0

I have a template that takes input from a form and and does several operations. These operations call plugin functions and I'd like one of them to call a different function if one of the input parameters is set.

This is the template code:

{if segment_2 == 'submit'}
    <?
      $embed_params = 'email="' . $_POST['email'] . '"';
      $embed_params .= 'PID="' . $_POST['PID'] . '"';
      $embed_params .= 'DOB="' . $_POST['DOB'] . '" Site="" site="'.$_POST['site'].'"';
    ?>
    {embed='/forgot_password_form' message='{exp:forgot_password:send_email code="{segment_3}" <?=$embed_params?>}' <?=$embed_params?>}
{if:elseif segment_2 == 'reset'}
    {embed='/forgot_password_reset' email='{exp:forgot_password:check_code code="{segment_3}"}' code="{segment_3}" <?=$embed_params?> site="<?=$_POST['site']?>"}
{if:elseif segment_2 == 'reset_submit'}
    {embed='/forgot_password_reset' message='{exp:forgot_password:update_password code="<?=$_POST['code']?>" password="<?=$_POST['password']?>" site="<?=$_POST['site']?>" }' }
{if:else}
    {embed='/forgot_password_form' }
{/if}

They get an email with a reset code when the send_mail plugin function s called and then when they click the reset link, it calls forgot_password/reset to load a reset form and when they submit the reset form, it calls the forgot_password/reset_submit to update their password.

Now, if the $_POST["email'] is set, I want to call exp:forgot_password:send_email, if it is not set, I want to call exp:forgot_password:show_pass.

I'm going to return their actual username and password to show vs. having them reset it.

How would I call show_pass instead of send_email if the email address is not set here? Or should I just use the plugin code to determine?

0

It is highly advisable to avoid using PHP in templates, in this instance it's even more important as you're taking raw POST data and doing no validation or security checks on it so opening your website up to security vulnerabilities.

Use the Mo' Variables add-on (EE2 and EE3 compatible) to capture the POST data, which will sanitize it as well.

{if segment_2 == 'submit'}
    {embed='/forgot_password_form' 
        message='{exp:forgot_password:send_email code="{segment_3}"
            email="{post:email}"
            PID="{post:PID}"
            DOB="{post:DOB}"
            Site="{post:site}"}'
        email="{post:email}"
        PID="{post:PID}"
        DOB="{post:DOB}"
        Site="{post:site}"}

{if:else}
    {if segment_2 == 'reset'}
        {embed='/forgot_password_reset' 
            email='{exp:forgot_password:check_code code="{segment_3}"}'
            code="{segment_3}"
            email="{post:email}"
            PID="{post:PID}"
            DOB="{post:DOB}"
            Site="{post:site}"}
    {if:elseif segment_2 == 'reset_submit'}
        {embed='/forgot_password_reset' 
            message='{exp:forgot_password:send_email code="{segment_3}"
                code="{post:code}"
                password="{post:password}"
                Site="{post:site}"}'}
    {if:else}
        {embed='/forgot_password_form'}
    {/if}
{/if}

I'm not actually sure where you want to call send_email or show_pass in all this, but here it is:

{if "{post:email}"}
    {exp:forgot_password:send_email}
{if:else}
    {exp:forgot_password:show_pass}
{/if}

How are you going to show the password as EE uses 1 way encryption? Or is this not related to EE membership?

All the above is based on your code, but personally, I would refactor the lot and place it in your add-on to process it. You don't need to pass any POST, segment or site variables then as they'll all be accessible from within your add-on. Then you could simply have:

{exp:forget_password}
    {if "{route}" == "form"}
        Display the form content in this template instead of embed using variables 
        output from your tag pair plugin (with post data correctly sanitized using 
        correct EE form class).

    {if:else}
        Display the reset content in this template, as above
    {/if}
{/exp:forget_password}
| improve this answer | |
  • 1. Yes, it is not EE based membership. 2. Yes, we know about the "security" vulnerabilities, the cleaning is done in the plugin. 3. I just hate it when people lecture you about things like this. 4. This entire EE installation will be going away in a couple of months so this is all just throw away code, anyway, but thatnks. – MB34 Jun 27 '16 at 14:09
  • I'm not lecturing as I know nothing about your approach or level of knowledge, ideally I wanted to give you a balanced answer without creating a thread of 2 way conversation as I find out more. Also presenting best practises makes the answer useful for other people in the future who have similar or related issues and stumble upon this QA. – Peter Lewis Jun 27 '16 at 18:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.