Skip to content
This repository was archived by the owner on Nov 19, 2024. It is now read-only.

Commit 061890a

Browse files
dshevtsovdshevtsov
authored
Merge pull request magento-commerce/devdocs#2576
GA: 2.4.3-p1, 2.3.7-p2
2 parents 4d409b3 + 07f18fd commit 061890a

File tree

10 files changed

+324
-90
lines changed

10 files changed

+324
-90
lines changed

‎src/_data/toc/release-notes.yml

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,8 @@ pages:
77
include_versions: ["2.4"]
88
children:
99

10+
- label: Adobe Commerce 2.4.3-p1 Release Notes
11+
url: /release-notes/2-4-3-p1.html
1012

1113
- label: Magento Open Source 2.4.3 Release Notes
1214
url: /release-notes/open-source-2-4-3.html
@@ -46,6 +48,9 @@ pages:
4648
- label: Component Status
4749
url: /release-notes/component-status.html
4850

51+
- label: Adobe Commerce 2.3.7-p2 Release Notes
52+
url: /release-notes/2-3-7-p2.html
53+
4954
- label: Adobe Commerce 2.3.7-p1 Release Notes
5055
url: /release-notes/2-3-7-p1.html
5156

‎src/_data/whats-new.yml

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,45 @@ link: "/whats-new.html"
66
thread: "/whatsnew-feed.xml"
77
updated: Mon Oct 11 14:51:53 2021
88
entries:
9+
- description: Added release notes for the 2.4.3-p1 and 2.3.7-p2 Adobe Commerce releases.
10+
See [2.4 Release Information](https://devdocs.magento.com/guides/v2.4/release-notes/bk-release-notes.html)
11+
and [2.3 Release Information](https://devdocs.magento.com/guides/v2.3/release-notes/bk-release-notes.html).
12+
versions: 2.4.3, 2.3.7
13+
type: Major Update
14+
date: October 12, 2021
15+
link: https://github.com/magento-commerce/devdocs/pull/2558
16+
merge_commit: 49f0b0cd0aa5886aa0de6f95d4e2659bb335e044
17+
contributor: jfrontain
18+
membership: true
19+
labels:
20+
- Major Update
21+
- 2.4.3
22+
- 2.3.7
23+
- description: Added a [backwards incompatible change](https://devdocs.magento.com/guides/v2.4/release-notes/backward-incompatible-changes/)
24+
that describes changes to Media Gallery folders.
25+
versions: 2.4.3, 2.3.7
26+
type: Major Update
27+
date: October 12, 2021
28+
link: https://github.com/magento-commerce/devdocs/pull/2488
29+
merge_commit: 38eb1ac8bd936a9bb8747dba2f1421e9a9f35876
30+
contributor: dobooth
31+
membership: true
32+
labels:
33+
- Major Update
34+
- 2.4.3
35+
- 2.3.7
36+
- description: Expanded [GraphQL security configuration](https://devdocs.magento.com/guides/v2.3/graphql/security-configuration.html)
37+
to include configuration of the GraphQL module.
38+
versions: 2.3.x
39+
type: Major Update
40+
date: October 12, 2021
41+
link: https://github.com/magento-commerce/devdocs/pull/2511
42+
merge_commit: c980768f7a022ebe848cc1019896d3084476f259
43+
contributor: keharper
44+
membership: true
45+
labels:
46+
- Major Update
47+
- 2.3.x
948
- description: Added a reference topic for the [list of events](https://devdocs.magento.com/guides/v2.4/extension-dev-guide/event-list.html).
1049
versions: 2.4.x
1150
type: New Topic

‎src/guides/v2.3/ext-best-practices/tutorials/modify-image-library-permissions/index.md

Lines changed: 22 additions & 87 deletions
Original file line numberDiff line numberDiff line change
@@ -3,98 +3,33 @@ group: extension-best-practices
33
title: Modify Media Library folder permissions
44
---
55

