Skip to content

Commit c3908b4

Browse files
zakdmaaakimov
zakdma
authored and
aakimov
committed
MAGETWO-90410: Prepare codebase for 2.1.14
1 parent d7954d6 commit c3908b4

File tree

28 files changed

+1298
-203
lines changed

28 files changed

+1298
-203
lines changed

‎app/code/Magento/Catalog/Model/ImageUploader.php

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -64,6 +64,18 @@ class ImageUploader
6464
*/
6565
protected $allowedExtensions;
6666

67+
/**
68+
* List of allowed image mime types.
69+
*
70+
* @var array
71+
*/
72+
private $allowedMimeTypes = [
73+
'image/jpg',
74+
'image/jpeg',
75+
'image/gif',
76+
'image/png',
77+
];
78+
6779
/**
6880
* ImageUploader constructor
6981
*
@@ -218,6 +230,7 @@ public function moveFileFromTmp($imageName)
218230
* @return string[]
219231
*
220232
* @throws \Magento\Framework\Exception\LocalizedException
233+
* @throws \Exception
221234
*/
222235
public function saveFileToTmpDir($fileId)
223236
{
@@ -228,6 +241,10 @@ public function saveFileToTmpDir($fileId)
228241
$uploader->setAllowedExtensions($this->getAllowedExtensions());
229242
$uploader->setAllowRenameFiles(true);
230243

244+
if (!$uploader->checkMimeType($this->allowedMimeTypes)) {
245+
throw new \Magento\Framework\Exception\LocalizedException(__('File validation failed.'));
246+
}
247+
231248
$result = $uploader->save($this->mediaDirectory->getAbsolutePath($baseTmpPath));
232249
unset($result['path']);
233250

‎app/code/Magento/Catalog/Model/Product/Gallery/UpdateHandler.php

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,9 @@ protected function processDeletedImages($product, array &$images)
2828
foreach ($images as &$image) {
2929
if (!empty($image['removed'])) {
3030
if (!empty($image['value_id']) && !isset($picturesInOtherStores[$image['file']])) {
31+
if (preg_match('/\.\.(\\\|\/)/', $image['file'])) {
32+
continue;
33+
}
3134
$recordsToDelete[] = $image['value_id'];
3235
$catalogPath = $this->mediaConfig->getBaseMediaPath();
3336
$isFile = $this->mediaDirectory->isFile($catalogPath . $image['file']);

