Last commit: Tue Oct 13 22:52:59 2026 +0200	Jan Dankert	New: The UI is now able to send hierarchical form data and the server is converting it into an object. This is a very nice feature, because this enables a better OpenAPI interface.


      <?php
      
      namespace cms\action;
      
      use cms\api\Values;
      use util\exception\ValidationException;
      use util\Hydrator;
      use util\json\JSON;
      use util\mail\Mail;
     use util\Text;
     use util\YAML;
     
     
     class RequestParams
     {
     	const PARAM_TOKEN        = 'token'          ;
     	const PARAM_ACTION       = 'action'         ;
     	const PARAM_SUBACTION    = 'subaction'      ;
     	const PARAM_ID           = 'id'             ;
     	const PARAM_LANGUAGE_ID  = 'languageid'     ;
     	const PARAM_MODEL_ID     = 'modelid'        ;
     	const PARAM_PROJECT_ID   = 'projectid'      ;
     	const PARAM_DATABASE_ID  = 'dbid'           ;
     	const PARAM_OUTPUT       = 'output'         ;
     
     	public $action;
     	public $method;
     	public $id;
     
     	public $isAction;
     
     	/**
     	 * Request headers.
     	 * @var array
     	 */
     
     	public $headers;
     	public $authUser;
     	public $authPassword;
     	public $authToken;
     	public $apiToken;
     
     	private array $parameter;
     
     	/**
     	 * @var bool
     	 */
     	public $isUIAction;
     
     
     	/**
     	 * @var bool
     	 */
     	public $withAuthorization;
     
     	/**
     	 * RequestParams constructor.
     	 */
     	public function __construct()
     	{
     		// Is this a POST request?
     		$this->isAction = @$_SERVER['REQUEST_METHOD'] == 'POST';
     		$this->headers = array_change_key_case(getallheaders(), CASE_LOWER);
     
     		$this->tryBasicAuthorization();
     
     		$this->setParameterStore();
     
     		if   ( defined("API_CALL") ) {
     			$this->id     = API_ID;
     			$this->action = API_ACTION;
     			$this->method = API_SUBACTION;
     		} else {
     			$this->id     = $this->getAlphanum(self::PARAM_ID       );
     			$this->action = $this->getAlphanum(self::PARAM_ACTION   );
     			$this->method = $this->getAlphanum(self::PARAM_SUBACTION);
     		}
     	}
     
     
     	/**
     	 * Setting the source for request parameters.
     	 */
     	protected function setParameterStore() {
     
     
     		$contenttype = trim(explode( ';',@$this->headers['content-type'])[0]);
     
     		if   ( !$this->isAction )
     			$this->parameter = &$_GET;
     			// GET method in the HTTP/1.1 spec, section 9.3:
     			// The GET method means retrieve whatever information ([...]) is identified by the Request-URI.
     			// so the request body MUST be ignored here.
     		else
     			// POST requests are NOT idempotent
     			switch( $contenttype ) {
     				// These content-types are known by PHP, so we do NOT have to parse them:
     				case 'application/x-www-form-urlencoded': // the most used form url encoding
     				case 'multipart/form-data':               // Multipart-Formdata for File uploads
    				case '':
    					$this->parameter = &$_POST; // Using builtin POST data parsing
    					break;
    
    				// The request body contains a JSON document
    				case 'text/json':
    				case 'application/json':
    					// parsing the JSON data
    					$this->parameter = JSON::decode(file_get_contents("php://input"));
    					break;
    
    				case 'text/xml':
    				case 'application/xml':
    					$this->parameter = (array)simplexml_load_string(file_get_contents("php://input"));
    					break;
    
    				case 'application/yaml':
    					$this->parameter = YAML::parse(file_get_contents("php://input"));
    					break;
    
    				default:
    					// Unknown content type
    					throw new \LogicException('HTTP-POST with unknown content type: ' . $contenttype);
    			}
    
    	}
    
    
    
