Merge pull request #6 from GreenMeteor/dev

Fix: Nonce

Author: ArchBlood

Module.php

@@ -4,6 +4,7 @@
 
 use Yii;
 use yii\helpers\Url;
+use humhub\libs\Html;
 use humhub\components\Module as BaseModule;
 
 class Module extends BaseModule
@@ -31,12 +32,15 @@ public function getTitle()
     public function getHtmlCode()
     {
         $htmlCode = $this->settings->get('htmlCode');
+
         if (empty($htmlCode)) {
             return '';
         }
+
         return $htmlCode;
     }
 
+
     public function getOrder()
     {
         $sortOrder = $this->settings->get('sortOrder');

widgets/CodeboxFrame.php

@@ -3,17 +3,14 @@
 namespace humhub\modules\codebox\widgets;
 
 use Yii;
+use humhub\libs\Html;
 use humhub\components\Widget;
-use humhub\modules\web\security\helpers\Security;
 
 /**
  * CodeboxFrame adds HTML snippet code to all layouts extended by config.php
  */
 class CodeboxFrame extends Widget
 {
-
-    public $contentContainer;
-
     /**
      * @inheritdoc
      */
@@ -31,7 +28,16 @@ public function run()
             return '';
         }
 
-        return $this->render('codeboxframe', ['title' => $title, 'htmlCode' => $htmlCode, $sortOrder => 'sortOrder', 'nonce' => Security::getNonce()]);
+        // Generate nonce attribute
+        $nonce = Html::nonce();
+
+        // Check if {{nonce}} placeholder exists in htmlCode
+        if (strpos($htmlCode, 'nonce={{nonce}}') !== false) {
+            // Replace {{nonce}} with the generated nonce value
+            $htmlCode = str_replace('nonce={{nonce}}', $nonce, $htmlCode);
+        }
+
+        return $this->render('codeboxframe', ['title' => $title, 'htmlCode' => $htmlCode, 'sortOrder' => $sortOrder, 'nonce' => $nonce]);
     }
 
 }

widgets/views/codeboxframe.php

@@ -7,14 +7,10 @@
 
 <div class="panel panel-default panel-codebox" id="panel-codebox">
     <?= PanelMenu::widget(['id' => 'panel-codebox']); ?>
-  <div class="panel-heading">
-    <strong><?= Html::encode($title) ?></strong>
-  </div>
-  <div class="panel-body">
-
-<?= Html::beginTag('div') ?>
-<?= $htmlCode ?>
-<?= Html::endTag('div'); ?>
-
-</div>
+    <div class="panel-heading">
+        <strong><?= Html::encode($title) ?></strong>
+    </div>
+    <div class="panel-body">
+        <?= $htmlCode ?>
+    </div>
 </div>