Skip to content

Commit 1ee941e

Browse files
author
Oleksii Korshenko
committed
Merge remote-tracking branch 'mainline/develop' into public
2 parents 2911074 + f8cc46a commit 1ee941e

File tree

185 files changed

+4094
-2813
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

185 files changed

+4094
-2813
lines changed

‎app/code/Magento/Authorizenet/Model/Authorizenet.php

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -104,6 +104,11 @@ abstract class Authorizenet extends \Magento\Payment\Model\Method\Cc
104104
*/
105105
protected $_debugReplacePrivateDataKeys = ['merchantAuthentication', 'x_login'];
106106

107+
/**
108+
* @var \Magento\Framework\Xml\Security
109+
*/
110+
protected $xmlSecurityHelper;
111+
107112
/**
108113
* @param \Magento\Framework\Model\Context $context
109114
* @param \Magento\Framework\Registry $registry
@@ -117,6 +122,7 @@ abstract class Authorizenet extends \Magento\Payment\Model\Method\Cc
117122
* @param \Magento\Authorizenet\Helper\Data $dataHelper
118123
* @param \Magento\Authorizenet\Model\Request\Factory $requestFactory
119124
* @param \Magento\Authorizenet\Model\Response\Factory $responseFactory
125+
* @param \Magento\Framework\Xml\Security $xmlSecurityHelper
120126
* @param \Magento\Framework\Model\Resource\AbstractResource $resource
121127
* @param \Magento\Framework\Data\Collection\AbstractDb $resourceCollection
122128
* @param array $data
@@ -135,13 +141,15 @@ public function __construct(
135141
\Magento\Authorizenet\Helper\Data $dataHelper,
136142
\Magento\Authorizenet\Model\Request\Factory $requestFactory,
137143
\Magento\Authorizenet\Model\Response\Factory $responseFactory,
144+
\Magento\Framework\Xml\Security $xmlSecurityHelper,
138145
\Magento\Framework\Model\Resource\AbstractResource $resource = null,
139146
\Magento\Framework\Data\Collection\AbstractDb $resourceCollection = null,
140147
array $data = []
141148
) {
142149
$this->dataHelper = $dataHelper;
143150
$this->requestFactory = $requestFactory;
144151
$this->responseFactory = $responseFactory;
152+
$this->xmlSecurityHelper = $xmlSecurityHelper;
145153

146154
parent::__construct(
147155
$context,
@@ -489,6 +497,10 @@ protected function loadTransactionDetails($transactionId)
489497

490498
try {
491499
$responseBody = $client->request()->getBody();
500+
if (!$this->xmlSecurityHelper->scan($responseBody)) {
501+
$this->_logger->critical('Attempt loading of external XML entities in response from Authorizenet.');
502+
throw new \Exception();
503+
}
492504
$debugData['response'] = $responseBody;
493505
libxml_use_internal_errors(true);
494506
$responseXmlDocument = new \Magento\Framework\Simplexml\Element($responseBody);

‎app/code/Magento/Authorizenet/Model/Directpost.php

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -130,6 +130,7 @@ class Directpost extends \Magento\Authorizenet\Model\Authorizenet implements Tra
130130
* @param \Magento\Authorizenet\Helper\Data $dataHelper
131131
* @param \Magento\Authorizenet\Model\Directpost\Request\Factory $requestFactory
132132
* @param \Magento\Authorizenet\Model\Directpost\Response\Factory $responseFactory
133+
* @param \Magento\Framework\Xml\Security $xmlSecurityHelper
133134
* @param \Magento\Sales\Model\OrderFactory $orderFactory
134135
* @param \Magento\Store\Model\StoreManagerInterface $storeManager
135136
* @param \Magento\Quote\Model\QuoteRepository $quoteRepository
@@ -153,6 +154,7 @@ public function __construct(
153154
\Magento\Authorizenet\Helper\Data $dataHelper,
154155
\Magento\Authorizenet\Model\Directpost\Request\Factory $requestFactory,
155156
\Magento\Authorizenet\Model\Directpost\Response\Factory $responseFactory,
157+
\Magento\Framework\Xml\Security $xmlSecurityHelper,
156158
\Magento\Sales\Model\OrderFactory $orderFactory,
157159
\Magento\Store\Model\StoreManagerInterface $storeManager,
158160
\Magento\Quote\Model\QuoteRepository $quoteRepository,
@@ -183,6 +185,7 @@ public function __construct(
183185
$dataHelper,
184186
$requestFactory,
185187
$responseFactory,
188+
$xmlSecurityHelper,
186189
$resource,
187190
$resourceCollection,
188191
$data