6-
The Magento Media Library gives admins the ability to upload image files in specific folders.
7-
The [Storage class] for images in Magento's CMS module manages image file uploads, file retrievals, and directory creation.
6+
The Magento Media Gallery gives admins the ability to upload image files in specific folders. The Storage class for images in the CMS module manages image file uploads, file retrievals, and directory creation.
87

9-
For security purposes, Magento does not provide Media Library access to contents in specific folders.
10-
This configuration is set in the CMS module's `di.xml` file and injected into the Storage class constructor.
8+
For security purposes, Magento provides Media Gallery access to contents in specific folders. The configuration path `system/media_storage_configuration/media_storage/allowed_resource/media_gallery_image_folders` in `config.xml` is used to define "Media Gallery Allowed" folders
119

12-
By default, Magento allows Media Library access to all directories under `/pub/media` except the following:
10+
By default, Magento allows Media Gallery access to the following two directories under `/pub/media`:
1311

14-
* `captcha`
15-
* `catalog/product`
16-
* `customer`
17-
* `downloadable`
18-
* `import`
19-
* `theme`
20-
* `theme_customization`
21-
* `tmp`
12+
* `catalog/category`
13+
* `wysiwyg`
2214

23-
In this tutorial, you will learn how to specify Media Library view permissions for folders using the `di.xml` file.
15+
In this tutorial, you will learn how to extend "Media Gallery Allowed" folders using the `config.xml` file.
2416

25-
## Step 1: Create `di.xml` file
17+
1. Create a `config.xml` file.
2618

27-
If your module does not have one, create a [`di.xml`] file under the `etc` directory.
19+
If your module does not have one, create a `config.xml` file under the etc directory.
2820

29-
## Step 2: Specify class type configuration
21+
1. Add a new "Media Gallery Allowed" folder:
3022

31-
To work with the constructor arguments for the `Storage` class, create a new `type` element with the `name` property set to `Magento\Cms\Model\Wysiwyg\Images\Storage` in the `di.xml` file.
32-
33-
Under the `type` element, create an `arguments` element.
34-
35-
```xml
36-
<type name="Magento\Cms\Model\Wysiwyg\Images\Storage">
37-
<arguments>
38-
</arguments>
39-
</type>
40-
```
41-
42-
## Step 3: Specify argument name
43-
44-
To change the content of the `dirs` argument provided to the constructor, create a new `argument` array element with the name `dirs` under `arguments`.
45-
46-
```xml
47-
<type name="Magento\Cms\Model\Wysiwyg\Images\Storage">
48-
<arguments>
49-
<argument name="dirs" xsi:type="array">
50-
</argument>
51-
</arguments>
52-
</type>
53-
```
54-
55-
## Step 4: Exclude or include directory
56-
57-
### Step 4a: Exclude a directory
58-
59-
Add entries to the `exclude` array to extend the list of view restricted directories.
60-
61-
The following configuration restricts Media Library access to content under `pub/media/private-directory/`:
62-
63-
```xml
64-
<type name="Magento\Cms\Model\Wysiwyg\Images\Storage">
65-
<arguments>
66-
<argument name="dirs" xsi:type="array">
67-
<item name="exclude" xsi:type="array">
68-
<item name="private-directory" xsi:type="array">
69-
<item name="regexp" xsi:type="boolean">true</item>
70-
<item name="name" xsi:type="string">pub[/\\]+media[/\\]+private-directory[/\\]*$</item>
71-
</item>
72-
</item>
73-
</argument>
74-
</arguments>
75-
</type>
76-
```
77-
78-
### Step 4b: Include an excluded directory
79-
80-
Add entries to the `include` array to override directory restrictions.
81-
82-
The following configuration overrides the default directory restriction for the `pub/media/downloadable/` directory:
83-
84-
```xml
85-
<type name="Magento\Cms\Model\Wysiwyg\Images\Storage">
86-
<arguments>
87-
<argument name="dirs" xsi:type="array">
88-
<item name="include" xsi:type="array">
89-
<item name="downloadable" xsi:type="array">
90-
<item name="regexp" xsi:type="boolean">true</item>
91-
<item name="name" xsi:type="string">pub[/\\]+media[/\\]+downloadable[/\\]*$</item>
92-
</item>
93-
</item>
94-
</argument>
95-
</arguments>
96-
</type>
97-
```
98-
99-
[`di.xml`]: {{page.baseurl }}/extension-dev-guide/build/di-xml-file.html
100-
[Storage class]: {{ site.mage2bloburl }}/{{page.guide_version}}/app/code/Magento/Cms/Model/Wysiwyg/Images/Storage.php
23+
```xml
24+
<system>
25+
<media_storage_configuration>
26+
<allowed_resources>
27+
<media_gallery_image_folders>
28+
<!-- new "Media Gallery Allowed" folders -->
29+
<my_image_folder>custom_folder_name</my_image_folder>
30+
<my_catalog_image_folder>catalog/custom_folder_name</my_catalog_image_folder>
31+
</media_gallery_image_folders>
32+
</allowed_resources>
33+
</media_storage_configuration>
34+
</system>
35+
```

