Merge pull request #6456 from magento-borg/2.3.7-bugfixes-121420

dvoskoboinikov · web-flow · commit bbedf180ad5a · 2020-12-15T16:47:03.000-06:00
[CIA] Bugfixes
diff --git a/app/code/Magento/Catalog/Controller/Adminhtml/Product/Gallery/Upload.php b/app/code/Magento/Catalog/Controller/Adminhtml/Product/Gallery/Upload.php
@@ -11,7 +11,7 @@
 use Magento\Framework\Exception\LocalizedException;
 
 /**
- * Class Upload
+ * Class Upload image(s)
  */
 class Upload extends \Magento\Backend\App\Action implements HttpPostActionInterface
 {
@@ -108,8 +108,10 @@ public function execute()
 
             $result['url'] = $this->productMediaConfig->getTmpMediaUrl($result['file']);
             $result['file'] = $result['file'] . '.tmp';
-        } catch (\Exception $e) {
+        } catch (LocalizedException $e) {
             $result = ['error' => $e->getMessage(), 'errorcode' => $e->getCode()];
+        } catch (\Throwable $e) {
+            $result = ['error' => 'Something went wrong while saving the file(s).', 'errorcode' => 0];
         }
 
         /** @var \Magento\Framework\Controller\Result\Raw $response */
diff --git a/app/code/Magento/Catalog/Test/Mftf/ActionGroup/AdminSaveCategoryFormActionGroup.xml b/app/code/Magento/Catalog/Test/Mftf/ActionGroup/AdminSaveCategoryFormActionGroup.xml
@@ -17,6 +17,7 @@
         <scrollToTopOfPage stepKey="scrollToTopOfTheCategoryPage"/>
         <click selector="{{AdminMainActionsSection.save}}" stepKey="saveCategory"/>
         <waitForElementVisible selector="{{AdminMessagesSection.success}}" stepKey="waitForSuccessMessageAppears"/>
+        <dontSee selector="{{AdminCategoryMessagesSection.saveCategoryWarningMessage}}" stepKey="dontSeeWarningMessage"/>
         <see userInput="You saved the category." selector="{{AdminMessagesSection.success}}" stepKey="assertSuccessMessage"/>
     </actionGroup>
 </actionGroups>
diff --git a/app/code/Magento/Catalog/Test/Mftf/ActionGroup/SaveProductFormActionGroup.xml b/app/code/Magento/Catalog/Test/Mftf/ActionGroup/SaveProductFormActionGroup.xml
@@ -17,6 +17,7 @@
         <waitForElementVisible selector="{{AdminProductFormActionSection.saveButton}}" stepKey="waitForSaveProductButton"/>
         <click selector="{{AdminProductFormActionSection.saveButton}}" stepKey="clickSaveProduct"/>
         <waitForElementVisible selector="{{AdminMessagesSection.success}}" stepKey="waitProductSaveSuccessMessage"/>
+        <dontSee selector="{{AdminProductMessagesSection.saveProductWarningMessage}}" stepKey="dontSeeWarningMessage"/>
         <see selector="{{AdminMessagesSection.success}}" userInput="You saved the product." stepKey="seeSaveConfirmation"/>
     </actionGroup>
 </actionGroups>
diff --git a/app/code/Magento/Catalog/Test/Mftf/Section/AdminCategoryMessagesSection.xml b/app/code/Magento/Catalog/Test/Mftf/Section/AdminCategoryMessagesSection.xml
@@ -11,5 +11,6 @@
     <section name="AdminCategoryMessagesSection">
         <element name="SuccessMessage" type="text" selector=".message-success"/>
         <element name="errorMessage" type="text" selector="//div[@class='message message-error error']"/>
+        <element name="saveCategoryWarningMessage" type="text" selector=".message-warning"/>
     </section>
 </sections>
diff --git a/app/code/Magento/Catalog/Test/Mftf/Section/AdminProductMessagesSection.xml b/app/code/Magento/Catalog/Test/Mftf/Section/AdminProductMessagesSection.xml
@@ -11,5 +11,6 @@
     <section name="AdminProductMessagesSection">
         <element name="successMessage" type="text" selector=".message-success"/>
         <element name="errorMessage" type="text" selector=".message.message-error.error"/>
+        <element name="saveProductWarningMessage" type="text" selector=".message-warning"/>
     </section>
 </sections>
diff --git a/app/code/Magento/Cms/Test/Mftf/ActionGroup/SaveAndCloseCMSBlockWithSplitButtonActionGroup.xml b/app/code/Magento/Cms/Test/Mftf/ActionGroup/SaveAndCloseCMSBlockWithSplitButtonActionGroup.xml
@@ -17,6 +17,7 @@
         <click selector="{{BlockNewPagePageActionsSection.expandSplitButton}}" stepKey="expandSplitButton"/>
