Skip to content

Commit ca03c88

Browse files
author
Sergey Semenov
committed
Merge remote-tracking branch 'mainline/2.0' into MAGETWO-46891-2.0
2 parents 96cfc06 + ee8ba2a commit ca03c88

File tree

80 files changed

+1024
-490
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

80 files changed

+1024
-490
lines changed

‎CHANGELOG.md

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,19 @@
1+
2.0.1
2+
=============
3+
* Fixed bugs:
4+
* Fixed an issue where can't deploy sample data after "composer create-project"
5+
* Fixed a security issue on user account page
6+
* Fixed a security issue on product page
7+
* Fixed an issue where possible edit someone else reviews
8+
* Fixed an issue where possible view order details for certain orders
9+
* Fixed an issue where catalog price rule isn't applied to product created using Web API
10+
* Fixed a potential vulnerability where possible insert SQL injection
11+
* Fixed a potential vulnerability on checkout page
12+
* Fixed an issue with upload empty file to custom option
13+
* Fixed an issue with performance on customer edit form
14+
* GitHub requests:
15+
* [#2519](https://github.com/magento/magento2/issues/2519) -- Fixed an issue where synonyms don't work with Magento 2.0
16+
117
2.0.0
218
=============
319
* Fixed bugs:

‎app/code/Magento/Authorizenet/Test/Unit/Model/DirectpostTest.php

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -331,7 +331,7 @@ public function testCheckResponseCodeFailure($responseCode)
331331
$this->dataHelperMock->expects($this->any())
332332
->method('wrapGatewayError')
333333
->with($reasonText)
334-
->willReturn(__('Gateway error: ' . $reasonText));
334+
->willReturn(__('Gateway error: %1', $reasonText));
335335

336336
$this->directpost->checkResponseCode();
337337
}

‎app/code/Magento/Backend/i18n/en_US.csv

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -306,7 +306,7 @@ YTD,YTD
306306
"Maximum sender name length is 255. Please correct your settings.","Maximum sender name length is 255. Please correct your settings."
307307
"The file you're uploading exceeds the server size limit of %1 kilobytes.","The file you're uploading exceeds the server size limit of %1 kilobytes."
308308
"The base directory to upload file is not specified.","The base directory to upload file is not specified."
309-
"The specified image adapter cannot be used because of: ","The specified image adapter cannot be used because of: "
309+
"The specified image adapter cannot be used because of: %1","The specified image adapter cannot be used because of: %1"
310310
"Default scope","Default scope"
311311
"Base currency","Base currency"
312312
"Display default currency","Display default currency"

‎app/code/Magento/Backend/view/adminhtml/templates/page/js/require_js.phtml

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,4 +7,7 @@
77
<script>
88
var BASE_URL = '<?php /* @escapeNotVerified */ echo $block->getUrl('*') ?>';
99
var FORM_KEY = '<?php /* @escapeNotVerified */ echo $block->getFormKey() ?>';
10+
var require = {
11+
"baseUrl": "<?php /* @escapeNotVerified */ echo $block->getViewFileUrl('/') ?>"
12+
};
1013
</script>

‎app/code/Magento/Catalog/Model/Product/Option/Type/File/Validator.php

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -100,6 +100,17 @@ protected function getValidatorErrors($errors, $fileInfo, $option)
100100
$this->fileSize->getMaxFileSizeInMb()
101101
);
102102
break;
103+
case \Zend_Validate_File_ImageSize::NOT_DETECTED:
104+
$result[] = __(
105+
"The file '%1' is empty. Please choose another one",
106+
$fileInfo['title']
107+
);
108+
break;
109+
default:
110+
$result[] = __(
111+
"The file '%1' is invalid. Please choose another one",
112+
$fileInfo['title']
113+
);
103114
}
104115
}
105116
return $result;

‎app/code/Magento/Catalog/Model/Product/Option/Type/File/ValidatorFile.php

Lines changed: 18 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -57,22 +57,30 @@ class ValidatorFile extends Validator
5757
*/
5858
protected $product;
5959

