Skip to content

Commit 10df823

Browse files
admanesachinadmanesachin
committed
Merge branch 'MC-38365' of github.com:magento-cia/magento2ce into cia-2.3.7-1152021
2 parents bbedf18 + 1fec323 commit 10df823

File tree

25 files changed

+327
-175
lines changed

25 files changed

+327
-175
lines changed

‎app/code/Magento/Checkout/view/frontend/web/js/sidebar.js

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -64,11 +64,14 @@ define([
6464
events['click ' + this.options.button.checkout] = $.proxy(function () {
6565
var cart = customerData.get('cart'),
6666
customer = customerData.get('customer'),
67+
cookieOptions = {
68+
samesite: 'lax'
69+
},
6770
element = $(this.options.button.checkout);
6871

6972
if (!customer().firstname && cart().isGuestCheckoutAllowed === false) {
7073
// set URL for redirect on successful login/registration. It's postprocessed on backend.
71-
$.cookie('login_redirect', this.options.url.checkout);
74+
$.cookie('login_redirect', this.options.url.checkout, cookieOptions);
7275

7376
if (this.options.url.isRedirectRequired) {
7477
element.prop('disabled', true);

‎app/code/Magento/Cookie/view/base/web/js/jquery.storageapi.extended.js

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,7 @@ define([
1818
function _extend(storage) {
1919
$.extend(storage, {
2020
_secure: window.cookiesConfig ? window.cookiesConfig.secure : false,
21+
_samesite: window.cookiesConfig ? window.cookiesConfig.samesite : 'lax',
2122

2223
/**
2324
* Set value under name
@@ -30,7 +31,8 @@ define([
3031
expires: this._expires,
3132
path: this._path,
3233
domain: this._domain,
33-
secure: this._secure
34+
secure: this._secure,
35+
samesite: this._samesite
3436
};
3537

3638
$.cookie(this._prefix + name, value, $.extend(_default, options || {}));
@@ -58,6 +60,10 @@ define([
5860
this._secure = c.secure;
5961
}
6062

63+
if (typeof c.samesite !== 'undefined') {
64+
this._samesite = c.samesite;
65+
}
66+
6167
return this;
6268
}
6369
});

‎app/code/Magento/Customer/view/frontend/web/js/customer-data.js

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -32,7 +32,8 @@ define([
3232
//TODO: remove global change, in this case made for initNamespaceStorage
3333
$.cookieStorage.setConf({
3434
path: '/',
35-
expires: 1
35+
expires: 1,
36+
samesite: 'lax'
3637
});
3738

3839
storage = $.initNamespaceStorage('mage-cache-storage').localStorage;

‎app/code/Magento/PageCache/Plugin/RegisterFormKeyFromCookie.php

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -96,6 +96,7 @@ private function updateCookieFormKey(string $formKey): void
9696
$cookieMetadata->setDomain($this->sessionConfig->getCookieDomain());
9797
$cookieMetadata->setPath($this->sessionConfig->getCookiePath());
9898
$cookieMetadata->setSecure($this->sessionConfig->getCookieSecure());
99+
$cookieMetadata->setSameSite('Lax');
99100
$lifetime = $this->sessionConfig->getCookieLifetime();
100101
if ($lifetime !== 0) {
101102
$cookieMetadata->setDuration($lifetime);

‎app/code/Magento/Persistent/Model/Session.php

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,7 @@
1212
* @method int getCustomerId()
1313
* @method Session setCustomerId()
1414
* @SuppressWarnings(PHPMD.CouplingBetweenObjects)
15+
* @SuppressWarnings(PHPMD.CookieAndSessionMisuse)
1516
* @since 100.0.2
1617
*/
1718
class Session extends \Magento\Framework\Model\AbstractModel
@@ -391,7 +392,8 @@ private function setCookie($value, $duration, $path)
391392
->setDuration($duration)
392393
->setPath($path)
393394
->setSecure($this->getRequest()->isSecure())
394-
->setHttpOnly(true);
395+
->setHttpOnly(true)
396+
->setSameSite('Lax');
395397
$this->_cookieManager->setPublicCookie(
396398
self::COOKIE_NAME,
397399
$value,

‎app/code/Magento/Persistent/Test/Unit/Model/SessionTest.php

Lines changed: 61 additions & 48 deletions
Original file line numberDiff line numberDiff line change
@@ -3,42 +3,58 @@
33
* Copyright © Magento, Inc. All rights reserved.
44
* See COPYING.txt for license details.
55
*/
6+
declare(strict_types=1);
7+
68
namespace Magento\Persistent\Test\Unit\Model;
79

