Skip to content

Commit 93cc54f

Browse files
oshmyheliukBaDos
authored andcommitted
MAGECLOUD-4649: Merge PageBuilder Security Patches to m-cloud-patches (#6)
1 parent 3b0fee2 commit 93cc54f

3 files changed

+358
-0
lines changed

patches.json

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -201,6 +201,10 @@
201201
"2.3.0": "MAGECLOUD-3392__reduce_q-ty_of_error_report_files__2.3.0.patch",
202202
"2.3.1": "MAGECLOUD-3392__reduce_q-ty_of_error_report_files__2.3.1.patch",
203203
"2.3.2 - 2.3.3": "MAGECLOUD-3392__reduce_q-ty_of_error_report_files__2.3.2.patch"
204+
},
205+
"Fix pagebuilder module": {
206+
"2.3.1": "MDVA-22979__fix_pagebuilder_module__2.3.1.patch",
207+
"2.3.2": "MDVA-22979__fix_pagebuilder_module__2.3.2.patch"
204208
}
205209
},
206210
"monolog/monolog": {
Lines changed: 177 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,177 @@
1+
diff -Nuar a/vendor/magento/module-email/Block/Adminhtml/Template/Preview.php b/vendor/magento/module-email/Block/Adminhtml/Template/Preview.php
2+
index 5f22a36510c..7f3fe8e91eb 100644
3+
--- a/vendor/magento/module-email/Block/Adminhtml/Template/Preview.php
4+
+++ b/vendor/magento/module-email/Block/Adminhtml/Template/Preview.php
5+
@@ -53,19 +53,26 @@ class Preview extends \Magento\Backend\Block\Widget
6+
* Prepare html output
7+
*
8+
* @return string
9+
+ * @throws \Magento\Framework\Exception\LocalizedException
10+
*/
11+
protected function _toHtml()
12+
{
13+
+ $request = $this->getRequest();
14+
+
15+
+ if (!$request instanceof \Magento\Framework\App\RequestSafetyInterface || !$request->isSafeMethod()) {
16+
+ throw new \Magento\Framework\Exception\LocalizedException(__('Wrong request.'));
17+
+ }
18+
+
19+
$storeId = $this->getAnyStoreView()->getId();
20+
/** @var $template \Magento\Email\Model\Template */
21+
$template = $this->_emailFactory->create();
22+
23+
- if ($id = (int)$this->getRequest()->getParam('id')) {
24+
+ if ($id = (int)$request->getParam('id')) {
25+
$template->load($id);
26+
} else {
27+
- $template->setTemplateType($this->getRequest()->getParam('type'));
28+
- $template->setTemplateText($this->getRequest()->getParam('text'));
29+
- $template->setTemplateStyles($this->getRequest()->getParam('styles'));
30+
+ $template->setTemplateType($request->getParam('type'));
31+
+ $template->setTemplateText($request->getParam('text'));
32+
+ $template->setTemplateStyles($request->getParam('styles'));
33+
}
34+
35+
$template->setTemplateText($this->_maliciousCode->filter($template->getTemplateText()));
36+
diff -Nuar a/vendor/magento/module-page-builder/Controller/ContentType/Preview.php b/vendor/magento/module-page-builder/Controller/ContentType/Preview.php
37+
index b7d59ecc8..09f8e8510 100644
38+
--- a/vendor/magento/module-page-builder/Controller/ContentType/Preview.php
39+
+++ b/vendor/magento/module-page-builder/Controller/ContentType/Preview.php
40+
@@ -26,19 +26,28 @@ class Preview extends \Magento\Framework\App\Action\Action implements HttpPostAc
41+
*/
42+
private $rendererPool;
43+
44+
+ /**
45+
+ * @var \Magento\Backend\Model\Auth
46+
+ */
47+
+ private $auth;
48+
+
49+
/**
50+
* Constructor
51+
*
52+
* @param \Magento\Backend\App\Action\Context $context
53+
* @param \Magento\PageBuilder\Model\Stage\RendererPool $rendererPool
