Merge remote-tracking branch 'arcticfoxes/MC-5895' into 2.3-qwerty-pr

Author: Joan He

app/code/Magento/Ui/Controller/Index/Render.php

@@ -7,15 +7,19 @@
 
 use Magento\Backend\App\Action\Context;
 use Magento\Framework\App\ObjectManager;
-use Magento\Framework\App\Response\Http as HttpResponse;
 use Magento\Framework\View\Element\UiComponentFactory;
 use Magento\Framework\View\Element\UiComponentInterface;
 use Magento\Ui\Model\UiComponentTypeResolver;
+use Magento\Framework\Escaper;
+use Magento\Framework\Controller\Result\JsonFactory;
+use Psr\Log\LoggerInterface;
+use Magento\Framework\AuthorizationInterface;
 
 /**
  * Is responsible for providing ui components information on store front.
  *
  * @SuppressWarnings(PHPMD.AllPurposeAction)
+ * @SuppressWarnings(PHPMD.CouplingBetweenObjects)
  */
 class Render extends \Magento\Framework\App\Action\Action
 {
@@ -34,42 +38,117 @@ class Render extends \Magento\Framework\App\Action\Action
      */
     private $contentTypeResolver;
 
+    /**
+     * @var JsonFactory
+     */
+    private $resultJsonFactory;
+
+    /**
+     * @var Escaper
+     */
+    private $escaper;
+
+    /**
+     * @var LoggerInterface
+     */
+    private $logger;
+
+    /**
+     * @var AuthorizationInterface
+     */
+    private $authorization;
+
     /**
      * Render constructor.
      * @param Context $context
      * @param UiComponentFactory $uiComponentFactory
      * @param UiComponentTypeResolver|null $contentTypeResolver
+     * @param JsonFactory|null $resultJsonFactory
+     * @param Escaper|null $escaper
+     * @param LoggerInterface|null $logger
      */
     public function __construct(
         Context $context,
         UiComponentFactory $uiComponentFactory,
-        ?UiComponentTypeResolver $contentTypeResolver = null
+        ?UiComponentTypeResolver $contentTypeResolver = null,
+        JsonFactory $resultJsonFactory = null,
+        Escaper $escaper = null,
+        LoggerInterface $logger = null
     ) {
         parent::__construct($context);
         $this->context = $context;
         $this->uiComponentFactory = $uiComponentFactory;
+        $this->authorization = $context->getAuthorization();
         $this->contentTypeResolver = $contentTypeResolver
             ?? ObjectManager::getInstance()->get(UiComponentTypeResolver::class);
+        $this->resultJsonFactory = $resultJsonFactory ?? ObjectManager::getInstance()->get(JsonFactory::class);
+        $this->escaper = $escaper ?? ObjectManager::getInstance()->get(Escaper::class);
+        $this->logger = $logger ?? ObjectManager::getInstance()->get(LoggerInterface::class);
     }
 
     /**
-     * Action for AJAX request
-     *
-     * @return void
+     * @inheritdoc
      */
     public function execute()
     {
         if ($this->_request->getParam('namespace') === null) {
-            $this->_redirect('noroute');
+            $this->_redirect('admin/noroute');
+
             return;
         }
 
-        $component = $this->uiComponentFactory->create($this->_request->getParam('namespace'));
-        $this->prepareComponent($component);
-        /** @var HttpResponse $response */
-        $response = $this->getResponse();
-        $response->appendBody((string) $component->render());
-        $response->setHeader('Content-Type', $this->contentTypeResolver->resolve($component->getContext()), true);
+        try {
+            $component = $this->uiComponentFactory->create($this->getRequest()->getParam('namespace'));
+            if ($this->validateAclResource($component->getContext()->getDataProvider()->getConfigData())) {
+                $this->prepareComponent($component);
+                $this->getResponse()->appendBody((string)$component->render());
+
+                $contentType = $this->contentTypeResolver->resolve($component->getContext());
+                $this->getResponse()->setHeader('Content-Type', $contentType, true);
+            } else {
+                /** @var \Magento\Framework\Controller\Result\Json $resultJson */
+                $resultJson = $this->resultJsonFactory->create();
+                $resultJson->setStatusHeader(
+                    \Zend\Http\Response::STATUS_CODE_403,
+                    \Zend\Http\AbstractMessage::VERSION_11,
+                    'Forbidden'
+                );
+                return $resultJson->setData([
+                    'error' => $this->escaper->escapeHtml('Forbidden'),
+                    'errorcode' => 403
+                ]);
+            }
+        } catch (\Magento\Framework\Exception\LocalizedException $e) {
+            $this->logger->critical($e);
+            $result = [
+                'error' => $this->escaper->escapeHtml($e->getMessage()),
+                'errorcode' => $this->escaper->escapeHtml($e->getCode())
+            ];
+            /** @var \Magento\Framework\Controller\Result\Json $resultJson */
+            $resultJson = $this->resultJsonFactory->create();
+            $resultJson->setStatusHeader(
+                \Zend\Http\Response::STATUS_CODE_400,
+                \Zend\Http\AbstractMessage::VERSION_11,
+                'Bad Request'
+            );
+
+            return $resultJson->setData($result);
+        } catch (\Exception $e) {
+            $this->logger->critical($e);
+            $result = [
+                'error' => __('UI component could not be rendered because of system exception'),
+                'errorcode' => $this->escaper->escapeHtml($e->getCode())
+            ];
+            /** @var \Magento\Framework\Controller\Result\Json $resultJson */
+            $resultJson = $this->resultJsonFactory->create();
+            $resultJson->setStatusHeader(
+                \Zend\Http\Response::STATUS_CODE_400,
+                \Zend\Http\AbstractMessage::VERSION_11,
+                'Bad Request'
+            );
+
+            return $resultJson->setData($result);
+        }
     }
 
     /**
@@ -85,4 +164,25 @@ private function prepareComponent(UiComponentInterface $component)
         }
         $component->prepare();
     }
+
+    /**
+     * Optionally validate ACL resource of components with a DataSource/DataProvider
+     *
+     * @param mixed $dataProviderConfigData
+     * @return bool
+     */
+    private function validateAclResource($dataProviderConfigData)
+    {
+        if (isset($dataProviderConfigData['aclResource'])) {
+            if (!$this->authorization->isAllowed($dataProviderConfigData['aclResource'])) {
+                if (!$this->_request->isAjax()) {
+                    $this->_redirect('noroute');
+                }
+
+                return false;
+            }
+        }
+
+        return true;
+    }
 }