Skip to content

Commit 09d662e

Browse files
heyitsrobertheAlex Paliarush
heyitsroberthe
authored and
Alex Paliarush
committed
MAGETWO-70580: Merged fixes
1 parent e9893b3 commit 09d662e

File tree

215 files changed

+36719
-41734
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

215 files changed

+36719
-41734
lines changed

‎app/code/Magento/AdminNotification/Controller/Adminhtml/System/Message/ListAction.php

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,11 @@
88

99
class ListAction extends \Magento\Backend\App\AbstractAction
1010
{
11+
/**
12+
* Authorization level of a basic admin session
13+
*/
14+
const ADMIN_RESOURCE = 'Magento_AdminNotification::show_list';
15+
1116
/**
1217
* @var \Magento\Framework\Json\Helper\Data
1318
*/

‎app/code/Magento/AdminNotification/Model/Feed.php

Lines changed: 14 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -148,9 +148,9 @@ public function checkUpdate()
148148
$feedData[] = [
149149
'severity' => (int)$item->severity,
150150
'date_added' => date('Y-m-d H:i:s', $itemPublicationDate),
151-
'title' => (string)$item->title,
152-
'description' => (string)$item->description,
153-
'url' => (string)$item->link,
151+
'title' => $this->escapeString($item->title),
152+
'description' => $this->escapeString($item->description),
153+
'url' => $this->escapeString($item->link),
154154
];
155155
}
156156
}
@@ -246,4 +246,15 @@ public function getFeedXml()
246246

247247
return $xml;
248248
}
249+
250+
/**
251+
* Converts incoming data to string format and escapes special characters.
252+
*
253+
* @param \SimpleXMLElement $data
254+
* @return string
255+
*/
256+
private function escapeString(\SimpleXMLElement $data)
257+
{
258+
return htmlspecialchars((string)$data);
259+
}
249260
}

‎app/code/Magento/AdminNotification/Test/Unit/Model/FeedTest.php

Lines changed: 42 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -145,8 +145,27 @@ public function testCheckUpdate($callInbox, $curlRequest)
145145
->will($this->returnValue('Sat, 6 Sep 2014 16:46:11 UTC'));
146146
if ($callInbox) {
147147
$this->inboxFactory->expects($this->once())->method('create')
148-
->will(($this->returnValue($this->inboxModel)));
149-
$this->inboxModel->expects($this->once())->method('parse')->will($this->returnSelf());
148+
->will($this->returnValue($this->inboxModel));
149+
$this->inboxModel->expects($this->once())
150+
->method('parse')
151+
->with(
152+
$this->callback(
153+
function ($data) {
154+
$fieldsToCheck = ['title', 'description', 'url'];
155+
return array_reduce(
156+
$fieldsToCheck,
157+
function ($initialValue, $item) use ($data) {
158+
$haystack = $data[0][$item] ?? false;
159+
return $haystack
160+
? $initialValue && !strpos($haystack, '<') && !strpos($haystack, '>')
161+
: true;
162+
},
163+
true
164+
);
165+
}
166+
)
167+
)
168+
->will($this->returnSelf());
150169
} else {
151170
$this->inboxFactory->expects($this->never())->method('create');
152171
$this->inboxModel->expects($this->never())->method('parse');
@@ -196,7 +215,27 @@ public function checkUpdateDataProvider()
196215
</item>
197216
</channel>
198217
</rss>'
199-
]
218+
],
219+
[
220+
true,
221+
// @codingStandardsIgnoreStart
222+
'HEADER
223+
224+
<?xml version="1.0" encoding="utf-8" ?>
225+
<rss version="2.0" xmlns:atom="http://www.w3.org/2005/Atom">
226+
<channel>
227+
<title>MagentoCommerce</title>
228+
<item>
229+
<title><![CDATA[<script>alert("Hello!");</script>Test Title]]></title>
230+
<link><![CDATA[http://magento.com/feed_url<script>alert("Hello!");</script>]]></link>
231+
<severity>4</severity>
232+
<description><![CDATA[Test <script>alert("Hello!");</script>Description]]></description>
233+
<pubDate>Tue, 20 Jun 2017 13:14:47 UTC</pubDate>
234+
</item>
235+
</channel>
236+
</rss>'
237+
// @codingStandardsIgnoreEnd
238+
],
200239
];
201240
}
202241
}