60+
/**
61+
* @var \Magento\Framework\Validator\File\IsImage
62+
*/
63+
protected $isImageValidator;
64+
6065
/**
6166
* @param \Magento\Framework\App\Config\ScopeConfigInterface $scopeConfig
6267
* @param \Magento\Framework\Filesystem $filesystem
6368
* @param \Magento\Framework\File\Size $fileSize
6469
* @param \Magento\Framework\HTTP\Adapter\FileTransferFactory $httpFactory
70+
* @param \Magento\Framework\Validator\File\IsImage $isImageValidator
6571
* @throws \Magento\Framework\Exception\FileSystemException
6672
*/
6773
public function __construct(
6874
\Magento\Framework\App\Config\ScopeConfigInterface $scopeConfig,
6975
\Magento\Framework\Filesystem $filesystem,
7076
\Magento\Framework\File\Size $fileSize,
71-
\Magento\Framework\HTTP\Adapter\FileTransferFactory $httpFactory
77+
\Magento\Framework\HTTP\Adapter\FileTransferFactory $httpFactory,
78+
\Magento\Framework\Validator\File\IsImage $isImageValidator
7279
) {
7380
$this->mediaDirectory = $filesystem->getDirectoryWrite(DirectoryList::MEDIA);
7481
$this->filesystem = $filesystem;
7582
$this->httpFactory = $httpFactory;
83+
$this->isImageValidator = $isImageValidator;
7684
parent::__construct($scopeConfig, $filesystem, $fileSize);
7785
}
7886

@@ -169,8 +177,15 @@ public function validate($processingParams, $option)
169177
$_height = 0;
170178

171179
if ($tmpDirectory->isReadable($tmpDirectory->getRelativePath($fileInfo['tmp_name']))) {
172-
$imageSize = getimagesize($fileInfo['tmp_name']);
173-
if ($imageSize) {
180+
if (filesize($fileInfo['tmp_name'])) {
181+
if ($this->isImageValidator->isValid($fileInfo['tmp_name'])) {
182+
$imageSize = getimagesize($fileInfo['tmp_name']);
183+
}
184+
} else {
185+
throw new LocalizedException(__('The file is empty. Please choose another one'));
186+
}
187+
188+
if (!empty($imageSize)) {
174189
$_width = $imageSize[0];
175190
$_height = $imageSize[1];
176191
}

‎app/code/Magento/Catalog/i18n/en_US.csv

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -699,3 +699,4 @@ Autosettings,Autosettings
699699
"Allow Gift Message","Allow Gift Message"
700700
"Meta Title","Meta Title"
701701
"Maximum 255 chars","Maximum 255 chars"
702+
"The file is empty. Please choose another one","The file is empty. Please choose another one"

‎app/code/Magento/Catalog/view/adminhtml/templates/catalog/product/composite/fieldset/options/type/file.phtml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -68,7 +68,7 @@ require(['prototype'], function(){
6868
</label>
6969
<div class="admin__field-control control">
7070
<?php if ($_fileExists): ?>
71-
<span class="<?php /* @escapeNotVerified */ echo $_fileNamed ?>"><?php /* @escapeNotVerified */ echo $_fileInfo->getTitle(); ?></span>
71+
<span class="<?php /* @noEscape */ echo $_fileNamed ?>"><?php echo $block->escapeHtml($_fileInfo->getTitle()); ?></span>
7272
<a href="javascript:void(0)" class="label" onclick="opFile<?php /* @escapeNotVerified */ echo $_rand; ?>.toggleFileChange($(this).next('.input-box'))">
7373
<?php /* @escapeNotVerified */ echo __('Change') ?>
7474
</a>&nbsp;
@@ -79,7 +79,7 @@ require(['prototype'], function(){
7979
<?php endif; ?>
8080
<div class="input-box" <?php echo $_fileExists ? 'style="display:none"' : '' ?>>
8181
<!-- ToDo UI: add appropriate file class when z-index issue in ui dialog will be resolved -->
82-
<input type="file" name="<?php /* @escapeNotVerified */ echo $_fileName; ?>" class="product-custom-option<?php echo $_option->getIsRequire() ? ' required-entry' : '' ?>" price="<?php /* @escapeNotVerified */ echo $block->getCurrencyPrice($_option->getPrice(true)) ?>" <?php echo $_fileExists ? 'disabled="disabled"' : '' ?>/>
82+
<input type="file" name="<?php /* @noEscape */ echo $_fileName; ?>" class="product-custom-option<?php echo $_option->getIsRequire() ? ' required-entry' : '' ?>" price="<?php /* @escapeNotVerified */ echo $block->getCurrencyPrice($_option->getPrice(true)) ?>" <?php echo $_fileExists ? 'disabled="disabled"' : '' ?>/>
8383
<input type="hidden" name="<?php /* @escapeNotVerified */ echo $_fieldNameAction; ?>" value="<?php /* @escapeNotVerified */ echo $_fieldValueAction; ?>" />
8484

