MVC for TYPO3 4.3 with extbase

Inspiring people toshare

T3CON09 Dallas

MVC for TYPO3 4.3 with Extbase

MVC workshop for TYPO3 4.3

Oliver Hader <oliver@typo3.org>Sebastian Kurfürst <sebastian@typo3.org>

15.04.2009

Inspiring people toshareMVC for TYPO3 4.3 with Extbase

Abstract

The current state of the art

Core concepts - MVC and DDD

Extension building with Extbase

Outlook and conclusion

Hello world

Blog example

Persistence

Abstract

Hello world

Blog example

Persistence

The current stateof the art

http://commons.wikimedia.org/wiki/File:Z%C3%BCrich_-_Seefeld_-_Heureka_IMG_1757.JPG

FEPlugin

Database tables

dispatches callsfetches data

renders outputResources

templatesJavaScript/CSS

imagesextends tslib_pibase TypoScript

FrontendExtension

File structure

A new extension: Blogging with TYPO3

Overview

define features of the new blogging application

implement the business logic

define the look and feel

take a look at security issues

modify and extend the application

Blog features

administrate blogs, blog posts and blog comments

list all available blogs

list all blog posts of a blog

list all comments of a blog post

allow users to post new comments

Comment Tag

Blog business logic

dispatch method calls in tx_blog_pi1->main()

public function main($content, $conf) { $this->conf = $conf; $this->pi_setPiVarDefaults(); $this->pi_loadLL();

if ($this->piVars['postUid']) { if ($this->piVars['newComment']) { $this->storeNewComment(); } $content = $this->renderPost(); } elseif ($this->piVars['blogUid']) { $content = $this->renderBlog(); } else { $content = $this->renderListOfBlogs(); } return $this->pi_wrapInBaseClass($content);}

Task 1: Output a listing of blogs

fetch available blogs from database

implement a new method „renderListOfBlogs()“

protected function renderListOfBlogs() {...

$blogs = $GLOBALS['TYPO3_DB']->exec_SELECTgetRows( '*', 'tx_blog_blog', 'deleted=0 AND hidden=0 AND sys_language_uid=' .

$GLOBALS['TSFE']->sys_language_uid . $this->cObj->enableFields('tx_blog_blog'), '', 'name' );

iterate through all blogs and render themprotected function renderListOfBlogs() { $template = $this->cObj->fileResource($this->conf['template']); $blogElementSubpart = $this->cObj->getSubpart($template, '###SUBPART_BLOGELEMENT###');

$blogs = $GLOBALS['TYPO3_DB']->exec_SELECTgetRows(...); foreach ($blogs as $blog) { $linkParameters = array('blogUid' => $blog['uid']); $markers = array( '###BLOG_NAME###' => $blog['name'], '###BLOG_LOGO###' => $this->cImage('uploads/tx_blog/' . $blog['logo']), '###BLOG_DESCRIPTION###' => $this->pi_RTEcssText($blog['description']), '###BLOG_MORELINK###' => $this->pi_linkTP('show blog', $linkParameters, true), ); $blogElements.= $this->cObj->substituteMarkerArray($blogElementSubpart, $markers); } return $content;}

create the template with markers and subparts

<div class="blog element"> ###BLOG_NAME### ###BLOG_LOGO### ###BLOG_DESCRIPTION### ###BLOG_MORELINK###</div>

Task 2: Display a single post with its comments

implement a new method „renderListOfBlogs()“

protected function renderPost() { $post = $this->pi_getRecord('tx_blog_post', $this->piVars['postUid']); $comments = $GLOBALS['TYPO3_DB']->exec_SELECTgetRows( '*', 'tx_blog_comment', 'deleted=0 AND hidden=0 AND sys_language_uid=' .

