Merge branch 'MAGETWO-36837-authentication-bypass' into develop

Author: Dale Sikkema

app/code/Magento/Backend/App/AbstractAction.php

@@ -81,17 +81,10 @@ abstract class AbstractAction extends \Magento\Framework\App\Action\Action
      */
     protected $_formKeyValidator;
 
-    /**
-     * Resource used to authorize access to the controller
-     *
-     * @var string
-     */
-    protected $resource;
-
     /**
      * @param \Magento\Backend\App\Action\Context $context
      */
-    public function __construct(Action\Context $context, $resource = '')
+    public function __construct(Action\Context $context)
     {
         parent::__construct($context);
         $this->_authorization = $context->getAuthorization();
@@ -109,7 +102,7 @@ public function __construct(Action\Context $context, $resource = '')
      */
     protected function _isAllowed()
     {
-        return $this->_authorization->isAllowed($this->resource ?: self::ADMIN_RESOURCE);
+        return $this->_authorization->isAllowed(self::ADMIN_RESOURCE);
     }
 
     /**

app/code/Magento/Backend/Test/Unit/App/Action/Plugin/AuthenticationTest.php

@@ -89,7 +89,7 @@ public function testAroundDispatchProlongStorage()
      * Calls aroundDispatch to access protected method _processNotLoggedInUser
      *
      * Data provider supplies different possibilities of request parameters and properties
-     * @dataProvider userNotLoggedInRequest
+     * @dataProvider processNotLoggedInUserDataProvider
      */
     public function testProcessNotLoggedInUser($isIFrameParam, $isAjaxParam, $isForwardedFlag)
     {
@@ -143,14 +143,13 @@ public function testProcessNotLoggedInUser($isIFrameParam, $isAjaxParam, $isForw
         $request->expects($this->exactly($setterCalls))->method('setDispatched')->with(false)->willReturnSelf();
 
         $expectedResult = 'expectedResult';
-        $proceed = function ($request) use ($expectedResult)
-        {
+        $proceed = function ($request) use ($expectedResult) {
             return $expectedResult;
         };
         $this->assertEquals($expectedResult, $this->plugin->aroundDispatch($subject, $proceed, $request));
     }
 
-    public function userNotLoggedInRequest()
+    public function processNotLoggedInUserDataProvider()
     {
         return [
             'iFrame' => [true, false, false],