Skip to content

Commit ebe01a9

Browse files
xmavxmav
committed
Merge remote-tracking branch 'publication/2.1' into 2.1-develop-merge-2.1.17
2 parents 0e67ac9 + 1f9186c commit ebe01a9

File tree

308 files changed

+4827
-3712
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

308 files changed

+4827
-3712
lines changed

‎.htaccess

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,6 @@
11
# All explanations you could find in .htaccess.sample file
2+
## Specifies option, to use methods arguments in backtrace or not
3+
SetEnv MAGE_DEBUG_SHOW_ARGS 1
24
DirectoryIndex index.php
35
<IfModule mod_php5.c>
46
php_value memory_limit 756M
@@ -114,6 +116,10 @@ DirectoryIndex index.php
114116
order allow,deny
115117
deny from all
116118
</Files>
119+
<Files .user.ini>
120+
order allow,deny
121+
deny from all
122+
</Files>
117123
ErrorDocument 404 /pub/errors/404.php
118124
ErrorDocument 403 /pub/errors/404.php
119125
<IfModule mod_headers.c>

‎.htaccess.sample

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -278,6 +278,10 @@ DirectoryIndex index.php
278278
order allow,deny
279279
deny from all
280280
</Files>
281+
<Files .user.ini>
282+
order allow,deny
283+
deny from all
284+
</Files>
281285

282286
# For 404s and 403s that aren't handled by the application, show plain 404 response
283287
ErrorDocument 404 /pub/errors/404.php

‎app/bootstrap.php

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,7 @@
88
* Environment initialization
99
*/
1010
error_reporting(E_ALL);
11+
stream_wrapper_unregister('phar');
1112
#ini_set('display_errors', 1);
1213

1314
/* PHP version validation */

‎app/code/Magento/AdminNotification/Block/Grid/Renderer/Actions.php

Lines changed: 8 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,9 @@
1010

1111
namespace Magento\AdminNotification\Block\Grid\Renderer;
1212

13+
/**
14+
* Renderer class for action in the admin notifications grid.
15+
*/
1316
class Actions extends \Magento\Backend\Block\Widget\Grid\Column\Renderer\AbstractRenderer
1417
{
1518
/**
@@ -39,9 +42,9 @@ public function __construct(
3942
*/
4043
public function render(\Magento\Framework\DataObject $row)
4144
{
42-
$readDetailsHtml = $row->getUrl() ? '<a class="action-details" target="_blank" href="' . $row->getUrl() . '">' . __(
43-
'Read Details'
44-
) . '</a> | ' : '';
45+
$readDetailsHtml = $row->getUrl() ? '<a class="action-details" target="_blank" href="' .
46+
$this->escapeUrl($row->getUrl()) . '">' .
47+
__('Read Details') . '</a> | ' : '';
4548

4649
$markAsReadHtml = !$row->getIsRead() ? '<a class="action-mark" href="' . $this->getUrl(
4750
'*/*/markAsRead/',
@@ -52,7 +55,8 @@ public function render(\Magento\Framework\DataObject $row)
5255

5356
$encodedUrl = $this->_urlHelper->getEncodedUrl();
5457
return sprintf(
55-
'%s%s<a class="action-delete" href="%s" onClick="deleteConfirm(\'%s\', this.href); return false;">%s</a>',
58+
'%s%s<a class="action-delete" href="%s" onclick="deleteConfirm(\'%s\', this.href, {data: {}});' .
59+
' return false;">%s</a>',
5660
$readDetailsHtml,
5761
$markAsReadHtml,
5862
$this->getUrl(

‎app/code/Magento/AdminNotification/composer.json

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@
1010
"lib-libxml": "*"
1111
},
1212
"type": "magento2-module",
13-
"version": "100.1.6",
13+
"version": "100.1.7",
1414
"license": [
1515
"OSL-3.0",
1616
"AFL-3.0"

‎app/code/Magento/Authorizenet/Model/Directpost.php

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -549,16 +549,16 @@ public function setResponseData(array $postData)
549549
public function validateResponse()
550550
{
551551
$response = $this->getResponse();
552-
//md5 check
553-
if (
554-
!$this->getConfigData('trans_md5')
555-
|| !$this->getConfigData('login')
556-
|| !$response->isValidHash($this->getConfigData('trans_md5'), $this->getConfigData('login'))
552+
$hashConfigKey = !empty($response->getData('x_SHA2_Hash')) ? 'signature_key' : 'trans_md5';
553+
554+
//hash check
555+
if (!$response->isValidHash($this->getConfigData($hashConfigKey), $this->getConfigData('login'))
557556
) {
558557
throw new \Magento\Framework\Exception\LocalizedException(
559558
__('The transaction was declined because the response hash validation failed.')
560559
);
561560
}
561+
562562
return true;
563563
}
564564

