Allow to disable encryption of params

Author: arrilot

README.md

@@ -214,9 +214,12 @@ In some situations it can be very beneficial to load widget content with AJAX.
 Fortunately, this can be achieved very easily!
 All you need to do is to change facade or blade directive - `Widget::` => `AsyncWidget::`, `@widget` => `@asyncWidget`
 
-> Note: Widget params are encrypted and sent via ajax call. Expect them to be json_encoded and json_decoded afterwards.
+Widget params are encrypted (by default) and sent via ajax call under the hood. So expect them to be `json_encoded()` and `json_decoded()` afterwards.
 
-> Note: Since version 3.1 you no longer need `jquery` to make ajax calls. However you can set `use_jquery_for_ajax_calls` to `true` in the config file if you want to.
+> Note: You can turn encryption off for a given widget by setting `public $encryptParams = false;` on it. However, this action makes widget params publicly accessible, so please make sure you do not leave any vulnerabilities.
+For example, if you pass something like user_id through widget params and turn encryption off, you do need to add one more access check inside the widget.
+
+> Note: You can set `use_jquery_for_ajax_calls` to `true` in the config file to use it for ajax calls if you want to.
 
 By default nothing is shown until ajax call is finished.
 

src/AbstractWidget.php

@@ -20,6 +20,14 @@ abstract class AbstractWidget
      */
     public $cacheTime = false;
 
+    /**
+     * Should widget params be encrypted before sending them to /arrilot/load-widget?
+     * Turning encryption off can help with making custom reloads from javascript, but makes widget params publicly accessible.
+     *
+     * @var bool
+     */
+    public $encryptParams = true;
+
     /**
      * The configuration array.
      *

src/Controllers/WidgetController.php

@@ -22,9 +22,14 @@ public function showWidget(Request $request)
 
         $factory = app()->make('arrilot.widget');
         $widgetName = $request->input('name', '');
-        $widgetParams = $factory->decryptWidgetParams($request->input('params', ''));
 
-        return call_user_func_array([$factory, $widgetName], $widgetParams);
+        $widgetParams = $request->input('skip_encryption', '')
+            ? $request->input('params', '')
+            : $factory->decryptWidgetParams($request->input('params', ''));
+
+        $decodedParams = json_decode($widgetParams, true);
+
+        return call_user_func_array([$factory, $widgetName], $decodedParams ?: []);
     }
 
     /**
@@ -36,5 +41,8 @@ protected function prepareGlobals(Request $request)
     {
         WidgetId::set($request->input('id', 1) - 1);
         AbstractWidgetFactory::$skipWidgetContainer = true;
+        if ($request->input('skip_encryption', '')) {
+            AbstractWidgetFactory::$allowOnlyWidgetsWithDisabledEncryption = true;
+        }
     }
 }

src/Factories/AbstractWidgetFactory.php

@@ -4,6 +4,7 @@
 
 use Arrilot\Widgets\AbstractWidget;
 use Arrilot\Widgets\Contracts\ApplicationWrapperContract;
+use Arrilot\Widgets\Misc\EncryptException;
 use Arrilot\Widgets\Misc\InvalidWidgetClassException;
 use Arrilot\Widgets\Misc\ViewExpressionTrait;
 use Arrilot\Widgets\WidgetId;
@@ -68,6 +69,13 @@ abstract class AbstractWidgetFactory
      */
     public static $skipWidgetContainer = false;
 
+    /**
+     * The flag for not wrapping content in a special container.
+     *
+     * @var bool
+     */
+    public static $allowOnlyWidgetsWithDisabledEncryption = false;
+
     /**
      * Constructor.
      *
@@ -101,6 +109,7 @@ public function __call($widgetName, array $params = [])
      * @param $params
      *
      * @throws InvalidWidgetClassException
+     * @throws EncryptException
      */
     protected function instantiateWidget(array $params = [])
     {
@@ -117,10 +126,14 @@ protected function instantiateWidget(array $params = [])
         $widgetClass = class_exists($fqcn) ? $fqcn : $this->widgetName;
 
         if (!is_subclass_of($widgetClass, 'Arrilot\Widgets\AbstractWidget')) {
-            throw new InvalidWidgetClassException('Class "'.$widgetClass.'" must extend "Arrilot\Widgets\AbstractWidget" class');
+            throw new InvalidWidgetClassException('Class "'.$widgetClass.'" must exist and extend "Arrilot\Widgets\AbstractWidget" class');
         }
 
