Last commit: Sat Oct 17 03:14:01 2026 +0200	Jan Dankert	stacktrace may contain HTML chars,so we have to escape them.


      <?php
      
      namespace cms\output;
      
      use BadMethodCallException;
      use cms\action\RequestParams;
      use cms\base\Configuration;use cms\base\Language as L;
      use cms\base\Startup;use cms\Dispatcher;
      use cms\output\BaseOutput;
     use Exception;
     use template_engine\engine\TemplateRunner;
     use util\Http;
     use logger\Logger;
     use LogicException;
     use \util\exception\ObjectNotFoundException;
     use util\exception\UIException;
     use util\exception\SecurityException;
     use template_engine\engine\TemplateEngine;
     use util\Request;use util\Session;use util\text\TextMessage;
     
     
     /**
      * The HTML output is calling a template for the user interface.
      */
     class UIOutput extends BaseOutput
     {
         /**
          * Preparing the client...
          */
         protected  function beforeAction($request)
     	{
     		// Sending the Content-Security-Policy.
     		self::setContentSecurityPolicy();
     
     		if   ( @$_REQUEST['scope']=='openid' ) {
     			$request->redirectActionAndMethod('login','oidc');
     		}
     		elseif (empty($request->action)) {
     			$request->redirectActionAndMethod('index','show' );
     		}
     
     		if   ( $request->isAction )
     			throw new \RuntimeException('The HTML output driver does not accept POST requests');
     
         }
     
     
     
         protected function outputData($request, $data): void
         {
             // The action is able to change its method and action name.
             $subaction = $request->method;
             $action    = $request->action;
     
     
             $this::outputTemplate($request,$action, $subaction, $data );
         }
     
     
     
     	/**
     	 * Sets the timezone so that dates in the UI are displayed in the correct timezone.
     	 */
     	protected static function setTimezone() {
     
     		if   ( $timezone = self::getCustomTimezone() ) {
     
     			date_default_timezone_set( $timezone );
     
     			if   ( DEVELOPMENT )
     				header('X-OR-custom-timezone: '.$timezone );
     		}
     
     		// Default: Unchanged, so /etc/timezone or /etc/localtime is used by PHP.
     	}
     
     
     	/**
     	 * Gets the custom timezone of the user or the configured timezone.
     	 */
     	protected static function getCustomTimezone() {
     
     		$user = Request::getUser(); // the user timezone has precedence.
     		if   ( $user && $user->timezone && in_array( $user->timezone,timezone_identifiers_list() ) ) // user is set and a timezone is set and timezone is valid
     			return( $user->timezone ); // Timezone from user setting
     		elseif ( $configuredTimezone = Configuration::subset('ui')->get('timezone') )
     			return $configuredTimezone; // Timezone from configuration
     
     		return  null;
     	}
     
     
     	/**
     	 * Executes and outputs an HTML template.
     	 *
     	 * @param $request RequestParams
     	 * @param $action string action
     	 * @param $subaction string method
     	 * @param $outputData array Output data
    	 */
        private static function outputTemplate($request, $action, $subaction, $outputData)
        {
    		$outputData += [
    			// the following special data is used in FormComponent for filling the form.
    			'_id'    => $request->id,
    			'_token' => Session::token(),
    		];
    
            $templateFile = Startup::MODULE_DIR . 'cms/ui/themes/default/html/views/' . $action.'/'.$subaction . '.php';
    
    		self::setTimezone();
    
    		if   ( DEVELOPMENT ) {
    			header('X-OR-Template: '.$templateFile               );
    
    			$outputDataClone = $outputData;
    			array_walk_recursive($outputDataClone, function(&$v) {
    				if   ( ! $v )
    					return $v;
    				$v = htmlspecialchars($v);
    			});
    			//array_walk_recursive($outputDataClone, function(&$v) { if(is_string($v)) $v = htmlspecialchars($v); });
    			echo "<!-- Output:\n\n".print_r($outputDataClone,true)."\n\n-->";
    		}
    
            $engine = new TemplateRunner();
            //$engine->request = $request;
            $engine->executeTemplate( $templateFile, $outputData );
        }
    
    
        /**
         * Content-Security-Policy.
         */
        private static function setContentSecurityPolicy()
        {
            // config is not loaded yet. Allow nothing...
            header('Content-Security-Policy: default-src \'none\'' );
    