‎app/code/Magento/Authorizenet/Model/Directpost/Request.php

Lines changed: 103 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,7 @@
77
namespace Magento\Authorizenet\Model\Directpost;
88

99
use Magento\Authorizenet\Model\Request as AuthorizenetRequest;
10+
use Magento\Framework\Intl\DateTimeFactory;
1011

1112
/**
1213
* Authorize.net request model for DirectPost model
@@ -18,9 +19,33 @@ class Request extends AuthorizenetRequest
1819
*/
1920
protected $_transKey = null;
2021

22+
/**
23+
* Hexadecimal signature key.
24+
*
25+
* @var string
26+
*/
27+
private $signatureKey = '';
28+
29+
/**
30+
* @var DateTimeFactory
31+
*/
32+
private $dateTimeFactory;
33+
34+
/**
35+
* @param DateTimeFactory $dateTimeFactory
36+
* @param array $data
37+
*/
38+
public function __construct(
39+
DateTimeFactory $dateTimeFactory,
40+
array $data = []
41+
) {
42+
$this->dateTimeFactory = $dateTimeFactory;
43+
parent::__construct($data);
44+
}
45+
2146
/**
2247
* Return merchant transaction key.
23-
* Needed to generate sign.
48+
* Needed to generate MD5 sign.
2449
*
2550
* @return string
2651
*/
@@ -31,7 +56,7 @@ protected function _getTransactionKey()
3156

3257
/**
3358
* Set merchant transaction key.
34-
* Needed to generate sign.
59+
* Needed to generate MD5 sign.
3560
*
3661
* @param string $transKey
3762
* @return $this
@@ -43,7 +68,7 @@ protected function _setTransactionKey($transKey)
4368
}
4469

4570
/**
46-
* Generates the fingerprint for request.
71+
* Generates the MD5 fingerprint for request.
4772
*
4873
* @param string $merchantApiLoginId
4974
* @param string $merchantTransactionKey
@@ -63,7 +88,7 @@ public function generateRequestSign(
6388
) {
6489
return hash_hmac(
6590
"md5",
66-
$merchantApiLoginId . "^" . $fpSequence . "^" . $fpTimestamp . "^" . $amount . "^" . $currencyCode,
91+
$merchantApiLoginId . '^' . $fpSequence . '^' . $fpTimestamp . '^' . $amount . '^' . $currencyCode,
6792
$merchantTransactionKey
6893
);
6994
}
@@ -85,6 +110,7 @@ public function setConstantData(\Magento\Authorizenet\Model\Directpost $paymentM
85110
->setXRelayUrl($paymentMethod->getRelayUrl());
86111

87112
$this->_setTransactionKey($paymentMethod->getConfigData('trans_key'));
113+
$this->setSignatureKey($paymentMethod->getConfigData('signature_key'));
88114
return $this;
89115
}
90116

@@ -168,17 +194,81 @@ public function setDataFromOrder(
168194
*/
169195
public function signRequestData()
170196
{
171-
$fpTimestamp = time();
172-
$hash = $this->generateRequestSign(
173-
$this->getXLogin(),
174-
$this->_getTransactionKey(),
175-
$this->getXAmount(),
176-
$this->getXCurrencyCode(),
177-
$this->getXFpSequence(),
178-
$fpTimestamp
179-
);
197+
$fpDate = $this->dateTimeFactory->create('now', new \DateTimeZone('UTC'));
198+
$fpTimestamp = $fpDate->getTimestamp();
199+
200+
if (!empty($this->getSignatureKey())) {
201+
$hash = $this->generateSha2RequestSign(
202+
$this->getXLogin(),
203+
$this->getSignatureKey(),
204+
$this->getXAmount(),
205+
$this->getXCurrencyCode(),
206+
$this->getXFpSequence(),
207+
$fpTimestamp
208+
);
209+
} else {
210+
$hash = $this->generateRequestSign(
211+
$this->getXLogin(),
212+
$this->_getTransactionKey(),
213+
$this->getXAmount(),
214+
$this->getXCurrencyCode(),
215+
$this->getXFpSequence(),
216+
$fpTimestamp
217+
);
218+
}
219+
180220
$this->setXFpTimestamp($fpTimestamp);
181221
$this->setXFpHash($hash);
222+
182223
return $this;
183224
}
225+
226+
/**
227+
* Generates the SHA2 fingerprint for request.
228+
*
229+
* @param string $merchantApiLoginId
230+
* @param string $merchantSignatureKey
231+
* @param string $amount
232+
* @param string $currencyCode
233+
* @param string $fpSequence An invoice number or random number.
234+
* @param string $fpTimestamp
235+
* @return string The fingerprint.
236+
*/
237+
private function generateSha2RequestSign(
238+
$merchantApiLoginId,
239+
$merchantSignatureKey,
240+
$amount,
241+
$currencyCode,
242+
$fpSequence,
243+
$fpTimestamp
244+
) {
245+
$message = $merchantApiLoginId . '^' . $fpSequence . '^' . $fpTimestamp . '^' . $amount . '^' . $currencyCode;
246+
247+
return strtoupper(hash_hmac('sha512', $message, pack('H*', $merchantSignatureKey)));
248+
}
249+
250+
/**
251+
* Return merchant hexadecimal signature key.
252+
*
253+
* Needed to generate SHA2 sign.
254+
*
255+
* @return string
256+
*/
257+
private function getSignatureKey()
258+
{
259+
return $this->signatureKey;
260+
}
261+
262+
/**
263+
* Set merchant hexadecimal signature key.
264+
*
265+
* Needed to generate SHA2 sign.
266+
*
267+
* @param string $signatureKey
268+
* @return void
269+
*/
270+
private function setSignatureKey($signatureKey)
271+
{
272+
$this->signatureKey = $signatureKey;
273+
}
184274
}