         <click selector="{{BlockNewPagePageActionsSection.saveAndClose}}" stepKey="clickSaveBlock"/>
         <waitForPageLoad stepKey="waitForPageLoadAfterClickingSave"/>
+        <dontSee selector="{{BlockPageActionsSection.saveBlockWarningMessage}}" stepKey="dontSeeWarningMessage"/>
         <see userInput="You saved the block." stepKey="assertSaveBlockSuccessMessage"/>
     </actionGroup>
 </actionGroups>
diff --git a/app/code/Magento/Cms/Test/Mftf/ActionGroup/SaveCMSBlockActionGroup.xml b/app/code/Magento/Cms/Test/Mftf/ActionGroup/SaveCMSBlockActionGroup.xml
@@ -16,6 +16,7 @@
         <waitForElementVisible selector="{{CmsNewBlockBlockActionsSection.savePage}}" stepKey="waitForSaveButton"/>
         <click selector="{{CmsNewBlockBlockActionsSection.savePage}}" stepKey="clickSaveButton"/>
         <waitForPageLoad stepKey="waitForPageLoad"/>
+        <dontSee selector="{{BlockPageActionsSection.saveBlockWarningMessage}}" stepKey="dontSeeWarningMessage"/>
         <see userInput="You saved the block." stepKey="seeSuccessfulSaveMessage"/>
     </actionGroup>
 </actionGroups>
diff --git a/app/code/Magento/Cms/Test/Mftf/ActionGroup/SaveCmsPageActionGroup.xml b/app/code/Magento/Cms/Test/Mftf/ActionGroup/SaveCmsPageActionGroup.xml
@@ -18,6 +18,7 @@
         <waitForElementVisible selector="{{CmsNewPagePageActionsSection.savePage}}" stepKey="waitForSaveCmsPage"/>
         <click selector="{{CmsNewPagePageActionsSection.savePage}}" stepKey="clickSaveCmsPage"/>
         <waitForElementVisible time="1" selector="{{CmsPagesPageActionsSection.addNewPageButton}}" stepKey="waitForCmsPageSaveButton"/>
+        <dontSee selector="{{CmsPagesPageActionsSection.savePageWarningMessage}}" stepKey="dontSeeWarningMessage"/>
         <see userInput="You saved the page." selector="{{CmsPagesPageActionsSection.savePageSuccessMessage}}" stepKey="assertSavePageSuccessMessage"/>
     </actionGroup>
 </actionGroups>
diff --git a/app/code/Magento/Cms/Test/Mftf/Section/BlockPageActionsSection.xml b/app/code/Magento/Cms/Test/Mftf/Section/BlockPageActionsSection.xml
@@ -18,5 +18,6 @@
         <element name="FilterBtn" type="input" selector="//button[text()='Filters']"/>
         <element name="URLKey" type="input" selector="//div[@class='admin__form-field-control']/input[@name='identifier']"/>
         <element name="ApplyFiltersBtn" type="button" selector="//span[text()='Apply Filters']"/>
+        <element name="saveBlockWarningMessage" type="text" selector=".message-warning"/>
     </section>
 </sections>
diff --git a/app/code/Magento/Cms/Test/Mftf/Section/CmsPagesPageActionsSection.xml b/app/code/Magento/Cms/Test/Mftf/Section/CmsPagesPageActionsSection.xml
@@ -25,6 +25,7 @@
         <element name="firstItemEditButton" type="button" selector=".data-grid .action-select-wrap .action-menu-item[data-action~='item-edit']"/>
         <element name="activeFilter" type="button" selector="(//div[contains(@class, 'admin__data-grid-filters-current') and contains(@class, '_show')])[1]"/>
         <element name="savePageSuccessMessage" type="text" selector=".message-success"/>
+        <element name="savePageWarningMessage" type="text" selector=".message-warning"/>
         <element name="delete" type="button" selector="//div[text()='{{var1}}']/parent::td//following-sibling::td[@class='data-grid-actions-cell']//a[text()='Delete']" parameterized="true"/>
         <element name="deleteConfirm" type="button" selector=".action-primary.action-accept" timeout="60"/>
         <element name="pageRowCheckboxByIdentifier" type="checkbox" selector="//table[@data-role='grid']//td[count(../../..//th[./*[.='URL Key']]/preceding-sibling::th) + 1][./*[.='{{identifier}}']]/../td//input[@data-action='select-row']"  parameterized="true" />
diff --git a/app/code/Magento/Security/view/base/web/js/escaper.js b/app/code/Magento/Security/view/base/web/js/escaper.js
@@ -157,7 +157,8 @@ define([], function () {
                     attribute = treeWalker.currentNode.attributes[i];
                     nodeName = treeWalker.currentNode.nodeName.toLowerCase();
 
