csrf protection for delete, fix up issue with modals

Author: wilr

client/js/ManyField.src.js

@@ -4,19 +4,23 @@
     var wrapManyFields = function() {
       $('.manyfield__holder').each(function(i, elem) {
         var canSort = $(elem).hasClass('manyfield__holder--cansort')
-        var canAdd = $(elem).find('.manyfield__add').length > 0
         var canRemove = $(elem).hasClass('manyfield__holder--canremove')
-
         var field = $(elem).find('.manyfield__row')
 
         $(elem).find('.manyfield__row').each(function (r, row) {
           if (canRemove) {
             if (!$(row).find('.manyfield__remove').length) {
-              var href = $(this).data('inline-save');
+              var href = $(this).data('inline-delete');
 
               if (href) {
                 href.replace('saveRecord', 'deleteRecord');
-                href = href + '?ID='+ $(row).find('[name=ID]').val();
+                var id = $(row).find('input[type="hidden"][name*=ID]');
+
+                if (id.length < 1) {
+                  console.error('No ID hidden field in ManyField row');
+                }
+
+                href = href + '?ID='+ id.val();
 
                 $(row).prepend('<a class="btn btn-sm btn-danger manyfield__remove" href="' + href + '"><i class="fa fa-times"></i></a>');
               }
@@ -56,28 +60,34 @@
           value = $(field).val();
         }
 
+        var cleanName = name.substr(name.indexOf('[') + 1, name.indexOf(']') - (name.indexOf('[') + 1));
+
+
+        if (name.split('[').length > 3) {
+          cleanName += name.substr(name.lastIndexOf('['), name.lastIndexOf(']') - (name.lastIndexOf('[') - 1));
+        }
+
         data.push({
-          name: name.substr(name.indexOf('[') + 1, name.indexOf(']') - (name.indexOf('[') + 1)),
+          name: cleanName,
           value: value
         })
       })
 
+
       data.push({
         name: 'SecurityID',
         value: csrf
       })
 
       $.post(url, $.param(data), function() {
-        //..
+        $('body').trigger('manyFieldSaved');
       });
     })
 
     $('body').on('click', '.manyfield__add a', function(e) {
       e.preventDefault();
 
-      var
-        form = $(this).parents('form'),
-        parents = $(this).parents('.manyfield__holder');
+      var parents = $(this).parents('.manyfield__holder');
 
       $.get($(this).attr('href'), { index: parents.find('.manyfield__row').length }, function(data) {
         var rows = parents.find('.manyfield__row').last()
@@ -91,7 +101,7 @@
 
           // write the provided names as we don't need to namespace them in this
           // case - we can only edit one at a time
-          var content = $(data)
+          var content = $(data);
           content.find('input[name]').each(function(i, field) {
             if ($(field).attr('name').indexOf('[') !== false) {
               var name = $(field).attr('name').substring(
@@ -103,7 +113,15 @@
             }
           });
 
-          modal.find('.modal-body').html(content.html());
+          // move the modal form outside of the main form
+          if (modal.parents('form').length > 0) {
+            modal.detach().prependTo('body');
+          }
+
+
+          var saveURL = modal.attr('data-save-url');
+          content = $('<form action="'+ saveURL + '"></form>').html(data)
+          modal.find('.modal-body').html(content);
           modal.modal('show');
         } else {
           if (rows && rows.length) {
@@ -133,8 +151,12 @@
 
       parent.remove()
 
+      var data = {
+        'SecurityID': $('input[name=SecurityID]').val()
+      };
+
       if ($(this).attr('href')) {
-        $.post($(this).attr('href'));
+        $.post($(this).attr('href'), data);
       }
 
       $('body').trigger('manyFieldRemoved', {
@@ -154,16 +176,25 @@
         form
       });
 
-      if (form.get(0).checkValidity()) {
+      if (form.length > 0 && form.get(0).checkValidity()) {
         var body = $(this).parents('.modal-content').find('.modal-body')
           .addClass('loading')
 
-        $.post(form.attr('action'), form.serialize(), function(reply) {
+        var action = form.attr('action');
+
+        if (!action) {
+          console.error('No action found on form');
+          return;
+        }
+
+        $.post(action, form.serialize(), function(reply) {
           // reply should be the updated content for
-          form.parents('.manyfield__holder').html(reply);
-          body.html('');
+          if (reply) {
+            form.parents('.manyfield__holder').html(reply);
+            body.html('');
+          }
 
-          form.parents('.modal').modal('hide');
+          $('.modal').modal('hide');
           $('body').removeClass('modal-open');
           $('.modal-backdrop').remove();
 
@@ -175,6 +206,8 @@
         // highlight issues
         e.preventDefault();
 
+        alert('You are missing one or more fields');
+
         return false;
       }
     })

src/ManyField.php

@@ -474,7 +474,7 @@ public function deleteRecord()
         $request = Controller::curr()->getRequest();
 
         if (!SecurityToken::inst()->checkRequest($request)) {
-            return Controller::curr()->httpError(400);
+            return Controller::curr()->httpError(400, 'Bad security token');
         }
 
         if ($this->readonly) {
@@ -499,7 +499,7 @@ public function deleteRecord()
         $record = $class::get()->byId($index);
 
         if (!$record || !$record->canDelete()) {
-            return Controller::curr()->httpError(400);
+            return Controller::curr()->httpError(404, 'No record found with that ID');
         }
 
         $record->delete();
@@ -660,13 +660,21 @@ public function generateRow($index, $value = null, $prefixName = true)
             $field = $field->setReadonly($this->readonly);
             $field = $field->setDisabled($this->readonly);
 
-            $row->push($field);
+            if ($value && $value->hasMethod('modifyManyRecordField')) {
+                $field = $value->modifyManyRecordField($field);
+            }
+
+            if ($field) {
+                $row->push($field);
+            }
         }
 
+
         if ($this->inlineSave) {
             $row
                 ->addExtraClass('inline-save')
-                ->setAttribute('data-inline-save', $this->Link('saveRecord'));
+                ->setAttribute('data-inline-save', $this->Link('saveRecord'))
+                ->setAttribute('data-inline-delete', $this->Link('deleteRecord'));;
         }
 
         $this->extend('alterRow', $row);