Skip to content

Commit 9829aa4

Browse files
rganinrganin
committed
Merge branch 'develop' of https://github.corp.magento.com/magento2/magento2ce into MAGETWO-43102
Conflicts: dev/tests/functional/tests/app/Magento/CatalogRule/Test/Block/Adminhtml/Promo/Catalog/Edit/PromoForm.xml
2 parents fc47f03 + 0e6dcf2 commit 9829aa4

File tree

222 files changed

+10872
-1043
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

222 files changed

+10872
-1043
lines changed

‎app/code/Magento/Backend/Controller/Adminhtml/System/Account/Save.php

Lines changed: 27 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -9,9 +9,27 @@
99
use Magento\Framework\Exception\AuthenticationException;
1010
use Magento\Framework\Exception\LocalizedException;
1111
use Magento\Framework\Controller\ResultFactory;
12+
use Magento\Framework\Exception\State\UserLockedException;
1213

1314
class Save extends \Magento\Backend\Controller\Adminhtml\System\Account
1415
{
16+
/**
17+
* @var \Magento\Security\Helper\SecurityCookie
18+
*/
19+
protected $securityCookieHelper;
20+
21+
/**
22+
* @param \Magento\Backend\App\Action\Context $context
23+
* @param \Magento\Security\Helper\SecurityCookie $securityCookieHelper
24+
*/
25+
public function __construct(
26+
\Magento\Backend\App\Action\Context $context,
27+
\Magento\Security\Helper\SecurityCookie $securityCookieHelper
28+
) {
29+
parent::__construct($context);
30+
$this->securityCookieHelper = $securityCookieHelper;
31+
}
32+
1533
/**
1634
* Saving edited user information
1735
*
@@ -43,21 +61,22 @@ public function execute()
4361
/** Before updating admin user data, ensure that password of current admin user is entered and is correct */
4462
$currentUserPasswordField = \Magento\User\Block\User\Edit\Tab\Main::CURRENT_USER_PASSWORD_FIELD;
4563
$currentUserPassword = $this->getRequest()->getParam($currentUserPasswordField);
46-
$isCurrentUserPasswordValid = !empty($currentUserPassword) && is_string($currentUserPassword);
4764
try {
48-
if (!($isCurrentUserPasswordValid && $user->verifyIdentity($currentUserPassword))) {
49-
throw new AuthenticationException(__('You have entered an invalid password for current user.'));
50-
}
65+
$user->performIdentityCheck($currentUserPassword);
5166
if ($password !== '') {
5267
$user->setPassword($password);
5368
$user->setPasswordConfirmation($passwordConfirmation);
5469
}
5570
$user->save();
56-
/** Send password reset email notification only when password was changed */
57-
if ($password !== '') {
58-
$user->sendPasswordResetNotificationEmail();
59-
}
71+
72+
$user->sendNotificationEmailsIfRequired();
73+
6074
$this->messageManager->addSuccess(__('You saved the account.'));
75+
} catch (UserLockedException $e) {
76+
$this->_auth->logout();
77+
$this->securityCookieHelper->setLogoutReasonCookie(
78+
\Magento\Security\Model\AdminSessionsManager::LOGOUT_REASON_USER_LOCKED
79+
);
6180
} catch (ValidatorException $e) {
6281
$this->messageManager->addMessages($e->getMessages());
6382
if ($e->getMessage()) {

‎app/code/Magento/Backend/Test/Unit/Controller/Adminhtml/System/Account/SaveTest.php

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -42,6 +42,9 @@ class SaveTest extends \PHPUnit_Framework_TestCase
4242
/** @var \PHPUnit_Framework_MockObject_MockObject|\Magento\Framework\TranslateInterface */
4343
protected $_translatorMock;
4444

45+
/** @var \PHPUnit_Framework_MockObject_MockObject |\Magento\Framework\Event\ManagerInterface */
46+
protected $eventManagerMock;
47+
4548
protected function setUp()
4649
{
4750
$this->_requestMock = $this->getMockBuilder('Magento\Framework\App\Request\Http')
@@ -76,7 +79,7 @@ protected function setUp()
7679
$this->_userMock = $this->getMockBuilder('Magento\User\Model\User')
7780
->disableOriginalConstructor()
7881
->setMethods(
79-
['load', 'save', 'sendPasswordResetNotificationEmail', 'verifyIdentity', '__sleep', '__wakeup']
82+
['load', 'save', 'sendNotificationEmailsIfRequired', 'performIdentityCheck', '__sleep', '__wakeup']
8083
)
8184
->getMock();
8285

@@ -190,10 +193,9 @@ public function testSaveAction()
190193
);
191194

192195
$this->_userMock->setUserId($userId);
193-
196+
$this->_userMock->expects($this->once())->method('performIdentityCheck')->will($this->returnValue(true));
194197
$this->_userMock->expects($this->once())->method('save');
195-
$this->_userMock->expects($this->once())->method('verifyIdentity')->will($this->returnValue(true));
196-
$this->_userMock->expects($this->once())->method('sendPasswordResetNotificationEmail');
198+
$this->_userMock->expects($this->once())->method('sendNotificationEmailsIfRequired');
197199

