Skip to content

Commit d6a56f0

Browse files
author
Korshenko, Oleksii(okorshenko)
committed
Merge pull request #488 from magento-sparta/2.0.3_backlog
[SUPPORT] 2.0.3 Release
2 parents df6c393 + d583bd8 commit d6a56f0

File tree

56 files changed

+1622
-140
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

56 files changed

+1622
-140
lines changed

‎CHANGELOG.md

Lines changed: 11 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,12 +3,22 @@
33
* Fixed bugs:
44
* Fixed HTML escaping issue on user account
55
* Fixed fatal error during import
6+
* Fixed aggregation of sales rule report data by cron
7+
* Fixed an issue with showing HTML tags in messages
8+
* Fixed an issue with adding product swatch attributes through the SOAP
9+
* Fixed an issue with Admin Action Log archive
10+
* Fixed an issue when Rule-based free shipping doesn't work
611
* GitHub requests:
12+
* [#2453](https://github.com/magento/magento2/issues/2453) -- Fixed an issue when long street addresses are truncated after checkout
13+
* [#2628](https://github.com/magento/magento2/issues/2628) -- Fixed an issue with missing shipping data in orders API
714
* [#2852](https://github.com/magento/magento2/issues/2852) -- Fixed an issue where "magento setup:config:set" cleans data
815
* [#2957](https://github.com/magento/magento2/issues/2957) -- Fixed performance issue with products import
9-
* [#2628](https://github.com/magento/magento2/issues/2628) -- Fixed issue with missing shipping data in orders API
16+
* [#3233](https://github.com/magento/magento2/issues/3233) -- Fixed an issue with arbitrary PHP code execution in phrases
17+
* [#3786](https://github.com/magento/magento2/issues/3786) -- Fixed an issue with ability to brute force API access token
1018
* Various improvements:
1119
* Fixed performance issue with swatches functionality
20+
* Fixed issue with redundant requests when customer has shopping cart items
21+
* Fixed several security-related issues
1222

1323
2.0.1
1424
=============

‎app/code/Magento/Authorizenet/Controller/Directpost/Payment/Redirect.php

Lines changed: 37 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,10 +6,20 @@
66
*/
77
namespace Magento\Authorizenet\Controller\Directpost\Payment;
88

9+
use Magento\Framework\App\ObjectManager;
910
use Magento\Payment\Block\Transparent\Iframe;
11+
use Magento\Framework\Escaper;
1012

13+
/**
14+
* Class Redirect
15+
*/
1116
class Redirect extends \Magento\Authorizenet\Controller\Directpost\Payment
1217
{
18+
/**
19+
* @var Escaper
20+
*/
21+
private $escaper;
22+
1323
/**
1424
* Retrieve params and put javascript into iframe
1525
*
@@ -19,7 +29,7 @@ public function execute()
1929
{
2030
$helper = $this->dataFactory->create('frontend');
2131

22-
$redirectParams = $this->getRequest()->getParams();
32+
$redirectParams = $this->filterData($this->getRequest()->getParams());
2333
$params = [];
2434
if (!empty($redirectParams['success'])
2535
&& isset($redirectParams['x_invoice_num'])
@@ -44,4 +54,30 @@ public function execute()
4454
$this->_view->addPageLayoutHandles();
4555
$this->_view->loadLayout(false)->renderLayout();
4656
}
57+
58+
/**
59+
* Escape xss in request data
60+
* @param array $data
61+
* @return array
62+
*/
63+
private function filterData(array $data)
64+
{
65+
$self = $this;
66+
array_walk($data, function (&$item) use ($self) {
67+
$item = $self->getEscaper()->escapeXssInUrl($item);
68+
});
69+
return $data;
70+
}
71+
72+
/**
73+
* Get Escaper instance
74+
* @return Escaper
75+
*/
76+
private function getEscaper()
77+
{
78+
if (!$this->escaper) {
79+
$this->escaper = ObjectManager::getInstance()->get(Escaper::class);
80+
}
81+
return $this->escaper;
82+
}
4783
}

‎app/code/Magento/Authorizenet/Test/Unit/Controller/Directpost/Payment/RedirectTest.php

