Skip to content

Commit 3ec9211

Browse files
oshmyheliukoshmyheliuk
committed
Merge remote-tracking branch 'origin/develop' into MAGETWO-49517
2 parents c2431d7 + ce68a6d commit 3ec9211

File tree

534 files changed

+13729
-5532
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

534 files changed

+13729
-5532
lines changed

‎.htaccess

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,12 @@
44

55
# SetEnv MAGE_MODE developer
66

7+
############################################
8+
## overrides default umask value to allow using different
9+
## file permissions
10+
11+
# SetEnv MAGE_UMASK 022
12+
713
############################################
814
## uncomment these lines for CGI mode
915
## make sure to specify the correct cgi php binary file name

‎README.md

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -72,3 +72,10 @@ To suggest documentation improvements, click [here][4].
7272
[2]: <http://devdocs.magento.com/guides/v2.0/contributor-guide/contributing.html#report>
7373
[3]: <https://github.com/magento/magento2/issues>
7474
[4]: <http://devdocs.magento.com>
75+
76+
<h2>Reporting security issues</h2>
77+
78+
To report security vulnerabilities in Magento software or web sites, please e-mail <a href="mailto:security@magento.com">security@magento.com</a>. Please do not report security issues using GitHub. Be sure to encrypt your e-mail with our <a href="https://info2.magento.com/rs/magentoenterprise/images/security_at_magento.asc">encryption key</a> if it includes sensitive information. Learn more about reporting security issues <a href="https://magento.com/security/reporting-magento-security-issue">here</a>.
79+
80+
Stay up-to-date on the latest vulnerabilities and patches for Magento by signing up for <a href="https://magento.com/security/sign-up">Security Alert Notifications</a>.
81+

‎app/bootstrap.php

Lines changed: 7 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -10,15 +10,19 @@
1010
error_reporting(E_ALL);
1111
#ini_set('display_errors', 1);
1212

13+
/* Custom umask value may be provided in MAGE_UMASK environment variable */
14+
$mask = isset($_SERVER['MAGE_UMASK']) ? octdec($_SERVER['MAGE_UMASK']) : 002;
15+
umask($mask);
16+
1317
/* PHP version validation */
14-
if (version_compare(phpversion(), '5.5.0', '<') === true) {
18+
if (!defined('PHP_VERSION_ID') || PHP_VERSION_ID < 50522) {
1519
if (PHP_SAPI == 'cli') {
16-
echo 'Magento supports PHP 5.5.0 or later. ' .
20+
echo 'Magento supports PHP 5.5.22 or later. ' .
1721
'Please read http://devdocs.magento.com/guides/v1.0/install-gde/system-requirements.html';
1822
} else {
1923
echo <<<HTML
2024
<div style="font:12px/1.35em arial, helvetica, sans-serif;">
21-
<p>Magento supports PHP 5.5.0 or later. Please read
25+
<p>Magento supports PHP 5.5.22 or later. Please read
2226
<a target="_blank" href="http://devdocs.magento.com/guides/v1.0/install-gde/system-requirements.html">
2327
Magento System Requirements</a>.
2428
</div>

‎app/code/Magento/AdvancedPricingImportExport/Model/Export/AdvancedPricing.php

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -95,10 +95,8 @@ class AdvancedPricing extends \Magento\CatalogImportExport\Model\Export\Product
9595
* @param \Magento\CatalogImportExport\Model\Export\Product\Type\Factory $_typeFactory
9696
* @param \Magento\Catalog\Model\Product\LinkTypeProvider $linkTypeProvider
9797
* @param \Magento\CatalogImportExport\Model\Export\RowCustomizerInterface $rowCustomizer
98-
* @param \Magento\Framework\Model\Entity\MetadataPool $metadataPool
9998
* @param ImportProduct\StoreResolver $storeResolver
10099
* @param \Magento\Customer\Api\GroupRepositoryInterface $groupRepository
101-
* @param \Magento\Framework\Model\Entity\MetadataPool $metadataPool
102100
* @throws \Magento\Framework\Exception\LocalizedException
103101
* @SuppressWarnings(PHPMD.ExcessiveParameterList)
104102
*/
@@ -119,7 +117,6 @@ public function __construct(
119117
\Magento\CatalogImportExport\Model\Export\Product\Type\Factory $_typeFactory,
120118
\Magento\Catalog\Model\Product\LinkTypeProvider $linkTypeProvider,
121119
\Magento\CatalogImportExport\Model\Export\RowCustomizerInterface $rowCustomizer,
122-
\Magento\Framework\Model\Entity\MetadataPool $metadataPool,
123120
\Magento\CatalogImportExport\Model\Import\Product\StoreResolver $storeResolver,
124121
\Magento\Customer\Api\GroupRepositoryInterface $groupRepository
125122
) {

