From d376dac11c8008c59dc29d6515543ac23f856a0e Mon Sep 17 00:00:00 2001
From: Aaron Parecki <aaron@parecki.com>
Date: Tue, 17 Jan 2017 09:58:04 -0800
Subject: allow only mp-syndicate-to and syndicate-to

---
 controllers/controllers.php | 6 ++++--
 views/settings.php          | 7 ++++++-
 2 files changed, 10 insertions(+), 3 deletions(-)

diff --git a/controllers/controllers.php b/controllers/controllers.php
index 3f95147..4b19879 100644
--- a/controllers/controllers.php
+++ b/controllers/controllers.php
@@ -324,8 +324,10 @@ $app->post('/settings/save', function() use($app) {
     if(array_key_exists('slug_field', $params) && $params['slug_field'])
       $user->micropub_slug_field = $params['slug_field'];
 
-    if(array_key_exists('syndicate_field', $params) && $params['syndicate_field'])
-      $user->micropub_syndicate_field = $params['syndicate_field'];
+    if(array_key_exists('syndicate_field', $params) && $params['syndicate_field']) {
+      if(in_array($params['syndicate_field'], ['syndicate-to','mp-syndicate-to']))
+        $user->micropub_syndicate_field = $params['syndicate_field'];
+    }
 
     $user->save();
     $app->response()['Content-type'] = 'application/json';
diff --git a/views/settings.php b/views/settings.php
index 5895718..23a1b71 100644
--- a/views/settings.php
+++ b/views/settings.php
@@ -48,7 +48,12 @@
     <tr>
       <td>Syndication</td>
       <td>
-        <div style="margin-bottom:4px;"><input type="text" id="syndicate-to-field-name" value="<?= $this->user->micropub_syndicate_field ?>" placeholder="mp-syndicate-to" class="form-control"></div>
+        <div style="margin-bottom:4px;">
+          <select id="syndicate-to-field-name">
+            <option value="mp-syndicate-to" <?= $this->user->micropub_syndicate_field == 'mp-syndicate-to' ? 'selected="selected"' : '' ?>>mp-syndicate-to</option>
+            <option value="syndicate-to" <?= $this->user->micropub_syndicate_field == 'syndicate-to' ? 'selected="selected"' : '' ?>>syndicate-to</option>
+          </select>
+        </div>
         <div><input type="button" class="btn btn-primary" value="Save" id="save-syndicate-to-field"></div>
       </td>
       <td>Choose the name of the field that the syndication values will be sent in. This should be set to <code>mp-syndicate-to</code> unless your endpoint is using the deprecated <code>syndicate-to</code> property.</td>
-- 
cgit v1.2.3