Jump to content

Access PHP file from JS file


KarlvonKarton
 Share

Recommended Posts

ProcessWire by default blocks access to files with the extensions php, htm, html, inc and tpl underneath the templates directory (or, to be precise, the shipped .htaccess file does so). This is a security feature.

Thus, to access third party PHP code, you have two choices:

  • Move the relevant code outside of the templates directory or
  • create a template with a PHP file in site/templates that includes the external library (in your case instapast-ajax.php, and that's where Ryan's quote comes in) and a page that uses this template (and that provides you with the URL to call from JS)
  • Like 7
Link to comment
Share on other sites

I have tried the second choice of BitPoet too:

Somewhere on a page I have two pieces of HTML:

<!-- trigger -->
<a title=“some titleclass="instapast" data-insta=“some_page_id”>linkname</a>

<!-- Zurb Foundation Reveal Popup -->
<div class="reveal" id="instapastPopup" data-reveal>
<h1 id="instapastPopupTitle"></h1>
<p id="instapastPopupContent"></p>
<button class="close-button" data-close aria-label="Close modal" type="button">
<span aria-hidden="true">&times;</span>
</button>
</div>

The Javascript /templates/scripts/app.js

jQuery(document).ready(function($){
	
	var request;
		
	$('a.instapast').click(function(){
		
		var id = this.dataset.insta;
		
		request = $.ajax({
			url:  "instapast-ajax/?id=" + id, // instapast-ajax.php is in the directory templates
			type: "post"
		});
	
		request.done(function (data, textStatus, jqXHR){			
			var json = $.parseJSON(data);
			$('#instapastPopupTitle').html(json.title);
			$('#instapastPopupContent').html(json.text);

			$('#instapastPopup').foundation('open');
		});
	});
});


In Processwire I have made a Template: instapast-ajax
And a page with the same name and the template avove: instapast-ajax
That gives me the URL for app.js:  /instapast-ajax/

The code in instapast-ajax.php:

<?php namespace ProcessWire;
	
	//$ID = $_GET['id']; // not secure
	$ID = $sanitizer->int($input->get->id); // updated thanks to bernhard

	$instagramPickTitle_ = $pages->get($ID)->title;
	$instagramPickContent_ = $pages->get($ID)->text;
	
	$arr = array(
			'title' => $instagramPickTitle_,
			'text' => $instagramPickContent_
		);
		
	$json = json_encode($arr);
	echo $json;

ps: I hope I did not forget something.

Edited by KarlvonKarton
Bernhard's tip on sanitizer
  • Like 2
Link to comment
Share on other sites

  • 3 years later...
On 8/10/2016 at 12:49 PM, BitPoet said:

ProcessWire by default blocks access to files with the extensions php, htm, html, inc and tpl underneath the templates directory (or, to be precise, the shipped .htaccess file does so). This is a security feature.

Thus, to access third party PHP code, you have two choices:

  • Move the relevant code outside of the templates directory or
  • create a template with a PHP file in site/templates that includes the external library (in your case instapast-ajax.php, and that's where Ryan's quote comes in) and a page that uses this template (and that provides you with the URL to call from JS)

For the first solution Im stilling getting the forbidden error after moving the php file to the site directory. Here's my console after ajax submission to the contact.php file. I need to access processwire page variables from this file also.

1255886055_ScreenShot2020-06-24at1_09_56PM.png.18b94a1d75042ee62edb7a687989819d.png

Link to comment
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
 Share

  • Recently Browsing   0 members

    • No registered users viewing this page.
×
×
  • Create New...