sr_email_subscribe setzt nur einen Teil der Marker

**doni** · 17.10.2009, 08:18

Hallo,

ich habe in meinem Typo3 4.2.9 eine Postleitzahlensuche über ast_addresszipsearch realisiert.
Funktioniert alles ohne Probleme, aber die Extension hat einen Bug und wird nicht mehr weiter entwickelt.

Jetzt habe ich eine Extension gefunden welche dies auch macht (wt_directory).
Nur ist es so, dass diese Extension die Adressen aus tt_address liest und nicht aus fe_users.

Damit sich jemand registrieren kann, musste ich die Extension sr_email_subscribe installieren, welche aber nicht alle Marker im FE übersetzt.
Z.B. werden die Marker für "...FIRST_NAME" als Marker angezeigt und die für den Vornamen werden normal übersetzt.

Im Template habe ich z.B. drin:
###LABEL_FIRST_NAME###
###LABEL_LAST_NAME###

Und wenn ich im Root-Setup-TS einsetze:
plugin.tx_sremailsubscribe_pi1._LOCAL_LANG.de {
first_name = Test-Vorname
last_name = Test-Nachname
}
... wird leider nur "Test-Nachname" und ###LABEL_FIRST_NAME### angezeigt.

Muss ich da bestimmte Versionen der Extensions einsetzen?
Die hier habe ich installiert:
div2007, 0.2.3
sr_email_subscribe, 1.2.9
sr_feuser_register, 2.5.23
static_info_tables, 2.1.1
tt_address, 2.2.1
wt_directory, 1.3.21

Meine Frage wäre jetzt; Wie kann ich die Marker setzen?
Oder kennt jemand eine Alternative zur Postleitzahlensuche?

**doni** · 18.10.2009, 19:16

Da ich das Problem nicht lösen konnte, habe ich die ganze Aktion wieder rückgängig gemacht.
Dafür habe ich jetzt die Extension ast_addresszipsearch vor einer SQL-Injection abgesichert.
typo3.org: TYPO3 Security Bulletin TYPO3-SA-2009-013: Multiple vulnerabilities in third party extensions
Und zwar in dieser Datei: /typo3conf/ext/ast_addresszipsearch/pi1/class.tx_astaddresszipsearch_pi1.php

Hier die von mir angepasste Datei:

!!! start - Hinweis !!!
Ich übernehme KEINE Haftung für eventuell entstandene Schäden!
!!! ende - Hinweis !!!

Code:

<?php
	/***************************************************************
	*  Copyright notice
	*
	*  (c) 2004 Andre Steiling (steiling@pilotprojekt.com)
	*  All rights reserved
	*
	*  This script is part of the TYPO3 project. The TYPO3 project is
	*  free software; you can redistribute it and/or modify
	*  it under the terms of the GNU General Public License as published by
	*  the Free Software Foundation; either version 2 of the License, or
	*  (at your option) any later version.
	*
	*  The GNU General Public License can be found at
	*  http://www.gnu.org/copyleft/gpl.html.
	*
	*  This script is distributed in the hope that it will be useful,
	*  but WITHOUT ANY WARRANTY; without even the implied warranty of
	*  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
	*  GNU General Public License for more details.
	*
	*  This copyright notice MUST APPEAR in all copies of the script!
	***************************************************************/
	/**
	 * Plugin 'Zip search for address list' for the 'ast_addresszipsearch' extension.
	 *
	 * @author Andre Steiling <steiling@pilotprojekt.com>
	 */
	/**
	 * [CLASS/FUNCTION INDEX of SCRIPT]
	 *
	 *
	 *
	 *   56: class tx_astaddresszipsearch_pi1 extends tslib_pibase
	 *   70:     function main($content, $conf)
	 *   96:     function showSearch()
	 *  123:     function showResult()
	 *
	 * TOTAL FUNCTIONS: 3
	 * (This index is automatically created/updated by the extension "extdeveval")
	 *
	 */


	require_once(PATH_tslib.'class.tslib_pibase.php');


	/**
	 * Extends T3 for the address zip search ...
	 *
	 * @author	Andre Steiling <steiling@pilotprojekt.com>
	 * @package TYPO3
	 * @subpackage tx_astaddresszipsearch_pi1
	 */
	class tx_astaddresszipsearch_pi1 extends tslib_pibase {
		var $prefixId = 'tx_astaddresszipsearch_pi1';
		// Same as class name
		var $scriptRelPath = 'pi1/class.tx_astaddresszipsearch_pi1.php'; // Path to this script relative to the extension dir.
		var $extKey = 'ast_addresszipsearch'; // The extension key.


