Skip to content

Commit aee74f9

Browse files
author
sergey
committed
Admin user can call arbitrary Module class's constructor via Cart Price Rule magento#35135
Redefined the check of the using class
1 parent a945273 commit aee74f9

File tree

9 files changed

+251
-86
lines changed

9 files changed

+251
-86
lines changed

‎app/code/Magento/CatalogRule/Controller/Adminhtml/Promo/Catalog.php

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -43,7 +43,7 @@ abstract class Catalog extends Action
4343
/**
4444
* Date filter instance
4545
*
46-
* @var \Magento\Framework\Stdlib\DateTime\Filter\Date
46+
* @var Date
4747
*/
4848
protected $_dateFilter;
4949

‎app/code/Magento/CatalogRule/Controller/Adminhtml/Promo/Catalog/NewActionHtml.php

Lines changed: 16 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -4,15 +4,17 @@
44
* Copyright © Magento, Inc. All rights reserved.
55
* See COPYING.txt for license details.
66
*/
7-
namespace Magento\CatalogRule\Controller\Adminhtml\Promo\Catalog;
87

9-
use Magento\Rule\Model\Action\AbstractAction;
8+
declare(strict_types=1);
9+
namespace Magento\CatalogRule\Controller\Adminhtml\Promo\Catalog;
1010

1111
/**
1212
* @SuppressWarnings(PHPMD.AllPurposeAction)
1313
*/
14-
class NewActionHtml extends \Magento\CatalogRule\Controller\Adminhtml\Promo\Catalog
14+
class NewActionHtml extends NewHtml
1515
{
16+
protected string $typeChecked = 'Magento\Rule\Model\Action\AbstractAction';
17+
1618
/**
1719
* Execute new action html.
1820
*
@@ -24,21 +26,21 @@ public function execute()
2426
$typeArr = explode('|', str_replace('-', '/', $this->getRequest()->getParam('type', '')));
2527
$type = $typeArr[0];
2628

27-
$model = $this->_objectManager->create($type)
28-
->setId($id)
29-
->setType($type)
30-
->setRule($this->_objectManager->create(\Magento\CatalogRule\Model\Rule::class))
31-
->setPrefix('actions');
29+
$model = $this->_objectManager->create($type);
30+
if ($this->verifyClassName($model)) {
31+
$model->setId($id)
32+
->setType($type)
33+
->setRule($this->_objectManager->create(\Magento\CatalogRule\Model\Rule::class))
34+
->setPrefix('actions');
3235

33-
if (!empty($typeArr[1])) {
34-
$model->setAttribute($typeArr[1]);
35-
}
36+
if (!empty($typeArr[1])) {
37+
$model->setAttribute($typeArr[1]);
38+
}
3639

37-
if ($model instanceof AbstractAction) {
3840
$model->setJsFormObject($this->getRequest()->getParam('form'));
3941
$html = $model->asHtmlRecursive();
40-
} else {
41-
$html = '';
42+
}else {
43+
$html = $this->getErrorJson();
4244
}
4345
$this->getResponse()->setBody($html);
4446
}

‎app/code/Magento/CatalogRule/Controller/Adminhtml/Promo/Catalog/NewConditionHtml.php

Lines changed: 18 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -4,15 +4,18 @@
44
* Copyright © Magento, Inc. All rights reserved.
55
* See COPYING.txt for license details.
66
*/
7+
8+
declare(strict_types=1);
79
namespace Magento\CatalogRule\Controller\Adminhtml\Promo\Catalog;
810

11+
use Magento\CatalogRule\Model\Rule;
912
use Magento\Framework\App\Action\HttpGetActionInterface;
1013
use Magento\Framework\App\Action\HttpPostActionInterface as HttpPostActionInterface;
11-
use Magento\Rule\Model\Condition\AbstractCondition;
12-
use Magento\CatalogRule\Controller\Adminhtml\Promo\Catalog as CatalogAction;
1314

14-
class NewConditionHtml extends CatalogAction implements HttpPostActionInterface, HttpGetActionInterface
15+
class NewConditionHtml extends NewHtml implements HttpPostActionInterface, HttpGetActionInterface
1516
{
17+
protected string $typeChecked = 'Magento\Rule\Model\Condition\AbstractCondition';
18+
1619
/**
1720
* Execute new condition html.
1821
*
@@ -25,23 +28,25 @@ public function execute()
2528
$typeArr = explode('|', str_replace('-', '/', $this->getRequest()->getParam('type', '')));
2629
$type = $typeArr[0];
2730

28-
$model = $this->_objectManager->create($type)
29-
->setId($id)
30-
->setType($type)
31-
->setRule($this->_objectManager->create(\Magento\CatalogRule\Model\Rule::class))
32-
->setPrefix('conditions');
31+
$model = $this->_objectManager->create($type);
3332

