CoolCMS API

AdminSettingPresenter extends BasePresenter

in package

• Application

uses AdminFormHelpersTrait, AdminEditFormComponentsTrait, ThemePickerTrait

Admin settings (`/admin/system-nastaveni-administrace/prehled`), a tab of the settings section.

Table of Contents

Constants

LOGIN_BACKLINK  : string = 'backlink'

Login page parameter with the key of the stored request to return to ({@see loginReturnArgs()}).

DEFAULT_ITEMS_PER_PAGE  : mixed = 20

Items per page of admin lists when the DB setting is missing.

FORM_BACK_SUBSECTION  : mixed = 'formBack'

Session subsection mapping a key to the previous page URL of edit forms.

SESSION_NAMESPACE  : mixed = 'admin'

BLOCKED_EXTENSIONS  : mixed = ['php', 'php3', 'php4', 'php5', 'php7', 'php8',...

Extensions that must not be uploaded into the web-served folder; otherwise an editor upload would mean running foreign code on the server. It is no content whitelist (the editor uploads what is needed), only a safeguard against executable files.

EDITOR_PAGE_LIMIT  : mixed = 500

Listing cap; the dialog is a suggester, not a paged list.

EDITOR_PAGE_TARGETS  : mixed = ['front:system:page:show']

Routes the editor may link to: text pages only.

EDITOR_UPLOAD_FOLDER  : mixed = 'editorUploads'

Editor root (relative to the `uploads/` root). Changing it to `''` would open the whole `uploads/` tree to the manager; the editor user could then reach (and delete) files of other modules such as products and avatars.

IMAGE_EXTENSIONS  : mixed = ['jpg', 'jpeg', 'png', 'gif', 'webp', 'avif', '...

Extensions the file manager shows as a preview instead of a document icon.

KEY_ITEMS_PER_PAGE  : mixed = 'admin.itemsPerPage'

Setting key with the number of records per page in admin lists (DataGrid).

LOCALE_MAP  : mixed = ['cs' => 'cs_CZ', 'en' => 'en_US', 'sk' => 'sk_...

Maps the short language code to the full locale of the registered NEON sources.

MODULE  : mixed = 1

Index of the System module in `cms_system_settings`.

PICKER_MODULE  : mixed = 1

Settings of both appearances live in the System module.

Properties

$accessTokenValidator  : AccessTokenValidator

Signature and expiry alone are not enough: a revoked token (`jti` on the deny-list) that has not expired yet would keep the session logged in although the Api guard rejects the same token. Same contract as {@see \App\Core\Traits\Api\Presenters\JwtAuthTrait::checkJwtAuth()}, one implementation.

$adminFormActionsFactory  : FormActionsFactory

$adminLangNavFactory  : LangNavFactory

$adminLanguageManager  : LanguageManager

$adminPageManager  : AdminPageManager

$authManager  : AuthManager

$authStorageManager  : AuthStorageManager

$authUserManager  : UserManager

Admin `UserManager` for {@see UserManager::login()}. A module must not read through another module, so admin has its own `login()` that calls the same Api endpoint (`api/system/auth/login`).

$columnSchema  : ColumnSchema

Limits of the real database columns for {@see guardColumns()}.

$container  : Container

$deviceDetector  : DeviceDetector

$editorAutosaveScope  : EditorAutosaveScope

Scope of the editor autosave drafts, see {@see \App\Core\Security\EditorAutosaveScope}.

$editorLinkPageManager  : PageManager

NOTE: own property name. `$pageManager` already exists on presenters (`PagePickerTrait`), and two `#[Inject]` properties of the same name would collide in the trait composition.

$editorUploadManager  : FileSystemManager

NOTE: own property name, not `$fileSystemManager`.

$eventDispatcher  : EventDispatcher

$formSubmissionGuard  : FormSubmissionGuard

One-time submission tokens of "add" forms, see {@see guardFormSubmitOnce()}.

$jwtManager  : JwtManager

$languageContext  : LanguageContext

$languageManager  : LanguageManager

$localizationContext  : LocalizationContext

$localizationManager  : LocalizationManager

$loginDeviceCookie  : LoginDeviceCookie

Cookie of a known device for the password login throttle ({@see self::rememberLoginDevice()}).

$modalWindowFactory  : ModalWindowFactory

Injected through Nette presenter inject (after construction), not the constructor.

$picker  : string

Picker mode of a list; when not empty, the presenter renders its `show` grid as a selection modal (no add/edit/delete/checkboxes, each row has a select button) in the minimal `@picker.latte` layout.

$pickerExclude  : int

Id of the record that cannot be selected in picker mode (its select button is hidden).