		/**
		 * Main function:
		 * Creates the template file and switchs to one of the function to show the search form or the result
		 *
		 * @param	string		content
		 * @param	array		configuration data
		 * @return	string		HTML content
		 */
		function main($content, $conf) {
			$this->conf = $conf;
			$this->pi_setPiVarDefaults();
			$this->pi_loadLL();
			
			// No cache
			$GLOBALS['TSFE']->set_no_cache();

			// Template code
			$templateFile = $this->conf['templateFile']?$this->conf['templateFile']:t3lib_extMgm::siteRelPath('ast_addresszipsearch').'tmpl_zipsearch.html';
			$this->templateCode = $this->cObj->fileResource($templateFile);

			$mode = $this->piVars['DATA']['mode'];
			/* start - sql-injection verhindern - by wpr (Web-Publishing Ronge) am 18.10.09 #################################################################### */
			// alle HTML-Tags löschen
			$mode = strip_tags($mode);
			// Escapes special characters in a string for use in a SQL statement, taking into account the current charset of the connection
			$mode = mysql_real_escape_string($mode);
			// falls $mode nicht 1 ergibt, dann soll $mode leer bleiben
			if($mode!=1){$mode='';}
			//echo 'mode: -'.$mode.'-<br />';
			/* ende - sql-injection verhindern - by wpr (Web-Publishing Ronge) am 18.10.09 #################################################################### */
			switch($mode) {
				case 1:
					return $this->showResult();
				break;
				default:
					return $this->showSearch();
				break;
			}
		}


		/**
		 * Default mode: Renders the zip search form
		 *
		 * @return	string		HTML content
		 */
		function showSearch() {
			// Template Subpart
			$subpart = $this->cObj->getSubpart($this->templateCode, '###SEARCHFORM###');

			// Template Marker
			$markerArray = array();
			$markerArray['###FORM_MODE###']         = $this->prefixId.'[DATA][mode]';
			$markerArray['###FORM_NAME###']         = $this->prefixId;
			$markerArray['###FORM_URL###']          = $this->pi_getPageLink($GLOBALS['TSFE']->id);
			$markerArray['###FORMLABEL_LEGEND###']  = $this->pi_getLL('formLabelLegend');
			$markerArray['###FORMLABEL_ZIP###']     = $this->pi_getLL('formLabelZip');
			$markerArray['###FORMNAME_ZIP###']      = $this->prefixId.'[DATA][zip]';
			/* start - sql-injection verhindern - by wpr (Web-Publishing Ronge) am 18.10.09 #################################################################### */
			//$markerArray['###FORMVALUE_ZIP###']     = $this->piVars['DATA']['zip'];
			$tempForMarkerArrayFORMVALUE_ZIP        = mysql_real_escape_string($this->piVars['DATA']['zip']);
			$markerArray['###FORMVALUE_ZIP###']     = preg_replace("/[^0-9]/", "", $tempForMarkerArrayFORMVALUE_ZIP);
			/* ende - sql-injection verhindern - by wpr (Web-Publishing Ronge) am 18.10.09 #################################################################### */
			$markerArray['###FORMNAME_SUBMIT###']   = $this->pi_getLL('formLabelZip');
			$markerArray['###FORMLABEL_SUBMIT###']  = $this->pi_getLL('formLabelSubmit');

			$content = $this->cObj->substituteMarkerArray($subpart,$markerArray);
			return '<div id="'.$this->prefixId.'">'.$content.'</div>'.chr(10);
		}


		/**
		 * Result mode: Rednders the search result and optinal the search form again
		 *
		 * @return	string		HTML content
		 */
		function showResult() {
			$this->resultHTML = '';
			$this->resultHits = 0;
			
			$this->conf['code']      = $this->cObj->data['select_key'];
			$this->conf['pidList']   = $this->cObj->data['pages'];
            $this->conf['recursive'] = $this->cObj->data['recursive'];
			$pidList = $this->pi_getPidList($this->conf['pidList'],$this->conf['recursive']);
			$theCode = trim($this->conf['code']);

			// Result sorting
			$resultSorting = strtolower($this->conf['resultSorting']);
			
			// Search mode:
			// Could be 'single' for searching only a single zip oer
			// 'range' for searchin in a range of zip codes, see documentation for details
			$searchMode = $this->conf['searchMode'];

			// Slice the '$theCode', get country and specific ZIP length:
			// ZIP code length is defined by '/Int'
			list($counChar, $counLen) = explode('/', $theCode);
			$counLen  = intval($counLen);
			$counChar = $counChar;

