Skip to content

Commit 5ef3cb7

Browse files
dvoskoboinikovdvoskoboinikov
committed
Merge branch '2.3.7-develop' into 2.3.7-develop-2.3-develop-sync-030121
# Conflicts: # app/code/Magento/Backend/Test/Unit/Model/Auth/SessionTest.php # app/code/Magento/Captcha/Test/Unit/Model/DefaultTest.php # app/code/Magento/Checkout/Test/Unit/Model/GuestPaymentInformationManagementTest.php # app/code/Magento/Checkout/Test/Unit/Model/PaymentInformationManagementTest.php # app/code/Magento/Cms/Test/Unit/Helper/Wysiwyg/ImagesTest.php # app/code/Magento/Cms/Test/Unit/Model/Wysiwyg/Images/StorageTest.php # app/code/Magento/Customer/Test/Unit/Controller/Account/LogoutTest.php # app/code/Magento/Customer/Test/Unit/Model/AccountManagementTest.php # app/code/Magento/Customer/Test/Unit/Model/FileProcessorTest.php # app/code/Magento/Customer/Test/Unit/Model/Metadata/Form/FileTest.php # app/code/Magento/Customer/Test/Unit/Model/Metadata/Form/ImageTest.php # app/code/Magento/ImportExport/Test/Unit/Controller/Adminhtml/Export/File/DownloadTest.php # app/code/Magento/ImportExport/Test/Unit/Helper/ReportTest.php # app/code/Magento/Persistent/Test/Unit/Model/SessionTest.php # app/code/Magento/SendFriend/Test/Unit/Model/SendFriendTest.php # app/code/Magento/Swatches/Test/Unit/Controller/Ajax/MediaTest.php # app/code/Magento/Theme/Test/Unit/Controller/Adminhtml/System/Design/Theme/DownloadCssTest.php # app/code/Magento/Theme/Test/Unit/Helper/StorageTest.php # app/code/Magento/Theme/Test/Unit/Model/Design/Backend/FileTest.php # app/code/Magento/Theme/Test/Unit/Model/Wysiwyg/StorageTest.php # app/code/Magento/Ui/Test/Unit/Component/Listing/Columns/ColumnTest.php # dev/tests/api-functional/testsuite/Magento/Customer/Api/CustomerRepositoryTest.php # dev/tests/api-functional/testsuite/Magento/GraphQl/Customer/GetCustomerTest.php # dev/tests/integration/testsuite/Magento/User/Model/UserTest.php # lib/internal/Magento/Framework/App/Test/Unit/StaticResourceTest.php # lib/internal/Magento/Framework/DB/Test/Unit/Adapter/Pdo/MysqlTest.php # lib/internal/Magento/Framework/Filesystem/Test/Unit/Driver/FileTest.php # lib/internal/Magento/Framework/Session/Test/Unit/ConfigTest.php # lib/internal/Magento/Framework/Stdlib/Test/Unit/Cookie/PhpCookieManagerTest.php
2 parents 7865bf0 + c1025c0 commit 5ef3cb7

File tree

350 files changed

+52109
-35788
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

350 files changed

+52109
-35788
lines changed

‎app/code/Magento/Authorization/Model/CompositeUserContext.php

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -56,15 +56,15 @@ protected function add(UserContextInterface $userContext)
5656
}
5757

5858
/**
59-
* {@inheritdoc}
59+
* @inheritDoc
6060
*/
6161
public function getUserId()
6262
{
6363
return $this->getUserContext() ? $this->getUserContext()->getUserId() : null;
6464
}
6565

6666
/**
67-
* {@inheritdoc}
67+
* @inheritDoc
6868
*/
6969
public function getUserType()
7070
{
@@ -78,7 +78,7 @@ public function getUserType()
7878
*/
7979
protected function getUserContext()
8080
{
81-
if ($this->chosenUserContext === null) {
81+
if (!$this->chosenUserContext) {
8282
/** @var UserContextInterface $userContext */
8383
foreach ($this->userContexts as $userContext) {
8484
if ($userContext->getUserType() && $userContext->getUserId() !== null) {

‎app/code/Magento/Authorization/Model/ResourceModel/Role.php

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -119,6 +119,8 @@ protected function _afterDelete(\Magento\Framework\Model\AbstractModel $role)
119119

120120
$connection->delete($this->_ruleTable, ['role_id = ?' => (int)$role->getId()]);
121121

