Skip to content

Commit 765f26f

Browse files
admanesachinadmanesachin
committed
Merge branch 'MC-36034' of github.com:magento-cia/magento2ce into cia-2.4.3-bugfixes-4222021
2 parents 12a12bd + e7497d4 commit 765f26f

File tree

13 files changed

+499
-2
lines changed

13 files changed

+499
-2
lines changed

‎app/code/Magento/Security/Block/Config/Backend/Session/SessionSize.php

Lines changed: 77 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,77 @@
1+
<?php
2+
/**
3+
* Copyright © Magento, Inc. All rights reserved.
4+
* See COPYING.txt for license details.
5+
*/
6+
7+
/**
8+
* System config email field backend model
9+
*/
10+
declare(strict_types=1);
11+
12+
namespace Magento\Security\Block\Config\Backend\Session;
13+
14+
use Magento\Backend\Block\Template\Context;
15+
use Magento\Config\Block\System\Config\Form\Field;
16+
use Magento\Framework\Data\Form\Element\AbstractElement;
17+
use Magento\Framework\Exception\ValidatorException;
18+
use Magento\Framework\Serialize\Serializer\Json;
19+
20+
/**
21+
* Backend Model for Max Session Size
22+
*/
23+
class SessionSize extends Field
24+
{
25+
/**
26+
* @var Json
27+
*/
28+
private $json;
29+
30+
/**
31+
* @param Context $context
32+
* @param Json $json
33+
* @param array $data
34+
*/
35+
public function __construct(
36+
Context $context,
37+
Json $json,
38+
array $data = []
39+
) {
40+
parent::__construct($context, $data);
41+
$this->json = $json;
42+
}
43+
44+
/**
45+
* {@inheritdoc}
46+
* @throws ValidatorException
47+
*/
48+
protected function _getElementHtml(AbstractElement $element)
49+
{
50+
$html = parent::_getElementHtml($element);
51+
$originalData = $element->getOriginalData();
52+
$maxSessionSizeAdminSelector = '#' . $element->getHtmlId();
53+
$jsString = '<script type="text/x-magento-init"> {"' .
54+
$maxSessionSizeAdminSelector . '": {
55+
"Magento_Security/js/system/config/session-size": {"modalTitleText": ' .
56+
$this->json->serialize(__($originalData['modal_title_text'])) . ', "modalContentBody": ' .
57+
$this->json->serialize($this->getModalContentBody($originalData['modal_content_body_path']))
58+
. '}}}</script>';
59+
60+
$html .= $jsString;
61+
return $html;
62+
}
63+
64+
/**
65+
* Get HTML for the modal content body when user switches to disable
66+
*
67+
* @param string $templatePath
68+
* @return string
69+
* @throws ValidatorException
70+
*/
71+
private function getModalContentBody(string $templatePath)
72+
{
73+
$templateFileName = $this->getTemplateFile($templatePath);
74+
75+
return $this->fetchView($templateFileName);
76+
}
77+
}

‎app/code/Magento/Security/Model/Config/Backend/Session/SessionSize.php

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
<?php
2+
/**
3+
* Copyright © Magento, Inc. All rights reserved.
4+
* See COPYING.txt for license details.
5+
*/
6+
7+
/**
8+
* System config email field backend model
9+
*/
10+
declare(strict_types=1);
11+
12+
namespace Magento\Security\Model\Config\Backend\Session;
13+
14+
use Magento\Framework\App\Config\Value;
15+
16+
/**
17+
* Backend Model for Max Session Size
18+
*/
19+
class SessionSize extends Value
20+
{
21+
/**
22+
* Handles the before save event
23+
*
24+
* @return $this
25+
*/
26+
public function beforeSave()
27+
{
28+
$value = $this->getValue();
29+
if ($value === '0') {
30+
$value = 0;
31+
} else {
32+
$value = (int)$value;
33+
if ($value === null || $value <= 0) {
34+
$value = 256000;
35+
}
36+
}
37+
$this->setValue((string)$value);
38+
return $this;
39+
}
40+
}

‎app/code/Magento/Security/composer.json

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,7 @@
77
"require": {
88
"php": "~7.3.0||~7.4.0",
99
"magento/framework": "*",
10+
"magento/module-config": "*",
1011
"magento/module-backend": "*",
1112
"magento/module-store": "*",
1213
"magento/module-user": "*"

