CRM-15928, Added code to create qfkey for profile on the basis of global settings

diff --git a/CRM/Admin/Form/Setting/Miscellaneous.php b/CRM/Admin/Form/Setting/Miscellaneous.php
index 762d8b346807d011af75df47d39c5fe98bca15fe..8ad66345c20a1bf48823ce9d6e9ee6c5dbf08987 100644 (file)
--- a/CRM/Admin/Form/Setting/Miscellaneous.php
+++ b/CRM/Admin/Form/Setting/Miscellaneous.php
@@ -52,6 +52,7 @@ class CRM_Admin_Form_Setting_Miscellaneous extends CRM_Admin_Form_Setting {
     'recentItemsMaxCount' => CRM_Core_BAO_Setting::SYSTEM_PREFERENCES_NAME,
     'recentItemsProviders' => CRM_Core_BAO_Setting::SYSTEM_PREFERENCES_NAME,
     'dedupe_default_limit' => CRM_Core_BAO_Setting::SYSTEM_PREFERENCES_NAME,
+    'allow_profile_html_snippet' => CRM_Core_BAO_Setting::SYSTEM_PREFERENCES_NAME,
   );
 
   public $_uploadMaxSize;

diff --git a/CRM/Profile/Page/Router.php b/CRM/Profile/Page/Router.php
index a9b6ab2b3712e367e4fea45d167e87f2c252dab2..4d3288842af71bdfb045b2a04d02f631a23db115 100644 (file)
--- a/CRM/Profile/Page/Router.php
+++ b/CRM/Profile/Page/Router.php
@@ -98,10 +98,11 @@ class CRM_Profile_Page_Router extends CRM_Core_Page {
 
     if ($secondArg == 'edit' || $secondArg == 'create') {
       if ($secondArg == 'edit') {
+        $allowHtmlSnippet = Civi::settings()->get('allow_profile_html_snippet');
         $controller = new CRM_Core_Controller_Simple('CRM_Profile_Form_Edit',
           ts('Create Profile'),
           CRM_Core_Action::UPDATE,
-          FALSE, FALSE, TRUE
+          FALSE, FALSE, $allowHtmlSnippet
         );
         $controller->set('edit', 1);
         $controller->process();
@@ -113,7 +114,7 @@ class CRM_Profile_Page_Router extends CRM_Core_Page {
           ts('Create Profile'),
           array(
             'mode' => CRM_Core_Action::ADD,
-            'ignoreKey' => TRUE,
+            'ignoreKey' => $allowHtmlSnippet,
           )
         );
       }

diff --git a/CRM/UF/Page/Group.php b/CRM/UF/Page/Group.php
index 82b7dd8b488bd5e8ae802b2667b0d9df095fe6cf..facff57a4f9ac37b06e7065f545916b54648c624 100644 (file)
--- a/CRM/UF/Page/Group.php
+++ b/CRM/UF/Page/Group.php
@@ -118,12 +118,6 @@ class CRM_UF_Page_Group extends CRM_Core_Page {
           'qs' => 'action=delete&id=%%id%%',
           'title' => ts('Delete CiviCRM Profile Group'),
         ),
-        CRM_Core_Action::PROFILE => array(
-          'name' => ts('HTML Form Snippet'),
-          'url' => 'civicrm/admin/uf/group',
-          'qs' => 'action=profile&gid=%%id%%',
-          'title' => ts('HTML Form Snippet for this Profile'),
-        ),
         CRM_Core_Action::COPY => array(
           'name' => ts('Copy'),
           'url' => 'civicrm/admin/uf/group',
@@ -132,6 +126,15 @@ class CRM_UF_Page_Group extends CRM_Core_Page {
           'extra' => 'onclick = "return confirm(\'' . $copyExtra . '\');"',
         ),
       );
+      $allowHtmlSnippet = Civi::settings()->get('allow_profile_html_snippet');
+      if ($allowHtmlSnippet) {
+        self::$_actionLinks[CRM_Core_Action::PROFILE] = array(
+          'name' => ts('HTML Form Snippet'),
+          'url' => 'civicrm/admin/uf/group',
+          'qs' => 'action=profile&gid=%%id%%',
+          'title' => ts('HTML Form Snippet for this Profile'),
+        );
+      }
     }
     return self::$_actionLinks;
   }