122+
$this->_cache->clean(\Zend_Cache::CLEANING_MODE_MATCHING_TAG, [\Magento\Backend\Block\Menu::CACHE_TAGS]);
123+
122124
return $this;
123125
}
124126

‎app/code/Magento/Authorization/Model/Role.php

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -33,6 +33,11 @@ class Role extends \Magento\Framework\Model\AbstractModel
3333
*/
3434
protected $_eventPrefix = 'authorization_roles';
3535

36+
/**
37+
* @var string
38+
*/
39+
protected $_cacheTag = 'user_assigned_role';
40+
3641
/**
3742
* @param \Magento\Framework\Model\Context $context
3843
* @param \Magento\Framework\Registry $registry

‎app/code/Magento/Backend/App/AbstractAction.php

Lines changed: 22 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -5,9 +5,12 @@
55
*/
66
namespace Magento\Backend\App;
77

8+
use Magento\Framework\Encryption\Helper\Security;
9+
810
/**
911
* Generic backend controller
1012
*
13+
* phpcs:disable Magento2.Classes.AbstractApi
1114
* @api
1215
* @SuppressWarnings(PHPMD.NumberOfChildren)
1316
* @SuppressWarnings(PHPMD.CouplingBetweenObjects)
@@ -101,6 +104,8 @@ public function __construct(Action\Context $context)
101104
}
102105

103106
/**
107+
* Checking if the user has access to requested component.
108+
*
104109
* @return bool
105110
*/
106111
protected function _isAllowed()
@@ -119,6 +124,8 @@ protected function _getSession()
119124
}
120125

121126
/**
127+
* Get message manager.
128+
*
122129
* @return \Magento\Framework\Message\ManagerInterface
123130
*/
124131
protected function getMessageManager()
@@ -146,6 +153,8 @@ protected function _setActiveMenu($itemId)
146153
}
147154

148155
/**
156+
* Prepare breadcrumbs.
157+
*
149158
* @param string $label
150159
* @param string $title
151160
* @param string|null $link
@@ -158,6 +167,8 @@ protected function _addBreadcrumb($label, $title, $link = null)
158167
}
159168

160169
/**
170+
* Add content to specified block.
171+
*
161172
* @param \Magento\Framework\View\Element\AbstractBlock $block
162173
* @return $this
163174
*/
@@ -167,6 +178,8 @@ protected function _addContent(\Magento\Framework\View\Element\AbstractBlock $bl
167178
}
168179

169180
/**
181+
* Move block to left container.
182+
*
170183
* @param \Magento\Framework\View\Element\AbstractBlock $block
171184
* @return $this
172185
*/
@@ -176,6 +189,8 @@ protected function _addLeft(\Magento\Framework\View\Element\AbstractBlock $block
176189
}
177190

178191
/**
192+
* Add js to specified block.
193+
*
179194
* @param \Magento\Framework\View\Element\AbstractBlock $block
180195
* @return $this
181196
*/
@@ -200,6 +215,8 @@ private function _moveBlockToContainer(\Magento\Framework\View\Element\AbstractB
200215
}
201216

202217
/**
218+
* Dispatch request.
219+
*
203220
* @param \Magento\Framework\App\RequestInterface $request
204221
* @return \Magento\Framework\App\ResponseInterface
205222
*/
@@ -286,8 +303,7 @@ public function _processUrlKeys()
286303
}
287304

288305
/**
289-
* Set session locale,
290-
* process force locale set through url params
306+
* Set session locale, process force locale set through url params.
291307
*
292308
* @return $this
293309
*/
@@ -309,8 +325,8 @@ protected function _processLocaleSettings()
309325
* Set redirect into response
310326
*
311327
* @TODO MAGETWO-28356: Refactor controller actions to new ResultInterface
312-
* @param string $path
313-
* @param array $arguments
328+
* @param string $path
329+
* @param array $arguments
314330
* @return \Magento\Framework\App\ResponseInterface
315331
*/
316332
protected function _redirect($path, $arguments = [])
@@ -333,7 +349,7 @@ protected function _redirect($path, $arguments = [])
333349
protected function _forward($action, $controller = null, $module = null, array $params = null)
334350
{
335351
$this->_getSession()->setIsUrlNotice($this->_actionFlag->get('', self::FLAG_IS_URLS_CHECKED));
336-
return parent::_forward($action, $controller, $module, $params);
352+
parent::_forward($action, $controller, $module, $params);
337353
}
338354

