Merge pull request #682 from ArthurHoaro/delete-button

Bugfixes on link deletion, and use a GET form

diff --combined index.php
index bb1debd3f515bcd5bf2a3b892b3b60890812c092,34f0e3817782b288f59fab89114ce6a1dde07ede..2ed14d4f2f3ac67ed6bd5e041fc434b27a7aa050
--- 1/index.php
--- 2/index.php
+++ b/index.php
@@@ -175,6 -175,7 +175,6 @@@ define('STAY_SIGNED_IN_TOKEN', sha1($co
  if (isset($_SERVER['HTTP_ACCEPT_LANGUAGE'])) {
      autoLocale($_SERVER['HTTP_ACCEPT_LANGUAGE']);
  }
 -header('Content-Type: text/html; charset=utf-8'); // We use UTF-8 for proper international characters handling.
  
  /**
   * Checking session state (i.e. is the user still logged in)
@@@ -730,10 -731,17 +730,10 @@@ function showLinkList($PAGE, $LINKSDB, 
   *
   * @param ConfigManager $conf          Configuration Manager instance.
   * @param PluginManager $pluginManager Plugin Manager instance,
 + * @param LinkDB        $LINKSDB
   */
 -function renderPage($conf, $pluginManager)
 +function renderPage($conf, $pluginManager, $LINKSDB)
  {
 -    $LINKSDB = new LinkDB(
 -        $conf->get('resource.datastore'),
 -        isLoggedIn(),
 -        $conf->get('privacy.hide_public_links'),
 -        $conf->get('redirector.url'),
 -        $conf->get('redirector.encode_url')
 -    );
 -
      $updater = new Updater(
          read_updates_file($conf->get('resource.updates')),
          $LINKSDB,
@@@ -910,6 -918,10 +910,6 @@@
          $feedGenerator->setLocale(strtolower(setlocale(LC_COLLATE, 0)));
          $feedGenerator->setHideDates($conf->get('privacy.hide_timestamps') && !isLoggedIn());
          $feedGenerator->setUsePermalinks(isset($_GET['permalinks']) || !$conf->get('feed.rss_permalinks'));
 -        $pshUrl = $conf->get('config.PUBSUBHUB_URL');
 -        if (!empty($pshUrl)) {
 -            $feedGenerator->setPubsubhubUrl($pshUrl);
 -        }
          $data = $feedGenerator->buildData();
  
          // Process plugin hook.
@@@ -926,7 -938,7 +926,7 @@@
          exit;
      }
  
 -    // Display openseach plugin (XML)
 +    // Display opensearch plugin (XML)
      if ($targetPage == Router::$PAGE_OPENSEARCH) {
          header('Content-Type: application/xml; charset=utf-8');
          $PAGE->assign('serverurl', index_url($_SERVER));
@@@ -1130,8 -1142,6 +1130,8 @@@
              $conf->set('feed.rss_permalinks', !empty($_POST['enableRssPermalinks']));
              $conf->set('updates.check_updates', !empty($_POST['updateCheck']));
              $conf->set('privacy.hide_public_links', !empty($_POST['hidePublicLinks']));
 +            $conf->set('api.enabled', !empty($_POST['apiEnabled']));
 +            $conf->set('api.secret', escape($_POST['apiSecret']));
              try {
                  $conf->write(isLoggedIn());
              }
@@@ -1160,8 -1170,6 +1160,8 @@@
              $PAGE->assign('enable_rss_permalinks', $conf->get('feed.rss_permalinks', false));
              $PAGE->assign('enable_update_check', $conf->get('updates.check_updates', true));
              $PAGE->assign('hide_public_links', $conf->get('privacy.hide_public_links', false));
 +            $PAGE->assign('api_enabled', $conf->get('api.enabled', true));
 +            $PAGE->assign('api_secret', $conf->get('api.secret'));
              $PAGE->renderPage('configure');
              exit;
          }
@@@ -1285,6 -1293,7 +1285,6 @@@
  
          $LINKSDB[$id] = $link;
          $LINKSDB->save($conf->get('resource.page_cache'));
 -        pubsubhub($conf);
  
          // If we are called from the bookmarklet, we must close the popup:
          if (isset($_GET['source']) && ($_GET['source']=='bookmarklet' || $_GET['source']=='firefoxsocialapi')) {
@@@ -1316,21 -1325,21 +1316,21 @@@
      }
  
      // -------- User clicked the "Delete" button when editing a link: Delete link from database.
-     if (isset($_POST['delete_link']))
+     if ($targetPage == Router::$PAGE_DELETELINK)
      {
-         if (!tokenOk($_POST['token'])) die('Wrong token.');
- 
          // We do not need to ask for confirmation:
          // - confirmation is handled by JavaScript
          // - we are protected from XSRF by the token.
  
