Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

html_entity_decodeを使っている箇所を修正 #107

Merged
merged 2 commits into from
Jun 15, 2021
Merged

html_entity_decodeを使っている箇所を修正 #107

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
d758ef1
fix xss
chihiro-adachi Jun 12, 2021
09a25cf
bump version.
kiy0taka Jun 12, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
190 changes: 81 additions & 109 deletions Event/MailMagazineLegacy.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -159,9 +159,6 @@ public function onRenderAdminCustomerBefore(FilterResponseEvent $event)
$request = $event->getRequest();
$response = $event->getResponse();

$crawler = new Crawler($response->getContent());
$html = $this->getHtml($crawler);

$form = $this->app['form.factory']->createBuilder('admin_customer')->getForm();

if ('POST' === $request->getMethod() && $response->headers->has('location')) {
Expand Down Expand Up @@ -213,20 +210,24 @@ public function onRenderAdminCustomerBefore(FilterResponseEvent $event)

$form->handleRequest($request);

$document = \DOMDocument::loadHTML($response->getContent());
$xpath = new \DOMXPath($document);
$table = $xpath->query('//div[@class="form-horizontal"]', $document)->item(0);

if (!$table) {
return $response->getContent();
}

$parts = $this->app->renderView('MailMagazine/Resource/template/admin/mailmagazine.twig', array(
'form' => $form->createView(),
));

try {
$oldHtml = $this->decodeHtml($crawler->filter('.form-horizontal .form-group')->last()->parents()->html());

$newHtml = $oldHtml.$parts;
$html = str_replace($oldHtml, $newHtml, $html);
} catch (\InvalidArgumentException $e) {
}

$response->setContent($html);
$dom = \DOMDocument::loadHtml('<?xml encoding="utf-8" ?>'.$parts);
$newNode = $dom->getElementsByTagName('div')->item(0);
$table->appendChild($document->importNode($newNode, true));

$crawler = new Crawler($document);
$response->setContent($crawler->html());
$event->setResponse($response);
}
}
Expand All @@ -247,51 +248,47 @@ protected function getNewEntryHtml($request, $response)
{
$app = &$this->app;

$crawler = new Crawler($response->getContent());
$html = $this->getHtml($crawler);
// 今が登録確認画面か確認する
$confirmFlg = $this->isEntryConfirm($request);

try {
// 今が登録確認画面か確認する
$confirmFlg = $this->isEntryConfirm($request);
// POSTの場合はメールマガジン送付を入力不可にする
$twigName = 'entry_add_mailmaga.twig';
if ('POST' === $this->app['request']->getMethod() && $confirmFlg) {
$twigName = 'entry_confirm_add_mailmaga.twig';
}

// POSTの場合はメールマガジン送付を入力不可にする
$twigName = 'entry_add_mailmaga.twig';
if ('POST' === $this->app['request']->getMethod() && $confirmFlg) {
$twigName = 'entry_confirm_add_mailmaga.twig';
}
// Formの取得
$builder = $app['form.factory']->createBuilder('entry');
$form = $builder->getForm();

// Formの取得
$builder = $app['form.factory']->createBuilder('entry');
$form = $builder->getForm();
$form->handleRequest($request);

if ($confirmFlg) {
$builder->setAttribute('freeze', true);
$form = $builder->getForm();
$form->handleRequest($request);
}

if ($confirmFlg) {
$builder->setAttribute('freeze', true);
$form = $builder->getForm();
$form->handleRequest($request);
}

// 追加先のノードを取得
$nodeHtml = $crawler->filter('.dl_table.not_required')->last()->html();

// 追加する情報のHTMLを取得する.
try {
$parts = $this->app['twig']->render(
'MailMagazine/Resource/template/'.$twigName,
array('form' => $form->createView())
);
} catch (Exception $exception) {
log_error($exception->getMessage());
}
$newNodeHtml = $nodeHtml.$parts;
$document = \DOMDocument::loadHTML($response->getContent());
$xpath = new \DOMXPath($document);
$table = $xpath->query('//div[@class="dl_table not_required"]', $document)->item(0);

$html = str_replace($nodeHtml, $newNodeHtml, $html);
} catch (\InvalidArgumentException $e) {
// no-op
if (!$table) {
return $response->getContent();
}

return $html;
$parts = $this->app['twig']->render(
'MailMagazine/Resource/template/' . $twigName,
array('form' => $form->createView())
);