            // This will be overwritten by the index action
        }
    
    
    	/**
    	 * @param string $text
    	 * @param $cause Exception the cause, or <code>null</code> if not available.
    	 */
    	protected function setError(string $text, Exception $cause):void
    {
    		if ( !headers_sent() )
    			// The following HTML contains inline CSS code, so we have to allow inline CSS.
    			header('Content-Security-Policy: style-src: inline; default: self');
    
    ?><!DOCTYPE html>
    <html lang="en">
    <head>
        <meta charset="utf-8"/>
        <meta name="viewport" content="width=device-width, initial-scale=1"/>
        <title><?php echo $text ?></title>
        <style type="text/css">
    
            header, main {
                display: block
            }
    
            body {
                width: 100%;
                height: 100%;
                background-color: rgba(13,8,5,0.58);
                color: white;
                font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, Helvetica, Arial, sans-serif, "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI Symbol";
                line-height: 1.4;
                font-size: 1.5em;
                text-align: center;
            }
    
            pre {
                margin:10%;
                width: 80%;
                overflow: visible;
                height: 40%;
                color: silver;
                text-align: left;
                font-size: 0.6rem;
            }
    
            h1 {
                font-size: 2em;
            }
    </style>
    </head>
    <body>
    
    <header>
        <h1 id="cms-error-message"><?php echo $text ?></h1>
    </header>
    
    <main>
        <p>Something went terribly wrong &#x1F61E;</p>
    
        <pre id="cms-error-log"><?php // Display exceptions only in development mode, because they may contain sensitive internal information like passwords.
          if ($cause) {
    		if (defined('DEVELOPMENT') && DEVELOPMENT  ) {
    		  echo htmlentities($cause->__toString());
    		}
    		else {
    			while (true) {
    				echo($cause->getMessage());
    				$previous = $cause->getPrevious();
    				if ($previous) {
    					echo "\n\n" . 'Caused by:'."\n";
    					$cause = $previous;
    				} else
    					break;
    			}
    		}
    	  }
        ?></pre>
    </main>
    
    </body>
    </html><?php
    
    	}
    
    	public function getContentType(): string|null
    	{
    		return 'text/html';
    	}
    }


Download modules/cms/output/UIOutput.class.php

History
Sat, 17 Oct 2026 03:14:01 +0200	Jan Dankert	stacktrace may contain HTML chars,so we have to escape them.
Sat, 17 Oct 2026 01:14:30 +0200	Jan Dankert	New: Using a structured class for the API-Response. The output for GET-Requests is now without the "output" layer.
Tue, 13 Oct 2026 13:38:43 +0200	Jan Dankert	PHP8: Some fixes for PHP8.
Tue, 14 Jan 2025 01:27:20 +0100	Jan Dankert	Fix: Debug output should be human readable.
Mon, 13 Feb 2023 22:46:58 +0100	Jan Dankert	Show server error messages in the UI notice window.
Sat, 28 Jan 2023 19:10:47 +0100	Jan Dankert	New: Templates may be rendered as Mustache, Script and Script template.
Fri, 15 Apr 2022 14:51:22 +0200	dankert	Refactoring: User,Config and Database info is now stored in the Request, because so there is no session required for clients which are using Basic Authorization.
Fri, 18 Mar 2022 00:30:30 +0100	dankert	Fix: Test if stored timezone value is valid in the actual server environment.
Tue, 15 Mar 2022 20:00:51 +0100	dankert	Deleted commented code.
Fri, 11 Mar 2022 19:33:58 +0100	dankert	Better solution to escape the output data.
Fri, 11 Mar 2022 19:25:58 +0100	dankert	Fix: HTML in Comments must be escaped.
Wed, 9 Mar 2022 01:57:45 +0100	dankert	Fix: Do not write the language to a cookie.
Wed, 9 Mar 2022 00:53:10 +0100	dankert	Fix: Setting the correct timezone from the user property.
Mon, 14 Feb 2022 00:06:35 +0100	dankert	Documentation...
Mon, 14 Feb 2022 00:01:10 +0100	dankert	Fix: UI needs output data "_token" and "_id".
Sun, 13 Feb 2022 19:39:49 +0100	dankert	Refactoring: Special output type "preview" for previewing pages and files.