Skip to content

Commit 2e5cf7c

Browse files
rizwankhglrizwankhgl
committed
AC-479: Input validation for File Upload in Customer Address
 * Merge branch '2.4.4-develop' into AC-479
2 parents 14271c3 + ea6c573 commit 2e5cf7c

File tree

80 files changed

+1653
-353
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

80 files changed

+1653
-353
lines changed

‎app/code/Magento/CatalogInventory/Model/StockStateProvider.php

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -135,7 +135,7 @@ public function checkQuoteItemQty(StockItemInterface $stockItem, $qty, $summaryQ
135135
$result->addData($this->checkQtyIncrements($stockItem, $qty)->getData());
136136

137137
$result->setItemIsQtyDecimal($stockItem->getIsQtyDecimal());
138-
if (!$stockItem->getIsQtyDecimal() && (floor($qty) !== $qty)) {
138+
if (!$stockItem->getIsQtyDecimal() && (floor($qty) !== (float) $qty)) {
139139
$result->setHasError(true)
140140
->setMessage(__('You cannot use decimal quantity for this product.'))
141141
->setErrorCode('qty_decimal')

‎app/code/Magento/Cms/Model/Wysiwyg/Images/Storage.php

Lines changed: 4 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -77,8 +77,6 @@ class Storage extends \Magento\Framework\DataObject
7777
protected $_coreFileStorageDb = null;
7878

7979
/**
80-
* Cms wysiwyg images
81-
*
8280
* @var \Magento\Cms\Helper\Wysiwyg\Images
8381
*/
8482
protected $_cmsWysiwygImages = null;
@@ -109,36 +107,26 @@ class Storage extends \Magento\Framework\DataObject
109107
protected $_session;
110108

111109
/**
112-
* Directory database factory
113-
*
114110
* @var \Magento\MediaStorage\Model\File\Storage\Directory\DatabaseFactory
115111
*/
116112
protected $_directoryDatabaseFactory;
117113

118114
/**
119-
* Storage database factory
120-
*
121115
* @var \Magento\MediaStorage\Model\File\Storage\DatabaseFactory
122116
*/
123117
protected $_storageDatabaseFactory;
124118

125119
/**
126-
* Storage file factory
127-
*
128120
* @var \Magento\MediaStorage\Model\File\Storage\FileFactory
129121
*/
130122
protected $_storageFileFactory;
131123

132124
/**
133-
* Storage collection factory
134-
*
135125
* @var \Magento\Cms\Model\Wysiwyg\Images\Storage\CollectionFactory
136126
*/
137127
protected $_storageCollectionFactory;
138128

139129
/**
140-
* Uploader factory
141-
*
142130
* @var \Magento\MediaStorage\Model\File\UploaderFactory
143131
*/
144132
protected $_uploaderFactory;
@@ -745,8 +733,8 @@ private function getResizedParams(string $source): array
745733
$configWidth = $this->_resizeParameters['width'];
746734
$configHeight = $this->_resizeParameters['height'];
747735

748-
//phpcs:ignore Generic.PHP.NoSilencedErrors
749-
[$imageWidth, $imageHeight] = @getimagesize($source);
736+
$driver = $this->_directory->getDriver();
737+
[$imageWidth, $imageHeight] = getimagesizefromstring($driver->fileGetContents($source));
750738

751739
if ($imageWidth && $imageHeight) {
752740
$imageWidth = $configWidth > $imageWidth ? $imageWidth : $configWidth;
@@ -999,7 +987,7 @@ private function getAllowedPathPattern()
999987
);
1000988
$regExp = '/^(';
1001989
$or = '';
1002-
foreach($mediaGalleryImageFolders as $folder) {
990+
foreach ($mediaGalleryImageFolders as $folder) {
1003991
$folderPattern = str_replace('/', '[\/]+', $folder);
1004992
$regExp .= $or . $folderPattern . '\b(?!-)(?:\/?[a-zA-Z0-9\-\_]+)*\/?$';
1005993
$or = '|';
@@ -1013,7 +1001,7 @@ private function getAllowedPathPattern()
10131001
/**
10141002
* Get allowed media gallery image folders
10151003
*
1016-
* example:
1004+
* Example:
10171005
* [
10181006
* [0 => 'wysiwyg'],
10191007
* [0 => 'catalog', 1 => 'category']

‎app/code/Magento/Cms/Test/Unit/Model/Wysiwyg/Images/StorageTest.php

Lines changed: 11 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -141,6 +141,9 @@ class StorageTest extends TestCase
141141
*/
142142
private $fileMock;
143143

