Fix: use CSRF token manager for Contao 5 request token

contao/templates/be_dummy_copier.html5

@@ -1,7 +1,4 @@
-<?php $this->extend('be_main'); ?>
+<form action="<?= $this->action; ?>" method="post" style="max-width:900px;">
-
-<?php $this->block('main'); ?>
-  <form action="<?= $this->action; ?>" method="post" style="max-width:900px;">
     <input type="hidden" name="REQUEST_TOKEN" value="<?= $this->requestToken; ?>">
     <input type="hidden" name="FORM_SUBMIT" value="tl_dummy_copier">
 
@@ -25,7 +22,7 @@
           </span>
           <select id="sourcePages" name="sourcePages[]" multiple size="12" style="width:100%;">
             <?php foreach (($this->pageChoices ?? []) as $id => $label): ?>
-              <option value="<?= (int) $id; ?>" <?= in_array((int) $id, ($this->selected['sourcePages'] ?? []), true) ? 'selected' : ''; ?>><?= $this->specialchars((string) $label); ?></option>
+              <option value="<?= (int) $id; ?>" <?= in_array((int) $id, ($this->selected['sourcePages'] ?? []), true) ? 'selected' : ''; ?>><?= htmlspecialchars((string) $label, ENT_QUOTES, 'UTF-8'); ?></option>
             <?php endforeach; ?>
           </select>
         <?php endif; ?>
@@ -41,7 +38,7 @@
         </span>
         <select id="sourceModules" name="sourceModules[]" multiple size="10" style="width:100%;">
           <?php foreach (($this->moduleChoices ?? []) as $id => $label): ?>
-            <option value="<?= (int) $id; ?>" <?= in_array((int) $id, ($this->selected['sourceModules'] ?? []), true) ? 'selected' : ''; ?>><?= $this->specialchars((string) $label); ?></option>
+            <option value="<?= (int) $id; ?>" <?= in_array((int) $id, ($this->selected['sourceModules'] ?? []), true) ? 'selected' : ''; ?>><?= htmlspecialchars((string) $label, ENT_QUOTES, 'UTF-8'); ?></option>
           <?php endforeach; ?>
         </select>
       </label>
@@ -56,7 +53,7 @@
         </span>
         <select id="sourceContent" name="sourceContent[]" multiple size="10" style="width:100%;">
           <?php foreach (($this->contentChoices ?? []) as $id => $label): ?>
-            <option value="<?= (int) $id; ?>" <?= in_array((int) $id, ($this->selected['sourceContent'] ?? []), true) ? 'selected' : ''; ?>><?= $this->specialchars((string) $label); ?></option>
+            <option value="<?= (int) $id; ?>" <?= in_array((int) $id, ($this->selected['sourceContent'] ?? []), true) ? 'selected' : ''; ?>><?= htmlspecialchars((string) $label, ENT_QUOTES, 'UTF-8'); ?></option>
           <?php endforeach; ?>
         </select>
       </label>
@@ -74,7 +71,7 @@
           </span>
           <select id="sourceDirectories" name="sourceDirectories[]" multiple size="10" style="width:100%;">
             <?php foreach (($this->directoryChoices ?? []) as $path => $label): ?>
-              <option value="<?= $this->specialchars((string) $path); ?>" <?= in_array((string) $path, ($this->selected['sourceDirectories'] ?? []), true) ? 'selected' : ''; ?>><?= $this->specialchars((string) $label); ?></option>
+              <option value="<?= htmlspecialchars((string) $path, ENT_QUOTES, 'UTF-8'); ?>" <?= in_array((string) $path, ($this->selected['sourceDirectories'] ?? []), true) ? 'selected' : ''; ?>><?= htmlspecialchars((string) $label, ENT_QUOTES, 'UTF-8'); ?></option>
             <?php endforeach; ?>
           </select>
         <?php endif; ?>
@@ -89,7 +86,7 @@
           <select name="targetParentPage" required style="width:100%;">
             <option value="">Bitte waehlen</option>
             <?php foreach (($this->pageChoices ?? []) as $id => $label): ?>
-              <option value="<?= (int) $id; ?>" <?= ((int) ($this->selected['targetParentPage'] ?? 0) === (int) $id) ? 'selected' : ''; ?>><?= $this->specialchars((string) $label); ?></option>
+              <option value="<?= (int) $id; ?>" <?= ((int) ($this->selected['targetParentPage'] ?? 0) === (int) $id) ? 'selected' : ''; ?>><?= htmlspecialchars((string) $label, ENT_QUOTES, 'UTF-8'); ?></option>
             <?php endforeach; ?>
           </select>
         <?php endif; ?>
@@ -97,8 +94,8 @@
     </p>
 
