Skip to content

Commit deb5ec7

Browse files
author
Hwashiang Yu
committed
Merge remote-tracking branch 'upstream/2.1.18-develop' into MAGETWO-98351
2 parents 9b3cee5 + 63e79aa commit deb5ec7

File tree

18 files changed

+887
-121
lines changed

18 files changed

+887
-121
lines changed

‎app/code/Magento/Catalog/Controller/Adminhtml/Product/Widget/Chooser.php

Lines changed: 27 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,16 @@
11
<?php
22
/**
3-
*
43
* Copyright © Magento, Inc. All rights reserved.
54
* See COPYING.txt for license details.
65
*/
76
namespace Magento\Catalog\Controller\Adminhtml\Product\Widget;
87

8+
use Magento\Framework\Exception\NotFoundException;
9+
use Magento\Framework\App\ObjectManager;
10+
11+
/**
12+
* Chooser Product container Action.
13+
*/
914
class Chooser extends \Magento\Backend\App\Action
1015
{
1116
/**
@@ -25,28 +30,41 @@ class Chooser extends \Magento\Backend\App\Action
2530
*/
2631
protected $layoutFactory;
2732

33+
/**
34+
* @var \Magento\Framework\Escaper
35+
*/
36+
private $escaper;
37+
2838
/**
2939
* @param \Magento\Backend\App\Action\Context $context
3040
* @param \Magento\Framework\Controller\Result\RawFactory $resultRawFactory
3141
* @param \Magento\Framework\View\LayoutFactory $layoutFactory
42+
* @param \Magento\Framework\Escaper|null $escaper
3243
*/
3344
public function __construct(
3445
\Magento\Backend\App\Action\Context $context,
3546
\Magento\Framework\Controller\Result\RawFactory $resultRawFactory,
36-
\Magento\Framework\View\LayoutFactory $layoutFactory
47+
\Magento\Framework\View\LayoutFactory $layoutFactory,
48+
\Magento\Framework\Escaper $escaper = null
3749
) {
3850
parent::__construct($context);
3951
$this->resultRawFactory = $resultRawFactory;
4052
$this->layoutFactory = $layoutFactory;
53+
$this->escaper = $escaper ?: ObjectManager::getInstance()->get(\Magento\Framework\Escaper::class);
4154
}
4255

4356
/**
44-
* Chooser Source action
57+
* Chooser Source action.
4558
*
4659
* @return \Magento\Framework\Controller\Result\Raw
60+
* @throws \Magento\Framework\Exception\NotFoundException
4761
*/
4862
public function execute()
4963
{
64+
if (!$this->getRequest()->isPost()) {
65+
throw new NotFoundException(__('Page not found.'));
66+
}
67+
5068
$uniqId = $this->getRequest()->getParam('uniq_id');
5169
$massAction = $this->getRequest()->getParam('use_massaction', false);
5270
$productTypeId = $this->getRequest()->getParam('product_type_id', null);
@@ -57,11 +75,11 @@ public function execute()
5775
'',
5876
[
5977
'data' => [
60-
'id' => $uniqId,
78+
'id' => $this->escaper->escapeHtml($uniqId),
6179
'use_massaction' => $massAction,
6280
'product_type_id' => $productTypeId,
63-
'category_id' => $this->getRequest()->getParam('category_id'),
64-
]
81+
'category_id' => (int)$this->getRequest()->getParam('category_id'),
82+
],
6583
]
6684
);
6785

@@ -73,10 +91,10 @@ public function execute()
7391
'',
7492
[
7593
'data' => [
76-
'id' => $uniqId . 'Tree',
94+
'id' => $this->escaper->escapeHtml($uniqId) . 'Tree',
7795
'node_click_listener' => $productsGrid->getCategoryClickListenerJs(),
7896
'with_empty_node' => true,
79-
]
97+
],
8098
]
8199
);
82100

@@ -88,6 +106,7 @@ public function execute()
88106

89107
/** @var \Magento\Framework\Controller\Result\Raw $resultRaw */
90108
$resultRaw = $this->resultRawFactory->create();
109+
91110
return $resultRaw->setContents($html);
92111
}
93112
}

‎app/code/Magento/Catalog/Test/Unit/Controller/Adminhtml/Product/Widget/ChooserTest.php

