Temporary fix for frontend AfformTokens being generated incorrectly

[mattwire]

Overview

On WordPress when you use the Afform "MessageTokens" it doesn't always generate the correct URLs.

Before

URLs generated incorrectly depending on context

After

URLs generated correctly.

Technical Details

Example:

1. Submit an Afform (with contact + activity) that is on the WordPress frontend (eg. embedded in a page): https://mysite.com/myfirstform.
2. Trigger a CiviRule on "activity create" that sends an email containing a "Message Token" for another form: https://mysite.com/mysecondform.
3. Review the sent email and see that the link to the form is not correct.

It looks like: https://mysite.com/myfirstform?civiwp=mysite.com/mysecondform&token=...
But should look like: https://mysite.com/mysecondform?token=...

This is because the tokens code detects the referrer form and uses that as the frontend_url which we don't want in this case because the forms are completely separate.

Comments

Adding this as draft because it's a hacky proof of concept using \Civi::$statics to pass context through. But we should do it a better way.

[civibot]

🤖 Thank you for contributing to CiviCRM! ❤️ We will need to test and review this PR. 👷

Introduction for new contributors...

• If this is your first PR, an admin will greenlight automated testing with the command ok to test or add to whitelist.
• A series of tests will automatically run. You can see the results at the bottom of this page (if there are any problems, it will include a link to see what went wrong).
• A demo site will be built where anyone can try out a version of CiviCRM that includes your changes.
• If this process needs to be repeated, an admin will issue the command test this please to rerun tests and build a new demo site.
• Before this PR can be merged, it needs to be reviewed. Please keep in mind that reviewers are volunteers, and their response time can vary from a few hours to a few weeks depending on their availability and their knowledge of this particular part of CiviCRM.
• A great way to speed up this process is to "trade reviews" with someone - find an open PR that you feel able to review, and leave a comment like "I'm reviewing this now, could you please review mine?" (include a link to yours). You don't have to wait for a response to get started (and you don't have to stop at one!) the more you review, the faster this process goes for everyone 😄
• To ensure that you are credited properly in the final release notes, please add yourself to contributor-key.yml
• For more information about contributing, see CONTRIBUTING.md.

Quick links for reviewers...

• ➡️ PR Demo site (can be rebuilt with the command test this please).
• 📖 Review standards
• 🗒️ Review template (brief or verbose)

➡️ Online demo of this PR 🔗

[totten]

Oy. My head does spin a little bit with WP URLs.

Just to cover background... make sure I'm following...

---

• Submit an Afform (with contact + activity) that is on the WordPress frontend (eg. embedded in a page): https://mysite.com/myfirstform.
• Trigger a CiviRule on "activity create" that sends an email containing a "Message Token" for another form: https://mysite.com/mysecondform.

Dumb question: In these examples, none of the paths show civicrm/. Is that the literal setup, or just a trimmed illustration?

(If it's literal -- how does the second one work? Is something in Civi/Afform hotwired? Or is it also a WP-page with embed?)

---

This is because the tokens code detects the referrer form and uses that as the frontend_url which we don't want in this case because the forms are completely separate.

Just to make sure, "the tokens code detects..." is referring to this stuff in WordPress::url() and not this stuff in Civi\Afform\Tokens.

i.e. We are sending a well-formed request to CRM_Utils_System_WordPress::url(), but it's returning wonky output?

---

The configuration is a little elaborate. I was trying to reproduce in somewhat thinner environment:

• Make a form at civicrm/example (afformExample). Mark it public. Enable token support.
• Install this WP plugin to setup a WP "Page" with a short-code. Call out to Civi to render the token.
  • https://gist.github.com/totten/3b9b25963cbc688f651746f23c397dbe#file-hello_world-php-L16
  • Basically:

    civi_wp()->initialize();
    ...CRM_Core_TokenSmarty::render(['html' => '{form.afformExampleUrl}'], ['contactId' => 202])['html']...

For me, on wpmaster, this outputs valid URLs:

Which isn't super-helpful for me wanting to reproduce. But if you try the same, it might be an interesting comparison. Like:

• If that example is broken for you, then maybe it points to something pretty general in the URL handling.
• If that example is working for you, then maybe it points to some interaction during the HTTP POST (involving Afform submit API and CiviRules).

[mattwire]

@totten Thanks for spending some time on this. Sorry if my initial explanation was not clear enough. I've clarified below in response to your testing and identified the difference between your "test environment" and my "live environment". ie. I can reproduce with a modified version of your WP hello-world plugin.

• Submit an Afform (with contact + activity) that is on the WordPress frontend (eg. embedded in a page): https://mysite.com/myfirstform.
• Trigger a CiviRule on "activity create" that sends an email containing a "Message Token" for another form: https://mysite.com/mysecondform.