     <p><label>Ziel-Artikel ID (nur fuer einzelne Content-IDs):<br><input type="number" name="targetArticle" min="0" value="<?= (int) ($this->selected['targetArticle'] ?? 0); ?>"></label></p>
-    <p><label>Ziel-Verzeichnis (z. B. files/kunden/kunde-x):<br><input type="text" name="targetDirectory" style="width:100%" value="<?= $this->specialchars((string) ($this->selected['targetDirectory'] ?? '')); ?>"></label></p>
+    <p><label>Ziel-Verzeichnis (z. B. files/kunden/kunde-x):<br><input type="text" name="targetDirectory" style="width:100%" value="<?= htmlspecialchars((string) ($this->selected['targetDirectory'] ?? ''), ENT_QUOTES, 'UTF-8'); ?>"></label></p>
-    <p><label>Praefix fuer Titel/Name/Alias:<br><input type="text" name="namePrefix" placeholder="kunde-x-" value="<?= $this->specialchars((string) ($this->selected['namePrefix'] ?? '')); ?>"></label></p>
+    <p><label>Praefix fuer Titel/Name/Alias:<br><input type="text" name="namePrefix" placeholder="kunde-x-" value="<?= htmlspecialchars((string) ($this->selected['namePrefix'] ?? ''), ENT_QUOTES, 'UTF-8'); ?>"></label></p>
 
     <p><label><input type="checkbox" name="includeContent" value="1" checked> Seiten inkl. Artikel/Content kopieren</label></p>
     <p><label><input type="checkbox" name="copyModules" value="1" checked> Module kopieren und neu verlinken</label></p>
@@ -170,5 +167,4 @@
         });
       })();
     </script>
-  </form>
+</form>
-<?php $this->endblock(); ?>

src/Backend/DummyCopierModule.php

@@ -8,13 +8,10 @@ use Webfarben\DummyCopier\Service\DummyCopier;
 use Webfarben\DummyCopier\Service\DummyCopyOptions;
 use Contao\BackendModule;
 use Contao\Environment;
-use Contao\FileTree;
 use Contao\Input;
 use Contao\Message;
-use Contao\PageTree;
 use Contao\StringUtil;
 use Contao\System;
-use Contao\Widget;
 use Doctrine\DBAL\Connection;
 use Symfony\Component\Filesystem\Filesystem;
 
@@ -28,7 +25,7 @@ class DummyCopierModule extends BackendModule
         $connection = System::getContainer()->get('database_connection');
 
         $this->Template->action = Environment::get('request');
-        $this->Template->requestToken = \defined('REQUEST_TOKEN') ? REQUEST_TOKEN : '';
+        $this->Template->requestToken = $this->getCsrfToken();
         $this->Template->pageChoices = $this->getPageChoices($connection);
         $this->Template->moduleChoices = $this->getModuleChoices($connection);
         $this->Template->contentChoices = $this->getContentChoices($connection);
@@ -36,6 +33,7 @@ class DummyCopierModule extends BackendModule
         $this->Template->sourcePagesWidget = '';
         $this->Template->targetParentPageWidget = '';
         $this->Template->sourceDirectoriesWidget = '';
+
         $targetParentPageId = $this->parseSingleIdInput(Input::postRaw('targetParentPage'));
 
