diff --git a/CHANGELOG-WIP.md b/CHANGELOG-WIP.md index 6491da16d33..56bbb11930e 100644 --- a/CHANGELOG-WIP.md +++ b/CHANGELOG-WIP.md @@ -12,3 +12,4 @@ ### System - MySQL mutex locks and PHP session names are now namespaced using the application ID combined with the environment name. ([#15313](https://github.com/craftcms/cms/issues/15313)) +- `x-craft-preview` and `x-craft-live-preview` params are now hashed, and `craft\web\Request::getIsPreview()` will only return `true` if the param validates. ([#15605](https://github.com/craftcms/cms/discussions/15605)) diff --git a/src/controllers/ElementsController.php b/src/controllers/ElementsController.php index ccd00a037f4..3bb4c835180 100644 --- a/src/controllers/ElementsController.php +++ b/src/controllers/ElementsController.php @@ -24,6 +24,7 @@ use craft\helpers\Db; use craft\helpers\ElementHelper; use craft\helpers\Html; +use craft\helpers\StringHelper; use craft\helpers\UrlHelper; use craft\models\ElementActivity; use craft\models\FieldLayoutForm; @@ -440,6 +441,7 @@ public function actionEdit(?ElementInterface $element, ?int $elementId = null): 'isUnpublishedDraft' => $isUnpublishedDraft, 'previewTargets' => $previewTargets, 'previewToken' => $previewTargets ? $security->generateRandomString() : null, + 'previewParamValue' => $previewTargets ? $security->hashData(StringHelper::randomString(10)) : null, 'revisionId' => $element->revisionId, 'siteId' => $element->siteId, 'siteStatuses' => $siteStatuses, @@ -1423,11 +1425,13 @@ public function actionSaveDraft(): ?Response if ($this->request->getIsCpRequest()) { [$docTitle, $title] = $this->_editElementTitles($element); + $previewTargets = $element->getPreviewTargets(); $data += $this->_fieldLayoutData($element); $data += [ 'docTitle' => $docTitle, 'title' => $title, - 'previewTargets' => $element->getPreviewTargets(), + 'previewTargets' => $previewTargets, + 'previewParamValue' => $previewTargets ? Craft::$app->getSecurity()->hashData(StringHelper::randomString(10)) : null, 'initialDeltaValues' => Craft::$app->getView()->getInitialDeltaValues(), 'updatedTimestamp' => $element->dateUpdated->getTimestamp(), 'canonicalUpdatedTimestamp' => $element->getCanonical()->dateUpdated->getTimestamp(), diff --git a/src/web/Request.php b/src/web/Request.php index 49d9c7286f8..1bcd3270f75 100644 --- a/src/web/Request.php +++ b/src/web/Request.php @@ -696,11 +696,16 @@ public function getActionSegments(): ?array */ public function getIsPreview(): bool { - return ( - ($this->getQueryParam('x-craft-preview') ?? $this->getQueryParam('x-craft-live-preview')) !== null && - // If there's a token but it expired, they're looking at the live site - (!$this->getHadToken() || $this->getToken() !== null) - ); + $previewParamValue = $this->getQueryParam('x-craft-preview') ?? $this->getQueryParam('x-craft-live-preview'); + if (!$previewParamValue) { + return false; + } + if (!Craft::$app->getSecurity()->validateData($previewParamValue)) { + return false; + } + + // If there's a token but it expired, they're looking at the live site + return !$this->getHadToken() || $this->getToken() !== null; } /** diff --git a/src/web/assets/cp/dist/cp.js b/src/web/assets/cp/dist/cp.js index a7b530406f2..35bb8314d8c 100644 --- a/src/web/assets/cp/dist/cp.js +++ b/src/web/assets/cp/dist/cp.js @@ -1,3 +1,3 @@ /*! For license information please see cp.js.LICENSE.txt */ -(function(){var __webpack_modules__={463:function(){Craft.Accordion=Garnish.Base.extend({$trigger:null,targetSelector:null,_$target:null,init:function(t){var e=this;this.$trigger=$(t),this.$trigger.data("accordion")&&(console.warn("Double-instantiating an accordion trigger on an element"),this.$trigger.data("accordion").destroy()),this.$trigger.data("accordion",this),this.targetSelector=this.$trigger.attr("aria-controls")?"#".concat(this.$trigger.attr("aria-controls")):null,this.targetSelector&&(this._$target=$(this.targetSelector)),this.addListener(this.$trigger,"click","onTriggerClick"),this.addListener(this.$trigger,"keypress",(function(t){var i=t.keyCode;i!==Garnish.SPACE_KEY&&i!