Page Id from $_GET

[arturg]

Hi, I.m creating edit page for other pages and I would like to take page Id from $_GET, i have this error: 

Error: Call to a member function numChildren() on a non-object (line 382 of /home/creacode/public_html/minskmazowiecki.praca.24.net.pl/wire/core/PagesEditor.php) 

And this is my code: 

<?php

$pageId = ($_GET["s"]);

// get a page
$editpage = $pages->get($pageId);
$ignorefields = array("isOld","language_published");

$form = $modules->get("InputfieldForm");
$form->method = 'post';
$form->action = './';

// get the collection of inputs that can populate this page's fields
$inputfields = $editpage->getInputfields();

// make all the fields required and add them to the form
foreach($inputfields as $inputfield) {
    if(in_array($inputfield->name, $ignorefields)) continue;
    $form->add($inputfield);
}

// the inputfields don't already have a submit button, so we'll add one.
$submit = $modules->get("InputfieldSubmit");
$submit->name = "submit";
$submit->value = 'Submit';

// add the submit button the the form
$form->add($submit);

$out = '';

// process the form
if($this->input->post->submit) {
    // now we assume the form has been submitted.
    // tell the form to process input frmo the post vars.
    $form->processInput($this->input->post);

    // see if any errors occurred
    if( count( $form->getErrors() )) {
        // re-render the form, it will include the error messages
        $out .= $form->render();
    } else {
        // successful form submission, so populate the page with the new values.
        $editpage->setOutputFormatting(false);
        foreach($form as $field) {
            $editpage->set($field->name, $field->value);
        }
        // save it
        $editpage->save();
        $out .= "Page saved.";
        $out .= $form->render();
    }
} else {
    $out .= $form->render();
}

echo $out;

[horst]

I would use $input->get->s, and not the PHP superglobal $_GET['s'].

Also you need to check if it is a valid ID:

<?php

$pageId = (int) $input->get->s;  // also typecast to integer

// get a page
$editpage = $pages->get("id=$pageId");

// now check if you have get a page
if($editpage->id > 0) {  // if it could not find a page with that id, it returns a NullPage with id = 0

// it also may be good to add some more to the get selector, like template=XXXXXX,
//as if one simply can send you only an ID, someone may try to open Adminpages or others! 

[arturg]

ok, but I have page message.php with edit link like this: 

<a href="<?php echo $pages->get(1109)->url; ?>?s=<?php echo $page->id; ?>">edit</a>    

this link me to the edit.php with: 

<?php

// get a page
$editpage = $pages->get($_GET["s"]);
$ignorefields = array("isOld","language_published");

$form = $modules->get("InputfieldForm");
$form->method = 'post';
$form->action = './';

// get the collection of inputs that can populate this page's fields
$inputfields = $editpage->getInputfields();

// make all the fields required and add them to the form
foreach($inputfields as $inputfield) {
    if(in_array($inputfield->name, $ignorefields)) continue;
    $form->add($inputfield);
}

// the inputfields don't already have a submit button, so we'll add one.
$submit = $modules->get("InputfieldSubmit");
$submit->name = "submit";
$submit->value = 'Submit';

// add the submit button the the form
$form->add($submit);

$out = '';

// process the form
if($this->input->post->submit) {
    // now we assume the form has been submitted.
    // tell the form to process input frmo the post vars.
    $form->processInput($this->input->post);

    // see if any errors occurred
    if( count( $form->getErrors() )) {
        // re-render the form, it will include the error messages
        $out .= $form->render();
    } else {
        // successful form submission, so populate the page with the new values.
        $editpage->setOutputFormatting(false);
        foreach($form as $field) {
            $editpage->set($field->name, $field->value);
        }
        // save it
        $editpage->save();
        $out .= "Page saved.";
        $out .= $form->render();
    }
} else {
    $out .= $form->render();
}

echo $out;

[LostKobrakai]

First of all $input->get->s is basically the same as $_GET['s'], but without having the whole checking if the array key is actually set (isset …) mess. Secondly you're giving anyone the possibility to apply any changes your code is creating to any page in your system, which isn't great. You should make sure only applicable pages are selected in your $pages->get() call by adding additional selectors (at least disable all admin pages with 'parent!=2'). And lastly you should check if you successfully found a valid page before doing anything else.