{"action":"created","issue":{"url":"https://api.github.com/repos/GetSimpleCMS/GetSimpleCMS/issues/1076","labels_url":"https://api.github.com/repos/GetSimpleCMS/GetSimpleCMS/issues/1076/labels{/name}","comments_url":"https://api.github.com/repos/GetSimpleCMS/GetSimpleCMS/issues/1076/comments","events_url":"https://api.github.com/repos/GetSimpleCMS/GetSimpleCMS/issues/1076/events","html_url":"https://github.com/GetSimpleCMS/GetSimpleCMS/issues/1076","id":95162995,"number":1076,"title":"An exposed API for backend utility functions","user":{"login":"lokothodida","id":4363863,"avatar_url":"https://avatars.githubusercontent.com/u/4363863?v=3","gravatar_id":"","url":"https://api.github.com/users/lokothodida","html_url":"https://github.com/lokothodida","followers_url":"https://api.github.com/users/lokothodida/followers","following_url":"https://api.github.com/users/lokothodida/following{/other_user}","gists_url":"https://api.github.com/users/lokothodida/gists{/gist_id}","starred_url":"https://api.github.com/users/lokothodida/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/lokothodida/subscriptions","organizations_url":"https://api.github.com/users/lokothodida/orgs","repos_url":"https://api.github.com/users/lokothodida/repos","events_url":"https://api.github.com/users/lokothodida/events{/privacy}","received_events_url":"https://api.github.com/users/lokothodida/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":4,"created_at":"2015-07-15T10:51:30Z","updated_at":"2015-07-15T14:42:01Z","closed_at":null,"body":"The [`/inc/basic.php`](https://github.com/GetSimpleCMS/GetSimpleCMS/blob/master/admin/inc/basic.php) file has a lot of functions that are useful not just for the core, but for plugin developers:\r\n\r\n* string cleaning/sanitization\r\n* slugification\r\n* xml creation/saving\r\n* folder/file manipulation\r\n* access to cached variables/site data\r\n* sending email\r\n* getting (relative) urls\r\n* transliteration\r\n\r\nThese are all tools that many plugin developers re-implement themselves, and this will likely expose their plugins to the very same (XSS) vulnerabilities that you have been working with in the core as of late.\r\n\r\nIf there were an exposed and documented API/library for some of these features, it could solve the following problems:\r\n\r\n* Plugin development is made simpler because GetSimple-specific utilites exist for many of the nitty-gritty problems that are often encountered (namely interacting with the actual GetSimple site data (xml files), folder creation (particularly permissions) and getting GS configuration information)\r\n  * A good utility for building and getting data from XML structures would end up doing the more useful bit of (the simpler side of) `DM_Matrix`'s functionality but in the core\r\n* With a suitable wrapper around getting/saving data (whether it is XML or otherwise), most (if not all) of the character escaping/validation can be done in the wrapper. This means that all core functionality and plugins that use said wrapper benefit from the same security fixes simultaneously\r\n* It will make the sample plugin #962 more tractable, as it will effectively showcase the API and how best to use it\r\n\r\nI'm not suggesting that the current state of the `basic.php` file just be documented and exposed or that the file be rewritten, but that we have a new class/set of classes/set of functions with simple interfaces that realize their functionality (likely by wrapping them). Something like a `GSUtil` class or a series of `gs_util_*` functions. I can also see that a lot of these types of methods (e.g. `getRelRequestURI`are being introduced in 3.4, but I don't know if you are intending to expose them.\r\n\r\n### Example for creating folders/files\r\n```php\r\n$folder = 'foldername/';\r\n$file   = $folder . 'data'; // or specify the extension; .xml is default\r\n\r\n// Create the folder (function does it only if the folder doesn't exist)\r\n// Permissions are automatically set to be sensible ones\r\n// Folder is created data/other/foldername/\r\nGSUtil::mkdir($folder);\r\n\r\n// Create the file\r\nGSUtil::mkfile($file);\r\n\r\n// Some manipulations to the file's @data (which is given as an array)\r\n$data = GSUtil::getFileData($file);\r\n$data['title'] = 'New title';\r\n\r\n// ...\r\n\r\n// Save the changes to the file\r\nGSUtil::saveFileData($file, $data);\r\n```\r\n\r\nThe developer is kept abstracted away from the XML implementation details and character escaping and is left just manipulating an `array`.\r\n\r\n## Proposal methods for theoretical `GSUtil`\r\n* `mkdir($dir)` : create directory `/data/other/$dir`\r\n* `rmdir($dir)` : remove directory `/data/other/$dir`\r\n* `mkfile($filename, $data)` : make (XML) file `/data/other/$filename` with data from `(array) $data`\r\n* `backup($dir)` : create a backup of directory `data/other/$dir`\r\n* `getFileData($filename)` : get data of (XML) file `/data/other/$filename` formatted as an `array`\r\n* `saveFileData($filename, $data)` : save `(array) $data` to XML file `data/other/$filename`, with strings safely escaped/ in `CDATA` blocks\r\n* `translit($string)` : transliterate `$string`\r\n* `slug($string)` : return i18n-valid slug of the `$string`"},"comment":{"url":"https://api.github.com/repos/GetSimpleCMS/GetSimpleCMS/issues/comments/121637134","html_url":"https://github.com/GetSimpleCMS/GetSimpleCMS/issues/1076#issuecomment-121637134","issue_url":"https://api.github.com/repos/GetSimpleCMS/GetSimpleCMS/issues/1076","id":121637134,"user":{"login":"tablatronix","id":807787,"avatar_url":"https://avatars.githubusercontent.com/u/807787?v=3","gravatar_id":"","url":"https://api.github.com/users/tablatronix","html_url":"https://github.com/tablatronix","followers_url":"https://api.github.com/users/tablatronix/followers","following_url":"https://api.github.com/users/tablatronix/following{/other_user}","gists_url":"https://api.github.com/users/tablatronix/gists{/gist_id}","starred_url":"https://api.github.com/users/tablatronix/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/tablatronix/subscriptions","organizations_url":"https://api.github.com/users/tablatronix/orgs","repos_url":"https://api.github.com/users/tablatronix/repos","events_url":"https://api.github.com/users/tablatronix/events{/privacy}","received_events_url":"https://api.github.com/users/tablatronix/received_events","type":"User","site_admin":false},"created_at":"2015-07-15T14:42:01Z","updated_at":"2015-07-15T14:42:01Z","body":"There is some movement in the forums, gs custom settings plugin, and of course your oop plugin stuff."}}