Rework the front end preview

calendar-bundle/src/EventListener/PreviewUrlConvertListener.php

@@ -17,26 +17,16 @@
 use Contao\CoreBundle\Framework\ContaoFramework;
 use Contao\Events;
 use Symfony\Component\HttpFoundation\Request;
-use Symfony\Component\HttpFoundation\RequestStack;
 
 /**
  * @internal
  */
 class PreviewUrlConvertListener
 {
-    /**
-     * @var RequestStack
-     */
-    private $requestStack;
-
-    /**
-     * @var ContaoFramework
-     */
     private $framework;
 
-    public function __construct(RequestStack $requestStack, ContaoFramework $framework)
+    public function __construct(ContaoFramework $framework)
     {
-        $this->requestStack = $requestStack;
         $this->framework = $framework;
     }
 
@@ -49,7 +39,7 @@ public function __invoke(PreviewUrlConvertEvent $event): void
             return;
         }
 
-        $request = $this->requestStack->getCurrentRequest();
+        $request = $event->getRequest();
 
         if (null === $request || null === ($eventModel = $this->getEventModel($request))) {
             return;

calendar-bundle/src/Resources/config/listener.yml

@@ -26,7 +26,6 @@ services:
     contao_calendar.listener.preview_url_convert:
         class: Contao\CalendarBundle\EventListener\PreviewUrlConvertListener
         arguments:
-            - '@request_stack'
             - '@contao.framework'
         tags:
             - { name: kernel.event_listener }

calendar-bundle/tests/DependencyInjection/ContaoCalendarExtensionTest.php

@@ -139,7 +139,6 @@ public function testRegistersThePreviewUrlConvertListener(): void
 
         $this->assertEquals(
             [
-                new Reference('request_stack'),
                 new Reference('contao.framework'),
             ],
             $definition->getArguments()

calendar-bundle/tests/EventListener/PreviewUrlConverterListenerTest.php

@@ -19,7 +19,6 @@
 use Contao\Events;
 use Contao\TestCase\ContaoTestCase;
 use Symfony\Component\HttpFoundation\Request;
-use Symfony\Component\HttpFoundation\RequestStack;
 
 class PreviewUrlConverterListenerTest extends ContaoTestCase
 {
@@ -30,9 +29,6 @@ public function testConvertsThePreviewUrl(): void
         $request->server->set('SERVER_NAME', 'localhost');
         $request->server->set('SERVER_PORT', 80);
 
-        $requestStack = new RequestStack();
-        $requestStack->push($request);
-
         $eventModel = $this->createMock(CalendarEventsModel::class);
 
         $adapters = [
@@ -41,9 +37,9 @@ public function testConvertsThePreviewUrl(): void
         ];
 
         $framework = $this->mockContaoFramework($adapters);
-        $event = new PreviewUrlConvertEvent();
+        $event = new PreviewUrlConvertEvent($request);
 
-        $listener = new PreviewUrlConvertListener($requestStack, $framework);
+        $listener = new PreviewUrlConvertListener($framework);
         $listener($event);
 
         $this->assertSame('http://localhost/events/winter-holidays.html', $event->getUrl());
@@ -57,9 +53,9 @@ public function testDoesNotConvertThePreviewUrlIfTheFrameworkIsNotInitialized():
             ->willReturn(false)
         ;
 
-        $event = new PreviewUrlConvertEvent();
+        $event = new PreviewUrlConvertEvent(new Request());
 
-        $listener = new PreviewUrlConvertListener(new RequestStack(), $framework);
+        $listener = new PreviewUrlConvertListener($framework);
         $listener($event);
 
         $this->assertNull($event->getUrl());
@@ -71,13 +67,10 @@ public function testDoesNotConvertThePreviewUrlIfTheCalendarParameterIsNotSet():
         $request->server->set('SERVER_NAME', 'localhost');
         $request->server->set('SERVER_PORT', 80);
 
-        $requestStack = new RequestStack();
-        $requestStack->push($request);
-
         $framework = $this->mockContaoFramework();
-        $event = new PreviewUrlConvertEvent();
+        $event = new PreviewUrlConvertEvent($request);
 
-        $listener = new PreviewUrlConvertListener($requestStack, $framework);
+        $listener = new PreviewUrlConvertListener($framework);
         $listener($event);
 
         $this->assertNull($event->getUrl());
@@ -90,17 +83,14 @@ public function testDoesNotConvertThePreviewUrlIfThereIsNoEvent(): void
         $request->server->set('SERVER_NAME', 'localhost');
         $request->server->set('SERVER_PORT', 80);
 
-        $requestStack = new RequestStack();
-        $requestStack->push($request);
-
         $adapters = [
             CalendarEventsModel::class => $this->mockConfiguredAdapter(['findByPk' => null]),
         ];
 
         $framework = $this->mockContaoFramework($adapters);
-        $event = new PreviewUrlConvertEvent();
+        $event = new PreviewUrlConvertEvent($request);
 
-        $listener = new PreviewUrlConvertListener($requestStack, $framework);
+        $listener = new PreviewUrlConvertListener($framework);
         $listener($event);
 
