Merge pull request #4397 from magento-obsessive-owls/owls-2.2.10-delivery

[owls] MC-17485, MC-17582

Author: danmooney2

app/code/Magento/Catalog/Model/Product/AttributeSet/Options.php

@@ -5,10 +5,13 @@
  */
 namespace Magento\Catalog\Model\Product\AttributeSet;
 
+/**
+ * Attribute Set Options
+ */
 class Options implements \Magento\Framework\Data\OptionSourceInterface
 {
     /**
-     * @var null|array
+     * @var array
      */
     protected $options;
 
@@ -25,15 +28,23 @@ public function __construct(
     }
 
     /**
-     * @return array|null
+     * @inheritDoc
      */
     public function toOptionArray()
     {
         if (null == $this->options) {
             $this->options = $this->collectionFactory->create()
                 ->setEntityTypeFilter($this->product->getTypeId())
                 ->toOptionArray();
+
+            array_walk(
+                $this->options,
+                function (&$option) {
+                    $option['__disableTmpl'] = true;
+                }
+            );
         }
+
         return $this->options;
     }
 }

app/code/Magento/ImportExport/Model/Import/Source/Zip.php

@@ -32,6 +32,12 @@ public function __construct(
             throw new ValidatorException(__('Sorry, but the data is invalid or the file is not uploaded.'));
         }
         $directory->delete($directory->getRelativePath($file));
-        parent::__construct($csvFile, $directory, $options);
+
+        try {
+            parent::__construct($csvFile, $directory, $options);
+        } catch (\LogicException $e) {
+            $directory->delete($directory->getRelativePath($csvFile));
+            throw $e;
+        }
     }
 }

lib/internal/Magento/Framework/Archive/Zip.php

@@ -54,7 +54,8 @@ public function unpack($source, $destination)
         $zip = new \ZipArchive();
         if ($zip->open($source) === true) {
             $filename = $this->filterRelativePaths($zip->getNameIndex(0) ?: '');
-            if ($filename) {
+            if ($filename && !preg_match('#[:"*?|<>%]#', $filename)) {
+                // extract first entry in zip file to destination directory
                 $zip->extractTo(dirname($destination), $filename);
                 rename(dirname($destination).'/'.$filename, $destination);
             } else {