).
- 2006-12-17a: Fixed problems with delete link not deleting sometimes (caused by extraneous white spaces).
- 2006-12-17: Initial release.
Comments
See Discussion at Fox-Comments
See Also top
Contributors