8-
class SessionTest extends \PHPUnit\Framework\TestCase
10+
use Magento\Framework\App\Request\Http;
11+
use Magento\Framework\Model\ActionValidator\RemoveAction;
12+
use Magento\Framework\Model\Context;
13+
use Magento\Framework\Model\ResourceModel\Db\AbstractDb;
14+
use Magento\Framework\Session\Config\ConfigInterface;
15+
use Magento\Framework\Stdlib\Cookie\CookieMetadataFactory;
16+
use Magento\Framework\Stdlib\Cookie\PublicCookieMetadata;
17+
use Magento\Framework\Stdlib\Cookie\SensitiveCookieMetadata;
18+
use Magento\Framework\Stdlib\CookieManagerInterface;
19+
use Magento\Framework\TestFramework\Unit\Helper\ObjectManager;
20+
use Magento\Persistent\Model\Session;
21+
use PHPUnit\Framework\MockObject\MockObject;
22+
use PHPUnit\Framework\TestCase;
23+
24+
class SessionTest extends TestCase
925
{
1026
/**
11-
* @var \Magento\Persistent\Model\Session
27+
* @var Session
1228
*/
1329
protected $session;
1430

1531
/**
16-
* @var \Magento\Framework\Session\Config\ConfigInterface|\PHPUnit_Framework_MockObject_MockObject
32+
* @var ConfigInterface|MockObject
1733
*/
1834
protected $configMock;
1935

2036
/**
21-
* @var \Magento\Framework\Stdlib\CookieManagerInterface |\PHPUnit_Framework_MockObject_MockObject
37+
* @var CookieManagerInterface|MockObject
2238
*/
2339
protected $cookieManagerMock;
2440

2541
/**
26-
* @var \Magento\Framework\Stdlib\Cookie\CookieMetadataFactory |\PHPUnit_Framework_MockObject_MockObject
42+
* @var CookieMetadataFactory|MockObject
2743
*/
2844
protected $cookieMetadataFactoryMock;
2945

30-
protected function setUp()
46+
protected function setUp(): void
3147
{
32-
$helper = new \Magento\Framework\TestFramework\Unit\Helper\ObjectManager($this);
33-
$this->configMock = $this->createMock(\Magento\Framework\Session\Config\ConfigInterface::class);
34-
$this->cookieManagerMock = $this->createMock(\Magento\Framework\Stdlib\CookieManagerInterface::class);
48+
$helper = new ObjectManager($this);
49+
$this->configMock = $this->getMockForAbstractClass(ConfigInterface::class);
50+
$this->cookieManagerMock = $this->getMockForAbstractClass(CookieManagerInterface::class);
3551
$this->cookieMetadataFactoryMock = $this->getMockBuilder(
36-
\Magento\Framework\Stdlib\Cookie\CookieMetadataFactory::class
52+
CookieMetadataFactory::class
3753
)->disableOriginalConstructor()
3854
->getMock();
3955

4056
$resourceMock = $this->getMockForAbstractClass(
41-
\Magento\Framework\Model\ResourceModel\Db\AbstractDb::class,
57+
AbstractDb::class,
4258
[],
4359
'',
4460
false,
@@ -47,24 +63,24 @@ protected function setUp()
4763
['__wakeup', 'getIdFieldName', 'getConnection', 'beginTransaction', 'delete', 'commit', 'rollBack']
4864
);
4965

50-
$actionValidatorMock = $this->createMock(\Magento\Framework\Model\ActionValidator\RemoveAction::class);
51-
$actionValidatorMock->expects($this->any())->method('isAllowed')->will($this->returnValue(true));
66+
$actionValidatorMock = $this->createMock(RemoveAction::class);
67+
$actionValidatorMock->expects($this->any())->method('isAllowed')->willReturn(true);
5268

5369
$context = $helper->getObject(
54-
\Magento\Framework\Model\Context::class,
70+
Context::class,
5571
[
5672
'actionValidator' => $actionValidatorMock,
5773
]
5874
);
5975

6076
$this->session = $helper->getObject(
61-
\Magento\Persistent\Model\Session::class,
77+
Session::class,
6278
[
6379
'sessionConfig' => $this->configMock,
6480
'cookieManager' => $this->cookieManagerMock,
6581
'context' => $context,
6682
'cookieMetadataFactory' => $this->cookieMetadataFactoryMock,
67-
'request' => $this->createMock(\Magento\Framework\App\Request\Http::class),
83+
'request' => $this->createMock(Http::class),
6884
'resource' => $resourceMock,
6985
]
7086
);
@@ -74,8 +90,8 @@ public function testLoadByCookieKeyWithNull()
7490
{
7591
$this->cookieManagerMock->expects($this->once())
7692
->method('getCookie')
77-
->with(\Magento\Persistent\Model\Session::COOKIE_NAME)
78-
->will($this->returnValue(null));
93+
->with(Session::COOKIE_NAME)
94+
->willReturn(null);
7995
$this->session->loadByCookieKey(null);
8096
}
8197