34-
if (!empty($typeArr[1])) {
35-
$model->setAttribute($typeArr[1]);
36-
}
33+
if ($this->verifyClassName($model)) {
34+
$model->setId($id)
35+
->setType($type)
36+
->setRule($this->_objectManager->create(Rule::class))
37+
->setPrefix('conditions');
38+
39+
if (!empty($typeArr[1])) {
40+
$model->setAttribute($typeArr[1]);
41+
}
3742

38-
if ($model instanceof AbstractCondition) {
3943
$model->setJsFormObject($this->getRequest()->getParam('form'));
4044
$model->setFormName($formName);
4145
$html = $model->asHtmlRecursive();
4246
} else {
43-
$html = '';
47+
$html = $this->getErrorJson();
4448
}
49+
4550
$this->getResponse()->setBody($html);
4651
}
4752
}

‎app/code/Magento/CatalogRule/Controller/Adminhtml/Promo/Catalog/NewHtml.php

Lines changed: 69 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,69 @@
1+
<?php
2+
/**
3+
* Copyright © Magento, Inc. All rights reserved.
4+
* See COPYING.txt for license details.
5+
*/
6+
7+
declare(strict_types=1);
8+
9+
namespace Magento\CatalogRule\Controller\Adminhtml\Promo\Catalog;
10+
11+
use Magento\Backend\App\Action\Context;
12+
use Magento\CatalogRule\Controller\Adminhtml\Promo\Catalog as CatalogAction;
13+
use Magento\Framework\Registry;
14+
use Magento\Framework\Serialize\SerializerInterface;
15+
use Magento\Framework\Stdlib\DateTime\Filter\Date;
16+
17+
abstract class NewHtml extends CatalogAction
18+
{
19+
/**
20+
* @var string
21+
*/
22+
protected string $typeChecked = '';
23+
24+
/**
25+
* @var SerializerInterface
26+
*/
27+
protected SerializerInterface $serializer;
28+
29+
public function __construct(
30+
Context $context,
31+
Registry $coreRegistry,
32+
Date $dateFilter,
33+
SerializerInterface $serializer
34+
){
35+
parent::__construct($context, $coreRegistry, $dateFilter);
36+
37+
$this->serializer = $serializer;
38+
}
39+
40+
/**
41+
* Verify class instance
42+
*
43+
* @param mixed $verifyClass
44+
* @return bool
45+
*/
46+
public function verifyClassName($verifyClass): bool
47+
{
48+
if ($verifyClass instanceof $this->typeChecked) {
49+
return true;
50+
}
51+
52+
return false;
53+
}
54+
55+
/**
56+
* Get Error json
57+
*
58+
* @return bool|string
59+
*/
60+
protected function getErrorJson()
61+
{
62+
return $this->serializer->serialize(
63+
[
64+
'error' => true,
65+
'message' => __('Selected type is not inherited from type %1', $this->typeChecked)
66+
]
67+
);
68+
}
69+
}

‎app/code/Magento/Rule/view/adminhtml/web/rules.js

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -347,9 +347,11 @@ define([
347347
},
348348
onComplete: this.onAddNewChildComplete.bind(this, new_elem),
349349
onSuccess: function (transport) {
350+
let responseElement = '';
350351
if (this._processSuccess(transport)) {
351-
$(new_elem).update(transport.responseText);
352+
responseElement = transport.responseText;
352353
}
354+
$(new_elem).update(responseElement);
353355
}.bind(this),
354356
onFailure: this._processFailure.bind(this)
355357
});

‎app/code/Magento/SalesRule/Controller/Adminhtml/Promo/Quote.php

Lines changed: 23 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,15 @@
55
*/
66
namespace Magento\SalesRule\Controller\Adminhtml\Promo;
77

8-
abstract class Quote extends \Magento\Backend\App\Action
8+
use Magento\Backend\App\Action;
9+
use Magento\Backend\App\Action\Context;
10+
use Magento\Framework\App\Response\Http\FileFactory;
11+
use Magento\Framework\Registry;
12+
use Magento\Framework\Stdlib\DateTime\Filter\Date;
13+
use Magento\SalesRule\Model\RegistryConstants;
14+
use Magento\SalesRule\Model\Rule;
15+
16+
abstract class Quote extends Action
917
{
1018
/**
1119
* Authorization level of a basic admin session
@@ -17,31 +25,31 @@ abstract class Quote extends \Magento\Backend\App\Action
1725
/**
1826
* Core registry
1927
*
20-
* @var \Magento\Framework\Registry
28+
* @var Registry
2129
*/
2230
protected $_coreRegistry = null;
2331

2432
/**
25-
* @var \Magento\Framework\App\Response\Http\FileFactory
33+
* @var FileFactory
2634
*/
2735
protected $_fileFactory;
2836

