CoolCMS API

EditAdvertFormTrait

Company profile editing.

Loads the profile, verifies the permission (logged-in owner or session token) and provides the actions that show the edit form.

Tags
requires

AdvertAuthorizationFormTrait shows the login form and stores the token in the session

AdvertPasswordResetFormTrait new-password form from the "forgotten password" link and the "manage profile" link (manageKey) from the insertion e-mail

Table of Contents

Constants

sessionSection  : mixed = 'front.comcat.advert.edit'
tabConfirm  : mixed = 'confirm'
tabDelete  : mixed = 'delete'
tabExtend  : mixed = 'extend'
tabForm  : mixed = 'form'
Tab keys of the edit page; they match the files in `Templates/Advert/Sections/Edit/`.
tabRenew  : mixed = 'renew'
tabResponses  : mixed = 'responses'
tabStatistics  : mixed = 'statistics'

Properties

$capabilityTokenIssuer  : CapabilityTokenIssuer
Issuer of the capability token for the Api layer (see {@see self::checkAutorization()}).
$advert  : Advert|null

Methods

actionEdit()  : void
getAdvert()  : Advert|null
renderEdit()  : void
setAdvert()  : self
createComponentEditAdvertForm()  : AdvertForm
buildEditTabs()  : array<int, string>
Builds the list of available tabs; Renew and Extend appear by the expiration state.
checkAutorization()  : bool
Verifies that the current user may edit the company profile.
grantAdvertEditCapability()  : void
IMPORTANT: the scope is `comcat.advert.edit`; if it were shared with Bazaar, a capability for advert id 5 would authorize company id 5.
grantAdvertEditCapabilityFromSession()  : void
Sends the capability from the session before the profile is loaded: the Api verifies it itself (password digest from the DB in `ownsByCapability()`), so a stale session record opens nothing. Without it, `get` for editing would return a masked e-mail to an anonymous editor and the form would fail validation. {@see self::checkAutorization()} then issues the capability again after checking against the fresh hash, which stays decisive for access.

Constants

tabForm

Tab keys of the edit page; they match the files in `Templates/Advert/Sections/Edit/`.

private mixed tabForm = 'form'

Properties

Methods

buildEditTabs()

Builds the list of available tabs; Renew and Extend appear by the expiration state.

private buildEditTabs() : array<int, string>
Return values
array<int, string>

checkAutorization()

Verifies that the current user may edit the company profile.

private checkAutorization() : bool

A logged-in owner passes without a session. Guests need a valid token in the session (id + hash + expiration) stored after the password was entered.

IMPORTANT: the capability must be issued only after the hash is compared with the DB, otherwise a stale session record would open the profile. Full reasoning in EditAdvertFormTrait::checkAutorization().

Return values
bool

grantAdvertEditCapability()

IMPORTANT: the scope is `comcat.advert.edit`; if it were shared with Bazaar, a capability for advert id 5 would authorize company id 5.

private grantAdvertEditCapability(int $advertId, string $passwordHash, int $expiration) : void
Parameters
$advertId : int
$passwordHash : string
$expiration : int

grantAdvertEditCapabilityFromSession()

Sends the capability from the session before the profile is loaded: the Api verifies it itself (password digest from the DB in `ownsByCapability()`), so a stale session record opens nothing. Without it, `get` for editing would return a masked e-mail to an anonymous editor and the form would fail validation. {@see self::checkAutorization()} then issues the capability again after checking against the fresh hash, which stays decisive for access.

private grantAdvertEditCapabilityFromSession(int $advertId) : void
Parameters
$advertId : int
On this page

Search results