cmb69 / extedit_xh

Very limited multi user capability for CMSimple_XH

Extedit_XH

Extedit_XH facilitates to have an arbitrary amount of so called “extedits”, i.e. content areas, which can be edited by users logged in via Memberpages_XH or Register_XH. That allows a very limited multi-user capability without the need to grant these users full administration authorisation. The plugin offers basically the same functionality as the One Page for simpleMultiUser plugin, but uses the editor of CMSimple_XH. For security reasons the file browser is replaced with a minimal image picker.

• Requirements
• Download
• Installation
• Settings
• Usage
  • Image Picker
• Troubleshooting
• License
• Credits

Requirements

Extedit_XH is a plugin for CMSimple_XH. It requires CMSimple_XH ≥ 1.7.0 and PHP ≥ 7.1.0.

Download

The lastest release is available for download on Github.

Installation

The installation is done as with many other CMSimple_XH plugins. See the CMSimple_XH wiki for further details.

1. Backup the data on your server.
2. Unzip the distribution on your computer.
3. Upload the whole directory extedit/ to your server into the plugins/ directory of CMSimple_XH.
4. Set write permissions for the subdirectories config/, css/ and languages/.
5. Navigate to Plugins → Extedit in the back-end to check if all requirements are fulfilled.

Settings

The configuration of the plugin is done as with many other CMSimple_XH plugins in the back-end of the Website. Select Plugins → Extedit.

You can change the default settings of Extedit_XH under Config. Hints for the options will be displayed when hovering over the help icon with your mouse.

Localization is done under Language. You can translate the character strings to your own language if there is no appropriate language file available, or customize them according to your needs.

Usage

To embed an “extedit” on a page, insert the following:

{{{extedit('%USERNAME%', '%TEXTNAME%')}}}

To embed an “extedit” in the template, insert the following:

<?=extedit('%USERNAME%', '%TEXTNAME%')?>

Note: if “extedits” are embedded in the template or a newsbox, the configuration option Allow → Template has to be enabled.

The parameters have the following meaning:

• %USERNAME%: The name of the Register_XH or Memberpages_XH user, who may edit the content. If * is given as username, all authenticated users may edit the content. Alternatively, you can specify multiple usernames separated by comma (without any whitespace) here.

• %TEXTNAME%: The unique name of the “extedit”. Omit this parameter to use the heading of the containing page. This parameter is mandatory, if you place the extedit() call in the template or a newsbox.

When authorized users are logged in, they are presented an Edit link, where they can edit the contents of the “extedit”. They can insert images via the editor, but have no access to the file browser – only a simple Image Picker is available. In preview mode the admin of the Website is also able to edit the “extedit”, and has access to the file browser as usual. Visitors will only see the content of the “extedit”.

It is possible to have an arbitrary amount of “extedits” on a single page, all of them assigned to a certain user, each of them assigned to a different user, or a mixture thereof. To avoid that a user inadvertently overwrites the changes made by another user, a simple optimistic concurrency lock is implemented.

The contents of all “extedits” are stored in the automatically created subfolder extedit/ of the current content/ folder, each in a single file. The filename is made from the %TEXTNAME% by stripping all invalid characters (only alphanumeric characters and hyphens are allowed). Therefore all respectively stripped %TEXTNAME%s have to be unique for each language of the CMSimple_XH installation.

Caveat: If you omit the %TEXTNAME% parameter, the heading of the page will be used instead. If you later change the page heading, the “extedit” file has to be manually renamed. Furthermore it is perfectly valid to have the same page heading more than once in CMSimple_XH in different subtrees of the TOC, but that does not work for Extedit_XH. So it is probably better to always explicitly specify the %TEXTNAME% parameter.

It is possible to use plugin calls in the “extedits” (what has to be enabled in the configuration), but this is of limited use, as the users will not be able to actually administrate the plugins. However, some plugins do not need such management, so they can be used ad hoc, and others could be prepared by the admin.

Image Picker

As the filebrowser is only available for the administrator of the Website for security reasons, Extedit_XH offers a very simplistic image picker for users who are logged in via Memberpages_XH or Register_XH.

By default the user has only access to his own subfolder of the image folder (which is normally userfiles/images/). This subfolder has to have the same name as the user and must be created by the administrator. The user can upload images to this folder, but cannot delete or rename these images. Furthermore, the user is not able to access subfolders of his own image folder.

Limitations

• The image picker is currently available only for TinyMCE4 and CKEditor.
• Advanced management of the “extedit” files (e.g. deleting and renaming) has to be done via FTP.

Troubleshooting

Report bugs and ask for support either on Github or in the CMSimple_XH Forum.

