Skip to content

Commit 8e1cac4

Browse files
pawan-adobe-securitypawan-adobe-security
authored
Merge pull request #9225 from magento-cia/cia-2.4.8-beta1-develop-bugfix-09022024
Cia 2.4.8 beta1 develop bugfix 09022024
2 parents e446919 + eb22b57 commit 8e1cac4

File tree

22 files changed

+151
-35
lines changed

22 files changed

+151
-35
lines changed

‎app/code/Magento/AdvancedSearch/Controller/Adminhtml/Search/System/Config/TestConnection.php

Lines changed: 11 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -4,22 +4,27 @@
44
* Copyright © Magento, Inc. All rights reserved.
55
* See COPYING.txt for license details.
66
*/
7+
declare(strict_types=1);
8+
79
namespace Magento\AdvancedSearch\Controller\Adminhtml\Search\System\Config;
810

911
use Magento\Backend\App\Action;
1012
use Magento\Backend\App\Action\Context;
1113
use Magento\AdvancedSearch\Model\Client\ClientResolver;
14+
use Magento\Framework\App\Action\HttpPostActionInterface;
15+
use Magento\Framework\Controller\Result\Json;
1216
use Magento\Framework\Controller\Result\JsonFactory;
17+
use Magento\Framework\Exception\LocalizedException;
1318
use Magento\Framework\Filter\StripTags;
1419

15-
class TestConnection extends Action
20+
class TestConnection extends Action implements HttpPostActionInterface
1621
{
1722
/**
1823
* Authorization level of a basic admin session.
1924
*
2025
* @see _isAllowed()
2126
*/
22-
const ADMIN_RESOURCE = 'Magento_CatalogSearch::config_catalog_search';
27+
public const ADMIN_RESOURCE = 'Magento_Catalog::config_catalog';
2328

2429
/**
2530
* @var ClientResolver
@@ -57,7 +62,7 @@ public function __construct(
5762
/**
5863
* Check for connection to server
5964
*
60-
* @return \Magento\Framework\Controller\Result\Json
65+
* @return Json
6166
*/
6267
public function execute()
6368
{
@@ -69,22 +74,22 @@ public function execute()
6974

7075
try {
7176
if (empty($options['engine'])) {
72-
throw new \Magento\Framework\Exception\LocalizedException(
77+
throw new LocalizedException(
7378
__('Missing search engine parameter.')
7479
);
7580
}
7681
$response = $this->clientResolver->create($options['engine'], $options)->testConnection();
7782
if ($response) {
7883
$result['success'] = true;
7984
}
80-
} catch (\Magento\Framework\Exception\LocalizedException $e) {
85+
} catch (LocalizedException $e) {
8186
$result['errorMessage'] = $e->getMessage();
8287
} catch (\Exception $e) {
8388
$message = __($e->getMessage());
8489
$result['errorMessage'] = $this->tagFilter->filter($message);
8590
}
8691

87-
/** @var \Magento\Framework\Controller\Result\Json $resultJson */
92+
/** @var Json $resultJson */
8893
$resultJson = $this->resultJsonFactory->create();
8994
return $resultJson->setData($result);
9095
}

‎app/code/Magento/Backend/Controller/Adminhtml/System/Design.php

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -14,10 +14,10 @@ abstract class Design extends Action
1414
*
1515
* @see _isAllowed()
1616
*/
17-
const ADMIN_RESOURCE = 'Magento_Backend::design';
17+
public const ADMIN_RESOURCE = 'Magento_Backend::schedule';
1818

1919
/**
20-
* Core registry
20+
* Core registry instance
2121
*
2222
* @var \Magento\Framework\Registry
2323
*/

‎app/code/Magento/CatalogSearch/etc/acl.xml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -13,12 +13,12 @@
1313
<resource id="Magento_Backend::stores_settings">
1414
<resource id="Magento_Config::config">
1515
<resource id="Magento_Catalog::config_catalog" title="Catalog Section" translate="title">
16-
<resource id="Magento_CatalogSearch::config_catalog_search" title="Catalog Search" translate="title" sortOrder="10" />
16+
<resource id="Magento_CatalogSearch::config_catalog_search" title="Catalog Search" translate="title" sortOrder="10" disabled="true" />
1717
</resource>
1818
</resource>
1919
</resource>
2020
</resource>
2121
</resource>
2222
</resources>
2323
</acl>
24-
</config>
24+
</config>

‎app/code/Magento/Cms/Block/Adminhtml/Block/Widget/Chooser.php

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -96,7 +96,7 @@ public function prepareElementHtml(\Magento\Framework\Data\Form\Element\Abstract
9696
*/
9797
public function getRowClickCallback()
9898
{
99-
$chooserJsObject = $this->getId();
99+
$chooserJsObject = $this->_escaper->escapeJs($this->getId());
100100
$js = '
101101
function (grid, event) {
102102
var trElement = Event.findElement(event, "tr");