144+
/**
145+
* @var array
146+
*/
144147
private $allowedImageExtensions = [
145148
'jpg' => 'image/jpg',
146149
'jpeg' => 'image/jpeg',
@@ -366,13 +369,13 @@ public function testGetDirsCollectionCreateSubDirectories()
366369
}
367370

368371
/**
369-
* @param array $exclude
370-
* @param array $include
371-
* @param array $fileNames
372-
* @param array $expectedRemoveKeys
372+
* @param $path
373+
* @param $callNum
374+
* @param string $dirsFilter
375+
* @throws \Exception
373376
* @dataProvider dirsCollectionDataProvider
374377
*/
375-
public function testGetDirsCollection($path, $callNum, $dirsFilter='')
378+
public function testGetDirsCollection($path, $callNum, $dirsFilter = '')
376379
{
377380
$this->generalTestGetDirsCollection($path, $callNum, $dirsFilter);
378381
}
@@ -517,6 +520,9 @@ public function testUploadFile()
517520
[$thumbnailTargetPath, true],
518521
]
519522
);
523+
$this->driverMock->expects(self::once())
524+
->method('fileGetContents')
525+
->willReturn('some content');
520526

521527
$image = $this->getMockBuilder(Image::class)
522528
->disableOriginalConstructor()

‎app/code/Magento/Cms/Ui/Component/Listing/Column/BlockActions.php

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -66,24 +66,24 @@ public function prepareDataSource(array $dataSource)
6666
'href' => $this->urlBuilder->getUrl(
6767
static::URL_PATH_EDIT,
6868
[
69-
'block_id' => $item['block_id'],
69+
'block_id' => $item['block_id']
7070
]
7171
),
72-
'label' => __('Edit'),
72+
'label' => __('Edit')
7373
],
7474
'delete' => [
7575
'href' => $this->urlBuilder->getUrl(
7676
static::URL_PATH_DELETE,
7777
[
78-
'block_id' => $item['block_id'],
78+
'block_id' => $item['block_id']
7979
]
8080
),
8181
'label' => __('Delete'),
8282
'confirm' => [
8383
'title' => __('Delete %1', $title),
84-
'message' => __('Are you sure you want to delete a %1 record?', $title),
84+
'message' => __('Are you sure you want to delete a %1 record?', $title)
8585
],
86-
'post' => true,
86+
'post' => true
8787
],
8888
];
8989
}
@@ -102,6 +102,7 @@ public function prepareDataSource(array $dataSource)
102102
private function getEscaper()
103103
{
104104
if (!$this->escaper) {
105+
// phpcs:ignore Magento2.PHP.AutogeneratedClassNotInConstructor
105106
$this->escaper = ObjectManager::getInstance()->get(Escaper::class);
106107
}
107108
return $this->escaper;

‎app/code/Magento/Integration/Model/Oauth/Token.php

Lines changed: 8 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -59,7 +59,9 @@ class Token extends \Magento\Framework\Model\AbstractModel
5959

6060
/**#@- */
6161

62-
/**#@- */
62+
/**
63+
* @var OauthHelper
64+
*/
6365
protected $_oauthHelper;
6466

6567
/**
@@ -136,9 +138,10 @@ public function __construct(
136138
$this->_consumerFactory = $consumerFactory;
137139
$this->_oauthData = $oauthData;
138140
$this->_oauthHelper = $oauthHelper;
139-
$this->reader = ObjectManager::getInstance()->get(UserTokenReaderInterface::class);
140-
$this->issuer = ObjectManager::getInstance()->get(UserTokenIssuerInterface::class);
141-
$this->tokenParamsFactory = ObjectManager::getInstance()->get(UserTokenParametersInterfaceFactory::class);
141+
$this->reader = $reader ?? ObjectManager::getInstance()->get(UserTokenReaderInterface::class);
142+
$this->issuer = $issuer ?? ObjectManager::getInstance()->get(UserTokenIssuerInterface::class);
143+
$this->tokenParamsFactory = $paramsFactory ??
144+
ObjectManager::getInstance()->get(UserTokenParametersInterfaceFactory::class);
142145
}
143146

144147
/**
@@ -360,6 +363,7 @@ public function loadByConsumerIdAndUserType($consumerId, $userType)
360363
{
361364
$tokenData = $this->getResource()->selectTokenByConsumerIdAndUserType($consumerId, $userType);
362365
$this->setData($tokenData ? $tokenData : []);
366+
$this->getResource()->afterLoad($this);
363367
return $this;
364368
}
365369

‎app/code/Magento/Integration/Model/Oauth/Token/Provider.php

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -44,7 +44,7 @@ public function __construct(
4444
}
4545

