Skip to content

Commit f40f24c

Browse files
author
Joan He
committed
MAGETWO-99282: Eliminate @escapeNotVerified in Magento_Catalog module
1 parent 211dd25 commit f40f24c

File tree

118 files changed

+2090
-1961
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

118 files changed

+2090
-1961
lines changed

‎app/code/Magento/Catalog/Block/Adminhtml/Product/Edit/AttributeSet.php

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -42,12 +42,14 @@ public function __construct(
4242
public function getSelectorOptions()
4343
{
4444
return [
45-
'source' => $this->getUrl('catalog/product/suggestAttributeSets'),
45+
'source' => $this->escapeUrl($this->getUrl('catalog/product/suggestAttributeSets')),
4646
'className' => 'category-select',
4747
'showRecent' => true,
4848
'storageKey' => 'product-template-key',
4949
'minLength' => 0,
50-
'currentlySelected' => $this->_coreRegistry->registry('product')->getAttributeSetId()
50+
'currentlySelected' => $this->escapeHtml(
51+
$this->_coreRegistry->registry('product')->getAttributeSetId()
52+
)
5153
];
5254
}
5355
}

‎app/code/Magento/Catalog/Block/Adminhtml/Product/Edit/Tab/Attributes/Search.php

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -68,7 +68,7 @@ public function getSelectorOptions()
6868
{
6969
$templateId = $this->_coreRegistry->registry('product')->getAttributeSetId();
7070
return [
71-
'source' => $this->getUrl('catalog/product/suggestAttributes'),
71+
'source' => $this->escapeUrl($this->getUrl('catalog/product/suggestAttributes')),
7272
'minLength' => 0,
7373
'ajaxOptions' => ['data' => ['template_id' => $templateId]],
7474
'template' => '[data-template-for="product-attribute-search-' . $this->getGroupId() . '"]',

‎app/code/Magento/Catalog/Block/Product/Gallery.php

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -115,7 +115,7 @@ public function getImageWidth()
115115
if ($size[0] > 600) {
116116
return 600;
117117
} else {
118-
return $size[0];
118+
return (int) $size[0];
119119
}
120120
}
121121
}

‎app/code/Magento/Catalog/Block/Product/ListProduct.php

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -373,7 +373,7 @@ public function getAddToCartPostParams(Product $product)
373373
return [
374374
'action' => $url,
375375
'data' => [
376-
'product' => $product->getEntityId(),
376+
'product' => (int) $product->getEntityId(),
377377
ActionInterface::PARAM_NAME_URL_ENCODED => $this->urlHelper->getEncodedUrl($url),
378378
]
379379
];

‎app/code/Magento/Catalog/Block/Product/View.php

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -189,22 +189,22 @@ public function getJsonConfig()
189189
$tierPrices = [];
190190
$tierPricesList = $product->getPriceInfo()->getPrice('tier_price')->getTierPriceList();
191191
foreach ($tierPricesList as $tierPrice) {
192-
$tierPrices[] = $tierPrice['price']->getValue();
192+
$tierPrices[] = $tierPrice['price']->getValue() * 1;
193193
}
194194
$config = [
195-
'productId' => $product->getId(),
195+
'productId' => (int)$product->getId(),
196196
'priceFormat' => $this->_localeFormat->getPriceFormat(),
197197
'prices' => [
198198
'oldPrice' => [
199-
'amount' => $product->getPriceInfo()->getPrice('regular_price')->getAmount()->getValue(),
199+
'amount' => $product->getPriceInfo()->getPrice('regular_price')->getAmount()->getValue() * 1,
200200
'adjustments' => []
201201
],
202202
'basePrice' => [
203-
'amount' => $product->getPriceInfo()->getPrice('final_price')->getAmount()->getBaseAmount(),
203+
'amount' => $product->getPriceInfo()->getPrice('final_price')->getAmount()->getBaseAmount() * 1,
204204
'adjustments' => []
205205
],
206206
'finalPrice' => [
207-
'amount' => $product->getPriceInfo()->getPrice('final_price')->getAmount()->getValue(),
207+
'amount' => $product->getPriceInfo()->getPrice('final_price')->getAmount()->getValue() * 1,
208208
'adjustments' => []
209209
]
210210
],

‎app/code/Magento/Catalog/Block/Product/View/Gallery.php

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -114,7 +114,7 @@ public function getGalleryImages()
114114
*/
115115
public function getMagnifier()
116116
{
117-
return $this->jsonEncoder->encode($this->getVar('magnifier'));
117+
return $this->jsonEncoder->encode($this->escapeJs($this->getVar('magnifier')));
118118
}
119119

120120
/**

‎app/code/Magento/Catalog/view/adminhtml/templates/catalog/category/checkboxes/tree.phtml

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,6 @@
44
* See COPYING.txt for license details.
55
*/
66

7-
// @codingStandardsIgnoreFile
87
/**
98
* @var $block \Magento\Catalog\Block\Adminhtml\Category\Tree
109
*/