			// Template Subparts
			$subpartHeader      = $this->cObj->getSubpart($this->templateCode, '###SEARCHRESULT_HEADER###');
			$this->subpartList  = $this->cObj->getSubpart($this->templateCode, '###SEARCHRESULT_LIST###');
			$this->subpartListA = $this->cObj->getSubpart($this->templateCode, '###SEARCHRESULT_LIST_A###');
			$this->subpartListB = $this->cObj->getSubpart($this->templateCode, '###SEARCHRESULT_LIST_B###');

			// Posted ZIP code preformating
			$zipInput    = $this->piVars['DATA']['zip'];
			/* start - sql-injection verhindern - by wpr (Web-Publishing Ronge) am 18.10.09 #################################################################### */
			// alle HTML-Tags löschen
			$zipInput = strip_tags($zipInput);
			// Escapes special characters in a string for use in a SQL statement, taking into account the current charset of the connection
			$zipInput = mysql_real_escape_string($zipInput);
			// damit es auch wirklich nur Zahlen sind
			$zipInput = preg_replace("/[^0-9]/", "", $zipInput);
			// ist die Zahl auch zwischen 1 und 99999?
			if(($zipInput<=0) or ($zipInput>=100000)){$zip='';}
			//echo 'zip: -'.$zipInput.'-<br />';
			/* ende - sql-injection verhindern - by wpr (Web-Publishing Ronge) am 18.10.09 #################################################################### */
			$resultStr   = $zipInput;
			$zipComplete = $zipInput;
			$inputLen    = strlen($zipInput);
			// % = undefined char and length / RegExp in mySQL for searchMode 'single'
			$zipSQL = $zipInput.'%';

			// Complete the zipInput to the full length of the country´s ZIP code, for user´s information
			// Also needed for searchMode 'range' => $zipComplete
			$counLen = ($counLen != '')?$counLen:10;
			$xEnd = $counLen-$inputLen;
			for ($x=0; $x < $xEnd; $x++) {
				$resultStr   .= 'x';
				$zipComplete .= '0';
			}
			
			/* start - sql-injection verhindern - by wpr (Web-Publishing Ronge) am 18.10.09 #################################################################### */
			// folgendes deaktiviert, weil es z.Zt. nicht gebraucht wird
	### Anpassungen für B., später mal einfließen lassen ###
			// Search by city:			
			/* $cityInput = str_replace(' ', '_', $this->piVars['DATA']['city']);
			$cityInput = str_replace('+', '_', $cityInput);
			if ($cityInput != '') {
				$resultStr  = $cityInput;
				$citySQL    = '%'.$cityInput;
				$inputLen   = strlen($cityInput);
			} */
	### Anpassungen für B., später mal einfließen lassen ###
			/* ende - sql-injection verhindern - by wpr (Web-Publishing Ronge) am 18.10.09 #################################################################### */
			
			// Result
			if ($inputLen != 0) {
				// DB query in order of searchMode
				switch ($searchMode) { 
					case 'single':
						$res = $GLOBALS['TYPO3_DB']->exec_SELECTquery('*', 'fe_users', 'zip LIKE \''.$zipSQL.'\' AND country = \''.$counChar.'\' AND pid IN ('.$pidList.')'.$this->cObj->enableFields('fe_users'), '', $resultSorting, '');
					break;
					case 'range':
						$res = $GLOBALS['TYPO3_DB']->exec_SELECTquery('*', 'fe_users', 'country = \''.$counChar.'\' AND pid IN ('.$pidList.')'.$this->cObj->enableFields('fe_users'), '', $resultSorting, '');
					break;
			/* start - sql-injection verhindern - by wpr (Web-Publishing Ronge) am 18.10.09 #################################################################### */
			// folgendes deaktiviert, weil es z.Zt. nicht gebraucht wird
					/* case 'city':
						$res = $GLOBALS['TYPO3_DB']->exec_SELECTquery('*', 'fe_users', 'city LIKE BINARY \''.$citySQL.'\' AND country = \''.$counChar.'\' AND pid IN ('.$pidList.')'.$this->cObj->enableFields('fe_users'), '', $resultSorting, '');
					break; */
			/* ende - sql-injection verhindern - by wpr (Web-Publishing Ronge) am 18.10.09 #################################################################### */
				}
				// Result
				$this->completeHits = $GLOBALS['TYPO3_DB']->sql_num_rows($res);
				while ($row = $GLOBALS['TYPO3_DB']->sql_fetch_assoc($res)) {
##				t3lib_div::print_array($row);
					$this->formatAddress($row, $searchMode, intval($zipComplete));
				}
			// no records
			} else $this->resultHTML = $this->pi_getLL('resultLabelNoRecords').'!';