‎app/code/Magento/Catalog/Test/Unit/Model/ImageUploaderTest.php

Lines changed: 166 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,166 @@
1+
<?php
2+
/**
3+
* Copyright © Magento, Inc. All rights reserved.
4+
* See COPYING.txt for license details.
5+
*/
6+
namespace Magento\Catalog\Test\Unit\Model;
7+
8+
/**
9+
* Magento\Catalog\Model\ImageUploader unit tests.
10+
*/
11+
class ImageUploaderTest extends \PHPUnit_Framework_TestCase
12+
{
13+
/**
14+
* @var \Magento\Catalog\Model\ImageUploader
15+
*/
16+
private $imageUploader;
17+
18+
/**
19+
* Core file storage database.
20+
*
21+
* @var \Magento\MediaStorage\Helper\File\Storage\Database|\PHPUnit_Framework_MockObject_MockObject
22+
*/
23+
private $coreFileStorageDatabaseMock;
24+
25+
/**
26+
* Media directory object (writable).
27+
*
28+
* @var \Magento\Framework\Filesystem|\PHPUnit_Framework_MockObject_MockObject
29+
*/
30+
private $mediaDirectoryMock;
31+
32+
/**
33+
* Media directory object (writable).
34+
*
35+
* @var \Magento\Framework\Filesystem\Directory\WriteInterface|\PHPUnit_Framework_MockObject_MockObject
36+
*/
37+
private $mediaWriteDirectoryMock;
38+
39+
/**
40+
* Uploader factory.
41+
*
42+
* @var \Magento\MediaStorage\Model\File\UploaderFactory|\PHPUnit_Framework_MockObject_MockObject
43+
*/
44+
private $uploaderFactoryMock;
45+
46+
/**
47+
* Store manager.
48+
*
49+
* @var \Magento\Store\Model\StoreManagerInterface|\PHPUnit_Framework_MockObject_MockObject
50+
*/
51+
private $storeManagerMock;
52+
53+
/**
54+
* @var \Psr\Log\LoggerInterface|\PHPUnit_Framework_MockObject_MockObject
55+
*/
56+
private $loggerMock;
57+
58+
/**
59+
* Base tmp path.
60+
*
61+
* @var string
62+
*/
63+
private $baseTmpPath;
64+
65+
/**
66+
* Base path.
67+
*
68+
* @var string
69+
*/
70+
private $basePath;
71+
72+
/**
73+
* Allowed extensions.
74+
*
75+
* @var string
76+
*/
77+
private $allowedExtensions;
78+
79+
/**
80+
* @inheritdoc
81+
*/
82+
protected function setUp()
83+
{
84+
$this->coreFileStorageDatabaseMock = $this->getMockBuilder(
85+
\Magento\MediaStorage\Helper\File\Storage\Database::class
86+
)
87+
->disableOriginalConstructor()
88+
->getMock();
89+
$this->mediaDirectoryMock = $this->getMockBuilder(
90+
\Magento\Framework\Filesystem::class
91+
)
92+
->disableOriginalConstructor()
93+
->getMock();
94+
$this->mediaWriteDirectoryMock = $this->getMockBuilder(
95+
\Magento\Framework\Filesystem\Directory\WriteInterface::class
96+
)
97+
->disableOriginalConstructor()
98+
->getMock();
99+
$this->mediaDirectoryMock->expects($this->any())->method('getDirectoryWrite')->willReturn(
100+
$this->mediaWriteDirectoryMock
101+
);
102+
$this->uploaderFactoryMock = $this->getMockBuilder(
103+
\Magento\MediaStorage\Model\File\UploaderFactory::class
104+
)
105+
->disableOriginalConstructor()
106+
->getMock();
107+
$this->storeManagerMock = $this->getMockBuilder(
108+
\Magento\Store\Model\StoreManagerInterface::class
109+
)
110+
->disableOriginalConstructor()
111+
->getMock();
112+
$this->loggerMock = $this->getMockBuilder(\Psr\Log\LoggerInterface::class)
113+
->disableOriginalConstructor()
114+
->getMock();
115+
$this->baseTmpPath = 'base/tmp/';
116+
$this->basePath = 'base/real/';
117+
$this->allowedExtensions = ['.jpg'];
118+
119+
$this->imageUploader =
120+
new \Magento\Catalog\Model\ImageUploader(
121+
$this->coreFileStorageDatabaseMock,
122+
$this->mediaDirectoryMock,
123+
$this->uploaderFactoryMock,
124+
$this->storeManagerMock,
125+
$this->loggerMock,
126+
$this->baseTmpPath,
127+
$this->basePath,
128+
$this->allowedExtensions
129+
);
130+
}
131+
132+
public function testSaveFileToTmpDir()
133+
{
134+
$fileId = 'file.jpg';
135+
$allowedMimeTypes = [
136+
'image/jpg',
137+
'image/jpeg',
138+
'image/gif',
139+
'image/png',
140+
];
141+
/** @var \Magento\MediaStorage\Model\File\Uploader|\PHPUnit_Framework_MockObject_MockObject $uploader */
142+
$uploader = $this->getMockBuilder(\Magento\MediaStorage\Model\File\Uploader::class)
143+
->disableOriginalConstructor()
144+
->getMock();
145+
$this->uploaderFactoryMock->expects($this->once())->method('create')->willReturn($uploader);
146+
$uploader->expects($this->once())->method('setAllowedExtensions')->with($this->allowedExtensions);
147+
$uploader->expects($this->once())->method('setAllowRenameFiles')->with(true);
148+
$this->mediaWriteDirectoryMock->expects($this->once())->method('getAbsolutePath')->with($this->baseTmpPath)
149+
->willReturn($this->basePath);
150+
$uploader->expects($this->once())->method('save')->with($this->basePath)
151+
->willReturn(['tmp_name' => $this->baseTmpPath, 'file' => $fileId, 'path' => $this->basePath]);
152+
$uploader->expects($this->atLeastOnce())->method('checkMimeType')->with($allowedMimeTypes)->willReturn(true);
153+
$storeMock = $this->getMockBuilder(\Magento\Store\Model\Store::class)
154+
->disableOriginalConstructor()
155+
->setMethods(['getBaseUrl'])
156+
->getMock();
157+
158+
$this->storeManagerMock->expects($this->once())->method('getStore')->willReturn($storeMock);
159+
$storeMock->expects($this->once())->method('getBaseUrl');
160+
$this->coreFileStorageDatabaseMock->expects($this->once())->method('saveFile');
161+
162+
$result = $this->imageUploader->saveFileToTmpDir($fileId);
163+
164+
$this->assertArrayNotHasKey('path', $result);
165+
}
166+
}

