merge magento/develop into magento-earl-grey/MAGETWO-72521

Author: Magento CICD

app/code/Magento/AdminNotification/Controller/Adminhtml/System/Message/ListAction.php

@@ -8,6 +8,11 @@
 
 class ListAction extends \Magento\Backend\App\AbstractAction
 {
+    /**
+     * Authorization level of a basic admin session
+     */
+    const ADMIN_RESOURCE = 'Magento_AdminNotification::show_list';
+
     /**
      * @var \Magento\Framework\Json\Helper\Data
      */

app/code/Magento/AdminNotification/Model/Feed.php

@@ -148,9 +148,9 @@ public function checkUpdate()
                     $feedData[] = [
                         'severity' => (int)$item->severity,
                         'date_added' => date('Y-m-d H:i:s', $itemPublicationDate),
-                        'title' => (string)$item->title,
-                        'description' => (string)$item->description,
-                        'url' => (string)$item->link,
+                        'title' => $this->escapeString($item->title),
+                        'description' => $this->escapeString($item->description),
+                        'url' => $this->escapeString($item->link),
                     ];
                 }
             }
@@ -246,4 +246,15 @@ public function getFeedXml()
 
         return $xml;
     }
+
+    /**
+     * Converts incoming data to string format and escapes special characters.
+     *
+     * @param \SimpleXMLElement $data
+     * @return string
+     */
+    private function escapeString(\SimpleXMLElement $data)
+    {
+        return htmlspecialchars((string)$data);
+    }
 }

app/code/Magento/AdminNotification/Test/Unit/Model/FeedTest.php

@@ -145,8 +145,27 @@ public function testCheckUpdate($callInbox, $curlRequest)
             ->will($this->returnValue('Sat, 6 Sep 2014 16:46:11 UTC'));
         if ($callInbox) {
             $this->inboxFactory->expects($this->once())->method('create')
-                ->will(($this->returnValue($this->inboxModel)));
-            $this->inboxModel->expects($this->once())->method('parse')->will($this->returnSelf());
+                ->will($this->returnValue($this->inboxModel));
+            $this->inboxModel->expects($this->once())
+                ->method('parse')
+                ->with(
+                    $this->callback(
+                        function ($data) {
+                            $fieldsToCheck = ['title', 'description', 'url'];
+                            return array_reduce(
+                                $fieldsToCheck,
+                                function ($initialValue, $item) use ($data) {
+                                    $haystack = $data[0][$item] ?? false;
+                                    return $haystack
+                                        ? $initialValue && !strpos($haystack, '<') && !strpos($haystack, '>')
+                                        : true;
+                                },
+                                true
+                            );
+                        }
+                    )
+                )
+                ->will($this->returnSelf());
         } else {
             $this->inboxFactory->expects($this->never())->method('create');
             $this->inboxModel->expects($this->never())->method('parse');
@@ -196,7 +215,27 @@ public function checkUpdateDataProvider()
                                 </item>
                             </channel>
                         </rss>'
-            ]
+            ],
+            [
+                true,
+                // @codingStandardsIgnoreStart
+                'HEADER
+
+                <?xml version="1.0" encoding="utf-8" ?>
+                        <rss version="2.0" xmlns:atom="http://www.w3.org/2005/Atom">
+                            <channel>
+                                <title>MagentoCommerce</title>
+                                <item>
+                                    <title><![CDATA[<script>alert("Hello!");</script>Test Title]]></title>
+                                    <link><![CDATA[http://magento.com/feed_url<script>alert("Hello!");</script>]]></link>
+                                    <severity>4</severity>
+                                    <description><![CDATA[Test <script>alert("Hello!");</script>Description]]></description>
+                                    <pubDate>Tue, 20 Jun 2017 13:14:47 UTC</pubDate>
+                                </item>
+                            </channel>
+                        </rss>'
+                // @codingStandardsIgnoreEnd
+            ],
         ];
     }
 }

app/code/Magento/AdminNotification/etc/config.xml

@@ -12,7 +12,7 @@
                 <feed_url>notifications.magentocommerce.com/magento2/community/notifications.rss</feed_url>
                 <popup_url>widgets.magentocommerce.com/notificationPopup</popup_url>
                 <severity_icons_url>widgets.magentocommerce.com/%s/%s.gif</severity_icons_url>
-                <use_https>0</use_https>
+                <use_https>1</use_https>
                 <frequency>1</frequency>
                 <last_update>0</last_update>
             </adminnotification>

app/code/Magento/AdminNotification/view/adminhtml/ui_component/notification_area.xml

