Skip to content

Commit 5400465

Browse files
vzabaznovvzabaznov
authored
Merge pull request #1516 from magento-helix/MAGETWO-71868
MAGETWO-71868: Merge release branch into 2.0-develop
2 parents 145eca3 + f4eeb17 commit 5400465

File tree

546 files changed

+16559
-12663
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

546 files changed

+16559
-12663
lines changed

‎app/code/Magento/AdminNotification/Controller/Adminhtml/Notification.php

Lines changed: 2 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -10,10 +10,7 @@
1010
abstract class Notification extends \Magento\Backend\App\AbstractAction
1111
{
1212
/**
13-
* @return bool
13+
* {@inheritdoc}
1414
*/
15-
protected function _isAllowed()
16-
{
17-
return $this->_authorization->isAllowed('Magento_AdminNotification::show_list');
18-
}
15+
const ADMIN_RESOURCE = 'Magento_AdminNotification::show_list';
1916
}

‎app/code/Magento/AdminNotification/Controller/Adminhtml/Notification/MarkAsRead.php

Lines changed: 5 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,11 @@
88

99
class MarkAsRead extends \Magento\AdminNotification\Controller\Adminhtml\Notification
1010
{
11+
/**
12+
* {@inheritdoc}
13+
*/
14+
const ADMIN_RESOURCE = 'Magento_AdminNotification::mark_as_read';
15+
1116
/**
1217
* @return void
1318
*/
@@ -36,12 +41,4 @@ public function execute()
3641
}
3742
$this->_redirect('adminhtml/*/');
3843
}
39-
40-
/**
41-
* @return bool
42-
*/
43-
protected function _isAllowed()
44-
{
45-
return $this->_authorization->isAllowed('Magento_AdminNotification::mark_as_read');
46-
}
4744
}

‎app/code/Magento/AdminNotification/Controller/Adminhtml/Notification/MassMarkAsRead.php

Lines changed: 5 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,11 @@
88

99
class MassMarkAsRead extends \Magento\AdminNotification\Controller\Adminhtml\Notification
1010
{
11+
/**
12+
* {@inheritdoc}
13+
*/
14+
const ADMIN_RESOURCE = 'Magento_AdminNotification::mark_as_read';
15+
1116
/**
1217
* @return void
1318
*/
@@ -38,12 +43,4 @@ public function execute()
3843
}
3944
$this->_redirect('adminhtml/*/');
4045
}
41-
42-
/**
43-
* @return bool
44-
*/
45-
protected function _isAllowed()
46-
{
47-
return $this->_authorization->isAllowed('Magento_AdminNotification::mark_as_read');
48-
}
4946
}

‎app/code/Magento/AdminNotification/Controller/Adminhtml/Notification/MassRemove.php

Lines changed: 5 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,11 @@
88

99
class MassRemove extends \Magento\AdminNotification\Controller\Adminhtml\Notification
1010
{
11+
/**
12+
* {@inheritdoc}
13+
*/
14+
const ADMIN_RESOURCE = 'Magento_AdminNotification::adminnotification_remove';
15+
1116
/**
1217
* @return void
1318
*/
@@ -33,12 +38,4 @@ public function execute()
3338
}
3439
$this->getResponse()->setRedirect($this->_redirect->getRedirectUrl($this->getUrl('*')));
3540
}
36-
37-
/**
38-
* @return bool
39-
*/
40-
protected function _isAllowed()
41-
{
42-
return $this->_authorization->isAllowed('Magento_AdminNotification::adminnotification_remove');
43-
}
4441
}

‎app/code/Magento/AdminNotification/Controller/Adminhtml/Notification/Remove.php

Lines changed: 5 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,11 @@
88

99
class Remove extends \Magento\AdminNotification\Controller\Adminhtml\Notification
1010
{
11+
/**
12+
* {@inheritdoc}
13+
*/
14+
const ADMIN_RESOURCE = 'Magento_AdminNotification::adminnotification_remove';
15+
1116
/**
1217
* @return void
1318
*/
@@ -35,12 +40,4 @@ public function execute()
3540
}
3641
$this->_redirect('adminhtml/*/');
3742
}
38-
39-
/**
40-
* @return bool
41-
*/
42-
protected function _isAllowed()
43-
{
44-
return $this->_authorization->isAllowed('Magento_AdminNotification::adminnotification_remove');
45-
}
4643
}

