AdvertConfirmTrait
Two forms of advert confirmation by the owner: - `handleConfirm()`: through the activation URL (from the e-mail or the advert detail) - `handleConfirmAdvert()`: by a click directly on the edit page
Tags
Table of Contents
Methods
- handleConfirm() : void
- Confirms the advert through the activation key from the URL (`?do=confirm&key=...` link of the e-mail `BZ_ADVERT_ACTIVATION_REQUEST`).
- handleConfirmAdvert() : void
- Confirms the advert directly from the edit page (Confirm tab).
Methods
handleConfirm()
Confirms the advert through the activation key from the URL (`?do=confirm&key=...` link of the e-mail `BZ_ADVERT_ACTIVATION_REQUEST`).
public
handleConfirm() : void
IMPORTANT: the handler needs #[CrossOrigin]. Nette forces Requires(sameOrigin: true) on
every handle*(), and a click from a mail client is cross-site, so detectedCsrf() would
silently redirect without do/key and the handler would never run. The link is protected
by the key, not by the origin.
An unconfirmed advert is hidden from a guest and actionDetail() nulls $this->advert, so
the handler works only with the id from the URL. A guest cannot write updateColumn(confirmedAt)
(no updateColumns privilege), so everything goes through the Api action confirmByKey:
constant-time key check, deleted or banned = rejection, key consumption, ES and category
counts and a limit of failed attempts
(AdvertConfirmByKeyTrait).
The Api answer does not distinguish an unknown or deleted advert from a wrong key, so the Front does not either (one error message). A repeated click with the right key is a success.
Attributes
- #[CrossOrigin]
handleConfirmAdvert()
Confirms the advert directly from the edit page (Confirm tab).
public
handleConfirmAdvert() : void