@@ -24,6 +24,7 @@
             </storageConfig>
             <updateUrl path="mui/index/render"/>
         </settings>
+        <aclResource>Magento_AdminNotification::show_list</aclResource>
         <dataProvider class="Magento\AdminNotification\Ui\Component\DataProvider\DataProvider" name="notification_area_data_source">
             <settings>
                 <requestFieldName>identity</requestFieldName>

app/code/Magento/Authorizenet/Controller/Directpost/Payment/BackendResponse.php

@@ -6,8 +6,48 @@
  */
 namespace Magento\Authorizenet\Controller\Directpost\Payment;
 
+use Magento\Authorizenet\Helper\DataFactory;
+use Magento\Authorizenet\Model\Directpost;
+use Magento\Authorizenet\Model\DirectpostFactory;
+use Magento\Framework\App\Action\Context;
+use Magento\Framework\Controller\ResultFactory;
+use Magento\Framework\Exception\LocalizedException;
+use Magento\Framework\Registry;
+use Psr\Log\LoggerInterface;
+
 class BackendResponse extends \Magento\Authorizenet\Controller\Directpost\Payment
 {
+    /**
+     * @var LoggerInterface
+     */
+    private $logger;
+
+    /**
+     * @var DirectpostFactory
+     */
+    private $directpostFactory;
+
+    /**
+     * BackendResponse constructor.
+     *
+     * @param Context $context
+     * @param Registry $coreRegistry
+     * @param DataFactory $dataFactory
+     * @param DirectpostFactory $directpostFactory
+     * @param LoggerInterface|null $logger
+     */
+    public function __construct(
+        Context $context,
+        Registry $coreRegistry,
+        DataFactory $dataFactory,
+        DirectpostFactory $directpostFactory,
+        LoggerInterface $logger = null
+    ) {
+        parent::__construct($context, $coreRegistry, $dataFactory);
+        $this->directpostFactory = $directpostFactory ?: $this->_objectManager->create(DirectpostFactory::class);
+        $this->logger = $logger ?: $this->_objectManager->get(LoggerInterface::class);
+    }
+
     /**
      * Response action.
      * Action for Authorize.net SIM Relay Request.
@@ -16,7 +56,20 @@ class BackendResponse extends \Magento\Authorizenet\Controller\Directpost\Paymen
      */
     public function execute()
     {
+        $data = $this->getRequest()->getParams();
+        /** @var Directpost $paymentMethod */
+        $paymentMethod = $this->directpostFactory->create();
+        if (!empty($data['store_id'])) {
+            $paymentMethod->setStore($data['store_id']);
+        }
+        $paymentMethod->setResponseData($data);
+        try {
+            $paymentMethod->validateResponse();
+        } catch (LocalizedException $e) {
+            $this->logger->critical($e->getMessage());
+            return $this->_redirect('noroute');
+        }
         $this->_responseAction('adminhtml');
-        return $this->resultFactory->create(\Magento\Framework\Controller\ResultFactory::TYPE_PAGE);
+        return $this->resultFactory->create(ResultFactory::TYPE_PAGE);
     }
 }

app/code/Magento/Backend/Block/Widget/Grid/Column.php

@@ -5,6 +5,7 @@
  */
 namespace Magento\Backend\Block\Widget\Grid;
 
+use Magento\Backend\Block\Widget;
 use Magento\Backend\Block\Widget\Grid\Column\Filter\AbstractFilter;
 
 /**
@@ -14,7 +15,7 @@
  * @deprecated 100.2.0 in favour of UI component implementation
  * @since 100.0.2
  */
-class Column extends \Magento\Backend\Block\Widget
+class Column extends Widget
 {
     /**
      * Parent grid
@@ -289,12 +290,30 @@ public function getRowField(\Magento\Framework\DataObject $row)
          */
         $frameCallback = $this->getFrameCallback();
         if (is_array($frameCallback)) {
+            $this->validateFrameCallback($frameCallback);
             $renderedValue = call_user_func($frameCallback, $renderedValue, $row, $this, false);
         }
 
