Merge remote-tracking branch 'chaika/MC-23192' into Chaika-PR-2019-11-25

Author: veloraven

app/code/Magento/Newsletter/Controller/Adminhtml/Template/Preview.php

@@ -6,12 +6,14 @@
  */
 namespace Magento\Newsletter\Controller\Adminhtml\Template;
 
+use Magento\Framework\App\Action\HttpPostActionInterface;
 use Magento\Framework\App\Action\HttpGetActionInterface;
+use Magento\Newsletter\Controller\Adminhtml\Template;
 
 /**
  * View a rendered template.
  */
-class Preview extends \Magento\Newsletter\Controller\Adminhtml\Template implements HttpGetActionInterface
+class Preview extends Template implements HttpPostActionInterface, HttpGetActionInterface
 {
     /**
      * Preview Newsletter template
@@ -25,7 +27,7 @@ public function execute()
         $data = $this->getRequest()->getParams();
         $isEmptyRequestData = empty($data) || !isset($data['id']);
         $isEmptyPreviewData = !$this->_getSession()->hasPreviewData() || empty($this->_getSession()->getPreviewData());
-        
+
         if ($isEmptyRequestData && $isEmptyPreviewData) {
             $this->_forward('noroute');
             return $this;

app/code/Magento/Newsletter/view/adminhtml/templates/template/edit.phtml

@@ -17,12 +17,13 @@ use Magento\Framework\App\TemplateTypesInterface;
     </div>
     <?= /* @noEscape */ $block->getForm() ?>
 </form>
-<form action="<?= $block->escapeUrl($block->getPreviewUrl()) ?>" method="get" id="newsletter_template_preview_form" target="_blank">
+<form action="<?= $block->escapeUrl($block->getPreviewUrl()) ?>" method="post" id="newsletter_template_preview_form" target="_blank">
     <div class="no-display">
         <input type="hidden" id="preview_type" name="type" value="<?= /* @noEscape */ $block->isTextType() ? 1 : 2 ?>" />
         <input type="hidden" id="preview_text" name="text" value="" />
         <input type="hidden" id="preview_styles" name="styles" value="" />
         <input type="hidden" id="preview_id" name="id" value="" />
+        <input type="hidden" name="form_key" value="<?= $block->escapeHtmlAttr($block->getFormKey()) ?>" >
     </div>
 </form>
 <script>