@@ -85,23 +101,22 @@ public function testLoadByCookieKeyWithNull()
85101
public function testAfterDeleteCommit()
86102
{
87103
$cookiePath = 'some_path';
88-
$this->configMock->expects($this->once())->method('getCookiePath')->will($this->returnValue($cookiePath));
89-
$cookieMetadataMock = $this->getMockBuilder(\Magento\Framework\Stdlib\Cookie\SensitiveCookieMetadata::class)
104+
$this->configMock->expects($this->once())->method('getCookiePath')->willReturn($cookiePath);
105+
$cookieMetadataMock = $this->getMockBuilder(SensitiveCookieMetadata::class)
90106
->disableOriginalConstructor()
91107
->getMock();
92108
$cookieMetadataMock->expects($this->once())
93109
->method('setPath')
94-
->with($cookiePath)
95-
->will($this->returnSelf());
110+
->with($cookiePath)->willReturnSelf();
96111
$this->cookieMetadataFactoryMock->expects($this->once())
97112
->method('createSensitiveCookieMetadata')
98-
->will($this->returnValue($cookieMetadataMock));
113+
->willReturn($cookieMetadataMock);
99114
$this->cookieManagerMock->expects(
100115
$this->once()
101116
)->method(
102117
'deleteCookie'
103118
)->with(
104-
\Magento\Persistent\Model\Session::COOKIE_NAME,
119+
Session::COOKIE_NAME,
105120
$cookieMetadataMock
106121
);
107122
$this->session->afterDeleteCommit();
@@ -113,32 +128,31 @@ public function testSetPersistentCookie()
113128
$duration = 1000;
114129
$key = 'sessionKey';
115130
$this->session->setKey($key);
116-
$cookieMetadataMock = $this->getMockBuilder(\Magento\Framework\Stdlib\Cookie\PublicCookieMetadata::class)
131+
$cookieMetadataMock = $this->getMockBuilder(PublicCookieMetadata::class)
117132
->disableOriginalConstructor()
118133
->getMock();
119134
$cookieMetadataMock->expects($this->once())
120135
->method('setPath')
121-
->with($cookiePath)
122-
->will($this->returnSelf());
136+
->with($cookiePath)->willReturnSelf();
123137
$cookieMetadataMock->expects($this->once())
124138
->method('setDuration')
125-
->with($duration)
126-
->will($this->returnSelf());
139+
->with($duration)->willReturnSelf();
127140
$cookieMetadataMock->expects($this->once())
128141
->method('setSecure')
129-
->with(false)
130-
->will($this->returnSelf());
142+
->with(false)->willReturnSelf();
131143
$cookieMetadataMock->expects($this->once())
132144
->method('setHttpOnly')
133-
->with(true)
134-
->will($this->returnSelf());
145+
->with(true)->willReturnSelf();
146+
$cookieMetadataMock->expects($this->once())
147+
->method('setSameSite')
148+
->with('Lax')->willReturnSelf();
135149
$this->cookieMetadataFactoryMock->expects($this->once())
136150
->method('createPublicCookieMetadata')
137-
->will($this->returnValue($cookieMetadataMock));
151+
->willReturn($cookieMetadataMock);
138152
$this->cookieManagerMock->expects($this->once())
139153
->method('setPublicCookie')
140154
->with(
141-
\Magento\Persistent\Model\Session::COOKIE_NAME,
155+
Session::COOKIE_NAME,
142156
$key,
143157
$cookieMetadataMock
144158
);
@@ -160,36 +174,35 @@ public function testRenewPersistentCookie(
160174
$cookieValue = 'cookieValue',
161175
$cookiePath = 'cookiePath'
162176
) {
163-
$cookieMetadataMock = $this->getMockBuilder(\Magento\Framework\Stdlib\Cookie\PublicCookieMetadata::class)
177+
$cookieMetadataMock = $this->getMockBuilder(PublicCookieMetadata::class)
164178
->disableOriginalConstructor()
165179
->getMock();
166180
$cookieMetadataMock->expects($this->exactly($numCalls))
167181
->method('setPath')
168-
->with($cookiePath)
169-
->will($this->returnSelf());
182+
->with($cookiePath)->willReturnSelf();
170183
$cookieMetadataMock->expects($this->exactly($numCalls))
171184
->method('setDuration')
172-
->with($cookieDuration)
173-
->will($this->returnSelf());
185+
->with($cookieDuration)->willReturnSelf();
174186
$cookieMetadataMock->expects($this->exactly($numCalls))
175187
->method('setSecure')
176-
->with(false)
177-
->will($this->returnSelf());
188+
->with(false)->willReturnSelf();
178189
$cookieMetadataMock->expects($this->exactly($numCalls))
179190
->method('setHttpOnly')
180-
->with(true)
181-
->will($this->returnSelf());
191+
->with(true)->willReturnSelf();
192+
$cookieMetadataMock->expects($this->exactly($numCalls))
193+
->method('setSameSite')
194+
->with('Lax')->willReturnSelf();
182195
$this->cookieMetadataFactoryMock->expects($this->exactly($numCalls))
183196
->method('createPublicCookieMetadata')
184-
->will($this->returnValue($cookieMetadataMock));
197+
->willReturn($cookieMetadataMock);
185198
$this->cookieManagerMock->expects($this->exactly($numGetCookieCalls))
186199
->method('getCookie')
187-
->with(\Magento\Persistent\Model\Session::COOKIE_NAME)
188-
->will($this->returnValue($cookieValue));
200+
->with(Session::COOKIE_NAME)
201+
->willReturn($cookieValue);
189202
$this->cookieManagerMock->expects($this->exactly($numCalls))
190203
->method('setPublicCookie')
191204
->with(
192-
\Magento\Persistent\Model\Session::COOKIE_NAME,
205+
Session::COOKIE_NAME,
193206
$cookieValue,
194207
$cookieMetadataMock
195208
);