‎app/code/Magento/Security/etc/adminhtml/system.xml

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -36,6 +36,29 @@
3636
</field>
3737
</group>
3838
</section>
39+
<section id="system">
40+
<group id="security" translate="label" type="text" sortOrder="60" showInDefault="1" showInWebsite="1">
41+
<label>Security</label>
42+
<field id="max_session_size_admin" translate="label" type="text" sortOrder="1" showInDefault="1" canRestore="1">
43+
<label>Max Session Size in Admin</label>
44+
<attribute type="modal_title_text">Are You Sure About Your Max Session Size in Admin Settings?</attribute>
45+
<attribute type="modal_content_body_path">Magento_Security::system/config/session_size_admin/modal_content_body.phtml</attribute>
46+
<validate>required-entry validate-zero-or-greater validate-digits</validate>
47+
<frontend_model>Magento\Security\Block\Config\Backend\Session\SessionSize</frontend_model>
48+
<backend_model>Magento\Security\Model\Config\Backend\Session\SessionSize</backend_model>
49+
<comment>Limit the maximum session size in bytes. Use 0 to disable.</comment>
50+
</field>
51+
<field id="max_session_size_storefront" translate="label" type="text" sortOrder="2" showInDefault="1" canRestore="1">
52+
<label>Max Session Size in Storefront</label>
53+
<attribute type="modal_title_text">Are You Sure About Your Max Session Size in Storefront Settings?</attribute>
54+
<attribute type="modal_content_body_path">Magento_Security::system/config/session_size_storefront/modal_content_body.phtml</attribute>
55+
<validate>required-entry validate-zero-or-greater validate-digits</validate>
56+
<frontend_model>Magento\Security\Block\Config\Backend\Session\SessionSize</frontend_model>
57+
<backend_model>Magento\Security\Model\Config\Backend\Session\SessionSize</backend_model>
58+
<comment>Limit the maximum session size in bytes. Use 0 to disable.</comment>
59+
</field>
60+
</group>
61+
</section>
3962
<section id="customer">
4063
<group id="password">
4164
<field id="password_reset_protection_type" translate="label" type="select" sortOrder="5" showInDefault="1" showInWebsite="1" showInStore="1" canRestore="1">

‎app/code/Magento/Security/etc/config.xml

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,12 @@
1616
<session_lifetime>900</session_lifetime>
1717
</security>
1818
</admin>
19+
<system>
20+
<security>
21+
<max_session_size_admin>256000</max_session_size_admin>
22+
<max_session_size_storefront>256000</max_session_size_storefront>
23+
</security>
24+
</system>
1925
<customer>
2026
<password>
2127
<password_reset_protection_type>1</password_reset_protection_type>

‎app/code/Magento/Security/view/adminhtml/templates/system/config/session_size_admin/modal_content_body.phtml

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
<?php
2+
/**
3+
* Copyright © Magento, Inc. All rights reserved.
4+
* See COPYING.txt for license details.
5+
*/
6+
7+
?>
8+
<div>
9+
<p>
10+
<strong><?= $block->escapeHtml(__('Warning')) ?></strong>
11+
<?= $block->escapeHtml(__(': You are about to set max session size in admin to be lower than recommended ' .
12+
'default session size. Low max session size in admin could break admin functionalities such as admin ' .
13+
'panel login. Are you sure you want to make this change?')) ?>
14+
</p>
15+
</div>

‎app/code/Magento/Security/view/adminhtml/templates/system/config/session_size_storefront/modal_content_body.phtml

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
<?php
2+
/**
3+
* Copyright © Magento, Inc. All rights reserved.
4+
* See COPYING.txt for license details.
5+
*/
6+
7+
?>
8+
<div>
9+
<p>
10+
<strong><?= $block->escapeHtml(__('Warning')) ?></strong>
11+
<?= $block->escapeHtml(__(': You are about to set max session size in storefront to be lower than ' .
12+
' recommended default session size. Low max session size in storefront could break storefront ' .
13+
'functionalities such as customer login. Are you sure you want to make this change?')) ?>
14+
</p>
15+
</div>

‎app/code/Magento/Security/view/adminhtml/web/js/system/config/session-size.js

Lines changed: 58 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,58 @@
1+
/**
2+
* Copyright © Magento, Inc. All rights reserved.
3+
* See COPYING.txt for license details.
4+
*/
5+
6+
define([
7+
'jquery',
8+
'mage/translate',
9+
'Magento_Ui/js/modal/confirm',
10+
'domReady!'
11+
], function ($, $t, confirm) {
12+
'use strict';
13+
14+
return function (config, inputEl) {
15+
var $inputEl = $(inputEl);
16+
17+
$inputEl.on('blur', function () {
18+
var inputVal = parseInt($inputEl.val(), 10);
19+
20+
if (256000 > inputVal) {
21+
confirm({
22+
title: $t(config.modalTitleText),
23+
content: $t(config.modalContentBody),
24+
buttons: [{
25+
text: $t('No'),
26+
class: 'action-secondary action-dismiss',
27+
28+
/**
29+
* Close modal and trigger 'cancel' action on click
30+
*/
31+
click: function (event) {
32+
this.closeModal(event);
33+
}
34+
}, {
35+
text: $t('Yes'),
36+
class: 'action-primary action-accept',
37+
38+
/**
39+
* Close modal and trigger 'confirm' action on click
40+
*/
41+
click: function (event) {
42+
this.closeModal(event, true);
43+
}
44+
}],
45+
actions: {
46+
47+
/**
48+
* Revert back to original value
49+
*/
50+
cancel: function () {
51+
$inputEl.val(256000);
52+
}
53+
}
54+
});
55+
}
56+
});
57+
};
58+
});

