FuelPHP Forums

Here's my security section of my config:

'security' => array(
  'csrf_autoload'   => false,
  'csrf_token_key'  => 'fuel_csrf_token',
  'csrf_expiration'  => 0,
  'uri_filter'   => array('htmlentities'),

  /**
   * This input filter can be any normal PHP function as well as 'xss_clean'
   *
   * WARNING: Using xss_clean will cause a performance hit.  How much is
   * dependant on how much input data there is.
   */
  'input_filter'   => array(),

  /**
   * Whether to automatically encode (htmlentities) view data
   */
  'auto_filter_output' => false,

  /**
   * With output encoding switched on all objects passed will be converted to strings or
   * throw exceptions unless they are instances of the classes in this array.
   */
  'whitelisted_classes' => array('Fuel\\Core\\View', 'Fuel\\Core\\ViewModel', 'Closure')
 ),

I think I've figured out my issue - Controller_Wrapper extends Controller_Template (and has since before I wanted to switch to a different style of nested views), so I have to set the variables to $this->header, etc... Previously my view had a bunch of echo render() statements in it calling each of the views individually. What I'm trying to do is allow my base wrapper controller to handle ajax requests. At the same time, I'm changing how variables are assigned throughout the system, because previous I was using set_global, etc. Basically, a browser request to /ajax/path/to/controller does a Request::forge('path/to/controller'); and encodes the response in the right format for the AJAX request. The problem is I don't want to echo the entire template for AJAX requests - I just want to return a partial view as HTML instead of having it inside of the entire template. I'd like to reuse as much code as possible here. Any ideas?

One of the issues I'm faced with is the <title> of the site is actually set by the controller being called. I was calling set_global('title') previously, but since I'm doing the views differently now (by returning the view instead of setting it to $this->template->content) I'm not sure how to set the title of the page. I could use set_global still, but is there another way?

If your template is served by Controller_Template, your index should not return the partial. Returning the view will be taken care of by the Controller_Template. You should assign the "admin/articles/index" view to the appropriate section of the template. I'm a bit clueless to why that Request is there, you're fetching the same controller again?

The way I see it: Controller_App extends Controller_Wrapper extends Controller_Template. Wrapper defines the page template using the structure of the template controller, and in the before of the wrapper controller you define the 'static' bits of the template: everything but the template body (the content). When your Controller_App action method is called, it processes the request, creates the view object for the template body, assigns all variables to it, and finally assigns the view object to the template variable. After this all, the after() method of your controller stack is called. Normally, in case of the Controller_Template it will render the template view and return it, so Fuel can send it to the browser. So what you need to do is define your own after() method in Controller_Wrapper. In that method you check if it was an ajax call. If not, call the parent::after(), business as usual. If it was an ajax call, fetch the variables from the body view object using the get() method of the view, construct your json array, and send it out. Do not call the parent::after(), so your template will not be rendered anymore. If you can't make it generic, you can also do this in Controller_App, and have a specific after() method per controller.

By the way, I'm getting this error:

OutOfBoundsException [ Error ]: View variable is not set: content

Here's my code:

<?php
class Controller_Ajax extends Controller_Wrapper {
 public function router() {
  $this->is_ajax = true;
  $segments = Uri::segments();
  array_shift($segments); // remove ajax
  $path = implode('/', $segments);
  
  $output['html'] = Request::forge($path)->execute();
  var_dump($output);
 }
}

Controller_Wrapper:

 public function after($response) {
  // If the request is ajax, we want to return the content
  if(!$this->is_ajax) {
   parent::after($response);
  } else {
   $this->template->get('content');
  }
 }

Controller_Admin_Articles:

  $view = View::forge('admin/articles/index', $data);
  if(Request::main() === Request::active()) {
   $this->template->title = "Article";
  }
  $this->template->content = $view;

Any ideas?

Unfortunately I actually need to extend Controller_Wrapper in all of those controllers. Controller_Ajax doesn't need to extend Controller_Wrapper, though, since it's making an HMVC request I can handle errors in the Ajax controllers separately. Basically, Controller_Wrapper handles all the auth. Controller_Admin does it for admin.

You can't enable/disable the profiler dynamically, other then adding some code to the config file itself. The value is read and used long before any user code is executed.

This is not an issue that can be solved with a template controller. All that will do for you is autoload the 'wrapper' view. Which version of Fuel are you using? If you're going to use render(), know that your array contains string output. So you need to use the third parameter 'false' to make sure your rendered HTML isn't escaped:

return View::forge('wrapper', $views, false);

It's better just to remove the render() method, and have Fuel render the views automatically when needed. With this change, your code works without problems where, on the latest 1.1/develop.