Merge pull request #4466 from magento-arcticfoxes/MC-17309

[arcticfoxes] Bug Fixes

Author: Joan He

app/code/Magento/Rule/Model/Condition/Sql/Builder.php

@@ -152,9 +152,11 @@ protected function _getMappedSqlCondition(
     ): string {
         $argument = $condition->getMappedSqlField();
 
-        // If rule hasn't valid argument - create negative expression to prevent incorrect rule behavior.
+        // If rule hasn't valid argument - prevent incorrect rule behavior.
         if (empty($argument)) {
             return $this->_expressionFactory->create(['expression' => '1 = -1']);
+        } elseif (preg_match('/[^a-z0-9\-_\.\`]/i', $argument) > 0) {
+            throw new \Magento\Framework\Exception\LocalizedException(__('Invalid field'));
         }
 
         $conditionOperator = $condition->getOperatorForValidate();
@@ -195,7 +197,6 @@ protected function _getMappedSqlCondition(
                 );
             }
         }
-
         return $this->_expressionFactory->create(
             ['expression' => $expression]
         );
@@ -241,6 +242,7 @@ protected function _getMappedSqlCombination(
      * @param AbstractCollection $collection
      * @param Combine $combine
      * @return void
+     * @throws \Magento\Framework\Exception\LocalizedException
      */
     public function attachConditionToCollection(
         AbstractCollection $collection,
@@ -250,29 +252,45 @@ public function attachConditionToCollection(
         $this->_joinTablesToCollection($collection, $combine);
         $whereExpression = (string)$this->_getMappedSqlCombination($combine);
         if (!empty($whereExpression)) {
-            if (!empty($combine->getConditions())) {
-                $conditions = '';
-                $attributeField = '';
-                foreach ($combine->getConditions() as $condition) {
-                    if ($condition->getData('attribute') === \Magento\Catalog\Api\Data\ProductInterface::SKU) {
-                        $conditions = $condition->getData('value');
-                        $attributeField = $condition->getMappedSqlField();
-                    }
-                }
+            $collection->getSelect()->where($whereExpression);
+            $this->buildConditions($collection, $combine);
+        }
+    }
 
-                $collection->getSelect()->where($whereExpression);
+    /**
+     * Build sql conditions from combination.
+     *
+     * @param AbstractCollection $collection
+     * @param Combine $combine
+     * @return void
+     */
+    private function buildConditions(AbstractCollection $collection, Combine $combine) : void
+    {
+        if (!empty($combine->getConditions())) {
+            $conditions = '';
+            $attributeField = '';
+            foreach ($combine->getConditions() as $condition) {
+                if ($condition->getData('attribute') === \Magento\Catalog\Api\Data\ProductInterface::SKU) {
+                    $conditions = $condition->getData('value');
+                    $attributeField = $condition->getMappedSqlField();
+                }
+            }
 
-                if (!empty($conditions) && !empty($attributeField)) {
-                    $conditions = explode(',', $conditions);
-                    foreach ($conditions as &$condition) {
-                        $condition = "'" . trim($condition) . "'";
-                    }
-                    $conditions = implode(', ', $conditions);
-                    $collection->getSelect()->order("FIELD($attributeField, $conditions)");
+            if (!empty($conditions) && !empty($attributeField)) {
+                $conditions = explode(',', $conditions);
+                foreach ($conditions as &$condition) {
+                    $condition = trim($condition);
                 }
-            } else {
-                // Select ::where method adds braces even on empty expression
-                $collection->getSelect()->where($whereExpression);
+                $conditions = implode(', ', $conditions);
+                $collection->getSelect()->order(
+                    $this->_connection->quoteInto(
+                        "FIELD(?, ?)",
+                        [
+                            $attributeField,
+                            $conditions
+                        ]
+                    )
+                );
             }
         }
     }