view core/lib/Drupal/Core/Ajax/SettingsCommand.php @ 13:5fb285c0d0e3

Update Drupal core to 8.4.7 via Composer. Security update; I *think* we've
been lucky to get away with this so far, as we don't support self-registration
which seems to be used by the so-called "drupalgeddon 2" attack that 8.4.5
was vulnerable to.

<?php

namespace Drupal\Core\Ajax;

/**
 * AJAX command for adjusting Drupal's JavaScript settings.
 *
 * The 'settings' command instructs the client either to use the given array as
 * the settings for ajax-loaded content or to extend drupalSettings with the
 * given array, depending on the value of the $merge parameter.
 *
 * This command is implemented by Drupal.AjaxCommands.prototype.settings()
 * defined in misc/ajax.js.
 *
 * @ingroup ajax
 */
class SettingsCommand implements CommandInterface {

  /**
   * An array of key/value pairs of JavaScript settings.
   *
   * This will be used for all commands after this if they do not include their
   * own settings array.
   *
   * @var array
   */
  protected $settings;

  /**
   * Whether the settings should be merged into the global drupalSettings.
   *
   * By default (FALSE), the settings that are passed to Drupal.attachBehaviors
   * will not include the global drupalSettings.
   *
   * @var bool
   */
  protected $merge;

  /**
   * Constructs a SettingsCommand object.
   *
   * @param array $settings
   *   An array of key/value pairs of JavaScript settings.
   * @param bool $merge
   *   Whether the settings should be merged into the global drupalSettings.
   */
  public function __construct(array $settings, $merge = FALSE) {
    $this->settings = $settings;
    $this->merge = $merge;
  }

  /**
   * Implements Drupal\Core\Ajax\CommandInterface:render().
   */
  public function render() {

    return [
      'command' => 'settings',
      'settings' => $this->settings,
      'merge' => $this->merge,
    ];
  }

}