Customizing the backend interface

Michel Gagnon

Hello,

I am currently involved in a new project where Zenphoto would become the base for equipment selection. Apart from photos, there would be information on price, technical modifications, training, etc. I'm thinking of using the "Custom Data" and CodeBlock 1, 2, 3..." fields for that, but I need to remember what information needs to go where. Hence my question.

Is it possible to customize the name of those fields, and what would be the best way to do so? My approach would be to design a "theme page" so the relevant Edit pages are loaded with the proper description.
So do I add a theme page for the page:
zenphoto/zp-core/admin-edit.php?page=edit&album=xxx
And how do I link it?

Is it the suggested approach or is there a better approach? I do not want to change the overall look and feel of the administrative interface.

Thanks.

acrylian

Yes and no. There is no easy way to customize those display names.

The way to go is actually to use filters to either divide it via serialisation of the content or add add new fields you then could store within the plugin_storage table.

You can also add fields, all kind of form elements, to the sidebar boxes (the multiple_layouts plugin for example does it with a drop down selector. My sideways plguin "featured_images" does it with a button.

Info on those filters here:
http://www.zenphoto.org/news/zenphoto-plugin-architecture#admin-filters
Beware that this is a bit more advanced coding.

sbillard

You may also be interested in a new feature available in 1.4.6 that allows a plugin to create custom database fields. This technique is now used to add the User Address fields for administrators. See the `userAddressFields` plugin for details.

If you can wait for the 1.4.6 release this would be a much better approach. The plugin can also add functions to handle the display of the data. A nice clean, encapsulated approach with little chance of conflicting with other plugins or theme uses of the custom data field.

Michel Gagnon

Thanks. Acrylian's answer is a bit the kind of answer that I dreaded.
I will probably use the 1.4.6 Development release, as I still have lots of background work to do on XAMPP before we release it publicly. It will also allow me to fine-tune the translation.

pju_photo

Hey, just chiming in. I'm currently working on a plugin that could help you with what I think you want to do.

This is very barebones but functional. You can create and delete your own custom data fields. So far, only textbox, textarea and checkbox inputs are possible, but more are coming up.

BIG WARNING: Inputs are not really tested for security yet. So depending on who can use your backend this might be a big no go.

Feel free to check it out on github here: https://github.com/pju-/advanced_custom_data

If you have any questions, just let me know.

The new feature about plugins being able to create custom database fields sounds great btw. I guess I'll have to rewrite to accommodate to that.

acrylian

I guess I should add an entry to our extensions page.

pju_photo

I'd rather you wait a little with that. This really isn't quite ready yet, I'd need to do some cleanup first. Btw it would be great if someone with a bit more knowledge had some time and could have a look at it, especially security/input sanitation wise. I'm in over my head with this one, just learning by doing.

acrylian

Ok. I already downloaded it and will try to take a look some time later. I meant to do a similar plugin myself but never got to it.

Michel Gagnon

I will take a look at it. I am not an expert on database programming, so I will probably be of better help doing the testing, proofreading, translating and other things like that.

One question about security: the number of people who have access to the back end will be very limited at the beginning (i.e. myself and 1-2 other people). The number of people who may upload pages and photos will increase, but it won't be "everyone" in the foreseeable future. So my security concern would be the following: Does it open a backdoor where any attacker (non-member, non-user) could corrupt the website?

sbillard

IF the users can "edit" images and albums then they can insert codeblocks and the like. Those could have malicious code if the users are not trustworthy.

The 1.4.6 release will tighten up these things. No scripts will be allowed in "normal" text fields and Codeblocks will have their own "rights" so that you can withhold them from your users.

We believe that we have good protection for XSRF attacks, so your users do not have to be "super careful". Still if they do not practice secure management of their computer someone could get to it and then have access to whatever you have allowed the user to do on your site.

Michel Gagnon

OK I see. Basically, I have a 1-2 month development period on XAMPP, then it's probably another 2-3 months when it will be online but with only one authorized user (me). So if I start granting upload access to trusted people in June (or maybe delay it to September) that probably leaves enough time for 1.4.6 safety measures to land.

sbillard

I expect 1.4.6 to be out by June. We are not making new implementations on it, but there have been some significant changes and consolidations, so we are also not in a hurry to release it.

Of course your testing and feedback would be greatly appreciated!