$pickerExcludeSubtreeLft  : int

`lft`/`rgt` bounds of a whole subtree whose nodes cannot be selected in picker mode.

$pickerExcludeSubtreeRgt  : int

$presenterContext  : PresenterContext

$privilegeManager  : PrivilegeManager

$queryCacheContext  : QueryCacheContext

Query cache policy for the whole admin request; `startup()` disables it.

$routerDispatcher  : RouterDispatcher

$settingContext  : SettingContext

$settingManager  : SettingManager

$themeContext  : ThemeContext

$themeManager  : ThemeManager

$themeResolver  : DefaultThemeResolver

$translator  : ITranslator

$translatorSessionResolver  : Session

$userManager  : UserManager

$adminPageEntity  : AdminPage|null

$debugMode  : bool

$productionMode  : bool

$savedEntityId  : int|null

Id of the record just saved; set by the `$processData` callback in `createForm()` after a successful save.

$translatorDomain  : string

$isLoggingIn  : bool

$theme  : Theme|null

$themeCatalog  : ThemeCatalog

$userPrivileges  : array<int, string>

Methods

__construct()  : mixed

beforeRender()  : void

createComponent()  : IComponent|null

flashFormOwnErrors()  : void

Flashes form-level errors (`$form->getOwnErrors()`) as `danger` messages.

flashRejectedUploads()  : void

Flashes one `warning` listing the files the Api rejected (type, dimensions, unreadable) after a successful save of a form with a dropzone ({@see UploadRejection}).

formatLayoutTemplateFiles()  : array<string|int, mixed>

Admin version of {@see \App\Core\Traits\Front\Presenters\ThemeInitTrait::formatLayoutTemplateFiles()}.

getAdminPageEntity()  : AdminPage|null

getContainer()  : Container

getFormBackUrl()  : string

Returns the stored previous page URL for the key, used by the `cancel` link in the template.

getModalWindow()  : ModalWindow

getRouterDispatcher()  : RouterDispatcher

getTranslator()  : ITranslator

guardFormSubmitOnce()  : void

Protects a form against a double submit: one rendered form saves at most once.

handleChangeLocale()  : void

handleEditorCreateFolder()  : void

Creates a subfolder in `folder` (path relative to the editor root).

handleEditorDelete()  : void

Deletes a file or (recursively) a folder. An empty path would point to the editor root, which cannot be deleted.

handleEditorFiles()  : void

Sends the folder listing for the editor file manager. The `folder` parameter is a path relative to the editor root (empty means the root).

handleEditorPages()  : void

Sends the page list for the link dialog as JSON `{"pages": [{id, label, url}, ...]}` sorted by label.

handleEditorRename()  : void

Renames a file or folder (`path` relative to the editor root).

handleEditorUpload()  : void

Accepts a file from the editor (field `file`, multipart POST; optional `folder` = subfolder of the editor root) and sends JSON `{"location": "/www/uploads/editorUploads/..."}`, the format TinyMCE expects from `images_upload_handler`.

handleLogout()  : void

handleSignOut()  : void

hasServiceByType()  : bool

Returns whether the container has a service of the given type.

initializeTranslator()  : void

isAddAction()  : bool

Tells whether the current action creates a record: `add` and the `add<Something>` actions (`addMenu`, `addKey`). Derived from the server context only, like {@see formSubmitPrivilege()}.

isAllowed()  : bool

Returns whether the logged-in user has the given privilege.

isSubmitOnceForm()  : bool

Tells whether the form was protected by {@see guardFormSubmitOnce()}.

loginWithCredentials()  : void

Logs in with username and password; called only by the login form (after validation and CSRF).

publishFieldErrors()  : void

Publishes element errors of a failed submit to the client.

redirectToFormBack()  : void

Redirects to the stored previous page and discards the key.

renderShow()  : void

resolveFormBackKey()  : string

Returns the previous-page key: from the URL if present (survives the update redirect), otherwise on a plain GET render of the edit page stores `Referer` in the session under a new random key.

runSubmitOnce()  : bool|null

Runs a saving step of a form under its one-time token (a form without the token just runs it).

setConfigParameters()  : void

setTranslator()  : $this

startup()  : void

typedComponent()  : T

Returns a subcomponent with a verified type.

addThemePickerFields()  : void

Adds the hidden field pair that a click on a preview fills.

authorize()  : void

Authorization hook; by default requires the `:Admin` privilege.

authorizeFormSubmit()  : void

Gate for writing presenter forms built by `createForm()`.

authorizeListing()  : void

Gate for reading lists.

checkAdminAccess()  : void

Entry gate to the admin: a guest is sent to login; a logged-in user without `:Admin` is sent to login with an error.