Lines changed: 110 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,110 @@
1+
<?php
2+
/**
3+
* Copyright © 2016 Magento. All rights reserved.
4+
* See COPYING.txt for license details.
5+
*/
6+
namespace Magento\Authorizenet\Test\Unit\Controller\Directpost\Payment;
7+
8+
use Magento\Authorizenet\Controller\Directpost\Payment\Redirect;
9+
use Magento\Framework\App\RequestInterface;
10+
use Magento\Framework\App\ViewInterface;
11+
use Magento\Framework\Escaper;
12+
use Magento\Framework\Registry;
13+
use Magento\Framework\TestFramework\Unit\Helper\ObjectManager;
14+
use Magento\Payment\Block\Transparent\Iframe;
15+
use PHPUnit_Framework_MockObject_MockObject as MockObject;
16+
17+
/**
18+
* Class RedirectTest
19+
*/
20+
class RedirectTest extends \PHPUnit_Framework_TestCase
21+
{
22+
/**
23+
* @var RequestInterface|MockObject
24+
*/
25+
private $request;
26+
27+
/**
28+
* @var ViewInterface|MockObject
29+
*/
30+
private $view;
31+
32+
/**
33+
* @var Registry|MockObject
34+
*/
35+
private $coreRegistry;
36+
37+
/**
38+
* @var Escaper|MockObject
39+
*/
40+
private $escaper;
41+
42+
/**
43+
* @var Redirect
44+
*/
45+
private $controller;
46+
47+
protected function setUp()
48+
{
49+
$objectManager = new ObjectManager($this);
50+
51+
$this->request = static::getMockForAbstractClass(RequestInterface::class);
52+
53+
$this->view = static::getMockForAbstractClass(ViewInterface::class);
54+
55+
$this->coreRegistry = static::getMockBuilder(Registry::class)
56+
->disableOriginalConstructor()
57+
->setMethods(['register'])
58+
->getMock();
59+
60+
$this->escaper = static::getMockBuilder(Escaper::class)
61+
->disableOriginalConstructor()
62+
->setMethods(['escapeXssInUrl'])
63+
->getMock();
64+
65+
$this->controller = $objectManager->getObject(Redirect::class, [
66+
'request' => $this->request,
67+
'view' => $this->view,
68+
'coreRegistry' => $this->coreRegistry
69+
]);
70+
71+
$refClass = new \ReflectionClass(Redirect::class);
72+
$refProperty = $refClass->getProperty('escaper');
73+
$refProperty->setAccessible(true);
74+
$refProperty->setValue($this->controller, $this->escaper);
75+
}
76+
77+
/**
78+
* @covers \Magento\Authorizenet\Controller\Directpost\Payment\Redirect::execute
79+
*/
80+
public function testExecute()
81+
{
82+
$url = 'http://test.com/redirect?=test';
83+
$params = [
84+
'order_success' => $url
85+
];
86+
$this->request->expects(static::once())
87+
->method('getParams')
88+
->willReturn($params);
89+
90+
$this->escaper->expects(static::once())
91+
->method('escapeXssInUrl')
92+
->with($url)
93+
->willReturn($url);
94+
95+
$this->coreRegistry->expects(static::once())
96+
->method('register')
97+
->with(Iframe::REGISTRY_KEY, $params);
98+
99+
$this->view->expects(static::once())
100+
->method('addPageLayoutHandles');
101+
$this->view->expects(static::once())
102+
->method('loadLayout')
103+
->with(false)
104+
->willReturnSelf();
105+
$this->view->expects(static::once())
106+
->method('renderLayout');
107+
108+
$this->controller->execute();
109+
}
110+
}

‎app/code/Magento/Backend/Block/Widget/Grid/Column/Renderer/Date.php

Lines changed: 7 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -76,12 +76,15 @@ public function render(\Magento\Framework\DataObject $row)
7676
{
7777
if ($data = $row->getData($this->getColumn()->getIndex())) {
7878
$timezone = $this->getColumn()->getTimezone() !== false ? $this->_localeDate->getConfigTimezone() : 'UTC';
79+
if (!($data instanceof \DateTime)) {
80+
$localeDate = new \DateTime($data, new \DateTimeZone($timezone));
81+
} else {
82+
$data->setTimezone(new \DateTimeZone($timezone));
83+
$localeDate = $data;
84+
}
7985
return $this->dateTimeFormatter->formatObject(
8086
$this->_localeDate->date(
81-
new \DateTime(
82-
$data,
83-
new \DateTimeZone($timezone)
84-
)
87+
$localeDate
8588
),
8689
$this->_getFormat()
8790
);