‎app/code/Magento/CatalogImportExport/Model/Import/Uploader.php

Lines changed: 17 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -7,10 +7,12 @@
77

88
use Magento\Framework\App\Filesystem\DirectoryList;
99
use Magento\Framework\Filesystem\DriverPool;
10+
use Magento\Framework\App\ObjectManager;
1011

1112
/**
1213
* Import entity product model
1314
*
15+
* @SuppressWarnings(PHPMD.CouplingBetweenObjects)
1416
* @author Magento Core Team <core@magentocommerce.com>
1517
*/
1618
class Uploader extends \Magento\MediaStorage\Model\File\Uploader
@@ -85,6 +87,11 @@ class Uploader extends \Magento\MediaStorage\Model\File\Uploader
8587
*/
8688
protected $_coreFileStorage;
8789

90+
/**
91+
* @var \Magento\Framework\App\Filesystem\DirectoryResolver
92+
*/
93+
private $directoryResolver;
94+
8895
/**
8996
* @param \Magento\MediaStorage\Helper\File\Storage\Database $coreFileStorageDb
9097
* @param \Magento\MediaStorage\Helper\File\Storage $coreFileStorage
@@ -93,6 +100,7 @@ class Uploader extends \Magento\MediaStorage\Model\File\Uploader
93100
* @param \Magento\Framework\Filesystem $filesystem
94101
* @param \Magento\Framework\Filesystem\File\ReadFactory $readFactory
95102
* @param null $filePath
103+
* @param \Magento\Framework\App\Filesystem\DirectoryResolver|null $directoryResolver
96104
* @throws \Magento\Framework\Exception\LocalizedException
97105
*/
98106
public function __construct(
@@ -102,7 +110,8 @@ public function __construct(
102110
\Magento\MediaStorage\Model\File\Validator\NotProtectedExtension $validator,
103111
\Magento\Framework\Filesystem $filesystem,
104112
\Magento\Framework\Filesystem\File\ReadFactory $readFactory,
105-
$filePath = null
113+
$filePath = null,
114+
\Magento\Framework\App\Filesystem\DirectoryResolver $directoryResolver = null
106115
) {
107116
if ($filePath !== null) {
108117
$this->_setUploadFile($filePath);
@@ -113,6 +122,8 @@ public function __construct(
113122
$this->_validator = $validator;
114123
$this->_directory = $filesystem->getDirectoryWrite(DirectoryList::ROOT);
115124
$this->_readFactory = $readFactory;
125+
$this->directoryResolver = $directoryResolver
126+
?: ObjectManager::getInstance()->get(\Magento\Framework\App\Filesystem\DirectoryResolver::class);
116127
}
117128

118129
/**
@@ -217,6 +228,7 @@ protected function _validateFile()
217228

218229
$fileExtension = pathinfo($filePath, PATHINFO_EXTENSION);
219230
if (!$this->checkAllowedExtension($fileExtension)) {
231+
$this->_directory->delete($filePath);
220232
throw new \Exception('Disallowed file type.');
221233
}
222234
//run validate callbacks
@@ -262,7 +274,10 @@ public function getTmpDir()
262274
*/
263275
public function setTmpDir($path)
264276
{
265-
if (is_string($path) && $this->_directory->isReadable($path)) {
277+
if (is_string($path)
278+
&& $this->_directory->isReadable($path)
279+
&& $this->directoryResolver->validatePath($this->_directory->getAbsolutePath($path), DirectoryList::ROOT)
280+
) {
266281
$this->_tmpDir = $path;
267282
return true;
268283
}

