Skip to content

Commit 1106fbd

Browse files
nathanjosiahnathanjosiah
authored
Merge pull request #4087 from magento-borg/borg-qwerty-2.3
[borg] Bug fixes
2 parents b6ae02f + b5069d3 commit 1106fbd

File tree

7 files changed

+69
-28
lines changed

7 files changed

+69
-28
lines changed

‎app/code/Magento/Captcha/Model/DefaultModel.php

Lines changed: 17 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -3,13 +3,18 @@
33
* Copyright © Magento, Inc. All rights reserved.
44
* See COPYING.txt for license details.
55
*/
6+
declare(strict_types=1);
7+
68
namespace Magento\Captcha\Model;
79

810
use Magento\Captcha\Helper\Data;
11+
use Magento\Framework\Math\Random;
912

1013
/**
1114
* Implementation of \Zend\Captcha\Image
1215
*
16+
* @SuppressWarnings(PHPMD.CookieAndSessionMisuse)
17+
*
1318
* @api
1419
* @since 100.0.2
1520
*/
@@ -83,24 +88,32 @@ class DefaultModel extends \Zend\Captcha\Image implements \Magento\Captcha\Model
8388
*/
8489
private $words;
8590

91+
/**
92+
* @var Random
93+
*/
94+
private $randomMath;
95+
8696
/**
8797
* @param \Magento\Framework\Session\SessionManagerInterface $session
8898
* @param \Magento\Captcha\Helper\Data $captchaData
8999
* @param ResourceModel\LogFactory $resLogFactory
90100
* @param string $formId
101+
* @param Random $randomMath
91102
* @throws \Zend\Captcha\Exception\ExtensionNotLoadedException
92103
*/
93104
public function __construct(
94105
\Magento\Framework\Session\SessionManagerInterface $session,
95106
\Magento\Captcha\Helper\Data $captchaData,
96107
\Magento\Captcha\Model\ResourceModel\LogFactory $resLogFactory,
97-
$formId
108+
$formId,
109+
Random $randomMath = null
98110
) {
99111
parent::__construct();
100112
$this->session = $session;
101113
$this->captchaData = $captchaData;
102114
$this->resLogFactory = $resLogFactory;
103115
$this->formId = $formId;
116+
$this->randomMath = $randomMath ?? \Magento\Framework\App\ObjectManager::getInstance()->get(Random::class);
104117
}
105118

106119
/**
@@ -382,23 +395,9 @@ public function setShowCaptchaInSession($value = true)
382395
*/
383396
protected function generateWord()
384397
{
385-
$word = '';
386-
$symbols = $this->getSymbols();
398+
$symbols = (string)$this->captchaData->getConfig('symbols');
387399
$wordLen = $this->getWordLen();
388-
for ($i = 0; $i < $wordLen; $i++) {
389-
$word .= $symbols[array_rand($symbols)];
390-
}
391-
return $word;
392-
}
393-
394-
/**
395-
* Get symbols array to use for word generation
396-
*
397-
* @return array
398-
*/
399-
private function getSymbols()
400-
{
401-
return str_split((string)$this->captchaData->getConfig('symbols'));
400+
return $this->randomMath->getRandomString($wordLen, $symbols);
402401
}
403402

404403
/**
@@ -562,7 +561,7 @@ protected function randomSize()
562561
*/
563562
protected function gc()
564563
{
565-
//do nothing
564+
return; // required for static testing to pass
566565
}
567566

568567
/**

‎app/code/Magento/Captcha/Test/Unit/Model/DefaultTest.php

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,8 +3,12 @@
33
* Copyright © Magento, Inc. All rights reserved.
44
* See COPYING.txt for license details.
55
*/
6+
declare(strict_types=1);
7+
68
namespace Magento\Captcha\Test\Unit\Model;
79

