Sometimes you just want to keep things simple and not bother with a token -- this patch adds this callback type.

The callback functionality is what I expected out of the box from the rules_link module, but the way the rules_link module has been put together is fairly inflexible and needs some work if it's going to be used as a generalised solution for links and rules. There's a lot of things that don't work as advertised internally e.g. $entity_id being passed around but never used. Also using a URL like "cart/add" or "foobar/baz" will break the module, the URL must not have any slashes.

Support from Acquia helps fund testing for Drupal Acquia logo

Comments

BenK’s picture

+1 subscribing

aidanlis’s picture

FileSize
3.23 KB

Forgot the .admin in the patch.

fago’s picture

>Sometimes you just want to keep things simple and not bother with a token -- this patch adds this callback type.

This would be a CSRF vulnerability, so I don't think it's a good idea ;)

aidanlis’s picture

It's not CSRF if the Rule's action is Safe and Idempotent [1], e.g. I want to advertise a special offer in the paper, where visiting http://example.com/specials/donut/ adds a donut to the cart, applies a discount, and redirects them to the checkout pane.

[1] http://www.w3.org/Protocols/rfc2616/rfc2616-sec9.html

fago’s picture

but your example isn't idempotent - and most won't be.

aidanlis’s picture

It is idempotent, running it multiple times has no effect on the state of the users session (assuming you have an "empty cart" before hand).

Can you think of a better way to achieve what I want to do? I think it's a little silly to block functionality in a module because it could be abused ...

fago’s picture

Your described example adds something to the cart, so the cart isn't the same anymore afterwards. Thus it's not idempotent.

I don't see the problem with added tokens. Just make use of the helper function for outputting links - I suppose there is such a helper.. ;)

There's a lot of things that don't work as advertised internally e.g. $entity_id being passed around but never used. Also using a URL like "cart/add" or "foobar/baz" will break the module, the URL must not have any slashes.

I'd suggest working on fixing that.

aidanlis’s picture

A helper function isn't going to help me with my printed media ad though ...

... what about if I put a warning under "Callback" saying that this opens the door to CSRF attacks and should be used with caution?

spineless’s picture

I am using your patch for the commerce add to cart feature.

http://drupal.org/node/823466

The article calls for the use of this patch. rules_link_callback.patch.

I was able to install the commerce add to cart patch however when I attempted to git the rules_link_callback.patch I did not do as well.

I could not find the following files in the rules module.

rules_link_admin.inc
rules_link.module

Here is the terminal window error message:

user@ubuntu11.04:~/website/sites/all/modules/rules$ git apply -v rules_link_callback.patch
rules_link_callback.patch:10: trailing whitespace.
'#options' => array('callback' => t('Callback'), 'javascript' => t('Javascript'), 'token' => t('Normal'), 'confirm' => t('Confirmation')),
rules_link_callback.patch:23: trailing whitespace.
function rules_link_trigger($rules_link) {
rules_link_callback.patch:28: trailing whitespace.
* Menu callback for callback links.
rules_link_callback.patch:29: trailing whitespace.
*/
rules_link_callback.patch:30: trailing whitespace.
function rules_link_trigger_callback($rules_link) {
Checking patch rules_link.admin.inc...
error: rules_link.admin.inc: No such file or directory
Checking patch rules_link.module...
error: rules_link.module: No such file or directory
user@ubuntu11.04:~/website/sites/all/modules/rules$

Any ideas what i did wrong?

Spineless

aidanlis’s picture

@spineless This is a patch to rules_link, not rules ...

@fago There's a clear use case for this, and although I agree we're violating GET idempotentcy on the first request I don't see any other way this could work - you can't deny the practical necessity. I don't mind forking your module into rules_simplelink, but I'd really like you to reconsider.

sepgil’s picture

Status: Active » Closed (won't fix)

I admit, there are uses cases were a simple callback would be usefull, but the amount of such use cases is small. Adding such a callback is to risky, and therefore I'm not willing to add it to my module.

fago’s picture

Maybe, making link-types pluggable would make sense?

aidanlis’s picture

@sepgil: ... I'm flabberghasted, but that's fine, I will make an alternative module.

We were hoping to use rules_link to build the Commerce equivalent of the Ubercart's Cart Links module - a module which had tens of thousands of users before it was integrated into Ubercart core - hardly a "small use case".

aidanlis’s picture

New module here, http://drupal.org/project/rules_linkevent ... will make clicking a link an event.

mitchell’s picture

Title: Add a callback link type » Make link-types pluggable
Status: Closed (won't fix) » Needs work

Whoah!.. This is completely uncharacteristic in the Rules / Drupal ecosystems.

I've seen many opportunities for cooperation where one proposed solution needed to change from what the contributors and maintainers had originally intended. The issues went back and forth, a middle ground was discovered, and a productive direction was taken... and many users rejoiced. This is the type of thing which has made Rules great.

As a user, I really hope we'll figure out what can be done based on the points already made and, potentially, what can be merged from this fork. I'd be happy to help, but I hope this type of resistance will be seen for what it is, a mistake.
---

aidanlis: would fago's suggestion fit your needs? has Rules Link Event given you new insights about a callback link type?

fago: could you please explain more about what making link-types pluggable might allow and how it would look? and if possible, recommend a better solution than a CSRF-able plugin.

sepgil: same questions as ^ and a reminder to please "stand on the shoulders of giants" as we all say

spineless: error messages are a easier to read in txt files

all-contributors: thank you for your patience, commitment, and skill!

aidanlis’s picture

@mitchell Although I appreciate you putting some energy into this, all of your comments are superfluous. There's no extra insight needed and we all know what a pluggable architecture would look like. Suggesting that there exists a better solution than a CSRF-able plugin shows you don't understand a fundamental requirement (e.g. printed media).

mitchell’s picture

aidanlis, please take a moment to reflect on your tone. I'm trying to remain respectful, and I would appreciate it would read over the DCOC.

> Although I appreciate you putting some energy into this, all of your comments are superfluous.
If you're saying they're excessive, I'll admit they're a bit long. But unnecessary? Collaboration matters deeply here. I think you may be misjudging the situation. There are between 100k and 500k rules users and your project has created a lot confusion for them/us. And still, Rules users are still waiting for "a generalised solution for links and rules." I would like us to get back on track for that.

> There's no extra insight needed and we all know what a pluggable architecture would look like.
Here's what I want to find out: would it suit you? are you still interested in working on it?

> Suggesting that there exists a better solution than a CSRF-able plugin shows you don't understand a fundamental requirement (e.g. printed media).
I'm not a programmer, and I didn't suggest that. This issue clearly demonstrates the need to address the scenario described in #1553546: Encourage issue queue participants to clearly formulate the problem separately from proposed solutions. Our tools might let us down, but let's not let each other down.

mitchell’s picture

Issue summary: View changes

Improved the wording.