?.base`. On every
* shell request, admin2.php substitutes that placeholder in the served
* HTML and injects a `` anywhere in this JSON closes the block
// early and everything after it is parsed as page markup. Branding title
// and subtitle are operator-supplied free text, so without escaping the
// angle brackets a value of `
` breaks out
// and executes on the pre-auth login page.
//
// Escaping the TAGS rather than relying on JSON_UNESCAPED_SLASHES being
// absent is deliberate: the `\/` form only protects the closing tag by
// accident, so anyone re-adding JSON_UNESCAPED_SLASHES for URL
// readability would silently reopen the hole. Here the slashes stay
// readable and the brackets are neutralised directly, which is the part
// that actually matters. The escapes decode back to the identical string,
// so the SPA still sees exactly what the operator typed.
$config = json_encode($config, JSON_UNESCAPED_SLASHES | JSON_HEX_TAG | JSON_HEX_AMP);
$configScript = "";
$html = str_replace('', '' . "\n " . $configScript, $html);
header('Content-Type: text/html; charset=UTF-8');
echo $html;
exit;
}
/**
* Resolve site branding + admin language for the pre-auth boot config.
*
* Reuses the API plugin's PreferencesResolver so the shape and storage
* (user/config/admin-next.yaml) stay identical to the post-auth
* /admin-next/preferences payload. Best-effort: any failure (API plugin
* absent, config unreadable) returns null and the SPA falls back to its
* built-in defaults.
*
* @return array{branding: array, appearance: array, brandingUrls: array, language: string}|null
*/
private function resolveBrandingForBoot(): ?array
{
$resolverClass = \Grav\Plugin\Api\Services\PreferencesResolver::class;
if (!class_exists($resolverClass)) {
return null;
}
try {
$resolver = new $resolverClass($this->grav);
$branding = $resolver->siteBranding();
$sitePrefs = $resolver->sitePreferences();
$language = is_string($sitePrefs['adminLanguage'] ?? null) ? $sitePrefs['adminLanguage'] : '';
$appearance = [];
foreach (['colorMode', 'accentHue', 'accentSaturation', 'darkShade', 'fontFamily', 'fontSize', 'helpMode'] as $key) {
if (array_key_exists($key, $sitePrefs)) {
$appearance[$key] = $sitePrefs[$key];
}
}
return [
'branding' => $branding,
'appearance' => $appearance,
'brandingUrls' => [
'light' => $resolver->brandingMediaUrl((string) ($branding['logoLight'] ?? '')),
'dark' => $resolver->brandingMediaUrl((string) ($branding['logoDark'] ?? '')),
'favicon' => $resolver->brandingMediaUrl((string) ($branding['favicon'] ?? '')),
],
'language' => $language,
];
} catch (\Throwable) {
return null;
}
}
}