‎app/code/Magento/Catalog/etc/webapi.xml

Lines changed: 21 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -30,13 +30,13 @@
3030
<route url="/V1/products" method="GET">
3131
<service class="Magento\Catalog\Api\ProductRepositoryInterface" method="getList"/>
3232
<resources>
33-
<resource ref="anonymous" />
33+
<resource ref="Magento_Catalog::products" />
3434
</resources>
3535
</route>
3636
<route url="/V1/products/:sku" method="GET">
3737
<service class="Magento\Catalog\Api\ProductRepositoryInterface" method="get"/>
3838
<resources>
39-
<resource ref="anonymous" />
39+
<resource ref="Magento_Catalog::products" />
4040
</resources>
4141
</route>
4242

@@ -49,7 +49,7 @@
4949
<route url="/V1/products/attributes/:attributeCode" method="GET">
5050
<service class="Magento\Catalog\Api\ProductAttributeRepositoryInterface" method="get"/>
5151
<resources>
52-
<resource ref="anonymous" />
52+
<resource ref="Magento_Catalog::attributes_attributes" />
5353
</resources>
5454
</route>
5555
<route url="/V1/products/attributes" method="GET">
@@ -97,19 +97,19 @@
9797
<route url="/V1/products/types" method="GET">
9898
<service class="Magento\Catalog\Api\ProductTypeListInterface" method="getProductTypes"/>
9999
<resources>
100-
<resource ref="anonymous"/>
100+
<resource ref="Magento_Catalog::products"/>
101101
</resources>
102102
</route>
103103
<route url="/V1/products/attribute-sets/sets/list" method="GET">
104104
<service class="Magento\Catalog\Api\AttributeSetRepositoryInterface" method="getList"/>
105105
<resources>
106-
<resource ref="anonymous"/>
106+
<resource ref="Magento_Catalog::sets"/>
107107
</resources>
108108
</route>
109109
<route url="/V1/products/attribute-sets/:attributeSetId" method="GET">
110110
<service class="Magento\Catalog\Api\AttributeSetRepositoryInterface" method="get"/>
111111
<resources>
112-
<resource ref="anonymous"/>
112+
<resource ref="Magento_Catalog::sets"/>
113113
</resources>
114114
</route>
115115
<route url="/V1/products/attribute-sets/:attributeSetId" method="DELETE">
@@ -133,7 +133,7 @@
133133
<route url="/V1/products/attribute-sets/:attributeSetId/attributes" method="GET">
134134
<service class="Magento\Catalog\Api\ProductAttributeManagementInterface" method="getAttributes"/>
135135
<resources>
136-
<resource ref="anonymous"/>
136+
<resource ref="Magento_Catalog::sets"/>
137137
</resources>
138138
</route>
139139
<route url="/V1/products/attribute-sets/attributes" method="POST">
@@ -151,7 +151,7 @@
151151
<route url="/V1/products/attribute-sets/groups/list" method="GET">
152152
<service class="Magento\Catalog\Api\ProductAttributeGroupRepositoryInterface" method="getList"/>
153153
<resources>
154-
<resource ref="anonymous"/>
154+
<resource ref="Magento_Catalog::sets"/>
155155
</resources>
156156
</route>
157157
<route url="/V1/products/attribute-sets/groups" method="POST">
@@ -175,7 +175,7 @@
175175
<route url="/V1/products/attributes/:attributeCode/options" method="GET">
176176
<service class="Magento\Catalog\Api\ProductAttributeOptionManagementInterface" method="getItems"/>
177177
<resources>
178-
<resource ref="anonymous" />
178+
<resource ref="Magento_Catalog::attributes_attributes" />
179179
</resources>
180180
</route>
181181
<route url="/V1/products/attributes/:attributeCode/options" method="POST">
@@ -193,13 +193,13 @@
193193
<route url="/V1/products/media/types/:attributeSetName" method="GET">
194194
<service class="Magento\Catalog\Api\ProductMediaAttributeManagementInterface" method="getList"/>
195195
<resources>
196-
<resource ref="anonymous"/>
196+
<resource ref="Magento_Catalog::attributes_attributes"/>
197197
</resources>
198198
</route>
199199
<route url="/V1/products/:sku/media/:entryId" method="GET">
200200
<service class="Magento\Catalog\Api\ProductAttributeMediaGalleryManagementInterface" method="get"/>
201201
<resources>
202-
<resource ref="anonymous"/>
202+
<resource ref="Magento_Catalog::attributes_attributes"/>
203203
</resources>
204204
</route>
205205
<route url="/V1/products/:sku/media" method="POST">
@@ -223,15 +223,15 @@
223223
<route url="/V1/products/:sku/media" method="GET">
224224
<service class="Magento\Catalog\Api\ProductAttributeMediaGalleryManagementInterface" method="getList"/>
225225
<resources>
226-
<resource ref="anonymous"/>
226+
<resource ref="Magento_Catalog::catalog"/>
227227
</resources>
228228
</route>
229229