339355
/**
@@ -360,7 +376,7 @@ protected function _validateSecretKey()
360376
}
361377

362378
$secretKey = $this->getRequest()->getParam(\Magento\Backend\Model\UrlInterface::SECRET_KEY_PARAM_NAME, null);
363-
if (!$secretKey || $secretKey != $this->_backendUrl->getSecretKey()) {
379+
if (!$secretKey || !Security::compareStrings($secretKey, $this->_backendUrl->getSecretKey())) {
364380
return false;
365381
}
366382
return true;

‎app/code/Magento/Backend/Block/Widget.php

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -91,7 +91,7 @@ public function getButtonHtml($label, $onclick, $class = '', $buttonId = null, $
9191
\Magento\Backend\Block\Widget\Button::class
9292
)->setData(
9393
[
94-
'label' => $this->escapeHtml($label),
94+
'label' => $label,
9595
'onclick' => $onclick,
9696
'class' => $class,
9797
'type' => 'button',

‎app/code/Magento/Backend/Controller/Adminhtml/System/Account/Save.php

Lines changed: 14 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -5,35 +5,37 @@
55
*/
66
namespace Magento\Backend\Controller\Adminhtml\System\Account;
77

8+
use Magento\Backend\App\Action\Context;
9+
use Magento\Framework\App\Action\HttpPostActionInterface;
10+
use Magento\Framework\App\ObjectManager;
811
use Magento\Framework\Validator\Exception as ValidatorException;
9-
use Magento\Framework\Exception\AuthenticationException;
1012
use Magento\Framework\Exception\LocalizedException;
1113
use Magento\Framework\Controller\ResultFactory;
1214
use Magento\Framework\Exception\State\UserLockedException;
1315
use Magento\Security\Model\SecurityCookie;
1416

1517
/**
18+
* Saving an admin user info.
19+
*
1620
* @SuppressWarnings(PHPMD.CouplingBetweenObjects)
1721
*/
18-
class Save extends \Magento\Backend\Controller\Adminhtml\System\Account
22+
class Save extends \Magento\Backend\Controller\Adminhtml\System\Account implements HttpPostActionInterface
1923
{
2024
/**
2125
* @var SecurityCookie
2226
*/
2327
private $securityCookie;
2428

2529
/**
26-
* Get security cookie
30+
* Save controller constructor.
2731
*
28-
* @return SecurityCookie
29-
* @deprecated 100.1.0
32+
* @param Context $context
33+
* @param SecurityCookie|null $securityCookie
3034
*/
31-
private function getSecurityCookie()
35+
public function __construct(Context $context, ?SecurityCookie $securityCookie = null)
3236
{
33-
if (!($this->securityCookie instanceof SecurityCookie)) {
34-
return \Magento\Framework\App\ObjectManager::getInstance()->get(SecurityCookie::class);
35-
}
36-
return $this->securityCookie;
37+
parent::__construct($context);
38+
$this->securityCookie = $securityCookie ?? ObjectManager::getInstance()->get(SecurityCookie::class);
3739
}
3840

3941
/**
@@ -71,7 +73,7 @@ public function execute()
7173
$user->performIdentityCheck($currentUserPassword);
7274
if ($password !== '') {
7375
$user->setPassword($password);
74-
$user->setPasswordConfirmation($passwordConfirmation);
76+
$user->setData('password_confirmation', $passwordConfirmation);
7577
}
7678
$errors = $user->validate();
7779
if ($errors !== true && !empty($errors)) {
@@ -85,7 +87,7 @@ public function execute()
8587
}
8688
} catch (UserLockedException $e) {
8789
$this->_auth->logout();
88-
$this->getSecurityCookie()->setLogoutReasonCookie(
90+
$this->securityCookie->setLogoutReasonCookie(
8991
\Magento\Security\Model\AdminSessionsManager::LOGOUT_REASON_USER_LOCKED
9092
);
9193
} catch (ValidatorException $e) {

‎app/code/Magento/Backend/Model/Auth/Session.php

Lines changed: 34 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3,10 +3,14 @@
33
* Copyright © Magento, Inc. All rights reserved.
44
* See COPYING.txt for license details.
55
*/
6+
declare(strict_types=1);
7+
68
namespace Magento\Backend\Model\Auth;
79

10+
use Magento\Framework\App\ObjectManager;
811
use Magento\Framework\Stdlib\Cookie\CookieMetadataFactory;
912
use Magento\Framework\Stdlib\CookieManagerInterface;
13+
use Magento\Framework\Message\ManagerInterface;
1014