10+
use Magento\Framework\Math\Random;
11+
812
/**
913
* @SuppressWarnings(PHPMD.CouplingBetweenObjects)
1014
*/
@@ -375,4 +379,38 @@ public function isShownToLoggedInUserDataProvider()
375379
[false, 'user_forgotpassword']
376380
];
377381
}
382+
383+
/**
384+
* @param string $string
385+
* @dataProvider generateWordProvider
386+
* @throws \ReflectionException
387+
*/
388+
public function testGenerateWord($string)
389+
{
390+
$randomMock = $this->createMock(Random::class);
391+
$randomMock->expects($this->once())
392+
->method('getRandomString')
393+
->will($this->returnValue($string));
394+
$captcha = new \Magento\Captcha\Model\DefaultModel(
395+
$this->session,
396+
$this->_getHelperStub(),
397+
$this->_resLogFactory,
398+
'user_create',
399+
$randomMock
400+
);
401+
$method = new \ReflectionMethod($captcha, 'generateWord');
402+
$method->setAccessible(true);
403+
$this->assertEquals($string, $method->invoke($captcha));
404+
}
405+
/**
406+
* @return array
407+
*/
408+
public function generateWordProvider()
409+
{
410+
return [
411+
['ABC123'],
412+
['1234567890'],
413+
['The quick brown fox jumps over the lazy dog.']
414+
];
415+
}
378416
}

‎app/code/Magento/Customer/etc/adminhtml/system.xml

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -280,6 +280,7 @@
280280
</field>
281281
<field id="html" translate="label" type="textarea" sortOrder="3" showInDefault="1" showInWebsite="1" showInStore="1" canRestore="1">
282282
<label>HTML</label>
283+
<comment>Only 'b', 'br', 'em', 'i', 'li', 'ol', 'p', 'strong', 'sub', 'sup', 'ul' tags are allowed</comment>
283284
</field>
284285
<field id="pdf" translate="label" type="textarea" sortOrder="4" showInDefault="1" showInWebsite="1" showInStore="1" canRestore="1">
285286
<label>PDF</label>

‎app/code/Magento/Customer/i18n/en_US.csv

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -500,6 +500,7 @@ Strong,Strong
500500
"Address Templates","Address Templates"
501501
"Online Customers Options","Online Customers Options"
502502
"Online Minutes Interval","Online Minutes Interval"
503+
"Only 'b', 'br', 'em', 'i', 'li', 'ol', 'p', 'strong', 'sub', 'sup', 'ul' tags are allowed","Only 'b', 'br', 'em', 'i', 'li', 'ol', 'p', 'strong', 'sub', 'sup', 'ul' tags are allowed"
503504
"Leave empty for default (15 minutes).","Leave empty for default (15 minutes)."
504505
"Customer Notification","Customer Notification"
505506
"Customer Grid","Customer Grid"

‎app/code/Magento/Customer/view/adminhtml/templates/tab/view/personal_info.phtml

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,7 @@ $lastLoginDateStore = $block->getStoreLastLoginDate();
1313

1414
$createDateAdmin = $block->getCreateDate();
1515
$createDateStore = $block->getStoreCreateDate();
16+
$allowedAddressHtmlTags = ['b', 'br', 'em', 'i', 'li', 'ol', 'p', 'strong', 'sub', 'sup', 'ul'];
1617
?>
1718
<div class="fieldset-wrapper customer-information">
1819
<div class="fieldset-wrapper-title">
@@ -61,7 +62,7 @@ $createDateStore = $block->getStoreCreateDate();
6162
</table>
6263
<address>
6364
<strong><?= $block->escapeHtml(__('Default Billing Address')) ?></strong><br/>
64-
<?= $block->getBillingAddressHtml() ?>
65+
<?= $block->escapeHtml($block->getBillingAddressHtml(), $allowedAddressHtmlTags) ?>
6566
</address>
6667

6768
</div>

‎app/code/Magento/Sales/view/adminhtml/templates/order/create/data.phtml

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@
1010
<div class="page-create-order">
1111
<script>
1212
require(["Magento_Sales/order/create/form"], function(){
13-
order.setCurrencySymbol('<?= /* @escapeNotVerified */ $block->getCurrencySymbol($block->getCurrentCurrencyCode()) ?>')
13+
order.setCurrencySymbol('<?= $block->escapeJs($block->getCurrencySymbol($block->getCurrentCurrencyCode())) ?>')
1414
});
1515
</script>
1616
<div class="order-details<?php if ($block->getCustomerId()): ?> order-details-existing-customer<?php endif; ?>">
@@ -35,7 +35,7 @@
3535

3636
<section id="order-addresses" class="admin__page-section order-addresses">
3737
<div class="admin__page-section-title">
38-
<span class="title"><?= /* @escapeNotVerified */ __('Address Information') ?></span>
38+
<span class="title"><?= $block->escapeHtml(__('Address Information')) ?></span>
3939
</div>
4040
<div class="admin__page-section-content">
4141
<div id="order-billing_address" class="admin__page-section-item order-billing-address">
@@ -69,11 +69,11 @@
6969