230230
<!-- Tier Price -->
231231
<route url="/V1/products/:sku/group-prices/:customerGroupId/tiers" method="GET">
232232
<service class="Magento\Catalog\Api\ProductTierPriceManagementInterface" method="getList"/>
233233
<resources>
234-
<resource ref="anonymous"/>
234+
<resource ref="Magento_Catalog::catalog"/>
235235
</resources>
236236
</route>
237237
<route url="/V1/products/:sku/group-prices/:customerGroupId/tiers/:qty/price/:price" method="POST">
@@ -256,7 +256,7 @@
256256
<route url="/V1/categories/:categoryId" method="GET">
257257
<service class="Magento\Catalog\Api\CategoryRepositoryInterface" method="get" />
258258
<resources>
259-
<resource ref="anonymous" />
259+
<resource ref="Magento_Catalog::categories" />
260260
</resources>
261261
</route>
262262
<route url="/V1/categories" method="POST">
@@ -268,7 +268,7 @@
268268
<route url="/V1/categories" method="GET">
269269
<service class="Magento\Catalog\Api\CategoryManagementInterface" method="getTree" />
270270
<resources>
271-
<resource ref="anonymous" />
271+
<resource ref="Magento_Catalog::categories" />
272272
</resources>
273273
</route>
274274
<route url="/V1/categories/:id" method="PUT">
@@ -294,13 +294,13 @@
294294
<route url="/V1/products/:sku/options" method="GET">
295295
<service class="Magento\Catalog\Api\ProductCustomOptionRepositoryInterface" method="getList"/>
296296
<resources>
297-
<resource ref="anonymous"/>
297+
<resource ref="Magento_Catalog::catalog"/>
298298
</resources>
299299
</route>
300300
<route url="/V1/products/:sku/options/:optionId" method="GET">
301301
<service class="Magento\Catalog\Api\ProductCustomOptionRepositoryInterface" method="get"/>
302302
<resources>
303-
<resource ref="anonymous"/>
303+
<resource ref="Magento_Catalog::catalog"/>
304304
</resources>
305305
</route>
306306
<route url="/V1/products/options" method="POST">
@@ -326,19 +326,19 @@
326326
<route url="/V1/products/links/types" method="GET">
327327
<service class="Magento\Catalog\Api\ProductLinkTypeListInterface" method="getItems"/>
328328
<resources>
329-
<resource ref="anonymous"/>
329+
<resource ref="Magento_Catalog::catalog"/>
330330
</resources>
331331
</route>
332332
<route url="/V1/products/links/:type/attributes" method="GET">
333333
<service class="Magento\Catalog\Api\ProductLinkTypeListInterface" method="getItemAttributes"/>
334334
<resources>
335-
<resource ref="anonymous"/>
335+
<resource ref="Magento_Catalog::catalog"/>
336336
</resources>
337337
</route>
338338
<route url="/V1/products/:sku/links/:type" method="GET">
339339
<service class="Magento\Catalog\Api\ProductLinkManagementInterface" method="getLinkedItemsByType"/>
340340
<resources>
341-
<resource ref="anonymous"/>
341+
<resource ref="Magento_Catalog::catalog"/>
342342
</resources>
343343
</route>
344344
<route url="/V1/products/:sku/links" method="POST">
@@ -364,7 +364,7 @@
364364
<route url="/V1/categories/:categoryId/products" method="GET">
365365
<service class="Magento\Catalog\Api\CategoryLinkManagementInterface" method="getAssignedProducts" />
366366
<resources>
367-
<resource ref="anonymous" />
367+
<resource ref="Magento_Catalog::categories" />
368368
</resources>
369369
</route>
370370
<route url="/V1/categories/:categoryId/products" method="POST">

‎app/code/Magento/CatalogInventory/etc/webapi.xml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,7 @@
2828
<route url="/V1/stockStatuses/:productSku" method="GET">
2929
<service class="Magento\CatalogInventory\Api\StockRegistryInterface" method="getStockStatusBySku"/>
3030
<resources>
31-
<resource ref="anonymous"/>
31+
<resource ref="Magento_CatalogInventory::cataloginventory"/>
3232
</resources>
3333
</route>
3434
</routes>

0 commit comments

Comments
 (0)