4646
/**
47-
* {@inheritdoc}
47+
* @inheritdoc
4848
*/
4949
public function validateConsumer($consumer)
5050
{
@@ -58,7 +58,7 @@ public function validateConsumer($consumer)
5858
}
5959

6060
/**
61-
* {@inheritdoc}
61+
* @inheritdoc
6262
*/
6363
public function createRequestToken($consumer)
6464
{
@@ -73,7 +73,7 @@ public function createRequestToken($consumer)
7373
}
7474

7575
/**
76-
* {@inheritdoc}
76+
* @inheritdoc
7777
*/
7878
public function validateRequestToken($requestToken, $consumer, $oauthVerifier)
7979
{
@@ -99,7 +99,7 @@ public function validateRequestToken($requestToken, $consumer, $oauthVerifier)
9999
}
100100

101101
/**
102-
* {@inheritdoc}
102+
* @inheritdoc
103103
*/
104104
public function getAccessToken($consumer)
105105
{
@@ -118,7 +118,7 @@ public function getAccessToken($consumer)
118118
}
119119

120120
/**
121-
* {@inheritdoc}
121+
* @inheritdoc
122122
*/
123123
public function validateAccessTokenRequest($accessToken, $consumer)
124124
{
@@ -144,7 +144,7 @@ public function validateAccessTokenRequest($accessToken, $consumer)
144144
}
145145

146146
/**
147-
* {@inheritdoc}
147+
* @inheritdoc
148148
*/
149149
public function validateAccessToken($accessToken)
150150
{
@@ -168,15 +168,15 @@ public function validateAccessToken($accessToken)
168168
}
169169

170170
/**
171-
* {@inheritdoc}
171+
* @inheritdoc
172172
*/
173173
public function validateOauthToken($oauthToken)
174174
{
175175
return strlen($oauthToken) == \Magento\Framework\Oauth\Helper\Oauth::LENGTH_TOKEN;
176176
}
177177

178178
/**
179-
* {@inheritdoc}
179+
* @inheritdoc
180180
*/
181181
public function getConsumerByKey($consumerKey)
182182
{

‎app/code/Magento/Integration/Model/ResourceModel/Oauth/Consumer.php

Lines changed: 49 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,17 +5,29 @@
55
*/
66
namespace Magento\Integration\Model\ResourceModel\Oauth;
77

8+
use Magento\Framework\App\ObjectManager;
9+
use Magento\Framework\Encryption\Encryptor;
10+
811
class Consumer extends \Magento\Framework\Model\ResourceModel\Db\AbstractDb
912
{
13+
14+
/**
15+
* @var Encryptor
16+
*/
17+
private $encryptor;
18+
1019
/**
1120
* @param \Magento\Framework\Model\ResourceModel\Db\Context $context
1221
* @param string $connectionName
22+
* @param Encryptor $encryptor
1323
*/
1424
public function __construct(
1525
\Magento\Framework\Model\ResourceModel\Db\Context $context,
16-
$connectionName = null
26+
$connectionName = null,
27+
Encryptor $encryptor = null
1728
) {
1829
parent::__construct($context, $connectionName);
30+
$this->encryptor = $encryptor ?? ObjectManager::getInstance()->get(Encryptor::class);
1931
}
2032

2133
/**
@@ -61,4 +73,40 @@ public function getTimeInSecondsSinceCreation($consumerId)
6173

6274
return $connection->fetchOne($select);
6375
}
76+
77+
/**
78+
* @inheritdoc
79+
*/
80+
protected function _beforeSave(\Magento\Framework\Model\AbstractModel $object)
81+
{
82+
if ($object->getSecret()) {
83+
$object->setSecret($this->encryptor->encrypt($object->getSecret()));
84+
}
85+
86+
return parent::_beforeSave($object);
87+
}
88+
89+
/**
90+
* @inheritdoc
91+
*/
92+
protected function _afterLoad(\Magento\Framework\Model\AbstractModel $object)
93+
{
94+
if ($object->getSecret()) {
95+
$object->setSecret($this->encryptor->decrypt($object->getSecret()));
96+
}
97+
98+
return parent::_afterLoad($object);
99+
}
100+
101+
/**
102+
* @inheritdoc
103+
*/
104+
protected function _afterSave(\Magento\Framework\Model\AbstractModel $object)
105+
{
106+
if ($object->getSecret()) {
107+
$object->setSecret($this->encryptor->decrypt($object->getSecret()));
108+
}
109+
110+
return parent::_afterSave($object);
111+
}
64112
}

0 commit comments

Comments
 (0)