‎app/code/Magento/Authorizenet/etc/adminhtml/system.xml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -45,7 +45,7 @@
4545
<label>Gateway URL</label>
4646
</field>
4747
<field id="cgi_url_td" translate="label" type="text" sortOrder="100" showInDefault="1" showInWebsite="1" showInStore="0">
48-
<label>Transaction Details Url</label>
48+
<label>Transaction Details URL</label>
4949
</field>
5050
<field id="currency" translate="label" type="select" sortOrder="110" showInDefault="1" showInWebsite="1" showInStore="0">
5151
<label>Accepted Currency</label>

‎app/code/Magento/Authorizenet/view/frontend/web/js/view/payment/method-renderer/authorizenet-directpost.js

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -48,7 +48,7 @@ define(
4848
var self = this;
4949
if (this.validateHandler() && additionalValidators.validate()) {
5050
this.isPlaceOrderActionAllowed(false);
51-
$.when(setPaymentInformationAction(this.messageContainer)).done(function() {
51+
$.when(setPaymentInformationAction(this.messageContainer, {'method': self.getCode()})).done(function() {
5252
self.placeOrderHandler();
5353
}).fail(function() {
5454
self.isPlaceOrderActionAllowed(true);

‎app/code/Magento/Backend/view/adminhtml/templates/widget/form/renderer/fieldset/element.phtml

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,8 @@ $fieldClass .= ($note) ? ' with-note' : '';
2222
$fieldClass .= (!$element->getLabelHtml()) ? ' no-label' : '';
2323

2424
$fieldAttributes = $fieldId . ' class="' . $fieldClass . '" '
25-
. $block->getUiId('form-field', $element->getId());
25+
. $block->getUiId('form-field', $element->getId())
26+
. ($element->getFieldExtraAttributes() ? ' ' . $element->getFieldExtraAttributes() : '');
2627
?>
2728

2829
<?php if (!$element->getNoDisplay()): ?>

‎app/code/Magento/Braintree/Block/Creditcard/Management.php

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -258,7 +258,7 @@ public function currentCustomerLastName()
258258
*/
259259
public function getEditUrl($token)
260260
{
261-
return $this->getUrl('braintree/creditcard/edit', ['token' => $token]);
261+
return $this->getUrl('braintree/creditcard/edit', ['token' => $token, '_secure' => true]);
262262
}
263263

264264
/**
@@ -269,7 +269,7 @@ public function getEditUrl($token)
269269
*/
270270
public function getDeleteUrl($token)
271271
{
272-
return $this->getUrl('braintree/creditcard/delete', ['token' => $token]);
272+
return $this->getUrl('braintree/creditcard/delete', ['token' => $token, '_secure' => true]);
273273
}
274274

275275
/**
@@ -279,7 +279,7 @@ public function getDeleteUrl($token)
279279
*/
280280
public function getAddUrl()
281281
{
282-
return $this->getUrl('braintree/creditcard/newcard');
282+
return $this->getUrl('braintree/creditcard/newcard', ['_secure' => true]);
283283
}
284284

285285
/**
@@ -289,7 +289,7 @@ public function getAddUrl()
289289
*/
290290
public function getDeleteConfirmUrl()
291291
{
292-
return $this->getUrl('braintree/creditcard/deleteconfirm');
292+
return $this->getUrl('braintree/creditcard/deleteconfirm', ['_secure' => true]);
293293
}
294294