$GLOBALS['TSFE']->sys_language_uid . ' AND post_uid=' . $this->piVars['postUid'] . ' AND post_table="tx_blog_post"' . $this->cObj->enableFields('tx_blog_comment'), '', 'date DESC' );

// fill marker arrays and substitute in template// return content

Task 3: Add a new comment to a blog post

the whole plugin is cached („USER“)

dynamic user input won‘t be handled by the rendering when cached

define uncached behavior in TypoScript

[globalVar = _POST:tx_blog_pi1|newComment = 1] plugin.tx_blog_pi1 = USER_INT[global]

Task 3: Add a new comment to a blog post

store new comment in database

protected function storeNewComment() { $fields = array( 'post_uid' => $this->piVars['postUid'], 'post_table' => 'tx_blog_post', 'date' => time(), 'author' => $this->piVars['author'], 'email' => $this->piVars['email'], 'content' => $this->piVars['content'], );

$GLOBALS['TYPO3_DB']->exec_INSERTquery( 'tx_blog_comment', $fields );}

Take a look at security issues

possibility of SQL injections

unvalidated information submitted by a user

is there really a mail address where it was expected?

are integers really integers?

malicious information submitted by a user (XSS)

is there a possibility to inject JavaScript code?

Security: SQL injections

unescaped or unchecked values that are transferred to the database directly

$comments = $GLOBALS['TYPO3_DB']->exec_SELECTgetRows('*','tx_blog_comment','deleted=0 AND hidden=0 AND sys_language_uid=' . $GLOBALS['TSFE']->sys_language_uid . ' AND post_uid=' . $this->piVars['postUid'] . ' AND post_table="tx_blog_post"' .$this->cObj->enableFields('tx_blog_comment'));

with &postUid=1; INSERT INTO be_users SET ...; SELECT * FROM tx_blog_comment WHERE 1=1

SELECT * FROM tx_blog_comment WHERE post_uid=1;INSERT INTO be_users SET ...;SELECT * FROM tx_blog_comment WHERE 1=1 AND post_table=“tx_blog_post“ ...

Security: SQL injections

always escape or cast variables from outside

' AND post_uid=' . intval($this->piVars['postUid']) . ' AND post_table="tx_blog_post"' .

Modify and extend the blog application

store information on different DBMS (e.g. move from MySQL to Oracle)

are there any SQL statements that won‘t work in Oracle?

what about the length of the table names?

integrate spam protection for posting new comments

add validation to the arguments submitted by a user

integrate a PDF and RSS version of all blogs

implement new business logic for each new output format

Abstract

Hello world

Blog example

Persistence

http://www.flickr.com/photos/seier/501370105/

ModelViewController

DomainDrivenDesign

Core concepts

Model View Controller

Core concepts - MVC

Layered architecture

Domain Model (Domain Layer)

Controller

http://www.flickr.com/photos/bunchofpants/106465356/sizes/o/

The model is a smallrepresentation of

reality.

Core concepts - MVC

Application domain

Example: Car rental application

Application domain contains: Car, Sales Agent, Customer, Sale, Billing

defines properties and behavior of these (real world) objects

Core concepts - MVC

Object representation of data and behavior

represents the application domain in software

FLOW3: Domain Models

Core concepts - MVC

Model: Car rental example

Topictext

renders data for different output mediums

it‘s only about displaying data

includes all output logic

The viewrenders

http://www.sxc.hu/photo/1157763

The controller steersthe data flow and triggers actions

http://www.sxc.hu/browse.phtml?f=view&id=956017

Controller

Request Response

Core concepts - MVC

Conclusion MVC

Model: stores data and behavior

View: renders data

Controller: connects model and view, reacts to user input

DomainDrivenDesign

Core concepts - Domain Driven Design

Application Logic (Service Layer)

Controller

Data Mapper

Data Source Abstraction

Presentation

Domain

Data source

Application Logic (Service Layer)

Controller

Data Mapper

Data Source Abstraction

Presentation

Domain

Data source

Principles of Domain Driven Design

Domain describes activity or business of user.

on the

Domain

Having your domain rules in software

The Tower of Babel

Ubiquitous language

common vocabulary is an important prerequisite to work together

you should use the same vocabulary for discussion, modelling, development and documentation

Principles of Domain Driven Design

Domain = activity or business of user

focus on the domain

build rules of the domain in software

ubiquitous language

Example: Phone book

showEntries()checkIfUserCanDeleteEntry()exportPhoneBook()logChanges()

Not in thePhoneBook

domain

Why should you use DDD?

