Merge pull request #272 from magento-obsessive-owls/1.0-develop-sync-1.0.2

Create 1.0.2-release

Author: davemacaulay

.github/CODEOWNERS

@@ -0,0 +1,3 @@
+# CODEOWNERS file for /docs/ folder.
+# Forces a review from other writers for anything within /docs/.
+/docs/ @magento/devdocs-admins

README.md

@@ -9,6 +9,10 @@ Use this access to:
 
 Should you find an issue in Page Builder functionality, please report it on GitHub.
 
+## Documentation
+
+Please use this link to access the latest Page Builder documentation: https://devdocs.magento.com/page-builder/docs/index.html
+
 ## GitHub installation only
 
 **The pre-release version of Page Builder MUST be installed by cloning the GitHub repos as described here.**
@@ -43,11 +47,6 @@ Before installing Page Builder, make sure you have:
     bin/magento setup:upgrade
     ```
 
-## Developer documentation
-
-We will update the developer documentation frequently during beta. Please use this link to access the latest updates: 
-[Page Builder developer documentation](https://devdocs.magedevteam.com/72/page-builder/docs/getting-started/introduction.html)
-
 ## Contribute to Page Builder
 
 We appreciate any and all contributions to Page Builder. If you are interested in contributing to this repository, please see our [Contribution Guide].

app/code/Magento/PageBuilder/Block/Adminhtml/Stage/Render.php

@@ -0,0 +1,88 @@
+<?php
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+
+declare(strict_types=1);
+
+namespace Magento\PageBuilder\Block\Adminhtml\Stage;
+
+use Magento\Framework\View\Element\Template;
+use Magento\RequireJs\Model\FileManager;
+use Magento\PageBuilder\Model\Stage\Config;
+use Magento\Framework\Serialize\Serializer\Json;
+
+/**
+ * Class Render
+ */
+class Render extends Template
+{
+    /**
+     * @var FileManager
+     */
+    private $fileManager;
+
+    /**
+     * @var Config
+     */
+    private $pageBuilderConfig;
+
+    /**
+     * @var Json
+     */
+    private $json;
+
+    /**
+     * @param Template\Context $context
+     * @param FileManager $fileManager
+     * @param Config $config
+     * @param Json $json
+     * @param array $data
+     */
+    public function __construct(
+        Template\Context $context,
+        FileManager $fileManager,
+        Config $config,
+        Json $json,
+        array $data = []
+    ) {
+        parent::__construct($context, $data);
+        $this->fileManager = $fileManager;
+        $this->pageBuilderConfig = $config;
+        $this->json = $json;
+    }
+
+    /**
+     * Generate the URL to RequireJS
+     *
+     * @return string
+     * @throws \Magento\Framework\Exception\LocalizedException
+     */
+    public function getRequireJsUrl() : string
+    {
+        $asset = $this->_assetRepo->createAsset('requirejs/require.js');
+        return $asset->getUrl();
+    }
+
+    /**
+     * Retrieve the URL to the RequireJS Config file
+     *
+     * @return string
+     */
+    public function getRequireJsConfigUrl() : string
+    {
+        $requireJsConfig = $this->fileManager->createRequireJsConfigAsset();
+        return $requireJsConfig->getUrl();
+    }
+
+    /**
+     * Retrieve the Page Builder's config
+     *
+     * @return array
+     */
+    public function getPageBuilderConfig() : string
+    {
+        return $this->json->serialize($this->pageBuilderConfig->getConfig());
+    }
+}