198200
$this->_requestMock->setParams($requestParams);
199201

‎app/code/Magento/Backend/composer.json

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,7 @@
1313
"magento/module-quote": "100.0.*",
1414
"magento/module-catalog": "100.0.*",
1515
"magento/module-user": "100.0.*",
16+
"magento/module-security": "100.0.*",
1617
"magento/module-backup": "100.0.*",
1718
"magento/module-customer": "100.0.*",
1819
"magento/module-translation": "100.0.*",

‎app/code/Magento/Backend/etc/adminhtml/system.xml

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -368,12 +368,6 @@
368368
<label>Forgot and Reset Email Sender</label>
369369
<source_model>Magento\Config\Model\Config\Source\Email\Identity</source_model>
370370
</field>
371-
<field id="password_reset_link_expiration_period" translate="label comment" type="text" sortOrder="30" showInDefault="1" showInWebsite="0" showInStore="0">
372-
<label>Recovery Link Expiration Period (days)</label>
373-
<comment>Please enter a number 1 or greater in this field.</comment>
374-
<validate>required-entry integer validate-greater-than-zero</validate>
375-
<backend_model>Magento\Config\Model\Config\Backend\Admin\Password\Link\Expirationperiod</backend_model>
376-
</field>
377371
</group>
378372
<group id="startup" translate="label" type="text" sortOrder="20" showInDefault="1" showInWebsite="0" showInStore="0">
379373
<label>Startup Page</label>
@@ -414,6 +408,12 @@
414408
</group>
415409
<group id="security" translate="label" type="text" sortOrder="35" showInDefault="1" showInWebsite="0" showInStore="0">
416410
<label>Security</label>
411+
<field id="password_reset_link_expiration_period" translate="label comment" type="text" sortOrder="7" showInDefault="1" showInWebsite="0" showInStore="0">
412+
<label>Recovery Link Expiration Period (hours)</label>
413+
<comment>Please enter a number 1 or greater in this field.</comment>
414+
<validate>required-entry integer validate-greater-than-zero</validate>
415+
<backend_model>Magento\Config\Model\Config\Backend\Admin\Password\Link\Expirationperiod</backend_model>
416+
</field>
417417
<field id="use_form_key" translate="label" type="select" sortOrder="10" showInDefault="1" showInWebsite="0" showInStore="0">
418418
<label>Add Secret Key to URLs</label>
419419
<source_model>Magento\Config\Model\Config\Source\Yesno</source_model>

‎app/code/Magento/Captcha/Model/DefaultModel.php

Lines changed: 16 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -333,12 +333,27 @@ public function logAttempt($login)
333333
if ($this->_isEnabled() && in_array($this->_formId, $this->_getTargetForms())) {
334334
$this->_getResourceModel()->logAttempt($login);
335335
if ($this->_isOverLimitLoginAttempts($login)) {
336-
$this->_session->setData($this->_getFormIdKey('show_captcha'), 1);
336+
$this->setShowCaptchaInSession(true);
337337
}
338338
}
339339
return $this;
340340
}
341341

342+
/**
343+
* Set show_captcha flag in session
344+
*
345+
* @param bool $value
346+
* @return void
347+
*/
348+
public function setShowCaptchaInSession($value = true)
349+
{
350+
if ($value !== true) {
351+
$value = false;
352+
}
353+
354+
$this->_session->setData($this->_getFormIdKey('show_captcha'), $value);
355+
}
356+
342357
/**
343358
* Generate word used for captcha render
344359
*

