Skip to content

Commit 9b09423

Browse files
author
ogorkun
committed
MC-34385: Filter fields allowing HTML
1 parent 3bdd5ba commit 9b09423

File tree

3 files changed

+63
-46
lines changed

3 files changed

+63
-46
lines changed

‎app/code/Magento/Cms/Model/Block.php

Lines changed: 52 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -6,8 +6,15 @@
66
namespace Magento\Cms\Model;
77

88
use Magento\Cms\Api\Data\BlockInterface;
9+
use Magento\Framework\App\ObjectManager;
910
use Magento\Framework\DataObject\IdentityInterface;
1011
use Magento\Framework\Model\AbstractModel;
12+
use Magento\Framework\Validation\ValidationException;
13+
use Magento\Framework\Validator\HTML\WYSIWYGValidatorInterface;
14+
use Magento\Framework\Model\Context;
15+
use Magento\Framework\Registry;
16+
use Magento\Framework\Model\ResourceModel\AbstractResource;
17+
use Magento\Framework\Data\Collection\AbstractDb;
1118

1219
/**
1320
* CMS block model
@@ -40,6 +47,32 @@ class Block extends AbstractModel implements BlockInterface, IdentityInterface
4047
*/
4148
protected $_eventPrefix = 'cms_block';
4249

50+
/**
51+
* @var WYSIWYGValidatorInterface
52+
*/
53+
private $wysiwygValidator;
54+
55+
/**
56+
* @param Context $context
57+
* @param Registry $registry
58+
* @param AbstractResource|null $resource
59+
* @param AbstractDb|null $resourceCollection
60+
* @param array $data
61+
* @param WYSIWYGValidatorInterface|null $wysiwygValidator
62+
*/
63+
public function __construct(
64+
Context $context,
65+
Registry $registry,
66+
AbstractResource $resource = null,
67+
AbstractDb $resourceCollection = null,
68+
array $data = [],
69+
?WYSIWYGValidatorInterface $wysiwygValidator = null
70+
) {
71+
parent::__construct($context, $registry, $resource, $resourceCollection, $data);
72+
$this->wysiwygValidator = $wysiwygValidator
73+
?? ObjectManager::getInstance()->get(WYSIWYGValidatorInterface::class);
74+
}
75+
4376
/**
4477
* Construct.
4578
*
@@ -63,12 +96,26 @@ public function beforeSave()
6396
}
6497

6598
$needle = 'block_id="' . $this->getId() . '"';
66-
if (false == strstr($this->getContent(), (string) $needle)) {
67-
return parent::beforeSave();
99+
if (strstr($this->getContent(), (string) $needle) !== false) {
100+
throw new \Magento\Framework\Exception\LocalizedException(
101+
__('Make sure that static block content does not reference the block itself.')
102+
);
68103
}
69-
throw new \Magento\Framework\Exception\LocalizedException(
70-
__('Make sure that static block content does not reference the block itself.')
71-
);
104+
parent::beforeSave();
105+
106+
//Validating HTML content.
107+
if ($this->getContent() && $this->getContent() !== $this->getOrigData(self::CONTENT)) {
108+
try {
109+
$this->wysiwygValidator->validate($this->getContent());
110+
} catch (ValidationException $exception) {
111+
throw new ValidationException(
112+
__('Content field contains restricted HTML elements. %1', $exception->getMessage()),
113+
$exception
114+
);
115+
}
116+
}
117+
118+
return $this;
72119
}
73120

74121
/**

‎app/code/Magento/Cms/Model/BlockRepository.php

Lines changed: 10 additions & 41 deletions
Original file line numberDiff line numberDiff line change
@@ -17,9 +17,8 @@
1717
use Magento\Framework\Exception\CouldNotSaveException;
1818
use Magento\Framework\Exception\NoSuchEntityException;
1919
use Magento\Framework\Reflection\DataObjectProcessor;
20-
use Magento\Framework\Validation\ValidationException;
21-
use Magento\Framework\Validator\HTML\WYSIWYGValidatorInterface;
2220
use Magento\Store\Model\StoreManagerInterface;
21+
use Magento\Framework\EntityManager\HydratorInterface;
2322