54+
+ * @param \Magento\Backend\Model\Auth $auth
55+
*/
56+
public function __construct(
57+
\Magento\Backend\App\Action\Context $context,
58+
- \Magento\PageBuilder\Model\Stage\RendererPool $rendererPool
59+
+ \Magento\PageBuilder\Model\Stage\RendererPool $rendererPool,
60+
+ \Magento\Backend\Model\Auth $auth = null
61+
) {
62+
parent::__construct($context);
63+
64+
$this->rendererPool = $rendererPool;
65+
+ $this->auth = $auth ?? \Magento\Framework\App\ObjectManager::getInstance()
66+
+ ->get(\Magento\Backend\Model\Auth::class);
67+
}
68+
69+
/**
70+
@@ -48,14 +57,18 @@ class Preview extends \Magento\Framework\App\Action\Action implements HttpPostAc
71+
*/
72+
public function execute()
73+
{
74+
- $pageResult = $this->resultFactory->create(ResultFactory::TYPE_PAGE);
75+
- // Some template filters and directive processors expect this to be called in order to function.
76+
- $pageResult->initLayout();
77+
+ if ($this->auth->isLoggedIn()) {
78+
+ $pageResult = $this->resultFactory->create(ResultFactory::TYPE_PAGE);
79+
+ // Some template filters and directive processors expect this to be called in order to function.
80+
+ $pageResult->initLayout();
81+
+
82+
+ $params = $this->getRequest()->getParams();
83+
+ $renderer = $this->rendererPool->getRenderer($params['role']);
84+
+ $result = ['data' => $renderer->render($params)];
85+
86+
- $params = $this->getRequest()->getParams();
87+
- $renderer = $this->rendererPool->getRenderer($params['role']);
88+
- $result = ['data' => $renderer->render($params)];
89+
+ return $this->resultFactory->create(ResultFactory::TYPE_JSON)->setData($result);
90+
+ }
91+
92+
- return $this->resultFactory->create(ResultFactory::TYPE_JSON)->setData($result);
93+
+ $this->_forward('noroute');
94+
}
95+
}
96+
diff -Nuar a/vendor/magento/module-page-builder/Model/Stage/Config.php b/vendor/magento/module-page-builder/Model/Stage/Config.php
97+
index 17288978e..baf3ce106 100644
98+
--- a/vendor/magento/module-page-builder/Model/Stage/Config.php
99+
+++ b/vendor/magento/module-page-builder/Model/Stage/Config.php
100+
@@ -135,7 +135,9 @@ class Config
101+
'content_types' => $this->getContentTypes(),
102+
'stage_config' => $this->data,
103+
'media_url' => $this->urlBuilder->getBaseUrl(['_type' => UrlInterface::URL_TYPE_MEDIA]),
104+
- 'preview_url' => $this->frontendUrlBuilder->getUrl('pagebuilder/contenttype/preview'),
105+
+ 'preview_url' => $this->frontendUrlBuilder
106+
+ ->addSessionParam()
107+
+ ->getUrl('pagebuilder/contenttype/preview'),
108+
'column_grid_default' => $this->scopeConfig->getValue(self::XML_PATH_COLUMN_GRID_DEFAULT),
109+
'column_grid_max' => $this->scopeConfig->getValue(self::XML_PATH_COLUMN_GRID_MAX),
110+
'can_use_inline_editing_on_stage' => $this->isWysiwygProvisionedForEditingOnStage(),
111+
diff -Nuar a/vendor/magento/module-page-builder/Plugin/Framework/Session/SidResolver.php b/vendor/magento/module-page-builder/Plugin/Framework/Session/SidResolver.php
112+
new file mode 100644
113+
index 000000000..a1e9d943a
114+
--- /dev/null
115+
+++ b/vendor/magento/module-page-builder/Plugin/Framework/Session/SidResolver.php
116+
@@ -0,0 +1,49 @@
117+
+<?php
118+
+/**
119+
+ * Copyright © Magento, Inc. All rights reserved.