‎src/guides/v2.3/graphql/security-configuration.md

Lines changed: 124 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -3,9 +3,13 @@ group: graphql
33
title: GraphQL security configuration
44
---
55

6-
The Framework `app/etc/di.xml` file uses the `maxPageSize` argument to restrict the maximum page size in queries to 300. To override this default value, create a custom module and provide a new value in the module's [di.xml]({{page.baseurl}}/extension-dev-guide/build/di-xml-file.html) file.
6+
The Framework and `GraphQl` module `di.xml` files define several security-related configuration values that you should review to ensure they align with types of mutations and queries that you run.
77

8-
The following example changes the limit to `100`:
8+
To override these default values, create a custom module and provide a new value in the appropriate [di.xml]({{page.baseurl}}/extension-dev-guide/build/di-xml-file.html) file.
9+
10+
## Framework configuration
11+
12+
In GraphQL, the `SearchCriteriaValidator` class constructor limits the maximum page size in queries to `300` by default as well. You can change the default in the `di.xml` file. The following example changes the limit to `100`:
913

1014
```xml
1115
<type name="Magento\Framework\GraphQl\Query\Resolver\Argument\Validator\SearchCriteriaValidator">
@@ -15,4 +19,121 @@ The following example changes the limit to `100`:
1519
</type>
1620
```
1721

