Merge remote-tracking branch 'origin/10.5' into 10.6

# Conflicts:
#	doc/Development_Documentation/23_Installation_and_Upgrade/09_Upgrade_Notes/README.md

bundles/AdminBundle/Controller/Admin/TranslationController.php

@@ -396,7 +396,10 @@ public function translationsAction(Request $request, TranslatorInterface $transl
             } elseif ($request->get('xaction') == 'create') {
                 $t = Translation::getByKey($data['key'], $domain);
                 if ($t) {
-                    throw new \Exception($translator->trans('identifier_already_exists', [], $domain));
+                    return $this->adminJson([
+                        'message' => 'identifier_already_exists',
+                        'success' => false,
+                    ]);
                 }
 
                 $t = new Translation();

bundles/AdminBundle/Resources/public/js/pimcore/document/editables/areablock.js

@@ -691,38 +691,45 @@ pimcore.document.editables.areablock = Class.create(pimcore.document.area_abstra
     },
 
     getTypeMenu: function (scope, element, insertPosition) {
-        var menu = [];
-        var groupMenu;
-        var limits = this.config["limits"] || {};
-
-        if(typeof this.config.group != "undefined") {
-            var groups = Object.keys(this.config.group);
-            for (var g=0; g<groups.length; g++) {
-                if(groups[g].length > 0) {
-                    groupMenu = {
+        const menu = [];
+        const limits = this.config["limits"] || {};
+
+        if (typeof this.config.group != "undefined") {
+            const groups = Object.keys(this.config.group);
+            const maxHeight = Ext.getBody().getViewSize().height;
+            for (let g = 0; g < groups.length; g++) {
+                if (groups[g].length > 0) {
+                    let groupMenu = {
                         text: t(groups[g]),
                         iconCls: "pimcore_icon_area",
                         hideOnClick: false,
-                        menu: []
+                        menu: {
+                            xtype: 'menu',
+                            items: []
+                        }
                     };
 
-                    for (var i=0; i<this.config.types.length; i++) {
-                        if(in_array(this.config.types[i].type,this.config.group[groups[g]])) {
+                    for (let i = 0; i < this.config.types.length; i++) {
+                        if (in_array(this.config.types[i].type,this.config.group[groups[g]])) {
                             let type = this.config.types[i].type;
                             if (typeof limits[type] == "undefined" ||
                                 typeof this.brickTypeUsageCounter[type] == "undefined" || this.brickTypeUsageCounter[type] < limits[type]) {
-                                    groupMenu.menu.push(this.getMenuConfigForBrick(this.config.types[i], scope, element, insertPosition));
+                                    groupMenu.menu.items.push(this.getMenuConfigForBrick(this.config.types[i], scope, element, insertPosition));
                             }
                         }
                     }
-                    if(groupMenu.menu.length) {
+                    if (groupMenu.menu.items.length) {
+                        // One item has a height of 32px
+                        if (groupMenu.menu.items.length * 32 > maxHeight) {
+                            groupMenu.menu.height = maxHeight;
+                        }
                         menu.push(groupMenu);
                     }
                 }
             }
         } else {
-            for (var i=0; i<this.config.types.length; i++) {
-                let type = this.config.types[i].type;
+            for (let i = 0; i < this.config.types.length; i++) {
+                const type = this.config.types[i].type;
                 if (typeof limits[type] == "undefined" ||
                     typeof this.brickTypeUsageCounter[type] == "undefined" || this.brickTypeUsageCounter[type] < limits[type]) {
                     menu.push(this.getMenuConfigForBrick(this.config.types[i], scope, element, insertPosition));

bundles/AdminBundle/Resources/public/js/pimcore/object/helpers/gridConfigDialog.js

@@ -217,10 +217,11 @@ pimcore.object.helpers.gridConfigDialog = Class.create(pimcore.element.helpers.g
                     child = child[0];
 
                 } else {
-                    var text = t(nodeConf.label);
+                    let text = t(nodeConf.label);
 