diff --git a/CRM/Upgrade/Incremental/php/FourSeven.php b/CRM/Upgrade/Incremental/php/FourSeven.php
index 9988e9c6d696a245578e5fd3070d32eeb2c566ce..d1d2bce59e3c00c76ba99f496cc9af607de85f60 100644 (file)
--- a/CRM/Upgrade/Incremental/php/FourSeven.php
+++ b/CRM/Upgrade/Incremental/php/FourSeven.php
@@ -99,6 +99,9 @@ class CRM_Upgrade_Incremental_php_FourSeven extends CRM_Upgrade_Incremental_Base
 
       $postUpgradeMessage .= '<p>' . ts('The custom fatal error template setting has been removed.') . '</p>';
     }
+    if ($rev == '4.7.9') {
+      $postUpgradeMessage .= '<br /><br />' . ts("WARNING: To improve security, HTML snippets for profiles are no longer allowed to create or edit data by default. If you need to allow users to submit profiles using HTML snippets, you can enable by going to Administer > System Settings > Misc (Undelete, PDFs, Limits, Logging, Captcha, etc.) and clicking to enable 'Override security by accepting unauthenticated posts from other sites?");
+    }
   }
 
   /**

diff --git a/settings/Core.setting.php b/settings/Core.setting.php
index babe57747df05700efc0efcf98c6ca6dc6a8c9d8..de65a3e91fe82e1bb93b333a3e290118093df8d1 100644 (file)
--- a/settings/Core.setting.php
+++ b/settings/Core.setting.php
@@ -176,6 +176,21 @@ return array(
     'description' => NULL,
     'help_text' => NULL,
   ),
+  'allow_profile_html_snippet' => array(
+    'group_name' => 'CiviCRM Preferences',
+    'group' => 'core',
+    'name' => 'allow_profile_html_snippet',
+    'type' => 'Boolean',
+    'quick_form_type' => 'YesNo',
+    'default' => FALSE,
+    'html_type' => 'radio',
+    'add' => '4.7',
+    'title' => 'Allow Profile Html Snippet',
+    'is_domain' => 1,
+    'is_contact' => 0,
+    'description' => 'This settings allows to enable HTML snippet for profile.',
+    'help_text' => NULL,
+  ),
   'editor_id' => array(
     'group_name' => 'CiviCRM Preferences',
     'group' => 'core',

diff --git a/templates/CRM/Admin/Form/Setting/Miscellaneous.tpl b/templates/CRM/Admin/Form/Setting/Miscellaneous.tpl
index 32125f896663a7ffd3040e4bad4858b3a2b1cba7..234f6a95369366ef6491cb7fcf9e98e5b23ec7c1 100644 (file)
--- a/templates/CRM/Admin/Form/Setting/Miscellaneous.tpl
+++ b/templates/CRM/Admin/Form/Setting/Miscellaneous.tpl
@@ -73,6 +73,23 @@
             </td>
           </tr>
         {/foreach}
+        </tr>
+        <tr class="crm-miscellaneous-form-block-recentItemsMaxCount">
+            <td class="label">{$form.recentItemsMaxCount.label}</td>
+            <td>{$form.recentItemsMaxCount.html}<br />
+                <span class="description">{$recentItemsMaxCount_description}</span></td>
+        </tr>
+        <tr class="crm-miscellaneous-form-block-recentItemsProviders">
+            <td class="label">{$form.recentItemsProviders.label}</td>
+            <td>{$form.recentItemsProviders.html}<br />
+                <span class="description">{$recentItemsProviders_description}</span></td>
+        </tr>
+        <tr class="crm-miscellaneous-form-block-allow_profile_html_snippet">
+          <td class="label">{$form.allow_profile_html_snippet.label}</td>
+          <td>{$form.allow_profile_html_snippet.html}<br />
+            <p class="description">{ts}If enabled, CiviCRM will allow users to submit profiles using HTML snippets.{/ts}</p>
+          </td>
+        </tr>
 
     </table>
 <h3>{ts}reCAPTCHA Keys{/ts}</h3>