Skip to content

Commit c652d7d

Browse files
SeruyVSeruyV
committed
Merge remote-tracking branch 'origin/MAGETWO-96522' into 2.1.18-develop-pr67
2 parents 6baf040 + 6041931 commit c652d7d

File tree

9 files changed

+228
-28
lines changed

9 files changed

+228
-28
lines changed

‎app/code/Magento/Checkout/Controller/Cart/CouponPost.php

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -72,6 +72,9 @@ public function execute()
7272
if (!$this->getRequest()->isPost()) {
7373
throw new \Magento\Framework\Exception\NotFoundException(__('Page not found.'));
7474
}
75+
if (!$this->_formKeyValidator->validate($this->getRequest())) {
76+
return $this->_goBack();
77+
}
7578

7679
$couponCode = $this->getRequest()->getParam('remove') == 1
7780
? ''

‎app/code/Magento/Checkout/Test/Unit/Controller/Cart/CouponPostTest.php

Lines changed: 11 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,11 +6,13 @@
66
namespace Magento\Checkout\Test\Unit\Controller\Cart;
77

88
use Magento\Checkout\Controller\Cart\Index;
9+
use Magento\Framework\Data\Form\FormKey\Validator;
910

1011
/**
1112
* Test for \Magento\Checkout\Controller\Cart\CouponPost
1213
*
1314
* @SuppressWarnings(PHPMD.CouplingBetweenObjects)
15+
* @SuppressWarnings(PHPMD.TooManyFields)
1416
*/
1517
class CouponPostTest extends \PHPUnit_Framework_TestCase
1618
{
@@ -84,6 +86,11 @@ class CouponPostTest extends \PHPUnit_Framework_TestCase
8486
*/
8587
private $redirectFactory;
8688

89+
/**
90+
* @var Validator|\PHPUnit_Framework_MockObject_MockObject
91+
*/
92+
private $formKeyValidatorMock;
93+
8794
/**
8895
* @var \PHPUnit_Framework_MockObject_MockObject
8996
*/
@@ -166,6 +173,8 @@ protected function setUp()
166173
->getMock();
167174
$this->quoteRepository = $this->getMock(\Magento\Quote\Api\CartRepositoryInterface::class);
168175
$this->shippingAddress = $this->getMock(\Magento\Quote\Model\Quote\Address::class, [], [], '', false);
176+
$this->formKeyValidatorMock = $this->getMock(Validator::class, [], [], '', false);
177+
$this->formKeyValidatorMock->expects($this->once())->method('validate')->willReturn(true);
169178

170179
$objectManagerHelper = new \Magento\Framework\TestFramework\Unit\Helper\ObjectManager($this);
171180

@@ -176,7 +185,8 @@ protected function setUp()
176185
'checkoutSession' => $this->checkoutSession,
177186
'cart' => $this->cart,
178187
'couponFactory' => $this->couponFactory,
179-
'quoteRepository' => $this->quoteRepository
188+
'quoteRepository' => $this->quoteRepository,
189+
'formKeyValidator' => $this->formKeyValidatorMock,
180190
]
181191
);
182192
}

‎app/code/Magento/Checkout/view/frontend/templates/cart/coupon.phtml

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,7 @@
2828
</div>
2929
</div>
3030
<div class="actions-toolbar">
31+
<?php echo $block->getBlockHtml('formkey')?>
3132
<?php if (!strlen($block->getCouponCode())): ?>
3233
<div class="primary">
3334
<button class="action apply primary" type="button" value="<?php /* @escapeNotVerified */ echo __('Apply Discount') ?>">

‎app/code/Magento/Customer/Controller/Account/ForgotPasswordPost.php

Lines changed: 20 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,8 @@
1010
use Magento\Customer\Model\AccountManagement;
1111
use Magento\Customer\Model\Session;
1212
use Magento\Framework\App\Action\Context;
13+
use Magento\Framework\App\ObjectManager;
14+
use Magento\Framework\Data\Form\FormKey\Validator;
1315
use Magento\Framework\Escaper;
1416
use Magento\Framework\Exception\NoSuchEntityException;
1517
use Magento\Framework\Exception\SecurityViolationException;
@@ -31,33 +33,50 @@ class ForgotPasswordPost extends \Magento\Customer\Controller\AbstractAccount
3133
*/
3234
protected $session;
3335

