Skip to content

Commit 98c65ea

Browse files
SeruyVSeruyV
committed
Merge remote-tracking branch 'origin/2.1.18-develop' into MAGETWO-98233
2 parents 089efd2 + b9e1434 commit 98c65ea

File tree

19 files changed

+791
-142
lines changed

19 files changed

+791
-142
lines changed

‎app/code/Magento/Catalog/Controller/Product/Compare/Add.php

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -8,10 +8,13 @@
88

99
use Magento\Framework\Exception\NoSuchEntityException;
1010

11+
/**
12+
* Add item to compare list action.
13+
*/
1114
class Add extends \Magento\Catalog\Controller\Product\Compare
1215
{
1316
/**
14-
* Add item to compare list
17+
* Add item to compare list.
1518
*
1619
* @return \Magento\Framework\Controller\ResultInterface
1720
*/
@@ -26,12 +29,13 @@ public function execute()
2629
if ($productId && ($this->_customerVisitor->getId() || $this->_customerSession->isLoggedIn())) {
2730
$storeId = $this->_storeManager->getStore()->getId();
2831
try {
32+
/** @var \Magento\Catalog\Model\Product $product */
2933
$product = $this->productRepository->getById($productId, false, $storeId);
3034
} catch (NoSuchEntityException $e) {
3135
$product = null;
3236
}
3337

34-
if ($product) {
38+
if ($product && $product->isSalable()) {
3539
$this->_catalogProductCompareList->addProduct($product);
3640
$productName = $this->_objectManager->get(\Magento\Framework\Escaper::class)
3741
->escapeHtml($product->getName());
@@ -43,6 +47,7 @@ public function execute()
4347

4448
$this->_objectManager->get(\Magento\Catalog\Helper\Product\Compare::class)->calculate();
4549
}
50+
4651
return $resultRedirect->setRefererOrBaseUrl();
4752
}
4853

‎app/code/Magento/Catalog/Controller/Product/Compare/Remove.php

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -8,11 +8,15 @@
88

99
use Magento\Framework\Exception\NoSuchEntityException;
1010

11+
/**
12+
* Remove item from compare list action.
13+
*/
1114
class Remove extends \Magento\Catalog\Controller\Product\Compare
1215
{
1316
/**
14-
* Remove item from compare list
17+
* Remove item from compare list.
1518
*
19+
* @SuppressWarnings(PHPMD.CyclomaticComplexity)
1620
* @return \Magento\Framework\Controller\ResultInterface
1721
*/
1822
public function execute()
@@ -21,12 +25,13 @@ public function execute()
2125
if ($this->isActionAllowed() && $productId) {
2226
$storeId = $this->_storeManager->getStore()->getId();
2327
try {
28+
/** @var \Magento\Catalog\Model\Product $product */
2429
$product = $this->productRepository->getById($productId, false, $storeId);
2530
} catch (NoSuchEntityException $e) {
2631
$product = null;
2732
}
2833

29-
if ($product) {
34+
if ($product && $product->isSalable()) {
3035
/** @var $item \Magento\Catalog\Model\Product\Compare\Item */
3136
$item = $this->_compareItemFactory->create();
3237
if ($this->_customerSession->isLoggedIn()) {
@@ -58,6 +63,7 @@ public function execute()
5863

5964
if (!$this->getRequest()->getParam('isAjax', false)) {
6065
$resultRedirect = $this->resultRedirectFactory->create();
66+
6167
return $resultRedirect->setRefererOrBaseUrl();
6268
}
6369
}

‎app/code/Magento/Cms/etc/di.xml

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -43,7 +43,6 @@
4343
</item>
4444
<item name="media_allowed" xsi:type="array">
4545
<item name="flv" xsi:type="string">video/x-flv</item>
46-
<item name="swf" xsi:type="string">application/x-shockwave-flash</item>
4746
<item name="avi" xsi:type="string">video/x-msvideo</item>
4847
<item name="mov" xsi:type="string">video/x-sgi-movie</item>
4948
<item name="rm" xsi:type="string">application/vnd.rn-realmedia</item>

‎app/code/Magento/Newsletter/view/adminhtml/templates/preview/iframeswitcher.phtml

