feat: VivesPOS landing on Winter CMS 1.2 — theme + plugin + Dockerfile

- Base: wintercms/winter branch 1.2 (full framework)
- Theme vivespos: Canvas 7 + Bootstrap 5 CDN, custom CSS
- Layout: deferred GTM/GA4 tracking, JSON-LD SoftwareApplication
- Partials: hero (offline-first), features, modes (offline/nube toggle),
  screenshots, pricing (3 planes), comparison, FAQ, CTA
- Plugin VivesPOS.Site with ContactForm
- Dockerfile: PHP 8.2 Apache, port 80, healthcheck
- Added winter/wn-pages, blog, sitemap, seo plugins
- Active theme set to vivespos

modules/system/twig/securitypolicy/SafeCollection.php

@@ -0,0 +1,165 @@
+<?php namespace System\Twig\SecurityPolicy;
+
+use ArrayAccess;
+use Countable;
+use IteratorAggregate;
+use Traversable;
+use Illuminate\Contracts\Support\Arrayable;
+use Illuminate\Contracts\Support\Jsonable;
+use Illuminate\Support\Enumerable;
+use Illuminate\Support\Traits\ForwardsCalls;
+
+/**
+ * SafeCollection is a collection proxy that is safe to use in a Twig sandbox.
+ *
+ * Collections are handed to templates everywhere, and their higher-order methods
+ * (map, each, filter, reduce, ...) execute arbitrary callables — `things.map('system')`
+ * would run `system()`. Twig's security policy cannot inspect method *arguments*, so
+ * instead the receiver is cast to this proxy (by the custom GetAttrNode) before the call,
+ * and every callable argument is nulled out before being forwarded. Callables are unusable
+ * in Twig anyway, so nothing legitimate is lost.
+ *
+ * @package winter\wn-system-module
+ */
+class SafeCollection implements ArrayAccess, Countable, IteratorAggregate, Arrayable, Jsonable
+{
+    use ForwardsCalls;
+
+    /**
+     * @var Enumerable The wrapped collection (Collection or LazyCollection).
+     */
+    protected $collection;
+
+    /**
+     * @var string[] Methods where a string argument is an attribute/key name (not a callback).
+     * For these, string values are preserved; non-string callables are still stripped.
+     * Safe because Laravel's useAsCallable() never treats a string as a callback.
+     */
+    protected $hybridCallableArgs = [
+        'contains',
+        'containsstrict',
+        'doesntcontain',
+        'groupby',
+        'keyby',
+        'implode',
+        'search',
+        'sortby',
+        'sortbydesc',
+        'unique',
+        'duplicates',
+        'partition',
+    ];
+
+    /**
+     * @var string[] Methods that instantiate arbitrary classes or dispatch statically from a
+     * string argument (not caught by is_callable stripping), so they are blocked outright.
+     */
+    protected $blockedMethods = [
+        'mapinto',
+        'pipeinto',
+        'toresourcecollection',
+    ];
+
+    /**
+     * Constructor
+     */
+    public function __construct(Enumerable $collection)
+    {
+        $this->collection = $collection;
+    }
+
+    /**
+     * Forward all other calls to the collection, stripping callable arguments first.
+     */
+    public function __call($method, $parameters)
+    {
+        if (in_array(strtolower($method), $this->blockedMethods)) {
+            return $this;
+        }
+
+        $normalized = strtolower($method);
+        foreach ($parameters as &$param) {
+            $param = $this->stripCallables($param, $normalized);
+        }
+        unset($param);
+
+        return $this->forwardCallTo($this->collection, $method, $parameters);
+    }
+
+    /**
+     * Recursively null out any callable value at any depth. Hybrid methods keep string
+     * values (used as attribute names) but still drop non-string callables.
+     */
+    protected function stripCallables($value, string $method)
+    {
+        if (is_array($value)) {
+            foreach ($value as $key => $item) {
+                $value[$key] = $this->stripCallables($item, $method);
+            }
+            return $value;
+        }
+
+        if (
+            is_callable($value) &&
+            (!in_array($method, $this->hybridCallableArgs) || !is_string($value))
+        ) {
+            return null;
+        }
+
+        return $value;
+    }
+
+    public function getIterator(): Traversable
+    {
+        return $this->collection->getIterator();
+    }
+
+    public function offsetExists($offset): bool
+    {
+        return $this->collection instanceof ArrayAccess
+            ? $this->collection->offsetExists($offset)
+            : false;
+    }
+
+    #[\ReturnTypeWillChange]
+    public function offsetGet($offset)
+    {
+        return $this->collection instanceof ArrayAccess
+            ? $this->collection->offsetGet($offset)
+            : null;
+    }
+
+    public function offsetSet($offset, $value): void
+    {
+        if ($this->collection instanceof ArrayAccess) {
+            $this->collection->offsetSet($offset, $value);
+        }
+    }
+
+    public function offsetUnset($offset): void
+    {
+        if ($this->collection instanceof ArrayAccess) {
+            $this->collection->offsetUnset($offset);
+        }
+    }
+
+    public function count(): int
+    {
+        return $this->collection->count();
+    }
+
+    public function toArray()
+    {
+        return $this->collection->toArray();
+    }
+
+    public function toJson($options = 0)
+    {
+        return $this->collection->toJson($options);
+    }
+
+    public function __toString(): string
+    {
+        return $this->collection->toJson();
+    }
+}