-                    if (nodeConf.dataType !== "system" && this.showFieldname && nodeConf.key) {
-                        text = text + " (" + nodeConf.key.replace("~", ".") + ")";
+                    const keyText = ` (${nodeConf.key.replace("~", ".")})`;
+                    if (nodeConf.dataType !== "system" && this.showFieldname && nodeConf.key && !text.includes(keyText)) {
+                        text = text + keyText;
                     }
 
                     var child = {

bundles/AdminBundle/Resources/public/js/pimcore/settings/metadata/predefined.js

@@ -84,8 +84,8 @@ pimcore.settings.metadata.predefined = Class.create({
         this.store.getProxy().getReader().setMessageProperty('message');
         this.store.getProxy().on('exception', function (proxy, response, operation) {
             pimcore.helpers.showNotification(t("error"), t(operation.getError()), "error");
-            store.load();
-        });
+            this.store.load();
+        }.bind(this));
 
         this.store.addListener('exception', function(proxy, mode, action, options, response) {
             Ext.Msg.show({

bundles/AdminBundle/Resources/public/js/pimcore/settings/translation.js

@@ -339,11 +339,11 @@ pimcore.settings.translation.domain = Class.create({
 
         var store = this.store;
 
+        this.store.getProxy().getReader().setMessageProperty('message');
         this.store.getProxy().on('exception', function (proxy, request, operation) {
-            operation.config.records.forEach(function (item) {
-                store.remove(item);
-            });
-        });
+            pimcore.helpers.showNotification(t("error"), t(operation.getError()), "error");
+            this.store.load();
+        }.bind(this));
 
         let proxy = store.getProxy();
         proxy.extraParams["domain"] = this.domain;
@@ -616,7 +616,7 @@ pimcore.settings.translation.domain = Class.create({
         }
 
         if(value) {
-            let html = /<([A-Za-z][A-Za-z0-9]*)\b[^>]*>(.*?)<\/\1>/.test(value);
+            let html = /<\/?[a-z][\s\S]*>/i.test(value);
             let plain = value.match(/\n/gm)
 
             if (html || plain) {

doc/Development_Documentation/03_Documents/02_Document_Types/15_Print_Documents.md

@@ -58,6 +58,20 @@ Depending on the renderer, there might be settings possible for the rendering pr
 The provided settings might be extended in future. 
 For details of settings please see section below or renderer documentation.
 
+### Sandbox Restrictions
+Print document renders user controlled twig templates in a sandbox with restrictive
+security policies for tags, filters & functions. Please use following configuration to allow more in template rendering:
+
+```yaml
+    pimcore:
+          templating_engine:
+              twig:
+                sandbox_security_policy:
+                  tags: ['if']
+                  filters: ['upper']
+                  functions: ['include', 'path']
+```
+
 ## Special PDFreactor Settings
 
 **Printermarks**: With PDFreactor there comes a out-of-the-box feature to add printermarks to the PDF. 
@@ -113,4 +127,3 @@ There are two possible workflows for images:
 2) Keep RGB style PNG/Jpeg images in the CMYK PDF files and let the printing house take care of converting them to the correct colorspace.
 
 Option 2) is preferred, as colorspace conversions are tricky and error-prone due to tightly coupled printer hardware dependencies.
-

doc/Development_Documentation/23_Installation_and_Upgrade/09_Upgrade_Notes/README.md

@@ -11,6 +11,9 @@
 - [ClassSavedInterface] Introduced additional interface implementing the `classSaved` method. The interface will be used by field definitions in `Pimcore\Model\DataObject\ClassDefinition\Data\*`. If your custom field definition implements the `classSaved` method, please use the `ClassSavedInterface` interface. Make sure that you either provide a default value (e.g. `$params = []`) for `$params` or don't use a second parameter in the method signature at all. Note that using the `classSaved` method without implementing the interface is deprecated and won't work in Pimcore 11. 
 