1115
/**
1216
* Backend Auth session model
@@ -56,6 +60,11 @@ class Session extends \Magento\Framework\Session\SessionManager implements \Mage
5660
*/
5761
protected $_config;
5862

63+
/**
64+
* @var ManagerInterface
65+
*/
66+
private $messageManager;
67+
5968
/**
6069
* @param \Magento\Framework\App\Request\Http $request
6170
* @param \Magento\Framework\Session\SidResolverInterface $sidResolver
@@ -69,6 +78,7 @@ class Session extends \Magento\Framework\Session\SessionManager implements \Mage
6978
* @param \Magento\Framework\Acl\Builder $aclBuilder
7079
* @param \Magento\Backend\Model\UrlInterface $backendUrl
7180
* @param \Magento\Backend\App\ConfigInterface $config
81+
* @param ManagerInterface $messageManager
7282
* @throws \Magento\Framework\Exception\SessionException
7383
* @SuppressWarnings(PHPMD.ExcessiveParameterList)
7484
*/
@@ -84,11 +94,13 @@ public function __construct(
8494
\Magento\Framework\App\State $appState,
8595
\Magento\Framework\Acl\Builder $aclBuilder,
8696
\Magento\Backend\Model\UrlInterface $backendUrl,
87-
\Magento\Backend\App\ConfigInterface $config
97+
\Magento\Backend\App\ConfigInterface $config,
98+
ManagerInterface $messageManager = null
8899
) {
89100
$this->_config = $config;
90101
$this->_aclBuilder = $aclBuilder;
91102
$this->_backendUrl = $backendUrl;
103+
$this->messageManager = $messageManager ?? ObjectManager::getInstance()->get(ManagerInterface::class);
92104
parent::__construct(
93105
$request,
94106
$sidResolver,
@@ -171,6 +183,25 @@ public function isLoggedIn()
171183
*/
172184
public function prolong()
173185
{
186+
$sessionUser = $this->getUser();
187+
$errorMessage = '';
188+
if ($sessionUser !== null) {
189+
if ((int)$sessionUser->getIsActive() !== 1) {
190+
$errorMessage = 'The account sign-in was incorrect or your account is disabled temporarily. '
191+
. 'Please wait and try again later.';
192+
}
193+
if (!$sessionUser->hasAssigned2Role($sessionUser->getId())) {
194+
$errorMessage = 'More permissions are needed to access this.';
195+
}
196+
197+
if (!empty($errorMessage)) {
198+
$this->destroy();
199+
$this->messageManager->addErrorMessage(__($errorMessage));
200+
201+
return;
202+
}
203+
}
204+
174205
$lifetime = $this->_config->getValue(self::XML_PATH_SESSION_LIFETIME);
175206
$cookieValue = $this->cookieManager->getCookie($this->getName());
176207

@@ -181,7 +212,8 @@ public function prolong()
181212
->setPath($this->sessionConfig->getCookiePath())
182213
->setDomain($this->sessionConfig->getCookieDomain())
183214
->setSecure($this->sessionConfig->getCookieSecure())
184-
->setHttpOnly($this->sessionConfig->getCookieHttpOnly());
215+
->setHttpOnly($this->sessionConfig->getCookieHttpOnly())
216+
->setSameSite($this->sessionConfig->getCookieSameSite());
185217
$this->cookieManager->setPublicCookie($this->getName(), $cookieValue, $cookieMetadata);
186218
}
187219
}

‎app/code/Magento/Backend/Model/Session/AdminConfig.php

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -85,6 +85,7 @@ public function __construct(
8585
$this->setCookiePath($adminPath);
8686
$this->setName($sessionName);
8787
$this->setCookieSecure($this->_httpRequest->isSecure());
88+
$this->setCookieSameSite('Lax');
8889
}
8990

9091
/**
@@ -96,6 +97,7 @@ private function extractAdminPath()
9697
{
9798
$backendApp = $this->backendAppList->getCurrentApp();
9899
$cookiePath = null;
100+
//phpcs:ignore
99101
$baseUrl = parse_url($this->backendUrlFactory->create()->getBaseUrl(), PHP_URL_PATH);
100102
if (!$backendApp) {
101103
$cookiePath = $baseUrl . $this->_frontNameResolver->getFrontName();

0 commit comments

Comments
 (0)