8585
<?php if ($_option->getFileExtension()): ?>

‎app/code/Magento/Catalog/view/adminhtml/web/js/new-category-dialog.js

Lines changed: 33 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -83,20 +83,42 @@ define([
8383
var thisButton = $(e.currentTarget);
8484

8585
thisButton.prop('disabled', true);
86+
87+
var postData = {
88+
general: {
89+
name: $('#new_category_name').val(),
90+
is_active: 1,
91+
include_in_menu: 1
92+
},
93+
parent: $('#new_category_parent').val(),
94+
use_config: ['available_sort_by', 'default_sort_by'],
95+
form_key: FORM_KEY,
96+
return_session_messages_only: 1
97+
};
98+
99+
var fields = {};
100+
101+
$.each($(newCategoryForm).serializeArray(), function(_, field) {
102+
if (
103+
field.name &&
104+
field.name != 'new_category_name' &&
105+
field.name != 'new_category_parent'
106+
) {
107+
if (fields.hasOwnProperty(field.name)) {
108+
fields[field.name] = $.makeArray(fields[field.name]);
109+
fields[field.name].push(field.value);
110+
}
111+
else {
112+
fields[field.name] = field.value;
113+
}
114+
}
115+
});
116+
$.extend(postData, fields);
117+
86118
$.ajax({
87119
type: 'POST',
88120
url: widget.options.saveCategoryUrl,
89-
data: {
90-
general: {
91-
name: $('#new_category_name').val(),
92-
is_active: 1,
93-
include_in_menu: 1
94-
},
95-
parent: $('#new_category_parent').val(),
96-
use_config: ['available_sort_by', 'default_sort_by'],
97-
form_key: FORM_KEY,
98-
return_session_messages_only: 1
99-
},
121+
data: postData,
100122
dataType: 'json',
101123
context: $('body')
102124
}).success(function (data) {

‎app/code/Magento/Catalog/view/frontend/templates/product/view/options/type/file.phtml

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -17,14 +17,14 @@
1717
<?php $class = ($_option->getIsRequire()) ? ' required' : ''; ?>
1818

1919
<div class="field file<?php /* @escapeNotVerified */ echo $class; ?>">
20-
<label class="label" for="<?php /* @escapeNotVerified */ echo $_fileName; ?>" id="<?php /* @escapeNotVerified */ echo $_fileName; ?>-label">
20+
<label class="label" for="<?php /* @noEscape */ echo $_fileName; ?>" id="<?php /* @noEscape */ echo $_fileName; ?>-label">
2121
<span><?php echo $block->escapeHtml($_option->getTitle()) ?></span>
2222
<?php /* @escapeNotVerified */ echo $block->getFormatedPrice() ?>
2323
</label>
2424
<?php if ($_fileExists): ?>
2525
<div class="control">
26-
<span class="<?php /* @escapeNotVerified */ echo $_fileNamed ?>"><?php /* @escapeNotVerified */ echo $_fileInfo->getTitle(); ?></span>
27-
<a href="javascript:void(0)" class="label" id="change-<?php /* @escapeNotVerified */ echo $_fileName ?>" >
26+
<span class="<?php /* @noEscape */ echo $_fileNamed ?>"><?php echo $block->escapeHtml($_fileInfo->getTitle()); ?></span>
27+
<a href="javascript:void(0)" class="label" id="change-<?php /* @noEscape */ echo $_fileName ?>" >
2828
<?php /* @escapeNotVerified */ echo __('Change') ?>
2929
</a>
3030
<?php if (!$_option->getIsRequire()): ?>
@@ -35,8 +35,8 @@
3535
<?php endif; ?>
3636
<div class="control" id="input-box-<?php /* @escapeNotVerified */ echo $_fileName ?>"
3737
data-mage-init='{"priceOptionFile":{
38-
"fileName":"<?php /* @escapeNotVerified */ echo $_fileName ?>",
39-
"fileNamed":"<?php /* @escapeNotVerified */ echo $_fileNamed ?>",
38+
"fileName":"<?php /* @noEscape */ echo $_fileName ?>",
39+
"fileNamed":"<?php /* @noEscape */ echo $_fileNamed ?>",
4040
"fieldNameAction":"<?php /* @escapeNotVerified */ echo $_fieldNameAction ?>",
4141
"changeFileSelector":"#change-<?php /* @escapeNotVerified */ echo $_fileName ?>",
4242
"deleteFileSelector":"#delete-<?php /* @escapeNotVerified */ echo $_fileName ?>"}

0 commit comments

Comments
 (0)