Skip to content

Commit 2c952e7

Browse files
vzabaznovvzabaznov
committed
MAGETWO-71465: Prepare code base 2.1.9
1 parent 34fc8d8 commit 2c952e7

File tree

220 files changed

+3220
-2687
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

220 files changed

+3220
-2687
lines changed

‎app/code/Magento/AdminNotification/Controller/Adminhtml/System/Message/ListAction.php

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,13 @@
88

99
class ListAction extends \Magento\Backend\App\AbstractAction
1010
{
11+
/**
12+
* Authorization level of a basic admin session.
13+
*
14+
* @see _isAllowed()
15+
*/
16+
const ADMIN_RESOURCE = 'Magento_AdminNotification::show_list';
17+
1118
/**
1219
* @var \Magento\Framework\Json\Helper\Data
1320
*/

‎app/code/Magento/AdminNotification/Model/Feed.php

Lines changed: 14 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -146,9 +146,9 @@ public function checkUpdate()
146146
$feedData[] = [
147147
'severity' => (int)$item->severity,
148148
'date_added' => date('Y-m-d H:i:s', $itemPublicationDate),
149-
'title' => (string)$item->title,
150-
'description' => (string)$item->description,
151-
'url' => (string)$item->link,
149+
'title' => $this->escapeString($item->title),
150+
'description' => $this->escapeString($item->description),
151+
'url' => $this->escapeString($item->link),
152152
];
153153
}
154154
}
@@ -244,4 +244,15 @@ public function getFeedXml()
244244

245245
return $xml;
246246
}
247+
248+
/**
249+
* Converts incoming data to string format and escapes special characters.
250+
*
251+
* @param \SimpleXMLElement $data
252+
* @return string
253+
*/
254+
private function escapeString(\SimpleXMLElement $data)
255+
{
256+
return htmlspecialchars((string)$data);
257+
}
247258
}

‎app/code/Magento/AdminNotification/Test/Unit/Model/FeedTest.php

Lines changed: 65 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -52,13 +52,25 @@ class FeedTest extends \PHPUnit_Framework_TestCase
5252

5353
protected function setUp()
5454
{
55-
$this->inboxFactory = $this->getMock('Magento\AdminNotification\Model\InboxFactory', ['create'], [], '', false);
56-
$this->curlFactory = $this->getMock('Magento\Framework\HTTP\Adapter\CurlFactory', ['create'], [], '', false);
57-
$this->curl = $this->getMockBuilder('Magento\Framework\HTTP\Adapter\Curl')
55+
$this->inboxFactory = $this->getMock(
56+
\Magento\AdminNotification\Model\InboxFactory::class,
57+
['create'],
58+
[],
59+
'',
60+
false
61+
);
62+
$this->curlFactory = $this->getMock(
63+
\Magento\Framework\HTTP\Adapter\CurlFactory::class,
64+
['create'],
65+
[],
66+
'',
67+
false
68+
);
69+
$this->curl = $this->getMockBuilder(\Magento\Framework\HTTP\Adapter\Curl::class)
5870
->disableOriginalConstructor()->getMock();
59-
$this->appState = $this->getMock('Magento\Framework\App\State', ['getInstallDate'], [], '', false);
71+
$this->appState = $this->getMock(\Magento\Framework\App\State::class, ['getInstallDate'], [], '', false);
6072
$this->inboxModel = $this->getMock(
61-
'Magento\AdminNotification\Model\Inbox',
73+
\Magento\AdminNotification\Model\Inbox::class,
6274
[
6375
'__wakeup',
6476
'parse'
@@ -68,15 +80,15 @@ protected function setUp()
6880
false
6981
);
7082
$this->backendConfig = $this->getMock(
71-
'Magento\Backend\App\ConfigInterface',
83+
\Magento\Backend\App\ConfigInterface::class,
7284
[
7385
'getValue',
7486
'setValue',
7587
'isSetFlag'
7688
]
7789
);
7890
$this->cacheManager = $this->getMock(
79-
'Magento\Framework\App\CacheInterface',
91+
\Magento\Framework\App\CacheInterface::class,
8092
[
8193
'load',
8294
'getFrontend',
@@ -86,18 +98,18 @@ protected function setUp()
8698
]
8799
);
88100

