SID-02091: Programmatically change form field via POST call

Status:	Answered	TWiki version:	6.0.0	Perl version:	Perl 5.10.1
Category:	CategoryApplications	Server OS:	RedHat	Last update:	10 years ago

Hi, I was wondering if there is any way to change a topic content by using a POST call (i.e. via Javascript). I've been struggling while trying to implement this, and I got stuck with the crypttoken thing (which I don't want to disable). It seems there is no way to manually generate the crypttoken.

The reason for this is that the 'save' script called via an HTML form works great, but has the annoying side effect of causing the page to reload.

Being able to change a TWiki form field via a POST call would allow, for example, the use of AJAX calls.

I encountered this problem while trying to implement the "number of views" feature for a topic.

-- Thomas Fozzi - 2015-07-22

Discussion and Answer

If you want to keep the crypttoken enabled for security you need to issue two Ajax call, one to get a crypttoken, one to do a post.

1. Create a utility topic that generates a crypttoken:

This is simply an empty HTML form that calls the save script:

<form action="%SCRIPTURLPATH{save}%/%WEB%/%TOPIC%" method="post">
</form>

TWiki will render this and will insert a hidden input field called crypttoken, such as:

<form action="%SCRIPTURLPATH{save}%/%WEB%/%TOPIC%" method="post">
<input type="hidden" name="crypttoken" value="0093eb1191ed76dbef45decd5480d971" />
</form>

2. Do first Ajax call to get the crypttoken:

Do your first call to get the utility topic with the form. Extract the crypttoken from input field using JavaScript.

3. Do second Ajax call to post content:

In your http post, add a crypttoken parameter with the value you got from the first call.

Note: For added security consider using access control for the utility topic so that nobody else can highjack the crypttokens. Your first Ajax call would need to authenticate.

-- Peter Thoeny - 2015-07-22

Hi Peter,

thank you for the super detailed answer. The crypttoken trick looks very useful to implement APIs.

Unfortunately, thinking better to my problem, it doesn't seem a great idea to keep the topic views number by using a field of his own form. This is because the topic is not public writable.

Facts:

• I want to count the views of a topic which is public readable, but not public writable (including its form)
• I'm using cookies to ignore multiple views from the same user (using IP would not work for different users connecting through the same gateway)
• the only TWiki script which doesn't require authentication is 'view'

So far the most promising solution seems the SetGetPlugin, using variables in permanent mode to store the number of views for each topic. The only step missing is to be able to update such variable from client-side, i.e. via Javascript, that is after any TWiki variable has been rendered. I can't use a REST call because that I would require to authenticate. I guess a possible solution could be an AJAX call to a utility topic which only contains the SET command.

More specifically these woudl be the steps in Javascript:

1. check if the cookie is present (if it's present there's nothign to do)
2. if the cookie is not present AJAX call to the utility topic which updates the variable
3. dinamically fill the innerHTML of the node which renders the view numbers with the updated value

Any comment appreciated.

Thomas

-- Thomas Fozzi - 2015-07-22

How about using or creating a new plugin instead of client side magic? Did you see the PageStatsPlugin? You could enhance that or create a new plugin based on your needs.

-- Peter Thoeny - 2015-07-23

That would be a good idea. I had a look into PageStatsPlugin and I noticed it takes in count only the current month log. A nice enhancement would be to have the possibility to take in count the last N months.

Still, it doesn't allow me to use the cookies, for which I necessarily need to have some client-side logic. I imagine a plugin could be able to render Javascript code along with HTML (TwistyPlugin does, for example).

As soon as I have some spare time I'll try to understand better how plugins work, best practise for development etc.

Thanks again Thomas

-- Thomas Fozzi - 2015-07-23

The server sends the cookie to the browser, so you do have access to the cookie in a TWiki plugin. Or, even easier, the logged-in user if you want to get stats on just them, e.g. excluding non-authenticated users.

Intro on plugins creation at TWikiPlugins.

-- Peter Thoeny - 2015-07-23

If you answer a question - or someone answered one of your questions - please remember to edit the page and set the status to answered. The status selector is below the edit box.