$dom = \DOMDocument::loadHtml('<?xml encoding="utf-8" ?>'.$parts);
$newNode = $dom->getElementsByTagName('dl')->item(0);
$table->appendChild($document->importNode($newNode, true));

$crawler = new Crawler($document);

return $crawler->html();
}

/**
Expand All @@ -306,51 +303,49 @@ protected function getNewMypageChangeHtml($request, $response)
{
$app = &$this->app;

$crawler = new Crawler($response->getContent());
$html = $this->getHtml($crawler);

try {
// カスタマIDの取得
$Customer = $app->user();
if (is_null($Customer)) {
return $html;
}
// カスタマIDの取得
$Customer = $app->user();
if (is_null($Customer)) {
return $response->getContent();
}

// Formの取得
$builder = $app['form.factory']->createBuilder('entry');
$form = $builder->getForm();
// Formの取得
$builder = $app['form.factory']->createBuilder('entry');
$form = $builder->getForm();

if ('POST' === $this->app['request']->getMethod()) {
$form->handleRequest($request);
} else {
// DBからメルマガ送付情報を取得する
$MailmagaCustomerRepository = $this->app['eccube.plugin.mail_magazine.repository.mail_magazine_mailmaga_customer'];
$MailmagaCustomer = $MailmagaCustomerRepository->findOneBy(array('customer_id' => $Customer->getId()));
if ('POST' === $this->app['request']->getMethod()) {
$form->handleRequest($request);
} else {
// DBからメルマガ送付情報を取得する
$MailmagaCustomerRepository = $this->app['eccube.plugin.mail_magazine.repository.mail_magazine_mailmaga_customer'];
$MailmagaCustomer = $MailmagaCustomerRepository->findOneBy(array('customer_id' => $Customer->getId()));

if (!is_null($MailmagaCustomer)) {
$form->get('mailmaga_flg')->setData($MailmagaCustomer->getMailmagaFlg());
}
if (!is_null($MailmagaCustomer)) {
$form->get('mailmaga_flg')->setData($MailmagaCustomer->getMailmagaFlg());
}
}

// 追加先のノードを取得
if (!count($crawler->filter('.dl_table.not_required')->last())) {
return $html;
}
$nodeHtml = $crawler->filter('.dl_table.not_required')->last()->html();

// 追加する情報のHTMLを取得する.
$parts = $this->app['twig']->render(
'MailMagazine/Resource/template/entry_add_mailmaga.twig',
array('form' => $form->createView())
);
$newNodeHtml = $nodeHtml.$parts;

$html = str_replace($nodeHtml, $newNodeHtml, $html);
} catch (\InvalidArgumentException $e) {
// no-op
$document = \DOMDocument::loadHTML($response->getContent());
$xpath = new \DOMXPath($document);
$table = $xpath->query('//div[@class="dl_table not_required"]', $document)->item(0);

if (!$table) {
return $response->getContent();
}

return $html;
// 追加する情報のHTMLを取得する.
$parts = $this->app['twig']->render(
'MailMagazine/Resource/template/entry_add_mailmaga.twig',
array('form' => $form->createView())
);

$dom = \DOMDocument::loadHtml('<?xml encoding="utf-8" ?>'.$parts);
$newNode = $dom->getElementsByTagName('dl')->item(0);
$table->appendChild($document->importNode($newNode, true));

$crawler = new Crawler($document);

return $crawler->html();
}

/**
Expand All @@ -375,27 +370,4 @@ protected function isEntryConfirm($request)

return false;
}

/**
* 解析用HTMLを取得.
*
* @param Crawler $crawler
*
* @return string
*/
private function getHtml(Crawler $crawler)
{
$html = '';
foreach ($crawler as $domElement) {
$domElement->ownerDocument->formatOutput = true;
$html .= $domElement->ownerDocument->saveHTML();
}

return $this->decodeHtml($html);
}

private function decodeHtml($html)
{
return html_entity_decode($html, ENT_NOQUOTES, 'UTF-8');
}
}
2 changes: 1 addition & 1 deletion config.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
name: MailMagazine
event: MailMagazine
code: MailMagazine
version: 1.0.2
version: 1.0.4
service:
- MailMagazineServiceProvider
orm.path:
Expand Down