Merge remote-tracking branch 'origin/2.3-develop' into MAGETWO-72512

Author: zakdma

.htaccess

@@ -355,6 +355,15 @@
             Require all denied
         </IfVersion>
     </Files>
+    <Files auth.json>
+        <IfVersion < 2.4>
+            order allow,deny
+            deny from all
+        </IfVersion>
+        <IfVersion >= 2.4>
+            Require all denied
+        </IfVersion>
+    </Files>
 
 # For 404s and 403s that aren't handled by the application, show plain 404 response
 ErrorDocument 404 /pub/errors/404.php

.htaccess.sample

@@ -332,6 +332,15 @@
             Require all denied
         </IfVersion>
     </Files>
+    <Files auth.json>
+        <IfVersion < 2.4>
+            order allow,deny
+            deny from all
+        </IfVersion>
+        <IfVersion >= 2.4>
+            Require all denied
+        </IfVersion>
+    </Files>
 
 # For 404s and 403s that aren't handled by the application, show plain 404 response
 ErrorDocument 404 /pub/errors/404.php

app/code/Magento/Braintree/view/frontend/web/js/view/payment/method-renderer/hosted-fields.js

@@ -61,7 +61,7 @@ define([
         },
 
         /**
-         * @returns {Bool}
+         * @returns {Boolean}
          */
         isVaultEnabled: function () {
             return this.vaultEnabler.isVaultEnabled();
@@ -142,11 +142,20 @@ define([
             return true;
         },
 
+        /**
+         * Returns state of place order button
+         * @returns {Boolean}
+         */
+        isButtonActive: function () {
+            return this.isActive() && this.isPlaceOrderActionAllowed();
+        },
+
         /**
          * Trigger order placing
          */
         placeOrderClick: function () {
             if (this.validateCardType()) {
+                this.isPlaceOrderActionAllowed(false);
                 $(this.getSelector('submit')).trigger('click');
             }
         },

app/code/Magento/Braintree/view/frontend/web/template/payment/form.html

@@ -141,8 +141,7 @@
                         data-bind="
                             click: placeOrderClick,
                             attr: {title: $t('Place Order')},
-                            css: {disabled: !isPlaceOrderActionAllowed()},
-                            enable: isActive()
+                            enable: isButtonActive()
                         "
                         disabled>
                     <span data-bind="i18n: 'Place Order'"></span>

app/code/Magento/Bundle/Model/OptionRepository.php

@@ -201,10 +201,10 @@ public function save(
 
         /** @var \Magento\Bundle\Model\Option $existingOption */
         $existingOption = $optionCollection->getFirstItem();
-        if (!$optionId) {
-            $option->setOptionId(null);
-        }
         if (!$optionId || $existingOption->getParentId() != $parentId) {
+            //If option ID is empty or existing option's parent ID is different
+            //we'd need a new ID for the option.
+            $option->setOptionId(null);
             $option->setDefaultTitle($option->getTitle());
             if (is_array($option->getProductLinks())) {
                 $linksToAdd = $option->getProductLinks();

app/code/Magento/Bundle/Model/Product/SaveHandler.php

@@ -5,6 +5,7 @@
  */
 namespace Magento\Bundle\Model\Product;
 
+use Magento\Bundle\Api\Data\OptionInterface;
 use Magento\Catalog\Api\Data\ProductInterface;
 use Magento\Bundle\Api\ProductOptionRepositoryInterface as OptionRepository;
 use Magento\Bundle\Api\ProductLinkManagementInterface;
@@ -49,42 +50,58 @@ public function __construct(
             ?: ObjectManager::getInstance()->get(MetadataPool::class);
     }
 
