Datagrid can be draggable now

Author: henzigo

src/Component/Grid/Grid.php

@@ -67,6 +67,8 @@ class Grid
 
     protected ?string $orderingEntityClass = null;
 
+    protected ?string $dragAndDropOrderSourceColumnName = null;
+
     protected PaginationResult $paginationResults;
 
     /**
@@ -461,7 +463,7 @@ public function getGridParameters(array|string|null $removeParameters = []): arr
             }
         }
 
-        if ($this->getOrderSourceColumnName() !== null) {
+        if (!$this->isDragAndDrop() && $this->getOrderSourceColumnName() !== null) {
             $gridParameters['order'] = $this->getOrderSourceColumnNameWithDirection();
         }
 
@@ -512,8 +514,8 @@ protected function loadRows(): void
         $orderDirection = $this->orderDirection;
 
         if ($this->isDragAndDrop()) {
-            $orderSourceColumnName = null;
-            $orderDirection = DataSourceInterface::ORDER_DESC;
+            $orderSourceColumnName = $this->dragAndDropOrderSourceColumnName;
+            $orderDirection = DataSourceInterface::ORDER_ASC;
         }
 
         $this->paginationResults = $this->dataSource->getPaginatedRows(
@@ -567,9 +569,15 @@ public function getValueFromRowBySourceColumnName(array $row, string $sourceColu
         return $row[$sourceColumnName];
     }
 
-    public function enableDragAndDrop(string $entityClass): void
+    /**
+     * When drag-and-drop is enabled the listing is always ordered by $orderSourceColumnName ascending,
+     * regardless of any ordering coming from the request, so the persisted positions are never mixed up.
+     * Pass null when the ordering is already baked into the data source query builder (legacy grids).
+     */
+    public function enableDragAndDrop(string $entityClass, ?string $orderSourceColumnName = null): void
     {
         $this->orderingEntityClass = $entityClass;
+        $this->dragAndDropOrderSourceColumnName = $orderSourceColumnName;
     }
 
     public function enableMultipleDragAndDrop(): void

tests/Unit/Component/Grid/GridTest.php

@@ -337,6 +337,47 @@ public function testEnableDragAndDrop(): void
         $this->assertTrue($grid->isDragAndDrop());
     }
 
+    public function testDragAndDropIgnoresRequestOrderToPreventOrderByInjection(): void
+    {
+        $getParameters = [
+            Grid::GET_PARAMETER => [
+                'gridId' => [
+                    'order' => 'maliciousColumn',
+                ],
+            ],
+        ];
+
+        $request = new Request($getParameters);
+        $requestStack = new RequestStack();
+        $requestStack->push($request);
+
+        $twigStub = $this->createStub(Environment::class);
+        $routerStub = $this->createStub(Router::class);
+        $routeCsrfProtectorStub = $this->createStub(RouteCsrfProtector::class);
+        $dataSourceMock = $this->getMockBuilder(DataSourceInterface::class)->getMock();
+        $dataSourceMock->expects($this->once())->method('getPaginatedRows')
+            ->with(null, 1, 'position', DataSourceInterface::ORDER_ASC)
+            ->willReturn(new PaginationResult(1, 1, 0, []));
+        $accessCheckerStub = $this->createStub(AccessCheckerInterface::class);
+        $accessCheckerStub
+            ->method('canEdit')
+            ->willReturn(true);
+
+        $grid = new Grid(
+            'gridId',
+            SystemRole::ALL,
+            $dataSourceMock,
+            $requestStack,
+            $routerStub,
+            $routeCsrfProtectorStub,
+            $twigStub,
+            $accessCheckerStub,
+        );
+
+        $grid->enableDragAndDrop('Path\To\Entity\Class', 'position');
+        $grid->createView();
+    }
+
     public function testReorderColumns(): void
     {
         $request = new Request();