modules/system/twig/securitypolicy/SafePaginator.php

@@ -0,0 +1,100 @@
+<?php namespace System\Twig\SecurityPolicy;
+
+use ArrayAccess;
+use Countable;
+use IteratorAggregate;
+use Traversable;
+use Illuminate\Support\Traits\ForwardsCalls;
+
+/**
+ * SafePaginator is a paginator proxy that is safe to use in a Twig sandbox.
+ *
+ * Paginators expose `through(callable)` (on both AbstractPaginator and
+ * AbstractCursorPaginator), which executes an arbitrary callable over the items. This proxy
+ * forwards every method to the wrapped paginator but strips callable arguments first, exactly
+ * like SafeCollection. All the rendering/navigation methods (render, links, currentPage,
+ * total, items, url, ...) keep working because they take no callables.
+ *
+ * @package winter\wn-system-module
+ */
+class SafePaginator implements ArrayAccess, Countable, IteratorAggregate
+{
+    use ForwardsCalls;
+
+    /**
+     * @var \Illuminate\Pagination\AbstractPaginator|\Illuminate\Pagination\AbstractCursorPaginator
+     */
+    protected $paginator;
+
+    /**
+     * Constructor
+     */
+    public function __construct($paginator)
+    {
+        $this->paginator = $paginator;
+    }
+
+    /**
+     * Forward all calls to the paginator, stripping callable arguments first.
+     */
+    public function __call($method, $parameters)
+    {
+        foreach ($parameters as &$param) {
+            $param = $this->stripCallables($param);
+        }
+        unset($param);
+
+        return $this->forwardCallTo($this->paginator, $method, $parameters);
+    }
+
+    /**
+     * Recursively null out any callable value at any depth.
+     */
+    protected function stripCallables($value)
+    {
+        if (is_array($value)) {
+            foreach ($value as $key => $item) {
+                $value[$key] = $this->stripCallables($item);
+            }
+            return $value;
+        }
+
+        return is_callable($value) ? null : $value;
+    }
+
+    public function getIterator(): Traversable
+    {
+        return $this->paginator->getIterator();
+    }
+
+    public function offsetExists($offset): bool
+    {
+        return $this->paginator->offsetExists($offset);
+    }
+
+    #[\ReturnTypeWillChange]
+    public function offsetGet($offset)
+    {
+        return $this->paginator->offsetGet($offset);
+    }
+
+    public function offsetSet($offset, $value): void
+    {
+        $this->paginator->offsetSet($offset, $value);
+    }
+
+    public function offsetUnset($offset): void
+    {
+        $this->paginator->offsetUnset($offset);
+    }
+
+    public function count(): int
+    {
+        return $this->paginator->count();
+    }
+
+    public function __toString(): string
+    {
+        return (string) $this->paginator->render();
+    }
+}