checkAuthentication()  : void

checkCurrentPrivilege()  : void

Builds the key from the current request (`:Admin:<Module>:<Presenter>:<action>`) and checks it. `getName()` already contains the `Admin:...` prefix, so only one leading colon is added.

checkPrivilege()  : void

Checks a specific privilege; throws 403 when denied.

createComponentAdminFormActions()  : FormActions

createComponentAdminLangNav()  : LangNav

createComponentEditForm()  : Form

createComponentModalWindow()  : ModalWindow

createForm()  : Form

Creates an edit form with the standard actions and a return to the previous page.

currentLangId()  : int|null

Returns the current language id (for picker labels etc.), null when unknown.

domainTranslator()  : PrefixedTranslator|null

Returns a translator prefixed with the presenter domain, or `null` (empty domain or a translator other than Contributte).

formSubmitPrivilege()  : string

Returns the privilege key required to save a form built by `createForm()`.

getAdminItemsPerPage()  : int

Returns the default items per page of admin lists from the DB setting `admin.itemsPerPage` (module System = 1), falling back to {@see DEFAULT_ITEMS_PER_PAGE}.

getAdminLayout()  : string

Returns the layout name; in picker mode ({@see $picker}) the `show` grid uses the minimal `@picker.latte` (no sidebar/header) so the opener fetch returns only the table.

getFormBackFallback()  : string

Returns the return URL when the previous page is unknown; override in a presenter without a `show` action.

getFormLanguages()  : array<int, Language>

Returns the languages for multilingual form fields (admin `LanguageManager`).

getSessionKey()  : string

Returns a session key string, e.g. 'front.auth.step1'.

getSessionSection()  : SessionSection

Returns a Nette\SessionSection instance using a dynamically built session key.

guardColumns()  : void

Gates every text and number field of the form by the real column it writes to ({@see \App\Core\Forms\ColumnGate::guard()}): an oversized value is an error at the field, never a database error that closes the entity manager (admin walkthrough A1, A14).

initializePresenterContext()  : void

intOrNull()  : int|null

Converts mixed to int or null (an empty or zero value becomes null).

isSameSiteRequest()  : bool

Tells whether the request comes from the own site (Nette SameSite cookie); protects GET actions with a side effect.

loadUserPrivileges()  : void

Loads all privileges of the logged-in user with one database query. Call it right after `checkAdminAccess()` in `startup()` (the user is guaranteed to be logged in by then).

logout()  : void

parseDateTime()  : DateTime|null

Converts a `datetime-local` input or text value to `DateTime`, or null when empty or unparsable.

saveThemePickerSettings()  : bool

Saves the map from {@see themePickerSettings()}; FALSE = nothing was saved.

setTranslatorDomain()  : void

setupTemplateTranslator()  : void

Sets a translator prefixed with the presenter domain into the template (as Front components do, see {@see \App\Core\Base\BaseComponent::setup()}).

str()  : string

Safely converts a mixed form value to string.

strOrNull()  : string|null

Converts mixed to string or null (an empty string is stored as null).

themePickerDirRel()  : string

Root of the admin themes, relative to the project root. `theme.admin.path` is built from it too, so folder name = template name.

themePickerGroups()  : array<int, array{slug: string, labelKey: string, themes: list, variants: list}>}>

Templates grouped for rendering. Each variant carries its preview and an "is currently set" flag.

themePickerKeys()  : array{theme: string, path: string, skin: string}

Keys of the admin branch.

themePickerSettings()  : array<string, string>|null

Validates the submitted pair and builds a map "setting key => value", or returns NULL and writes the error into the form.

createIdentity()  : SimpleIdentity|null

createMultiplierComponent()  : Multiplier<string|int, IComponent>

Creates a multiplier for the component.

createNewComponentInstance()  : IComponent|null

Creates a new component instance without adding it to the presenter; used by the multiplier.

createStandardComponent()  : IComponent|null

Creates a standard component (not a multiplier).

editorBreadcrumb()  : array<int, array{label: string, path: string}>

Builds the breadcrumb navigation: cumulative segment paths.

editorLinkLangId()  : int

Returns the language used to pick labels and URLs (default 1, Czech).

editorPageLabel()  : string

Returns the page label: title, otherwise name, otherwise `#id`.

editorPageRoute()  : Route|null

Returns the first page route the editor may link to. A page may have several (many-to-many); the whitelisted one is taken, not the first in order, so a page with both `Page:show` and `Page:form` ends up on the right one.

editorPageUrl()  : string|null

Returns the front end address of a page. The router builds it from the page route, so `/o-nas` and any prefix come out on their own.

editorParentFolder()  : string|null

Returns the parent folder (null in the editor root).

editorPath()  : string|null

Converts a client path (relative to the editor root) to an Api path (relative to the `uploads/` root).

