fix(tmplvars): TVフォーム生成とURL型保存処理をPHP8対応

[yama]

https://forum.modx.jp/viewtopic.php?t=2036

概要

このPRの目的を日本語で記載してください。

This pull request introduces several improvements and refactorings to the handling and rendering of Template Variables (TVs) in the document manager module. The changes focus on modernizing the TV input rendering process by moving HTML markup into template files, enhancing security with better escaping, improving maintainability, and updating the logic for URL TVs. Additionally, there are minor fixes and code cleanups in related areas.

Key improvements and changes:

Template Variable (TV) Rendering Refactor

• Moved the rendering of TV input fields (such as date, file, image, and URL types) from inline PHP string generation to dedicated template files (form_date.tpl, form_file.tpl, form_image.tpl, form_url.tpl). This improves maintainability and separation of concerns. [1] [2] [3] [4] [5]
• Updated the renderFormElement method to handle null or missing values more robustly and to ensure proper type casting for default text and elements.
• Improved handling of PHP code in TV default values and field values by checking for string type before processing.

Security and Data Handling

• Added HTML escaping (hsc()) for TV captions and descriptions when rendering checkboxes, reducing the risk of XSS vulnerabilities.
• Ensured that TV values are always initialized to a string, preventing potential PHP warnings or errors.

URL Template Variable Logic Update

• Refined the logic for handling URL TVs: now supports a special "DocID" prefix that wraps numeric values in MODX link notation, and only prepends a prefix if selected (no longer strips protocols unnecessarily).
• Updated the URL TV input to use a template for consistent rendering and easier maintenance.

JavaScript and UI Improvements

• Moved resource/file/image browser JavaScript functions out of PHP-generated code and into the main template, reducing duplication and improving clarity.

Minor Fixes and Cleanups

• Fixed variable naming and initialization in access control rendering for modules and TVs. [1] [2]
• Changed SQL joins and queries in tv.ajax.php for more accurate TV listing and ordering.
• Updated form name references in templates to support dynamic forms.

These changes collectively modernize the TV input system, improve security, and lay the groundwork for further enhancements.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 3a57d92ecd

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[Copilot]

Pull request overview

ドキュメント管理・マネージャ内のTemplate Variable(TV)フォーム生成をテンプレートベースへ寄せ、PHP8環境での警告回避とURL型TVの保存・表示処理を更新する変更。

Changes:

• TV入力フォーム生成をテンプレートファイル（date/file/image/url）へ移行し、URL型TVのprefix/DocID対応を追加
• DocManager側TV一覧取得・描画処理を整理（JOIN/ORDER調整、caption/descriptionのエスケープ、共通renderFormElement利用）
• DocManagerのファイル/画像ブラウザ用JSをテンプレートへ集約、権限制御UIの変数初期化を修正

Reviewed changes

Copilot reviewed 10 out of 10 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
manager/includes/traits/document.parser.subparser.trait.php	TVレンダリング共通処理を更新（URL専用フォーム追加、dateフォームのform名対応、image/fileのエスケープ等）
manager/includes/docvars/inputform/form_url.tpl	URL型TV入力（prefix選択＋入力欄）のテンプレート新設
manager/includes/docvars/inputform/form_image.tpl	image入力のstyle属性受け渡し形式を調整
manager/includes/docvars/inputform/form_file.tpl	file入力のstyle属性受け渡し形式を調整
manager/includes/docvars/inputform/form_date.tpl	日付クリア処理の参照フォーム名を動的化
manager/actions/element/mutate_tmplvars.dynamic.php	TVアクセス権UIの変数初期化（$chks/$notPublic）を修正
manager/actions/element/mutate_module.dynamic.php	モジュールアクセス権UIの変数初期化（$chks/$notPublic）を修正
assets/modules/docmanager/tv.ajax.php	TV一覧取得クエリ・描画を更新し、共通tmplvarsレンダリングとエスケープを適用
assets/modules/docmanager/templates/main.tpl	ファイル/画像ブラウザ呼び出しJSをテンプレート側へ集約
assets/modules/docmanager/classes/dm_backend.class.php	URL型TVの保存処理をprefix/DocID対応へ更新

[Copilot]

Pull request overview

Copilot reviewed 14 out of 14 changed files in this pull request and generated 2 comments.