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,15 @@
1515
</div>
1616
<?php endif;?>
1717
</div>
18-
<iframe name="preview_iframe" id="preview_iframe" frameborder="0" title="<?php /* @escapeNotVerified */ echo __('Preview') ?>" width="100%"></iframe>
18+
<iframe
19+
name="preview_iframe"
20+
id="preview_iframe"
21+
frameborder="0"
22+
title="<?php /* @escapeNotVerified */ echo __('Preview') ?>"
23+
width="100%"
24+
sandbox="allow-forms allow-pointer-lock"
25+
>
26+
</iframe>
1927
<?php echo $block->getChildHtml('preview_form'); ?>
2028
</div>
2129

‎app/code/Magento/Sales/Block/Order/Info/Buttons/Rss.php

Lines changed: 24 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,9 @@
55
*/
66
namespace Magento\Sales\Block\Order\Info\Buttons;
77

8+
use Magento\Framework\App\ObjectManager;
9+
use Magento\Sales\Model\Rss\Signature;
10+
811
/**
912
* Block of links in Order view page
1013
*/
@@ -25,24 +28,35 @@ class Rss extends \Magento\Framework\View\Element\Template
2528
*/
2629
protected $rssUrlBuilder;
2730

31+
/**
32+
* @var Signature
33+
*/
34+
private $signature;
35+
2836
/**
2937
* @param \Magento\Framework\View\Element\Template\Context $context
3038
* @param \Magento\Sales\Model\OrderFactory $orderFactory
3139
* @param \Magento\Framework\App\Rss\UrlBuilderInterface $rssUrlBuilder
3240
* @param array $data
41+
* @param Signature|null $signature
3342
*/
3443
public function __construct(
3544
\Magento\Framework\View\Element\Template\Context $context,
3645
\Magento\Sales\Model\OrderFactory $orderFactory,
3746
\Magento\Framework\App\Rss\UrlBuilderInterface $rssUrlBuilder,
38-
array $data = []
47+
array $data = [],
48+
Signature $signature = null
3949
) {
4050
$this->orderFactory = $orderFactory;
4151
$this->rssUrlBuilder = $rssUrlBuilder;
52+
$this->signature = $signature ?: ObjectManager::getInstance()->get(Signature::class);
53+
4254
parent::__construct($context, $data);
4355
}
4456

4557
/**
58+
* Get link url.
59+
*
4660
* @return string
4761
*/
4862
public function getLink()
@@ -51,6 +65,8 @@ public function getLink()
5165
}
5266

5367
/**
68+
* Get translatable label for url.
69+
*
5470
* @return \Magento\Framework\Phrase
5571
*/
5672
public function getLabel()
@@ -88,15 +104,20 @@ protected function getUrlKey($order)
88104
}
89105

90106
/**
91-
* @return string
107+
* Get type, secure and query params for link.
108+
*
109+
* @return array
110+
* @SuppressWarnings(PHPMD.RequestAwareBlockMethod)
92111
*/
93112
protected function getLinkParams()
94113
{
95114
$order = $this->orderFactory->create()->load($this->_request->getParam('order_id'));
115+
$data = $this->getUrlKey($order);
116+
96117
return [
97118
'type' => 'order_status',
98119
'_secure' => true,
99-
'_query' => ['data' => $this->getUrlKey($order)]
120+
'_query' => ['data' => $data, 'signature' => $this->signature->signData($data)],
100121
];
101122
}
102123
}

‎app/code/Magento/Sales/Model/Rss/OrderStatus.php

Lines changed: 41 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -6,10 +6,10 @@
66
namespace Magento\Sales\Model\Rss;
77

88
use Magento\Framework\App\Rss\DataProviderInterface;
9+
use Magento\Framework\App\ObjectManager;
910

1011
/**
11-
* Class OrderStatus
12-
* @package Magento\Sales\Model\Rss
12+
* Rss renderer for order statuses.
1313
*/
1414
class OrderStatus implements DataProviderInterface
1515
{
@@ -55,6 +55,11 @@ class OrderStatus implements DataProviderInterface
5555
*/
5656
protected $orderFactory;
5757