app/code/Magento/PageBuilder/Controller/Adminhtml/Stage/Render.php

@@ -0,0 +1,49 @@
+<?php
+/**
+ *
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+
+namespace Magento\PageBuilder\Controller\Adminhtml\Stage;
+
+use Magento\Framework\App\Action\HttpGetActionInterface;
+use Magento\RequireJs\Block\Html\Head\Config;
+
+/**
+ * Class Render
+ *
+ * Iframe to render Page Builder stage in isolation
+ */
+class Render extends \Magento\Backend\App\Action implements HttpGetActionInterface
+{
+    const ADMIN_RESOURCE = 'Magento_Backend::content';
+
+    /**
+     * Render the RequireJS and Page Builder render blocks without any additional layout
+     *
+     * @return void
+     */
+    public function execute()
+    {
+        $layout = $this->_view->getLayout();
+        $requireJs = $layout->createBlock(
+            \Magento\Backend\Block\Page\RequireJs::class,
+            'require.js'
+        );
+        $requireJs->setTemplate('Magento_Backend::page/js/require_js.phtml');
+        /* @var \Magento\PageBuilder\Block\Adminhtml\Stage\Render $renderBlock */
+        $renderBlock = $layout->createBlock(
+            \Magento\PageBuilder\Block\Adminhtml\Stage\Render::class,
+            'stage_render'
+        );
+        $renderBlock->setTemplate('Magento_PageBuilder::stage/render.phtml');
+        $babelPolyfill = $layout->createBlock(
+            \Magento\PageBuilder\Block\Adminhtml\Html\Head\BabelPolyfill::class,
+            'pagebuilder.babel.polyfill'
+        );
+        $babelPolyfill->setTemplate('Magento_PageBuilder::html/head/babel_polyfill.phtml');
+        $this->getResponse()->setBody($requireJs->toHtml() . $babelPolyfill->toHtml() . $renderBlock->toHtml());
+        $this->getResponse()->sendResponse();
+    }
+}

app/code/Magento/PageBuilder/Controller/ContentType/Preview.php

@@ -26,19 +26,28 @@ class Preview extends \Magento\Framework\App\Action\Action implements HttpPostAc
      */
     private $rendererPool;
 
+    /**
+     * @var \Magento\Backend\Model\Auth
+     */
+    private $auth;
+
     /**
      * Constructor
      *
      * @param \Magento\Backend\App\Action\Context $context
      * @param \Magento\PageBuilder\Model\Stage\RendererPool $rendererPool
+     * @param \Magento\Backend\Model\Auth $auth
      */
     public function __construct(
         \Magento\Backend\App\Action\Context $context,
-        \Magento\PageBuilder\Model\Stage\RendererPool $rendererPool
+        \Magento\PageBuilder\Model\Stage\RendererPool $rendererPool,
+        \Magento\Backend\Model\Auth $auth = null
     ) {
         parent::__construct($context);
 
         $this->rendererPool = $rendererPool;
+        $this->auth = $auth ?? \Magento\Framework\App\ObjectManager::getInstance()
+            ->get(\Magento\Backend\Model\Auth::class);
     }
 
     /**
@@ -48,14 +57,18 @@ public function __construct(
      */
     public function execute()
     {
-        $pageResult = $this->resultFactory->create(ResultFactory::TYPE_PAGE);
-        // Some template filters and directive processors expect this to be called in order to function.
-        $pageResult->initLayout();
+        if ($this->auth->isLoggedIn()) {
+            $pageResult = $this->resultFactory->create(ResultFactory::TYPE_PAGE);
+            // Some template filters and directive processors expect this to be called in order to function.
+            $pageResult->initLayout();
+
+            $params = $this->getRequest()->getParams();
+            $renderer = $this->rendererPool->getRenderer($params['role']);
+            $result = ['data' => $renderer->render($params)];
 
-        $params = $this->getRequest()->getParams();
-        $renderer = $this->rendererPool->getRenderer($params['role']);
-        $result = ['data' => $renderer->render($params)];
+            return $this->resultFactory->create(ResultFactory::TYPE_JSON)->setData($result);
+        }
 