Lines changed: 97 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,97 @@
1+
<?php
2+
/**
3+
* Copyright © Magento, Inc. All rights reserved.
4+
* See COPYING.txt for license details.
5+
*/
6+
7+
namespace Magento\Catalog\Test\Unit\Controller\Adminhtml\Product\Widget;
8+
9+
use Magento\Catalog\Controller\Adminhtml\Product\Widget\Chooser;
10+
use Magento\Framework\App\Action\Context;
11+
use Magento\Framework\Controller\Result\RawFactory;
12+
use Magento\Framework\View\LayoutFactory;
13+
use Magento\Framework\App\RequestInterface;
14+
use Magento\Framework\App\Request\Http;
15+
use Magento\Framework\TestFramework\Unit\Helper\ObjectManager as ObjectManagerHelper;
16+
17+
/**
18+
* Unit tests for Magento\Catalog\Controller\Adminhtml\Product\Widget\Chooser.
19+
*/
20+
class ChooserTest extends \PHPUnit_Framework_TestCase
21+
{
22+
/**
23+
* @var Chooser
24+
*/
25+
private $controller;
26+
27+
/**
28+
* @var Context|\PHPUnit_Framework_MockObject_MockObject
29+
*/
30+
private $contextMock;
31+
32+
/**
33+
* @var RawFactory|\PHPUnit_Framework_MockObject_MockObject
34+
*/
35+
private $rawFactoryMock;
36+
37+
/**
38+
* @var LayoutFactory|\PHPUnit_Framework_MockObject_MockObject
39+
*/
40+
private $layoutFactoryMock;
41+
42+
/**
43+
* @var RequestInterface|\PHPUnit_Framework_MockObject_MockObject
44+
*/
45+
private $requestInterfaceMock;
46+
47+
/**
48+
* @var Http|\PHPUnit_Framework_MockObject_MockObject
49+
*/
50+
private $requestMock;
51+
52+
/**
53+
* @inheritdoc
54+
*/
55+
protected function setUp()
56+
{
57+
$objectManagerHelper = new ObjectManagerHelper($this);
58+
59+
$this->contextMock = $this->getMock(\Magento\Backend\App\Action\Context::class, [], [], '', false);
60+
$this->rawFactoryMock = $this->getMock(\Magento\Framework\Controller\Result\RawFactory::class);
61+
$this->layoutFactoryMock = $this->getMock(\Magento\Framework\View\LayoutFactory::class, [], [], '', false);
62+
$this->requestMock = $this->getMock(\Magento\Framework\App\Request\Http::class, [], [], '', false);
63+
$this->requestInterfaceMock = $this->getMockForAbstractClass(
64+
\Magento\Framework\App\RequestInterface::class,
65+
[],
66+
'',
67+
false,
68+
true,
69+
true,
70+
['isPost']
71+
);
72+
$this->contextMock->expects($this->once())->method('getRequest')->willReturn($this->requestMock);
73+
74+
$this->controller = $objectManagerHelper->getObject(
75+
\Magento\Catalog\Controller\Adminhtml\Product\Widget\Chooser::class,
76+
[
77+
'context' => $this->contextMock,
78+
'resultRawFactory' => $this->rawFactoryMock,
79+
'layoutFactory' => $this->layoutFactoryMock,
80+
]
81+
);
82+
}
83+
84+
/**
85+
* Check that error throws when request is not a POST.
86+
*
87+
* @return void
88+
* @expectedException \Magento\Framework\Exception\NotFoundException
89+
* @expectedExceptionMessage Page not found.
90+
*/
91+
public function testExecuteWithNonPostRequest()
92+
{
93+
$this->requestMock->expects($this->once())->method('isPost')->willReturn(false);
94+
95+
$this->controller->execute();
96+
}
97+
}

‎app/code/Magento/Catalog/Ui/DataProvider/Product/Form/Modifier/Categories.php

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -336,6 +336,7 @@ protected function getCategoriesTree($filter = null)
336336

337337
$categoryById[$category->getId()]['is_active'] = $category->getIsActive();
338338
$categoryById[$category->getId()]['label'] = $category->getName();
339+
$categoryById[$category->getId()]['__disableTmpl'] = true;
339340
$categoryById[$category->getParentId()]['optgroup'][] = &$categoryById[$category->getId()];
340341
}
341342

‎app/code/Magento/Checkout/Controller/Cart/CouponPost.php

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -72,6 +72,9 @@ public function execute()
7272
if (!$this->getRequest()->isPost()) {
7373
throw new \Magento\Framework\Exception\NotFoundException(__('Page not found.'));
7474
}
75+
if (!$this->_formKeyValidator->validate($this->getRequest())) {
76+
return $this->_goBack();
77+
}
7578

7679
$couponCode = $this->getRequest()->getParam('remove') == 1
7780
? ''

‎app/code/Magento/Checkout/Test/Unit/Controller/Cart/CouponPostTest.php

Lines changed: 11 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,11 +6,13 @@
66
namespace Magento\Checkout\Test\Unit\Controller\Cart;
77

88
use Magento\Checkout\Controller\Cart\Index;
9+
use Magento\Framework\Data\Form\FormKey\Validator;
910

