Skip to content

Add Inline Form Key Updater to Page Cache | Fix Issue #13746 #27647

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
wants to merge 5 commits into from
Closed

Add Inline Form Key Updater to Page Cache | Fix Issue #13746 #27647

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
f0f1869
Register the Inline Form Key Updater Plugin
nicolasddev Apr 8, 2020
69ccbb8
Add the InlineFormKeyUpdater Plugin Class
nicolasddev Apr 8, 2020
d82e8d0
Insert a block for the form key provider template
nicolasddev Apr 8, 2020
500f52b
Add a pure JavaScript form key provider
nicolasddev Apr 8, 2020
9951677
Merge branch '2.4-develop' into patch-1
ihor-sviziev Sep 4, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
25 changes: 25 additions & 0 deletions app/code/Magento/PageCache/Plugin/Framework/View/Element/InlineFormKeyUpdater.php
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,25 @@
<?php
/**
*
* Copyright © Magento, Inc. All rights reserved.
* See COPYING.txt for license details.
*/

namespace Magento\PageCache\Plugin\Framework\View\Element;


class InlineFormKeyUpdater
{
public function afterToHtml(\Magento\Framework\View\Element\FormKey $subject, $result)
{
return $result.$this->getInlineJavaScript();
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Seems like this shouldn't happen in case if FPC is disabled. Am I correct?

}

private function getInlineJavaScript()
{
$uniqueId = uniqid();

return '<script id="'.$uniqueId.'">document.getElementById("'.$uniqueId.'").previousSibling.value = formKey;</script>';
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

As Magento introduced CSP, we need to replace this code with something like this:

magento2/app/code/Magento/Theme/view/frontend/templates/page/js/require_js.phtml

Line 15 in 89d3cda

echo /* @noEscape */ $secureRenderer->renderTag('script', [], $scriptString, false);

}
}
?>
3 changes: 3 additions & 0 deletions app/code/Magento/PageCache/etc/di.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -44,6 +44,9 @@
</argument>
</arguments>
</type>
<type name="Magento\Framework\View\Element\FormKey">
<plugin name="page_cache_inline_form_key_updater" type="Magento\PageCache\Plugin\Framework\View\Element\InlineFormKeyUpdater" sortOrder="1" disabled="false" />
</type>
<preference for="Magento\PageCache\Model\VclGeneratorInterface" type="Magento\PageCache\Model\Varnish\VclGenerator"/>
<preference for="Magento\PageCache\Model\VclTemplateLocatorInterface" type="Magento\PageCache\Model\Varnish\VclTemplateLocator"/>
<preference for="Magento\PageCache\Model\Spi\PageCacheTagsPreprocessorInterface" type="Magento\PageCache\Model\PageCacheTagsPreprocessorComposite"/>
Expand Down
7 changes: 7 additions & 0 deletions app/code/Magento/PageCache/view/frontend/layout/default.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,6 +10,13 @@
<referenceBlock name="head.components">
<block class="Magento\Framework\View\Element\Js\Components" name="pagecache_page_head_components" template="Magento_PageCache::js/components.phtml"/>
</referenceBlock>
<referenceBlock name="head.additional">
<block class="Magento\Framework\View\Element\Template" name="inline.form.key.provider">
<arguments>
<argument name="template" xsi:type="string">Magento_PageCache::inline_form_key_provider.phtml</argument>
</arguments>
</block>
</referenceBlock>
<referenceContainer name="content">
<block class="Magento\PageCache\Block\Javascript" template="Magento_PageCache::javascript.phtml" name="pageCache" as="pageCache"/>
</referenceContainer>
Expand Down
21 changes: 21 additions & 0 deletions app/code/Magento/PageCache/view/frontend/templates/inline_form_key_provider.phtml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,21 @@

<?php
/**
* Copyright © Magento, Inc. All rights reserved.
* See COPYING.txt for license details.
*/

/** @var \Magento\Framework\View\Element\Template $block */
?>
<script>
var formKey = (function () {

var value = "; " + document.cookie;
var parts = value.split("; " + 'form_key' + "=");

if (parts.length == 2) {
return parts.pop().split(";").shift();
}

})();
</script>
Comment on lines +10 to +21
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

  1. As Magento introduced CSP - we need to use something like this:

    magento2/app/code/Magento/Theme/view/frontend/templates/page/js/require_js.phtml

    Line 15 in 89d3cda

    echo /* @noEscape */ $secureRenderer->renderTag('script', [], $scriptString, false);

  2. Seems like case with missing form_key cookie isn't covered here

    magento2/app/code/Magento/PageCache/view/frontend/web/js/page-cache.js

    Lines 120 to 123 in 9544fb2

    if (!formKey) {
    formKey = generateRandomString(this.options.allowedCharacters, this.options.length);
    $.mage.cookies.set('form_key', formKey, options);
    }

  3. I think we need to remove following code as we basically replacing it with inline implementation

    magento2/app/code/Magento/PageCache/view/frontend/web/js/page-cache.js

    Lines 300 to 303 in 9544fb2

    domReady(function () {
    $('body')
    .formKey();
    });