36+
/**
37+
* @var Validator
38+
*/
39+
private $formKeyValidator;
40+
3441
/**
3542
* @param Context $context
3643
* @param Session $customerSession
3744
* @param AccountManagementInterface $customerAccountManagement
3845
* @param Escaper $escaper
46+
* @param Validator|null $formKeyValidator
3947
*/
4048
public function __construct(
4149
Context $context,
4250
Session $customerSession,
4351
AccountManagementInterface $customerAccountManagement,
44-
Escaper $escaper
52+
Escaper $escaper,
53+
Validator $formKeyValidator = null
4554
) {
4655
$this->session = $customerSession;
4756
$this->customerAccountManagement = $customerAccountManagement;
4857
$this->escaper = $escaper;
58+
$this->formKeyValidator = $formKeyValidator ?: ObjectManager::getInstance()->get(Validator::class);
4959
parent::__construct($context);
5060
}
5161

5262
/**
5363
* Forgot customer password action
5464
*
5565
* @return \Magento\Framework\Controller\Result\Redirect
66+
* @throws \Magento\Framework\Exception\NotFoundException
5667
*/
5768
public function execute()
5869
{
5970
/** @var \Magento\Framework\Controller\Result\Redirect $resultRedirect */
6071
$resultRedirect = $this->resultRedirectFactory->create();
72+
73+
if (!$this->getRequest()->isPost()) {
74+
throw new \Magento\Framework\Exception\NotFoundException(__('Page not found.'));
75+
}
76+
if (!$this->formKeyValidator->validate($this->getRequest())) {
77+
return $resultRedirect->setPath('*/*/forgotpassword');
78+
}
79+
6180
$email = (string)$this->getRequest()->getPost('email');
6281
if ($email) {
6382
$validator = new \Zend\Validator\EmailAddress();

‎app/code/Magento/Customer/Test/Unit/Controller/Account/ForgotPasswordPostTest.php

Lines changed: 88 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,7 @@
1313
use Magento\Framework\App\Request\Http as Request;
1414
use Magento\Framework\Controller\Result\Redirect as ResultRedirect;
1515
use Magento\Framework\Controller\Result\RedirectFactory as ResultRedirectFactory;
16+
use Magento\Framework\Data\Form\FormKey\Validator;
1617
use Magento\Framework\Escaper;
1718
use Magento\Framework\Exception\NoSuchEntityException;
1819
use Magento\Framework\Message\ManagerInterface;
@@ -67,31 +68,48 @@ class ForgotPasswordPostTest extends \PHPUnit_Framework_TestCase
6768
*/
6869
protected $messageManager;
6970

71+
/**
72+
* @var Validator|\PHPUnit_Framework_MockObject_MockObject
73+
*/
74+
private $formKeyValidatorMock;
75+
76+
/**
77+
* @inheritdoc
78+
*/
7079
protected function setUp()
7180
{
7281
$this->prepareContext();
7382

74-
$this->session = $this->getMockBuilder('Magento\Customer\Model\Session')
83+
$this->session = $this->getMockBuilder(\Magento\Customer\Model\Session::class)
7584
->disableOriginalConstructor()
7685
->getMock();
7786

78-
$this->accountManagement = $this->getMockBuilder('Magento\Customer\Api\AccountManagementInterface')
87+
$this->accountManagement = $this->getMockBuilder(\Magento\Customer\Api\AccountManagementInterface::class)
7988
->getMockForAbstractClass();
8089

81-
$this->escaper = $this->getMockBuilder('Magento\Framework\Escaper')
90+
$this->escaper = $this->getMockBuilder(\Magento\Framework\Escaper::class)
8291
->disableOriginalConstructor()
8392
->getMock();
93+
$this->formKeyValidatorMock = $this->getMockBuilder(Validator::class)
94+
->disableOriginalConstructor()
95+
->setMethods(['validate'])
96+
->getMock();
8497

