Skip to content

Commit ea6c573

Browse files
admanesachinadmanesachin
authored
Merge pull request #7195 from magento-cia/cia-2.4.4-develop-bugfixes-04112021
[cia] AC-1344: OAuth: remove SHA-1 as acceptable signature method
2 parents 53231ba + 1852609 commit ea6c573

File tree

25 files changed

+843
-127
lines changed

25 files changed

+843
-127
lines changed

‎app/code/Magento/Cms/Ui/Component/Listing/Column/BlockActions.php

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -66,24 +66,24 @@ public function prepareDataSource(array $dataSource)
6666
'href' => $this->urlBuilder->getUrl(
6767
static::URL_PATH_EDIT,
6868
[
69-
'block_id' => $item['block_id'],
69+
'block_id' => $item['block_id']
7070
]
7171
),
72-
'label' => __('Edit'),
72+
'label' => __('Edit')
7373
],
7474
'delete' => [
7575
'href' => $this->urlBuilder->getUrl(
7676
static::URL_PATH_DELETE,
7777
[
78-
'block_id' => $item['block_id'],
78+
'block_id' => $item['block_id']
7979
]
8080
),
8181
'label' => __('Delete'),
8282
'confirm' => [
8383
'title' => __('Delete %1', $title),
84-
'message' => __('Are you sure you want to delete a %1 record?', $title),
84+
'message' => __('Are you sure you want to delete a %1 record?', $title)
8585
],
86-
'post' => true,
86+
'post' => true
8787
],
8888
];
8989
}
@@ -102,6 +102,7 @@ public function prepareDataSource(array $dataSource)
102102
private function getEscaper()
103103
{
104104
if (!$this->escaper) {
105+
// phpcs:ignore Magento2.PHP.AutogeneratedClassNotInConstructor
105106
$this->escaper = ObjectManager::getInstance()->get(Escaper::class);
106107
}
107108
return $this->escaper;

‎app/code/Magento/Integration/Model/Oauth/Token.php

Lines changed: 8 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -59,7 +59,9 @@ class Token extends \Magento\Framework\Model\AbstractModel
5959

6060
/**#@- */
6161

62-
/**#@- */
62+
/**
63+
* @var OauthHelper
64+
*/
6365
protected $_oauthHelper;
6466

6567
/**
@@ -136,9 +138,10 @@ public function __construct(
136138
$this->_consumerFactory = $consumerFactory;
137139
$this->_oauthData = $oauthData;
138140
$this->_oauthHelper = $oauthHelper;
139-
$this->reader = ObjectManager::getInstance()->get(UserTokenReaderInterface::class);
140-
$this->issuer = ObjectManager::getInstance()->get(UserTokenIssuerInterface::class);
141-
$this->tokenParamsFactory = ObjectManager::getInstance()->get(UserTokenParametersInterfaceFactory::class);
141+
$this->reader = $reader ?? ObjectManager::getInstance()->get(UserTokenReaderInterface::class);
142+
$this->issuer = $issuer ?? ObjectManager::getInstance()->get(UserTokenIssuerInterface::class);
143+
$this->tokenParamsFactory = $paramsFactory ??
144+
ObjectManager::getInstance()->get(UserTokenParametersInterfaceFactory::class);
142145
}
143146

144147
/**
@@ -360,6 +363,7 @@ public function loadByConsumerIdAndUserType($consumerId, $userType)
360363
{
361364
$tokenData = $this->getResource()->selectTokenByConsumerIdAndUserType($consumerId, $userType);
362365
$this->setData($tokenData ? $tokenData : []);
366+
$this->getResource()->afterLoad($this);
363367
return $this;
364368
}
365369

‎app/code/Magento/Integration/Model/Oauth/Token/Provider.php

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -44,7 +44,7 @@ public function __construct(
4444
}
4545

4646
/**
47-
* {@inheritdoc}
47+
* @inheritdoc
4848
*/
4949
public function validateConsumer($consumer)
5050
{
@@ -58,7 +58,7 @@ public function validateConsumer($consumer)
5858
}
5959

