The files seen here were identified via the use of the track-custom-parent.pl script: https://gist.github.com/WebDragon/d0db898acb41eefaa8deb84921a77d42 which contains heavy commenting and perldoc describing its function
- Templatename.extra.tpl is included into Templatename.tpl if discovered. This is an easy way to add snippets (eg JS/CSS) to a template without having to change the core template (simplifies upgrades). docs
- Overrides with an integer in the path apply only to a single entity, eg in the first instance the override will only apply to the Contribute page with id=22. docs
- If a customisation is to
path/to/2/something.php
, the base template to refer to ispath/to/something.php
. - First thing I'd check would be what you can drop immediately. The ones named
2b
can go. If any of contribution pages 1, 2, 3, 21, 22 or 26 are not actively used, you can drop the matching customisations from your requirements.
- Changes the contribute confirmation process for the contribution page id=2 only.
- Looks like someone was trying to handle zero-payment contributions or defend against negative payments, from the debug and commented code?
- Seems to contain a bailout (
JExit()
) which suggests it's not in active use and might be removed. Check if you are using or receiving payments via Contribute page id=2.
- Fetches appropriate counties based on the selected province
- Looks like there is exploitable SQLi in this file
- Should be possible to use CiviCRM API to do this. The query in JS would be:
CRM.api3('Address', 'getoptions', {
"key": "county_id",
"state_province_id": 1004,
"field": "county_id"
}).done(function(result) {
// do something with your API result here
});
- Debug only, can probably be removed?
- Adds some CSS classes and rules (could also be done by Smarty templating)
- When State is changed, update the list of available Counties.
- Removes sections of template which should only be displayed if
$honor_block_is_active
,$pledgeBlock
,$form.is_recur
,$pcp
anyway. Those changes may not need to exist if the contribute page is configured to not show them? - Comments out a
<div class="label"> </div>
presumably for layout reasons. - The below change looks like a legit bugfix? But that line doesn't exist in current CiviCRM.
- {include file="CRM/common/paymentBlock.tpl'}
+ {include file="CRM/common/paymentBlock.tpl"}
- Seems to be all about layout customisations, but there's a lot here!
templates/CRM/Contribute/Form/Contribution/2b/Confirm.tpl
& templates/CRM/Contribute/Form/Contribution/2b/Main.extra.tpl
- I believe these are unused templates, since
2b
isn't a valid contribute page ID.
- Layout changes AFAICT.
- Special handling to multiply total fee by whatever's in input field custom_27.
- Adds an empty script tag. Might be unused or some weird layout workaround for horrid browsers :)
- Adds some wrapper elements to labels.
- Adds county selection JS.
- Displays related fields. IDK what this is doing to be honest.
- Lots of JS to do layout things. I didn't read this fully :)
- Includes
22/Dynamic.tpl
above.
- County selection again.
- Requires authenticated user to view this form. Suggest checking this from a CiviCRM extension (eg by implementing similar check in
hook_civicrm_buildForm()
) rather than at template layer.