‎app/code/Magento/Catalog/view/adminhtml/templates/catalog/category/edit.phtml

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -5,18 +5,18 @@
55
*/
66

77
/**
8-
* Template for \Magento\Catalog\Block\Adminhtml\Category\Edit
8+
* @var $block \Magento\Catalog\Block\Adminhtml\Category\Edit
99
*/
1010
?>
1111
<div data-id="information-dialog-category" class="messages" style="display: none;">
1212
<div class="message message-notice">
13-
<div><?= /* @escapeNotVerified */ __('This operation can take a long time') ?></div>
13+
<div><?= $block->escapeHtml(__('This operation can take a long time')) ?></div>
1414
</div>
1515
</div>
1616
<script type="text/x-magento-init">
1717
{
1818
"*": {
19-
"categoryForm": {"refreshUrl": "<?= /* @escapeNotVerified */ $block->getRefreshPathUrl() ?>"}
19+
"categoryForm": {"refreshUrl": "<?= $block->escapeJs($block->escapeUrl($block->getRefreshPathUrl())) ?>"}
2020
}
2121
}
2222
</script>

‎app/code/Magento/Catalog/view/adminhtml/templates/catalog/category/edit/assign_products.phtml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -16,8 +16,8 @@ $gridJsObjectName = $blockGrid->getJsObjectName();
1616
{
1717
"*": {
1818
"Magento_Catalog/catalog/category/assign-products": {
19-
"selectedProducts": <?= /* @escapeNotVerified */ $block->getProductsJson() ?>,
20-
"gridJsObjectName": <?= /* @escapeNotVerified */ '"' . $gridJsObjectName . '"' ?: '{}' ?>
19+
"selectedProducts": <?= /* @noEscape */ $block->getProductsJson() ?>,
20+
"gridJsObjectName": <?= /* @noEscape */ '"' . $gridJsObjectName . '"' ?: '{}' ?>
2121
}
2222
}
2323
}

‎app/code/Magento/Catalog/view/adminhtml/templates/catalog/category/tree.phtml

Lines changed: 23 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -4,35 +4,34 @@
44
* See COPYING.txt for license details.
55
*/
66

7-
// @codingStandardsIgnoreFile
8-
7+
/** @var $block \Magento\Catalog\Block\Adminhtml\Category\Tree */
98
?>
109
<div class="categories-side-col">
1110
<div class="sidebar-actions">
12-
<?php if ($block->getRoot()): ?>
11+
<?php if ($block->getRoot()) :?>
1312
<?= $block->getAddRootButtonHtml() ?><br/>
1413
<?= $block->getAddSubButtonHtml() ?>
1514
<?php endif; ?>
1615
</div>
1716
<div class="tree-actions">
18-
<?php if ($block->getRoot()): ?>
17+
<?php if ($block->getRoot()) :?>
1918
<?php //echo $block->getCollapseButtonHtml() ?>
2019
<?php //echo $block->getExpandButtonHtml() ?>
2120
<a href="#"
22-
onclick="tree.collapseTree(); return false;"><?= /* @escapeNotVerified */ __('Collapse All') ?></a>
21+
onclick="tree.collapseTree(); return false;"><?= $block->escapeHtml(__('Collapse All')) ?></a>
2322
<span class="separator">|</span> <a href="#"
24-
onclick="tree.expandTree(); return false;"><?= /* @escapeNotVerified */ __('Expand All') ?></a>
23+
onclick="tree.expandTree(); return false;"><?= $block->escapeHtml(_('Expand All')) ?></a>
2524
<?php endif; ?>
2625
</div>
27-
<?php if ($block->getRoot()): ?>
26+
<?php if ($block->getRoot()) :?>
2827
<div class="tree-holder">
2928
<div id="tree-div" class="tree-wrapper"></div>
3029
</div>
3130
</div>
3231

3332
<div data-id="information-dialog-tree" class="messages" style="display: none;">
3433
<div class="message message-notice">
35-
<div><?= /* @escapeNotVerified */ __('This operation can take a long time') ?></div>
34+
<div><?= $block->escapeHtml(__('This operation can take a long time')) ?></div>
3635
</div>
3736
</div>
3837
<script>
@@ -172,7 +171,7 @@
172171

