Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

CRM-18427: Submitted custom data values not reloaded on form when validation fails #8269

Merged
merged 2 commits into from
Aug 2, 2016

Conversation

monishdeb
Copy link
Member

@monishdeb monishdeb commented Apr 29, 2016

@monishdeb monishdeb added needs-work-not-review-ready Submitter required to take action, will be closed after 1-2 weeks in this state 4.7 labels Apr 29, 2016
@monishdeb
Copy link
Member Author

Jenkin, test this please

@monishdeb
Copy link
Member Author

monishdeb commented Apr 29, 2016

@colemanw @eileenmcnaughton as per https://issues.civicrm.org/jira/browse/CRM-16676?focusedCommentId=86474&page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-86474 reason behind this bug, this is the only fix I got, as now via 'civicrm/custom?type=&' loads CRM_Custom_Form_CustomDataByType snippet which only got info what we provide via url's parameters. This fix contain -

  1. json_encode([submitted custom values]) and append to the link
    https://github.com/civicrm/civicrm-core/pull/8269/files#diff-8dd71cd2b4ff3bc91e82e75dcdf32badR58
  2. When page reloads .. decode the data and use for setting default value
    https://github.com/civicrm/civicrm-core/pull/8269/files#diff-d9f1be3fcfd7cea0a4864a21997c258aR1862
    Though it looks a bit hackish so I have marked my PR with WIP if there is any scope to improve my PR !!

@monishdeb monishdeb removed the needs-work-not-review-ready Submitter required to take action, will be closed after 1-2 weeks in this state label May 6, 2016
@colemanw
Copy link
Member

jenkins, retest this please

@monishdeb
Copy link
Member Author

Test build failure is not related

@@ -1377,7 +1377,13 @@ public static function setDefaults(&$groupTree, &$defaults, $viewMode = FALSE, $
}
}
else {
$checkedValue = explode(CRM_Core_DAO::VALUE_SEPARATOR, substr($value, 1, -1));
if (is_array($value) && count($value)) {
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I have tested this patch by adding a new contribution & filling it in with contribution details & custom field details but no amount. I save the custom data disappears. However, with this patch it does not.

I'm just going through the patch to see if it makes sense / seems risk free.

This line seems risk free as an array would not have previously been handled & the non array path is unchanged

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I tested radio, checkbox, autocomplete, date, multiselect, select, adv multiselect..

@eileenmcnaughton
Copy link
Contributor

I think this is OK - it works & as far as I can see by getting the values only for specific fields (custom_xx) it's safe & being in the Custom class it should be fairly hard for someone to foolishly extend it to put credit card fields into the url.

Having said that, odd interaction with the $_POST array makes me inherently a little nervous so I'd really like @colemanw or @totten or @xurizaemon to quickly eyeball this & confirm they don't see any hole that I'm missing

@monishdeb
Copy link
Member Author

Jenkin test this please

@xurizaemon
Copy link
Member

I'm not comfortable with this ... can't articulate very well right now, but -

  • $_FILE uploads won't work with being translated to $_GET
  • potentially sensitive personal data (custom data) shouldn't be moved to $_GET params
  • $_GET won't work with larger input fields (text)

So using $_GET feels like an incomplete/not correct fix to me.

@monishdeb
Copy link
Member Author

monishdeb commented Jun 6, 2016

@xurizaemon I have a plan to fix that. How about we capture the same logic to add/delete attachments in activity, for custom file field too ? So now when user uploads a file then on submit, it actually made an entry in civicrm_file and other necessary table, so when the page reloads on validation error, it fetch the saved file entry (show as a link against the custom file field) BUT now you have a trash icon against the file link so you can delete and upload a new file.

#2 and #3 I agree thats it not right to pass such personal data and its weird to pass large input data via $_GET. So I was thinking what if we use cache to store/fetch this submitted values and later used to set default custom values on form reload!!

@eileenmcnaughton @colemanw is it ok ?

@xurizaemon
Copy link
Member

@monishdeb do you understand why these form fields need to be treated "specially"? I don't yet get the underlying cause of the need for this workaround. (Sorry, I know I'm chiming in late here.)

@eileenmcnaughton
Copy link
Contributor

@colemanw I feel like you need to look at this as you fixed something similar on the payment form

@colemanw
Copy link
Member

@monishdeb I agree that the cache option is a good one. Using $_POST instead of $_GET also seems like an acceptable solution.

@monishdeb
Copy link
Member Author

monishdeb commented Jul 22, 2016

@colemanw @eileenmcnaughton I have updated the PR and this is my change ac8833f as now we are storing the custom data in cache rather the passing it to url. As you can see I used to CRM_Core_BAO_Cache::setItem()/getItem() instead of Civi::cache->set()/get() because

  1. It un-/serialize submitted data on get/set respectively
  2. Always update the cache against corresponding cache path

However $_FILE uploads doesn't work not only for custom file field but also for other entity files e.g. activity attachments. So it should be raised as a separate issue.

}
// Generate cache key against which submitted custom value will be stored
$cacheKey = implode('_',
array(__CLASS__,
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

__CLASS__ will always be the same e.g. for forms open in multiple tabs. Do we have access to qfKey here?

Copy link
Member Author

@monishdeb monishdeb Jul 22, 2016

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ya I tried with qfKey earlier but getting some trouble with it as formatGroupTree() function is being called by multiple form as in here 'CRM_Custom_Form_CustomDataByType' form which is called via loadPage and entity form. So qfkey keeps changing for this two form instance. I tried to use get_class($form) != 'CRM_Custom_Form_CustomDataByType' as another flag to set/get qfkey but it throws invalid session handling error on page reload. Still lemme check if we can make use of qfkey.

@monishdeb
Copy link
Member Author

Done, updated the PR with f22fdc2 . Used qfKey only to be use a cache key.

@@ -1892,7 +1894,9 @@ public static function formatGroupTree(&$groupTree, $groupCount = 1, &$form = NU

if ($form) {
if (count($formValues)) {
$form->assign('submittedValues', json_encode($formValues));
$qf = $form->get('qfKey');
$form->assign('qf', $qf);
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

'qfKey' seems like a better name for this smarty variable.

@josephlacey
Copy link
Contributor

Thanks for all the work on this, y'all . I can test whenever the patch is ready, so just let me know.

However $_FILE uploads doesn't work not only for custom file field but also for other entity files e.g. activity attachments. So it should me raised as a separate issue.

I'd say there's a low expectation that this needs to work. A fair number of web applications I use don't save the upload file value when you fail validation.

@colemanw
Copy link
Member

@josephlacey feel free to test now; my last suggestion was a NFC.

@monishdeb
Copy link
Member Author

@colemanw done (but can't rename the url param to qfKey as it overrides the qfkey of corresponding dataUrl's form and eventually ends up into valid session key error on page reload)

@monishdeb
Copy link
Member Author

PR is ready for test :)

@jitendrapurohit
Copy link
Contributor

jitendrapurohit commented Aug 2, 2016

Tested the PR with different input custom fields, changes works fine for all of them.

@monishdeb
Copy link
Member Author

@josephlacey I am merging this PR as Jitendra had already tested for all kind of custom fields except file. Feel free to reopen the ticket if ya find any other bug.

@monishdeb monishdeb merged commit dbfd6b9 into civicrm:master Aug 2, 2016
@monishdeb monishdeb deleted the CRM-18427 branch August 2, 2016 07:33
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

7 participants