Skip to content

Commit f34ad6b

Browse files
zakdmazakdma
committed
MAGETWO-72041: Information Disclosure - Credit Card details & customer passwords compromise by non-admin user
1 parent ff6c326 commit f34ad6b

File tree

14 files changed

+717
-96
lines changed

14 files changed

+717
-96
lines changed

‎app/code/Magento/Customer/Block/Address/Edit.php

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -129,7 +129,7 @@ protected function _prepareLayout()
129129

130130
if ($postedData = $this->_customerSession->getAddressFormData(true)) {
131131
$postedData['region'] = [
132-
'region_id' => $postedData['region_id'],
132+
'region_id' => isset($postedData['region_id']) ? $postedData['region_id'] : null,
133133
'region' => $postedData['region'],
134134
];
135135
$this->dataObjectHelper->populateWithArray(

‎app/code/Magento/Customer/Model/Address/AbstractAddress.php

Lines changed: 14 additions & 67 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,7 @@
1212
use Magento\Customer\Api\Data\RegionInterface;
1313
use Magento\Customer\Api\Data\RegionInterfaceFactory;
1414
use Magento\Customer\Model\Data\Address as AddressData;
15+
use Magento\Framework\App\ObjectManager;
1516
use Magento\Framework\Model\AbstractExtensibleModel;
1617

1718
/**
@@ -118,6 +119,9 @@ class AbstractAddress extends AbstractExtensibleModel implements AddressModelInt
118119
*/
119120
protected $dataObjectHelper;
120121

122+
/** @var CompositeValidator */
123+
private $compositeValidator;
124+
121125
/**
122126
* @param \Magento\Framework\Model\Context $context
123127
* @param \Magento\Framework\Registry $registry
@@ -135,6 +139,8 @@ class AbstractAddress extends AbstractExtensibleModel implements AddressModelInt
135139
* @param \Magento\Framework\Model\ResourceModel\AbstractResource $resource
136140
* @param \Magento\Framework\Data\Collection\AbstractDb $resourceCollection
137141
* @param array $data
142+
* @param CompositeValidator $compositeValidator
143+
*
138144
* @SuppressWarnings(PHPMD.ExcessiveParameterList)
139145
*/
140146
public function __construct(
@@ -153,7 +159,8 @@ public function __construct(
153159
\Magento\Framework\Api\DataObjectHelper $dataObjectHelper,
154160
\Magento\Framework\Model\ResourceModel\AbstractResource $resource = null,
155161
\Magento\Framework\Data\Collection\AbstractDb $resourceCollection = null,
156-
array $data = []
162+
array $data = [],
163+
CompositeValidator $compositeValidator = null
157164
) {
158165
$this->_directoryData = $directoryData;
159166
$data = $this->_implodeArrayField($data);
@@ -165,6 +172,8 @@ public function __construct(
165172
$this->addressDataFactory = $addressDataFactory;
166173
$this->regionDataFactory = $regionDataFactory;
167174
$this->dataObjectHelper = $dataObjectHelper;
175+
$this->compositeValidator = $compositeValidator ?: ObjectManager::getInstance()
176+
->get(CompositeValidator::class);
168177
parent::__construct(
169178
$context,
170179
$registry,
@@ -562,84 +571,22 @@ public function getDataModel($defaultBillingAddressId = null, $defaultShippingAd
562571
}
563572

564573
/**
565-
* Validate address attribute values
566-
*
567-
*
574+
* Validate address attribute values.
568575
*
569-
* @return bool|array
570-
* @SuppressWarnings(PHPMD.CyclomaticComplexity)
571-
* @SuppressWarnings(PHPMD.NPathComplexity)
576+
* @return array|bool
572577
*/
573578
public function validate()
574579
{
575580
if ($this->getShouldIgnoreValidation()) {
576581
return true;
577582
}
578-
579-
$errors = [];
580-
if (!\Zend_Validate::is($this->getFirstname(), 'NotEmpty')) {
581-
$errors[] = __('"%fieldName" is required. Enter and try again.', ['fieldName' => 'firstname']);
582-
}
583-
584-
if (!\Zend_Validate::is($this->getLastname(), 'NotEmpty')) {
585-
$errors[] = __('"%fieldName" is required. Enter and try again.', ['fieldName' => 'lastname']);
586-
}
587-
588-
if (!\Zend_Validate::is($this->getStreetLine(1), 'NotEmpty')) {
589-
$errors[] = __('"%fieldName" is required. Enter and try again.', ['fieldName' => 'street']);
590-
}
591583