Dumb question: In these examples, none of the paths show civicrm/. Is that the literal setup, or just a trimmed illustration?

(If it's literal -- how does the second one work? Is something in Civi/Afform hotwired? Or is it also a WP-page with embed?)

Right, sorry! The second URL actually looks like https://mysite.com/civicrm/mysecondform/?_aff=Bearer+secretbearertokenhere#?Case1=123

This is because the tokens code detects the referrer form and uses that as the frontend_url which we don't want in this case because the forms are completely separate.

Just to make sure, "the tokens code detects..." is referring to this stuff in WordPress::url() and not this stuff in Civi\Afform\Tokens.

i.e. We are sending a well-formed request to CRM_Utils_System_WordPress::url(), but it's returning wonky output?

Correct.

The configuration is a little elaborate. I was trying to reproduce in somewhat thinner environment:

• Make a form at civicrm/example (afformExample). Mark it public. Enable token support.

• Install this WP plugin to setup a WP "Page" with a short-code. Call out to Civi to render the token.

  • https://gist.github.com/totten/3b9b25963cbc688f651746f23c397dbe#file-hello_world-php-L16
  • Basically:

    civi_wp()->initialize();
    ...CRM_Core_TokenSmarty::render(['html' => '{form.afformExampleUrl}'], ['contactId' => 202])['html']...
    

It's basically this code in CRM_Utils_System_WordPress::url() that breaks the Afform MessageTokens URL:

    // When on the front-end.
    if ($config->userFrameworkFrontend) {

      // Try and find the "calling" page/post.
      global $post;
      if ($post) {
        $frontend_url = get_permalink($post->ID);
        if (civi_wp()->basepage->is_match($post->ID)) {
          $basepage = TRUE;
        }
      }

    }

because it finds a valid $post and populates $frontend_url with that "permalink".

• If that example is broken for you, then maybe it points to something pretty general in the URL handling.
• If that example is working for you, then maybe it points to some interaction during the HTTP POST (involving Afform submit API and CiviRules).

Right, the difference between my more complex setup and your nice example is that for me $config->userFrameworkFrontend = TRUE and for you it is FALSE.

We can simulate that in your example hello-world WP plugin by adding

    $config = CRM_Core_Config::singleton();
    $config->userFrameworkFrontend = TRUE;

right after civi_wp()->initialize();

I can't quite see where that is meant to get set but it is set if you access any CiviCRM content via the CiviCRM basepage or embedded via shortcode.

With userFrameworkFrontend set to TRUE you'll see the problem - something like:

[totten]

We can simulate that in your example hello-world WP plugin by adding

$config = CRM_Core_Config::singleton();
$config->userFrameworkFrontend = TRUE;

Brilliant.

So with that, we don't need anything in CiviRules or Afform. The problem can be reframed even more tightly.

FWIW, I think that https://lab.civicrm.org/dev/wordpress/-/issues/149 was initially pointing to the same thing. That was closed. But I think it's worth pursuing.

Re-filed as: https://lab.civicrm.org/dev/wordpress/-/issues/152

[totten]

I can't quite see where that (userFrameworkFrontend) is meant to get set but it is set if you access any CiviCRM content via the CiviCRM basepage or embedded via shortcode.

It looks like the ordinary path to getting activated is through add_core_resources -- which I interpret this way: if the web-page involves Civi's JS/CSS, then all the hyperlinks will go into the long form.

[christianwach]

It looks like: https://mysite.com/myfirstform?civiwp=mysite.com/mysecondform&token=...

@mattwire Is this correct? The civiwp query var should never be anything other than civiwp=CiviCRM.

[christianwach]

For me, on wpmaster, this outputs valid URLs:

@totten Try putting a genuine CiviCRM Shortcode into the page before your [hello_world] one. That will trigger "shortcode mode" for URLs. Your shortcode won't, which is why you're getting valid Base Page URLs.

EDIT: The code that @mattwire posted also triggers "shortcode mode".

[christianwach]

@mattwire Rather than using a global to modify what you're doing, you could replicate what CiviCRM-WordPress does to ensure that a Base Page URL is generated. Something like:

if (function_exists('add_filter')) {
    // For WordPress: add modifying callbacks prior to multi-lingual compat.
    add_filter('civicrm/basepage/match', [civi_wp()->basepage, 'ensure_match'], 9);
    add_filter('civicrm/core/url/base', [civi_wp()->basepage, 'ensure_url'], 9, 2);
}
$url = self::createUrl($afform, $row->context['contactId']);
if (function_exists('add_filter')) {
    // For WordPress: remove callbacks.
    remove_filter('civicrm/basepage/match', [civi_wp()->basepage, 'ensure_match'], 9);
    remove_filter('civicrm/core/url/base', [civi_wp()->basepage, 'ensure_url'], 9);
}

This should make modifying CRM_Utils_System_WordPress::url() unnecessary.