CoolCMS API

AdvertConfirmTrait

Two forms of company profile confirmation by the owner: - `handleConfirm()` - through the activation URL (from the e-mail or the profile detail), - `handleConfirmAdvert()` - by a click directly on the edit page.

Tags
requires

EditAdvertFormTrait shares $advert, checkAutorization() and $advertManager

AdvertDetailTrait collectAdvertVisibilityIssues() (message "confirmed, waiting for approval")

Table of Contents

Methods

handleConfirm()  : void
Confirms through the activation key from the URL (the `?do=confirm&key=...` link of the `CC_ADVERT_ACTIVATION_REQUEST` e-mail).
handleConfirmAdvert()  : void
Confirms the company profile directly from the edit page (Confirm tab).

Methods

handleConfirm()

Confirms through the activation key from the URL (the `?do=confirm&key=...` link of the `CC_ADVERT_ACTIVATION_REQUEST` e-mail).

public handleConfirm() : void

IMPORTANT: the pieces below are all required, otherwise the link from the e-mail does nothing:

  1. Nette adds Requires(sameOrigin: true) to every handle*(). A click from a mail client is cross-site (Sec-Fetch-Site: none), so detectedCsrf() silently redirects to this without do/key and the handler never runs. The link is protected by the key, not by the origin, hence #[CrossOrigin].
  2. An unconfirmed company profile is hidden from a guest and actionDetail() nulls $this->advert, so the handler works only with the id from the URL.
  3. The Api rejects the updateColumn(confirmedAt) write of a guest (no updateColumns). Everything goes through the Api action confirmByKey (five layers, internal bridge): constant-time key check, deleted/banned = rejection, key consumption, ES + category counts and a failed-attempts limit (AdvertConfirmByKeyTrait).

The Api response does not tell an unknown/deleted profile from a wrong key, and neither does the front end (one error message). Repeating the click with the right key succeeds.

Attributes
#[CrossOrigin]

handleConfirmAdvert()

Confirms the company profile directly from the edit page (Confirm tab).

public handleConfirmAdvert() : void
On this page

Search results