‎app/code/Magento/AdminNotification/etc/config.xml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@
1212
<feed_url>notifications.magentocommerce.com/magento2/community/notifications.rss</feed_url>
1313
<popup_url>widgets.magentocommerce.com/notificationPopup</popup_url>
1414
<severity_icons_url>widgets.magentocommerce.com/%s/%s.gif</severity_icons_url>
15-
<use_https>0</use_https>
15+
<use_https>1</use_https>
1616
<frequency>1</frequency>
1717
<last_update>0</last_update>
1818
</adminnotification>

‎app/code/Magento/AdminNotification/view/adminhtml/ui_component/notification_area.xml

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,7 @@
2424
</storageConfig>
2525
<updateUrl path="mui/index/render"/>
2626
</settings>
27+
<aclResource>Magento_AdminNotification::show_list</aclResource>
2728
<dataProvider class="Magento\AdminNotification\Ui\Component\DataProvider\DataProvider" name="notification_area_data_source">
2829
<settings>
2930
<requestFieldName>identity</requestFieldName>

‎app/code/Magento/Authorizenet/Controller/Directpost/Payment/BackendResponse.php

Lines changed: 54 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,8 +6,48 @@
66
*/
77
namespace Magento\Authorizenet\Controller\Directpost\Payment;
88

9+
use Magento\Authorizenet\Helper\DataFactory;
10+
use Magento\Authorizenet\Model\Directpost;
11+
use Magento\Authorizenet\Model\DirectpostFactory;
12+
use Magento\Framework\App\Action\Context;
13+
use Magento\Framework\Controller\ResultFactory;
14+
use Magento\Framework\Exception\LocalizedException;
15+
use Magento\Framework\Registry;
16+
use Psr\Log\LoggerInterface;
17+
918
class BackendResponse extends \Magento\Authorizenet\Controller\Directpost\Payment
1019
{
20+
/**
21+
* @var LoggerInterface
22+
*/
23+
private $logger;
24+
25+
/**
26+
* @var DirectpostFactory
27+
*/
28+
private $directpostFactory;
29+
30+
/**
31+
* BackendResponse constructor.
32+
*
33+
* @param Context $context
34+
* @param Registry $coreRegistry
35+
* @param DataFactory $dataFactory
36+
* @param DirectpostFactory $directpostFactory
37+
* @param LoggerInterface|null $logger
38+
*/
39+
public function __construct(
40+
Context $context,
41+
Registry $coreRegistry,
42+
DataFactory $dataFactory,
43+
DirectpostFactory $directpostFactory,
44+
LoggerInterface $logger = null
45+
) {
46+
parent::__construct($context, $coreRegistry, $dataFactory);
47+
$this->directpostFactory = $directpostFactory ?: $this->_objectManager->create(DirectpostFactory::class);
48+
$this->logger = $logger ?: $this->_objectManager->get(LoggerInterface::class);
49+
}
50+
1151
/**
1252
* Response action.
1353
* Action for Authorize.net SIM Relay Request.
@@ -16,7 +56,20 @@ class BackendResponse extends \Magento\Authorizenet\Controller\Directpost\Paymen
1656
*/
1757
public function execute()
1858
{
59+
$data = $this->getRequest()->getParams();
60+
/** @var Directpost $paymentMethod */
61+
$paymentMethod = $this->directpostFactory->create();
62+
if (!empty($data['store_id'])) {
63+
$paymentMethod->setStore($data['store_id']);
64+
}
65+
$paymentMethod->setResponseData($data);
66+
try {
67+
$paymentMethod->validateResponse();
68+
} catch (LocalizedException $e) {
69+
$this->logger->critical($e->getMessage());
70+
return $this->_redirect('noroute');
71+
}
1972
$this->_responseAction('adminhtml');
20-
return $this->resultFactory->create(\Magento\Framework\Controller\ResultFactory::TYPE_PAGE);
73+
return $this->resultFactory->create(ResultFactory::TYPE_PAGE);
2174
}
2275
}

‎app/code/Magento/Backend/Block/Widget/Grid/Column.php

Lines changed: 21 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@
55
*/
66
namespace Magento\Backend\Block\Widget\Grid;
77

