MAGETWO-64317: POST request to /setup/index.php/session/prolong returns successful json

Author: shiftedreality

setup/src/Magento/Setup/Mvc/Bootstrap/InitParamListener.php

@@ -47,8 +47,8 @@ class InitParamListener implements ListenerAggregateInterface, FactoryInterface
      * @var array
      */
     private $controllersToSkip = [
-        \Magento\Setup\Controller\Session::class,
-        \Magento\Setup\Controller\Success::class
+        \Magento\Setup\Controller\Session::class => ['index', 'unlogin'],
+        \Magento\Setup\Controller\Success::class => ['index']
     ];
 
     /**
@@ -110,8 +110,12 @@ public function authPreDispatch($event)
         /** @var RouteMatch $routeMatch */
         $routeMatch = $event->getRouteMatch();
         $controller = $routeMatch->getParam('controller');
+        $action = $routeMatch->getParam('action');
 
-        if (!in_array($controller, $this->controllersToSkip)) {
+        $skipCheck = array_key_exists($controller, $this->controllersToSkip)
+            && in_array($action, $this->controllersToSkip[$controller]);
+
+        if (!$skipCheck) {
             /** @var Application $application */
             $application = $event->getApplication();
             $serviceManager = $application->getServiceManager();

setup/src/Magento/Setup/Test/Unit/Mvc/Bootstrap/InitParamListenerTest.php

@@ -302,10 +302,12 @@ public function testAuthPreDispatch()
             ->disableOriginalConstructor()
             ->getMock();
 
-        $routeMatchMock->expects($this->once())
+        $routeMatchMock->expects($this->exactly(2))
             ->method('getParam')
-            ->with('controller')
-            ->willReturn('testController');
+            ->willReturnMap([
+                ['controller', null, 'testController'],
+                ['action', null, 'testAction']
+            ]);
         $eventMock->expects($this->once())
             ->method('getRouteMatch')
             ->willReturn($routeMatchMock);
@@ -403,4 +405,36 @@ public function testAuthPreDispatch()
             $responseMock
         );
     }
+
+    public function testAuthPreDispatchSkip()
+    {
+        $eventMock = $this->getMockBuilder(\Zend\Mvc\MvcEvent::class)
+            ->disableOriginalConstructor()
+            ->getMock();
+        $routeMatchMock = $this->getMockBuilder(\Zend\Mvc\Router\Http\RouteMatch::class)
+            ->disableOriginalConstructor()
+            ->getMock();
+        $deploymentConfigMock = $this->getMockBuilder(\Magento\Framework\App\DeploymentConfig::class)
+            ->disableOriginalConstructor()
+            ->getMock();
+
+        $deploymentConfigMock->expects($this->never())
+            ->method('isAvailable');
+        $routeMatchMock->expects($this->exactly(2))
+            ->method('getParam')
+            ->willReturnMap([
+                ['controller', null, \Magento\Setup\Controller\Session::class],
+                ['action', null, 'unlogin']
+            ]);
+        $eventMock->expects($this->once())
+            ->method('getRouteMatch')
+            ->willReturn($routeMatchMock);
+        $eventMock->expects($this->never())
+            ->method('getApplication');
+
+        $this->assertSame(
+            $this->listener->authPreDispatch($eventMock),
+            false
+        );
+    }
 }