			// Info header
			$markerArray['###RESULTLABEL_HEADER###']        = $this->pi_getLL('resultLabelHeader');
			$markerArray['###RESULTLABEL_ZIP_AREA###']      = $this->pi_getLL('resultLabelZipArea');
			$markerArray['###RESULTLABEL_SEARCH_STRING###'] = $resultStr;
			$markerArray['###RESULTLABEL_HITS###']          = $this->pi_getLL('resultLabelHits');
			$markerArray['###RESULTVALUE_HITS###']          = $this->completeHits;
			$resultHead = $this->cObj->substituteMarkerArray($subpartHeader,$markerArray);

			// Add header if is set and clear the floating
			$content  = '<div id="'.$this->prefixId.'">'.chr(10);
			if ($this->conf['showResultHeader'] == 1) $content .= $resultHead.chr(10);
			$content .= $this->resultHTML.chr(10);
			$content .= '<div class="spacer">&nbsp;</div>'.chr(10);
			$content .= '</div>'.chr(10);

			// Add search box after result, if it is set ...
			if ($this->conf['showSearchInResult'] == 1) $content .= $this->showSearch();
			
			// return
			return $content;
		}


		/**
		 * Sub-function for showResult:
		 * If SearchMode is 'range', we have to search in a different way ...
		 * else do ordinary mySQL selection ...
		 *
		 * @param	array		mySQL select row
		 * @param	string		Searching mode: 'single' or 'range'
		 * @param	integer		Completed zip code for mode 'range'
		 * @return	array		Array width vault addresses
		 */
		function formatAddress($rowSQL, $searchMode, $zipCode=0) {
			// Preformat the zip code range
			$inList = 0;
			if ($searchMode == 'range') {
				$arrZIPs = explode(',', $rowSQL['zip']);
				foreach ($arrZIPs as $value) {
					$parts = explode('|', $value);
					if ($zipCode >= $parts[0] && $zipCode <= $parts[1]) $inList = 1;
				}
			}
			
			/* start - sql-injection verhindern - by wpr (Web-Publishing Ronge) am 18.10.09 #################################################################### */
			// folgendes geändert, weil es z.Zt. nicht gebraucht wird
			/* if ($inList == 1 || $searchMode == 'single' || $searchMode == 'city') { */
			/* ende - sql-injection verhindern - by wpr (Web-Publishing Ronge) am 18.10.09 #################################################################### */
			if ($inList == 1 || $searchMode == 'single') {
				// count hits ...
				$this->resultHits++;
				
				// Marker array
				// last_name first_name company
				$markerArray = array();
				$markerArray['###ADR_TITLE###']   = ($this->conf['showAddress.']['title'] == 1)?$rowSQL['title']:false;
				$markerArray['###ADR_FIRSTNAME###']   = ($this->conf['showAddress.']['first_name'] == 1)?$rowSQL['first_name']:false;
				$markerArray['###ADR_LASTNAME###']   = ($this->conf['showAddress.']['last_name'] == 1)?$rowSQL['last_name']:false;
				//$markerArray['###ADR_NAME###']    = ($this->conf['showAddress.']['name'] == 1)?$rowSQL['name']:false;
				$markerArray['###ADR_COMPANY###']    = ($this->conf['showAddress.']['company'] == 1)?$rowSQL['company']:false;
				$markerArray['###ADR_ADDRESS###'] = ($this->conf['showAddress.']['address'] == 1)?str_replace(chr(10), '<br />', $rowSQL['address']):false;
				$markerArray['###ADR_CITY###']    = ($this->conf['showAddress.']['city'] == 1)?$rowSQL['city']:false;
				$markerArray['###ADR_PHONE###']   = ($this->conf['showAddress.']['phone'] == 1)?$rowSQL['phone']:false;
				$markerArray['###ADR_FAX###']     = ($this->conf['showAddress.']['fax'] == 1)?$rowSQL['fax']:false;
				$markerArray['###ADR_MOBILE###']  = ($this->conf['showAddress.']['mobile'] == 1)?$rowSQL['mobile']:false;
				$markerArray['###ADR_EMAIL###']   = ($this->conf['showAddress.']['email'] == 1)?$rowSQL['email']:false;
				$markerArray['###ADR_WWW###']     = ($this->conf['showAddress.']['WWW'] == 1)?$rowSQL['www']:false;
				