    	/**
    	 * Ermittelt den Inhalt der gew�nschten Request-Variablen.
    	 * Falls nicht vorhanden, wird "" zur�ckgegeben.
    	 *
    	 * @param String $varName Schl�ssel
    	 * @return String Inhalt
    	 */
    	protected function getValue($varName)
    	{
    		if   ( ! $this->hasKey($varName) )
    			return null;
    
    		return $this->parameter[$varName];
    	}
    
    	protected function requireVar( $varName )
    	{
    		if   ( ! $this->hasKey($varName) )
    			throw new ValidationException( $varName );
    
    		return;
    	}
    
    
    	public function getAlphanum($varName ) {
    		return Text::clean( $this->getValue($varName), 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789.,_-!?%&/()' );
    	}
    
    
    	public function getFilename($varName ) {
    
    		// RFC 1738, Section 2.2:
    		// Thus, only alphanumerics, the special characters "$-_.+!*'(),", and
    		// reserved characters used for their reserved purposes may be used
    		// unencoded within a URL.
    		return Text::clean( $this->getValue($varName), 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789$-_.+!*(),\'' );
    	}
    
    
    	/**
    	 * Gets a mail adress out of the request.
    	 *
    	 * Throws a ValidationException if the mail adress is not valid.
    	 *
    	 * @param $varName
    	 * @return String
    	 */
    	public function getValidMail($varName ) {
    
    		$adress = Text::clean( $this->getValue($varName), 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789._-+@' );
    
    		if   ( ! Mail::checkAddress( $adress ) )
    			throw new ValidationException( $varName );
    
    		return $adress;
    	}
    
    
    	public function getRaw($varName ) {
    		return $this->getValue( $varName );
    	}
    
    
    	/**
    	 * Get required parameter value.
    	 *
    	 * @param $varName
    	 * @return String|null
    	 * @throws ValidationException
    	 */
    	public function getRequiredRaw($varName ) {
    
    		$this->requireVar( $varName );
    
    		return $this->getValue( $varName );
    	}
    
    
    	/**
    	 * @param $varName
    	 * @return string|null
    	 */
    	public function getText( $varName ) {
    
    		if   ( ! $this->hasKey($varName ))
    			return null;
    
    		// Allow all UTF-8 characters.
    		return mb_convert_encoding($this->getValue($varName), 'UTF-8', 'UTF-8');
    	}
    
    
    	/**
    	 * @param $varName string name of request parameter
    	 * @param $callback callable only called if the request parameter is given by the client
    	 */
    	public function handleText( $varName,$callback ) {
    
    		if   ( $this->hasKey($varName ) )
    			call_user_func( $callback, $this->getText($varName) );
    	}
    
    	/**
    	 * @param $varName
    	 * @param $callback
    	 */
    	public function handleNumber( $varName,$callback ) {
    
    		if   ( $this->hasKey($varName ) )
    			call_user_func( $callback, $this->getNumber($varName) );
    	}
    
    	/**
    	 * @param $varName
    	 * @param $callback
    	 */
    	public function handleBool($varName, $callback ) {
    
    		call_user_func( $callback, $this->isTrue($varName) );
    	}
    
    
    	/**
    	 * Gets the value of the request parameter.
    	 *
    	 * @param $nameOfRequestParameter
    	 * @return String
    	 * @throws ValidationException
    	 */
    	public function getRequiredText( $nameOfRequestParameter ) {
    
    		$this->requireVar( $nameOfRequestParameter );
    
    		return $this->getText( $nameOfRequestParameter );
    	}
    
    
    
    	/**
    	 * Gets the value of the request parameter.
    	 *
    	 * @param $nameOfRequestParameter
    	 * @return String
    	 * @throws ValidationException
    	 */
    	public function getNotEmptyText( $nameOfRequestParameter ) {
    
    		if   ( $value = $this->getRequiredText( $nameOfRequestParameter ) )
    			return $value;
    		else
    			return new ValidationException( $nameOfRequestParameter );
    	}
    
    
    
    	/**
    	 * Checks if the request contains the parameter.
    	 *
    	 * @param String $varName Schl�ssel
    	 * @return boolean true, falls vorhanden.
    	 */
    	protected function hasKey($varName)
    	{
    		return isset( $this->parameter[$varName] );
    	}
    