295295
/**
@@ -299,7 +299,7 @@ public function getDeleteConfirmUrl()
299299
*/
300300
public function getAjaxSaveUrl()
301301
{
302-
return $this->getUrl('braintree/creditcard/ajaxsave');
302+
return $this->getUrl('braintree/creditcard/ajaxsave', ['_secure' => true]);
303303
}
304304

305305
/**
@@ -309,7 +309,7 @@ public function getAjaxSaveUrl()
309309
*/
310310
public function getFormAction()
311311
{
312-
return $this->getUrl('braintree/creditcard/save');
312+
return $this->getUrl('braintree/creditcard/save', ['_secure' => true]);
313313
}
314314

315315
/**
@@ -319,7 +319,7 @@ public function getFormAction()
319319
*/
320320
public function getBackUrl()
321321
{
322-
return $this->getUrl('braintree/creditcard/index');
322+
return $this->getUrl('braintree/creditcard/index', ['_secure' => true]);
323323
}
324324

325325
/**

‎app/code/Magento/Braintree/Block/PayPal/Shortcut.php

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -125,7 +125,7 @@ public function getAmount()
125125
*/
126126
public function getReviewPageUrl()
127127
{
128-
return $this->_urlBuilder->getUrl('braintree/paypal/review');
128+
return $this->_urlBuilder->getUrl('braintree/paypal/review', ['_secure' => true]);
129129
}
130130

131131
/**

‎app/code/Magento/Braintree/Controller/PayPal/SaveShippingMethod.php

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -38,11 +38,11 @@ public function execute()
3838
if ($isAjax) {
3939
$this->getResponse()->setBody(
4040
'<script>window.location.href = '
41-
. $this->_url->getUrl('*/*/review')
41+
. $this->_url->getUrl('*/*/review', ['_secure' => true])
4242
. ';</script>'
4343
);
4444
} else {
45-
$this->_redirect('*/*/review');
45+
$this->_redirect('*/*/review', ['_secure' => true]);
4646
}
4747
}
4848
}

‎app/code/Magento/Braintree/Model/ConfigProvider.php

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -134,7 +134,7 @@ public function show3dSecure()
134134
*/
135135
public function getAjaxGenerateNonceUrl()
136136
{
137-
return $this->urlBuilder->getUrl('braintree/creditcard/generate');
137+
return $this->urlBuilder->getUrl('braintree/creditcard/generate', ['_secure' => true]);
138138
}
139139

140140
/**

‎app/code/Magento/Braintree/Model/PaymentMethod.php

Lines changed: 22 additions & 34 deletions
Original file line numberDiff line numberDiff line change
@@ -95,7 +95,7 @@ class PaymentMethod extends \Magento\Payment\Model\Method\Cc
9595
* @var bool
9696
*/
9797
protected $_canRefundInvoicePartial = true;
98-
98+
9999
/**
100100
* @var string
101101
*/
@@ -289,7 +289,7 @@ public function validate()
289289
throw new LocalizedException($error);
290290
}
291291
}
292-
292+
293293
return $this;
294294
}
295295