				// Adding a break after every row, exclude the labels, image, desc and the zip code:
				foreach ($markerArray as $key => $value) if ($value != '') $markerArray[$key] = $value.'';
				
				$markerArray['###ADR_ZIP###']     = ($this->conf['showAddress.']['ZIP'] == 1)?$rowSQL['zip']:false;
				$markerArray['###ADR_IMG###']     = ($this->conf['showImgInResult'] == 1)?$this->formatImage($rowSQL['image'],$rowSQL['name']):false;
				$markerArray['###ADR_DESC###']    = ($this->conf['showAddress.']['desc'] == 1)?$rowSQL['description']:false;
	
				$markerArray['###RESULTLABEL_PHONE###']  = ($markerArray['###ADR_PHONE###'] != '')?'<br />'.$this->pi_getLL('resultLabelPhone'):false;
				$markerArray['###RESULTLABEL_FAX###']    = ($markerArray['###ADR_FAX###'] != '')?'<br />'.$this->pi_getLL('resultLabelFax'):false;
				$markerArray['###RESULTLABEL_MOBILE###'] = ($markerArray['###ADR_MOBILE###'] != '')?'<br />'.$this->pi_getLL('resultLabelMobile'):false;					
				$markerArray['###RESULTLABEL_EMAIL###']  = ($markerArray['###ADR_EMAIL###'] != '')?'<br />'.$this->pi_getLL('resultLabelEmail'):false;
				$markerArray['###RESULTLABEL_WWW###']    = ($markerArray['###ADR_WWW###'] != '')?$this->pi_getLL('resultLabelWWW'):false;
				
				// Add row to the result:
				if ($this->conf['showBoxesLayout'] == 1) {	// Show 2 column layout or not ...
					$resultModulo = $this->resultHits%2;
					$subpartBox   = ($resultModulo == 1)?'<div class="row">'.$this->subpartListA:$this->subpartListB.'</div>';
					$hits         = $this->completeHits/2;
					$isFloat        = is_float($hits);
					#print($this->resultHits.' - '.$this->completeHits.'<br>');
					if ($isFloat == 1 && $this->resultHits == $this->completeHits) $subpartBox .= '</div>';
					$this->resultHTML    .= $this->cObj->substituteMarkerArray($subpartBox,$markerArray);
				} else $this->resultHTML .= $this->cObj->substituteMarkerArray($this->subpartList,$markerArray);
			}
		}
		
		
		/**
		 * Sub-function for showResult: Formating the image assigned to the address data
		 *
		 * @param	string		fe_users field 'image'
		 * @param	string		fe_users field 'name'
		 * @return	string		HTML content
		 */
		function formatImage($rowImage, $rowName) {
			// Get the first image
			$adrImg   = '';
			$imgs     = explode(',', $rowImage);
			$firstImg = $imgs[0];
			// Show the first image if there is one ...
			if ($firstImg) {
				$this->conf['image.']['file'] = 'uploads/pics/'.$firstImg;
				$this->conf['altText']        = $rowName;
				$adrImg .= $this->cObj->IMAGE($this->conf['image.']);
			} else {
				$this->conf['image.']['file'] = $this->conf['noImgAvailableSrc'];
				$this->conf['altText']        = $this->pi_getLL('noImgAvailableAlt');
				// Shows dummy image, if showNoImgAvailable is 1
				if ($this->conf['showNoImgAvailable'] == 1) $adrImg .= $this->cObj->IMAGE($this->conf['image.']);
			}
			return $adrImg;
		}


	} // class


	if (defined('TYPO3_MODE') && $TYPO3_CONF_VARS[TYPO3_MODE]['XCLASS']['ext/ast_addresszipsearch/pi1/class.tx_astaddresszipsearch_pi1.php']) {
		include_once($TYPO3_CONF_VARS[TYPO3_MODE]['XCLASS']['ext/ast_addresszipsearch/pi1/class.tx_astaddresszipsearch_pi1.php']);
	}
?>

**Martin Terber** · 05.11.2010, 21:38

Habe dasselbe Problem mit sr_email_subscribe. Zwei Marker aus dem HTML-Template werden nicht ersetzt, sondern als :

Code:

###LABEL_NAME### ###REQUIRED_NAME###
###MISSING_NAME###
###LABEL_FIRST_NAME### ###REQUIRED_FIRST_NAME###      ###EVAL_ERROR_FIELD_first_name### 
###MISSING_FIRST_NAME###

angezeigt.

Obwohl die Felder bei formFields richtig angegeben sind:

tx_sremailsubscribe.formFields = name,address,city,zip,email,module_sys_dmail_html