‎app/code/Magento/Sales/Helper/Guest.php

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,7 @@
1515
/**
1616
* Sales module base helper
1717
* @SuppressWarnings(PHPMD.CouplingBetweenObjects)
18+
* @SuppressWarnings(PHPMD.CookieAndSessionMisuse)
1819
*/
1920
class Guest extends \Magento\Framework\App\Helper\AbstractHelper
2021
{
@@ -71,7 +72,7 @@ class Guest extends \Magento\Framework\App\Helper\AbstractHelper
7172
const COOKIE_NAME = 'guest-view';
7273

7374
/**
74-
* Cookie path
75+
* Cookie path value
7576
*/
7677
const COOKIE_PATH = '/';
7778

@@ -209,7 +210,8 @@ private function setGuestViewCookie($cookieValue)
209210
{
210211
$metadata = $this->cookieMetadataFactory->createPublicCookieMetadata()
211212
->setPath(self::COOKIE_PATH)
212-
->setHttpOnly(true);
213+
->setHttpOnly(true)
214+
->setSameSite('Lax');
213215
$this->cookieManager->setPublicCookie(self::COOKIE_NAME, $cookieValue, $metadata);
214216
}
215217

@@ -224,6 +226,7 @@ private function setGuestViewCookie($cookieValue)
224226
*/
225227
private function loadFromCookie($fromCookie)
226228
{
229+
// phpcs:ignore Magento2.Functions.DiscouragedFunction
227230
$cookieData = explode(':', base64_decode($fromCookie));
228231
$protectCode = isset($cookieData[0]) ? $cookieData[0] : null;
229232
$incrementId = isset($cookieData[1]) ? $cookieData[1] : null;

‎app/code/Magento/Sales/Test/Unit/Helper/GuestTest.php

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -159,6 +159,10 @@ public function testLoadValidOrderNotEmptyPost()
159159
->method('setHttpOnly')
160160
->with(true)
161161
->willReturnSelf();
162+
$metaDataMock->expects($this->once())
163+
->method('setSameSite')
164+
->with('Lax')
165+
->willReturnSelf();
162166
$this->cookieMetadataFactoryMock->expects($this->once())
163167
->method('createPublicCookieMetadata')
164168
->willReturn($metaDataMock);
@@ -190,6 +194,10 @@ public function testLoadValidOrderStoredCookie()
190194
->method('setHttpOnly')
191195
->with(true)
192196
->willReturnSelf();
197+
$metaDataMock->expects($this->once())
198+
->method('setSameSite')
199+
->with('Lax')
200+
->willReturnSelf();
193201
$this->cookieMetadataFactoryMock->expects($this->once())
194202
->method('createPublicCookieMetadata')
195203
->willReturn($metaDataMock);

‎app/code/Magento/Security/Model/SecurityCookie.php

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,7 @@
1010
/**
1111
* Manager for a cookie with logout reason
1212
*
13+
* @SuppressWarnings(PHPMD.CookieAndSessionMisuse)
1314
* @api
1415
* @since 100.1.0
1516
*/
@@ -80,6 +81,7 @@ public function setLogoutReasonCookie($status)
8081
{
8182
$metaData = $this->createCookieMetaData();
8283
$metaData->setPath('/' . $this->backendData->getAreaFrontName());
84+
$metaData->setSameSite('Strict');
8385

8486
$this->phpCookieManager->setPublicCookie(
8587
self::LOGOUT_REASON_CODE_COOKIE_NAME,

0 commit comments

Comments
 (0)