8598
$this->controller = new ForgotPasswordPost(
8699
$this->context,
87100
$this->session,
88101
$this->accountManagement,
89-
$this->escaper
102+
$this->escaper,
103+
$this->formKeyValidatorMock
90104
);
91105
}
92106

107+
/**
108+
* @return void
109+
*/
93110
public function testExecuteEmptyEmail()
94111
{
112+
$this->validateRequest();
95113
$this->request->expects($this->once())
96114
->method('getPost')
97115
->with('email')
@@ -110,10 +128,14 @@ public function testExecuteEmptyEmail()
110128
$this->assertSame($this->resultRedirect, $this->controller->execute());
111129
}
112130

131+
/**
132+
* @return void
133+
*/
113134
public function testExecute()
114135
{
115136
$email = 'user1@example.com';
116137

138+
$this->validateRequest();
117139
$this->request->expects($this->once())
118140
->method('getPost')
119141
->with('email')
@@ -146,10 +168,14 @@ public function testExecute()
146168
$this->controller->execute();
147169
}
148170

171+
/**
172+
* @return void
173+
*/
149174
public function testExecuteNoSuchEntityException()
150175
{
151176
$email = 'user1@example.com';
152177

178+
$this->validateRequest();
153179
$this->request->expects($this->once())
154180
->method('getPost')
155181
->with('email')
@@ -182,11 +208,15 @@ public function testExecuteNoSuchEntityException()
182208
$this->controller->execute();
183209
}
184210

211+
/**
212+
* @return void
213+
*/
185214
public function testExecuteException()
186215
{
187216
$email = 'user1@example.com';
188217
$exception = new \Exception(__('Exception'));
189218

219+
$this->validateRequest();
190220
$this->request->expects($this->once())
191221
->method('getPost')
192222
->with('email')
@@ -210,28 +240,60 @@ public function testExecuteException()
210240
$this->controller->execute();
211241
}
212242

243+
/**
244+
* @return void
245+
* @expectedException \Magento\Framework\Exception\NotFoundException
246+
* @expectedExceptionMessage Page not found.
247+
*/
248+
public function testExecuteWithNonPostRequest()
249+
{
250+
$this->request->expects($this->once())->method('isPost')->willReturn(false);
251+
252+
$this->controller->execute();
253+
}
254+
255+
/**
256+
* @return void
257+
*/
258+
public function testExecuteWithInvalidFormKey()
259+
{
260+
$this->request->expects($this->once())->method('isPost')->willReturn(true);
261+
$this->formKeyValidatorMock->expects($this->once())
262+
->method('validate')
263+
->with($this->request)
264+
->willReturn(false);
265+
$this->resultRedirect->expects($this->once())->method('setPath')->with('*/*/forgotpassword')->willReturnSelf();
266+
267+
$this->controller->execute();
268+
}
269+
270+
/**
271+
* Prepare action context.
272+
*
273+
* @return void
274+
*/
213275
protected function prepareContext()
214276
{
215-
$this->resultRedirect = $this->getMockBuilder('Magento\Framework\Controller\Result\Redirect')
277+
$this->resultRedirect = $this->getMockBuilder(\Magento\Framework\Controller\Result\Redirect::class)
216278
->disableOriginalConstructor()
217279
->getMock();
218280

219-
$this->resultRedirectFactory = $this->getMockBuilder('Magento\Framework\Controller\Result\RedirectFactory')
281+
$this->resultRedirectFactory = $this->getMockBuilder(
282+
\Magento\Framework\Controller\Result\RedirectFactory::class
283+
)
220284
->disableOriginalConstructor()
221285
->getMock();
222286

223-
$this->context = $this->getMockBuilder('Magento\Framework\App\Action\Context')
287+
$this->context = $this->getMockBuilder(\Magento\Framework\App\Action\Context::class)
224288
->disableOriginalConstructor()
225289
->getMock();
226290

