Merge branch 'trunk'

app/Http/Middleware/XssSanitizer.php

@@ -18,7 +18,9 @@ class XssSanitizer
         $inputs = $request->all();
         array_walk_recursive($inputs, function (&$input, $name) use ($params) {
             if (in_array($name, $params)) {
+                // dd($input);
                 $input = clean($input);
+                // dd($input);
             } else {
                 $input = strip_tags($input);
             }

app/Providers/AppServiceProvider.php

@@ -40,7 +40,7 @@ class AppServiceProvider extends ServiceProvider
                 request()->getClientIp();
             }
         });
-        // LOCAL FORCE (eg: for Carbon)
+        // LOCAL FORCE eg: for Carbon
         setlocale(LC_ALL, \sprintf(
             '%s_%s.UTF-8',
             config('app.locale'),

composer.json

@@ -12,7 +12,7 @@
         "fruitcake/laravel-cors": "^2.0",
         "guzzlehttp/guzzle": "^7.0.1",
         "htmlmin/htmlmin": "^8.0",
-        "kwaadpepper/crud-policies": "^0.1.16",
+        "kwaadpepper/crud-policies": "^0.2.0",
         "kwaadpepper/enum": "^2.0",
         "kwaadpepper/exception-handler": "^0.0.1",
         "kwaadpepper/image-resizer": "^0.0.3",

config/crud-policies.php

@@ -9,6 +9,17 @@ return [
      */
     'urlPrefix' => 'crud-policies',
 
+    /**
+     * You shall protect routes
+     * These are applied to crud routes directly as middlewares
+     */
+    'middlewares' => [
+        \App\Http\Middleware\EncryptCookies::class,
+        \App\Http\Middleware\PreventRequestsDuringMaintenance::class,
+        \Illuminate\Session\Middleware\StartSession::class,
+        'auth:web'
+    ],
+
     /**
      * The public path where are stored
      * crud-policies asset files

config/purifier.php

@@ -25,24 +25,23 @@ return [
     'cacheFileMode' => 0755,
     'settings'      => [
         'default' => [
+            'HTML.SafeIframe'          => true, // For iframes
+            'URI.SafeIframeRegexp'     => "%^(http://|https://|//)(vimeo.com)%",
             'HTML.Doctype'             => 'HTML 4.01 Transitional',
-            'HTML.Allowed'             => 'div,b,strong,i,em,u,a[href|title],ul,ol,li,p[style],br,span[style],img[width|height|alt|src]',
-            'CSS.AllowedProperties'    => 'font,font-size,font-weight,font-style,font-family,text-decoration,padding-left,color,background-color,text-align',
+            'HTML.Allowed'             => 'h1[style],h2[style],h3[style],h4[style],h5[style],h6[style],figure[class|style],oembed[url],div[style],b,strong,i,em,u,a[href|title],ul[style],ol[style],dl[style],li,p[style],br,span[style|class],img[width|height|alt|src|style|class],iframe[src|width|height|class|frameborder|style],table[style],thead,tbody,th,tr,td,hr',
+            'CSS.AllowedProperties'    => 'font,font-size,font-weight,font-style,font-family,text-decoration,padding-left,color,background-color,text-align,list-style-type,float,width,height',
             'AutoFormat.AutoParagraph' => false,
-            'AutoFormat.RemoveEmpty'   => true,
-            'AutoFormat.RemoveEmpty.RemoveNbsp' => true,
-        ],
-        'test'    => [
-            'Attr.EnableID' => 'true',
+            'AutoFormat.RemoveEmpty'   => false,
+            'AutoFormat.RemoveEmpty.RemoveNbsp' => false,
         ],
         "youtube" => [
             "HTML.SafeIframe"      => 'true',
-            "URI.SafeIframeRegexp" => "%^(http://|https://|//)(www.youtube.com/embed/|player.vimeo.com/video/)%",
+            "URI.SafeIframeRegexp" => "%^(http://|https://|//)(www.youtube.com/embed/|player.vimeo.com/video/|vimeo.com/)%",
         ],
         'custom_definition' => [
             'id'  => 'html5-definitions',
             'rev' => 1,
-            'debug' => false,
+            'debug' => true,
             'elements' => [
                 // http://developers.whatwg.org/sections.html
                 ['section', 'Block', 'Flow', 'Common'],
@@ -59,6 +58,7 @@ return [
                 // http://developers.whatwg.org/grouping-content.html
                 ['figure', 'Block', 'Optional: (figcaption, Flow) | (Flow, figcaption) | Flow', 'Common'],
                 ['figcaption', 'Inline', 'Flow', 'Common'],
+                ['oembed', 'Inline', 'Flow', 'Common'],
 
                 // http://developers.whatwg.org/the-video-element.html#the-video-element
                 ['video', 'Block', 'Optional: (source, Flow) | (Flow, source) | Flow', 'Common', [
@@ -95,13 +95,24 @@ return [
                 ['tr', 'width', 'Text'],
                 ['tr', 'height', 'Text'],
                 ['tr', 'border', 'Text'],
+                ['figure', 'class', 'Text'],
+                ['figure', 'style', 'Text'],
+                ['oembed', 'url', 'Text'],
+                ['span', 'style', 'Text'],
+                ['img', 'style', 'Text'],
             ],
         ],
         'custom_attributes' => [
             ['a', 'target', 'Enum#_blank,_self,_target,_top'],
+            ['ol', 'style', 'Text'],
+            ['figure', 'style', 'Text'],
+            ['img', 'style', 'Text'],
+            ['span', 'style', 'Text'],
+            ['oembed', 'url', 'Text'],
         ],
         'custom_elements' => [
             ['u', 'Inline', 'Inline', 'Common'],
+            ['oembed', 'Inline', 'Inline', 'Common'],
         ],
     ],
 

resources/js/vuejs.js

@@ -22,8 +22,12 @@ vues.keys().map(key =>
 );
 const vuejsModules = [];
 
-document.getElementsByClassName('portsalaries-vuejs').forEach(element => {
-    vuejsModules.push(new __PORTSALARIEVue({
-        el: element
-    }));
-});
+let ptsVues = document.getElementsByClassName('portsalaries-vuejs')
+
+if (ptsVues.length) {
+    ptsVues.forEach(element => {
+        vuejsModules.push(new __PORTSALARIEVue({
+            el: element
+        }));
+    });
+}

resources/sass/back.scss

@@ -1,3 +1,9 @@
 @import "_import";
 
 @import "layouts/backend/top_nav";
+
+// ckeditor fix with to navbar
+.ck .ck-sticky-panel .ck-sticky-panel__content_sticky {
+    position: fixed !important;
+    top: 3.6rem !important;
+}

resources/views/front/flashes/show.blade.php

@@ -20,7 +20,9 @@
                             <h1 class="titleNormal">{{ $flash->title }}</h1>
                             <h1 class="date">{{ $flash->created_at->format('d/m/Y') }}</h1>
                         </div>
-                        <p class="container-news__article">{!! $flash->content !!}</p>
+                        <div class="container-news__article">
+                            <div class="ck-content">{!! clean($flash->content) !!}</div>
+                        </div>
                         <div class="btn-center">
                             <div class="btn-center-secondary"><a href="{{ route('fo.flash.index') }}">Retour</a> </div>
                         </div>
@@ -35,4 +37,4 @@
 
 </div>
 
-@endsection
+@endsection

resources/views/layouts/frontend.blade.php

@@ -3,6 +3,7 @@
     <head>
         @include('layouts.frontend.head')
         @stack('styles')
+        @crudPoliciesCSS()
     </head>
     <body>
         @include("layouts.frontend.header")