89-
$this->deploymentConfig = $this->getMockBuilder('Magento\Framework\App\DeploymentConfig')
101+
$this->deploymentConfig = $this->getMockBuilder(\Magento\Framework\App\DeploymentConfig::class)
90102
->disableOriginalConstructor()->getMock();
91103

92104
$this->objectManagerHelper = new ObjectManagerHelper($this);
93105

94-
$this->productMetadata = $this->getMockBuilder('Magento\Framework\App\ProductMetadata')
106+
$this->productMetadata = $this->getMockBuilder(\Magento\Framework\App\ProductMetadata::class)
95107
->disableOriginalConstructor()->getMock();
96108

97-
$this->urlBuilder = $this->getMock('Magento\Framework\UrlInterface');
109+
$this->urlBuilder = $this->getMock(\Magento\Framework\UrlInterface::class);
98110

99111
$this->feed = $this->objectManagerHelper->getObject(
100-
'Magento\AdminNotification\Model\Feed',
112+
\Magento\AdminNotification\Model\Feed::class,
101113
[
102114
'backendConfig' => $this->backendConfig,
103115
'cacheManager' => $this->cacheManager,
@@ -148,8 +160,27 @@ public function testCheckUpdate($callInbox, $curlRequest)
148160
->will($this->returnValue('Sat, 6 Sep 2014 16:46:11 UTC'));
149161
if ($callInbox) {
150162
$this->inboxFactory->expects($this->once())->method('create')
151-
->will(($this->returnValue($this->inboxModel)));
152-
$this->inboxModel->expects($this->once())->method('parse')->will($this->returnSelf());
163+
->will($this->returnValue($this->inboxModel));
164+
$this->inboxModel->expects($this->once())
165+
->method('parse')
166+
->with(
167+
$this->callback(
168+
function ($data) {
169+
$fieldsToCheck = ['title', 'description', 'url'];
170+
return array_reduce(
171+
$fieldsToCheck,
172+
function ($initialValue, $item) use ($data) {
173+
$haystack = (isset($data[0][$item]) ? $data[0][$item] : false);
174+
return $haystack
175+
? $initialValue && !strpos($haystack, '<') && !strpos($haystack, '>')
176+
: true;
177+
},
178+
true
179+
);
180+
}
181+
)
182+
)
183+
->will($this->returnSelf());
153184
} else {
154185
$this->inboxFactory->expects($this->never())->method('create');
155186
$this->inboxModel->expects($this->never())->method('parse');
@@ -199,7 +230,27 @@ public function checkUpdateDataProvider()
199230
</item>
200231
</channel>
201232
</rss>'
202-
]
233+
],
234+
[
235+
true,
236+
// @codingStandardsIgnoreStart
237+
'HEADER
238+
239+
<?xml version="1.0" encoding="utf-8" ?>
240+
<rss version="2.0" xmlns:atom="http://www.w3.org/2005/Atom">
241+
<channel>
242+
<title>MagentoCommerce</title>
243+
<item>
244+
<title><![CDATA[<script>alert("Hello!");</script>Test Title]]></title>
245+
<link><![CDATA[http://magento.com/feed_url<script>alert("Hello!");</script>]]></link>
246+
<severity>4</severity>
247+
<description><![CDATA[Test <script>alert("Hello!");</script>Description]]></description>
248+
<pubDate>Tue, 20 Jun 2017 13:14:47 UTC</pubDate>
249+
</item>
250+
</channel>
251+
</rss>'
252+
// @codingStandardsIgnoreEnd
253+
],
203254
];
204255
}
205256
}

‎app/code/Magento/AdminNotification/etc/config.xml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@
1212
<feed_url>notifications.magentocommerce.com/magento2/community/notifications.rss</feed_url>
1313
<popup_url>widgets.magentocommerce.com/notificationPopup</popup_url>
1414
<severity_icons_url>widgets.magentocommerce.com/%s/%s.gif</severity_icons_url>
15-
<use_https>0</use_https>
15+
<use_https>1</use_https>
1616
<frequency>1</frequency>
1717
<last_update>0</last_update>
1818
</adminnotification>