 
+## 10.5.13
+- [Web2Print] Print document twig expressions are now executed in a sandbox with restrictive security policies (just like Sending mails and Dataobject Text Layouts introduced in 10.5.9).
+
 ## 10.5.10
 - [DataObject] Deprecated: Loading non-Concrete objects with the Concrete class will not be possible in Pimcore 11.
 

lib/Event/DocumentEvents.php

@@ -167,6 +167,10 @@ final class DocumentEvents
      *  - reactorConfig | configuration which is passed to PDFReactor
      *  - document | Pimcore document that is converted
      *
+     * HeadlessChrome:
+     *  - params | puppeteer PDF options (see also https://pptr.dev/api/puppeteer.pdfoptions/)
+     *  - html | HTML passed to puppeteer
+     *
      * @Event("Pimcore\Event\Model\PrintConfigEvent")
      *
      * @var string

lib/Translation/ImporterService/Importer/DocumentImporter.php

@@ -26,6 +26,10 @@ class DocumentImporter extends AbstractElementImporter
      */
     protected function importAttribute(Element\ElementInterface $element, string $targetLanguage, Attribute $attribute)
     {
+        if ($targetLanguage != $element->getProperty('language')) {
+            return;
+        }
+
         parent::importAttribute($element, $targetLanguage, $attribute);
 
         if ($attribute->getType() === Attribute::TYPE_TAG && $element instanceof Document\PageSnippet) {

lib/Web2Print/Processor.php

@@ -30,6 +30,7 @@
 use Pimcore\Web2Print\Processor\WkHtmlToPdf;
 use Symfony\Component\Lock\LockFactory;
 use Symfony\Component\Lock\LockInterface;
+use Twig\Sandbox\SecurityError;
 
 abstract class Processor
 {
@@ -286,11 +287,20 @@ protected function processHtml($html, $params)
     {
         $document = $params['document'] ?? null;
         $hostUrl = $params['hostUrl'] ?? null;
-
         $templatingEngine = \Pimcore::getContainer()->get('pimcore.templating.engine.delegating');
-        $twig = $templatingEngine->getTwigEnvironment();
-        $template = $twig->createTemplate((string) $html);
-        $html = $twig->render($template, $params);
+
+        try {
+            $twig = $templatingEngine->getTwigEnvironment(true);
+            $template = $twig->createTemplate((string) $html);
+
+            $html = $twig->render($template, $params);
+        } catch (SecurityError $e) {
+            Logger::err((string) $e);
+
+            throw new \Exception(sprintf('Failed rendering the print template: %s. Please check your twig sandbox security policy or contact the administrator.', $e->getMessage()));
+        } finally {
+            $templatingEngine->disableSandboxExtensionFromTwigEnvironment();
+        }
 
         return Mail::setAbsolutePaths($html, $document, $hostUrl);
     }

lib/Web2Print/Processor/HeadlessChrome.php

@@ -91,6 +91,16 @@ public function getProcessingOptions()
     public function getPdfFromString($html, $params = [], $returnFilePath = false)
     {
         $params = $params ?: $this->getDefaultOptions();
+
+        $event = new PrintConfigEvent($this, [
+            'params' => $params,
+            'html' => $html,
+        ]);
+
+        \Pimcore::getEventDispatcher()->dispatch($event, DocumentEvents::PRINT_MODIFY_PROCESSING_CONFIG);
+
+        ['html' => $html, 'params' => $params] = $event->getArguments();
+
         $input = new StringInput();
         $input->setHtml($html);
 

models/DataObject/ClassDefinition/Data/BooleanSelect.php

@@ -463,17 +463,6 @@ public function getDataFromEditmode($data, $object = null, $params = [])
         return null;
     }
 
-    /**
-     * @param mixed $oldValue
-     * @param mixed $newValue
-     *
-     * @return bool
-     */
-    public function isEqual($oldValue, $newValue): bool
-    {
-        return $oldValue === $newValue;
-    }
-
     /**
      * {@inheritdoc}
      */

models/DataObject/ClassDefinition/Data/Select.php

@@ -633,4 +633,15 @@ public function getPhpdocReturnType(): ?string
     {
         return 'string|null';
     }
+
+    /**
+     * @param mixed $oldValue
+     * @param mixed $newValue
+     *
+     * @return bool
+     */
+    public function isEqual($oldValue, $newValue): bool
+    {
+        return $oldValue == $newValue;
+    }
 }

models/DataObject/Traits/ObjectVarTrait.php

@@ -44,13 +44,13 @@ public function getObjectVars()
     }
 
     /**
-     * @param string $var
+     * @param string|null $var
      *
      * @return mixed
      */
     public function getObjectVar($var)
     {
-        if (!property_exists($this, $var)) {
+        if (!$var || !property_exists($this, $var)) {
             return null;
         }
 

models/DataObject/Traits/SimpleComparisonTrait.php

@@ -28,7 +28,7 @@ trait SimpleComparisonTrait
      */
     public function isEqual($oldValue, $newValue): bool
     {
-        return $oldValue == $newValue;
+        return $oldValue === $newValue;
     }
 
