Calling plugin function depending upon input to template

Question

I have a template that takes input from a form and and does several operations. These operations call plugin functions and I'd like one of them to call a different function if one of the input parameters is set.

This is the template code:

{if segment_2 == 'submit'}
    <?
      $embed_params = 'email="' . $_POST['email'] . '"';
      $embed_params .= 'PID="' . $_POST['PID'] . '"';
      $embed_params .= 'DOB="' . $_POST['DOB'] . '" Site="" site="'.$_POST['site'].'"';
    ?>
    {embed='/forgot_password_form' message='{exp:forgot_password:send_email code="{segment_3}" <?=$embed_params?>}' <?=$embed_params?>}
{if:elseif segment_2 == 'reset'}
    {embed='/forgot_password_reset' email='{exp:forgot_password:check_code code="{segment_3}"}' code="{segment_3}" <?=$embed_params?> site="<?=$_POST['site']?>"}
{if:elseif segment_2 == 'reset_submit'}
    {embed='/forgot_password_reset' message='{exp:forgot_password:update_password code="<?=$_POST['code']?>" password="<?=$_POST['password']?>" site="<?=$_POST['site']?>" }' }
{if:else}
    {embed='/forgot_password_form' }
{/if}

They get an email with a reset code when the send_mail plugin function s called and then when they click the reset link, it calls forgot_password/reset to load a reset form and when they submit the reset form, it calls the forgot_password/reset_submit to update their password.

Now, if the $_POST["email'] is set, I want to call exp:forgot_password:send_email, if it is not set, I want to call exp:forgot_password:show_pass.

I'm going to return their actual username and password to show vs. having them reset it.

How would I call show_pass instead of send_email if the email address is not set here? Or should I just use the plugin code to determine?

Answer 1

It is highly advisable to avoid using PHP in templates, in this instance it's even more important as you're taking raw POST data and doing no validation or security checks on it so opening your website up to security vulnerabilities.

Use the Mo' Variables add-on (EE2 and EE3 compatible) to capture the POST data, which will sanitize it as well.

{if segment_2 == 'submit'}
    {embed='/forgot_password_form' 
        message='{exp:forgot_password:send_email code="{segment_3}"
            email="{post:email}"
            PID="{post:PID}"
            DOB="{post:DOB}"
            Site="{post:site}"}'
        email="{post:email}"
        PID="{post:PID}"
        DOB="{post:DOB}"
        Site="{post:site}"}

{if:else}
    {if segment_2 == 'reset'}
        {embed='/forgot_password_reset' 
            email='{exp:forgot_password:check_code code="{segment_3}"}'
            code="{segment_3}"
            email="{post:email}"
            PID="{post:PID}"
            DOB="{post:DOB}"
            Site="{post:site}"}
    {if:elseif segment_2 == 'reset_submit'}
        {embed='/forgot_password_reset' 
            message='{exp:forgot_password:send_email code="{segment_3}"
                code="{post:code}"
                password="{post:password}"
                Site="{post:site}"}'}
    {if:else}
        {embed='/forgot_password_form'}
    {/if}
{/if}

I'm not actually sure where you want to call send_email or show_pass in all this, but here it is:

{if "{post:email}"}
    {exp:forgot_password:send_email}
{if:else}
    {exp:forgot_password:show_pass}
{/if}

How are you going to show the password as EE uses 1 way encryption? Or is this not related to EE membership?

All the above is based on your code, but personally, I would refactor the lot and place it in your add-on to process it. You don't need to pass any POST, segment or site variables then as they'll all be accessible from within your add-on. Then you could simply have:

{exp:forget_password}
    {if "{route}" == "form"}
        Display the form content in this template instead of embed using variables 
        output from your tag pair plugin (with post data correctly sanitized using 
        correct EE form class).

    {if:else}
        Display the reset content in this template, as above
    {/if}
{/exp:forget_password}