Hi everybody
Those of you who keep track of the changesets may have notices that I created a branch to re-write the addressbook interface. I also made some code cleanup and moved some functions around. I'm sure that you gonna hate me for that but I think it's worth it :-)
The changeset is quite big so here's an overview what changed:
- Created a new class rcube_contacts that abstracts the acess to the
local address book. Another class with the same interface is on the way to handle the LDAP access.
- Moved template parsing functions to a new class rcmail_template
which extends the rcube_html_page class. The global object $OUTPUT is now an instance of rcmail_template.
- Replaced all $OUTPUT->add_script("$JS_OBJECT_NAME.set_env('foo',
'$bar');"); with the more elegant $OUTPUT->set_env('foo', $bar); Now also conditional template objects can access the env vars.
- Got rid of the global vars $JS_OBJECT_NAME and $CHARSET. Those have
been replaced by constans because they actually are constant values.
- Moved simple steps (html2text and quotaimg) out of the common
request process and created simple scripts in /bin/. These do not nead any user authentication or session values.
- Started to send POST requests from the client for actions that alter
data. Changing application states with GET is against RFC and allows for CSRF vulnerabilities. e.g. if someone were to email an RC user with: <img src="?_task=addressbook&_action=delete&_cid=1&_from=&_remote=1"> Then a contact would be deleted.
Please check out the new branch from https://svn.roundcube.net/branches/devel-addressbook and test it. Don't replace an existing (productive) installation with it.
Comments about the changes and the new classes are welcome.
Regards, Thomas