120+
+ * See COPYING.txt for license details.
121+
+ */
122+
+namespace Magento\PageBuilder\Plugin\Framework\Session;
123+
+
124+
+/**
125+
+ * Plugin for SID resolver.
126+
+ */
127+
+class SidResolver
128+
+{
129+
+ /**
130+
+ * @var \Magento\Framework\App\RequestInterface
131+
+ */
132+
+ private $request;
133+
+
134+
+ /**
135+
+ * @param \Magento\Framework\App\RequestInterface $request
136+
+ */
137+
+ public function __construct(
138+
+ \Magento\Framework\App\RequestInterface $request
139+
+ ) {
140+
+ $this->request = $request;
141+
+ }
142+
+
143+
+ /**
144+
+ * Get Sid for pagebuilder preview
145+
+ *
146+
+ * @param \Magento\Framework\Session\SidResolver $subject
147+
+ * @param string|null $result
148+
+ * @param \Magento\Framework\Session\SessionManagerInterface $session
149+
+ *
150+
+ * @return string|null
151+
+ */
152+
+ public function afterGetSid(
153+
+ \Magento\Framework\Session\SidResolver $subject,
154+
+ $result,
155+
+ \Magento\Framework\Session\SessionManagerInterface $session
156+
+ ) {
157+
+ if (strpos($this->request->getPathInfo(), '/pagebuilder/contenttype/preview') === 0) {
158+
+ return $this->request->getQuery(
159+
+ $subject->getSessionIdQueryParam($session)
160+
+ );
161+
+ }
162+
+
163+
+ return $result;
164+
+ }
165+
+}
166+
diff -Nuar a/vendor/magento/module-page-builder/etc/di.xml b/vendor/magento/module-page-builder/etc/di.xml
167+
index a147ab1b2..e7374870b 100644
168+
--- a/vendor/magento/module-page-builder/etc/di.xml
169+
+++ b/vendor/magento/module-page-builder/etc/di.xml
170+
@@ -140,4 +140,7 @@
171+
</argument>
172+
</arguments>
173+
</type>
174+
+ <type name="Magento\Framework\Session\SidResolver">
175+
+ <plugin name="pagebuilder_preview_sid_resolving" type="Magento\PageBuilder\Plugin\Framework\Session\SidResolver" />
176+
+ </type>
177+
</config>
Lines changed: 177 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,177 @@
1+
diff -Nuar a/vendor/magento/module-email/Block/Adminhtml/Template/Preview.php b/vendor/magento/module-email/Block/Adminhtml/Template/Preview.php
2+
index acc367de742..4f0479a9573 100644
3+
--- a/vendor/magento/module-email/Block/Adminhtml/Template/Preview.php
4+
+++ b/vendor/magento/module-email/Block/Adminhtml/Template/Preview.php
5+
@@ -55,19 +55,26 @@ class Preview extends \Magento\Backend\Block\Widget
6+
* Prepare html output
7+
*
8+
* @return string
9+
+ * @throws \Magento\Framework\Exception\LocalizedException
10+
*/
11+
protected function _toHtml()
12+
{
13+
+ $request = $this->getRequest();
14+
+
15+
+ if (!$request instanceof \Magento\Framework\App\RequestSafetyInterface || !$request->isSafeMethod()) {
16+
+ throw new \Magento\Framework\Exception\LocalizedException(__('Wrong request.'));