18-
[API security]({{page.baseurl}}/get-started/api-security.html) describes additional arguments that are applicable to web APIs in general.
22+
[API security]({{page.baseurl}}/get-started/api-security.html) describes additional arguments that are applicable to web APIs in general.
23+
24+
## GraphQl module configuration
25+
26+
The `GraphQl/etc/di.xml` file contains two arguments that can be overridden to enhance security and prevent performance bottlenecks:
27+
28+
Attribute | Default value | Description
29+
--- | --- | ---
30+
`queryComplexity` | 300 | Defines the maximum number of fields, objects, and fragments that a query can contain.
31+
`queryDepth` | 20 | Defines the maximum depth of nodes that query can return.
32+
33+
### Query complexity
34+
35+
A complex GraphQL query, such as the [`cart`]({{page.baseurl}}/graphql/queries/cart.html) or [`products`]({{page.baseurl}}/graphql/queries/products.html) query, can potentially generate a heavy workload on the server. Complex queries can potentially be used to create distributed denial of service (DDoS) attacks by overloading the server with specious requests.
36+
37+
Each instance of the following items adds 1 to the complexity score:
38+
39+
* A field and parent field in the body of the query.
40+
* A field in an inline fragment.
41+
* A field in a fragment spread. If a fragment spread is used multiple times, each field within is counted that number of times.
42+
43+
The following items do not count toward the complexity score:
44+
45+
* The root `query` field
46+
* Fragment declarations
47+
* Fragment spread declarations
48+
49+
The following sample query contains all of the items listed above.
50+
51+
```graphql
52+
query {
53+
countries {
54+
full_name_english
55+
name1: full_name_english
56+
...on Country {
57+
two_letter_abbreviation
58+
}
59+
...myFrag
60+
...myFrag
61+
}
62+
}
63+
fragment myFrag on Country {
64+
three_letter_abbreviation
65+
}
66+
```
67+
68+
The complexity count for the query is 6. These lines contributed to the count:
69+
70+
* `countries {}`
71+
* `full_name_english` (first instance)
72+
* `name1: full_name_english`
73+
* `two_letter_abbreviation`
74+
* `three_letter_abbreviation` (first instance of `...myFrag`)
75+
* `three_letter_abbreviation` (second instance of `...myFrag`)
76+
77+
Creating the `name1` alias did not cause the system to double count the entry.
78+
79+
If the count does not exceed the threshold set by the `queryComplexity` attribute, Magento validates and processes the query.
80+
81+
### Query depth
82+
83+
The `queryDepth` attribute specifies the maximum depth a query can return. This can be an issue for queries that return objects that show a hierarchy, such as [`CategoryTree`]({{page.baseurl}}/graphql/queries/category-list.html), or queries that return detailed data on complex [products]({{page.baseurl}}/graphql/queries/products.html). The default value of 20 allows for deep hierarchies and products, but you might want to reduce this number if you know that legitimate queries will never reach that depth.
84+
85+
The following query has a maximum depth of 5.
86+
87+
```graphql
88+
{
89+
categories(
90+
filters: {
91+
parent_id: {in: ["2"]}
92+
}
93+
) {
94+
total_count
95+
items {
96+
uid
97+
level
98+
name
99+
path
100+
children_count
101+
children {
102+
uid
103+
level
104+
name
105+
path
106+
children_count
107+
children {
108+
uid
109+
level
110+
name
111+
path
112+
children_count
113+
children {
114+
uid
115+
level
116+
name
117+
path
118+
}
119+
}
120+
}
121+
}
122+
page_info {
123+
current_page
124+
page_size
125+
total_pages
126+
}
127+
}
128+
}
129+
```
130+
131+
These fields contribute to the depth:
132+
133+
* `items`
134+
* `children` (first instance)
135+
* `children` (second instance)
136+
* `children` (third instance)
137+
* `uid` and other fields in this node
138+
139+
If the depth of the query exceeds the value `queryDepth`, the system returns an error.