2937
/**
30-
* @var \Magento\Framework\Stdlib\DateTime\Filter\Date
38+
* @var Date
3139
*/
3240
protected $_dateFilter;
3341

3442
/**
35-
* @param \Magento\Backend\App\Action\Context $context
36-
* @param \Magento\Framework\Registry $coreRegistry
37-
* @param \Magento\Framework\App\Response\Http\FileFactory $fileFactory
38-
* @param \Magento\Framework\Stdlib\DateTime\Filter\Date $dateFilter
43+
* @param Context $context
44+
* @param Registry $coreRegistry
45+
* @param FileFactory $fileFactory
46+
* @param Date $dateFilter
3947
*/
4048
public function __construct(
41-
\Magento\Backend\App\Action\Context $context,
42-
\Magento\Framework\Registry $coreRegistry,
43-
\Magento\Framework\App\Response\Http\FileFactory $fileFactory,
44-
\Magento\Framework\Stdlib\DateTime\Filter\Date $dateFilter
49+
Context $context,
50+
Registry $coreRegistry,
51+
FileFactory $fileFactory,
52+
Date $dateFilter
4553
) {
4654
parent::__construct($context);
4755
$this->_coreRegistry = $coreRegistry;
@@ -57,8 +65,8 @@ public function __construct(
5765
protected function _initRule()
5866
{
5967
$this->_coreRegistry->register(
60-
\Magento\SalesRule\Model\RegistryConstants::CURRENT_SALES_RULE,
61-
$this->_objectManager->create(\Magento\SalesRule\Model\Rule::class)
68+
RegistryConstants::CURRENT_SALES_RULE,
69+
$this->_objectManager->create(Rule::class)
6270
);
6371
$id = (int)$this->getRequest()->getParam('id');
6472

@@ -67,7 +75,7 @@ protected function _initRule()
6775
}
6876

6977
if ($id) {
70-
$this->_coreRegistry->registry(\Magento\SalesRule\Model\RegistryConstants::CURRENT_SALES_RULE)->load($id);
78+
$this->_coreRegistry->registry(RegistryConstants::CURRENT_SALES_RULE)->load($id);
7179
}
7280
}
7381

‎app/code/Magento/SalesRule/Controller/Adminhtml/Promo/Quote/NewActionHtml.php

Lines changed: 20 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -3,18 +3,23 @@
33
* Copyright © Magento, Inc. All rights reserved.
44
* See COPYING.txt for license details.
55
*/
6+
7+
declare(strict_types=1);
68
namespace Magento\SalesRule\Controller\Adminhtml\Promo\Quote;
79

8-
use Magento\Framework\App\Action\HttpPostActionInterface;
9-
use Magento\Rule\Model\Condition\AbstractCondition;
10-
use Magento\SalesRule\Controller\Adminhtml\Promo\Quote;
1110
use Magento\SalesRule\Model\Rule;
11+
use Magento\Rule\Model\Condition\AbstractCondition;
1212

1313
/**
1414
* New action html action
1515
*/
16-
class NewActionHtml extends Quote implements HttpPostActionInterface
16+
class NewActionHtml extends NewHtml
1717
{
18+
/**
19+
* @var string
20+
*/
21+
protected string $typeChecked = 'Magento\Rule\Model\Condition\AbstractCondition';
22+
1823
/**
1924
* New action html action
2025
*
@@ -30,31 +35,24 @@ public function execute()
3035
);
3136
$type = $typeArr[0];
3237

33-
$model = $this->_objectManager->create(
34-
$type
35-
)->setId(
36-
$id
37-
)->setType(
38-
$type
39-
)->setRule(
40-
$this->_objectManager->create(Rule::class)
41-
)->setPrefix(
42-
'actions'
43-
);
44-
if (!empty($typeArr[1])) {
45-
$model->setAttribute($typeArr[1]);
46-
}
38+
$model = $this->_objectManager->create($type);
39+
if ($this->verifyClassName($model)) {
40+
$model->setId($id)
41+
->setType($type)
42+
->setRule($this->_objectManager->create(Rule::class))
43+
->setPrefix('actions');
44+
if (!empty($typeArr[1])) {
45+
$model->setAttribute($typeArr[1]);
46+
}
4747

48-
if ($model instanceof AbstractCondition) {
4948
$model->setJsFormObject($formName);
5049
$model->setFormName($formName);
5150
$this->setJsFormObject($model);
5251
$html = $model->asHtmlRecursive();
5352
} else {
54-
$html = '';
53+
$html = $this->getErrorJson();
5554
}
56-
$this->getResponse()
57-
->setBody($html);
55+
$this->getResponse()->setBody($html);
5856
}
5957

6058
/**

0 commit comments

Comments
 (0)