fix: Allow admin component to define acl_resource for added security

Author: jissereitsma

Controller/Adminhtml/Index/Html.php

@@ -48,20 +48,12 @@ public function __construct(
         private readonly ComponentRegistry $componentRegistry,
         private readonly MessageManager $messageManager,
         private readonly Validator $formKeyValidator,
-        private readonly RequestInterface $request,
         private readonly AuthorizationInterface $authorization,
     ) {
     }
 
     public function execute(): ResultInterface|ResponseInterface
     {
-        $aclResource = $this->request->getParam('acl_resource');
-        if (!empty($aclResource) && !$this->authorization->isAllowed($aclResource)) {
-            throw new AuthorizationException(
-                __('Access denied.')
-            );
-        }
-
         $data = $this->requestDataLoader->load();
         $this->requestDataLoader->mergeRequestParams();
         $layout = $this->layoutLoader->load($data['handles']);
@@ -70,6 +62,14 @@ public function execute(): ResultInterface|ResponseInterface
         $updates = $this->sortUpdates($updates);
 
         foreach ($updates as $update) {
+            if (isset($update['aclResource'])) {
+                if (!empty($aclResource) && !$this->authorization->isAllowed($update['aclResource'])) {
+                    throw new AuthorizationException(
+                        __('Access denied.')
+                    );
+                }
+            }
+
             try {
                 $this->repositoryDispatcher->dispatch(
                     $update['component'],

Util/ComponentUtil.php

@@ -4,6 +4,7 @@
 
 use Magento\Framework\App\Request\Http;
 use Magento\Framework\App\RequestInterface;
+use Magento\Framework\App\State;
 use Magento\Framework\Data\Form\FormKey as FormKeyModel;
 use Magento\Framework\UrlFactory;
 use Magento\Framework\View\Element\AbstractBlock;
@@ -17,7 +18,8 @@ public function __construct(
         private readonly RequestInterface $request,
         private readonly FormKeyModel $formKey,
         private readonly IdConvertor $idConvertor,
-        private readonly AjaxSignature $ajaxSignature
+        private readonly AjaxSignature $ajaxSignature,
+        private readonly State $appState
     ) {
     }
 
@@ -67,12 +69,19 @@ public function getRequestData(): array
         ];
     }
 
+    public function getComponentUpdateData(AbstractBlock $block): array
+    {
+        return [
+            'handles' => $this->getHandles($block),
+            'pageHandles' => $this->getPageHandles($block),
+            'request' => $this->getRequestData(),
+        ];
+    }
+
     public function getSignature(AbstractBlock $block): string
     {
         return $this->ajaxSignature->sign(
-            $this->getHandles($block),
-            $this->getPageHandles($block),
-            $this->getRequestData()
+            $this->getComponentUpdateData($block)
         );
     }
 

Util/Controller/RequestDataLoader.php

@@ -35,12 +35,13 @@ public function load(): array
 
     private function validateSignature(array $data): void
     {
-        $isValid = $this->ajaxSignature->verify(
-            (array)($data['handles'] ?? []),
-            (array)($data['pageHandles'] ?? []),
-            (array)($data['request'] ?? []),
-            (string)($data['signature'] ?? '')
-        );
+        $input = array_intersect_key($data, array_flip([
+            'handles',
+            'pageHandles',
+            'request'
+        ]));
+
+        $isValid = $this->ajaxSignature->verify($input, (string)($data['signature'] ?? ''));
 
         if (false === $isValid) {
             throw new RuntimeException('Payload was tampered with');

Util/Security/AjaxSignature.php

@@ -11,24 +11,24 @@ public function __construct(
     ) {
     }
 
-    public function sign(array $handles, array $pageHandles, array $request): string
+    public function sign(array $data): string
     {
         return hash_hmac(
             'sha256',
-            $this->buildPayload($handles, $pageHandles, $request),
+            $this->buildPayload($data),
             $this->getCryptKey()
         );
     }
 
-    public function verify(array $handles, array $pageHandles, array $request, string $signature): bool
+    public function verify(array $data, string $signature): bool
     {
-        $expectedSignature = $this->sign($handles, $pageHandles, $request);
+        $expectedSignature = $this->sign($data);
         return hash_equals($expectedSignature, $signature);
     }
 
-    private function buildPayload(array $handles, array $pageHandles, array $request): string
+    private function buildPayload(array $data): string
     {
-        return (string)json_encode([$handles, $pageHandles, $request], JSON_UNESCAPED_SLASHES);
+        return (string)json_encode($data, JSON_UNESCAPED_SLASHES);
     }
 
     private function getCryptKey(): string

view/base/templates/script/ajax-queue.phtml

@@ -169,18 +169,14 @@ if ($interval < 10) {
             };
         },
         buildBody(requests) {
+            const componentData = JSON.parse('<?= /* @noEscape */ json_encode(
+                $componentUtil->getComponentUpdateData($block)
+            ) ?>');
+
             return {
+                ...componentData,
                 updates: this.getUpdates(requests),
                 targets: this.getTargets(requests),
-                handles: <?= /* @noEscape */ json_encode(
-                    $componentUtil->getHandles($block)
-                ) ?>,
-                pageHandles: <?= /* @noEscape */ json_encode(
-                    $componentUtil->getPageHandles($block)
-                ) ?>,
-                request: <?= /* @noEscape */ json_encode(
-                    $componentUtil->getRequestData()
-                ) ?>,
                 signature: <?= /* @noEscape */ json_encode(
                     $componentUtil->getSignature($block)
                 ) ?>