17+
+ }
18+
+
19+
$storeId = $this->getAnyStoreView()->getId();
20+
/** @var $template \Magento\Email\Model\Template */
21+
$template = $this->_emailFactory->create();
22+
23+
- if ($id = (int)$this->getRequest()->getParam('id')) {
24+
+ if ($id = (int)$request->getParam('id')) {
25+
$template->load($id);
26+
} else {
27+
- $template->setTemplateType($this->getRequest()->getParam('type'));
28+
- $template->setTemplateText($this->getRequest()->getParam('text'));
29+
- $template->setTemplateStyles($this->getRequest()->getParam('styles'));
30+
+ $template->setTemplateType($request->getParam('type'));
31+
+ $template->setTemplateText($request->getParam('text'));
32+
+ $template->setTemplateStyles($request->getParam('styles'));
33+
}
34+
35+
\Magento\Framework\Profiler::start($this->profilerName);
36+
diff -Nuar a/vendor/magento/module-page-builder/Controller/ContentType/Preview.php b/vendor/magento/module-page-builder/Controller/ContentType/Preview.php
37+
index b7d59ecc8..09f8e8510 100644
38+
--- a/vendor/magento/module-page-builder/Controller/ContentType/Preview.php
39+
+++ b/vendor/magento/module-page-builder/Controller/ContentType/Preview.php
40+
@@ -26,19 +26,28 @@ class Preview extends \Magento\Framework\App\Action\Action implements HttpPostAc
41+
*/
42+
private $rendererPool;
43+
44+
+ /**
45+
+ * @var \Magento\Backend\Model\Auth
46+
+ */
47+
+ private $auth;
48+
+
49+
/**
50+
* Constructor
51+
*
52+
* @param \Magento\Backend\App\Action\Context $context
53+
* @param \Magento\PageBuilder\Model\Stage\RendererPool $rendererPool
54+
+ * @param \Magento\Backend\Model\Auth $auth
55+
*/
56+
public function __construct(
57+
\Magento\Backend\App\Action\Context $context,
58+
- \Magento\PageBuilder\Model\Stage\RendererPool $rendererPool
59+
+ \Magento\PageBuilder\Model\Stage\RendererPool $rendererPool,
60+
+ \Magento\Backend\Model\Auth $auth = null
61+
) {
62+
parent::__construct($context);
63+
64+
$this->rendererPool = $rendererPool;
65+
+ $this->auth = $auth ?? \Magento\Framework\App\ObjectManager::getInstance()
66+
+ ->get(\Magento\Backend\Model\Auth::class);
67+
}
68+
69+
/**
70+
@@ -48,14 +57,18 @@ class Preview extends \Magento\Framework\App\Action\Action implements HttpPostAc
71+
*/
72+
public function execute()
73+
{
74+
- $pageResult = $this->resultFactory->create(ResultFactory::TYPE_PAGE);
75+
- // Some template filters and directive processors expect this to be called in order to function.
76+
- $pageResult->initLayout();
77+
+ if ($this->auth->isLoggedIn()) {
78+
+ $pageResult = $this->resultFactory->create(ResultFactory::TYPE_PAGE);
79+
+ // Some template filters and directive processors expect this to be called in order to function.
