Merge remote-tracking branch 'origin/2.3.6-develop-pr133' into 2.3.6-develop-pr133

Author: zakdma

dev/tests/integration/testsuite/Magento/Customer/Model/AccountManagementTest.php

@@ -15,7 +15,6 @@
 use Magento\Framework\Reflection\DataObjectProcessor;
 use Magento\Framework\Session\SessionManagerInterface;
 use Magento\Framework\Url as UrlBuilder;
-use Magento\Framework\Session\SessionManagerInterface;
 use Magento\Store\Model\StoreManagerInterface;
 use Magento\TestFramework\Helper\Bootstrap;
 

dev/tests/integration/testsuite/Magento/Framework/Filter/VariableResolver/LegacyResolverTest.php

@@ -117,6 +117,7 @@ public function getThing()
                 ['foo' => $dataClassStub, 'g' => ['h' => ['i' => 'abc']]],
                 'abca=123,b=321,'
             ],
+            'disallow __callParent method' => ['foo.___callParent()',['foo' => $classStub], null],
         ];
     }
 }

lib/internal/Magento/Framework/Filter/VariableResolver/LegacyResolver.php

@@ -160,12 +160,31 @@ private function handleObjectMethod(Template $filter, array $templateVariables,
     {
         $object = $stackArgs[$i - 1]['variable'];
         $method = $stackArgs[$i]['name'];
-        if (method_exists($object, $method) && substr($method, 0, 3) !== 'set') {
+        if ($this->isMethodCallable($object, $method)) {
             $args = $this->getStackArgs($stackArgs[$i]['args'], $filter, $templateVariables);
             $stackArgs[$i]['variable'] = call_user_func_array([$object, $method], $args);
         }
     }
 
+    /**
+     * Check if object method can be called.
+     *
+     * @param mixed $object
+     * @param string $method
+     * @return bool
+     */
+    private function isMethodCallable($object, string $method): bool
+    {
+        if (method_exists($object, $method)
+            && substr($method, 0, 3) !== 'set'
+            && $method !== '___callParent'
+        ) {
+            return true;
+        }
+
+        return false;
+    }
+
     /**
      * Return if the given index should be processed for data access
      *