     /**

models/Element/Service.php

@@ -1114,6 +1114,8 @@ public static function getValidKey($key, $type)
 
         // replace all 4 byte unicode characters
         $key = preg_replace('/[\x{10000}-\x{10FFFF}]/u', '-', $key);
+        // replace left to right marker characters ( lrm )
+        $key = preg_replace('/(\x{200e}|\x{200f})/u', '-', $key);
         // replace slashes with a hyphen
         $key = str_replace('/', '-', $key);
 

tests/_support/Helper/DataType/TestDataHelper.php

@@ -21,6 +21,7 @@
 use Pimcore\Model\Asset;
 use Pimcore\Model\DataObject;
 use Pimcore\Model\DataObject\AbstractObject;
+use Pimcore\Model\DataObject\ClassDefinition\Data;
 use Pimcore\Model\DataObject\Concrete;
 use Pimcore\Model\Document;
 use Pimcore\Model\Element\ElementInterface;
@@ -105,6 +106,20 @@ public function assertCountry(Concrete $object, $field, $seed = 1)
         $this->assertEquals($expected, $value);
     }
 
+    public function getFieldDefinition(Concrete $object, string $field): ?Data
+    {
+        $cd = $object->getClass();
+        $fd = $cd->getFieldDefinition($field);
+        if (!$fd) {
+            $localizedFields = $cd->getFieldDefinition('localizedfields');
+            if ($localizedFields instanceof DataObject\ClassDefinition\Data\Localizedfields) {
+                $fd = $localizedFields->getFieldDefinition($field);
+            }
+        }
+
+        return $fd;
+    }
+
     /**
      * @param Concrete $object
      * @param string $field
@@ -114,12 +129,20 @@ public function assertCountry(Concrete $object, $field, $seed = 1)
      */
     public function assertIsEqual($object, $field, $expected, $value)
     {
-        $fd = $object->getClass()->getFieldDefinition($field);
+        $fd = $this->getFieldDefinition($object, $field);
         if ($fd instanceof DataObject\ClassDefinition\Data\EqualComparisonInterface) {
             $this->assertTrue($fd->isEqual($expected, $value), sprintf('Expected isEqual() returns true for data type: %s', ucfirst($field)));
         }
     }
 
+    public function assertIsNotEqual(Concrete $object, string $field, mixed $expected, mixed $value): void
+    {
+        $fd = $this->getFieldDefinition($object, $field);
+        if ($fd instanceof DataObject\ClassDefinition\Data\EqualComparisonInterface) {
+            $this->assertFalse($fd->isEqual($expected, $value), sprintf('Expected isEqual() returns false for data type: %s', ucfirst($field)));
+        }
+    }
+
     /**
      * @param Concrete $object
      * @param string $field

tests/_support/Test/DataType/AbstractDataTypeTestCase.php

@@ -631,6 +631,19 @@ public function testLocalizedObjects()
         $this->testDataHelper->assertObjects($this->testObject, 'lobjects', $this->seed, 'de');
     }
 
+    public function testLocalizedInputNumberAsString()
+    {
+        $this->createTestObject();
+        $this->testObject->setLinput('0001', 'en');
+        $this->testObject->setLinput('0.1000', 'de');
+        $this->testObject->save();
+
+        $expectedEN = $this->testObject->getLinput('en');
+        $expectedDE = $this->testObject->getLinput('de');
+        $this->testDataHelper->assertIsNotEqual($this->testObject, 'linput', $expectedEN, '000001');
+        $this->testDataHelper->assertIsNotEqual($this->testObject, 'linput', $expectedDE, '0.100000');
+    }
+
     public function testLocalizedUrlSlug()
     {
         $this->createTestObject([