+    /**
+     * @param ProductInterface $bundle
+     * @param OptionInterface[] $currentOptions
+     *
+     * @return void
+     */
+    private function removeOldOptions(
+        ProductInterface $bundle,
+        array $currentOptions
+    ) {
+        $oldOptions = $this->optionRepository->getList($bundle->getSku());
+        if ($oldOptions) {
+            $remainingOptions = [];
+            $metadata
+                = $this->metadataPool->getMetadata(ProductInterface::class);
+            $productId = $bundle->getData($metadata->getLinkField());
+
+            foreach ($currentOptions as $option) {
+                $remainingOptions[] = $option->getOptionId();
+            }
+            foreach ($oldOptions as $option) {
+                if (!in_array($option->getOptionId(), $remainingOptions)) {
+                    $option->setParentId($productId);
+                    $this->removeOptionLinks($bundle->getSku(), $option);
+                    $this->optionRepository->delete($option);
+                }
+            }
+        }
+    }
+
     /**
      * @param object $entity
      * @param array $arguments
-     * @return \Magento\Catalog\Api\Data\ProductInterface|object
+     *
+     * @return ProductInterface|object
+     *
      * @SuppressWarnings(PHPMD.UnusedFormalParameter)
      */
     public function execute($entity, $arguments = [])
     {
         /** @var \Magento\Bundle\Api\Data\OptionInterface[] $options */
         $options = $entity->getExtensionAttributes()->getBundleProductOptions() ?: [];
-
+        //Only processing bundle products.
         if ($entity->getTypeId() !== 'bundle' || empty($options)) {
             return $entity;
         }
-
+        /** @var ProductInterface $entity */
+        //Removing old options
         if (!$entity->getCopyFromView()) {
-            $updatedOptions = [];
-            $oldOptions = $this->optionRepository->getList($entity->getSku());
-
-            $metadata = $this->metadataPool->getMetadata(ProductInterface::class);
-
-            $productId = $entity->getData($metadata->getLinkField());
-
-            foreach ($options as $option) {
-                $updatedOptions[$option->getOptionId()][$productId] = (bool)$option->getOptionId();
-            }
-
-            foreach ($oldOptions as $option) {
-                if (!isset($updatedOptions[$option->getOptionId()][$productId])) {
-                    $option->setParentId($productId);
-                    $this->removeOptionLinks($entity->getSku(), $option);
-                    $this->optionRepository->delete($option);
-                }
-            }
+            $this->removeOldOptions($entity, $options);
         }
-
+        //Saving active options.
         foreach ($options as $option) {
             $this->optionRepository->save($entity, $option);
         }

app/code/Magento/Catalog/Block/Adminhtml/Product/Attribute/Set/Main.php

@@ -233,7 +233,7 @@ public function getGroupTreeJson()
         /* @var $node \Magento\Eav\Model\Entity\Attribute\Group */
         foreach ($groups as $node) {
             $item = [];
-            $item['text'] = $node->getAttributeGroupName();
+            $item['text'] = $this->escapeHtml($node->getAttributeGroupName());
             $item['id'] = $node->getAttributeGroupId();
             $item['cls'] = 'folder';
             $item['allowDrop'] = true;
@@ -280,7 +280,7 @@ public function getAttributeTreeJson()
 
         foreach ($attributes as $child) {
             $attr = [
-                'text' => $child->getAttributeCode(),
+                'text' => $this->escapeHtml($child->getAttributeCode()),
                 'id' => $child->getAttributeId(),
                 'cls' => 'leaf',
                 'allowDrop' => false,

app/code/Magento/Catalog/Model/Indexer/Category/Product/Action/Full.php

@@ -87,13 +87,29 @@ public function __construct(
         $this->activeTableSwitcher = $activeTableSwitcher ?: $objectManager->get(ActiveTableSwitcher::class);
     }
 
+    /**
+     *
+     * Clear the table we'll be writing de-normalized data into
+     * to prevent archived data getting in the way of actual data.
+     *
+     * @return void
+     */
+    private function clearCurrentTable()
+    {
+        $this->connection->delete(
+            $this->activeTableSwitcher
+                ->getAdditionalTableName($this->getMainTable())
+        );
+    }
+
     /**
      * Refresh entities index
      *
      * @return $this
      */
     public function execute()
     {
+        $this->clearCurrentTable();
         $this->reindex();
         $this->activeTableSwitcher->switchTable($this->connection, [$this->getMainTable()]);
         return $this;
@@ -103,6 +119,9 @@ public function execute()
      * Return select for remove unnecessary data
      *
      * @return \Magento\Framework\DB\Select
+     *
+     * @deprecated Not used anymore.
+     * @see clearCurrentTable()
      */
     protected function getSelectUnnecessaryData()
     {
@@ -127,12 +146,14 @@ protected function getSelectUnnecessaryData()
      * Remove unnecessary data
      *
      * @return void
+     *
+     * @deprecated Not used anymore.
+     * @see clearCurrentTable()
      */
     protected function removeUnnecessaryData()
     {
-        $this->connection->query(
-            $this->connection->deleteFromSelect($this->getSelectUnnecessaryData(), $this->getMainTable())
-        );
+        //Called for backward compatibility.
+        $this->getSelectUnnecessaryData();
     }
 