‎app/code/Magento/Captcha/Observer/CheckUserEditObserver.php

Lines changed: 163 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,163 @@
1+
<?php
2+
/**
3+
* Copyright © 2015 Magento. All rights reserved.
4+
* See COPYING.txt for license details.
5+
*/
6+
namespace Magento\Captcha\Observer;
7+
8+
use Magento\Framework\Event\ObserverInterface;
9+
use Magento\Framework\Exception\NoSuchEntityException;
10+
use Magento\Customer\Helper\AccountManagement as AccountManagementHelper;
11+
use Magento\Customer\Model\Session;
12+
use Magento\Framework\App\Config\ScopeConfigInterface;
13+
use Magento\Customer\Api\CustomerRepositoryInterface;
14+
15+
/**
16+
* @SuppressWarnings(PHPMD.CouplingBetweenObjects)
17+
*/
18+
class CheckUserEditObserver implements ObserverInterface
19+
{
20+
/**
21+
* Form ID
22+
*/
23+
const FORM_ID = 'user_edit';
24+
25+
/**
26+
* @var \Magento\Captcha\Helper\Data
27+
*/
28+
protected $helper;
29+
30+
/**
31+
* @var \Magento\Framework\App\ActionFlag
32+
*/
33+
protected $actionFlag;
34+
35+
/**
36+
* @var \Magento\Framework\Message\ManagerInterface
37+
*/
38+
protected $messageManager;
39+
40+
/**
41+
* @var \Magento\Framework\App\Response\RedirectInterface
42+
*/
43+
protected $redirect;
44+
45+
/**
46+
* @var CaptchaStringResolver
47+
*/
48+
protected $captchaStringResolver;
49+
50+
/**
51+
* Account manager
52+
*
53+
* @var AccountManagementHelper
54+
*/
55+
protected $accountManagementHelper;
56+
57+
/**
58+
* @var Session
59+
*/
60+
protected $session;
61+
62+
/**
63+
* @var ScopeConfigInterface
64+
*/
65+
protected $scopeConfig;
66+
67+
/**
68+
* @var CustomerRepositoryInterface
69+
*/
70+
protected $customerRepository;
71+
72+
/**
73+
* @param \Magento\Captcha\Helper\Data $helper
74+
* @param \Magento\Framework\App\ActionFlag $actionFlag
75+
* @param \Magento\Framework\Message\ManagerInterface $messageManager
76+
* @param \Magento\Framework\App\Response\RedirectInterface $redirect
77+
* @param CaptchaStringResolver $captchaStringResolver
78+
* @param AccountManagementHelper $accountManagementHelper
79+
* @param Session $customerSession
80+
* @param ScopeConfigInterface $scopeConfig
81+
* @param CustomerRepositoryInterface $customerRepository
82+
*/
83+
public function __construct(
84+
\Magento\Captcha\Helper\Data $helper,
85+
\Magento\Framework\App\ActionFlag $actionFlag,
86+
\Magento\Framework\Message\ManagerInterface $messageManager,
87+
\Magento\Framework\App\Response\RedirectInterface $redirect,
88+
CaptchaStringResolver $captchaStringResolver,
89+
AccountManagementHelper $accountManagementHelper,
90+
Session $customerSession,
91+
ScopeConfigInterface $scopeConfig,
92+
CustomerRepositoryInterface $customerRepository
93+
) {
94+
$this->helper = $helper;
95+
$this->actionFlag = $actionFlag;
96+
$this->messageManager = $messageManager;
97+
$this->redirect = $redirect;
98+
$this->captchaStringResolver = $captchaStringResolver;
99+
$this->accountManagementHelper = $accountManagementHelper;
100+
$this->customerSession = $customerSession;
101+
$this->scopeConfig = $scopeConfig;
102+
$this->customerRepository = $customerRepository;
103+
}
104+
105+
/**
106+
* Check Captcha On Forgot Password Page
107+
*
108+
* @param \Magento\Framework\Event\Observer $observer
109+
* @return $this
110+
*/
111+
public function execute(\Magento\Framework\Event\Observer $observer)
112+
{
113+
$captchaModel = $this->helper->getCaptcha(self::FORM_ID);
114+
if ($captchaModel->isRequired()) {
115+
/** @var \Magento\Framework\App\Action\Action $controller */
116+
$controller = $observer->getControllerAction();
117+
if (!$captchaModel->isCorrect(
118+
$this->captchaStringResolver->resolve(
119+
$controller->getRequest(),
120+
self::FORM_ID
121+
)
122+
)) {
123+
try {
124+
$customer = $this->customerRepository->getById($this->customerSession->getCustomerId());
125+
$this->accountManagementHelper->processCustomerLockoutData($customer->getId());
126+
$this->customerRepository->save($customer);
127+
} catch (NoSuchEntityException $e) {
128+
//do nothing as customer existance is validated later in authenticate method
129+
}
130+
$this->workWithLock();
131+
$this->messageManager->addError(__('Incorrect CAPTCHA'));
132+
$this->actionFlag->set('', \Magento\Framework\App\Action\Action::FLAG_NO_DISPATCH, true);
133+
$this->redirect->redirect($controller->getResponse(), '*/*/edit');
134+
}
135+
}
136+
137+
$customer = $this->customerSession->getCustomer();
138+
$login = $customer->getEmail();
139+
$captchaModel->logAttempt($login);
140+
141+
return $this;
142+
}
143+
144+
/**
145+
* Logout a user if it is locked
146+
*
147+
* @throws \Magento\Framework\Exception\SessionException
148+
* @return void
149+
*/
150+
protected function workWithLock()
151+
{
152+
$customerModel = $this->customerSession->getCustomer();
153+
if ($customerModel->isCustomerLocked()) {
154+
$this->customerSession->logout();
155+
$this->customerSession->start();
156+
$message = __(
157+
'The account is locked. Please wait and try again or contact %1.',
158+
$this->scopeConfig->getValue('contact/email/recipient_email')
159+
);
160+
$this->messageManager->addError($message);
161+
}
162+
}
163+
}

0 commit comments

Comments
 (0)