    
    	/**
    	 * Gets the ID for the current action.
    	 *
    	 * @return Integer
    	 */
    	public function getId()
    	{
    		return $this->id;
    	}
    
    
    	/**
    	 * Ermittelt die aktuelle Id aus dem Request.<br>
    	 * Um welche ID es sich handelt, ist abh�ngig von der Action.
    	 *
    	 * @param string $varName name of parameter
    	 * @return Integer
    	 */
    	public function getNumber( $varName )
    	{
    		if    ( ! $this->hasKey($varName ))
    			return null;
    
    		return intval($this->getValue( $varName ));
    	}
    
    
    
    
    	/**
    	 * Ermittelt einen Float-Wert aus dem Request.<br>
    	 *
    	 * @param string $varName name of parameter
    	 * @return Float
    	 */
    	public function getFloat( $varName )
    	{
    		if    ( ! $this->hasKey($varName ))
    			return null;
    
    		return floatval($this->getValue( $varName ));
    	}
    	/**
    	 * Checks if the parameter value is true.
    	 *
    	 * @param string $varName name of parameter
    	 * @return Integer
    	 */
    	public function isTrue( $varName )
    	{
    		return in_array( $this->getValue($varName),['1','true','on']);
    	}
    
    
    
    
    	/**
    	 * Ermittelt die aktuelle Id aus dem Request.<br>
    	 * Um welche ID es sich handelt, ist abh�ngig von der Action.
    	 *
    	 * @param string $varName name of parameter
    	 * @return Integer
    	 */
    	public function getRequiredNumber($varName )
    	{
    		$this->requireVar( $varName );
    
    		return $this->getNumber( $varName );
    	}
    
    
    	public function getLanguageId()
    	{
    		return $this->getNumber(self::PARAM_LANGUAGE_ID);
    	}
    
    
    	public function getModelId()
    	{
    		return $this->getNumber(self::PARAM_MODEL_ID );
    	}
    
    
    	public function getProjectId()
    	{
    		return $this->getNumber(self::PARAM_PROJECT_ID );
    	}
    
    
    	public function getDatabaseId()
    	{
    		return $this->getAlphanum(self::PARAM_DATABASE_ID );
    	}
    
    
    	public function getToken()
    	{
    		return $this->getAlphanum(self::PARAM_TOKEN );
    	}
    
    
    	public function __toString() {
    		return 'Request '.$this->action.'/'.$this->method.'/'.$this->id;
    	}
    
    
    	/**
    	 * Redirect to a new action and method.
    	 *
    	 * @param $action
    	 * @param $method
    	 */
    	public function redirectActionAndMethod( $action, $method ) {
    
    		$this->action = $action;
    		$this->method = $method;
    	}
    
    
    	/**
    	 * Basic Authorization.
    	 *
    	 * Try login with basic authorization. This is useful for API clients, they to not need to track a session with cookies.
    	 */
    	private function tryBasicAuthorization()
    	{
    		if   ( $auth = @$this->headers['authorization'] ) {
    
    			$this->withAuthorization = true;
    			list( $type,$value ) = array_pad( explode(' ',$auth),2,'');
    			switch( $type ) {
    				case 'Basic':
    					list($this->authUser,$this->authPassword) = array_pad(explode(':',base64_decode( $value )),2,'' );
    					break;
    				case 'API':
    				case 'CMS-API':
    					$this->apiToken = $value;
    				case 'Bearer':
    				case 'JWT':
    					$this->authToken = $value;
    					break;
    				default:
    					// Only supporting Basic Auth and Bearer Auth
    					error_log('Only supporting the authorization schemes Basic, Bearer and API. Authorization header will be ignored.');
    			}
    
    		}
    	}
    
    
    	public function getRawParameters(): array
    	{
    		return $this->parameter;
    	}
    
    	public function toObject(string $class): object
    	{
    		return Hydrator::map( $class,$this->getRawParameters() );
    	}
    }