     /**
@@ -233,6 +254,7 @@ private function reindexCategoriesBySelect(\Magento\Framework\DB\Select $basicSe
                 )
             );
             $this->publishData();
+            //Called for backward compatibility.
             $this->removeUnnecessaryData();
         }
     }

app/code/Magento/Catalog/view/adminhtml/templates/catalog/product/attribute/set/main.phtml

@@ -315,7 +315,7 @@
                         },
 
                         validateGroupName : function(name, exceptNodeId) {
-                            name = name.strip();
+                            name = name.strip().escapeHTML();
                             var result = true;
                             if (name === '') {
                                 result = false;

app/code/Magento/CatalogInventory/Model/Indexer/Stock/AbstractAction.php

@@ -10,6 +10,7 @@
 
 use Magento\Framework\App\ObjectManager;
 use Magento\Framework\App\ResourceConnection;
+use Magento\Framework\EntityManager\MetadataPool;
 
 /**
  * Abstract action reindex class
@@ -70,25 +71,33 @@ abstract class AbstractAction
      */
     private $cacheCleaner;
 
+    /**
+     * @var MetadataPool
+     */
+    private $metadataPool;
+
     /**
      * @param ResourceConnection $resource
      * @param \Magento\CatalogInventory\Model\ResourceModel\Indexer\StockFactory $indexerFactory
      * @param \Magento\Catalog\Model\Product\Type $catalogProductType
      * @param \Magento\Framework\Indexer\CacheContext $cacheContext
      * @param \Magento\Framework\Event\ManagerInterface $eventManager
+     * @param MetadataPool|null $metadataPool
      */
     public function __construct(
         ResourceConnection $resource,
         \Magento\CatalogInventory\Model\ResourceModel\Indexer\StockFactory $indexerFactory,
         \Magento\Catalog\Model\Product\Type $catalogProductType,
         \Magento\Framework\Indexer\CacheContext $cacheContext,
-        \Magento\Framework\Event\ManagerInterface $eventManager
+        \Magento\Framework\Event\ManagerInterface $eventManager,
+        MetadataPool $metadataPool = null
     ) {
         $this->_resource = $resource;
         $this->_indexerFactory = $indexerFactory;
         $this->_catalogProductType = $catalogProductType;
         $this->cacheContext = $cacheContext;
         $this->eventManager = $eventManager;
+        $this->metadataPool = $metadataPool ?: ObjectManager::getInstance()->get(MetadataPool::class);
     }
 
     /**
@@ -154,10 +163,15 @@ protected function _getTable($entityName)
     public function getRelationsByChild($childIds)
     {
         $connection = $this->_getConnection();
-        $select = $connection->select()
-            ->from($this->_getTable('catalog_product_relation'), 'parent_id')
-            ->where('child_id IN(?)', $childIds);
-
+        $linkField = $this->metadataPool->getMetadata(\Magento\Catalog\Api\Data\ProductInterface::class)
+            ->getLinkField();
+        $select = $connection->select()->from(
+            ['cpe' => $this->_getTable('catalog_product_entity')],
+            'entity_id'
+        )->join(
+            ['relation' => $this->_getTable('catalog_product_relation')],
+            'relation.parent_id = cpe.' . $linkField
+        )->where('child_id IN(?)', $childIds);
         return $connection->fetchCol($select);
     }
 
@@ -230,7 +244,8 @@ protected function _reindexRows($productIds = [])
         if (!is_array($productIds)) {
             $productIds = [$productIds];
         }
-
+        $parentIds = $this->getRelationsByChild($productIds);
+        $productIds = $parentIds ? array_unique(array_merge($parentIds, $productIds)) : $productIds;
         $this->getCacheCleaner()->clean($productIds, function () use ($productIds) {
             $this->doReindex($productIds);
         });
@@ -248,13 +263,10 @@ private function doReindex($productIds = [])
     {
         $connection = $this->_getConnection();
 
-        $parentIds = $this->getRelationsByChild($productIds);
-        $processIds = $parentIds ? array_merge($parentIds, $productIds) : $productIds;
-
         // retrieve product types by processIds
         $select = $connection->select()
             ->from($this->_getTable('catalog_product_entity'), ['entity_id', 'type_id'])
-            ->where('entity_id IN(?)', $processIds);
+            ->where('entity_id IN(?)', $productIds);
         $pairs = $connection->fetchPairs($select);
 
         $byType = [];