Fix: use CSRF token manager for Contao 5 request token

Fix: remove PageTree/FileTree widgets, use native selects only
Fix: remove be_main extend for Contao 5 compatibility
2026-03-11 21:38:25 +01:00 · 2026-03-11 21:32:03 +01:00 · 2026-03-11 21:15:23 +01:00 · 2026-03-11 21:13:15 +01:00
2 changed files with 24 additions and 93 deletions
--- a/contao/templates/be_dummy_copier.html5
+++ b/contao/templates/be_dummy_copier.html5
@@ -1,6 +1,3 @@
-<?php $this->extend('be_main'); ?>
-
-<?php $this->block('main'); ?>
 <form action="<?= $this->action; ?>" method="post" style="max-width:900px;">
    <input type="hidden" name="REQUEST_TOKEN" value="<?= $this->requestToken; ?>">
    <input type="hidden" name="FORM_SUBMIT" value="tl_dummy_copier">
@@ -25,7 +22,7 @@
          </span>
          <select id="sourcePages" name="sourcePages[]" multiple size="12" style="width:100%;">
            <?php foreach (($this->pageChoices ?? []) as $id => $label): ?>
-              <option value="<?= (int) $id; ?>" <?= in_array((int) $id, ($this->selected['sourcePages'] ?? []), true) ? 'selected' : ''; ?>><?= $this->specialchars((string) $label); ?></option>
+              <option value="<?= (int) $id; ?>" <?= in_array((int) $id, ($this->selected['sourcePages'] ?? []), true) ? 'selected' : ''; ?>><?= htmlspecialchars((string) $label, ENT_QUOTES, 'UTF-8'); ?></option>
            <?php endforeach; ?>
          </select>
        <?php endif; ?>
@@ -41,7 +38,7 @@
        </span>
        <select id="sourceModules" name="sourceModules[]" multiple size="10" style="width:100%;">
          <?php foreach (($this->moduleChoices ?? []) as $id => $label): ?>
-            <option value="<?= (int) $id; ?>" <?= in_array((int) $id, ($this->selected['sourceModules'] ?? []), true) ? 'selected' : ''; ?>><?= $this->specialchars((string) $label); ?></option>
+            <option value="<?= (int) $id; ?>" <?= in_array((int) $id, ($this->selected['sourceModules'] ?? []), true) ? 'selected' : ''; ?>><?= htmlspecialchars((string) $label, ENT_QUOTES, 'UTF-8'); ?></option>
          <?php endforeach; ?>
        </select>
      </label>
@@ -56,7 +53,7 @@
        </span>
        <select id="sourceContent" name="sourceContent[]" multiple size="10" style="width:100%;">
          <?php foreach (($this->contentChoices ?? []) as $id => $label): ?>
-            <option value="<?= (int) $id; ?>" <?= in_array((int) $id, ($this->selected['sourceContent'] ?? []), true) ? 'selected' : ''; ?>><?= $this->specialchars((string) $label); ?></option>
+            <option value="<?= (int) $id; ?>" <?= in_array((int) $id, ($this->selected['sourceContent'] ?? []), true) ? 'selected' : ''; ?>><?= htmlspecialchars((string) $label, ENT_QUOTES, 'UTF-8'); ?></option>
          <?php endforeach; ?>
        </select>
      </label>
@@ -74,7 +71,7 @@
          </span>
          <select id="sourceDirectories" name="sourceDirectories[]" multiple size="10" style="width:100%;">
            <?php foreach (($this->directoryChoices ?? []) as $path => $label): ?>
-              <option value="<?= $this->specialchars((string) $path); ?>" <?= in_array((string) $path, ($this->selected['sourceDirectories'] ?? []), true) ? 'selected' : ''; ?>><?= $this->specialchars((string) $label); ?></option>
+              <option value="<?= htmlspecialchars((string) $path, ENT_QUOTES, 'UTF-8'); ?>" <?= in_array((string) $path, ($this->selected['sourceDirectories'] ?? []), true) ? 'selected' : ''; ?>><?= htmlspecialchars((string) $label, ENT_QUOTES, 'UTF-8'); ?></option>
            <?php endforeach; ?>
          </select>
        <?php endif; ?>
@@ -89,7 +86,7 @@
          <select name="targetParentPage" required style="width:100%;">
            <option value="">Bitte waehlen</option>
            <?php foreach (($this->pageChoices ?? []) as $id => $label): ?>
-              <option value="<?= (int) $id; ?>" <?= ((int) ($this->selected['targetParentPage'] ?? 0) === (int) $id) ? 'selected' : ''; ?>><?= $this->specialchars((string) $label); ?></option>
+              <option value="<?= (int) $id; ?>" <?= ((int) ($this->selected['targetParentPage'] ?? 0) === (int) $id) ? 'selected' : ''; ?>><?= htmlspecialchars((string) $label, ENT_QUOTES, 'UTF-8'); ?></option>
            <?php endforeach; ?>
          </select>
        <?php endif; ?>
@@ -97,8 +94,8 @@
    </p>