8+
use Magento\Backend\Block\Widget;
89
use Magento\Backend\Block\Widget\Grid\Column\Filter\AbstractFilter;
910

1011
/**
@@ -14,7 +15,7 @@
1415
* @deprecated 100.2.0 in favour of UI component implementation
1516
* @since 100.0.2
1617
*/
17-
class Column extends \Magento\Backend\Block\Widget
18+
class Column extends Widget
1819
{
1920
/**
2021
* Parent grid
@@ -289,12 +290,30 @@ public function getRowField(\Magento\Framework\DataObject $row)
289290
*/
290291
$frameCallback = $this->getFrameCallback();
291292
if (is_array($frameCallback)) {
293+
$this->validateFrameCallback($frameCallback);
292294
$renderedValue = call_user_func($frameCallback, $renderedValue, $row, $this, false);
293295
}
294296

295297
return $renderedValue;
296298
}
297299

300+
/**
301+
* Validate frame callback
302+
*
303+
* @throws \InvalidArgumentException
304+
*
305+
* @param array $callback
306+
* @return void
307+
*/
308+
private function validateFrameCallback(array $callback)
309+
{
310+
if (!is_object($callback[0]) || !$callback[0] instanceof Widget) {
311+
throw new \InvalidArgumentException(
312+
"Frame callback host must be instance of Magento\\Backend\\Block\\Widget"
313+
);
314+
}
315+
}
316+
298317
/**
299318
* Retrieve row column field value for export
300319
*
@@ -314,6 +333,7 @@ public function getRowFieldExport(\Magento\Framework\DataObject $row)
314333
*/
315334
$frameCallback = $this->getFrameCallback();
316335
if (is_array($frameCallback)) {
336+
$this->validateFrameCallback($frameCallback);
317337
$renderedValue = call_user_func($frameCallback, $renderedValue, $row, $this, true);
318338
}
319339

‎app/code/Magento/Backend/Controller/Adminhtml/Ajax/Translate.php

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,11 @@ class Translate extends \Magento\Backend\App\Action
2020
*/
2121
protected $resultJsonFactory;
2222

23+
/**
24+
* Authorization level of a basic admin session
25+
*/
26+
const ADMIN_RESOURCE = 'Magento_Backend::content_translation';
27+
2328
/**
2429
* @param Action\Context $context
2530
* @param \Magento\Framework\Translate\Inline\ParserInterface $inlineParser

‎app/code/Magento/Backend/Test/Unit/Block/Widget/Grid/ColumnTest.php

Lines changed: 96 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -3,12 +3,11 @@
33
* Copyright © Magento, Inc. All rights reserved.
44
* See COPYING.txt for license details.
55
*/
6-
7-
/**
8-
* Test class for \Magento\Backend\Block\Widget\Grid\Column
9-
*/
106
namespace Magento\Backend\Test\Unit\Block\Widget\Grid;
117