6060
/**
61-
* {@inheritdoc}
61+
* @inheritdoc
6262
*/
6363
public function createRequestToken($consumer)
6464
{
@@ -73,7 +73,7 @@ public function createRequestToken($consumer)
7373
}
7474

7575
/**
76-
* {@inheritdoc}
76+
* @inheritdoc
7777
*/
7878
public function validateRequestToken($requestToken, $consumer, $oauthVerifier)
7979
{
@@ -99,7 +99,7 @@ public function validateRequestToken($requestToken, $consumer, $oauthVerifier)
9999
}
100100

101101
/**
102-
* {@inheritdoc}
102+
* @inheritdoc
103103
*/
104104
public function getAccessToken($consumer)
105105
{
@@ -118,7 +118,7 @@ public function getAccessToken($consumer)
118118
}
119119

120120
/**
121-
* {@inheritdoc}
121+
* @inheritdoc
122122
*/
123123
public function validateAccessTokenRequest($accessToken, $consumer)
124124
{
@@ -144,7 +144,7 @@ public function validateAccessTokenRequest($accessToken, $consumer)
144144
}
145145

146146
/**
147-
* {@inheritdoc}
147+
* @inheritdoc
148148
*/
149149
public function validateAccessToken($accessToken)
150150
{
@@ -168,15 +168,15 @@ public function validateAccessToken($accessToken)
168168
}
169169

170170
/**
171-
* {@inheritdoc}
171+
* @inheritdoc
172172
*/
173173
public function validateOauthToken($oauthToken)
174174
{
175175
return strlen($oauthToken) == \Magento\Framework\Oauth\Helper\Oauth::LENGTH_TOKEN;
176176
}
177177

178178
/**
179-
* {@inheritdoc}
179+
* @inheritdoc
180180
*/
181181
public function getConsumerByKey($consumerKey)
182182
{

‎app/code/Magento/Integration/Model/ResourceModel/Oauth/Consumer.php

Lines changed: 49 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,17 +5,29 @@
55
*/
66
namespace Magento\Integration\Model\ResourceModel\Oauth;
77

8+
use Magento\Framework\App\ObjectManager;
9+
use Magento\Framework\Encryption\Encryptor;
10+
811
class Consumer extends \Magento\Framework\Model\ResourceModel\Db\AbstractDb
912
{
13+
14+
/**
15+
* @var Encryptor
16+
*/
17+
private $encryptor;
18+
1019
/**
1120
* @param \Magento\Framework\Model\ResourceModel\Db\Context $context
1221
* @param string $connectionName
22+
* @param Encryptor $encryptor
1323
*/
1424
public function __construct(
1525
\Magento\Framework\Model\ResourceModel\Db\Context $context,
16-
$connectionName = null
26+
$connectionName = null,
27+
Encryptor $encryptor = null
1728
) {
1829
parent::__construct($context, $connectionName);
30+
$this->encryptor = $encryptor ?? ObjectManager::getInstance()->get(Encryptor::class);
1931
}
2032

2133
/**
@@ -61,4 +73,40 @@ public function getTimeInSecondsSinceCreation($consumerId)
6173

6274
return $connection->fetchOne($select);
6375
}
76+
77+
/**
78+
* @inheritdoc
79+
*/
80+
protected function _beforeSave(\Magento\Framework\Model\AbstractModel $object)
81+
{
82+
if ($object->getSecret()) {
83+
$object->setSecret($this->encryptor->encrypt($object->getSecret()));
84+
}
85+
86+
return parent::_beforeSave($object);
87+
}
88+
89+
/**
90+
* @inheritdoc
91+
*/
92+
protected function _afterLoad(\Magento\Framework\Model\AbstractModel $object)
93+
{
94+
if ($object->getSecret()) {
95+
$object->setSecret($this->encryptor->decrypt($object->getSecret()));
96+
}
97+
98+
return parent::_afterLoad($object);
99+
}
100+
101+
/**
102+
* @inheritdoc
103+
*/
104+
protected function _afterSave(\Magento\Framework\Model\AbstractModel $object)
105+
{
106+
if ($object->getSecret()) {
107+
$object->setSecret($this->encryptor->decrypt($object->getSecret()));
108+
}
109+
110+
return parent::_afterSave($object);
111+
}
64112
}

