Merge branch 'cia-bugfix-ce-20240712' into cia-2.4.8-beta1-develop-bugfix-09022024

Author: pawan-adobe-security

app/code/Magento/Backend/Controller/Adminhtml/System/Design.php

@@ -14,10 +14,10 @@ abstract class Design extends Action
      *
      * @see _isAllowed()
      */
-    const ADMIN_RESOURCE = 'Magento_Backend::design';
+    public const ADMIN_RESOURCE = 'Magento_Backend::schedule';
 
     /**
-     * Core registry
+     * Core registry instance
      *
      * @var \Magento\Framework\Registry
      */

app/code/Magento/Sales/Controller/Adminhtml/Order/Invoice/Cancel.php

@@ -6,8 +6,18 @@
  */
 namespace Magento\Sales\Controller\Adminhtml\Order\Invoice;
 
-class Cancel extends \Magento\Sales\Controller\Adminhtml\Invoice\AbstractInvoice\View
+use Magento\Framework\App\Action\HttpPostActionInterface;
+use Magento\Sales\Controller\Adminhtml\Invoice\AbstractInvoice\View;
+
+class Cancel extends View implements HttpPostActionInterface
 {
+    /**
+     * Authorization level of a basic admin session
+     *
+     * @see _isAllowed()
+     */
+    public const ADMIN_RESOURCE = 'Magento_Sales::invoice';
+
     /**
      * Cancel invoice action
      *

app/code/Magento/Sales/Controller/Adminhtml/Order/Invoice/Capture.php

@@ -6,8 +6,18 @@
  */
 namespace Magento\Sales\Controller\Adminhtml\Order\Invoice;
 
-class Capture extends \Magento\Sales\Controller\Adminhtml\Invoice\AbstractInvoice\View
+use Magento\Framework\App\Action\HttpPostActionInterface;
+use Magento\Sales\Controller\Adminhtml\Invoice\AbstractInvoice\View;
+
+class Capture extends View implements HttpPostActionInterface
 {
+    /**
+     * Authorization level of a basic admin session
+     *
+     * @see _isAllowed()
+     */
+    public const ADMIN_RESOURCE = 'Magento_Sales::invoice';
+
     /**
      * Capture invoice action
      *

app/code/Magento/Sales/Controller/Adminhtml/Order/Invoice/NewAction.php

@@ -23,7 +23,7 @@ class NewAction extends \Magento\Backend\App\Action implements HttpGetActionInte
      *
      * @see _isAllowed()
      */
-    const ADMIN_RESOURCE = 'Magento_Sales::sales_invoice';
+    public const ADMIN_RESOURCE = 'Magento_Sales::invoice';
 
     /**
      * @var Registry

app/code/Magento/Sales/Controller/Adminhtml/Order/Invoice/Save.php

@@ -30,7 +30,7 @@ class Save extends \Magento\Backend\App\Action implements HttpPostActionInterfac
      *
      * @see _isAllowed()
      */
-    public const ADMIN_RESOURCE = 'Magento_Sales::sales_invoice';
+    public const ADMIN_RESOURCE = 'Magento_Sales::invoice';
 
     /**
      * @var InvoiceSender

app/code/Magento/Sales/Controller/Adminhtml/Order/Invoice/Start.php

@@ -10,6 +10,13 @@
 
 class Start extends \Magento\Sales\Controller\Adminhtml\Invoice\AbstractInvoice\View implements HttpGetActionInterface
 {
+    /**
+     * Authorization level of a basic admin session
+     *
+     * @see _isAllowed()
+     */
+    public const ADMIN_RESOURCE = 'Magento_Sales::invoice';
+
     /**
      * Start create invoice action
      *

app/code/Magento/Sales/Controller/Adminhtml/Order/Invoice/UpdateQty.php

@@ -18,11 +18,19 @@
 use Magento\Sales\Controller\Adminhtml\Invoice\AbstractInvoice\View as AbstractView;
 
 /**
- * Class UpdateQty
+ * Class UpdateQty to update invoice items qty
+ *
  * @SuppressWarnings(PHPMD.CouplingBetweenObjects)
  */
 class UpdateQty extends AbstractView implements HttpPostActionInterface
 {
+    /**
+     * Authorization level of a basic admin session
+     *
+     * @see _isAllowed()
+     */
+    public const ADMIN_RESOURCE = 'Magento_Sales::invoice';
+
     /**
      * @var JsonFactory
      */

app/code/Magento/Sales/Controller/Adminhtml/Order/Invoice/VoidAction.php

@@ -6,8 +6,18 @@
  */
 namespace Magento\Sales\Controller\Adminhtml\Order\Invoice;
 
-class VoidAction extends \Magento\Sales\Controller\Adminhtml\Invoice\AbstractInvoice\View
+use Magento\Framework\App\Action\HttpPostActionInterface;
+use Magento\Sales\Controller\Adminhtml\Invoice\AbstractInvoice\View;
+
+class VoidAction extends View implements HttpPostActionInterface
 {
+    /**
+     * Authorization level of a basic admin session
+     *
+     * @see _isAllowed()
+     */
+    public const ADMIN_RESOURCE = 'Magento_Sales::invoice';
+
     /**
      * Void invoice action
      *

dev/tests/integration/testsuite/Magento/Sales/Controller/Adminhtml/Order/Invoice/SaveTest.php

@@ -33,6 +33,11 @@ class SaveTest extends AbstractInvoiceControllerTest
     /** @var Item */
     private $orderItemResource;
 
+    /**
+     * @var string
+     */
+    protected $resource = "Magento_Sales::invoice";
+
     /**
      * @inheritdoc
      */