8+
use Magento\Backend\Block\Widget\Grid\Column\Renderer\AbstractRenderer;
9+
use Magento\Framework\DataObject;
10+
1211
class ColumnTest extends \PHPUnit\Framework\TestCase
1312
{
1413
/**
@@ -379,4 +378,97 @@ public function columnGroupedDataProvider()
379378
{
380379
return [[[], false], [['grouped' => 0], false], [['grouped' => 1], true]];
381380
}
381+
382+
/**
383+
* Testing row field export with valid frame callback
384+
*/
385+
public function testGetRowFieldAndExportWithFrameCallback()
386+
{
387+
$row = new DataObject(['id' => '2', 'title' => 'some item']);
388+
/** @var $rendererMock */
389+
$rendererMock = $this->getMockBuilder(AbstractRenderer::class)
390+
->disableOriginalConstructor()
391+
->setMethods(['renderExport', 'render'])
392+
->getMock();
393+
394+
$rendererMock->expects($this->any())->method('renderExport')->willReturnCallback(
395+
function (DataObject $row) {
396+
return $row->getData('title');
397+
}
398+
);
399+
400+
$rendererMock->expects($this->any())->method('render')->willReturnCallback(
401+
function (DataObject $row) {
402+
return $row->getData('title');
403+
}
404+
);
405+
406+
$frameCallbackHostObject = $this->getMockBuilder(\Magento\Backend\Block\Widget::class)
407+
->disableOriginalConstructor()
408+
->setMethods(['decorate'])
409+
->getMock();
410+
411+
$frameCallbackHostObject->expects($this->any())
412+
->method('decorate')
413+
->willReturnCallback(
414+
function ($renderValue) {
415+
return '__callback_decorated_' . $renderValue;
416+
}
417+
);
418+
419+
$this->_block->setRenderer($rendererMock);
420+
$this->_block->setFrameCallback([$frameCallbackHostObject, 'decorate']);
421+
$renderResult = $this->_block->getRowField($row);
422+
$exportResult = $this->_block->getRowFieldExport($row);
423+
$this->assertEquals('__callback_decorated_some item', $exportResult);
424+
$this->assertEquals('__callback_decorated_some item', $renderResult);
425+
}
426+
427+
/**
428+
* @expectedException \InvalidArgumentException
429+
* @expectedExceptionMessage Frame callback host must be instance of Magento\Backend\Block\Widget
430+
*/
431+
public function testGetRowFieldExportWithInvalidCallback()
432+
{
433+
$row = new DataObject(['id' => '2', 'title' => 'some item']);
434+
/** @var $rendererMock */
435+
$rendererMock = $this->getMockBuilder(AbstractRenderer::class)
436+
->disableOriginalConstructor()
437+
->setMethods(['renderExport', 'render'])
438+
->getMock();
439+
440+
$rendererMock->expects($this->any())->method('renderExport')->willReturnCallback(
441+
function (DataObject $row) {
442+
return $row->getData('title');
443+
}
444+
);
445+
446+
$this->_block->setRenderer($rendererMock);
447+
$this->_block->setFrameCallback([$this, 'testGetRowFieldExportWithFrameCallback']);
448+
$this->_block->getRowFieldExport($row);
449+
}
450+
451+
/**
452+
* @expectedException \InvalidArgumentException
453+
* @expectedExceptionMessage Frame callback host must be instance of Magento\Backend\Block\Widget
454+
*/
455+
public function testGetRowFieldWithInvalidCallback()
456+
{
457+
$row = new DataObject(['id' => '2', 'title' => 'some item']);
458+
/** @var $rendererMock */
459+
$rendererMock = $this->getMockBuilder(AbstractRenderer::class)
460+
->disableOriginalConstructor()
461+
->setMethods(['render'])
462+
->getMock();
463+
464+
$rendererMock->expects($this->any())->method('render')->willReturnCallback(
465+
function (DataObject $row) {
466+
return $row->getData('title');
467+
}
468+
);
469+
470+
$this->_block->setRenderer($rendererMock);
471+
$this->_block->setFrameCallback([$this, 'testGetRowFieldExportWithFrameCallback']);
472+
$this->_block->getRowField($row);
473+
}
382474
}

‎app/code/Magento/Backend/etc/acl.xml

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,7 @@
2222
<resource id="Magento_Backend::design" title="Design" translate="title" sortOrder="20">
2323
<resource id="Magento_Backend::schedule" title="Schedule" translate="title" sortOrder="30" />
2424
</resource>
25+
<resource id="Magento_Backend::content_translation" title="Content translation" translate="title" sortOrder="40" />
2526
</resource>
2627
<resource id="Magento_Backend::stores" title="Stores" translate="title" sortOrder="80">
2728
<resource id="Magento_Backend::stores_settings" title="Settings" translate="title" sortOrder="10">

‎app/code/Magento/Braintree/view/adminhtml/ui_component/braintree_report.xml

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,7 @@
2626
<settings>
2727
<updateUrl path="mui/index/render"/>
2828
</settings>
29+
<aclResource>Magento_Braintree::settlement_report</aclResource>
2930
<dataProvider class="BraintreeTransactionsDataProvider" name="braintree_report_data_source">
3031
<settings>
3132
<requestFieldName>id</requestFieldName>

‎app/code/Magento/Braintree/view/adminhtml/web/js/vault.js

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -109,7 +109,7 @@ define([
109109

110110
$('body').trigger('processStart');
111111

112-
$.get(self.nonceUrl, {
112+
$.getJSON(self.nonceUrl, {
113113
'public_hash': self.publicHash
114114
}).done(function (response) {
115115
self.setPaymentDetails(response.paymentMethodNonce);

0 commit comments

Comments
 (0)