173172
if (!this.collapsed) {
174173
this.collapsed = true;
175-
this.loader.dataUrl = '<?= /* @escapeNotVerified */ $block->getLoadTreeUrl(false) ?>';
174+
this.loader.dataUrl = '<?= $block->escapeJs($block->escapeUrl($block->getLoadTreeUrl(false))) ?>';
176175
this.request(this.loader.dataUrl, false);
177176
}
178177
},
@@ -181,7 +180,7 @@
181180
this.expandAll();
182181
if (this.collapsed) {
183182
this.collapsed = false;
184-
this.loader.dataUrl = '<?= /* @escapeNotVerified */ $block->getLoadTreeUrl(true) ?>';
183+
this.loader.dataUrl = '<?= $block->escapeJs($block->escapeUrl($block->getLoadTreeUrl(true))) ?>';
185184
this.request(this.loader.dataUrl, false);
186185
}
187186
},
@@ -216,7 +215,7 @@
216215
if (tree && switcherParams) {
217216
var url;
218217
if (switcherParams.useConfirm) {
219-
if (!confirm("<?= /* @escapeNotVerified */ __('Please confirm site switching. All data that hasn\'t been saved will be lost.') ?>")) {
218+
if (!confirm("<?= $block->escapeJs(__('Please confirm site switching. All data that hasn\'t been saved will be lost.')) ?>")) {
220219
return false;
221220
}
222221
}
@@ -259,7 +258,7 @@
259258
}
260259
});
261260
} else {
262-
var baseUrl = '<?= /* @escapeNotVerified */ $block->getEditUrl() ?>';
261+
var baseUrl = '<?= $block->escapeJs($block->escapeUrl($block->getEditUrl())) ?>';
263262
var urlExt = switcherParams.scopeParams + 'id/' + tree.currentNodeId + '/';
264263
url = parseSidUrl(baseUrl, urlExt);
265264
setLocation(url);
@@ -296,7 +295,7 @@
296295
if (scopeParams) {
297296
url = url + scopeParams;
298297
}
299-
<?php if ($block->isClearEdit()): ?>
298+
<?php if ($block->isClearEdit()) :?>
300299
if (selectedNode) {
301300
url = url + 'id/' + config.parameters.category_id;
302301
}
@@ -307,7 +306,7 @@
307306

308307
jQuery(function () {
309308
categoryLoader = new Ext.tree.TreeLoader({
310-
dataUrl: '<?= /* @escapeNotVerified */ $block->getLoadTreeUrl() ?>'
309+
dataUrl: '<?= $block->escapeJs($block->escapeUrl($block->getLoadTreeUrl())) ?>'
311310
});
312311

313312
categoryLoader.processResponse = function (response, parent, callback) {
@@ -389,26 +388,26 @@
389388
enableDD: true,
390389
containerScroll: true,
391390
selModel: new Ext.tree.CheckNodeMultiSelectionModel(),
392-
rootVisible: '<?= /* @escapeNotVerified */ $block->getRoot()->getIsVisible() ?>',
393-
useAjax: <?= /* @escapeNotVerified */ $block->getUseAjax() ?>,
394-
switchTreeUrl: '<?= /* @escapeNotVerified */ $block->getSwitchTreeUrl() ?>',
395-
editUrl: '<?= /* @escapeNotVerified */ $block->getEditUrl() ?>',
396-
currentNodeId: <?= /* @escapeNotVerified */ (int)$block->getCategoryId() ?>,
397-
baseUrl: '<?= /* @escapeNotVerified */ $block->getEditUrl() ?>'
391+
rootVisible: '<?= (bool)$block->getRoot()->getIsVisible() ?>',
392+
useAjax: <?= (bool)$block->getUseAjax() ?>,
393+
switchTreeUrl: '<?= $block->escapeJs($block->escapeUrl($block->getSwitchTreeUrl())) ?>',
394+
editUrl: '<?= $block->escapeJs($block->escapeUrl($block->getEditUrl())) ?>',
395+
currentNodeId: <?= (int)$block->getCategoryId() ?>,
396+
baseUrl: '<?= $block->escapeJs($block->escapeUrl($block->getEditUrl())) ?>'
398397
};
399398

400399
defaultLoadTreeParams = {
401400
parameters: {
402-
text: <?= /* @escapeNotVerified */ json_encode(htmlentities($block->getRoot()->getName())) ?>,
401+
text: <?= /* @noEscape */ json_encode(htmlentities($block->getRoot()->getName())) ?>,
403402
draggable: false,
404-
allowDrop: <?php if ($block->getRoot()->getIsVisible()): ?>true<?php else : ?>false<?php endif; ?>,
403+
allowDrop: <?php if ($block->getRoot()->getIsVisible()) :?>true<?php else :?>false<?php endif; ?>,
405404
id: <?= (int)$block->getRoot()->getId() ?>,
406405
expanded: <?= (int)$block->getIsWasExpanded() ?>,
407406
store_id: <?= (int)$block->getStore()->getId() ?>,
408407
category_id: <?= (int)$block->getCategoryId() ?>,
409408
parent: <?= (int)$block->getRequest()->getParam('parent') ?>
410409
},
411-
data: <?= /* @escapeNotVerified */ $block->getTreeJson() ?>
410+
data: <?= /* @noEscape */ $block->getTreeJson() ?>
412411
};
413412

414413
reRenderTree();
@@ -486,7 +485,7 @@
486485
click: function () {
487486
(function ($) {
488487
$.ajax({
489-
url: '<?= /* @escapeNotVerified */ $block->getMoveUrl() ?>',
488+
url: '<?= $block->escapeJs($block->escapeUrl($block->getMoveUrl())) ?>',
490489
method: 'POST',
491490
data: registry.get('pd'),
492491
showLoader: true

0 commit comments

Comments
 (0)