==Garnish.RETURN_KEY||(t.preventDefault(),e.onTriggerClick())}))},onTriggerClick:function(){"true"===this.$trigger.attr("aria-expanded")?this.hideTarget(this._$target):this.showTarget(this._$target)},showTarget:function(t){var e=this;if(t&&t.length){this.showTarget._currentHeight=t.height(),t.removeClass("hidden"),this.$trigger.removeClass("collapsed").addClass("expanded").attr("aria-expanded","true");for(var i=0;i .address-card");for(var n=0;n=this.settings.maxItems)){var e=$(t).appendTo(this.$tbody),i=e.find(".delete");this.settings.sortable&&this.sorter.addItems(e),this.$deleteBtns=this.$deleteBtns.add(i),this.addListener(i,"click","handleDeleteBtnClick"),this.totalItems++,this.updateUI()}},reorderItems:function(){var t=this;if(this.settings.sortable){for(var e=[],i=0;i=this.settings.maxItems?$(this.settings.newItemBtnSelector).addClass("hidden"):$(this.settings.newItemBtnSelector).removeClass("hidden"))}},{defaults:{tableSelector:null,noItemsSelector:null,newItemBtnSelector:null,idAttribute:"data-id",nameAttribute:"data-name",sortable:!1,allowDeleteAll:!0,minItems:0,maxItems:null,reorderAction:null,deleteAction:null,reorderSuccessMessage:Craft.t("app","New order saved."),reorderFailMessage:Craft.t("app","Couldn’t save new order."),confirmDeleteMessage:Craft.t("app","Are you sure you want to delete “{name}”?"),deleteSuccessMessage:Craft.t("app","“{name}” deleted."),deleteFailMessage:Craft.t("app","Couldn’t delete “{name}”."),onReorderItems:$.noop,onDeleteItem:$.noop}})},6872:function(){Craft.AssetImageEditor=Garnish.Modal.extend({$body:null,$footer:null,$imageTools:null,$buttons:null,$cancelBtn:null,$replaceBtn:null,$saveBtn:null,$focalPointBtn:null,$editorContainer:null,$straighten:null,$croppingCanvas:null,$spinner:null,$constraintContainer:null,$constraintRadioInputs:null,$customConstraints:null,canvas:null,image:null,viewport:null,focalPoint:null,grid:null,croppingCanvas:null,clipper:null,croppingRectangle:null,cropperHandles:null,cropperGrid:null,croppingShade:null,imageStraightenAngle:0,viewportRotation:0,originalWidth:0,originalHeight:0,imageVerticeCoords:null,zoomRatio:1,animationInProgress:!1,currentView:"",assetId:null,cacheBust:null,draggingCropper:!1,scalingCropper:!1,draggingFocal:!1,previousMouseX:0,previousMouseY:0,shiftKeyHeld:!1,editorHeight:0,editorWidth:0,cropperState:!1,scaleFactor:1,flipData:{},focalPointState:!1,maxImageSize:null,lastLoadedDimensions:null,imageIsLoading:!1,mouseMoveEvent:null,croppingConstraint:!1,constraintOrientation:"landscape",showingCustomConstraint:!1,saving:!1,renderImage:null,renderCropper:null,_queue:null,init:function(t,e){var i=this;this._queue=new Craft.Queue,this.cacheBust=Date.now(),this.setSettings(e,Craft.AssetImageEditor.defaults),null===this.settings.allowDegreeFractions&&(this.settings.allowDegreeFractions=Craft.isImagick),Garnish.prefersReducedMotion()&&(this.settings.animationDuration=1),this.assetId=t,this.flipData={x:0,y:0},this.$container=$('
').appendTo(Garnish.$bod),this.$body=$('
').appendTo(this.$container),this.$footer=$('
').appendTo(this.$container),this.base(this.$container,this.settings),this.$buttons=$('
').appendTo(this.$footer),this.$cancelBtn=$("
    '),tabManager:null,enableQueue:!0,totalJobs:0,jobInfo:null,displayedJobInfo:null,displayedJobInfoUnchanged:1,trackJobProgressTimeout:null,trackingJobProgress:!1,jobProgressCancelToken:null,jobProgressIcon:null,checkingForUpdates:!1,forcingRefreshOnUpdatesCheck:!1,includingDetailsOnUpdatesCheck:!1,checkForUpdatesCallbacks:null,checkForUpdatesFailureCallbacks:null,resizeTimeout:null,init:function(){var t=this;this.elementThumbLoader=new Craft.ElementThumbLoader,0!==Craft.remainingSessionTime&&(this.authManager=new Craft.AuthManager),this.$nav=$("#nav"),this.$navToggle=$("#primary-nav-toggle"),this.$globalSidebar=$("#global-sidebar"),this.$globalContainer=$("#global-container"),this.$mainContainer=$("#main-container"),this.$alerts=$("#alerts"),this.$crumbs=$("#crumbs"),this.$breadcrumbList=$(".breadcrumb-list"),this.$breadcrumbItems=$(".breadcrumb-list li"),this.