|
dolibarr 25.0.0-alpha
|
Whitelist of elementtype values accepted by the unified extrafields admin page (htdocs/admin/extrafields.php). More...
Go to the source code of this file.
Functions | |
| extrafieldsAdminProductServiceLabel ($keyBoth, $keyServiceOnly, $keyProductOnly, $noconv=false) | |
| Build a closure that mirrors the isModEnabled("product")/isModEnabled("service") conditional found across the product/service family of extrafields admin wrapper pages: the base translation key applies when both modules are enabled, and each of the other two keys applies when only one of the two modules is enabled. | |
| getExtrafieldsAdminMap () | |
| Return the whitelist of elementtype values accepted by htdocs/admin/extrafields.php, and the page metadata needed to render each one (which tab-bar function to call, which lang files to load, ...). | |
Whitelist of elementtype values accepted by the unified extrafields admin page (htdocs/admin/extrafields.php).
This is a closed registry: only elementtype values explicitly listed here can ever be processed by the unified extrafields admin page. Do not make this dynamic or pattern-based — the whole point is that an attacker-controlled string can never reach ExtraFields\addExtraField(), ExtraFields\update()/delete(), or the raw SQL built in core/actions_extrafields.inc.php, without having first matched one of these hardcoded keys.
Definition in file admin_extrafields.lib.php.
| extrafieldsAdminProductServiceLabel | ( | $keyBoth, | |
| $keyServiceOnly, | |||
| $keyProductOnly, | |||
| $noconv = false ) |
Build a closure that mirrors the isModEnabled("product")/isModEnabled("service") conditional found across the product/service family of extrafields admin wrapper pages: the base translation key applies when both modules are enabled, and each of the other two keys applies when only one of the two modules is enabled.
This exists purely to avoid repeating the same 8-line conditional in every title/headlabel closure of the product-family registry entries below — the original wrapper files all contained this exact conditional shape verbatim, only the translation keys (and, for the base key, trans() vs transnoentitiesnoconv()) differ between $title and $textobject.
| string | $keyBoth | Translation key when both product and service are enabled |
| string | $keyServiceOnly | Translation key when only the service module is enabled |
| string | $keyProductOnly | Translation key when only the product module is enabled |
| bool | $noconv | Use transnoentitiesnoconv() instead of trans() for $keyBoth, matching the original wrapper files' $textobject assignment |
Definition at line 51 of file admin_extrafields.lib.php.
References isModEnabled().
Referenced by getExtrafieldsAdminMap().
| getExtrafieldsAdminMap | ( | ) |
Return the whitelist of elementtype values accepted by htdocs/admin/extrafields.php, and the page metadata needed to render each one (which tab-bar function to call, which lang files to load, ...).
headlabel is the string (or no-arg callable returning an already-translated string) passed to dol_get_fiche_head()'s $title argument (the tab-head picto's alt/title tooltip). textobject is the string (or callable) shown in the "Define any additional / custom attributes that must be added to: %s" sentence rendered by core/tpl/admin_extrafields_view.tpl.php. The two original per-object wrapper files each set these independently and they are frequently NOT the same lang key — do not assume they match. textobject is optional and falls back to the resolved headlabel value when omitted, which is safe only when the source wrapper file passed the same string (or the same variable) to both, or never set $textobject at all. Like title, headlabel/textobject callables are called with no arguments and their return value is used as-is (already translated) — they are NOT passed through $langs->trans()/transnoentitiesnoconv() again. elementtype is optional and, when present, overrides the real object-type string passed to core/actions_extrafields.inc.php and the ExtraFields class — the array KEY is still what GETPOST('elementtype') must match against the whitelist, letting two map keys (two distinct tab-bar presentations) legitimately operate on the same underlying table.
A module (core or custom/) can contribute additional entries via the 'getExtrafieldsAdminMap' hook instead of editing this file — see the bottom of this function. A hook-contributed entry can only ADD a new key: if it reuses a key already defined below, the core definition silently wins. Whichever entry a request ultimately resolves to, hook-contributed or not, it is always developer-authored PHP from an installed, enabled module — never derived from request input — so this stays a closed whitelist in the sense that matters: only entries a module explicitly chose to declare, never an attacker-supplied string, can ever reach ExtraFields\addExtraField() /update()/delete() or the raw SQL in core/actions_extrafields.inc.php.
Definition at line 98 of file admin_extrafields.lib.php.
References extrafieldsAdminProductServiceLabel(), and getDolGlobalString().