-                    if (this.generallyAllowedAttributes.indexOf(attribute.name) === -1 || // eslint-disable-line max-depth,max-len
+                    if (this.generallyAllowedAttributes.indexOf(attribute.name) === -1  || // eslint-disable-line max-depth,max-len
+                        this._checkHrefValue(attribute) ||
                         this.forbiddenAttributesByElement[nodeName] &&
                         this.forbiddenAttributesByElement[nodeName].indexOf(attribute.name) !== -1
                     ) {
@@ -169,6 +170,16 @@ define([], function () {
             attributesToRemove.forEach(function (attributeToRemove) {
                 attributeToRemove.ownerElement.removeAttribute(attributeToRemove.name);
             });
+        },
+
+        /**
+         * Check that attribute contains script content
+         *
+         * @param {Object} attribute
+         * @private
+         */
+        _checkHrefValue: function (attribute) {
+            return attribute.nodeName === 'href' && attribute.nodeValue.startsWith('javascript');
         }
     };
 });
diff --git a/dev/tests/integration/testsuite/Magento/Catalog/Controller/Adminhtml/Product/Gallery/UploadTest.php b/dev/tests/integration/testsuite/Magento/Catalog/Controller/Adminhtml/Product/Gallery/UploadTest.php
@@ -198,18 +198,31 @@ public function uploadActionWithErrorsDataProvider(): array
                     'current_path' => '/../../../../_files',
                 ],
                 'expectation' => [
-                    'message' => 'Wrong file size.',
+                    'message' => 'Something went wrong while saving the file(s).',
                     'errorcode' => 0,
                     'tmp_media_path' => '/m/a/magento_empty.jpg',
                 ],
             ],
             'upload_without_image' => [
                 'file' => [],
                 'expectation' => [
-                    'message' => '$_FILES array is empty',
+                    'message' => 'Something went wrong while saving the file(s).',
                     'errorcode' => 0,
                 ],
             ],
+            'upload_wrong_png' => [
+                'file' => [
+                    'copy_file' => true,
+                    'name' => 'magento_wrong.png',
+                    'type' => 'image/png',
+                    'current_path' => '/../../../../_files',
+                ],
+                'expectation' => [
+                    'message' => 'Something went wrong while saving the file(s).',
+                    'errorcode' => 0,
+                    'tmp_media_path' => '/m/w/magento_wrong.png',
+                ],
+            ]
         ];
     }
 
diff --git a/dev/tests/integration/testsuite/Magento/Catalog/_files/magento_wrong.png b/dev/tests/integration/testsuite/Magento/Catalog/_files/magento_wrong.png
diff --git a/dev/tests/js/jasmine/tests/app/code/Magento/Security/view/base/web/js/escaper.test.js b/dev/tests/js/jasmine/tests/app/code/Magento/Security/view/base/web/js/escaper.test.js
@@ -131,6 +131,11 @@ define([
                 data: '<spa>n id="id1">Some string</span>',
                 expected: 'n id="id1"&gt;Some string',
                 allowedTags: ['span']
+            },
+            'link with script content': {
+                data: '<a href="javascript:void">Click</a>',
+                expected: '<a>Click</a>',
+                allowedTags: ['a']
             }
         };
     }