7070
<section class="admin__page-section order-summary">
7171
<div class="admin__page-section-title">
72-
<span class="title"><?= /* @escapeNotVerified */ __('Order Total') ?></span>
72+
<span class="title"><?= $block->escapeHtml(__('Order Total')) ?></span>
7373
</div>
7474
<div class="admin__page-section-content">
7575
<fieldset class="admin__fieldset order-history" id="order-comment">
76-
<legend class="admin__legend"><span><?= /* @escapeNotVerified */ __('Order History') ?></span></legend>
76+
<legend class="admin__legend"><span><?= $block->escapeHtml(__('Order History')) ?></span></legend>
7777
<br>
7878
<?= $block->getChildHtml('comment') ?>
7979
</fieldset>
@@ -88,15 +88,15 @@
8888
<div class="order-sidebar">
8989
<div class="store-switcher order-currency">
9090
<label class="admin__field-label" for="currency_switcher">
91-
<?= /* @escapeNotVerified */ __('Order Currency:') ?>
91+
<?= $block->escapeHtml(__('Order Currency:')) ?>
9292
</label>
9393
<select id="currency_switcher"
9494
class="admin__control-select"
9595
name="order[currency]"
9696
onchange="order.setCurrencyId(this.value); order.setCurrencySymbol(this.options[this.selectedIndex].getAttribute('symbol'));">
9797
<?php foreach ($block->getAvailableCurrencies() as $_code): ?>
98-
<option value="<?= /* @escapeNotVerified */ $_code ?>"<?php if ($_code == $block->getCurrentCurrencyCode()): ?> selected="selected"<?php endif; ?> symbol="<?= /* @escapeNotVerified */ $block->getCurrencySymbol($_code) ?>">
99-
<?= /* @escapeNotVerified */ $block->getCurrencyName($_code) ?>
98+
<option value="<?= $block->escapeHtmlAttr($_code) ?>"<?php if ($_code == $block->getCurrentCurrencyCode()): ?> selected="selected"<?php endif; ?> symbol="<?=$block->escapeHtmlAttr($block->getCurrencySymbol($_code)) ?>">
99+
<?= $block->escapeHtml($block->getCurrencyName($_code)) ?>
100100
</option>
101101
<?php endforeach; ?>
102102
</select>

‎app/code/Magento/Sales/view/adminhtml/templates/order/view/info.phtml

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,7 @@ $orderStoreDate = $block->formatDate(
2626
);
2727

2828
$customerUrl = $block->getCustomerViewUrl();
29+
$allowedAddressHtmlTags = ['b', 'br', 'em', 'i', 'li', 'ol', 'p', 'strong', 'sub', 'sup', 'ul'];
2930
?>
3031

3132
<section class="admin__page-section order-view-account-information">
@@ -171,7 +172,7 @@ $customerUrl = $block->getCustomerViewUrl();
171172
<span class="title"><?= $block->escapeHtml(__('Billing Address')) ?></span>
172173
<div class="actions"><?= /* @noEscape */ $block->getAddressEditLink($order->getBillingAddress()); ?></div>
173174
</div>
174-
<address class="admin__page-section-item-content"><?= /* @noEscape */ $block->getFormattedAddress($order->getBillingAddress()); ?></address>
175+
<address class="admin__page-section-item-content"><?= $block->escapeHtml($block->getFormattedAddress($order->getBillingAddress()), $allowedAddressHtmlTags); ?></address>
175176
</div>
176177
<?php if (!$block->getOrder()->getIsVirtual()): ?>
177178
<div class="admin__page-section-item order-shipping-address">
@@ -180,7 +181,7 @@ $customerUrl = $block->getCustomerViewUrl();
180181
<span class="title"><?= $block->escapeHtml(__('Shipping Address')) ?></span>
181182
<div class="actions"><?= /* @noEscape */ $block->getAddressEditLink($order->getShippingAddress()); ?></div>
182183
</div>
183-
<address class="admin__page-section-item-content"><?= /* @noEscape */ $block->getFormattedAddress($order->getShippingAddress()); ?></address>
184+
<address class="admin__page-section-item-content"><?= $block->escapeHtml($block->getFormattedAddress($order->getShippingAddress()), $allowedAddressHtmlTags); ?></address>
184185
</div>
185186
<?php endif; ?>
186187
</div>

0 commit comments

Comments
 (0)