Merge branch 'master' of https://github.com/unaio/una

inc/classes/BxDolPage.php

@@ -280,6 +280,16 @@ class BxDolPage extends BxDolFactory implements iBxDolFactoryObject, iBxDolRepla
         return $this->_isVisiblePage($this->_aObject);
     }
 
+    public function isEditAllowed ()
+    {
+        return false;
+    }
+
+    public function isDeleteAllowed ()
+    {
+        return false;
+    }
+
     /**
      * Replace provided markers in a string
      * @param $mixed string or array to replace markers in

modules/boonex/oauth2/classes/BxOAuthAPI.php

@@ -193,27 +193,40 @@ class BxOAuthAPI extends BxDol
     }
 
     /**
-     * @page private_api API Private
-     * @section private_api_market /m/oauth2/api/market
+     * @page public_api API Public
+     * @section public_api_com /m/oauth2/api/com
      * 
-     * API service call (com is for command).
+     * API service call (com is for command). 
+     * The call should be look this:
+     * `/m/oauth2/api/com/[metod-name-here]`
      * 
      * **Scopes:** 
      * `api`
      *
      * Everything is equivalent to @ref private_api_service, 
      * only module name parameter can be ommited and 
-     * method is passed as method parameter instead of GET variable
+     * method is passed as method parameter instead of GET/POST variable
      */
     function com($sMethod, $aToken, $bPublic)
     {
     	$_GET['key'] = $_POST['key'] = (isset($aToken['client_id']) ? $aToken['client_id'] : '');
-        $_GET['module'] = $_POST['module'] = 'bx_api';
+        if (!isset($_GET['module']) && !isset($_POST['module']))
+            $_GET['module'] = $_POST['module'] = 'bx_api';
         $_GET['method'] = $_POST['method'] = $sMethod;
         $this->service($aToken, $bPublic, true);
     }
 
     function isPublicAPI($sModule, $sMethod, $sClass = false)
+    {
+        return $this->_isAPI($sModule, $sMethod, $sClass, 'is_public_service');
+    }
+
+    function isSafeAPI($sModule, $sMethod, $sClass = false)
+    {
+        return $this->_isAPI($sModule, $sMethod, $sClass, 'is_safe_service');
+    }
+
+    protected function _isAPI($sModule, $sMethod, $sClass = false, $sCheckMethod = 'is_safe_service') 
     {
         if (!$sClass)
             $sClass = 'Module';
@@ -221,11 +234,12 @@ class BxOAuthAPI extends BxDol
         if (!BxDolRequest::serviceExists($sModule, $sMethod, $sClass))
             return false;
 
-        if (!BxDolRequest::serviceExists($sModule, 'is_public_service', $sClass))
+        if (!BxDolRequest::serviceExists($sModule, $sCheckMethod, $sClass))
             return false;
 
-        return BxDolService::call($sModule, 'is_public_service', array($sMethod));
+        return BxDolService::call($sModule, $sCheckMethod, array($sMethod));
     }
+    
 
     /**
      * @page private_api API Private

modules/boonex/oauth2/classes/BxOAuthModule.php

@@ -189,7 +189,7 @@ class BxOAuthModule extends BxDolModule
     }
 
     /**
-     * Authenicated or public call to the "API" module
+     * Authenicated or public call to the "safe" and "public" service methods 
      */
     function actionCom ($sMethod)
     {
@@ -198,11 +198,15 @@ class BxOAuthModule extends BxDolModule
             $this->_oAPI = new BxOAuthAPI($this);
         }
 
-        $bPublic = $this->_oAPI->isPublicAPI('bx_api', $sMethod);
+        $bPublic = $this->_oAPI->isPublicAPI(bx_get('module') ? bx_get('module') : 'bx_api', $sMethod);
         if ($bPublic) {
             $this->_oAPI->com($sMethod, array(), $bPublic);
         }
         else {
+            if (!$this->_oAPI->isSafeAPI(bx_get('module') ? bx_get('module') : 'bx_api', $sMethod)) {
+                $this->_oAPI->errorOutput(403, 'access_denied', 'Only "public" and "safe" services can be called, or method doesn\'t exist');
+            }
+
             $this->initOAuth($this->getClientIdFromAccessTokenHeader());
 
             // Handle a request to a resource and authenticate the access token

template/scripts/BxBasePage.php

@@ -233,9 +233,12 @@ class BxBasePage extends BxDolPage
         $aFieldsUnset = array('cell_id', 'active', 'copyable', 'deletable', 'object', 'text', 'text_updated', 'title_system', 'visible_for_levels');
         $aCells = $this->_oQuery->getPageBlocks();
         foreach ($aCells as $sKey => $aCell) {
-            foreach ($aCell as $i => $aBlock) {
+            foreach ($aCell as $i => $aBlock) {                
                 if (!$this->_isVisibleBlock($aBlock))
                     unset($aCells[$sKey][$i]);
+                
+                $this->processPageBlock($aCells[$sKey][$i], true);
+                $aBlock = $aCells[$sKey][$i];
 
                 $sFunc = '_getBlock' . ucfirst($aBlock['type']);
                 $aCells[$sKey][$i]['content'] = method_exists($this, $sFunc) ? $this->$sFunc($aBlock) : $aBlock['content'];
@@ -267,6 +270,8 @@ class BxBasePage extends BxDolPage
         foreach ($aBlocks as $sKey => $aCell) {
             $sCell = '';
             foreach ($aCell as $aBlock) {
+                $this->processPageBlock($aBlock, false);
+
                 $sContentWithBox = $this->_getBlockCode($aBlock);
 
             	$sHiddenOn = '';
@@ -284,6 +289,14 @@ class BxBasePage extends BxDolPage
         return $aVars;
     }
 
+    /**
+     * Process block values, especially if someting need to be overrided 
+     */
+    protected function processPageBlock(&$aBlock, $bApi = false) 
+    {
+
+    }
+
     /**
      * Get page code only.
      * @return string
@@ -316,9 +329,8 @@ class BxBasePage extends BxDolPage
 
         if (isset($GLOBALS['bx_profiler'])) $GLOBALS['bx_profiler']->beginPageBlock(_t($aBlock['title']), $aBlock['id']);
 
-        if ($this->_isVisibleBlock($aBlock)) {
-
-            $sFunc = '_getBlock' . ucfirst($aBlock['type']);
+        $sFunc = '_getBlock' . ucfirst($aBlock['type']);
+        if ($this->_isVisibleBlock($aBlock) && method_exists($this, $sFunc)) {
             $mixedContent = $this->$sFunc($aBlock);
 
             $sTitle = $this->getBlockTitle($aBlock);