Skip to content

moqui / moqui-mjml

Go to a project
Toggle navigation
Toggle navigation pinning
600190dc by acetousk
Options

Fix load#GrapeJs service, and improve authz check for resource facade

1 parent f5e625a1
Inline Side-by-side
Showing 2 changed files with 13 additions and 10 deletions
...@@ -179,9 +179,11 @@ along with this software (see the LICENSE.md file). If not, see ...@@ -179,9 +179,11 @@ along with this software (see the LICENSE.md file). If not, see
179 response = JSON.parse(request.responseText); 179 response = JSON.parse(request.responseText);
180 } 180 }
181 // console.log('response ', response) 181 // console.log('response ', response)
182 window.resourceId = response.resourceId; 182 window.htmlLocation = response.htmlLocation;
183 window.grapesLocation = response.grapesLocation;
183 const url = new URL(window.location.href) 184 const url = new URL(window.location.href)
184 url.searchParams.set('resourceId', window.resourceId); 185 url.searchParams.set('htmlLocation', response.htmlLocation);
186 url.searchParams.set('grapesLocation', response.grapesLocation);
185 window.history.pushState({}, '', url) 187 window.history.pushState({}, '', url)
186 188
187 const projectData = JSON.parse(response.data); 189 const projectData = JSON.parse(response.data);
......
...@@ -48,19 +48,19 @@ along with this software (see the LICENSE.md file). If not, see ...@@ -48,19 +48,19 @@ along with this software (see the LICENSE.md file). If not, see
48 </if> 48 </if>
49 49
50 <set field="grapesJsResource" from="ec.resource.getLocationReference('dbresource://grapesjs/project')"/> 50 <set field="grapesJsResource" from="ec.resource.getLocationReference('dbresource://grapesjs/project')"/>
51 <if condition="!grapesLocation &amp;&amp; htmlLocation"> 51 <if condition="!grapesLocation &amp;&amp; !htmlLocation">
52 <then> 52 <then>
53 <set field="htmlFile" from="project.makeFile(java.util.UUID.randomUUID().toString()+'.html')"/> 53 <set field="htmlFile" from="grapesJsResource.makeFile(java.util.UUID.randomUUID().toString()+'.html')"/>
54 <set field="grapesFile" from="project.makeFile(java.util.UUID.randomUUID().toString()+'.json')"/> 54 <set field="grapesFile" from="grapesJsResource.makeFile(java.util.UUID.randomUUID().toString()+'.json')"/>
55 55
56 <set field="data" from="ec.resource.getLocationReference('dbresource://grapesjs/template/default.json').getText()"/> 56 <set field="data" from="ec.resource.getLocationReference('dbresource://grapesjs/template/default.json').getText()"/>
57 <set field="htmlLocation" from="grapesJsResource.location + '/' + htmlFile?.dbResourceId + '.html'"/>
58 <set field="grapesLocation" from="grapesJsResource.location + '/' + grapesFile?.dbResourceId + '.json'"/>
57 <script><![CDATA[ 59 <script><![CDATA[
58 htmlFile.move(project.location + "/" + htmlFile.dbResourceId + ".html") 60 htmlFile.move(htmlLocation)
59 grapesFile.putText(data) 61 grapesFile.putText(data)
60 grapesFile.move(project.location + "/" + grapesFile.dbResourceId + ".json") 62 grapesFile.move(grapesLocation)
61 ]]></script> 63 ]]></script>
62 <set field="htmlLocation" from="htmlFile.location"/>
63 <set field="grapesLocation" from="grapesFile.location"/>
64 64
65 <if condition="emailTemplateId"> 65 <if condition="emailTemplateId">
66 <service-call name="update#moqui.basic.email.EmailTemplate" in-map="[emailTemplateId:emailTemplateId,grapesLocation:grapesLocation,htmlLocation:htmlLocation]"/> 66 <service-call name="update#moqui.basic.email.EmailTemplate" in-map="[emailTemplateId:emailTemplateId,grapesLocation:grapesLocation,htmlLocation:htmlLocation]"/>
...@@ -68,7 +68,8 @@ along with this software (see the LICENSE.md file). If not, see ...@@ -68,7 +68,8 @@ along with this software (see the LICENSE.md file). If not, see
68 </then> 68 </then>
69 <else> 69 <else>
70 <set field="putDbResource" from="ec.resource.getLocationReference(grapesLocation)"/> 70 <set field="putDbResource" from="ec.resource.getLocationReference(grapesLocation)"/>
71 <if condition="!putDbResource || putDbResource.parent?.dbResourceId != grapesJsResource.dbResourceId"> 71 <!-- TODO: Is this a strong enough check to prevent unauthorized access? -->
72 <if condition="!putDbResource || putDbResource.parent?.location != grapesJsResource.location">
72 <return error="true" message="Resource not found"/> 73 <return error="true" message="Resource not found"/>
73 </if> 74 </if>
74 75
......