diff --git a/src/Autocomplete/src/Controller/EntityAutocompleteController.php b/src/Autocomplete/src/Controller/EntityAutocompleteController.php index e65cb6dad12..de3fc6a10dc 100644 --- a/src/Autocomplete/src/Controller/EntityAutocompleteController.php +++ b/src/Autocomplete/src/Controller/EntityAutocompleteController.php @@ -18,16 +18,20 @@ use Symfony\Component\Routing\Generator\UrlGeneratorInterface; use Symfony\UX\Autocomplete\AutocompleteResultsExecutor; use Symfony\UX\Autocomplete\AutocompleterRegistry; +use Symfony\UX\Autocomplete\Calculator\ChecksumCalculatorInterface; /** * @author Ryan Weaver */ final class EntityAutocompleteController { + public const EXTRA_OPTIONS = 'extra_options'; + public function __construct( private AutocompleterRegistry $autocompleteFieldRegistry, private AutocompleteResultsExecutor $autocompleteResultsExecutor, private UrlGeneratorInterface $urlGenerator, + private ChecksumCalculatorInterface $checksumCalculator, ) { } @@ -38,6 +42,11 @@ public function __invoke(string $alias, Request $request): Response throw new NotFoundHttpException(sprintf('No autocompleter found for "%s". Available autocompleters are: (%s)', $alias, implode(', ', $this->autocompleteFieldRegistry->getAutocompleterNames()))); } + $extraOptions = $this->getExtraOptions($request); + $autocompleter = $autocompleter->withOptions([ + 'extra_options' => $extraOptions, + ]); + $page = $request->query->getInt('page', 1); $nextPage = null; @@ -54,4 +63,26 @@ public function __invoke(string $alias, Request $request): Response 'next_page' => $nextPage, ]); } + + /** + * @return array + */ + private function getExtraOptions(Request $request): array + { + // TODO: This method should be refactored + if (!$request->query->has(self::EXTRA_OPTIONS)) { + return []; + } + + /** @var array $extraOptions */ + $extraOptions = json_decode(base64_decode($request->query->get(self::EXTRA_OPTIONS)), true); + $checksum = $extraOptions['@checksum'] ?? null; + unset($extraOptions['@checksum']); + + if ($checksum !== $this->checksumCalculator->calculateForArray($extraOptions)) { + throw new \InvalidArgumentException('The extra options have been tampered with.'); + } + + return $extraOptions; + } } diff --git a/src/Autocomplete/src/DependencyInjection/AutocompleteExtension.php b/src/Autocomplete/src/DependencyInjection/AutocompleteExtension.php index ea907f4be17..4d22f98c523 100644 --- a/src/Autocomplete/src/DependencyInjection/AutocompleteExtension.php +++ b/src/Autocomplete/src/DependencyInjection/AutocompleteExtension.php @@ -117,6 +117,7 @@ private function registerBasicServices(ContainerBuilder $container): void new Reference('ux.autocomplete.autocompleter_registry'), new Reference('ux.autocomplete.results_executor'), new Reference('router'), + new Reference('ux.autocomplete.checksum_calculator'), ]) ->addTag('controller.service_arguments') ;