1011
/**
1112
* Test for \Magento\Checkout\Controller\Cart\CouponPost
1213
*
1314
* @SuppressWarnings(PHPMD.CouplingBetweenObjects)
15+
* @SuppressWarnings(PHPMD.TooManyFields)
1416
*/
1517
class CouponPostTest extends \PHPUnit_Framework_TestCase
1618
{
@@ -84,6 +86,11 @@ class CouponPostTest extends \PHPUnit_Framework_TestCase
8486
*/
8587
private $redirectFactory;
8688

89+
/**
90+
* @var Validator|\PHPUnit_Framework_MockObject_MockObject
91+
*/
92+
private $formKeyValidatorMock;
93+
8794
/**
8895
* @var \PHPUnit_Framework_MockObject_MockObject
8996
*/
@@ -166,6 +173,8 @@ protected function setUp()
166173
->getMock();
167174
$this->quoteRepository = $this->getMock(\Magento\Quote\Api\CartRepositoryInterface::class);
168175
$this->shippingAddress = $this->getMock(\Magento\Quote\Model\Quote\Address::class, [], [], '', false);
176+
$this->formKeyValidatorMock = $this->getMock(Validator::class, [], [], '', false);
177+
$this->formKeyValidatorMock->expects($this->once())->method('validate')->willReturn(true);
169178

170179
$objectManagerHelper = new \Magento\Framework\TestFramework\Unit\Helper\ObjectManager($this);
171180

@@ -176,7 +185,8 @@ protected function setUp()
176185
'checkoutSession' => $this->checkoutSession,
177186
'cart' => $this->cart,
178187
'couponFactory' => $this->couponFactory,
179-
'quoteRepository' => $this->quoteRepository
188+
'quoteRepository' => $this->quoteRepository,
189+
'formKeyValidator' => $this->formKeyValidatorMock,
180190
]
181191
);
182192
}

‎app/code/Magento/Checkout/view/frontend/templates/cart/coupon.phtml

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,7 @@
2828
</div>
2929
</div>
3030
<div class="actions-toolbar">
31+
<?php echo $block->getBlockHtml('formkey')?>
3132
<?php if (!strlen($block->getCouponCode())): ?>
3233
<div class="primary">
3334
<button class="action apply primary" type="button" value="<?php /* @escapeNotVerified */ echo __('Apply Discount') ?>">

‎app/code/Magento/Customer/Controller/Account/ForgotPasswordPost.php

Lines changed: 20 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,8 @@
1010
use Magento\Customer\Model\AccountManagement;
1111
use Magento\Customer\Model\Session;
1212
use Magento\Framework\App\Action\Context;
13+
use Magento\Framework\App\ObjectManager;
14+
use Magento\Framework\Data\Form\FormKey\Validator;
1315
use Magento\Framework\Escaper;
1416
use Magento\Framework\Exception\NoSuchEntityException;
1517
use Magento\Framework\Exception\SecurityViolationException;
@@ -31,33 +33,50 @@ class ForgotPasswordPost extends \Magento\Customer\Controller\AbstractAccount
3133
*/
3234
protected $session;
3335

36+
/**
37+
* @var Validator
38+
*/
39+
private $formKeyValidator;
40+
3441
/**
3542
* @param Context $context
3643
* @param Session $customerSession
3744
* @param AccountManagementInterface $customerAccountManagement
3845
* @param Escaper $escaper
46+
* @param Validator|null $formKeyValidator
3947
*/
4048
public function __construct(
4149
Context $context,
4250
Session $customerSession,
4351
AccountManagementInterface $customerAccountManagement,
44-
Escaper $escaper
52+
Escaper $escaper,
53+
Validator $formKeyValidator = null
4554
) {
4655
$this->session = $customerSession;
4756
$this->customerAccountManagement = $customerAccountManagement;
4857
$this->escaper = $escaper;
58+
$this->formKeyValidator = $formKeyValidator ?: ObjectManager::getInstance()->get(Validator::class);
4959
parent::__construct($context);
5060
}
5161

5262
/**
5363
* Forgot customer password action
5464
*
5565
* @return \Magento\Framework\Controller\Result\Redirect
66+
* @throws \Magento\Framework\Exception\NotFoundException
5667
*/
5768
public function execute()
5869
{
5970
/** @var \Magento\Framework\Controller\Result\Redirect $resultRedirect */
6071
$resultRedirect = $this->resultRedirectFactory->create();
72+
73+
if (!$this->getRequest()->isPost()) {
74+
throw new \Magento\Framework\Exception\NotFoundException(__('Page not found.'));
75+
}
76+
if (!$this->formKeyValidator->validate($this->getRequest())) {
77+
return $resultRedirect->setPath('*/*/forgotpassword');
78+
}
79+
6180
$email = (string)$this->getRequest()->getPost('email');
6281
if ($email) {
6382
$validator = new \Zend\Validator\EmailAddress();

0 commit comments

Comments
 (0)