‎app/code/Magento/AdvancedPricingImportExport/Test/Unit/Model/Export/AdvancedPricingTest.php

Lines changed: 0 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -107,11 +107,6 @@ class AdvancedPricingTest extends \PHPUnit_Framework_TestCase
107107
*/
108108
protected $groupRepository;
109109

110-
/**
111-
* @var \Magento\Framework\Model\Entity\MetadataPool|\PHPUnit_Framework_MockObject_MockObject
112-
*/
113-
protected $metadataPool;
114-
115110
/**
116111
* @var \Magento\ImportExport\Model\Export\Adapter\AbstractAdapter| \PHPUnit_Framework_MockObject_MockObject
117112
*/
@@ -290,13 +285,6 @@ protected function setUp()
290285
'',
291286
false
292287
);
293-
$this->metadataPool = $this->getMock(
294-
'\Magento\Framework\Model\Entity\MetadataPool',
295-
[],
296-
[],
297-
'',
298-
false
299-
);
300288
$this->writer = $this->getMock(
301289
'Magento\ImportExport\Model\Export\Adapter\AbstractAdapter',
302290
[
@@ -355,7 +343,6 @@ protected function setUp()
355343
$this->typeFactory,
356344
$this->linkTypeProvider,
357345
$this->rowCustomizer,
358-
$this->metadataPool,
359346
$this->storeResolver,
360347
$this->groupRepository
361348
);

‎app/code/Magento/Authorization/Model/ResourceModel/Rules.php

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -103,6 +103,8 @@ public function saveRel(\Magento\Authorization\Model\Rules $rule)
103103

104104
$connection->insert($this->getMainTable(), $insertData);
105105
} else {
106+
/** Give basic admin permissions to any admin */
107+
$postedResources[] = \Magento\Backend\App\AbstractAction::ADMIN_RESOURCE;
106108
$acl = $this->_aclBuilder->getAcl();
107109
/** @var $resource \Magento\Framework\Acl\AclResource */
108110
foreach ($acl->getResources() as $resourceId) {

‎app/code/Magento/Authorizenet/Controller/Directpost/Payment/Place.php

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -127,7 +127,7 @@ protected function placeCheckoutOrder()
127127
);
128128
} catch (\Exception $exception) {
129129
$result->setData('error', true);
130-
$result->setData('error_messages', __('Cannot place order.'));
130+
$result->setData('error_messages', __('Unable to place order. Please try again later.'));
131131
}
132132
if ($response instanceof Http) {
133133
$response->representJson($this->jsonHelper->jsonEncode($result));

‎app/code/Magento/Authorizenet/Controller/Directpost/Payment/Redirect.php

Lines changed: 37 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,10 +6,20 @@
66
*/
77
namespace Magento\Authorizenet\Controller\Directpost\Payment;
88

9+
use Magento\Framework\App\ObjectManager;
910
use Magento\Payment\Block\Transparent\Iframe;
11+
use Magento\Framework\Escaper;
1012

13+
/**
14+
* Class Redirect
15+
*/
1116
class Redirect extends \Magento\Authorizenet\Controller\Directpost\Payment
1217
{
18+
/**
19+
* @var Escaper
20+
*/
21+
private $escaper;
22+
1323
/**
1424
* Retrieve params and put javascript into iframe
1525
*
@@ -19,7 +29,7 @@ public function execute()
1929
{
2030
$helper = $this->dataFactory->create('frontend');
2131

22-
$redirectParams = $this->getRequest()->getParams();
32+
$redirectParams = $this->filterData($this->getRequest()->getParams());
2333
$params = [];
2434
if (!empty($redirectParams['success'])
2535
&& isset($redirectParams['x_invoice_num'])
@@ -44,4 +54,30 @@ public function execute()
4454
$this->_view->addPageLayoutHandles();
4555
$this->_view->loadLayout(false)->renderLayout();
4656
}
57+
58+
/**
59+
* Escape xss in request data
60+
* @param array $data
61+
* @return array
62+
*/
63+
private function filterData(array $data)
64+
{
65+
$self = $this;
66+
array_walk($data, function (&$item) use ($self) {
67+
$item = $self->getEscaper()->escapeXssInUrl($item);
68+
});
69+
return $data;
70+
}
71+
72+
/**
73+
* Get Escaper instance
74+
* @return Escaper
75+
*/
76+
private function getEscaper()
77+
{
78+
if (!$this->escaper) {
79+
$this->escaper = ObjectManager::getInstance()->get(Escaper::class);
80+
}
81+
return $this->escaper;
82+
}
4783
}