2423
/**
2524
* Class BlockRepository
@@ -73,9 +72,9 @@ class BlockRepository implements BlockRepositoryInterface
7372
private $collectionProcessor;
7473

7574
/**
76-
* @var WYSIWYGValidatorInterface
75+
* @var HydratorInterface
7776
*/
78-
private $wysiwygValidator;
77+
private $hydrator;
7978

8079
/**
8180
* @param ResourceBlock $resource
@@ -87,7 +86,7 @@ class BlockRepository implements BlockRepositoryInterface
8786
* @param DataObjectProcessor $dataObjectProcessor
8887
* @param StoreManagerInterface $storeManager
8988
* @param CollectionProcessorInterface $collectionProcessor
90-
* @param WYSIWYGValidatorInterface|null $wysiwygValidator
89+
* @param HydratorInterface|null $hydrator
9190
*/
9291
public function __construct(
9392
ResourceBlock $resource,
@@ -99,7 +98,7 @@ public function __construct(
9998
DataObjectProcessor $dataObjectProcessor,
10099
StoreManagerInterface $storeManager,
101100
CollectionProcessorInterface $collectionProcessor = null,
102-
?WYSIWYGValidatorInterface $wysiwygValidator = null
101+
?HydratorInterface $hydrator = null
103102
) {
104103
$this->resource = $resource;
105104
$this->blockFactory = $blockFactory;
@@ -110,46 +109,14 @@ public function __construct(
110109
$this->dataObjectProcessor = $dataObjectProcessor;
111110
$this->storeManager = $storeManager;
112111
$this->collectionProcessor = $collectionProcessor ?: $this->getCollectionProcessor();
113-
$this->wysiwygValidator = $wysiwygValidator
114-
?? ObjectManager::getInstance()->get(WYSIWYGValidatorInterface::class);
115-
}
116-
117-
/**
118-
* Validate block's content.
119-
*
120-
* @param Data\BlockInterface|Block $block
121-
* @throws CouldNotSaveException
122-
* @return void
123-
*/
124-
private function validateHtml(Data\BlockInterface $block): void
125-
{
126-
$oldContent = null;
127-
if ($block->getId()) {
128-
if ($block instanceof Block && $block->getOrigData()) {
129-
$oldContent = $block->getOrigData(Data\BlockInterface::CONTENT);
130-
} else {
131-
$oldBlock = $this->getById($block->getId());
132-
$oldContent = $oldBlock->getContent();
133-
}
134-
}
135-
if ($block->getContent() && $block->getContent() !== $oldContent) {
136-
//Validate HTML content.
137-
try {
138-
$this->wysiwygValidator->validate($block->getContent());
139-
} catch (ValidationException $exception) {
140-
throw new CouldNotSaveException(
141-
__('Content HTML has restricted elements. %1', $exception->getMessage()),
142-
$exception
143-
);
144-
}
145-
}
112+
$this->hydrator = $hydrator ?? ObjectManager::getInstance()->get(HydratorInterface::class);
146113
}
147114

148115
/**
149116
* Save Block data
150117
*
151118
* @param \Magento\Cms\Api\Data\BlockInterface $block
152-
* @return Block|Data\BlockInterface
119+
* @return Block
153120
* @throws CouldNotSaveException
154121
*/
155122
public function save(Data\BlockInterface $block)
@@ -158,7 +125,9 @@ public function save(Data\BlockInterface $block)
158125
$block->setStoreId($this->storeManager->getStore()->getId());
159126
}
160127

161-
$this->validateHtml($block);
128+
if ($block->getId() && $block instanceof Block && !$block->getOrigData()) {
129+
$block = $this->hydrator->hydrate($this->getById($block->getId()), $this->hydrator->extract($block));
130+
}
162131

163132
try {
164133
$this->resource->save($block);

‎app/code/Magento/Cms/etc/di.xml

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -215,6 +215,7 @@
215215
<type name="Magento\Cms\Model\BlockRepository">
216216
<arguments>
217217
<argument name="collectionProcessor" xsi:type="object">Magento\Cms\Model\Api\SearchCriteria\BlockCollectionProcessor</argument>
218+
<argument name="hydrator" xsi:type="object">Magento\Framework\EntityManager\AbstractModelHydrator</argument>
218219
</arguments>
219220
</type>
220221

0 commit comments

Comments
 (0)