         $this->Template->selected = [
@@ -49,8 +47,6 @@ class DummyCopierModule extends BackendModule
             'namePrefix' => trim((string) Input::post('namePrefix')),
         ];
 
-        $this->prepareTreeWidgets();
-
         if (Input::post('FORM_SUBMIT') !== 'tl_dummy_copier') {
             return;
         }
@@ -143,85 +139,24 @@ class DummyCopierModule extends BackendModule
         return $ids[0] ?? 0;
     }
 
-    private function prepareTreeWidgets(): void
+    private function getCsrfToken(): string
     {
-        if (!class_exists(PageTree::class) || !class_exists(FileTree::class) || !class_exists(Widget::class)) {
+        $container = System::getContainer();
-            return;
+
+        // Contao 5: use Symfony CSRF token manager
+        if ($container->has('contao.csrf.token_manager')) {
+            return $container
+                ->get('contao.csrf.token_manager')
+                ->getToken((string) $container->getParameter('contao.csrf_token_name'))
+                ->getValue();
         }
 
-        try {
+        // Contao 4 fallback
-            $selectedPages = $this->parseIdInput(Input::postRaw('sourcePages'));
+        if (\defined('REQUEST_TOKEN')) {
-            $selectedParent = (int) Input::post('targetParentPage');
+            return REQUEST_TOKEN;
-            $selectedDirectories = $this->parsePathInput(Input::postRaw('sourceDirectories'));
-
-            $this->Template->sourcePagesWidget = $this->renderPageTreeWidget(
-                'sourcePages',
-                'Quell-Seiten (pageTree)',
-                $selectedPages,
-                true
-            );
-
-            $this->Template->targetParentPageWidget = $this->renderPageTreeWidget(
-                'targetParentPage',
-                'Ziel-Elternseite (pageTree)',
-                $selectedParent > 0 ? [$selectedParent] : [],
-                false
-            );
-
-            $this->Template->sourceDirectoriesWidget = $this->renderFileTreeWidget(
-                'sourceDirectories',
-                'Quell-Verzeichnisse (fileTree)',
-                $selectedDirectories
-            );
-        } catch (\Throwable $exception) {
-            // If widget rendering differs by Contao version, the module falls back to select boxes.
-            $this->Template->sourcePagesWidget = '';
-            $this->Template->targetParentPageWidget = '';
-            $this->Template->sourceDirectoriesWidget = '';
-            Message::addInfo('Tree-Widgets konnten nicht initialisiert werden, Fallback-Auswahl wird verwendet.');
         }
-    }
 
-    private function renderPageTreeWidget(string $name, string $label, array $value, bool $multiple): string
+        return '';
-    {
-        $attributes = Widget::getAttributesFromDca([
-            'inputType' => 'pageTree',
-            'label' => [$label, ''],
-            'eval' => [
-                'fieldType' => $multiple ? 'checkbox' : 'radio',
-                'multiple' => $multiple,
-                'tl_class' => 'clr',
-            ],
-        ], $name, $value, $name, 'tl_dummy_copier');
-
-        $attributes['id'] = $name;
-        $attributes['name'] = $name;
-
-        $widget = new PageTree($attributes);
-
-        return $widget->generate();
-    }
-
-    private function renderFileTreeWidget(string $name, string $label, array $value): string
-    {
-        $attributes = Widget::getAttributesFromDca([
-            'inputType' => 'fileTree',
-            'label' => [$label, ''],
-            'eval' => [
-                'fieldType' => 'checkbox',
-                'filesOnly' => false,
-                'files' => false,
-                'multiple' => true,
-                'tl_class' => 'clr',
-            ],
-        ], $name, $value, $name, 'tl_dummy_copier');
-
-        $attributes['id'] = $name;
-        $attributes['name'] = $name;
-
-        $widget = new FileTree($attributes);
-
-        return $widget->generate();
     }
 
     /**