$notificationContainer=$("#notifications"),this.$main=$("#main"),this.$primaryForm=$("#main-form"),this.$headerContainer=$("#header-container"),this.$header=$("#header"),this.$mainContent=$("#main-content"),this.$details=$("#details"),this.$sidebarContainer=$("#sidebar-container"),this.$sidebarToggle=$("#sidebar-toggle"),this.$sidebar=$("#sidebar"),this.$contentContainer=$("#content-container"),this.$collapsibleTables=$("table.collapsible"),this.isMobile=Garnish.isMobileBrowser(),this.updateContentHeading();for(var e,i=this.$details.find(".meta > .field > .instructions"),n=0;n",{class:"info",html:s.children().html()}).appendTo(r),s.remove()}if(!this.isMobile&&this.$header.length&&(this.addListener(Garnish.$win,"scroll","updateFixedHeader"),this.updateFixedHeader()),Garnish.$doc.ready((function(){t.addListener(Garnish.$win,"resize",(function(e){if(e.target===window){t.handleWindowResize(),clearTimeout(t.resizeTimeout);var i=t;t.resizeTimeout=setTimeout((function(){i.setSidebarNavAttributes()}),100)}})),t.handleWindowResize(),t.setSidebarNavAttributes(),Garnish.requestAnimationFrame(t.initSpecialForms.bind(t))})),this.$alerts.length&&this.initAlerts(),this.addListener(this.$navToggle,"click","toggleNav"),this.addListener(this.$sidebarToggle,"click","toggleSidebar"),this.$primaryForm.length||(this.$primaryForm=$("form[data-saveshortcut]:first")),this.$primaryForm.length&&Garnish.hasAttr(this.$primaryForm,"data-saveshortcut")&&function(){var e=[],i=t.$primaryForm.data("actions");if(void 0===i)e.push([{keyCode:Garnish.S_KEY,ctrl:!0},{redirect:t.$primaryForm.data("saveshortcut-redirect"),retainScroll:Garnish.hasAttr(t.$primaryForm,"saveshortcut-scroll")}]);else for(var n=0;n",{class:"visually-hidden",html:Craft.t("app","Unread messages")}),u.addClass("unread").append(d)),this.addListener(u,"click",(function(){if(c)c.show();else{var t="";Craft.announcements.forEach((function(e){t+='
    ')+'
    '+'

    '.concat(e.heading,"

    ")+'
    '+'")+'
    '.concat(e.label,"
    ")+"
    "+"

    ".concat(e.body,"

    ")+"
    "})),c=new Garnish.HUD(u,'
    ').concat(t,"
    "),{onShow:function(){u.addClass("active")},onHide:function(){u.removeClass("active")}}),$("a",c.$main).each((function(){this.hostname.length&&this.hostname!==l.hostname&&void 0===$(this).attr("target")&&$(this).attr("rel","noopener").attr("target","_blank")})),p&&(u.removeClass("unread"),d.remove(),Craft.sendActionRequest("POST","users/mark-announcements-as-read",{data:{ids:Craft.announcements.map((function(t){return t.id}))}}))}}))}var f=document.getElementById("footer");f&&new IntersectionObserver((function(t){var e=function(t,e){return function(t){if(Array.isArray(t))return t}(t)||function(t,e){var i=null==t?null:"undefined"!=typeof Symbol&&t[Symbol.iterator]||t["@@iterator"];if(null!=i){var n,s,a=[],r=!0,o=!1;try{for(i=i.call(t);!(r=(n=i.next()).done)&&(a.push(n.value),!e||a.length!==e);r=!0);}catch(t){o=!0,s=t}finally{try{r||null==i.return||i.return()}finally{if(o)throw s}}return a}}(t,e)||a(t,e)||function(){throw new TypeError("Invalid attempt to destructure non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.")}()}(t,1)[0];e.target.classList.toggle("stuck",e.intersectionRatio<1)}),{rootMargin:"0px 0px -1px 0px",threshold:[1]}).observe(f),this.elementThumbLoader.load($("#user-info")),this.elementThumbLoader.load(this.$mainContent)},get $contentHeader(){var t=$("#content-header");return t.length?t:$("
    ",{id:"content-header",class:"pane-header"}).prependTo($("#content"))},get $noticeContainer(){var t=$("#content-notice");return t.length?t:$('