‎app/code/Magento/Backend/Block/Widget/Grid/Column.php

Lines changed: 20 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,14 +5,15 @@
55
*/
66
namespace Magento\Backend\Block\Widget\Grid;
77

8+
use Magento\Backend\Block\Widget;
89
use Magento\Backend\Block\Widget\Grid\Column\Filter\AbstractFilter;
910

1011
/**
1112
* Grid column block
1213
*
1314
* @author Magento Core Team <core@magentocommerce.com>
1415
*/
15-
class Column extends \Magento\Backend\Block\Widget
16+
class Column extends Widget
1617
{
1718
/**
1819
* Parent grid
@@ -287,12 +288,29 @@ public function getRowField(\Magento\Framework\DataObject $row)
287288
*/
288289
$frameCallback = $this->getFrameCallback();
289290
if (is_array($frameCallback)) {
291+
$this->validateFrameCallback($frameCallback);
290292
$renderedValue = call_user_func($frameCallback, $renderedValue, $row, $this, false);
291293
}
292294

293295
return $renderedValue;
294296
}
295297

298+
/**
299+
* Validate frame callback.
300+
*
301+
* @param array $callback
302+
* @throws \InvalidArgumentException
303+
* @return void
304+
*/
305+
private function validateFrameCallback(array $callback)
306+
{
307+
if (!is_object($callback[0]) || !$callback[0] instanceof Widget) {
308+
throw new \InvalidArgumentException(
309+
"Frame callback host must be instance of " . \Magento\Backend\Block\Widget::class
310+
);
311+
}
312+
}
313+
296314
/**
297315
* Retrieve row column field value for export
298316
*
@@ -312,6 +330,7 @@ public function getRowFieldExport(\Magento\Framework\DataObject $row)
312330
*/
313331
$frameCallback = $this->getFrameCallback();
314332
if (is_array($frameCallback)) {
333+
$this->validateFrameCallback($frameCallback);
315334
$renderedValue = call_user_func($frameCallback, $renderedValue, $row, $this, true);
316335
}
317336

‎app/code/Magento/Backend/Controller/Adminhtml/Ajax/Translate.php

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,13 @@
1010

1111
class Translate extends \Magento\Backend\App\Action
1212
{
13+
/**
14+
* Authorization level of a basic admin session.
15+
*
16+
* @see _isAllowed()
17+
*/
18+
const ADMIN_RESOURCE = 'Magento_Backend::content_translation';
19+
1320
/**
1421
* @var \Magento\Framework\Translate\Inline\ParserInterface
1522
*/

‎app/code/Magento/Backend/Test/Unit/Block/Widget/Grid/ColumnTest.php

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -28,9 +28,9 @@ class ColumnTest extends \PHPUnit_Framework_TestCase
2828

2929
protected function setUp()
3030
{
31-
$this->_layoutMock = $this->getMock('Magento\Framework\View\Layout', [], [], '', false, false);
31+
$this->_layoutMock = $this->getMock(\Magento\Framework\View\Layout::class, [], [], '', false, false);
3232
$this->_blockMock = $this->getMock(
33-
'Magento\Framework\View\Element\Template',
33+
\Magento\Framework\View\Element\Template::class,
3434
['setColumn', 'getHtml'],
3535
[],
3636
'',
@@ -40,10 +40,10 @@ protected function setUp()
4040

4141
$arguments = [
4242
'layout' => $this->_layoutMock,
43-
'urlBuilder' => $this->getMock('Magento\Backend\Model\Url', [], [], '', false),
43+
'urlBuilder' => $this->getMock(\Magento\Backend\Model\Url::class, [], [], '', false),
4444
];
4545
$objectManagerHelper = new \Magento\Framework\TestFramework\Unit\Helper\ObjectManager($this);
46-
$this->_block = $objectManagerHelper->getObject('Magento\Backend\Block\Widget\Grid\Column', $arguments);
46+
$this->_block = $objectManagerHelper->getObject(\Magento\Backend\Block\Widget\Grid\Column::class, $arguments);
4747
$this->_block->setId('id');
4848
}
4949

