view release on metacpan or  search on metacpan

lib/CGI/Application/Plugin/ValidateQuery.pm  view on Meta::CPAN

is usually called in C<< setup() >>, or a in a project super-class.

If C<log_level> is defined, it will override the the log level provided in
C<< validate_query_config >> and log a validation failure at that log
level.

If allow_extra is defined and true, any parameter found in $self->query not
listed in the call to validate_query will be ignored by the check (in other
words, it will be included in the profile passed to L<Params::Validate> but
marked only as optional). If this is all the validation you're performing,
don't use this; this option is here for cases where, for example, a bunch of
POST values are already being checked by something heavier like
L<Data::FormValidator> and you just want to check one or two GET values.

If you set a default for any parameter, the query will be modified with that
value should that parameter be missing.

=head2 validate_app_params

    $self->validate_app_params(
        user_id  => qr/\A[a-zA-Z]\z/,
    );

Behaves like C<< validate_query >> with these exceptions:

=over

=item * allow_extra is set to true

=item * items specified are looked for and validated using C<$self->param>
          instead of C<$self->query->param>.

=back


=head2 IMPLENTATION NOTES

We re-export the constants provided in L<Params::Validate>. They can be loaded
using either the :all tag or by including the :types tag along with the
validate_query methods. Using :all will import everything from both this
module and from Params::Validate.

We set "local $Params::Validate::NO_VALIDATION = 0;" to be sure that
Params::Validate works for us, even if is globally disabled.

To alter the application flow when validation fails, we set
'error_mode()' at the last minute, and then die, so the error mode is
triggered. Other uses of error_mode() should continue to work as normal.

This module is intended to be use for simple query validation tasks,
such as a link with  query string with a small number of arguments or a page
with a few dispatched args. For larger validation tasks, especially for
processing form submissions using L<Data::FormValidator> is recommended, along
with L<CGI::Application::ValidateRM> if you're using L<CGI::Application>.

=head2 FUTURE

This concept could be extended to all check values set through
C<< $ENV{PATH_INFO} >>.

This plugin does not handle file upload validations, and won't in the
future.

Providing untainting is not a goal of this module, but if it's easy and
if someone else provides a patch, perhaps support will be added. L<Params::Validate>
provides untainting functionality and may be useful.

=head1 AUTHOR

Nate Smith C<< nate@summersault.com >>, Mark Stosberg C<< mark@summersault.com >>

=head1 BUGS & ISSUES

Please report any bugs or feature requests to
C<bug-cgi-application-plugin-validatequery at rt.cpan.org>, or through the web interface at
L<http://rt.cpan.org/NoAuth/ReportBug.html?Queue=CGI-Application-Plugin-ValidateQuery>.
I will be notified, and then you'll automatically be notified of progress on
your bug as I make changes.

=head1 COPYRIGHT & LICENSE

Copyright 2009 Summersault, LLC., all rights reserved.

This program is free software; you can redistribute it and/or modify it
under the same terms as Perl itself.

=cut