License

Extedit_XH is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version.

Extedit_XH is distributed in the hope that it will be useful, but without any warranty; without even the implied warranty of merchantibility or fitness for a particular purpose. See the GNU General Public License for more details.

You should have received a copy of the GNU General Public License along with Extedit_XH. If not, see https://www.gnu.org/licenses/.

© 2013-2023 Christoph M. Becker

Danish translation © 2013 Jens Maegaard

Credits

The plugin logo is designed by Alessandro Rei. Many thanks for publishing this icon under GPL.

Many thanks to the community at the CMSimple_XH Forum for tips, suggestions and testing. Especially, I like to thank Ulrich, svasti and Hartmut for their early feedback. Also I like to thank Ele for reporting a critical bug early in the RC stage, and helping to resolve it.

And last but not least many thanks to Peter Harteg, the “father” of CMSimple, and all developers of CMSimple_XH without whom this amazing CMS would not exist.

extedit_xh's Issues

What about browsing media and downloads?

See https://cmsimpleforum.com/viewtopic.php?f=16&t=12566#p58589.

Require PHP ≥ 7.1.0

Cater to concurrency

Preferably, we use Pfw_XH's DocumentStore, what would require the plugin framework, so we postpone this issue.

Improve documentation regarding normal page and extedit editing/viewing

I.e. clarify that the extedits are widgets which are embedded in the normal page contents, which can be used to offer some introductory text by the admin, and following extedit(s) which are controlled by the external editors. Simple example:

<p>Hier finden sie Berichte einiger unserer Vereinsmitglieder zum letzten Tunier:</p>
{{{extedit('member1')}}}
{{{extedit('member2')}}}
{{{extedit('member3')}}}

Add tinymce5 integration

Albeit TinyMCE 5 is still not the default editor of CMSimple_XH, it should better be supported.

Make editor toolbar configurable

It would be sufficient to scan the inits/ folder for suitable inits. Of course, it would be nice to also deliver some reasonable inits by default.

Require CMSimple_XH ≥ 1.7.0

File upload CSRF vulnerability

The upload facility (implemented with d1fbeff) is vulnerable to CSRF.

ext/fileinfo requirement not documented

Extedit_XH unconditionally requires the fileinfo extension, which is neither documented in the manual nor checked for in the system check.

Automatic backup on logout

Analogous to CMSimple_XH's content backup, see https://cmsimpleforum.com/viewtopic.php?f=16&t=12566#p58661.

Support CKEditor and TinyMCE 4

All registered users can access the filepicker

Any registered user (Register_XH or Memberpages) can access the filepicker, even if this user does not have permissions to edit any extedit. That doesn't seem to be a real problem with 1.0beta1, but it's a showstopper now that the filepicker allows uploads.

It generally would be best if the filepicker was only available when an actual plugin call to extedit() is made on the current page (and only to the authorized users), but I'm not sure if that's possible with the current editor integration. I'll have to investigate.

A fallback would be a configurable whitelist of users who may access the filepicker.

get_magic_quotes_runtime() causes WSoD under PHP 8

Existing images are silently overwritten

If an image is uploaded, no check is in place to avoid overwriting an already existing image with the same name.

Remove tinymce (3) integration

TinyMCE 3 is no longer supported for years, so it makes no sense to keep that integration.

Drop ext/fileinfo requirement

As it is now, we use fileinfo to guess the mimetype of the uploaded file to verify that it is an image. That doesn't buy us much though, since some image types are probably not supported by the Webserver, and fileinfo might guess completely wrong anyway. Just relying on the file extension should be sufficient for the kind of security that is needed here.

Use mime_content_type() instead of finfo

Improve documentation

http://cmsimpleforum.com/viewtopic.php?t=8115&p=44154#p44154

Improve image picker

http://cmsimpleforum.com/viewtopic.php?f=12&t=5858&p=34223#p34210

RCI

Allow Extedits in Newsboxes and Template

See http://cmsimpleforum.com/viewtopic.php?f=16&t=8662.

Allow multiple users to edit the same extedit

See http://cmsimpleforum.com/viewtopic.php?f=16&t=8669&start=10#p47517.

Facilitate editor selection

It might make sense to offer another editor for extedit authors than what is used by the admin. Of course, that requires to have support for alternative editors working (#10) in the first place.

Extedits are invisible to non authorized users

Due to a critical bug introduced with commit d6f80b0, no extedit will ever be visible to users who are unauthorized to edit the extedit.

Fix mkdir issue wrt. umask

See http://cmsimpleforum.com/viewtopic.php?f=29&t=7970.

Implement PRG pattern