‎app/code/Magento/Authorizenet/Model/Directpost/Response.php

Lines changed: 67 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -24,25 +24,31 @@ class Response extends AuthorizenetResponse
2424
*/
2525
public function generateHash($merchantMd5, $merchantApiLogin, $amount, $transactionId)
2626
{
27-
if (!$amount) {
28-
$amount = '0.00';
29-
}
30-
3127
return strtoupper(md5($merchantMd5 . $merchantApiLogin . $transactionId . $amount));
3228
}
3329

3430
/**
3531
* Return if is valid order id.
3632
*
37-
* @param string $merchantMd5
33+
* @param string $storedHash
3834
* @param string $merchantApiLogin
3935
* @return bool
4036
*/
41-
public function isValidHash($merchantMd5, $merchantApiLogin)
37+
public function isValidHash($storedHash, $merchantApiLogin)
4238
{
43-
$hash = $this->generateHash($merchantMd5, $merchantApiLogin, $this->getXAmount(), $this->getXTransId());
39+
if (empty($this->getData('x_amount'))) {
40+
$this->setData('x_amount', '0.00');
41+
}
4442

45-
return Security::compareStrings($hash, $this->getData('x_MD5_Hash'));
43+
if (!empty($this->getData('x_SHA2_Hash'))) {
44+
$hash = $this->generateSha2Hash($storedHash);
45+
return Security::compareStrings($hash, $this->getData('x_SHA2_Hash'));
46+
} elseif (!empty($this->getData('x_MD5_Hash'))) {
47+
$hash = $this->generateHash($storedHash, $merchantApiLogin, $this->getXAmount(), $this->getXTransId());
48+
return Security::compareStrings($hash, $this->getData('x_MD5_Hash'));
49+
}
50+
51+
return false;
4652
}
4753

4854
/**
@@ -54,4 +60,57 @@ public function isApproved()
5460
{
5561
return $this->getXResponseCode() == \Magento\Authorizenet\Model\Directpost::RESPONSE_CODE_APPROVED;
5662
}
63+
64+
/**
65+
* Generates an SHA2 hash to compare against AuthNet's.
66+
*
67+
* @param string $signatureKey
68+
* @return string
69+
* @see https://support.authorize.net/s/article/MD5-Hash-End-of-Life-Signature-Key-Replacement
70+
*/
71+
private function generateSha2Hash($signatureKey)
72+
{
73+
$hashFields = [
74+
'x_trans_id',
75+
'x_test_request',
76+
'x_response_code',
77+
'x_auth_code',
78+
'x_cvv2_resp_code',
79+
'x_cavv_response',
80+
'x_avs_code',
81+
'x_method',
82+
'x_account_number',
83+
'x_amount',
84+
'x_company',
85+
'x_first_name',
86+
'x_last_name',
87+
'x_address',
88+
'x_city',
89+
'x_state',
90+
'x_zip',
91+
'x_country',
92+
'x_phone',
93+
'x_fax',
94+
'x_email',
95+
'x_ship_to_company',
96+
'x_ship_to_first_name',
97+
'x_ship_to_last_name',
98+
'x_ship_to_address',
99+
'x_ship_to_city',
100+
'x_ship_to_state',
101+
'x_ship_to_zip',
102+
'x_ship_to_country',
103+
'x_invoice_num',
104+
];
105+
106+
$message = '^';
107+
foreach ($hashFields as $field) {
108+
if (!empty($this->getData($field))) {
109+
$message .= $this->getData($field);
110+
}
111+
$message .= '^';
112+
}
113+
114+
return strtoupper(hash_hmac('sha512', $message, pack('H*', $signatureKey)));
115+
}
57116
}

0 commit comments

Comments
 (0)