@@ -69,7 +69,7 @@ public function testGetFilterWhenFilterIsNotSet()
6969
)->method(
7070
'createBlock'
7171
)->with(
72-
'Magento\Backend\Block\Widget\Grid\Column\Filter\Text'
72+
\Magento\Backend\Block\Widget\Grid\Column\Filter\Text::class
7373
)->will(
7474
$this->returnValue($this->_blockMock)
7575
);
@@ -119,7 +119,7 @@ public function testGetFilterWithInvalidFilterTypeWhenUseDefaultFilter()
119119
)->method(
120120
'createBlock'
121121
)->with(
122-
'Magento\Backend\Block\Widget\Grid\Column\Filter\Text'
122+
\Magento\Backend\Block\Widget\Grid\Column\Filter\Text::class
123123
)->will(
124124
$this->returnValue($this->_blockMock)
125125
);
@@ -226,7 +226,7 @@ public function testGetRendererWheRendererSetFalse()
226226
)->method(
227227
'createBlock'
228228
)->with(
229-
'Magento\Backend\Block\Widget\Grid\Column\Renderer\Text'
229+
\Magento\Backend\Block\Widget\Grid\Column\Renderer\Text::class
230230
)->will(
231231
$this->returnValue($this->_blockMock)
232232
);
@@ -370,12 +370,12 @@ public function testColumnIsGrouped($groupedData, $expected)
370370
{
371371
$arguments = [
372372
'layout' => $this->_layoutMock,
373-
'urlBuilder' => $this->getMock('Magento\Backend\Model\Url', [], [], '', false),
373+
'urlBuilder' => $this->getMock(\Magento\Backend\Model\Url::class, [], [], '', false),
374374
'data' => $groupedData,
375375
];
376376

377377
$objectManagerHelper = new \Magento\Framework\TestFramework\Unit\Helper\ObjectManager($this);
378-
$block = $objectManagerHelper->getObject('Magento\Backend\Block\Widget\Grid\Column', $arguments);
378+
$block = $objectManagerHelper->getObject(\Magento\Backend\Block\Widget\Grid\Column::class, $arguments);
379379
$this->assertEquals($expected, $block->isGrouped());
380380
}
381381

‎app/code/Magento/Backend/etc/acl.xml

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,7 @@
2222
<resource id="Magento_Backend::design" title="Design" translate="title" sortOrder="20">
2323
<resource id="Magento_Backend::schedule" title="Schedule" translate="title" sortOrder="30" />
2424
</resource>
25+
<resource id="Magento_Backend::content_translation" title="Content translation" translate="title" sortOrder="40" />
2526
</resource>
2627
<resource id="Magento_Backend::stores" title="Stores" translate="title" sortOrder="80">
2728
<resource id="Magento_Backend::stores_settings" title="Settings" translate="title" sortOrder="10">

‎app/code/Magento/Backend/view/adminhtml/templates/admin/login.phtml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -43,7 +43,7 @@
4343
data-validate="{required:true}"
4444
value=""
4545
placeholder="<?php /* @escapeNotVerified */ echo __('password') ?>"
46-
autocomplete="off"
46+
autocomplete="new-password"
4747
/>
4848
</div>
4949
</div>

‎app/code/Magento/Backup/view/adminhtml/templates/backup/dialogs.phtml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -73,7 +73,7 @@
7373
<fieldset class="admin__fieldset password-box-container">
7474
<div class="admin__field field _required">
7575
<label for="password" class="admin__field-label"><span><?php /* @escapeNotVerified */ echo __('User Password')?></span></label>
76-
<div class="admin__field-control"><input type="password" name="password" id="password" class="admin__control-text required-entry" autocomplete="off"></div>
76+
<div class="admin__field-control"><input type="password" name="password" id="password" class="admin__control-text required-entry" autocomplete="new-password"></div>
7777
</div>
7878

7979
<div class="admin__field field maintenance-checkbox-container">
@@ -119,7 +119,7 @@
119119
<span><?php /* @escapeNotVerified */ echo __('FTP Password') ?></span>
120120
</label>
121121
<div class="admin__field-control">
122-
<input type="password" class="admin__control-text" name="ftp_pass" id="ftp_pass" autocomplete="off">
122+
<input type="password" class="admin__control-text" name="ftp_pass" id="ftp_pass" autocomplete="new-password">
123123
</div>
124124
</div>
125125
<div class="admin__field field">

0 commit comments

Comments
 (0)