Skip to content

Commit ff97b7e

Browse files
pawan-adobe-securitypawan-adobe-security
committed
Merge branch '2.4.8-beta1-develop' into cia-2.4.8-beta1-develop-bugfix-07032024
2 parents 4d7f78a + 9ae6c5d commit ff97b7e

File tree

22 files changed

+135
-59
lines changed

22 files changed

+135
-59
lines changed

‎app/code/Magento/Catalog/Model/Product/Option/Type/File/ValidatorInfo.php

Lines changed: 7 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -49,6 +49,7 @@ class ValidatorInfo extends Validator
4949
* @var IoFile
5050
*/
5151
private $ioFile;
52+
5253
/**
5354
* @var NotProtectedExtension
5455
*/
@@ -147,12 +148,14 @@ private function validatePath(array $optionValuePath): bool
147148
{
148149
foreach ([$optionValuePath['quote_path'], $optionValuePath['order_path']] as $path) {
149150
$pathInfo = $this->ioFile->getPathInfo($path);
150-
if (isset($pathInfo['extension'])) {
151-
if (!$this->fileValidator->isValid($pathInfo['extension'])) {
152-
return false;
153-
}
151+
152+
if (isset($pathInfo['extension'])
153+
&& (empty($pathInfo['extension']) || !$this->fileValidator->isValid($pathInfo['extension']))
154+
) {
155+
return false;
154156
}
155157
}
158+
156159
return true;
157160
}
158161

‎app/code/Magento/Newsletter/Controller/Adminhtml/Queue.php

Lines changed: 12 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -18,5 +18,16 @@ abstract class Queue extends \Magento\Backend\App\Action
1818
*
1919
* @see _isAllowed()
2020
*/
21-
const ADMIN_RESOURCE = 'Magento_Newsletter::queue';
21+
public const ADMIN_RESOURCE = 'Magento_Newsletter::queue';
22+
23+
/**
24+
* Checks the acl permission
25+
*
26+
* @return bool
27+
*/
28+
protected function _isAllowed()
29+
{
30+
return ($this->_authorization->isAllowed(self::ADMIN_RESOURCE) &&
31+
$this->_authorization->isAllowed('Magento_Newsletter::template'));
32+
}
2233
}

‎app/code/Magento/Reports/Controller/Adminhtml/Report/Sales.php

Lines changed: 20 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@
33
* Copyright © Magento, Inc. All rights reserved.
44
* See COPYING.txt for license details.
55
*/
6+
declare(strict_types=1);
67

78
/**
89
* Sales report admin controller
@@ -13,6 +14,7 @@
1314

1415
/**
1516
* @SuppressWarnings(PHPMD.NumberOfChildren)
17+
* phpcs:disable Magento2.Classes.AbstractApi
1618
* @api
1719
* @since 100.0.2
1820
*/
@@ -37,31 +39,23 @@ public function _initAction()
3739
*/
3840
protected function _isAllowed()
3941
{
40-
switch ($this->getRequest()->getActionName()) {
41-
case 'sales':
42-
return $this->_authorization->isAllowed('Magento_Reports::salesroot_sales');
43-
break;
44-
case 'tax':
45-
return $this->_authorization->isAllowed('Magento_Reports::tax');
46-
break;
47-
case 'shipping':
48-
return $this->_authorization->isAllowed('Magento_Reports::shipping');
49-
break;
50-
case 'invoiced':
51-
return $this->_authorization->isAllowed('Magento_Reports::invoiced');
52-
break;
53-
case 'refunded':
54-
return $this->_authorization->isAllowed('Magento_Reports::refunded');
55-
break;
56-
case 'coupons':
57-
return $this->_authorization->isAllowed('Magento_Reports::coupons');
58-
break;
59-
case 'bestsellers':
60-
return $this->_authorization->isAllowed('Magento_Reports::bestsellers');
61-
break;
62-
default:
63-
return $this->_authorization->isAllowed('Magento_Reports::salesroot');
64-
break;
65-
}
42+
return match (strtolower($this->getRequest()->getActionName())) {
43+
'exportsalescsv', 'exportsalesexcel', 'sales' =>
44+
$this->_authorization->isAllowed('Magento_Reports::salesroot_sales'),
45+
'exporttaxcsv', 'exporttaxexcel', 'tax' =>
46+
$this->_authorization->isAllowed('Magento_Reports::tax'),
47+
'exportshippingcsv', 'exportshippingexcel', 'shipping' =>
48+
$this->_authorization->isAllowed('Magento_Reports::shipping'),
49+
'exportinvoicedcsv', 'exportinvoicedexcel', 'invoiced' =>
50+
$this->_authorization->isAllowed('Magento_Reports::invoiced'),
51+
'exportrefundedcsv', 'exportrefundedexcel', 'refunded' =>
52+
$this->_authorization->isAllowed('Magento_Reports::refunded'),
53+
'exportcouponscsv', 'exportcouponsexcel', 'coupons' =>
54+
$this->_authorization->isAllowed('Magento_Reports::coupons'),
55+
'exportbestsellerscsv', 'exportbestsellersexcel', 'bestsellers' =>
56+
$this->_authorization->isAllowed('Magento_Reports::bestsellers'),
57+
default =>
58+
$this->_authorization->isAllowed('Magento_Reports::salesroot'),
59+
};
6660
}
6761
}