‎app/code/Magento/Cms/Block/Adminhtml/Page/Widget/Chooser.php

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,6 @@
88
/**
99
* CMS page chooser for Wysiwyg CMS widget
1010
*
11-
* @author Magento Core Team <[email protected]>
1211
*/
1312
class Chooser extends \Magento\Backend\Block\Widget\Grid\Extended
1413
{
@@ -65,7 +64,6 @@ public function __construct(
6564
protected function _construct()
6665
{
6766
parent::_construct();
68-
//$this->setDefaultSort('name');
6967
$this->setUseAjax(true);
7068
$this->setDefaultFilter(['chooser_is_active' => '1']);
7169
}
@@ -113,7 +111,7 @@ public function prepareElementHtml(\Magento\Framework\Data\Form\Element\Abstract
113111
*/
114112
public function getRowClickCallback()
115113
{
116-
$chooserJsObject = $this->getId();
114+
$chooserJsObject = $this->_escaper->escapeJs($this->getId());
117115
$js = '
118116
function (grid, event) {
119117
var trElement = Event.findElement(event, "tr");

‎app/code/Magento/Customer/Controller/Adminhtml/Cart/Product/Composite/Cart.php

Lines changed: 20 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,7 @@
1212
use Magento\Quote\Model\Quote\Item;
1313
use Magento\Quote\Model\QuoteFactory;
1414
use Magento\Quote\Model\ResourceModel\QuoteItemRetriever;
15+
use Magento\Framework\AuthorizationInterface;
1516

1617
/**
1718
* Catalog composite product configuration controller
@@ -60,21 +61,30 @@ abstract class Cart extends \Magento\Backend\App\Action
6061
* @var QuoteItemRetriever
6162
*/
6263
private $quoteItemRetriever;
64+
65+
/**
66+
* @var AuthorizationInterface
67+
*/
68+
protected $_authorization;
69+
6370
/**
6471
* @param Action\Context $context
6572
* @param CartRepositoryInterface $quoteRepository
6673
* @param QuoteFactory $quoteFactory
6774
* @param QuoteItemRetriever $quoteItemRetriever
75+
* @param AuthorizationInterface $authorization
6876
*/
6977
public function __construct(
7078
Action\Context $context,
7179
CartRepositoryInterface $quoteRepository,
7280
QuoteFactory $quoteFactory,
73-
QuoteItemRetriever $quoteItemRetriever
81+
QuoteItemRetriever $quoteItemRetriever,
82+
AuthorizationInterface $authorization
7483
) {
7584
$this->quoteRepository = $quoteRepository;
7685
$this->quoteFactory = $quoteFactory;
7786
$this->quoteItemRetriever = $quoteItemRetriever;
87+
$this->_authorization = $authorization;
7888
parent::__construct($context);
7989
}
8090

@@ -112,4 +122,13 @@ protected function _initData()
112122

113123
return $this;
114124
}
125+
126+
/**
127+
* @inheritdoc
128+
*/
129+
protected function _isAllowed()
130+
{
131+
return $this->_authorization->isAllowed(self::ADMIN_RESOURCE)
132+
&& $this->_authorization->isAllowed('Magento_Cart::cart');
133+
}
115134
}

‎app/code/Magento/Customer/Controller/Adminhtml/Index/Cart.php

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,8 @@
33
* Copyright © Magento, Inc. All rights reserved.
44
* See COPYING.txt for license details.
55
*/
6+
declare(strict_types=1);
7+
68
namespace Magento\Customer\Controller\Adminhtml\Index;
79

810
use Magento\Backend\App\Action\Context;
@@ -43,6 +45,7 @@
4345
*
4446
* @SuppressWarnings(PHPMD.CouplingBetweenObjects)
4547
* @deprecated 101.0.0
48+
* @see no alternatives
4649
*/
4750
class Cart extends BaseAction implements HttpGetActionInterface, HttpPostActionInterface
4851
{
@@ -55,6 +58,13 @@ class Cart extends BaseAction implements HttpGetActionInterface, HttpPostActionI
5558
*/
5659
private $storeManager;
5760

61+
/**
62+
* Authorization level of a basic admin cart
63+
*
64+
* @see _isAllowed()
65+
*/
66+
public const ADMIN_RESOURCE = 'Magento_Cart::cart';
67+
5868
/**
5969
* Constructor
6070
*

‎app/code/Magento/Customer/Controller/Adminhtml/Index/Carts.php

Lines changed: 14 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,10 +3,23 @@
33
* Copyright © Magento, Inc. All rights reserved.
44
* See COPYING.txt for license details.
55
*/
6+
declare(strict_types=1);
7+
68
namespace Magento\Customer\Controller\Adminhtml\Index;
79

8-
class Carts extends \Magento\Customer\Controller\Adminhtml\Index
10+
use Magento\Customer\Controller\Adminhtml\Index as BaseAction;
11+
use Magento\Framework\App\Action\HttpGetActionInterface;
12+
use Magento\Framework\App\Action\HttpPostActionInterface as HttpPostActionInterface;
13+
14+
class Carts extends BaseAction implements HttpGetActionInterface, HttpPostActionInterface
915
{
16+
/**
17+
* Authorization level of a basic admin cart
18+
*
19+
* @see _isAllowed()
20+
*/
21+
public const ADMIN_RESOURCE = 'Magento_Cart::cart';
22+
1023
/**
1124
* Get shopping carts from all websites for specified client
1225
*