         $this->widget = new $widgetClass($this->widgetConfig);
+
+        if (static::$allowOnlyWidgetsWithDisabledEncryption && $this->widget->encryptParams) {
+            throw new EncryptException('Widget "'.$widgetClass.'" was not called properly');
+        }
     }
 
     /**
@@ -159,26 +172,24 @@ protected function wrapContentInContainer($content)
     /**
      * Encrypt widget params to be transported via HTTP.
      *
-     * @param array $params
+     * @param string $params
      *
      * @return string
      */
     public function encryptWidgetParams($params)
     {
-        return $this->app->make('encrypter')->encrypt(json_encode($params));
+        return $this->app->make('encrypter')->encrypt($params);
     }
 
     /**
      * Decrypt widget params that were transported via HTTP.
      *
      * @param string $params
      *
-     * @return array
+     * @return string
      */
     public function decryptWidgetParams($params)
     {
-        $params = json_decode($this->app->make('encrypter')->decrypt($params), true);
-
-        return $params ? $params : [];
+        return $this->app->make('encrypter')->decrypt($params);
     }
 }

src/Factories/AsyncWidgetFactory.php

@@ -14,7 +14,7 @@ public function run()
         $this->instantiateWidget(func_get_args());
 
         $placeholder = call_user_func([$this->widget, 'placeholder']);
-        $loader = $this->javascriptFactory->getLoader();
+        $loader = $this->javascriptFactory->getLoader($this->widget->encryptParams);
         $content = $this->wrapContentInContainer($placeholder.$loader);
 
         return $this->convertToViewExpression($content);

src/Factories/JavascriptFactory.php

@@ -31,31 +31,34 @@ public function __construct(AbstractWidgetFactory $widgetFactory)
     /**
      * Construct javascript code to load the widget.
      *
+     * @param bool $encryptParams
+     *
      * @return string
      */
-    public function getLoader()
+    public function getLoader($encryptParams = true)
     {
         return
             '<script type="text/javascript">'.
-                $this->constructAjaxCall().
+                $this->constructAjaxCall($encryptParams).
             '</script>';
     }
 
     /**
      * Construct javascript code to reload the widget.
      *
      * @param float|int $timeout
+     * @param bool $encryptParams
      *
      * @return string
      */
-    public function getReloader($timeout)
+    public function getReloader($timeout, $encryptParams = true)
     {
         $timeout = $timeout * 1000;
 
         return
             '<script type="text/javascript">'.
                 'setTimeout( function() {'.
-                    $this->constructAjaxCall().
+                    $this->constructAjaxCall($encryptParams).
                 '}, '.$timeout.')'.
             '</script>';
     }
@@ -83,15 +86,21 @@ protected function useJquery()
     /**
      * Construct ajax call for loaders.
      *
+     * @param bool $encryptParams
+     *
      * @return string
      */
-    protected function constructAjaxCall()
+    protected function constructAjaxCall($encryptParams = true)
     {
+        $encodedParams = json_encode($this->widgetFactory->widgetFullParams);
         $queryParams = [
             'id'     => WidgetId::get(),
             'name'   => $this->widgetFactory->widgetName,
-            'params' => $this->widgetFactory->encryptWidgetParams($this->widgetFactory->widgetFullParams),
+            'params' => $encryptParams ? $this->widgetFactory->encryptWidgetParams($encodedParams) : $encodedParams,
         ];
+        if (!$encryptParams) {
+            $queryParams['skip_encryption'] = 1;
+        }
 
         $url = $this->ajaxLink.'?'.http_build_query($queryParams);
 

src/Factories/WidgetFactory.php

@@ -17,7 +17,7 @@ public function run()
         $content = $this->getContentFromCache($args);
 
         if ($timeout = (float) $this->getReloadTimeout()) {
-            $content .= $this->javascriptFactory->getReloader($timeout);
+            $content .= $this->javascriptFactory->getReloader($timeout, $this->widget->encryptParams);
             $content = $this->wrapContentInContainer($content);
         }
 

src/Misc/EncryptException.php

@@ -0,0 +1,10 @@
+<?php
+
+namespace Arrilot\Widgets\Misc;
+
+use Exception;
+
+class EncryptException extends Exception
+{
+
+}