Merge remote-tracking branch 'origin/2.3-develop' into libs-upgrade

Author: buskamuza

.htaccess

@@ -355,6 +355,15 @@
             Require all denied
         </IfVersion>
     </Files>
+    <Files auth.json>
+        <IfVersion < 2.4>
+            order allow,deny
+            deny from all
+        </IfVersion>
+        <IfVersion >= 2.4>
+            Require all denied
+        </IfVersion>
+    </Files>
 
 # For 404s and 403s that aren't handled by the application, show plain 404 response
 ErrorDocument 404 /pub/errors/404.php

.htaccess.sample

@@ -332,6 +332,15 @@
             Require all denied
         </IfVersion>
     </Files>
+    <Files auth.json>
+        <IfVersion < 2.4>
+            order allow,deny
+            deny from all
+        </IfVersion>
+        <IfVersion >= 2.4>
+            Require all denied
+        </IfVersion>
+    </Files>
 
 # For 404s and 403s that aren't handled by the application, show plain 404 response
 ErrorDocument 404 /pub/errors/404.php

README.md

@@ -1,4 +1,5 @@
 [![Build Status](https://travis-ci.org/magento/magento2.svg?branch=2.3-develop)](https://travis-ci.org/magento/magento2)
+[![Open Source Helpers](https://www.codetriage.com/magento/magento2/badges/users.svg)](https://www.codetriage.com/magento/magento2)
 [![Gitter](https://badges.gitter.im/Join%20Chat.svg)](https://gitter.im/magento/magento2?utm_source=badge&utm_medium=badge&utm_campaign=pr-badge)
 [![Crowdin](https://d322cqt584bo4o.cloudfront.net/magento-2/localized.png)](https://crowdin.com/project/magento-2)
 <h2>Welcome</h2>

app/code/Magento/Braintree/view/frontend/web/js/view/payment/method-renderer/hosted-fields.js

@@ -61,7 +61,7 @@ define([
         },
 
         /**
-         * @returns {Bool}
+         * @returns {Boolean}
          */
         isVaultEnabled: function () {
             return this.vaultEnabler.isVaultEnabled();
@@ -142,11 +142,20 @@ define([
             return true;
         },
 
+        /**
+         * Returns state of place order button
+         * @returns {Boolean}
+         */
+        isButtonActive: function () {
+            return this.isActive() && this.isPlaceOrderActionAllowed();
+        },
+
         /**
          * Trigger order placing
          */
         placeOrderClick: function () {
             if (this.validateCardType()) {
+                this.isPlaceOrderActionAllowed(false);
                 $(this.getSelector('submit')).trigger('click');
             }
         },

app/code/Magento/Braintree/view/frontend/web/template/payment/form.html

@@ -141,8 +141,7 @@
                         data-bind="
                             click: placeOrderClick,
                             attr: {title: $t('Place Order')},
-                            css: {disabled: !isPlaceOrderActionAllowed()},
-                            enable: isActive()
+                            enable: isButtonActive()
                         "
                         disabled>
                     <span data-bind="i18n: 'Place Order'"></span>

app/code/Magento/Bundle/Model/OptionRepository.php

@@ -201,10 +201,10 @@ public function save(
 
         /** @var \Magento\Bundle\Model\Option $existingOption */
         $existingOption = $optionCollection->getFirstItem();
-        if (!$optionId) {
-            $option->setOptionId(null);
-        }
         if (!$optionId || $existingOption->getParentId() != $parentId) {
+            //If option ID is empty or existing option's parent ID is different
+            //we'd need a new ID for the option.
+            $option->setOptionId(null);
             $option->setDefaultTitle($option->getTitle());
             if (is_array($option->getProductLinks())) {
                 $linksToAdd = $option->getProductLinks();

app/code/Magento/Bundle/Model/Product/SaveHandler.php

@@ -5,6 +5,7 @@
  */
 namespace Magento\Bundle\Model\Product;
 
+use Magento\Bundle\Api\Data\OptionInterface;
 use Magento\Catalog\Api\Data\ProductInterface;
 use Magento\Bundle\Api\ProductOptionRepositoryInterface as OptionRepository;
 use Magento\Bundle\Api\ProductLinkManagementInterface;
@@ -49,42 +50,58 @@ public function __construct(
             ?: ObjectManager::getInstance()->get(MetadataPool::class);
     }
 
