Skip to content

Commit 6ffb363

Browse files
glo23503glo23503
committed
Merge remote-tracking branch 'magento-l3/ACP2E-1776' into APR222023_PR_sarmistha
2 parents 3545221 + ae0ae8a commit 6ffb363

File tree

8 files changed

+750
-10
lines changed

8 files changed

+750
-10
lines changed

‎app/code/Magento/Customer/Model/AccountManagement.php

Lines changed: 0 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -877,11 +877,6 @@ public function getConfirmationStatus($customerId)
877877
*/
878878
public function createAccount(CustomerInterface $customer, $password = null, $redirectUrl = '')
879879
{
880-
$groupId = $customer->getGroupId();
881-
if (isset($groupId) && !$this->authorization->isAllowed(self::ADMIN_RESOURCE)) {
882-
$customer->setGroupId(null);
883-
}
884-
885880
if ($password !== null) {
886881
$this->checkPasswordStrength($password);
887882
$customerEmail = $customer->getEmail();

‎app/code/Magento/Customer/Model/AccountManagementApi.php

Lines changed: 132 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,26 +6,158 @@
66

77
namespace Magento\Customer\Model;
88

9+
use Magento\Customer\Api\AddressRepositoryInterface;
10+
use Magento\Customer\Api\CustomerMetadataInterface;
11+
use Magento\Customer\Api\CustomerRepositoryInterface;
912
use Magento\Customer\Api\Data\CustomerInterface;
13+
use Magento\Customer\Api\Data\ValidationResultsInterfaceFactory;
14+
use Magento\Customer\Helper\View as CustomerViewHelper;
15+
use Magento\Customer\Model\Config\Share as ConfigShare;
16+
use Magento\Customer\Model\Customer as CustomerModel;
17+
use Magento\Customer\Model\Metadata\Validator;
18+
use Magento\Framework\Api\ExtensibleDataObjectConverter;
19+
use Magento\Framework\App\Config\ScopeConfigInterface;
20+
use Magento\Framework\AuthorizationInterface;
21+
use Magento\Framework\DataObjectFactory as ObjectFactory;
22+
use Magento\Framework\Encryption\EncryptorInterface as Encryptor;
23+
use Magento\Framework\Event\ManagerInterface;
24+
use Magento\Framework\Exception\AuthorizationException;
25+
use Magento\Framework\Mail\Template\TransportBuilder;
26+
use Magento\Framework\Math\Random;
27+
use Magento\Framework\Reflection\DataObjectProcessor;
28+
use Magento\Framework\Registry;
29+
use Magento\Framework\Stdlib\DateTime;
30+
use Magento\Framework\Stdlib\StringUtils as StringHelper;
31+
use Magento\Store\Model\StoreManagerInterface;
32+
use Psr\Log\LoggerInterface as PsrLogger;
1033

1134
/**
1235
* Account Management service implementation for external API access.
36+
*
1337
* Handle various customer account actions.
1438
*
1539
* @SuppressWarnings(PHPMD.CookieAndSessionMisuse)
40+
* @SuppressWarnings(PHPMD.CouplingBetweenObjects)
1641
*/
1742
class AccountManagementApi extends AccountManagement
1843
{
44+
/**
45+
* @var AuthorizationInterface
46+
*/
47+
private $authorization;
48+
49+
/**
50+
* @param CustomerFactory $customerFactory
51+
* @param ManagerInterface $eventManager
52+
* @param StoreManagerInterface $storeManager
53+
* @param Random $mathRandom
54+
* @param Validator $validator
55+
* @param ValidationResultsInterfaceFactory $validationResultsDataFactory
56+
* @param AddressRepositoryInterface $addressRepository
57+
* @param CustomerMetadataInterface $customerMetadataService
58+
* @param CustomerRegistry $customerRegistry
59+
* @param PsrLogger $logger
60+
* @param Encryptor $encryptor
61+
* @param ConfigShare $configShare
62+
* @param StringHelper $stringHelper
63+
* @param CustomerRepositoryInterface $customerRepository
64+
* @param ScopeConfigInterface $scopeConfig
65+
* @param TransportBuilder $transportBuilder
66+
* @param DataObjectProcessor $dataProcessor
67+
* @param Registry $registry
68+
* @param CustomerViewHelper $customerViewHelper
69+
* @param DateTime $dateTime
70+
* @param CustomerModel $customerModel
71+
* @param ObjectFactory $objectFactory
72+
* @param ExtensibleDataObjectConverter $extensibleDataObjectConverter
73+
* @param AuthorizationInterface $authorization
74+
* @SuppressWarnings(PHPMD.ExcessiveParameterList)
75+
*/
76+
public function __construct(
77+
CustomerFactory $customerFactory,
78+
ManagerInterface $eventManager,
79+
StoreManagerInterface $storeManager,
80+
Random $mathRandom,
81+
Validator $validator,
82+
ValidationResultsInterfaceFactory $validationResultsDataFactory,
83+
AddressRepositoryInterface $addressRepository,
84+
CustomerMetadataInterface $customerMetadataService,
85+
CustomerRegistry $customerRegistry,
86+
PsrLogger $logger,
87+
Encryptor $encryptor,
88+
ConfigShare $configShare,
89+
StringHelper $stringHelper,
90+
CustomerRepositoryInterface $customerRepository,
91+
ScopeConfigInterface $scopeConfig,
92+
TransportBuilder $transportBuilder,
93+
DataObjectProcessor $dataProcessor,
94+
Registry $registry,
95+
CustomerViewHelper $customerViewHelper,
96+
DateTime $dateTime,
97+
CustomerModel $customerModel,
98+
ObjectFactory $objectFactory,
99+
ExtensibleDataObjectConverter $extensibleDataObjectConverter,
100+
AuthorizationInterface $authorization
101+
) {
102+
$this->authorization = $authorization;
103+
parent::__construct(
104+
$customerFactory,
105+
$eventManager,
106+
$storeManager,
107+
$mathRandom,
108+
$validator,
109+
$validationResultsDataFactory,
110+
$addressRepository,
111+
$customerMetadataService,
112+
$customerRegistry,
113+
$logger,
114+
$encryptor,
115+
$configShare,
116+
$stringHelper,
117+
$customerRepository,
118+
$scopeConfig,
119+
$transportBuilder,
120+
$dataProcessor,
121+
$registry,
122+
$customerViewHelper,
123+
$dateTime,
124+
$customerModel,
125+
$objectFactory,
126+
$extensibleDataObjectConverter
127+
);
128+
}
129+
19130
/**
20131
* @inheritDoc
21132
*
22133
* Override createAccount method to unset confirmation attribute for security purposes.
23134
*/
24135
public function createAccount(CustomerInterface $customer, $password = null, $redirectUrl = '')
25136
{
137+
$this->validateCustomerRequest($customer);
26138
$customer = parent::createAccount($customer, $password, $redirectUrl);
27139
$customer->setConfirmation(null);
28140