‎app/code/Magento/Store/etc/di.xml

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -174,6 +174,11 @@
174174
<argument name="scopeType" xsi:type="const">Magento\Store\Model\ScopeInterface::SCOPE_STORE</argument>
175175
</arguments>
176176
</type>
177+
<type name="Magento\Framework\Session\SessionMaxSizeConfig">
178+
<arguments>
179+
<argument name="scopeType" xsi:type="const">Magento\Store\Model\ScopeInterface::SCOPE_STORE</argument>
180+
</arguments>
181+
</type>
177182
<type name="Magento\Framework\Session\SidResolver">
178183
<arguments>
179184
<argument name="scopeType" xsi:type="const">Magento\Store\Model\ScopeInterface::SCOPE_STORE</argument>

‎app/etc/di.xml

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1767,6 +1767,11 @@
17671767
<argument name="scopeType" xsi:type="const">Magento\Framework\App\Config\ScopeConfigInterface::SCOPE_TYPE_DEFAULT</argument>
17681768
</arguments>
17691769
</type>
1770+
<type name="Magento\Framework\Session\SessionMaxSizeConfig">
1771+
<arguments>
1772+
<argument name="scopeType" xsi:type="const">Magento\Framework\App\Config\ScopeConfigInterface::SCOPE_TYPE_DEFAULT</argument>
1773+
</arguments>
1774+
</type>
17701775
<virtualType name="CsrfRequestValidator" type="Magento\Framework\App\Request\CsrfValidator" />
17711776
<virtualType name="RequestValidator" type="Magento\Framework\App\Request\CompositeValidator">
17721777
<arguments>

‎lib/internal/Magento/Framework/Session/SaveHandler.php

Lines changed: 36 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -6,14 +6,21 @@
66

77
namespace Magento\Framework\Session;
88

9-
use Magento\Framework\Session\Config\ConfigInterface;
9+
use Magento\Framework\Exception\LocalizedException;
1010
use Magento\Framework\Exception\SessionException;
11+
use Magento\Framework\Session\Config\ConfigInterface;
12+
use Psr\Log\LoggerInterface;
1113

1214
/**
1315
* Magento session save handler.
1416
*/
1517
class SaveHandler implements SaveHandlerInterface
1618
{
19+
/**
20+
* @var LoggerInterface
21+
*/
22+
private $logger;
23+
1724
/**
1825
* Session handler
1926
*
@@ -36,19 +43,30 @@ class SaveHandler implements SaveHandlerInterface
3643
*/
3744
private $defaultHandler;
3845

46+
/**
47+
* @var SessionMaxSizeConfig
48+
*/
49+
private $sessionMaxSizeConfig;
50+
3951
/**
4052
* @param SaveHandlerFactory $saveHandlerFactory
4153
* @param ConfigInterface $sessionConfig
54+
* @param LoggerInterface $logger
55+
* @param SessionMaxSizeConfig $sessionMaxSizeConfigs
4256
* @param string $default
4357
*/
4458
public function __construct(
4559
SaveHandlerFactory $saveHandlerFactory,
4660
ConfigInterface $sessionConfig,
61+
LoggerInterface $logger,
62+
SessionMaxSizeConfig $sessionMaxSizeConfigs,
4763
$default = self::DEFAULT_HANDLER
4864
) {
4965
$this->saveHandlerFactory = $saveHandlerFactory;
5066
$this->sessionConfig = $sessionConfig;
67+
$this->logger = $logger;
5168
$this->defaultHandler = $default;
69+
$this->sessionMaxSizeConfig = $sessionMaxSizeConfigs;
5270
}
5371

5472
/**
@@ -90,10 +108,26 @@ public function read($sessionId)
90108
* @param string $sessionId
91109
* @param string $data
92110
* @return bool
111+
* @throws LocalizedException
93112
*/
94113
public function write($sessionId, $data)
95114
{
96-
return $this->callSafely('write', $sessionId, $data);
115+
$sessionMaxSize = $this->sessionMaxSizeConfig->getSessionMaxSize();
116+
$sessionSize = strlen($data);
117+
118+
if ($sessionMaxSize === null || $sessionMaxSize >= $sessionSize) {
119+
return $this->callSafely('write', $sessionId, $data);
120+
}
121+
122+
$this->logger->warning(
123+
sprintf(
124+
'Session size of %d exceeded allowed session max size of %d.',
125+
$sessionSize,
126+
$sessionMaxSize
127+
)
128+
);
129+
130+
return $this->callSafely('write', $sessionId, $this->read($sessionId));
97131
}
98132

99133
/**

0 commit comments

Comments
 (0)