Build complexSQL queries

Implement application logic

Mix PHP and HTML templateto build a template-based

layout

Read lots of TypoScriptand core API docs

Build frontend formswith error handling

Care about securityadapt to the coding style,structure and thinking of

different developers

Implement application logic

Flow [flō] is the mental state of operation in which the person is fully immersed in what he or she is doing by a feeling of energized focus, full involvement, and success in the process of the activity.

Abstract

Hello world

Blog example

Persistence

How to build a typo3 v4 based app

http://www.sxc.hu/photo/516864/

Extension buildingwith Extbase

File structure

Hello World

Task: Output “Hello World”

Controller

all controllers inherit from Tx_Extbase_MVC_Controller_ActionController

Controllers contain actions: *Action

Default action: indexAction

Topictext

Hello World

Break until 11:00

-> Start screenflow again

Abstract

Hello world

Blog example

Persistence

Blog example

Task 1: Output a listing of blog postings

You want to output the postings of a predefined blog.

// inside the BlogController:public function showAction() { $blogUid = 1; // Fetch blog with UID 1 // pass blog to view so it can be rendered}

How would you fetch a blog?

Extension building with Extbase - Blog Example

Aggregates

Comment Tag

BlogRepository Aggregate RootBlog

Aggregate

Aggregates

Idea: Put your objects into a tree / hierarchical structure

Root of the tree: aggregate root

Aggregate roots are accessible through Repositories

Model classes are POPOs (almost)

POPO = Plain Old PHP Object

Model examples

Repositories

Encapsulate all data access

SQL is allowed only in the Repository

Magic methods: findBy*, findOneBy*

Repositories Blog übergeben

// inside the BlogController:public function showAction() { $blogUid = 1; $blog = $this->blogRepository->findOneByUid($blogUid); // pass blog to view so it can be rendered

// inside the BlogController:public function showAction() { $blogUid = 1; $blog = $this->blogRepository->findOneByUid($blogUid); $this->view->assign('blog', $blog); return $this->view->render(); // can be omitted}

Inside the template:

<h1>Welcome to {blog.name}</h1>

<f:for each="{blog.posts}" as="post"> <h1>{post.title}</h1> <f:actionlink controller="Post" action="show" arguments="{postUid : post.uid}">read more </f:actionlink></f:for>

Task 2: Display a single blog post

Display a post with comments

// inside the PostController:public function showAction() { // Get the Post UID // Fetch post with UID X // Pass post to view so it can be rendered}

Arguments

/** * Action that displays one single post * * @param int $postUid The uid of a post * @return string The rendered view */public function showAction($postUid) {}

Arguments

All arguments must be registered.

Registration of expected arguments happens through defining them as method parameters.

PHPDoc is mandatory as it is used for data type validation

Arguments - more advanced

/** * Action that displays one single post * * @param int $postUid The uid of a post * @return string The rendered view */public function showAction($postUid = 1) {}

Default values

Arguments - more advanced

/** * Action that displays one single post * * @param string $title Title of the post * @param string $content Content of the post * @validate $title Length(maximum=100) * @return string The rendered view */public function createAction($title, $content) {}

Do additional validation

// inside the PostController:/** * @param int $postUid The post UID to be displayed */public function showAction($postUid = 0) { // Fetch post with UID X // Pass post to view so it can be rendered}

Aggregates - continued

Comment Tag

Aggregate

PostRepositoryPost

// inside the PostController:/** * @param int $postUid The post UID to be displayed */public function showAction($postUid = 0) { $post = $this->postRepository->findOneByUid($postUid); // Pass post to view so it can be rendered}

// inside the PostController:/** * @param int $postUid The post UID to be displayed */public function showAction($postUid = 0) { $post = $this->postRepository->findOneByUid($postUid); $this->view->assign('post', $post);}

Topictext

Task 2: Display a single blog post - template

Task 3: Add a new comment

a new comment needs to be stored for a given post

1. Create the template

2. Add the comment in the controller

Task 3: Add a new comment

1. The template

Abstract

Hello world

Blog example

Persistence

Aggregates revisited

Comment Tag

Aggregate

PostRepositoryPost

Persistence

adding a blog

the blog is an aggregate root

Now, the Blog is a managed object - changes are now automatically persisted!