592-
if (!\Zend_Validate::is($this->getCity(), 'NotEmpty')) {
593-
$errors[] = __('"%fieldName" is required. Enter and try again.', ['fieldName' => 'city']);
594-
}
595-
596-
if ($this->isTelephoneRequired()) {
597-
if (!\Zend_Validate::is($this->getTelephone(), 'NotEmpty')) {
598-
$errors[] = __('"%fieldName" is required. Enter and try again.', ['fieldName' => 'telephone']);
599-
}
600-
}
601-
602-
if ($this->isFaxRequired()) {
603-
if (!\Zend_Validate::is($this->getFax(), 'NotEmpty')) {
604-
$errors[] = __('"%fieldName" is required. Enter and try again.', ['fieldName' => 'fax']);
605-
}
606-
}
607-
608-
if ($this->isCompanyRequired()) {
609-
if (!\Zend_Validate::is($this->getCompany(), 'NotEmpty')) {
610-
$errors[] = __('"%fieldName" is required. Enter and try again.', ['fieldName' => 'company']);
611-
}
612-
}
613-
614-
$_havingOptionalZip = $this->_directoryData->getCountriesWithOptionalZip();
615-
if (!in_array(
616-
$this->getCountryId(),
617-
$_havingOptionalZip
618-
) && !\Zend_Validate::is(
619-
$this->getPostcode(),
620-
'NotEmpty'
621-
)
622-
) {
623-
$errors[] = __('"%fieldName" is required. Enter and try again.', ['fieldName' => 'postcode']);
624-
}
625-
626-
if (!\Zend_Validate::is($this->getCountryId(), 'NotEmpty')) {
627-
$errors[] = __('"%fieldName" is required. Enter and try again.', ['fieldName' => 'countryId']);
628-
}
629-
630-
if ($this->getCountryModel()->getRegionCollection()->getSize() && !\Zend_Validate::is(
631-
$this->getRegionId(),
632-
'NotEmpty'
633-
) && $this->_directoryData->isRegionRequired(
634-
$this->getCountryId()
635-
)
636-
) {
637-
$errors[] = __('"%fieldName" is required. Enter and try again.', ['fieldName' => 'regionId']);
638-
}
584+
$errors = $this->compositeValidator->validate($this);
639585

640586
if (empty($errors)) {
641587
return true;
642588
}
589+
643590
return $errors;
644591
}
645592

‎app/code/Magento/Customer/Model/Address/CompositeValidator.php

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
<?php
2+
/**
3+
* Copyright © Magento, Inc. All rights reserved.
4+
* See COPYING.txt for license details.
5+
*/
6+
7+
namespace Magento\Customer\Model\Address;
8+
9+
/**
10+
* Address composite validator.
11+
*/
12+
class CompositeValidator implements ValidatorInterface
13+
{
14+
/**
15+
* @var ValidatorInterface[]
16+
*/
17+
private $validators;
18+
19+
/**
20+
* @param array $validators
21+
*/
22+
public function __construct(
23+
array $validators = []
24+
) {
25+
$this->validators = $validators;
26+
}
27+
28+
/**
29+
* @inheritdoc
30+
*/
31+
public function validate(AbstractAddress $address)
32+
{
33+
$errors = [];
34+
foreach ($this->validators as $validator) {
35+
$errors = array_merge($errors, $validator->validate($address));
36+
}
37+
38+
return $errors;
39+
}
40+
}

