Skip to content

Commit cdccfed

Browse files
author
Anna Bukatar
committed
2 parents 34ad295 + 2e00918 commit cdccfed

File tree

173 files changed

+1891
-420
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

173 files changed

+1891
-420
lines changed

‎CHANGELOG.md

Lines changed: 11 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,12 +3,22 @@
33
* Fixed bugs:
44
* Fixed HTML escaping issue on user account
55
* Fixed fatal error during import
6+
* Fixed aggregation of sales rule report data by cron
7+
* Fixed an issue with showing HTML tags in messages
8+
* Fixed an issue with adding product swatch attributes through the SOAP
9+
* Fixed an issue with Admin Action Log archive
10+
* Fixed an issue when Rule-based free shipping doesn't work
611
* GitHub requests:
12+
* [#2453](https://github.com/magento/magento2/issues/2453) -- Fixed an issue when long street addresses are truncated after checkout
13+
* [#2628](https://github.com/magento/magento2/issues/2628) -- Fixed an issue with missing shipping data in orders API
714
* [#2852](https://github.com/magento/magento2/issues/2852) -- Fixed an issue where "magento setup:config:set" cleans data
815
* [#2957](https://github.com/magento/magento2/issues/2957) -- Fixed performance issue with products import
9-
* [#2628](https://github.com/magento/magento2/issues/2628) -- Fixed issue with missing shipping data in orders API
16+
* [#3233](https://github.com/magento/magento2/issues/3233) -- Fixed an issue with arbitrary PHP code execution in phrases
17+
* [#3786](https://github.com/magento/magento2/issues/3786) -- Fixed an issue with ability to brute force API access token
1018
* Various improvements:
1119
* Fixed performance issue with swatches functionality
20+
* Fixed issue with redundant requests when customer has shopping cart items
21+
* Fixed several security-related issues
1222

1323
2.0.1
1424
=============

‎app/code/Magento/AdminNotification/composer.json

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@
1010
"lib-libxml": "*"
1111
},
1212
"type": "magento2-module",
13-
"version": "100.0.3",
13+
"version": "100.0.4",
1414
"license": [
1515
"OSL-3.0",
1616
"AFL-3.0"

‎app/code/Magento/AdvancedPricingImportExport/composer.json

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@
1313
"magento/framework": "100.0.*"
1414
},
1515
"type": "magento2-module",
16-
"version": "100.0.3",
16+
"version": "100.0.4",
1717
"license": [
1818
"OSL-3.0",
1919
"AFL-3.0"

‎app/code/Magento/Authorization/composer.json

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@
77
"magento/framework": "100.0.*"
88
},
99
"type": "magento2-module",
10-
"version": "100.0.3",
10+
"version": "100.0.4",
1111
"license": [
1212
"OSL-3.0",
1313
"AFL-3.0"

‎app/code/Magento/Authorizenet/Controller/Directpost/Payment/Redirect.php

Lines changed: 37 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,10 +6,20 @@
66
*/
77
namespace Magento\Authorizenet\Controller\Directpost\Payment;
88

9+
use Magento\Framework\App\ObjectManager;
910
use Magento\Payment\Block\Transparent\Iframe;
11+
use Magento\Framework\Escaper;
1012

13+
/**
14+
* Class Redirect
15+
*/
1116
class Redirect extends \Magento\Authorizenet\Controller\Directpost\Payment
1217
{
18+
/**
19+
* @var Escaper
20+
*/
21+
private $escaper;
22+
1323
/**
1424
* Retrieve params and put javascript into iframe
1525
*
@@ -19,7 +29,7 @@ public function execute()
1929
{
2030
$helper = $this->dataFactory->create('frontend');
2131

22-
$redirectParams = $this->getRequest()->getParams();
32+
$redirectParams = $this->filterData($this->getRequest()->getParams());
2333
$params = [];
2434
if (!empty($redirectParams['success'])
2535
&& isset($redirectParams['x_invoice_num'])
@@ -44,4 +54,30 @@ public function execute()
4454
$this->_view->addPageLayoutHandles();
4555
$this->_view->loadLayout(false)->renderLayout();
4656
}
57+
58+
/**
59+
* Escape xss in request data
60+
* @param array $data
61+
* @return array
62+
*/
63+
private function filterData(array $data)
64+
{
65+
$self = $this;
66+
array_walk($data, function (&$item) use ($self) {
67+
$item = $self->getEscaper()->escapeXssInUrl($item);
68+
});
69+
return $data;
70+
}
71+
72+
/**
73+
* Get Escaper instance
74+
* @return Escaper
75+
*/
76+
private function getEscaper()
77+
{
78+
if (!$this->escaper) {
79+
$this->escaper = ObjectManager::getInstance()->get(Escaper::class);
80+
}
81+
return $this->escaper;
82+
}
4783
}

‎app/code/Magento/Authorizenet/Test/Unit/Controller/Directpost/Payment/RedirectTest.php