‎app/code/Magento/Sales/Block/Adminhtml/Order/View.php

Lines changed: 1 addition & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -16,29 +16,21 @@
1616
class View extends \Magento\Backend\Block\Widget\Form\Container
1717
{
1818
/**
19-
* Block group
20-
*
2119
* @var string
2220
*/
2321
protected $_blockGroup = 'Magento_Sales';
2422

2523
/**
26-
* Core registry
27-
*
2824
* @var \Magento\Framework\Registry
2925
*/
3026
protected $_coreRegistry = null;
3127

3228
/**
33-
* Sales config
34-
*
3529
* @var \Magento\Sales\Model\Config
3630
*/
3731
protected $_salesConfig;
3832

3933
/**
40-
* Reorder helper
41-
*
4234
* @var \Magento\Sales\Helper\Reorder
4335
*/
4436
protected $_reorderHelper;
@@ -121,7 +113,7 @@ protected function _construct()
121113
);
122114
}
123115

124-
if ($this->_isAllowedAction('Magento_Sales::emails') && !$order->isCanceled()) {
116+
if ($this->_isAllowedAction('Magento_Sales::email') && !$order->isCanceled()) {
125117
$message = __('Are you sure you want to send an order email to customer?');
126118
$this->addButton(
127119
'send_notification',

‎app/code/Magento/Sales/Controller/Adminhtml/Order/Creditmemo/Cancel.php

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -6,15 +6,16 @@
66
namespace Magento\Sales\Controller\Adminhtml\Order\Creditmemo;
77

88
use Magento\Backend\App\Action;
9+
use Magento\Framework\App\Action\HttpPostActionInterface;
910

10-
class Cancel extends \Magento\Backend\App\Action
11+
class Cancel extends \Magento\Backend\App\Action implements HttpPostActionInterface
1112
{
1213
/**
1314
* Authorization level of a basic admin session
1415
*
1516
* @see _isAllowed()
1617
*/
17-
const ADMIN_RESOURCE = 'Magento_Sales::sales_creditmemo';
18+
public const ADMIN_RESOURCE = 'Magento_Sales::creditmemo';
1819

1920
/**
2021
* @var \Magento\Backend\Model\View\Result\ForwardFactory

‎app/code/Magento/Sales/Controller/Adminhtml/Order/Creditmemo/NewAction.php

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@ class NewAction extends \Magento\Backend\App\Action implements HttpGetActionInte
1515
*
1616
* @see _isAllowed()
1717
*/
18-
const ADMIN_RESOURCE = 'Magento_Sales::sales_creditmemo';
18+
public const ADMIN_RESOURCE = 'Magento_Sales::creditmemo';
1919

2020
/**
2121
* @var \Magento\Sales\Controller\Adminhtml\Order\CreditmemoLoader

‎app/code/Magento/Sales/Controller/Adminhtml/Order/Creditmemo/Save.php

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@ class Save extends \Magento\Backend\App\Action implements HttpPostActionInterfac
1818
*
1919
* @see _isAllowed()
2020
*/
21-
public const ADMIN_RESOURCE = 'Magento_Sales::sales_creditmemo';
21+
public const ADMIN_RESOURCE = 'Magento_Sales::creditmemo';
2222

2323
/**
2424
* @var \Magento\Sales\Controller\Adminhtml\Order\CreditmemoLoader

‎app/code/Magento/Sales/Controller/Adminhtml/Order/Creditmemo/Start.php

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@ class Start extends \Magento\Backend\App\Action implements HttpGetActionInterfac
1414
*
1515
* @see _isAllowed()
1616
*/
17-
const ADMIN_RESOURCE = 'Magento_Sales::sales_creditmemo';
17+
public const ADMIN_RESOURCE = 'Magento_Sales::creditmemo';
1818

1919
/**
2020
* Start create creditmemo action

‎app/code/Magento/Sales/Controller/Adminhtml/Order/Creditmemo/UpdateQty.php

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@ class UpdateQty extends \Magento\Backend\App\Action implements HttpPostActionInt
1515
*
1616
* @see _isAllowed()
1717
*/
18-
const ADMIN_RESOURCE = 'Magento_Sales::sales_creditmemo';
18+
public const ADMIN_RESOURCE = 'Magento_Sales::creditmemo';
1919

2020
/**
2121
* @var \Magento\Sales\Controller\Adminhtml\Order\CreditmemoLoader

‎app/code/Magento/Sales/Controller/Adminhtml/Order/Creditmemo/VoidAction.php

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -6,15 +6,16 @@
66
namespace Magento\Sales\Controller\Adminhtml\Order\Creditmemo;
77

88
use Magento\Backend\App\Action;
9+
use Magento\Framework\App\Action\HttpPostActionInterface;
910

10-
class VoidAction extends Action
11+
class VoidAction extends Action implements HttpPostActionInterface
1112
{
1213
/**
1314
* Authorization level of a basic admin session
1415
*
1516
* @see _isAllowed()
1617
*/
17-
const ADMIN_RESOURCE = 'Magento_Sales::sales_creditmemo';
18+
public const ADMIN_RESOURCE = 'Magento_Sales::creditmemo';
1819

1920
/**
2021
* @var \Magento\Sales\Controller\Adminhtml\Order\CreditmemoLoader

0 commit comments

Comments
 (0)