    <p><label>Ziel-Artikel ID (nur fuer einzelne Content-IDs):<br><input type="number" name="targetArticle" min="0" value="<?= (int) ($this->selected['targetArticle'] ?? 0); ?>"></label></p>
-    <p><label>Ziel-Verzeichnis (z. B. files/kunden/kunde-x):<br><input type="text" name="targetDirectory" style="width:100%" value="<?= $this->specialchars((string) ($this->selected['targetDirectory'] ?? '')); ?>"></label></p>
-    <p><label>Praefix fuer Titel/Name/Alias:<br><input type="text" name="namePrefix" placeholder="kunde-x-" value="<?= $this->specialchars((string) ($this->selected['namePrefix'] ?? '')); ?>"></label></p>
+    <p><label>Ziel-Verzeichnis (z. B. files/kunden/kunde-x):<br><input type="text" name="targetDirectory" style="width:100%" value="<?= htmlspecialchars((string) ($this->selected['targetDirectory'] ?? ''), ENT_QUOTES, 'UTF-8'); ?>"></label></p>
+    <p><label>Praefix fuer Titel/Name/Alias:<br><input type="text" name="namePrefix" placeholder="kunde-x-" value="<?= htmlspecialchars((string) ($this->selected['namePrefix'] ?? ''), ENT_QUOTES, 'UTF-8'); ?>"></label></p>

    <p><label><input type="checkbox" name="includeContent" value="1" checked> Seiten inkl. Artikel/Content kopieren</label></p>
    <p><label><input type="checkbox" name="copyModules" value="1" checked> Module kopieren und neu verlinken</label></p>
@@ -171,4 +168,3 @@
      })();
    </script>
 </form>
-<?php $this->endblock(); ?>
--- a/src/Backend/DummyCopierModule.php
+++ b/src/Backend/DummyCopierModule.php
@@ -8,13 +8,10 @@ use Webfarben\DummyCopier\Service\DummyCopier;
 use Webfarben\DummyCopier\Service\DummyCopyOptions;
 use Contao\BackendModule;
 use Contao\Environment;
-use Contao\FileTree;
 use Contao\Input;
 use Contao\Message;
-use Contao\PageTree;
 use Contao\StringUtil;
 use Contao\System;
-use Contao\Widget;
 use Doctrine\DBAL\Connection;
 use Symfony\Component\Filesystem\Filesystem;

@@ -28,7 +25,7 @@ class DummyCopierModule extends BackendModule
        $connection = System::getContainer()->get('database_connection');

        $this->Template->action = Environment::get('request');
-        $this->Template->requestToken = \defined('REQUEST_TOKEN') ? REQUEST_TOKEN : '';
+        $this->Template->requestToken = $this->getCsrfToken();
        $this->Template->pageChoices = $this->getPageChoices($connection);
        $this->Template->moduleChoices = $this->getModuleChoices($connection);
        $this->Template->contentChoices = $this->getContentChoices($connection);
@@ -36,6 +33,7 @@ class DummyCopierModule extends BackendModule
        $this->Template->sourcePagesWidget = '';
        $this->Template->targetParentPageWidget = '';
        $this->Template->sourceDirectoriesWidget = '';
+
        $targetParentPageId = $this->parseSingleIdInput(Input::postRaw('targetParentPage'));

        $this->Template->selected = [
@@ -49,8 +47,6 @@ class DummyCopierModule extends BackendModule
            'namePrefix' => trim((string) Input::post('namePrefix')),
        ];