80+
+ $pageResult->initLayout();
81+
+
82+
+ $params = $this->getRequest()->getParams();
83+
+ $renderer = $this->rendererPool->getRenderer($params['role']);
84+
+ $result = ['data' => $renderer->render($params)];
85+
86+
- $params = $this->getRequest()->getParams();
87+
- $renderer = $this->rendererPool->getRenderer($params['role']);
88+
- $result = ['data' => $renderer->render($params)];
89+
+ return $this->resultFactory->create(ResultFactory::TYPE_JSON)->setData($result);
90+
+ }
91+
92+
- return $this->resultFactory->create(ResultFactory::TYPE_JSON)->setData($result);
93+
+ $this->_forward('noroute');
94+
}
95+
}
96+
diff -Nuar a/vendor/magento/module-page-builder/Model/Stage/Config.php b/vendor/magento/module-page-builder/Model/Stage/Config.php
97+
index 17288978e..baf3ce106 100644
98+
--- a/vendor/magento/module-page-builder/Model/Stage/Config.php
99+
+++ b/vendor/magento/module-page-builder/Model/Stage/Config.php
100+
@@ -135,7 +135,9 @@ class Config
101+
'content_types' => $this->getContentTypes(),
102+
'stage_config' => $this->data,
103+
'media_url' => $this->urlBuilder->getBaseUrl(['_type' => UrlInterface::URL_TYPE_MEDIA]),
104+
- 'preview_url' => $this->frontendUrlBuilder->getUrl('pagebuilder/contenttype/preview'),
105+
+ 'preview_url' => $this->frontendUrlBuilder
106+
+ ->addSessionParam()
107+
+ ->getUrl('pagebuilder/contenttype/preview'),
108+
'column_grid_default' => $this->scopeConfig->getValue(self::XML_PATH_COLUMN_GRID_DEFAULT),
109+
'column_grid_max' => $this->scopeConfig->getValue(self::XML_PATH_COLUMN_GRID_MAX),
110+
'can_use_inline_editing_on_stage' => $this->isWysiwygProvisionedForEditingOnStage(),
111+
diff -Nuar a/vendor/magento/module-page-builder/Plugin/Framework/Session/SidResolver.php b/vendor/magento/module-page-builder/Plugin/Framework/Session/SidResolver.php
112+
new file mode 100644
113+
index 000000000..a1e9d943a
114+
--- /dev/null
115+
+++ b/vendor/magento/module-page-builder/Plugin/Framework/Session/SidResolver.php
116+
@@ -0,0 +1,49 @@
117+
+<?php
118+
+/**
119+
+ * Copyright © Magento, Inc. All rights reserved.
120+
+ * See COPYING.txt for license details.
121+
+ */
122+
+namespace Magento\PageBuilder\Plugin\Framework\Session;
123+
+
124+
+/**
125+
+ * Plugin for SID resolver.
126+
+ */
127+
+class SidResolver
128+
+{
129+
+ /**
130+
+ * @var \Magento\Framework\App\RequestInterface
131+
+ */
132+
+ private $request;
133+
+
134+
+ /**
135+
+ * @param \Magento\Framework\App\RequestInterface $request
136+
+ */
137+
+ public function __construct(
138+
+ \Magento\Framework\App\RequestInterface $request
139+
+ ) {
140+
+ $this->request = $request;
141+
+ }
142+
+
143+
+ /**
144+
+ * Get Sid for pagebuilder preview
145+
+ *
146+
+ * @param \Magento\Framework\Session\SidResolver $subject
147+
+ * @param string|null $result
148+
+ * @param \Magento\Framework\Session\SessionManagerInterface $session
149+
+ *
150+
+ * @return string|null
151+
+ */
152+
+ public function afterGetSid(
153+
+ \Magento\Framework\Session\SidResolver $subject,
154+
+ $result,
155+
+ \Magento\Framework\Session\SessionManagerInterface $session
156+
+ ) {
157+
+ if (strpos($this->request->getPathInfo(), '/pagebuilder/contenttype/preview') === 0) {
158+
+ return $this->request->getQuery(
159+
+ $subject->getSessionIdQueryParam($session)
160+
+ );
161+
+ }
162+
+
163+
+ return $result;
164+
+ }
165+
+}
166+
diff -Nuar a/vendor/magento/module-page-builder/etc/di.xml b/vendor/magento/module-page-builder/etc/di.xml
167+
index a147ab1b2..e7374870b 100644
168+
--- a/vendor/magento/module-page-builder/etc/di.xml
169+
+++ b/vendor/magento/module-page-builder/etc/di.xml
170+
@@ -140,4 +140,7 @@
171+
</argument>
172+
</arguments>
173+
</type>
174+
+ <type name="Magento\Framework\Session\SidResolver">
175+
+ <plugin name="pagebuilder_preview_sid_resolving" type="Magento\PageBuilder\Plugin\Framework\Session\SidResolver" />
176+
+ </type>
177+
</config>

0 commit comments

Comments
 (0)