‎app/code/Magento/AdminNotification/Controller/Adminhtml/System/Message/ListAction.php

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,13 @@
88

99
class ListAction extends \Magento\Backend\App\AbstractAction
1010
{
11+
/**
12+
* Authorization level of a basic admin session.
13+
*
14+
* @see _isAllowed()
15+
*/
16+
const ADMIN_RESOURCE = 'Magento_AdminNotification::show_list';
17+
1118
/**
1219
* @var \Magento\Framework\Json\Helper\Data
1320
*/

‎app/code/Magento/AdminNotification/Model/Feed.php

Lines changed: 14 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -146,9 +146,9 @@ public function checkUpdate()
146146
$feedData[] = [
147147
'severity' => (int)$item->severity,
148148
'date_added' => date('Y-m-d H:i:s', $itemPublicationDate),
149-
'title' => (string)$item->title,
150-
'description' => (string)$item->description,
151-
'url' => (string)$item->link,
149+
'title' => $this->escapeString($item->title),
150+
'description' => $this->escapeString($item->description),
151+
'url' => $this->escapeString($item->link),
152152
];
153153
}
154154
}
@@ -244,4 +244,15 @@ public function getFeedXml()
244244

245245
return $xml;
246246
}
247+
248+
/**
249+
* Converts incoming data to string format and escapes special characters.
250+
*
251+
* @param \SimpleXMLElement $data
252+
* @return string
253+
*/
254+
private function escapeString(\SimpleXMLElement $data)
255+
{
256+
return htmlspecialchars((string)$data);
257+
}
247258
}

‎app/code/Magento/AdminNotification/Test/Unit/Model/FeedTest.php

Lines changed: 65 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -52,13 +52,25 @@ class FeedTest extends \PHPUnit_Framework_TestCase
5252

5353
protected function setUp()
5454
{
55-
$this->inboxFactory = $this->getMock('Magento\AdminNotification\Model\InboxFactory', ['create'], [], '', false);
56-
$this->curlFactory = $this->getMock('Magento\Framework\HTTP\Adapter\CurlFactory', ['create'], [], '', false);
57-
$this->curl = $this->getMockBuilder('Magento\Framework\HTTP\Adapter\Curl')
55+
$this->inboxFactory = $this->getMock(
56+
\Magento\AdminNotification\Model\InboxFactory::class,
57+
['create'],
58+
[],
59+
'',
60+
false
61+
);
62+
$this->curlFactory = $this->getMock(
63+
\Magento\Framework\HTTP\Adapter\CurlFactory::class,
64+
['create'],
65+
[],
66+
'',
67+
false
68+
);
69+
$this->curl = $this->getMockBuilder(\Magento\Framework\HTTP\Adapter\Curl::class)
5870
->disableOriginalConstructor()->getMock();
59-
$this->appState = $this->getMock('Magento\Framework\App\State', ['getInstallDate'], [], '', false);
71+
$this->appState = $this->getMock(\Magento\Framework\App\State::class, ['getInstallDate'], [], '', false);
6072
$this->inboxModel = $this->getMock(
61-
'Magento\AdminNotification\Model\Inbox',
73+
\Magento\AdminNotification\Model\Inbox::class,
6274
[
6375
'__wakeup',
6476
'parse'
@@ -68,15 +80,15 @@ protected function setUp()
6880
false
6981
);
7082
$this->backendConfig = $this->getMock(
71-
'Magento\Backend\App\ConfigInterface',
83+
\Magento\Backend\App\ConfigInterface::class,
7284
[
7385
'getValue',
7486
'setValue',
7587
'isSetFlag'
7688
]
7789
);
7890
$this->cacheManager = $this->getMock(
79-
'Magento\Framework\App\CacheInterface',
91+
\Magento\Framework\App\CacheInterface::class,
8092
[
8193
'load',
8294
'getFrontend',
@@ -86,15 +98,15 @@ protected function setUp()
8698
]
8799
);
88100

