Merge branch '2.1-develop' into MAGETWO-72280

Author: Dmytro Voskoboinikov

.gitignore

@@ -23,6 +23,8 @@ atlassian*
 /lib/internal/flex/varien/.settings
 /node_modules
 /.grunt
+/Gruntfile.js
+/package.json
 
 /pub/media/*.*
 !/pub/media/.htaccess

.htaccess

@@ -1,13 +1,13 @@
 # All explanations you could find in .htaccess.sample file
 DirectoryIndex index.php
 <IfModule mod_php5.c>
-    php_value memory_limit 768M
+    php_value memory_limit 756M
     php_value max_execution_time 18000
     php_flag session.auto_start off
     php_flag suhosin.session.cryptua off
 </IfModule>
 <IfModule mod_php7.c>
-    php_value memory_limit 768M
+    php_value memory_limit 756M
     php_value max_execution_time 18000
     php_flag session.auto_start off
     php_flag suhosin.session.cryptua off

.htaccess.sample

@@ -36,7 +36,7 @@ DirectoryIndex index.php
 ############################################
 ## adjust memory limit
 
-    php_value memory_limit 768M
+    php_value memory_limit 756M
     php_value max_execution_time 18000
 
 ############################################
@@ -59,7 +59,7 @@ DirectoryIndex index.php
 ############################################
 ## adjust memory limit
 
-    php_value memory_limit 768M
+    php_value memory_limit 756M
     php_value max_execution_time 18000
 
 ############################################

.user.ini

@@ -1,4 +1,4 @@
-memory_limit = 768M
+memory_limit = 756M
 max_execution_time = 18000
 session.auto_start = off
 suhosin.session.cryptua = off

app/code/Magento/AdminNotification/Controller/Adminhtml/System/Message/ListAction.php

@@ -8,6 +8,13 @@
 
 class ListAction extends \Magento\Backend\App\AbstractAction
 {
+    /**
+     * Authorization level of a basic admin session.
+     *
+     * @see _isAllowed()
+     */
+    const ADMIN_RESOURCE = 'Magento_AdminNotification::show_list';
+
     /**
      * @var \Magento\Framework\Json\Helper\Data
      */

app/code/Magento/AdminNotification/Model/Feed.php

@@ -146,9 +146,9 @@ public function checkUpdate()
                     $feedData[] = [
                         'severity' => (int)$item->severity,
                         'date_added' => date('Y-m-d H:i:s', $itemPublicationDate),
-                        'title' => (string)$item->title,
-                        'description' => (string)$item->description,
-                        'url' => (string)$item->link,
+                        'title' => $this->escapeString($item->title),
+                        'description' => $this->escapeString($item->description),
+                        'url' => $this->escapeString($item->link),
                     ];
                 }
             }
@@ -244,4 +244,15 @@ public function getFeedXml()
 
         return $xml;
     }
+
+    /**
+     * Converts incoming data to string format and escapes special characters.
+     *
+     * @param \SimpleXMLElement $data
+     * @return string
+     */
+    private function escapeString(\SimpleXMLElement $data)
+    {
+        return htmlspecialchars((string)$data);
+    }
 }

app/code/Magento/AdminNotification/Test/Unit/Model/FeedTest.php

@@ -52,13 +52,25 @@ class FeedTest extends \PHPUnit_Framework_TestCase
 
     protected function setUp()
     {
-        $this->inboxFactory = $this->getMock('Magento\AdminNotification\Model\InboxFactory', ['create'], [], '', false);
-        $this->curlFactory = $this->getMock('Magento\Framework\HTTP\Adapter\CurlFactory', ['create'], [], '', false);
-        $this->curl = $this->getMockBuilder('Magento\Framework\HTTP\Adapter\Curl')
+        $this->inboxFactory = $this->getMock(
+            \Magento\AdminNotification\Model\InboxFactory::class,
+            ['create'],
+            [],
+            '',
+            false
+        );
+        $this->curlFactory = $this->getMock(
+            \Magento\Framework\HTTP\Adapter\CurlFactory::class,
+            ['create'],
+            [],
+            '',
+            false
+        );
+        $this->curl = $this->getMockBuilder(\Magento\Framework\HTTP\Adapter\Curl::class)
             ->disableOriginalConstructor()->getMock();
-        $this->appState = $this->getMock('Magento\Framework\App\State', ['getInstallDate'], [], '', false);
+        $this->appState = $this->getMock(\Magento\Framework\App\State::class, ['getInstallDate'], [], '', false);
         $this->inboxModel = $this->getMock(
-            'Magento\AdminNotification\Model\Inbox',
+            \Magento\AdminNotification\Model\Inbox::class,
             [
                 '__wakeup',
                 'parse'
@@ -68,15 +80,15 @@ protected function setUp()
             false
         );
         $this->backendConfig = $this->getMock(
-            'Magento\Backend\App\ConfigInterface',
+            \Magento\Backend\App\ConfigInterface::class,
             [
                 'getValue',
                 'setValue',
                 'isSetFlag'
             ]
         );
         $this->cacheManager = $this->getMock(
-            'Magento\Framework\App\CacheInterface',
+            \Magento\Framework\App\CacheInterface::class,
             [
                 'load',
                 'getFrontend',
@@ -86,18 +98,18 @@ protected function setUp()
             ]
         );
 