‎src/guides/v2.3/release-notes/2-3-7-p2.md

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
---
2+
group: release-notes
3+
title: Adobe Commerce 2.3.7-p2 Release Notes
4+
---
5+
6+
{{ site.data.var.ee }} 2.3.7-p2 is a security-only release that provides security fixes that enhance your {{ site.data.var.ee }} 2.3.7 or {{ site.data.var.ce }} 2.3.7 deployment. Merchants can now install time-sensitive security fixes without applying the hundreds of functional fixes and enhancements that a full quarterly release provides. Patch 2.3.7-p2 is a security-only patch that provides fixes for vulnerabilities that have been identified in our previous quarterly release, {{ site.data.var.ee }} 2.3.7-p1.
7+
8+
{:.bs-callout-info}
9+
PHP 7.3 reaches end of support in December 2021, and {{ site.data.var.ee }} 2.3.x and {{ site.data.var.ce }} 2.3.x reaches end of support in April 2022. **We strongly recommend planning your upgrade now to {{ site.data.var.ee }} 2.4.x or {{ site.data.var.ce }} 2.4.x deployment to help maintain PCI compliance**.
10+
11+
{:.bs-callout-info}
12+
Quarterly releases may contain backward-incompatible changes (BIC). To review minor backward-incompatible changes, see [BIC reference]({{page.baseurl}}/release-notes/backward-incompatible-changes/reference.html). (Major backward-incompatible issues are described in [BIC highlights]({{page.baseurl}}/release-notes/backward-incompatible-changes/index.html). Not all releases introduce major BICs.)
13+
14+
## What's in this release?
15+
16+
Six security fixes and several security enhancements are included in this security patch. Security fixes are documented in the [Adobe Security Bulletin](https://helpx.adobe.com/security/products/magento/apsb21-86.html).
17+
18+
Security-only patches typically include all hotfixes that have been released for the preceding complete release. This release incorporates the two hotfixes that have been released for {{ site.data.var.ee }} 2.3.7-p1 and {{ site.data.var.ce }} 2.3.7-p1. See [Adobe Commerce 2.3.7-p1 Release Notes]({{page.baseurl}}/release-notes/2-3-7-p1.html) for information about these hotfixes.
19+
20+
This release also includes bug fixes for the [Klarna](https://docs.magento.com/user-guide/v2.3/payment/klarna.html) and [Vertex](https://docs.magento.com/user-guide/v2.3/tax/vertex.html) vendor-developed extensions.
21+
22+
### Resolution of known issues in Adobe Commerce 2.3.7-p1
23+
24+
This release includes fixes for the following known issues, which were first identified in {{ site.data.var.ee }} 2.3.7-p1:
25+
26+
* *PHP fatal error on upgrade*. This issue was previously addressed by patch `AC-384__Fix_Incompatible_PHP_Method__2.3.7-p1_ce.patch to address PHP fatal error on upgrade`.
27+
28+
* *Previously placed order price is displayed when a shopper tries to place an order with a different product using the PayPal payment method*. This issue was previously addressed by patch `Adobe Commerce 2.3.7-p1 known issue outdated order total for PayPal`.
29+
30+
### Security highlights
31+
32+
**Session IDs have been removed from the database**. This code change may result in breaking changes if merchants have customizations or installed extensions that use the raw session IDs stored in the database. <!--- MC-40976-->
33+
34+
**Restricted admin access to Media Gallery folders**. Default Media Gallery permissions now allow only directory operations (view, upload, delete, and create) that are explicitly allowed by configuration. Admin users can no longer access media assets through the Media Gallery that were uploaded outside of the `catalog/category` or `wysiwyg` directories. Administrators who want to access media assets must move them to an explicitly allowed folder or adjust their configuration settings. See [Modify Media Library folder permissions]({{page.baseurl}}/ext-best-practices/tutorials/modify-image-library-permissions/). <!--- B2B-1897-->
35+
36+
**Lowered limits to GraphQL query complexity**. The GraphQL maximum allowed query complexity has been lowered to prevent Denial-of-Service (DOS) attacks. See [GraphQL security configuration]({{page.baseurl}}/graphql/security-configuration.html). <!--- PWA-1700-->
37+
38+
**Recent penetration test vulnerabilities** have been fixed in this release. <!--- MC-42431-->
39+
40+
The Content Security Policy directive `frame-ancestors` now supports the source expression `unsafe-inline`. [GitHub-33101](https://github.com/magento/magento2/issues/33101) <!--- MC-42632-->
41+
42+
## Known issue
43+
44+
**Issue**: Adobe Stock images uploaded into the `<install_dir>/pub/media` and `<install_dir>/pub/media/catalog` directories are not visible in the Media Gallery. **Workaround**: To view and work with these images, delete them from the filesystem directories and re-upload them into an allowed Media Gallery directory. See the [Stock images not displayed, Adobe Commerce and Magento Open Source 2.3.7-p2](https://support.magento.com/hc/en-us/articles/4409491698189) Knowledge Base article.
45+
46+
## Installation and upgrade instructions
47+
48+
For instructions on downloading and applying security-only patches (including patch 2.3.7-p2), see [Quick start install]({{site.baseurl}}/guides/v2.4/install-gde/composer.html).
49+
50+
## More information?
51+
52+
For general information about security-only patches, see the Magento DevBlog post [Introducing the New Security-only Patch Release](https://community.magento.com/t5/Magento-DevBlog/Introducing-the-New-Security-only-Patch-Release/ba-p/141287).

0 commit comments

Comments
 (0)