editorUploadName()  : string|null

Builds a safe and unique file name. Sanitization copies the Api layer rules (webalize of the base and of the extension), so the name returned in the URL is exactly the name the file is stored under. The random suffix prevents collisions: `writeFile()` overwrites the same name without asking, so two different `obrazek.jpg` files would overwrite each other.

editorUploadUrl()  : string

Returns the public URL of a file. `$path` is relative to the `uploads/` root (so it includes `editorUploads/`), the same shape as other uploads in the system.

ensureEditorRoot()  : void

Creates the editor root folder; when it already exists the Api returns false and nothing happens.

expireIdleLogin()  : bool

Returns whether the login expired from inactivity. If so, revokes the tokens (like a logout), clears the `auth` section, logs out the Nette identity and returns true; otherwise moves the activity stamp forward.

getClientIp()  : string

initializeMetaTags()  : void

Fills the template with the title, meta tags and HTML text of the page from the translation (`PageText`) of the current language, for the layout (like the Front {@see \App\Core\Traits\Front\Presenters\PageInitTrait}).

initializePage()  : void

isDevelopment()  : bool

loadLocalization()  : Localization|null

localizationCurrencyKey()  : string|null

Admin ignores the localization currency (it takes the language only).

loginReturnArgs()  : array<string, string>

Remembers the request of a logged-out user so the login can return to it ({@see storeRequest()}, `backlink` of the login page, restored by `AuthStorageTrait::redirectAfterLoginAction()`).

logoutNetteUser()  : void

processFailedLogin()  : void

processInvalidToken()  : void

processLogin()  : void

processLoginException()  : void

processMissingToken()  : void

processSuccessfulLogin()  : void

processValidToken()  : void

readLoginDeviceToken()  : string|null

Returns the raw known-device cookie for the Api login (the Api verifies its signature).

redirectAfterLoginAction()  : void

After a login attempt: a successful login returns to the request remembered before the login (`backlink`, {@see PrivilegeCheckTrait::loginReturnArgs()}), otherwise to the dashboard; a failed one stays on the login page and keeps the way back.

refreshNetteIdentity()  : bool

Refreshes the token of the same logged-in user: identity data (token, name, email) are overwritten in the stored object without `login()`, so neither the session id nor the form CSRF tokens change. The identity is stored in the session section as an object; the change is written at the end of the request.

rememberLoginDevice()  : void

After a successful login (password or OAuth) issues or renews the known-device cookie ({@see LoginDeviceCookie}): a signed proof that this browser has already logged in to the account. The next login sends it to the Api ({@see self::processLogin()}), and above the account limit the password from this browser is still verified, so foreign attempts do not lock out the owner. HttpOnly, SameSite=Lax, Secure on HTTPS; lifetime from `ratelimit.loginDevice.cookieLifetime`.

resolveLoginErrorMessage()  : string

Resolves the flash message of a failed login.

revokeTokensOnLogout()  : void

Calls the Api logout (revokes the refresh family and deny-lists the access `jti`) for the tokens of the current session. Fail-open on purpose: any failure is only logged, because the local logout must not stay unfinished.

saveSettingForm()  : bool

setNetteUser()  : void

setSettingFormDefaults()  : void

storeEditorUpload()  : bool

Stores a file; the target folder may not exist (first upload into the root), so after a failure the root is created once and the write is retried. Deeper subfolders are created by the editor user through `editorCreateFolder`.

themePickerAssetUrl()  : string|null

Returns the relative path to the preview if the file exists and is not empty, otherwise NULL.

themePickerChoices()  : array<string, array<int, string>>

Offered pairs: template name => list of its skins (`''` = base color).

themePickerCover()  : array{skin: string, label: ?string, color: ?string, preview: ?string, previewFull: ?string, active: bool}

Variant shown by the card in the grid: the selected one, otherwise the base color.

themePickerDir()  : string

Returns the absolute directory with the templates of this branch.

themePickerGallery()  : array<int, array{view: string, url: string}>

Screenshots for the template gallery: large samples opened by a click on the thumbnail.

themePickerNames()  : array<int, string>

Names of the offered templates for the form rule.

themePickerPreviewFullUrl()  : string|null

Returns the URL of the whole-page thumbnail for the (template, skin) pair, or NULL when the file is missing.

themePickerPreviewUrl()  : string|null

Returns the preview URL for the (template, skin) pair, or NULL when the file is missing.

themePickerValue()  : string

Value of a key from module 1 as a string ('' = key missing or not a scalar).

tryRefresh()  : bool

Tries an auto-refresh for an expired access token. If the session holds a refresh token and the Api accepts it, stores the new pair in the session and returns true; otherwise returns false and the caller cancels the session.