‎app/code/Magento/Authorizenet/Test/Unit/Controller/Directpost/Payment/PlaceTest.php

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -280,7 +280,7 @@ public function textExecuteFailedPlaceOrderDataProvider()
280280
{
281281
$objectFailed = new \Magento\Framework\DataObject();
282282
$objectFailed->setData('error', true);
283-
$objectFailed->setData('error_messages', __('Cannot place order.'));
283+
$objectFailed->setData('error_messages', __('Unable to place order. Please try again later.'));
284284

285285
return [
286286
[

‎app/code/Magento/Authorizenet/Test/Unit/Controller/Directpost/Payment/RedirectTest.php

Lines changed: 110 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,110 @@
1+
<?php
2+
/**
3+
* Copyright © 2016 Magento. All rights reserved.
4+
* See COPYING.txt for license details.
5+
*/
6+
namespace Magento\Authorizenet\Test\Unit\Controller\Directpost\Payment;
7+
8+
use Magento\Authorizenet\Controller\Directpost\Payment\Redirect;
9+
use Magento\Framework\App\RequestInterface;
10+
use Magento\Framework\App\ViewInterface;
11+
use Magento\Framework\Escaper;
12+
use Magento\Framework\Registry;
13+
use Magento\Framework\TestFramework\Unit\Helper\ObjectManager;
14+
use Magento\Payment\Block\Transparent\Iframe;
15+
use PHPUnit_Framework_MockObject_MockObject as MockObject;
16+
17+
/**
18+
* Class RedirectTest
19+
*/
20+
class RedirectTest extends \PHPUnit_Framework_TestCase
21+
{
22+
/**
23+
* @var RequestInterface|MockObject
24+
*/
25+
private $request;
26+
27+
/**
28+
* @var ViewInterface|MockObject
29+
*/
30+
private $view;
31+
32+
/**
33+
* @var Registry|MockObject
34+
*/
35+
private $coreRegistry;
36+
37+
/**
38+
* @var Escaper|MockObject
39+
*/
40+
private $escaper;
41+
42+
/**
43+
* @var Redirect
44+
*/
45+
private $controller;
46+
47+
protected function setUp()
48+
{
49+
$objectManager = new ObjectManager($this);
50+
51+
$this->request = static::getMockForAbstractClass(RequestInterface::class);
52+
53+
$this->view = static::getMockForAbstractClass(ViewInterface::class);
54+
55+
$this->coreRegistry = static::getMockBuilder(Registry::class)
56+
->disableOriginalConstructor()
57+
->setMethods(['register'])
58+
->getMock();
59+
60+
$this->escaper = static::getMockBuilder(Escaper::class)
61+
->disableOriginalConstructor()
62+
->setMethods(['escapeXssInUrl'])
63+
->getMock();
64+
65+
$this->controller = $objectManager->getObject(Redirect::class, [
66+
'request' => $this->request,
67+
'view' => $this->view,
68+
'coreRegistry' => $this->coreRegistry
69+
]);
70+
71+
$refClass = new \ReflectionClass(Redirect::class);
72+
$refProperty = $refClass->getProperty('escaper');
73+
$refProperty->setAccessible(true);
74+
$refProperty->setValue($this->controller, $this->escaper);
75+
}
76+
77+
/**
78+
* @covers \Magento\Authorizenet\Controller\Directpost\Payment\Redirect::execute
79+
*/
80+
public function testExecute()
81+
{
82+
$url = 'http://test.com/redirect?=test';
83+
$params = [
84+
'order_success' => $url
85+
];
86+
$this->request->expects(static::once())
87+
->method('getParams')
88+
->willReturn($params);
89+
90+
$this->escaper->expects(static::once())
91+
->method('escapeXssInUrl')
92+
->with($url)
93+
->willReturn($url);
94+
95+
$this->coreRegistry->expects(static::once())
96+
->method('register')
97+
->with(Iframe::REGISTRY_KEY, $params);
98+
99+
$this->view->expects(static::once())
100+
->method('addPageLayoutHandles');
101+
$this->view->expects(static::once())
102+
->method('loadLayout')
103+
->with(false)
104+
->willReturnSelf();
105+
$this->view->expects(static::once())
106+
->method('renderLayout');
107+
108+
$this->controller->execute();
109+
}
110+
}

0 commit comments

Comments
 (0)