         return $renderedValue;
     }
 
+    /**
+     * Validate frame callback
+     *
+     * @throws \InvalidArgumentException
+     *
+     * @param array $callback
+     * @return void
+     */
+    private function validateFrameCallback(array $callback)
+    {
+        if (!is_object($callback[0]) || !$callback[0] instanceof Widget) {
+            throw new \InvalidArgumentException(
+                "Frame callback host must be instance of Magento\\Backend\\Block\\Widget"
+            );
+        }
+    }
+
     /**
      * Retrieve row column field value for export
      *
@@ -314,6 +333,7 @@ public function getRowFieldExport(\Magento\Framework\DataObject $row)
          */
         $frameCallback = $this->getFrameCallback();
         if (is_array($frameCallback)) {
+            $this->validateFrameCallback($frameCallback);
             $renderedValue = call_user_func($frameCallback, $renderedValue, $row, $this, true);
         }
 

app/code/Magento/Backend/Controller/Adminhtml/Ajax/Translate.php

@@ -20,6 +20,11 @@ class Translate extends \Magento\Backend\App\Action
      */
     protected $resultJsonFactory;
 
+    /**
+     * Authorization level of a basic admin session
+     */
+    const ADMIN_RESOURCE = 'Magento_Backend::content_translation';
+
     /**
      * @param Action\Context $context
      * @param \Magento\Framework\Translate\Inline\ParserInterface $inlineParser

app/code/Magento/Backend/Controller/Adminhtml/Noroute/Index.php

@@ -39,4 +39,14 @@ public function execute()
         $resultPage->addHandle('adminhtml_noroute');
         return $resultPage;
     }
+
+    /**
+     * Error page should be public accessible. Do not check keys to avoid redirect loop
+     *
+     * @return bool
+     */
+    protected function _validateSecretKey()
+    {
+        return true;
+    }
 }

app/code/Magento/Backend/Model/Search/Config.php

@@ -0,0 +1,116 @@
+<?php
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+namespace Magento\Backend\Model\Search;
+
+use Magento\Backend\Model\Search\Config\Result\Builder;
+use Magento\Config\Model\Config\Structure;
+use Magento\Config\Model\Config\Structure\Element\AbstractComposite;
+use Magento\Config\Model\Config\Structure\Element\Iterator as ElementIterator;
+
+/**
+ * Search Config Model
+ */
+class Config extends \Magento\Framework\DataObject
+{
+    /**
+     * @var \Magento\Framework\App\Config\ConfigTypeInterface
+     */
+    private $configStructure;
+
+    /**
+     * @var Builder
+     */
+    private $resultBuilder;
+
+    /**
+     * @param Structure $configStructure
+     * @param Builder $resultBuilder
+     */
+    public function __construct(Structure $configStructure, Builder $resultBuilder)
+    {
+        $this->configStructure = $configStructure;
+        $this->resultBuilder = $resultBuilder;
+    }
+
+    /**
+     * @param string $query
+     * @return $this
+     */
+    public function setQuery($query)
+    {
+        $this->setData('query', $query);
+        return $this;
+    }
+
+    /**
+     * @return string|null
+     */
+    public function getQuery()
+    {
+        return $this->getData('query');
+    }
+
+    /**
+     * @return bool
+     */
+    public function hasQuery()
+    {
+        return $this->hasData('query');
+    }
+
+    /**
+     * @param array $results
+     * @return $this
+     */
+    public function setResults(array $results)
+    {
+        $this->setData('results', $results);
+        return $this;
+    }
+
+    /**
+     * @return array|null
+     */
+    public function getResults()
+    {
+        return $this->getData('results');
+    }
+
+    /**
+     * Load search results
+     *
+     * @return $this
+     */
+    public function load()
+    {
+        $this->findInStructure($this->configStructure->getTabs(), $this->getQuery());
+        $this->setResults($this->resultBuilder->getAll());
+        return $this;
+    }
+
+    /**
+     * @param ElementIterator $structureElementIterator
+     * @param string $searchTerm
+     * @param string $pathLabel
+     * @return void
+     * @SuppressWarnings(PHPMD.LongVariable)
+     */
+    private function findInStructure(ElementIterator $structureElementIterator, $searchTerm, $pathLabel = '')
+    {
+        if (empty($searchTerm)) {
+            return;
+        }
+        foreach ($structureElementIterator as $structureElement) {
+            if (mb_stripos((string)$structureElement->getLabel(), $searchTerm) !== false) {
+                $this->resultBuilder->add($structureElement, $pathLabel);
+            }
+            $elementPathLabel = $pathLabel . ' / ' . $structureElement->getLabel();
+            if ($structureElement instanceof AbstractComposite && $structureElement->hasChildren()) {
+                $this->findInStructure($structureElement->getChildren(), $searchTerm, $elementPathLabel);
+            }
+        }
+    }
+}