-         // FIXME! We keep `lf_linkdate` for consistency before a proper API. To be removed.
-         $id = isset($_POST['lf_id']) ? intval(escape($_POST['lf_id'])) : intval(escape($_POST['lf_linkdate']));
- 
-         $pluginManager->executeHooks('delete_link', $LINKSDB[$id]);
+         if (! tokenOk($_GET['token'])) {
+             die('Wrong token.');
+         }
  
+         $id = intval(escape($_GET['lf_linkdate']));
+         $link = $LINKSDB[$id];
+         $pluginManager->executeHooks('delete_link', $link);
          unset($LINKSDB[$id]);
-         $LINKSDB->save('resource.page_cache'); // save to disk
+         $LINKSDB->save($conf->get('resource.page_cache')); // save to disk
  
          // If we are called from the bookmarklet, we must close the popup:
          if (isset($_GET['source']) && ($_GET['source']=='bookmarklet' || $_GET['source']=='firefoxsocialapi')) { echo '<script>self.close();</script>'; exit; }
@@@ -1601,8 -1610,8 +1601,8 @@@
  function buildLinkList($PAGE,$LINKSDB, $conf, $pluginManager)
  {
      // Used in templates
 -    $searchtags = !empty($_GET['searchtags']) ? escape($_GET['searchtags']) : '';
 -    $searchterm = !empty($_GET['searchterm']) ? escape($_GET['searchterm']) : '';
 +    $searchtags = !empty($_GET['searchtags']) ? escape(normalize_spaces($_GET['searchtags'])) : '';
 +    $searchterm = !empty($_GET['searchterm']) ? escape(normalize_spaces($_GET['searchterm'])) : '';
  
      // Smallhash filter
      if (! empty($_SERVER['QUERY_STRING'])
@@@ -1649,7 -1658,7 +1649,7 @@@
          } else {
              $link['updated_timestamp'] = '';
          }
 -        $taglist = explode(' ', $link['tags']);
 +        $taglist = preg_split('/\s+/', $link['tags'], -1, PREG_SPLIT_NO_EMPTY);
          uasort($taglist, 'strcasecmp');
          $link['taglist'] = $taglist;
          // Check for both signs of a note: starting with ? and 7 chars long.
@@@ -1945,14 -1954,6 +1945,14 @@@ function install($conf
              $conf->set('general.title', 'Shared links on '.escape(index_url($_SERVER)));
          }
          $conf->set('updates.check_updates', !empty($_POST['updateCheck']));
 +        $conf->set('api.enabled', !empty($_POST['enableApi']));
 +        $conf->set(
 +            'api.secret',
 +            generate_api_secret(
 +                $conf->get('credentials.login'),
 +                $conf->get('credentials.salt')
 +            )
 +        );
          try {
              // Everything is ok, let's create config file.
              $conf->write(isLoggedIn());
@@@ -2215,32 -2216,4 +2215,32 @@@ if (isset($_SERVER['QUERY_STRING']) && 
  if (!isset($_SESSION['LINKS_PER_PAGE'])) {
      $_SESSION['LINKS_PER_PAGE'] = $conf->get('general.links_per_page', 20);
  }
 -renderPage($conf, $pluginManager);
 +
 +$linkDb = new LinkDB(
 +    $conf->get('resource.datastore'),
 +    isLoggedIn(),
 +    $conf->get('privacy.hide_public_links'),
 +    $conf->get('redirector.url'),
 +    $conf->get('redirector.encode_url')
 +);
 +
 +$container = new \Slim\Container();
 +$container['conf'] = $conf;
 +$container['plugins'] = $pluginManager;
 +$app = new \Slim\App($container);
 +
 +// REST API routes
 +$app->group('/api/v1', function() {
 +    $this->get('/info', '\Shaarli\Api\Controllers\Info:getInfo');
 +})->add('\Shaarli\Api\ApiMiddleware');
 +
 +$response = $app->run(true);
 +// Hack to make Slim and Shaarli router work together:
 +// If a Slim route isn't found, we call renderPage().
 +if ($response->getStatusCode() == 404) {
 +    // We use UTF-8 for proper international characters handling.
 +    header('Content-Type: text/html; charset=utf-8');
 +    renderPage($conf, $pluginManager, $linkDb);
 +} else {
 +    $app->respond($response);
 +}