-        return $this->resultFactory->create(ResultFactory::TYPE_JSON)->setData($result);
+        $this->_forward('noroute');
     }
 }

app/code/Magento/PageBuilder/Model/Stage/Config.php

@@ -135,7 +135,10 @@ public function getConfig()
             'content_types' => $this->getContentTypes(),
             'stage_config' => $this->data,
             'media_url' => $this->urlBuilder->getBaseUrl(['_type' => UrlInterface::URL_TYPE_MEDIA]),
-            'preview_url' => $this->frontendUrlBuilder->getUrl('pagebuilder/contenttype/preview'),
+            'preview_url' => $this->frontendUrlBuilder
+                ->addSessionParam()
+                ->getUrl('pagebuilder/contenttype/preview'),
+            'render_url' => $this->urlBuilder->getUrl('pagebuilder/stage/render'),
             'column_grid_default' => $this->scopeConfig->getValue(self::XML_PATH_COLUMN_GRID_DEFAULT),
             'column_grid_max' => $this->scopeConfig->getValue(self::XML_PATH_COLUMN_GRID_MAX),
             'can_use_inline_editing_on_stage' => $this->isWysiwygProvisionedForEditingOnStage(),

app/code/Magento/PageBuilder/Model/Stage/HtmlFilter.php

@@ -49,17 +49,28 @@ public function filterHtml(string $content): string
             $this->loggerInterface->critical($e->getMessage());
         }
         libxml_use_internal_errors($previous);
-        // Remove all <script /> tags from output
-        foreach (iterator_to_array($dom->getElementsByTagName('script')) as $item) {
-            $item->parentNode->removeChild($item);
+        // Remove all <script /> tags, on* attributes from output
+        /** @var \DOMElement $item */
+        foreach (iterator_to_array($dom->getElementsByTagName('*')) as $item) {
+            if (in_array($item->tagName, ['script', 'meta', 'embed', 'object'])) {
+                $item->parentNode->removeChild($item);
+            } else {
+                foreach (iterator_to_array($item->attributes) as $attribute) {
+                    if (stripos($attribute->name, 'on') === 0 ||
+                        stripos(ltrim($attribute->value), 'javascript') === 0
+                    ) {
+                        $item->removeAttribute($attribute->name);
+                    }
+                }
+            }
         }
         $xpath = new \DOMXPath($dom);
         $htmlContentTypes = $xpath->query(
             '//*[@data-content-type="html" and not(contains(@class, "placeholder-html-code"))]'
         );
         foreach ($htmlContentTypes as $htmlContentType) {
             /* @var \DOMElement $htmlContentType */
-            $innerHTML= '';
+            $innerHTML = '';
             $children = $htmlContentType->childNodes;
             foreach ($children as $child) {
                 $innerHTML .= $child->ownerDocument->saveXML($child);

app/code/Magento/PageBuilder/Plugin/Filter/CustomVarTemplate.php

@@ -0,0 +1,53 @@
+<?php
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+declare(strict_types=1);
+
+namespace Magento\PageBuilder\Plugin\Filter;
+
+use Magento\Store\Model\Store;
+use Magento\Framework\Escaper;
+
+/**
+ * Plugin to the template filter to escape custom variable directives
+ */
+class CustomVarTemplate
+{
+    /**
+     * @var Escaper
+     */
+    private $escaper;
+
+    /**
+     * @param Escaper $escaper
+     */
+    public function __construct(
+        Escaper $escaper
+    ) {
+        $this->escaper = $escaper;
+    }
+
+    /**
+     * Determine if custom variable within a Page Builder CMS Block directive's return value needs to be escaped
+     *
+     * @param \Magento\Email\Model\Template\Filter $subject
+     * @param string $result
+     * @return string
+     */
+    public function afterCustomvarDirective(
+        \Magento\Email\Model\Template\Filter $subject,
+        $result
+    ) {
+        // Determine the need to escape the return value of observed method.
+        // Admin context requires store ID of 0; in that context return value should be escaped
+        $shouldEscape = $subject->getStoreId() !== null && (int) $subject->getStoreId() === Store::DEFAULT_STORE_ID;
+
+        if ($shouldEscape) {
+            return $this->escaper->escapeHtml($result);
+        } else {
+            return $result;
+        }
+    }
+}