+    /**
+     * @param ProductInterface $bundle
+     * @param OptionInterface[] $currentOptions
+     *
+     * @return void
+     */
+    private function removeOldOptions(
+        ProductInterface $bundle,
+        array $currentOptions
+    ) {
+        $oldOptions = $this->optionRepository->getList($bundle->getSku());
+        if ($oldOptions) {
+            $remainingOptions = [];
+            $metadata
+                = $this->metadataPool->getMetadata(ProductInterface::class);
+            $productId = $bundle->getData($metadata->getLinkField());
+
+            foreach ($currentOptions as $option) {
+                $remainingOptions[] = $option->getOptionId();
+            }
+            foreach ($oldOptions as $option) {
+                if (!in_array($option->getOptionId(), $remainingOptions)) {
+                    $option->setParentId($productId);
+                    $this->removeOptionLinks($bundle->getSku(), $option);
+                    $this->optionRepository->delete($option);
+                }
+            }
+        }
+    }
+
     /**
      * @param object $entity
      * @param array $arguments
-     * @return \Magento\Catalog\Api\Data\ProductInterface|object
+     *
+     * @return ProductInterface|object
+     *
      * @SuppressWarnings(PHPMD.UnusedFormalParameter)
      */
     public function execute($entity, $arguments = [])
     {
         /** @var \Magento\Bundle\Api\Data\OptionInterface[] $options */
         $options = $entity->getExtensionAttributes()->getBundleProductOptions() ?: [];
-
+        //Only processing bundle products.
         if ($entity->getTypeId() !== 'bundle' || empty($options)) {
             return $entity;
         }
-
+        /** @var ProductInterface $entity */
+        //Removing old options
         if (!$entity->getCopyFromView()) {
-            $updatedOptions = [];
-            $oldOptions = $this->optionRepository->getList($entity->getSku());
-
-            $metadata = $this->metadataPool->getMetadata(ProductInterface::class);
-
-            $productId = $entity->getData($metadata->getLinkField());
-
-            foreach ($options as $option) {
-                $updatedOptions[$option->getOptionId()][$productId] = (bool)$option->getOptionId();
-            }
-
-            foreach ($oldOptions as $option) {
-                if (!isset($updatedOptions[$option->getOptionId()][$productId])) {
-                    $option->setParentId($productId);
-                    $this->removeOptionLinks($entity->getSku(), $option);
-                    $this->optionRepository->delete($option);
-                }
-            }
+            $this->removeOldOptions($entity, $options);
         }
-
+        //Saving active options.
         foreach ($options as $option) {
             $this->optionRepository->save($entity, $option);
         }

app/code/Magento/Catalog/Block/Adminhtml/Product/Attribute/Set/Main.php

@@ -233,7 +233,7 @@ public function getGroupTreeJson()
         /* @var $node \Magento\Eav\Model\Entity\Attribute\Group */
         foreach ($groups as $node) {
             $item = [];
-            $item['text'] = $node->getAttributeGroupName();
+            $item['text'] = $this->escapeHtml($node->getAttributeGroupName());
             $item['id'] = $node->getAttributeGroupId();
             $item['cls'] = 'folder';
             $item['allowDrop'] = true;
@@ -280,7 +280,7 @@ public function getAttributeTreeJson()
 
         foreach ($attributes as $child) {
             $attr = [
-                'text' => $child->getAttributeCode(),
+                'text' => $this->escapeHtml($child->getAttributeCode()),
                 'id' => $child->getAttributeId(),
                 'cls' => 'leaf',
                 'allowDrop' => false,

app/code/Magento/Catalog/Model/Indexer/Category/Product/Action/Full.php

@@ -87,13 +87,29 @@ public function __construct(
         $this->activeTableSwitcher = $activeTableSwitcher ?: $objectManager->get(ActiveTableSwitcher::class);
     }
 
+    /**
+     *
+     * Clear the table we'll be writing de-normalized data into
+     * to prevent archived data getting in the way of actual data.
+     *
+     * @return void
+     */
+    private function clearCurrentTable()
+    {
+        $this->connection->delete(
+            $this->activeTableSwitcher
+                ->getAdditionalTableName($this->getMainTable())
+        );
+    }
+
     /**
      * Refresh entities index
      *
      * @return $this
      */
     public function execute()
     {
+        $this->clearCurrentTable();
         $this->reindex();
         $this->activeTableSwitcher->switchTable($this->connection, [$this->getMainTable()]);
         return $this;
@@ -103,6 +119,9 @@ public function execute()
      * Return select for remove unnecessary data
      *
      * @return \Magento\Framework\DB\Select
+     *
+     * @deprecated Not used anymore.
+     * @see clearCurrentTable()
      */
     protected function getSelectUnnecessaryData()
     {
@@ -127,12 +146,14 @@ protected function getSelectUnnecessaryData()
      * Remove unnecessary data
      *
      * @return void
+     *
+     * @deprecated Not used anymore.
+     * @see clearCurrentTable()
      */
     protected function removeUnnecessaryData()
     {
-        $this->connection->query(
-            $this->connection->deleteFromSelect($this->getSelectUnnecessaryData(), $this->getMainTable())
-        );
+        //Called for backward compatibility.
+        $this->getSelectUnnecessaryData();
     }
 
     /**
@@ -233,6 +254,7 @@ private function reindexCategoriesBySelect(\Magento\Framework\DB\Select $basicSe
                 )
             );
             $this->publishData();
+            //Called for backward compatibility.
             $this->removeUnnecessaryData();
         }
     }

app/code/Magento/Catalog/view/adminhtml/templates/catalog/product/attribute/set/main.phtml

@@ -315,7 +315,7 @@
                         },
 
                         validateGroupName : function(name, exceptNodeId) {
-                            name = name.strip();
+                            name = name.strip().escapeHTML();
                             var result = true;
                             if (name === '') {
                                 result = false;