-        $this->prepareTreeWidgets();
-
        if (Input::post('FORM_SUBMIT') !== 'tl_dummy_copier') {
            return;
        }
@@ -143,85 +139,24 @@ class DummyCopierModule extends BackendModule
        return $ids[0] ?? 0;
    }

-    private function prepareTreeWidgets(): void
+    private function getCsrfToken(): string
    {
-        if (!class_exists(PageTree::class) || !class_exists(FileTree::class) || !class_exists(Widget::class)) {
-            return;
+        $container = System::getContainer();
+
+        // Contao 5: use Symfony CSRF token manager
+        if ($container->has('contao.csrf.token_manager')) {
+            return $container
+                ->get('contao.csrf.token_manager')
+                ->getToken((string) $container->getParameter('contao.csrf_token_name'))
+                ->getValue();
        }

-        try {
-            $selectedPages = $this->parseIdInput(Input::postRaw('sourcePages'));
-            $selectedParent = (int) Input::post('targetParentPage');
-            $selectedDirectories = $this->parsePathInput(Input::postRaw('sourceDirectories'));
-
-            $this->Template->sourcePagesWidget = $this->renderPageTreeWidget(
-                'sourcePages',
-                'Quell-Seiten (pageTree)',
-                $selectedPages,
-                true
-            );
-
-            $this->Template->targetParentPageWidget = $this->renderPageTreeWidget(
-                'targetParentPage',
-                'Ziel-Elternseite (pageTree)',
-                $selectedParent > 0 ? [$selectedParent] : [],
-                false
-            );
-
-            $this->Template->sourceDirectoriesWidget = $this->renderFileTreeWidget(
-                'sourceDirectories',
-                'Quell-Verzeichnisse (fileTree)',
-                $selectedDirectories
-            );
-        } catch (\Throwable $exception) {
-            // If widget rendering differs by Contao version, the module falls back to select boxes.
-            $this->Template->sourcePagesWidget = '';
-            $this->Template->targetParentPageWidget = '';
-            $this->Template->sourceDirectoriesWidget = '';
-            Message::addInfo('Tree-Widgets konnten nicht initialisiert werden, Fallback-Auswahl wird verwendet.');
-        }
+        // Contao 4 fallback
+        if (\defined('REQUEST_TOKEN')) {
+            return REQUEST_TOKEN;
        }

-    private function renderPageTreeWidget(string $name, string $label, array $value, bool $multiple): string
-    {
-        $attributes = Widget::getAttributesFromDca([
-            'inputType' => 'pageTree',
-            'label' => [$label, ''],
-            'eval' => [
-                'fieldType' => $multiple ? 'checkbox' : 'radio',
-                'multiple' => $multiple,
-                'tl_class' => 'clr',
-            ],
-        ], $name, $value, $name, 'tl_dummy_copier');
-
-        $attributes['id'] = $name;
-        $attributes['name'] = $name;
-
-        $widget = new PageTree($attributes);
-
-        return $widget->generate();
-    }
-
-    private function renderFileTreeWidget(string $name, string $label, array $value): string
-    {
-        $attributes = Widget::getAttributesFromDca([
-            'inputType' => 'fileTree',
-            'label' => [$label, ''],
-            'eval' => [
-                'fieldType' => 'checkbox',
-                'filesOnly' => false,
-                'files' => false,
-                'multiple' => true,
-                'tl_class' => 'clr',
-            ],
-        ], $name, $value, $name, 'tl_dummy_copier');
-
-        $attributes['id'] = $name;
-        $attributes['name'] = $name;
-
-        $widget = new FileTree($attributes);
-
-        return $widget->generate();
+        return '';
    }

    /**
Author	SHA1	Message	Date
webfarben	06a70b8611	Fix: use CSRF token manager for Contao 5 request token	2026-03-11 21:38:25 +01:00
webfarben	6170b255a3	Fix: remove PageTree/FileTree widgets, use native selects only	2026-03-11 21:32:03 +01:00
webfarben	323ab20c6b	Fix: remove be_main extend for Contao 5 compatibility	2026-03-11 21:15:23 +01:00
webfarben	9ee7aea69b	Fix: replace specialchars() with htmlspecialchars() for Contao 5 compatibility	2026-03-11 21:13:15 +01:00