58+
/**
59+
* @var Signature
60+
*/
61+
private $signature;
62+
5863
/**
5964
* @param \Magento\Framework\ObjectManagerInterface $objectManager
6065
* @param \Magento\Framework\UrlInterface $urlBuilder
@@ -63,6 +68,7 @@ class OrderStatus implements DataProviderInterface
6368
* @param \Magento\Framework\Stdlib\DateTime\TimezoneInterface $localeDate
6469
* @param \Magento\Sales\Model\OrderFactory $orderFactory
6570
* @param \Magento\Framework\App\Config\ScopeConfigInterface $scopeConfig
71+
* @param Signature|null $signature
6672
*/
6773
public function __construct(
6874
\Magento\Framework\ObjectManagerInterface $objectManager,
@@ -71,7 +77,8 @@ public function __construct(
7177
\Magento\Sales\Model\ResourceModel\Order\Rss\OrderStatusFactory $orderResourceFactory,
7278
\Magento\Framework\Stdlib\DateTime\TimezoneInterface $localeDate,
7379
\Magento\Sales\Model\OrderFactory $orderFactory,
74-
\Magento\Framework\App\Config\ScopeConfigInterface $scopeConfig
80+
\Magento\Framework\App\Config\ScopeConfigInterface $scopeConfig,
81+
Signature $signature = null
7582
) {
7683
$this->objectManager = $objectManager;
7784
$this->urlBuilder = $urlBuilder;
@@ -80,6 +87,7 @@ public function __construct(
8087
$this->localeDate = $localeDate;
8188
$this->orderFactory = $orderFactory;
8289
$this->config = $scopeConfig;
90+
$this->signature = $signature ?: ObjectManager::getInstance()->get(Signature::class);
8391
}
8492

8593
/**
@@ -96,7 +104,10 @@ public function isAllowed()
96104
}
97105

98106
/**
107+
* Get rss data.
108+
*
99109
* @return array
110+
* @throws \InvalidArgumentException
100111
*/
101112
public function getRssData()
102113
{
@@ -108,6 +119,8 @@ public function getRssData()
108119
}
109120

110121
/**
122+
* Get cache key.
123+
*
111124
* @return string
112125
*/
113126
public function getCacheKey()
@@ -121,6 +134,8 @@ public function getCacheKey()
121134
}
122135

123136
/**
137+
* Get cache lifetime.
138+
*
124139
* @return int
125140
*/
126141
public function getCacheLifetime()
@@ -129,6 +144,8 @@ public function getCacheLifetime()
129144
}
130145

131146
/**
147+
* Get order.
148+
*
132149
* @return \Magento\Sales\Model\Order
133150
*/
134151
protected function getOrder()
@@ -137,8 +154,11 @@ protected function getOrder()
137154
return $this->order;
138155
}
139156

140-
$data = null;
141-
$json = base64_decode((string)$this->request->getParam('data'));
157+
$data = (string)$this->request->getParam('data');
158+
if ((string)$this->request->getParam('signature') !== $this->signature->signData($data)) {
159+
return null;
160+
}
161+
$json = base64_decode($data);
142162
if ($json) {
143163
$data = json_decode($json, true);
144164
}
@@ -154,14 +174,26 @@ protected function getOrder()
154174
$order = $this->orderFactory->create();
155175
$order->load($data['order_id']);
156176

157-
if ($order->getIncrementId() !== $data['increment_id'] || $order->getCustomerId() !== $data['customer_id']) {
177+
if (!$this->isOrderSuitable($order, $data)) {
158178
$order = null;
159179
}
160180
$this->order = $order;
161181

162182
return $this->order;
163183
}
164184

185+
/**
186+
* Check if selected order data correspond incoming data.
187+
*
188+
* @param \Magento\Sales\Model\Order $order
189+
* @param array $data
190+
* @return bool
191+
*/
192+
private function isOrderSuitable(\Magento\Sales\Model\Order $order, array $data)
193+
{
194+
return $order->getIncrementId() === $data['increment_id'] && $order->getCustomerId() === $data['customer_id'];
195+
}
196+
165197
/**
166198
* Get RSS feed items
167199
*
@@ -218,6 +250,8 @@ protected function getHeader()
218250
}
219251

220252
/**
253+
* Get feeds.
254+
*
221255
* @return array
222256
*/
223257
public function getFeeds()
@@ -226,7 +260,7 @@ public function getFeeds()
226260
}
227261

228262
/**
229-
* {@inheritdoc}
263+
* @inheritdoc
230264
*/
231265
public function isAuthRequired()
232266
{

0 commit comments

Comments
 (0)