         $this->assertNull($event->getUrl());

core-bundle/src/Controller/BackendController.php

@@ -21,8 +21,6 @@
 use Contao\BackendPage;
 use Contao\BackendPassword;
 use Contao\BackendPopup;
-use Contao\BackendPreview;
-use Contao\BackendSwitch;
 use Contao\CoreBundle\Picker\PickerBuilderInterface;
 use Contao\CoreBundle\Picker\PickerConfig;
 use Symfony\Component\HttpFoundation\RedirectResponse;
@@ -94,24 +92,6 @@ public function passwordAction(): Response
         return $controller->run();
     }
 
-    /**
-     * @Route("/contao/preview", name="contao_backend_preview")
-     */
-    public function previewAction(Request $request): Response
-    {
-        $previewScript = $this->getParameter('contao.preview_script');
-
-        if ($request->getScriptName() !== $previewScript) {
-            return $this->redirect($previewScript.$request->getRequestUri());
-        }
-
-        $this->initializeContaoFramework();
-
-        $controller = new BackendPreview();
-
-        return $controller->run();
-    }
-
     /**
      * @Route("/contao/confirm", name="contao_backend_confirm")
      */
@@ -172,18 +152,6 @@ public function popupAction(): Response
         return $controller->run();
     }
 
-    /**
-     * @Route("/contao/switch", name="contao_backend_switch")
-     */
-    public function switchAction(): Response
-    {
-        $this->initializeContaoFramework();
-
-        $controller = new BackendSwitch();
-
-        return $controller->run();
-    }
-
     /**
      * @Route("/contao/alerts", name="contao_backend_alerts")
      */

core-bundle/src/Controller/BackendPreviewController.php

@@ -0,0 +1,100 @@
+<?php
+
+declare(strict_types=1);
+
+/*
+ * This file is part of Contao.
+ *
+ * (c) Leo Feyer
+ *
+ * @license LGPL-3.0-or-later
+ */
+
+namespace Contao\CoreBundle\Controller;
+
+use Contao\CoreBundle\Event\PreviewUrlConvertEvent;
+use Contao\CoreBundle\Security\Authentication\FrontendPreviewAuthenticator;
+use Symfony\Component\EventDispatcher\EventDispatcherInterface;
+use Symfony\Component\HttpFoundation\RedirectResponse;
+use Symfony\Component\HttpFoundation\Request;
+use Symfony\Component\HttpFoundation\Response;
+use Symfony\Component\Routing\Annotation\Route;
+use Symfony\Component\Routing\Generator\UrlGeneratorInterface;
+use Symfony\Component\Routing\RouterInterface;
+use Symfony\Component\Security\Core\Authorization\AuthorizationCheckerInterface;
+
+/**
+ * This controller handles the back end preview call and redirects to the
+ * requested front end page while ensuring that the /preview.php entry point is
+ * used. When requested, the front end user gets authenticated.
+ *
+ * @Route(defaults={"_scope" = "backend"})
+ */
+class BackendPreviewController
+{
+    /**
+     * @var string
+     */
+    private $previewScript;
+
+    /**
+     * @var FrontendPreviewAuthenticator
+     */
+    private $previewAuthenticator;
+
+    /**
+     * @var EventDispatcherInterface
+     */
+    private $dispatcher;
+
+    /**
+     * @var RouterInterface
+     */
+    private $router;
+
+    /**
+     * @var AuthorizationCheckerInterface
+     */
+    private $authorizationChecker;
+
+    public function __construct(string $previewScript, FrontendPreviewAuthenticator $previewAuthenticator, EventDispatcherInterface $dispatcher, RouterInterface $router, AuthorizationCheckerInterface $authorizationChecker)
+    {
+        $this->previewScript = $previewScript;
+        $this->previewAuthenticator = $previewAuthenticator;
+        $this->dispatcher = $dispatcher;
+        $this->router = $router;
+        $this->authorizationChecker = $authorizationChecker;
+    }
+
+    /**
+     * @Route("/contao/preview", name="contao_backend_preview")
+     */
+    public function __invoke(Request $request): Response
+    {
+        if ($request->getScriptName() !== $this->previewScript) {
+            return new RedirectResponse($this->previewScript.$request->getRequestUri());
+        }
+
+        if (!$this->authorizationChecker->isGranted('ROLE_USER')) {
+            return new Response('Access denied', Response::HTTP_FORBIDDEN);
+        }
+
+        // Switch to a particular member (see contao/core#6546)
+        if (
+            ($frontendUser = $request->query->get('user'))
+            && !$this->previewAuthenticator->authenticateFrontendUser($frontendUser, false)
+        ) {
+            $this->previewAuthenticator->removeFrontendAuthentication();
+        }
+
+        $urlConvertEvent = new PreviewUrlConvertEvent($request);
+
+        $this->dispatcher->dispatch($urlConvertEvent);
+
+        if (null !== $targetUrl = $urlConvertEvent->getUrl()) {
+            return new RedirectResponse($targetUrl);
+        }
+
+        return new RedirectResponse($this->router->generate('contao_root', [], UrlGeneratorInterface::ABSOLUTE_URL));
+    }
+}