@@ -474,7 +474,7 @@ protected function braintreeAuthorize(InfoInterface $payment, $amount, $capture,
474474
$this->_debug($transactionParams);
475475
try {
476476
$result = $this->braintreeTransaction->sale($transactionParams);
477-
$this->_debug($result);
477+
$this->_debug($this->_convertObjToArray($result));
478478
} catch (\Exception $e) {
479479
$this->_logger->critical($e);
480480
throw new LocalizedException(__('Please try again later'));
@@ -589,8 +589,8 @@ public function capture(InfoInterface $payment, $amount)
589589
$this->partialCapture($payment, $amount);
590590
} else {
591591
$result = $this->braintreeTransaction->submitForSettlement($payment->getCcTransId(), $amount);
592-
$this->_debug($payment->getCcTransId().' - '.$amount);
593-
$this->_debug($result);
592+
$this->_debug([$payment->getCcTransId().' - '.$amount]);
593+
$this->_debug($this->_convertObjToArray($result));
594594
if ($result->success) {
595595
$payment->setIsTransactionClosed(0)
596596
->setShouldCloseParentTransaction(false);
@@ -621,8 +621,8 @@ public function refund(InfoInterface $payment, $amount)
621621
$transactionId = $this->braintreeHelper->clearTransactionId($payment->getRefundTransactionId());
622622
try {
623623
$transaction = $this->braintreeTransaction->find($transactionId);
624-
$this->_debug($payment->getCcTransId());
625-
$this->_debug($transaction);
624+
$this->_debug([$payment->getCcTransId()]);
625+
$this->_debug($this->_convertObjToArray($transaction));
626626
if ($transaction->status === \Braintree_Transaction::SUBMITTED_FOR_SETTLEMENT) {
627627
if ($transaction->amount != $amount) {
628628
$message = __('This refund is for a partial amount but the Transaction has not settled.')
@@ -641,7 +641,7 @@ public function refund(InfoInterface $payment, $amount)
641641
$result = $canVoid
642642
? $this->braintreeTransaction->void($transactionId)
643643
: $this->braintreeTransaction->refund($transactionId, $amount);
644-
$this->_debug($result);
644+
$this->_debug($this->_convertObjToArray($result));
645645
if ($result->success) {
646646
$payment->setIsTransactionClosed(1);
647647
} else {
@@ -711,9 +711,9 @@ public function void(InfoInterface $payment)
711711
}
712712
$errors = '';
713713
foreach ($transactionIds as $transactionId) {
714-
$this->_debug('void-' . $transactionId);
714+
$this->_debug(['void-' . $transactionId]);
715715
$result = $this->braintreeTransaction->void($transactionId);
716-
$this->_debug($result);
716+
$this->_debug($this->_convertObjToArray($result));
717717
if (!$result->success) {
718718
$errors .= ' ' . $this->errorHelper->parseBraintreeError($result)->getText();
719719
} elseif ($message) {
@@ -853,7 +853,7 @@ protected function getChannel()
853853
*/
854854
protected function cloneTransaction($amount, $transactionId)
855855
{
856-
$this->_debug('clone-' . $transactionId . ' amount=' . $amount);
856+
$this->_debug(['clone-' . $transactionId . ' amount=' . $amount]);
857857
$result = $this->braintreeTransaction->cloneTransaction(
858858
$transactionId,
859859
[
@@ -863,7 +863,7 @@ protected function cloneTransaction($amount, $transactionId)
863863
]
864864
]
865865
);
866-
$this->_debug($result);
866+
$this->_debug($this->_convertObjToArray($result));
867867
return $result;
868868
}
869869

@@ -907,28 +907,6 @@ public function canVoid()
907907
return $this->_canVoid;
908908
}
909909

910-
/**
911-
* Log debug data to file
912-
*
913-
* @param mixed $debugData
914-
* @return $this
915-
*/
916-
protected function _debug($debugData)
917-
{
918-
if (!$this->config->isDebugEnabled()) {
919-
return $this;
920-
}
921-
if (!is_array($debugData)) {
922-
if (is_object($debugData)) {
923-
$debugData = var_export($debugData, true);
924-
} else {
925-
$debugData = [$debugData];
926-
}
927-
}
928-
parent::_debug((array)$debugData);
929-
return $this;
930-
}
931-
932910
/**
933911
* Return replace keys for debug data
934912
*
@@ -957,4 +935,14 @@ public function getConfigData($field, $storeId = null)
957935
}
958936
return $this->config->getConfigData($field, $storeId);
959937
}
938+
939+
/**
940+
* Convert response from Braintree to array
941+
* @param \Braintree_Result_Successful|\Braintree_Result_Error|\Braintree_Transaction $data
942+
* @return array
943+
*/
944+
protected function _convertObjToArray($data)
945+
{
946+
return json_decode(json_encode($data), true);
947+
}
960948
}

0 commit comments

Comments
 (0)