Persistent objectsBlogRepository

Blog$blogRepository->add(Blog $blog);

Persistence

adding a blog

the blog is an aggregate root

Now, the Blog is a managed object - changes are now automatically persisted!

Persistent objectsBlogRepository

$blogRepository->add(Blog $blog);

PostRepository

Comment is no aggregate root

Thus, Comment is automatically persisted

Persistence

adding a comment

Persistent objects

Comment

PostPost

Persistence

Transparent object persistence

All objects (and their child-objects) managed by a repository are automatically persisted

changes to these objects are automatically persisted

Persistence

Summary: Domain objects

Persistence

Summary: Domain objects

we start with the business logic (PHP classes)

Objects represent things in the real world, with their attributes and behavior

we don't care about the database backend / persistence layer

Persistence

Excursus: ActiveRecord

Introduced with Ruby on Rails

Starts with the data structures in the database

attributes are not explicitly in the objects - taken from the database

class User < ActiveRecord::Base

Very intransparent!

Abstract

Hello world

Blog example

Persistence

Outlook

Availability and documentation

Extbase will be included in TYPO3 4.3

full-blown replacement for pibase

new preferred way to write extensions

futureproof, with concepts of FLOW3

Currently no documentation, but will be available with the final release

Outlook

New kickstarter

currently ongoing project by the core development team

will be released shortly after 4.3

Domain Driven Design - Don't think in databases, think in Objects!

Resources and links

Project web site: http://forge.typo3.org/projects/show/typo3v4-mvc

SVN: https://svn.typo3.org/TYPO3v4/CoreProjects/MVC/

we will provide documentation until the release of TYPO3 4.3

First release with TYPO3 4.3 alpha3: http://typo3.org/download/packages/

Conclusion

Greatly reusablecomponents

Easy and consistent API

Easily testable+

Needs initiallearning time

Extensionsneed proper

planning

You willget addicted

Feel the flowin TYPO3 v4

?????????????

inspiring people to share.

MVC for TYPO3 4.3 with extbase

Technology

Get into the FLOW with Extbase and TYPO3 4.3

TYPO3 6.2 LTS - TYPO3 Conference Stuttgart, 2013

Get into the FLOW with Extbase

Architecture & TYPO3

TYPO3 CMS 7.1 - What’s Newlobacher.de/files/TYPO3-CMS-7.1-Die-Neuerungen-pluswerk.pdf · Eigene Conditions für das Frontend wurden bereits mit TYPO3 CMS 7.0 eingeführt Seit TYPO3

Case Study luvwise - Web Essentials · TYPO3 CMS where the client can manage the content by themselves. Developed a TYPO3 CMS extension based on Fluid/Extbase where users can login

T3CON12-DE The New TYPO3 Association and the TYPO3 Universe

Typo3 Tutorial

Inside TYPO3

How to Secure TYPO3 Installations - TYPO3 Hosting mit ... · "Exclusive: Many TYPO3 Sites have been hacked" April 27, 2011: A vulnerability in TYPO3 appararently allows attackers

T3UNI12 - Université TYPO3 2012 : mariage TYPO3+ALFRESCO

TYPO3 Inc. slides for TYPO3 Camp Venlo 2016

TYPO3 CMS 8.7 - What’s New · TYPO3 CMS 8.7 - What’s New Chapter Overview Introduction TSconﬁg&TypoScript In-DepthChanges Extbase&Fluid Deprecated/RemovedFunctions SourcesandAuthors

T3CON14EU: Migrating from TYPO3 CMS to TYPO3 Flow

Cen’s surface,extbase,tion model representations of˜written …...Vol.:(0124578) Reading and Writing 1 Cen’s surface,extbase,tion model representations of˜written and˜illustrated

Manual Typo3

Official typo3.org infrastructure &the TYPO3 Server Admin Team

TYPO3 Congres 2012 - Aan de slag met TYPO3 Extbase en Fluid

Semantic TYPO3

powermail - manuell · The rebuild was done with Extbase and Fluid. ... content elements or pages in TYPO3 Access Stop Stopdate for a form Same function as known from default content