    ').attr("role","status").prependTo(this.$contentHeader)},initSpecialForms:function(){var t=this;if(this.$confirmUnloadForms=$("form[data-confirm-unload]"),this.$deltaForms=$("form[data-delta]"),this.$confirmUnloadForms.length){for(var e=this.$confirmUnloadForms.add(this.$deltaForms),i=function(i){var n=e.eq(i);if(!n.data("initialSerializedValue")){var s=n.data("serializer")||function(){return n.serialize()};n.data("initialSerializedValue",s())}t.addListener(n,"submit",(function(t){if(Garnish.hasAttr(n,"data-confirm-unload")&&this.removeListener(Garnish.$win,"beforeunload"),Garnish.hasAttr(n,"data-delta")){t.preventDefault();var e=n.data("serializer")||function(){return n.serialize()},i=Craft.findDeltaData(n.data("initialSerializedValue"),e(),n.data("delta-names"),null,n.data("initial-delta-values"),n.data("modified-delta-names"));Craft.createForm(i).appendTo(Garnish.$bod).submit()}}))},n=0;n a"):void 0},get $selectedTab(){return this.tabManager?this.tabManager.$selectedTab:void 0},get selectedTabIndex(){return this.tabManager?this.tabManager.$tabs.index(this.tabManager.$selectedTab):void 0},get $focusableTab(){return this.tabManager?this.tabManager.$focusableTab:void 0},selectTab:function(t){this.tabManager&&this.tabManager.selectTab(t)},deselectTab:function(){this.tabManager&&this.tabManager.deselectTab()},handleWindowResize:function(){this.updateResponsiveTables(),this.handleBreadcrumbVisibility()},breadcrumbItemsWrap:function(){if(this.$breadcrumbItems[0]){this.$breadcrumbList.css("ltr"===Craft.orientation?"margin-right":"margin-left","");for(var t=this.$breadcrumbList[0].getBoundingClientRect().width,e=0,i=this.$breadcrumbList.find("li"),n=0;n0&&(void 0===this.updateResponsiveTables._$table.data("lastContainerWidth")?this.updateResponsiveTables._check=!0:(this.updateResponsiveTables._isCollapsed=this.updateResponsiveTables._$table.hasClass("collapsed"),this.updateResponsiveTables._containerWidth>this.updateResponsiveTables._$table.data("lastContainerWidth")?this.updateResponsiveTables._isCollapsed&&(this.updateResponsiveTables._$table.removeClass("collapsed"),this.updateResponsiveTables._check=!0):this.updateResponsiveTables._isCollapsed||(this.updateResponsiveTables._check=!0)),this.updateResponsiveTables._check&&this.updateResponsiveTables._$table.width()-30>this.updateResponsiveTables._containerWidth&&this.updateResponsiveTables._$table.addClass("collapsed"),this.updateResponsiveTables._$table.data("lastContainerWidth",this.updateResponsiveTables._containerWidth))},updateFixedHeader:function(){if(!this.isMobile)if(this.$main.length&&this.$headerContainer[0].getBoundingClientRect().top<0){var t=this.$headerContainer.height();this.fixedHeader||(this.$contentContainer.css("min-height","calc(100vh - "+(t+14+48-1)+"px)"),this.$headerContainer.height(t),Garnish.$bod.addClass("fixed-header"),this.fixedHeader=!0),this._setFixedTopPos(this.$sidebar,t),this._setFixedTopPos(this.$details,t)}else this.fixedHeader&&(this.$headerContainer.height("auto"),Garnish.$bod.removeClass("fixed-header"),this.$contentContainer.css("min-height",""),this.$sidebar.removeClass("fixed").css("top",""),this.$details.removeClass("fixed").css("top",""),this.fixedHeader=!1)},_setFixedTopPos:function(t,e){t.length&&this.$contentContainer.length&&(t.outerHeight()>=this.$contentContainer.outerHeight()?t.removeClass("fixed").css("top",""):t.addClass("fixed").css("top",Math.min(e+14,Math.max(this.$mainContent[0].getBoundingClientRect().top,document.documentElement.clientHeight-t.outerHeight()))+"px"))},displayNotification:function(t,e,i){var n=new Craft.CP.Notification(t,e,i);return this.trigger("displayNotification",{notificationType:t,message:e,notification:n}),n},displayNotice:function(t,e){return this.displayNotification("notice",t,Object.assign({icon:"info",iconLabel:Craft.t("app","Notice")},e))},displaySuccess:function(t,e){return this.displayNotification("success",t,Object.assign({icon:"check",iconLabel:Craft.t("app","Success")},e))},displayError:function(t,e){return t&&"object"!==s(t)||(e=t,t=Craft.t("app","A server error occurred.")),this.displayNotification("error",t,Object.assign({icon:"alert",iconLabel:Craft.t("app","Error")},e))},fetchAlerts:function(){return Craft.queue.push((function(){return new Promise((function(t,e){var i={path:Craft.path};Craft.sendActionRequest("POST","app/get-cp-alerts",{data:i}).then((function(e){var i=e.data;t(i.alerts)})).catch(e)}))}))},displayAlerts:function(t){var e=!(arguments.length>1&&void 0!==arguments[1])||arguments[1];if(this.$alerts.remove(),Array.isArray(t)&&t.length){this.$alerts=$('