Merge MAGETWO-97066 into 2.2.8-bugfixes-180119

Author: dvoskoboinikov

app/code/Magento/Catalog/Block/Adminhtml/Product/Attribute/Edit.php

@@ -91,7 +91,23 @@ protected function _construct()
         if (!$entityAttribute || !$entityAttribute->getIsUserDefined()) {
             $this->buttonList->remove('delete');
         } else {
-            $this->buttonList->update('delete', 'label', __('Delete Attribute'));
+            $this->buttonList->update(
+                'delete',
+                'onclick',
+                sprintf(
+                    "deleteConfirm('%s','%s', %s)",
+                    __('Are you sure you want to do this?'),
+                    $this->getDeleteUrl(),
+                    json_encode(
+                        [
+                            'action' => '',
+                            'data' => [
+                                'form_key' => $this->getFormKey()
+                            ]
+                        ]
+                    )
+                )
+            );
         }
     }
 

app/code/Magento/Catalog/Controller/Adminhtml/Product/Attribute/Delete.php

@@ -6,13 +6,20 @@
  */
 namespace Magento\Catalog\Controller\Adminhtml\Product\Attribute;
 
+use Magento\Framework\Exception\NotFoundException;
+
 class Delete extends \Magento\Catalog\Controller\Adminhtml\Product\Attribute
 {
     /**
      * @return \Magento\Backend\Model\View\Result\Redirect
+     * @throws NotFoundException
      */
     public function execute()
     {
+        if (!$this->getRequest()->isPost()) {
+            throw new NotFoundException(__('Page not found'));
+        }
+
         $id = $this->getRequest()->getParam('attribute_id');
         $resultRedirect = $this->resultRedirectFactory->create();
         if ($id) {

app/code/Magento/Catalog/Controller/Adminhtml/Product/Attribute/Save.php

@@ -29,6 +29,7 @@
 use Magento\Framework\Registry;
 use Magento\Framework\View\LayoutFactory;
 use Magento\Framework\View\Result\PageFactory;
+use Magento\Framework\Exception\NotFoundException;
 
 /**
  * @SuppressWarnings(PHPMD.CouplingBetweenObjects)
@@ -124,6 +125,10 @@ public function __construct(
      */
     public function execute()
     {
+        if (!$this->getRequest()->isPost()) {
+            throw new NotFoundException(__('Page not found'));
+        }
+
         try {
             $optionData = $this->formDataSerializer->unserialize(
                 $this->getRequest()->getParam('serialized_options', '[]')