‎app/code/Magento/CatalogImportExport/Test/Unit/Model/Import/UploaderTest.php

Lines changed: 56 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -39,10 +39,15 @@ class UploaderTest extends \PHPUnit_Framework_TestCase
3939
protected $readFactory;
4040

4141
/**
42-
* @var \Magento\Framework\Filesystem\Directory\Writer| \PHPUnit_Framework_MockObject_MockObject
42+
* @var \Magento\Framework\Filesystem\Directory\Writer|\PHPUnit_Framework_MockObject_MockObject
4343
*/
4444
protected $directoryMock;
4545

46+
/**
47+
* @var \Magento\Framework\App\Filesystem\DirectoryResolver|\PHPUnit_Framework_MockObject_MockObject
48+
*/
49+
private $directoryResolver;
50+
4651
/**
4752
* @var \Magento\CatalogImportExport\Model\Import\Uploader|\PHPUnit_Framework_MockObject_MockObject
4853
*/
@@ -72,7 +77,7 @@ protected function setUp()
7277
->getMock();
7378

7479
$this->directoryMock = $this->getMockBuilder(\Magento\Framework\Filesystem\Directory\Writer::class)
75-
->setMethods(['writeFile', 'getRelativePath', 'isWritable', 'getAbsolutePath'])
80+
->setMethods(['writeFile', 'getRelativePath', 'isWritable', 'isReadable', 'getAbsolutePath'])
7681
->disableOriginalConstructor()
7782
->getMock();
7883

@@ -84,6 +89,11 @@ protected function setUp()
8489
->method('getDirectoryWrite')
8590
->will($this->returnValue($this->directoryMock));
8691

92+
$this->directoryResolver = $this->getMockBuilder(\Magento\Framework\App\Filesystem\DirectoryResolver::class)
93+
->disableOriginalConstructor()
94+
->setMethods(['validatePath'])
95+
->getMock();
96+
8797
$this->uploader = $this->getMockBuilder(\Magento\CatalogImportExport\Model\Import\Uploader::class)
8898
->setConstructorArgs([
8999
$this->coreFileStorageDb,
@@ -92,6 +102,8 @@ protected function setUp()
92102
$this->validator,
93103
$this->filesystem,
94104
$this->readFactory,
105+
null,
106+
$this->directoryResolver,
95107
])
96108
->setMethods(['_setUploadFile', 'save', 'getTmpDir'])
97109
->getMock();
@@ -169,4 +181,46 @@ public function moveFileUrlDataProvider()
169181
],
170182
];
171183
}
184+
185+
/**
186+
* @dataProvider validatePathDataProvider
187+
*
188+
* @param bool $pathIsValid
189+
* @return void
190+
*/
191+
public function testSetTmpDir($pathIsValid)
192+
{
193+
$path = 'path';
194+
$absolutePath = 'absolute_path';
195+
$this->directoryMock
196+
->expects($this->atLeastOnce())
197+
->method('isReadable')
198+
->with($path)
199+
->willReturn(true);
200+
$this->directoryMock
201+
->expects($this->atLeastOnce())
202+
->method('getAbsolutePath')
203+
->with($path)
204+
->willReturn($absolutePath);
205+
$this->directoryResolver
206+
->expects($this->atLeastOnce())
207+
->method('validatePath')
208+
->with($absolutePath, 'base')
209+
->willReturn($pathIsValid);
210+
211+
$this->assertEquals($pathIsValid, $this->uploader->setTmpDir($path));
212+
}
213+
214+
/**
215+
* Data provider for the testSetTmpDir()
216+
*
217+
* @return array
218+
*/
219+
public function validatePathDataProvider()
220+
{
221+
return [
222+
[true],
223+
[false],
224+
];
225+
}
172226
}

0 commit comments

Comments
 (0)