‎app/code/Magento/Integration/Model/ResourceModel/Oauth/Token.php

Lines changed: 51 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,9 @@
66
namespace Magento\Integration\Model\ResourceModel\Oauth;
77

88
use Magento\Authorization\Model\UserContextInterface;
9+
use Magento\Framework\Encryption\Encryptor;
10+
use Magento\Framework\Oauth\Helper\Oauth as OauthHelper;
11+
use Magento\Framework\App\ObjectManager;
912

1013
/**
1114
* OAuth token resource model
@@ -18,26 +21,34 @@ class Token extends \Magento\Framework\Model\ResourceModel\Db\AbstractDb
1821
protected $_dateTime;
1922

2023
/**
21-
* Date
24+
* Date Formatting
2225
*
2326
* @var \Magento\Framework\Stdlib\DateTime\DateTime
2427
*/
2528
protected $date;
2629

30+
/**
31+
* @var Encryptor
32+
*/
33+
private $encryptor;
34+
2735
/**
2836
* @param \Magento\Framework\Model\ResourceModel\Db\Context $context
2937
* @param \Magento\Framework\Stdlib\DateTime $dateTime
3038
* @param \Magento\Framework\Stdlib\DateTime\DateTime $date
3139
* @param string $connectionName
40+
* @param Encryptor $encryptor
3241
*/
3342
public function __construct(
3443
\Magento\Framework\Model\ResourceModel\Db\Context $context,
3544
\Magento\Framework\Stdlib\DateTime $dateTime,
3645
\Magento\Framework\Stdlib\DateTime\DateTime $date,
37-
$connectionName = null
46+
$connectionName = null,
47+
$encryptor = null
3848
) {
3949
$this->_dateTime = $dateTime;
4050
$this->date = $date;
51+
$this->encryptor = $encryptor ?? ObjectManager::getInstance()->get(Encryptor::class);
4152
parent::__construct($context, $connectionName);
4253
}
4354

@@ -195,4 +206,42 @@ public function selectTokenByCustomerId($customerId)
195206
->where('user_type = ?', UserContextInterface::USER_TYPE_CUSTOMER);
196207
return $connection->fetchRow($select);
197208
}
209+
210+
/**
211+
* @inheritdoc
212+
*/
213+
protected function _beforeSave(\Magento\Framework\Model\AbstractModel $object)
214+
{
215+
if ($object->getType() === \Magento\Integration\Model\Oauth\Token::TYPE_ACCESS) {
216+
217+
if (!empty($object->getSecret())) {
218+
$object->setSecret($this->encryptor->encrypt($object->getSecret()));
219+
}
220+
}
221+
return parent::_beforeSave($object);
222+
}
223+
224+
/**
225+
* @inheritdoc
226+
*/
227+
protected function _afterLoad(\Magento\Framework\Model\AbstractModel $object)
228+
{
229+
if ($object->getType() === \Magento\Integration\Model\Oauth\Token::TYPE_ACCESS) {
230+
$object->setSecret($this->encryptor->decrypt($object->getSecret()));
231+
}
232+
233+
return parent::_afterLoad($object);
234+
}
235+
236+
/**
237+
* @inheritdoc
238+
*/
239+
protected function _afterSave(\Magento\Framework\Model\AbstractModel $object)
240+
{
241+
if ($object->getType() === \Magento\Integration\Model\Oauth\Token::TYPE_ACCESS) {
242+
$object->setSecret($this->encryptor->decrypt($object->getSecret()));
243+
}
244+
245+
return parent::_afterSave($object);
246+
}
198247
}

0 commit comments

Comments
 (0)