Lines changed: 110 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,110 @@
1+
<?php
2+
/**
3+
* Copyright © 2016 Magento. All rights reserved.
4+
* See COPYING.txt for license details.
5+
*/
6+
namespace Magento\Authorizenet\Test\Unit\Controller\Directpost\Payment;
7+
8+
use Magento\Authorizenet\Controller\Directpost\Payment\Redirect;
9+
use Magento\Framework\App\RequestInterface;
10+
use Magento\Framework\App\ViewInterface;
11+
use Magento\Framework\Escaper;
12+
use Magento\Framework\Registry;
13+
use Magento\Framework\TestFramework\Unit\Helper\ObjectManager;
14+
use Magento\Payment\Block\Transparent\Iframe;
15+
use PHPUnit_Framework_MockObject_MockObject as MockObject;
16+
17+
/**
18+
* Class RedirectTest
19+
*/
20+
class RedirectTest extends \PHPUnit_Framework_TestCase
21+
{
22+
/**
23+
* @var RequestInterface|MockObject
24+
*/
25+
private $request;
26+
27+
/**
28+
* @var ViewInterface|MockObject
29+
*/
30+
private $view;
31+
32+
/**
33+
* @var Registry|MockObject
34+
*/
35+
private $coreRegistry;
36+
37+
/**
38+
* @var Escaper|MockObject
39+
*/
40+
private $escaper;
41+
42+
/**
43+
* @var Redirect
44+
*/
45+
private $controller;
46+
47+
protected function setUp()
48+
{
49+
$objectManager = new ObjectManager($this);
50+
51+
$this->request = static::getMockForAbstractClass(RequestInterface::class);
52+
53+
$this->view = static::getMockForAbstractClass(ViewInterface::class);
54+
55+
$this->coreRegistry = static::getMockBuilder(Registry::class)
56+
->disableOriginalConstructor()
57+
->setMethods(['register'])
58+
->getMock();
59+
60+
$this->escaper = static::getMockBuilder(Escaper::class)
61+
->disableOriginalConstructor()
62+
->setMethods(['escapeXssInUrl'])
63+
->getMock();
64+
65+
$this->controller = $objectManager->getObject(Redirect::class, [
66+
'request' => $this->request,
67+
'view' => $this->view,
68+
'coreRegistry' => $this->coreRegistry
69+
]);
70+
71+
$refClass = new \ReflectionClass(Redirect::class);
72+
$refProperty = $refClass->getProperty('escaper');
73+
$refProperty->setAccessible(true);
74+
$refProperty->setValue($this->controller, $this->escaper);
75+
}
76+
77+
/**
78+
* @covers \Magento\Authorizenet\Controller\Directpost\Payment\Redirect::execute
79+
*/
80+
public function testExecute()
81+
{
82+
$url = 'http://test.com/redirect?=test';
83+
$params = [
84+
'order_success' => $url
85+
];
86+
$this->request->expects(static::once())
87+
->method('getParams')
88+
->willReturn($params);
89+
90+
$this->escaper->expects(static::once())
91+
->method('escapeXssInUrl')
92+
->with($url)
93+
->willReturn($url);
94+
95+
$this->coreRegistry->expects(static::once())
96+
->method('register')
97+
->with(Iframe::REGISTRY_KEY, $params);
98+
99+
$this->view->expects(static::once())
100+
->method('addPageLayoutHandles');
101+
$this->view->expects(static::once())
102+
->method('loadLayout')
103+
->with(false)
104+
->willReturnSelf();
105+
$this->view->expects(static::once())
106+
->method('renderLayout');
107+
108+
$this->controller->execute();
109+
}
110+
}

‎app/code/Magento/Authorizenet/composer.json

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@
1313
"magento/framework": "100.0.*"
1414
},
1515
"type": "magento2-module",
16-
"version": "100.0.3",
16+
"version": "100.0.4",
1717
"license": [
1818
"proprietary"
1919
],

‎app/code/Magento/Backend/Block/Widget/Grid/Column/Renderer/Date.php

Lines changed: 7 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -76,12 +76,15 @@ public function render(\Magento\Framework\DataObject $row)
7676
{
7777
if ($data = $row->getData($this->getColumn()->getIndex())) {
7878
$timezone = $this->getColumn()->getTimezone() !== false ? $this->_localeDate->getConfigTimezone() : 'UTC';
79+
if (!($data instanceof \DateTime)) {
80+
$localeDate = new \DateTime($data, new \DateTimeZone($timezone));
81+
} else {
82+
$data->setTimezone(new \DateTimeZone($timezone));
83+
$localeDate = $data;
84+
}
7985
return $this->dateTimeFormatter->formatObject(
8086
$this->_localeDate->date(
81-
new \DateTime(
82-
$data,
83-
new \DateTimeZone($timezone)
84-
)
87+
$localeDate
8588
),
8689
$this->_getFormat()
8790
);

‎app/code/Magento/Backend/composer.json

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,7 @@
2121
"magento/framework": "100.0.*"
2222
},
2323
"type": "magento2-module",
24-
"version": "100.0.3",
24+
"version": "100.0.4",
2525
"license": [
2626
"OSL-3.0",
2727
"AFL-3.0"

‎app/code/Magento/Backup/composer.json

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@
99
"magento/framework": "100.0.*"
1010
},
1111
"type": "magento2-module",
12-
"version": "100.0.3",
12+
"version": "100.0.4",
1313
"license": [
1414
"OSL-3.0",
1515
"AFL-3.0"

0 commit comments

Comments
 (0)