89-
$this->deploymentConfig = $this->getMockBuilder('Magento\Framework\App\DeploymentConfig')
101+
$this->deploymentConfig = $this->getMockBuilder(\Magento\Framework\App\DeploymentConfig::class)
90102
->disableOriginalConstructor()->getMock();
91103
$this->objectManagerHelper = new ObjectManagerHelper($this);
92104

93-
$this->productMetadata = $this->getMock('Magento\Framework\App\ProductMetadata');
94-
$this->urlBuilder = $this->getMock('Magento\Framework\UrlInterface');
105+
$this->productMetadata = $this->getMock(\Magento\Framework\App\ProductMetadata::class);
106+
$this->urlBuilder = $this->getMock(\Magento\Framework\UrlInterface::class);
95107

96108
$this->feed = $this->objectManagerHelper->getObject(
97-
'Magento\AdminNotification\Model\Feed',
109+
\Magento\AdminNotification\Model\Feed::class,
98110
[
99111
'backendConfig' => $this->backendConfig,
100112
'cacheManager' => $this->cacheManager,
@@ -145,8 +157,27 @@ public function testCheckUpdate($callInbox, $curlRequest)
145157
->will($this->returnValue('Sat, 6 Sep 2014 16:46:11 UTC'));
146158
if ($callInbox) {
147159
$this->inboxFactory->expects($this->once())->method('create')
148-
->will(($this->returnValue($this->inboxModel)));
149-
$this->inboxModel->expects($this->once())->method('parse')->will($this->returnSelf());
160+
->will($this->returnValue($this->inboxModel));
161+
$this->inboxModel->expects($this->once())
162+
->method('parse')
163+
->with(
164+
$this->callback(
165+
function ($data) {
166+
$fieldsToCheck = ['title', 'description', 'url'];
167+
return array_reduce(
168+
$fieldsToCheck,
169+
function ($initialValue, $item) use ($data) {
170+
$haystack = (isset($data[0][$item]) ? $data[0][$item] : false);
171+
return $haystack
172+
? $initialValue && !strpos($haystack, '<') && !strpos($haystack, '>')
173+
: true;
174+
},
175+
true
176+
);
177+
}
178+
)
179+
)
180+
->will($this->returnSelf());
150181
} else {
151182
$this->inboxFactory->expects($this->never())->method('create');
152183
$this->inboxModel->expects($this->never())->method('parse');
@@ -196,7 +227,27 @@ public function checkUpdateDataProvider()
196227
</item>
197228
</channel>
198229
</rss>'
199-
]
230+
],
231+
[
232+
true,
233+
// @codingStandardsIgnoreStart
234+
'HEADER
235+
236+
<?xml version="1.0" encoding="utf-8" ?>
237+
<rss version="2.0" xmlns:atom="http://www.w3.org/2005/Atom">
238+
<channel>
239+
<title>MagentoCommerce</title>
240+
<item>
241+
<title><![CDATA[<script>alert("Hello!");</script>Test Title]]></title>
242+
<link><![CDATA[http://magento.com/feed_url<script>alert("Hello!");</script>]]></link>
243+
<severity>4</severity>
244+
<description><![CDATA[Test <script>alert("Hello!");</script>Description]]></description>
245+
<pubDate>Tue, 20 Jun 2017 13:14:47 UTC</pubDate>
246+
</item>
247+
</channel>
248+
</rss>'
249+
// @codingStandardsIgnoreEnd
250+
],
200251
];
201252
}
202253
}

‎app/code/Magento/AdminNotification/composer.json

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@
1010
"lib-libxml": "*"
1111
},
1212
"type": "magento2-module",
13-
"version": "100.0.6",
13+
"version": "100.0.7",
1414
"license": [
1515
"OSL-3.0",
1616
"AFL-3.0"

‎app/code/Magento/AdminNotification/etc/config.xml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@
1212
<feed_url>notifications.magentocommerce.com/magento2/community/notifications.rss</feed_url>
1313
<popup_url>widgets.magentocommerce.com/notificationPopup</popup_url>
1414
<severity_icons_url>widgets.magentocommerce.com/%s/%s.gif</severity_icons_url>
15-
<use_https>0</use_https>
15+
<use_https>1</use_https>
1616
<frequency>1</frequency>
1717
<last_update>0</last_update>
1818
</adminnotification>

0 commit comments

Comments
 (0)