Context menus and admin integration #

Part 4, chapter 20. An extension shows up in the administration in four places: the context menus of the content tree, the left menu, the tabs of the node view, and the top menu. All four are registered by settings that have not changed since the old releases, so an old extension's entries still appear. What changed is how they must behave: no inline code, and no link a user cannot open. This chapter goes through the four places.

1. Context menu entries #

The right-click menu of the content tree and of the sub-items list collects templates from admininterface.ini [AdditionalMenuSettings]. se7enxweb/ezownerchange registers its two entries like this:

<?php /* #?ini charset="utf-8"?

[AdditionalMenuSettings]
ContextMenuTemplateArray[]=popupmenu/ownercontextmenu.tpl
SubitemsContextMenuTemplateArray[]=popupmenu/ownersubitemscontextmenu.tpl

*/ ?>

The settings stay. The templates are what needs work, because the old ones use inline scripts and onmouseover or onclick attributes, which an enforced Content Security Policy blocks: the entry is drawn and does nothing.

Two fixes, depending on what the entry does:

Both are shown in full, before and after, in CSP: event handler attributes to data attributes.

The kernel's own menus are declared entirely in data-menu-* attributes (data-menu-url, data-menu-form, data-menu-submenu, data-menu-shown-if and others; the header comment of ezpopupmenu.js lists them). An entry that only needs to run in Exponential 6.0.15 or later can use those directly and needs no script at all.

Show the entry only to users who may use it #

Both example templates start with an access check, so a user without the policy does not see the entry:

{if fetch( 'user', 'has_access_to', hash( 'module', 'owner', 'function', 'change' ) )}
...
{/if}

Old templates often show the entry to everybody and let the view refuse. Add the check.

2. Left menu links #

A link in a left menu (the Setup menu is the usual place for an extension's tools) is a key in a [Leftmenu_*] section of menu.ini. se7enxweb/expqueue's settings/menu.ini.append.php:

<?php /* #?ini charset="utf-8"?
[Leftmenu_setup]
Links[expqueue]=expqueue/dashboard
LinkNames[expqueue]=Job queue
PolicyList_expqueue[]=expqueue/view
*/ ?>

• Links[<key>]: the address.
• LinkNames[<key>]: the text.
• PolicyList_<key>[]: the policies a user needs to see the link.

In Exponential 6 the kernel also checks, by default, whether the user can open the address itself (menu.ini [MenuAccessSettings] CheckViewAccess=enabled), and leaves out links the user cannot open (NoAccessLinks=hidden). So an old extension's link no longer shows to users without access, even if it never had a PolicyList_. Keep or add the PolicyList_ anyway: it states the intention and covers what an address cannot tell.

Groups in admin4 #

admin4 arranges the Setup menu in groups (Groups[], GroupLinks_<group>[]). A link in no group appears under "More". The kernel's menu.ini comment says an extension puts its link in a group "with GroupLinks_<group>[]=<key> in its menu.ini.append.php"; the groups ai and updates exist for extensions' links. Pick the group that fits what your tool does.

3. Tabs of the node view #

The node view's tabs are admininterface.ini [WindowControlsSettings] AdditionalTabs[], each with an [AdditionalTab_<id>] section. The kernel's audit tab is a good model:

[WindowControlsSettings]
AdditionalTabs[]=audit

[AdditionalTab_audit]
Title=
Description=
NavigationPartName=ezcontentnavigationpart
HeaderTemplate=audit/node_header.tpl
Template=audit/node.tpl

What to check in an old extension's tab:

• its templates carry no inline code and no inline CSS (chapters 13 to 16 of this part);
• it checks access in its template, as the audit tab does for audit/read;
• it looks right in admin4, light and dark (admin4 styling for extension pages).

A siteaccess can hide an extension's tab with HiddenTabs[], which exists because "a siteaccess cannot take a tab out of AdditionalTabs[] that an extension appends" (the comment in the kernel's admininterface.ini).

4. Top menu tabs and navigation parts #

An extension with its own area of the administration may add a navigation part (menu.ini [NavigationPart] Part[<identifier>]=<name>) and a top tab ([TopAdminMenu] Tabs[] with a [Topmenu_<name>] section). Most extensions do not need one: a group of links in Setup is easier to find and keeps the top menu short. If your old extension has a top tab, consider moving it into Setup during the upgrade, and say so in the changelog.

[TopAdminMenu] also has a list of tabs to leave out, for the same reason as HiddenTabs[].

Check your work #

• Right-click a node in the content tree and in the sub-items list, as an administrator and as a user without your policy: the entry appears only for the first, and works.
• With the browser console open: no Content Security Policy reports from your entries.
• The left menu link appears in the right group in admin4, and not for a user who cannot open it.

Related pages #

• Previous: admin4 styling for extension pages
• Next: Naming and branding during an upgrade
• Content Security Policy
• Policy functions and access
• Modules and views
• Free documentation: this page is free to copy, translate and improve under the GNU FDL 1.3.