Download modules/cms/action/RequestParams.class.php

History
Tue, 13 Oct 2026 22:52:59 +0200	Jan Dankert	New: The UI is now able to send hierarchical form data and the server is converting it into an object. This is a very nice feature, because this enables a better OpenAPI interface.
Wed, 4 Jun 2025 22:33:49 +0200	Jan Dankert	Fix: Getting the Request-Id was completly broken for whole UI :-O
Thu, 24 Apr 2025 00:13:35 +0200	Jan Dankert	New: OpenAPI with REST interface for all actions and methods
Mon, 6 Jan 2025 22:48:11 +0100	Jan Dankert	New: Now it is possible to remove and create new login/api token for a user; new API authorization with the authorization scheme "api".
Mon, 22 Apr 2024 22:29:49 +0200	Jan Dankert	Editing coordinates now possible.
Thu, 28 Apr 2022 00:28:24 +0200	Jan Dankert	New: Login with Json webtoken (JWT)
Mon, 25 Apr 2022 03:26:21 +0200	Jan Dankert	New: New Project may be created with sample data.
Fri, 15 Apr 2022 14:51:22 +0200	dankert	Refactoring: User,Config and Database info is now stored in the Request, because so there is no session required for clients which are using Basic Authorization.
Wed, 9 Mar 2022 13:28:52 +0100	dankert	Refactoring: Checkbox values are always sent to the server. In the actions we must test the value with 'isTrue()'
Wed, 9 Mar 2022 00:52:23 +0100	dankert	New: Only save a property if it is send by the client. This is useful using a API, so not sent properties will not be deleted.
Sun, 13 Feb 2022 19:39:49 +0100	dankert	Refactoring: Special output type "preview" for previewing pages and files.
Mon, 7 Feb 2022 21:44:42 +0100	dankert	New: Authenticate API users with the HTTP authorization header.
Mon, 7 Feb 2022 19:48:06 +0100	dankert	New: Support for YAML in request body.
Wed, 17 Nov 2021 23:29:17 +0100	Jan Dankert	Refactoring: New method for redirecting action and method.
Wed, 27 Oct 2021 02:27:59 +0200	Jan Dankert	Refactoring: Splitted the mail client into a.) sendmail and b.) smtp.
Thu, 11 Mar 2021 00:01:47 +0100	Jan Dankert	Refactoring: Cleaned the Request params.
Wed, 10 Mar 2021 23:51:22 +0100	Jan Dankert	Refactoring: Cleaned the Request params.
Sat, 27 Feb 2021 01:07:14 +0100	Jan Dankert	Fix: Request-Id may contain '_'.
Fri, 26 Feb 2021 01:06:01 +0100	Jan Dankert	Refactoring accessing the request parameter values.
Fri, 26 Feb 2021 00:04:49 +0100	Jan Dankert	New: Request may contain JSON,XML in POST data. This is good for API clients.
Thu, 25 Feb 2021 01:22:10 +0100	Jan Dankert	New: Edit all page elements in 1 view.
Sat, 20 Feb 2021 00:49:37 +0100	Jan Dankert	Cleanup of templates.
Sat, 31 Oct 2020 01:19:06 +0100	Jan Dankert	Better logging in the dispatcher.
Tue, 29 Sep 2020 22:17:11 +0200	Jan Dankert	Refactoring: Do not use global constants.
Sat, 26 Sep 2020 21:42:51 +0200	Jan Dankert	Refactoring: The UI Actions are now in their own namespace. No need for a confusing require file.
Sat, 26 Sep 2020 12:20:43 +0200	Jan Dankert	Refactoring: No global variables like $SESS  any more. All constants are capsulated by classes.
Thu, 10 Sep 2020 18:30:16 +0200	Jan Dankert	Some code cleanup, killing the old "checkMenu()"-methods.
Thu, 10 Sep 2020 18:02:54 +0200	Jan Dankert	The dispatcher is now able to call the action methods with parameters.
Sun, 23 Feb 2020 04:01:30 +0100	Jan Dankert	Refactoring with Namespaces for the cms modules, part 1: moving.