-        $this->deploymentConfig = $this->getMockBuilder('Magento\Framework\App\DeploymentConfig')
+        $this->deploymentConfig = $this->getMockBuilder(\Magento\Framework\App\DeploymentConfig::class)
             ->disableOriginalConstructor()->getMock();
 
         $this->objectManagerHelper = new ObjectManagerHelper($this);
 
-        $this->productMetadata = $this->getMockBuilder('Magento\Framework\App\ProductMetadata')
+        $this->productMetadata = $this->getMockBuilder(\Magento\Framework\App\ProductMetadata::class)
             ->disableOriginalConstructor()->getMock();
 
-        $this->urlBuilder = $this->getMock('Magento\Framework\UrlInterface');
+        $this->urlBuilder = $this->getMock(\Magento\Framework\UrlInterface::class);
 
         $this->feed = $this->objectManagerHelper->getObject(
-            'Magento\AdminNotification\Model\Feed',
+            \Magento\AdminNotification\Model\Feed::class,
             [
                 'backendConfig' => $this->backendConfig,
                 'cacheManager' => $this->cacheManager,
@@ -148,8 +160,27 @@ public function testCheckUpdate($callInbox, $curlRequest)
             ->will($this->returnValue('Sat, 6 Sep 2014 16:46:11 UTC'));
         if ($callInbox) {
             $this->inboxFactory->expects($this->once())->method('create')
-                ->will(($this->returnValue($this->inboxModel)));
-            $this->inboxModel->expects($this->once())->method('parse')->will($this->returnSelf());
+                ->will($this->returnValue($this->inboxModel));
+            $this->inboxModel->expects($this->once())
+                ->method('parse')
+                ->with(
+                    $this->callback(
+                        function ($data) {
+                            $fieldsToCheck = ['title', 'description', 'url'];
+                            return array_reduce(
+                                $fieldsToCheck,
+                                function ($initialValue, $item) use ($data) {
+                                    $haystack = (isset($data[0][$item]) ? $data[0][$item] : false);
+                                    return $haystack
+                                        ? $initialValue && !strpos($haystack, '<') && !strpos($haystack, '>')
+                                        : true;
+                                },
+                                true
+                            );
+                        }
+                    )
+                )
+                ->will($this->returnSelf());
         } else {
             $this->inboxFactory->expects($this->never())->method('create');
             $this->inboxModel->expects($this->never())->method('parse');
@@ -199,7 +230,27 @@ public function checkUpdateDataProvider()
                                 </item>
                             </channel>
                         </rss>'
-            ]
+            ],
+            [
+                true,
+                // @codingStandardsIgnoreStart
+                'HEADER
+
+                <?xml version="1.0" encoding="utf-8" ?>
+                        <rss version="2.0" xmlns:atom="http://www.w3.org/2005/Atom">
+                            <channel>
+                                <title>MagentoCommerce</title>
+                                <item>
+                                    <title><![CDATA[<script>alert("Hello!");</script>Test Title]]></title>
+                                    <link><![CDATA[http://magento.com/feed_url<script>alert("Hello!");</script>]]></link>
+                                    <severity>4</severity>
+                                    <description><![CDATA[Test <script>alert("Hello!");</script>Description]]></description>
+                                    <pubDate>Tue, 20 Jun 2017 13:14:47 UTC</pubDate>
+                                </item>
+                            </channel>
+                        </rss>'
+                // @codingStandardsIgnoreEnd
+            ],
         ];
     }
 }

app/code/Magento/AdminNotification/composer.json

@@ -10,7 +10,7 @@
         "lib-libxml": "*"
     },
     "type": "magento2-module",
-    "version": "100.1.2",
+    "version": "100.1.3",
     "license": [
         "OSL-3.0",
         "AFL-3.0"

app/code/Magento/AdminNotification/etc/config.xml

@@ -12,7 +12,7 @@
                 <feed_url>notifications.magentocommerce.com/magento2/community/notifications.rss</feed_url>
                 <popup_url>widgets.magentocommerce.com/notificationPopup</popup_url>
                 <severity_icons_url>widgets.magentocommerce.com/%s/%s.gif</severity_icons_url>
-                <use_https>0</use_https>
+                <use_https>1</use_https>
                 <frequency>1</frequency>
                 <last_update>0</last_update>
             </adminnotification>

app/code/Magento/Authorizenet/view/frontend/web/js/view/payment/method-renderer/authorizenet-directpost.js

@@ -5,15 +5,16 @@
 define(
     [
         'jquery',
-        'Magento_Payment/js/view/payment/iframe'
+        'Magento_Payment/js/view/payment/iframe',
+        'mage/translate'
     ],
-    function ($, Component) {
+    function ($, Component, $t) {
         'use strict';
 
         return Component.extend({
             defaults: {
                 template: 'Magento_Authorizenet/payment/authorizenet-directpost',
-                timeoutMessage: 'Sorry, but something went wrong. Please contact the seller.'
+                timeoutMessage: $t('Sorry, but something went wrong. Please contact the seller.')
             },
             placeOrderHandler: null,
             validateHandler: null,