227-
$this->request = $this->getMockBuilder('Magento\Framework\App\Request\Http')
291+
$this->request = $this->getMockBuilder(\Magento\Framework\App\Request\Http::class)
228292
->disableOriginalConstructor()
229-
->setMethods([
230-
'getPost',
231-
])
293+
->setMethods(['getPost', 'isPost'])
232294
->getMock();
233295

234-
$this->messageManager = $this->getMockBuilder('Magento\Framework\Message\ManagerInterface')
296+
$this->messageManager = $this->getMockBuilder(\Magento\Framework\Message\ManagerInterface::class)
235297
->getMockForAbstractClass();
236298

237299
$this->resultRedirectFactory->expects($this->any())
@@ -250,4 +312,18 @@ protected function prepareContext()
250312
->method('getMessageManager')
251313
->willReturn($this->messageManager);
252314
}
315+
316+
/**
317+
* Validate request.
318+
*
319+
* @return void
320+
*/
321+
private function validateRequest()
322+
{
323+
$this->request->expects($this->once())->method('isPost')->willReturn(true);
324+
$this->formKeyValidatorMock->expects($this->once())
325+
->method('validate')
326+
->with($this->request)
327+
->willReturn(true);
328+
}
253329
}

‎app/code/Magento/Customer/view/frontend/templates/form/forgotpassword.phtml

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,7 @@
2525
<?php echo $block->getChildHtml('form_additional_info'); ?>
2626
</fieldset>
2727
<div class="actions-toolbar">
28+
<?php echo $block->getBlockHtml('formkey')?>
2829
<div class="primary">
2930
<button type="submit" class="action submit primary"><span><?php echo $block->escapeHtml(__('Reset My Password')) ?></span></button>
3031
</div>

‎app/code/Magento/Sales/Controller/Guest/View.php

Lines changed: 21 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,8 @@
66
namespace Magento\Sales\Controller\Guest;
77

88
use Magento\Framework\App\Action;
9+
use Magento\Framework\App\ObjectManager;
10+
use Magento\Framework\Data\Form\FormKey\Validator;
911
use Magento\Sales\Helper\Guest as GuestHelper;
1012
use Magento\Framework\View\Result\PageFactory;
1113
use Magento\Framework\Controller\ResultInterface;
@@ -22,26 +24,42 @@ class View extends Action\Action
2224
*/
2325
protected $resultPageFactory;
2426

27+
/**
28+
* @var Validator
29+
*/
30+
private $formKeyValidator;
31+
2532
/**
2633
* @param \Magento\Framework\App\Action\Context $context
27-
* @param \Magento\Sales\Helper\Guest $guestHelper
28-
* @param \Magento\Framework\View\Result\PageFactory $resultPageFactory
34+
* @param GuestHelper $guestHelper
35+
* @param PageFactory $resultPageFactory
36+
* @param Validator|null $formKeyValidator
2937
*/
3038
public function __construct(
3139
Action\Context $context,
3240
GuestHelper $guestHelper,
33-
PageFactory $resultPageFactory
41+
PageFactory $resultPageFactory,
42+
Validator $formKeyValidator = null
3443
) {
3544
$this->guestHelper = $guestHelper;
3645
$this->resultPageFactory = $resultPageFactory;
46+
$this->formKeyValidator = $formKeyValidator ?: ObjectManager::getInstance()->get(Validator::class);
3747
parent::__construct($context);
3848
}
3949

4050
/**
4151
* @return \Magento\Framework\Controller\ResultInterface
52+
* @throws \Magento\Framework\Exception\NotFoundException
4253
*/
4354
public function execute()
4455
{
56+
if (!$this->getRequest()->isPost()) {
57+
throw new \Magento\Framework\Exception\NotFoundException(__('Page not found.'));
58+
}
59+
if (!$this->formKeyValidator->validate($this->getRequest())) {
60+
return $this->resultRedirectFactory->create()->setPath('*/*/form/');
61+
}
62+
4563
$result = $this->guestHelper->loadValidOrder($this->getRequest());
4664
if ($result instanceof ResultInterface) {
4765
return $result;

0 commit comments

Comments
 (0)