Merge remote-tracking branch 'origin/master' into feat/add-document-encrypter-service

src/Bundle/ChillWopiBundle/src/Controller/Editor.php

@@ -18,6 +18,7 @@ use Chill\DocStoreBundle\Entity\StoredObject;
 use Chill\WopiBundle\Service\Controller\ResponderInterface;
 use Exception;
 use loophp\psr17\Psr17Interface;
+use Symfony\Component\Finder\Exception\AccessDeniedException;
 use Symfony\Component\HttpFoundation\Response;
 use Symfony\Component\HttpKernel\Exception\NotFoundHttpException;
 use Symfony\Component\Routing\Generator\UrlGeneratorInterface;
@@ -28,7 +29,7 @@ use Symfony\Component\Security\Core\Security;
  * @internal
  * @coversNothing
  */
-final class Test
+final class Editor
 {
     private DocumentManagerInterface $documentManager;
 
@@ -64,6 +65,10 @@ final class Test
 
     public function __invoke(string $fileId): Response
     {
+        if (null === $user = $this->security->getUser()->getUsername()) {
+            throw new AccessDeniedException('You must be logged in to access to this resource.');
+        }
+
         $configuration = $this->wopiConfiguration->jsonSerialize();
         /** @var StoredObject $storedObject */
         $storedObject = $this->documentManager->findByDocumentId($fileId);
@@ -77,7 +82,7 @@ final class Test
         }
 
         $configuration['favIconUrl'] = '';
-        $configuration['access_token'] = $this->security->getUser()->getUsername();
+        $configuration['access_token'] = $user;
 
         $configuration['server'] = $this
             ->psr17

src/Bundle/ChillWopiBundle/src/Resources/public/page/editor/index.js

@@ -14,7 +14,7 @@ window.addEventListener('DOMContentLoaded', function(e) {
     office_frame.setAttribute('allowfullscreen', 'true');
 
     // The sandbox attribute is needed to allow automatic redirection to the O365 sign-in page in the business user flow
-    office_frame.setAttribute('sandbox', 'allow-scripts allow-same-origin allow-forms allow-popups allow-top-navigation allow-popups-to-escape-sandbox');
+    office_frame.setAttribute('sandbox', 'allow-downloads allow-scripts allow-same-origin allow-forms allow-popups allow-top-navigation allow-popups-to-escape-sandbox');
     frameholder.appendChild(office_frame);
 
     document.getElementById('office_form').submit();