‎app/code/Magento/Customer/Model/Address/Validator/Country.php

Lines changed: 106 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,106 @@
1+
<?php
2+
/**
3+
* Copyright © Magento, Inc. All rights reserved.
4+
* See COPYING.txt for license details.
5+
*/
6+
namespace Magento\Customer\Model\Address\Validator;
7+
8+
use Magento\Customer\Model\Address\AbstractAddress;
9+
use Magento\Customer\Model\Address\ValidatorInterface;
10+
11+
/**
12+
* Address country and region validator.
13+
*/
14+
class Country implements ValidatorInterface
15+
{
16+
/**
17+
* @var \Magento\Directory\Helper\Data
18+
*/
19+
private $directoryData;
20+
21+
/**
22+
* @param \Magento\Directory\Helper\Data $directoryData
23+
*/
24+
public function __construct(
25+
\Magento\Directory\Helper\Data $directoryData
26+
) {
27+
$this->directoryData = $directoryData;
28+
}
29+
30+
/**
31+
* @inheritdoc
32+
*/
33+
public function validate(AbstractAddress $address)
34+
{
35+
$errors = $this->validateCountry($address);
36+
if (empty($errors)) {
37+
$errors = $this->validateRegion($address);
38+
}
39+
40+
return $errors;
41+
}
42+
43+
/**
44+
* Validate country existence.
45+
*
46+
* @param AbstractAddress $address
47+
* @return array
48+
*/
49+
private function validateCountry(AbstractAddress $address)
50+
{
51+
$countryId = $address->getCountryId();
52+
$errors = [];
53+
if (!\Zend_Validate::is($countryId, 'NotEmpty')) {
54+
$errors[] = __('"%fieldName" is required. Enter and try again.', ['fieldName' => 'countryId']);
55+
} elseif (!in_array($countryId, $this->directoryData->getCountryCollection()->getAllIds(), true)) {
56+
//Checking if such country exists.
57+
$errors[] = __(
58+
'Invalid value of "%value" provided for the %fieldName field.',
59+
[
60+
'fieldName' => 'countryId',
61+
'value' => htmlspecialchars($countryId),
62+
]
63+
);
64+
}
65+
66+
return $errors;
67+
}
68+
69+
/**
70+
* Validate region existence.
71+
*
72+
* @param AbstractAddress $address
73+
* @return array
74+
*/
75+
private function validateRegion(AbstractAddress $address)
76+
{
77+
$errors = [];
78+
$countryId = $address->getCountryId();
79+
$countryModel = $address->getCountryModel();
80+
$regionCollection = $countryModel->getRegionCollection();
81+
$region = $address->getRegion();
82+
$regionId = (string)$address->getRegionId();
83+
$allowedRegions = $regionCollection->getAllIds();
84+
$isRegionRequired = $this->directoryData->isRegionRequired($countryId);
85+
if ($isRegionRequired && empty($allowedRegions) && !\Zend_Validate::is($region, 'NotEmpty')) {
86+
//If region is required for country and country doesn't provide regions list
87+
//region must be provided.
88+
$errors[] = __('"%fieldName" is required. Enter and try again.', ['fieldName' => 'region']);
89+
} elseif ($allowedRegions && !\Zend_Validate::is($regionId, 'NotEmpty') && $isRegionRequired) {
90+
//If country actually has regions and requires you to
91+
//select one then it must be selected.
92+
$errors[] = __('"%fieldName" is required. Enter and try again.', ['fieldName' => 'regionId']);
93+
} elseif ($regionId && !in_array($regionId, $allowedRegions, true)) {
94+
//If a region is selected then checking if it exists.
95+
$errors[] = __(
96+
'Invalid value of "%value" provided for the %fieldName field.',
97+
[
98+
'fieldName' => 'regionId',
99+
'value' => htmlspecialchars($regionId),
100+
]
101+
);
102+
}
103+
104+
return $errors;
105+
}
106+
}

0 commit comments

Comments
 (0)