29141
return $customer;
30142
}
143+
144+
/**
145+
* Validate anonymous request
146+
*
147+
* @param CustomerInterface $customer
148+
* @return void
149+
* @throws AuthorizationException
150+
*/
151+
private function validateCustomerRequest(CustomerInterface $customer): void
152+
{
153+
$groupId = $customer->getGroupId();
154+
if (isset($groupId) &&
155+
!$this->authorization->isAllowed(self::ADMIN_RESOURCE)
156+
) {
157+
$params = ['resources' => self::ADMIN_RESOURCE];
158+
throw new AuthorizationException(
159+
__("The consumer isn't authorized to access %resources.", $params)
160+
);
161+
}
162+
}
31163
}

‎app/code/Magento/Customer/Plugin/AsyncRequestCustomerGroupAuthorization.php

Lines changed: 78 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,78 @@
1+
<?php
2+
/**
3+
* Copyright © Magento, Inc. All rights reserved.
4+
* See COPYING.txt for license details.
5+
*/
6+
7+
declare(strict_types=1);
8+
9+
namespace Magento\Customer\Plugin;
10+
11+
use Magento\Customer\Api\Data\CustomerInterface;
12+
use Magento\Framework\App\ObjectManager;
13+
use Magento\Framework\AuthorizationInterface;
14+
use Magento\Framework\Exception\AuthorizationException;
15+
use Magento\AsynchronousOperations\Model\MassSchedule;
16+
17+
/**
18+
* Plugin to validate anonymous request for asynchronous operations containing group id.
19+
*/
20+
class AsyncRequestCustomerGroupAuthorization
21+
{
22+
/**
23+
* Authorization level of a basic admin session
24+
*
25+
* @see _isAllowed()
26+
*/
27+
public const ADMIN_RESOURCE = 'Magento_Customer::manage';
28+
29+
/**
30+
* @var AuthorizationInterface
31+
*/
32+
private $authorization;
33+
34+
/**
35+
*
36+
* @param AuthorizationInterface $authorization
37+
*/
38+
public function __construct(
39+
AuthorizationInterface $authorization
40+
) {
41+
$this->authorization = $authorization;
42+
}
43+
44+
/**
45+
* Validate groupId for anonymous request
46+
*
47+
* @param MassSchedule $massSchedule
48+
* @param string $topic
49+
* @param array $entitiesArray
50+
* @param string|null $groupId
51+
* @param string|null $userId
52+
* @return null
53+
* @throws AuthorizationException
54+
* @SuppressWarnings(PHPMD.UnusedFormalParameter)
55+
*/
56+
public function beforePublishMass(
57+
MassSchedule $massSchedule,
58+
string $topic,
59+
array $entitiesArray,
60+
string $groupId = null,
61+
string $userId = null
62+
) {
63+
foreach ($entitiesArray as $entityParams) {
64+
foreach ($entityParams as $entity) {
65+
if ($entity instanceof CustomerInterface) {
66+
$groupId = $entity->getGroupId();
67+
if (isset($groupId) && !$this->authorization->isAllowed(self::ADMIN_RESOURCE)) {
68+
$params = ['resources' => self::ADMIN_RESOURCE];
69+
throw new AuthorizationException(
70+
__("The consumer isn't authorized to access %resources.", $params)
71+
);
72+
}
73+
}
74+
}
75+
}
76+
return null;
77+
}
78+
}

0 commit comments

Comments
 (0)