‎app/code/Magento/Sales/Controller/Adminhtml/Order/Create.php

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,10 @@ abstract class Create extends \Magento\Backend\App\Action
2626
* Indicates how to process post data
2727
*/
2828
private const ACTION_SAVE = 'save';
29+
/**
30+
* Controller name for edit actions
31+
*/
32+
private const CONTROLLER_NAME_ORDER_EDIT = 'order_edit';
2933
/**
3034
* @var \Magento\Framework\Escaper
3135
*/
@@ -380,6 +384,9 @@ protected function _getAclResource()
380384
if (in_array($action, ['index', 'save', 'cancel']) && $this->_getSession()->getReordered()) {
381385
$action = 'reorder';
382386
}
387+
if (strtolower($this->getRequest()->getControllerName() ?? '') === self::CONTROLLER_NAME_ORDER_EDIT) {
388+
$action = 'actions_edit';
389+
}
383390
switch ($action) {
384391
case 'index':
385392
case 'save':
@@ -391,6 +398,9 @@ protected function _getAclResource()
391398
case 'cancel':
392399
$aclResource = 'Magento_Sales::cancel';
393400
break;
401+
case 'actions_edit':
402+
$aclResource = 'Magento_Sales::actions_edit';
403+
break;
394404
default:
395405
$aclResource = 'Magento_Sales::actions';
396406
break;

‎app/code/Magento/Sales/Controller/Adminhtml/Order/Invoice/Cancel.php

Lines changed: 11 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,8 +6,18 @@
66
*/
77
namespace Magento\Sales\Controller\Adminhtml\Order\Invoice;
88

9-
class Cancel extends \Magento\Sales\Controller\Adminhtml\Invoice\AbstractInvoice\View
9+
use Magento\Framework\App\Action\HttpPostActionInterface;
10+
use Magento\Sales\Controller\Adminhtml\Invoice\AbstractInvoice\View;
11+
12+
class Cancel extends View implements HttpPostActionInterface
1013
{
14+
/**
15+
* Authorization level of a basic admin session
16+
*
17+
* @see _isAllowed()
18+
*/
19+
public const ADMIN_RESOURCE = 'Magento_Sales::invoice';
20+
1121
/**
1222
* Cancel invoice action
1323
*

‎app/code/Magento/Sales/Controller/Adminhtml/Order/Invoice/Capture.php

Lines changed: 11 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,8 +6,18 @@
66
*/
77
namespace Magento\Sales\Controller\Adminhtml\Order\Invoice;
88

9-
class Capture extends \Magento\Sales\Controller\Adminhtml\Invoice\AbstractInvoice\View
9+
use Magento\Framework\App\Action\HttpPostActionInterface;
10+
use Magento\Sales\Controller\Adminhtml\Invoice\AbstractInvoice\View;
11+
12+
class Capture extends View implements HttpPostActionInterface
1013
{
14+
/**
15+
* Authorization level of a basic admin session
16+
*
17+
* @see _isAllowed()
18+
*/
19+
public const ADMIN_RESOURCE = 'Magento_Sales::invoice';
20+
1121
/**
1222
* Capture invoice action
1323
*

‎app/code/Magento/Sales/Controller/Adminhtml/Order/Invoice/NewAction.php

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,7 @@ class NewAction extends \Magento\Backend\App\Action implements HttpGetActionInte
2323
*
2424
* @see _isAllowed()
2525
*/
26-
const ADMIN_RESOURCE = 'Magento_Sales::sales_invoice';
26+
public const ADMIN_RESOURCE = 'Magento_Sales::invoice';
2727

2828
/**
2929
* @var Registry

‎app/code/Magento/Sales/Controller/Adminhtml/Order/Invoice/Save.php

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -30,7 +30,7 @@ class Save extends \Magento\Backend\App\Action implements HttpPostActionInterfac
3030
*
3131
* @see _isAllowed()
3232
*/
33-
public const ADMIN_RESOURCE = 'Magento_Sales::sales_invoice';
33+
public const ADMIN_RESOURCE = 'Magento_Sales::invoice';
3434

3535
/**
3636
* @var InvoiceSender

‎app/code/Magento/Sales/Controller/Adminhtml/Order/Invoice/Start.php

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,13 @@
1010

1111
class Start extends \Magento\Sales\Controller\Adminhtml\Invoice\AbstractInvoice\View implements HttpGetActionInterface
1212
{
13+
/**
14+
* Authorization level of a basic admin session
15+
*
16+
* @see _isAllowed()
17+
*/
18+
public const ADMIN_RESOURCE = 'Magento_Sales::invoice';
19+
1320
/**
1421
* Start create invoice action
1522
*

‎app/code/Magento/Sales/Controller/Adminhtml/Order/Invoice/UpdateQty.php

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -18,11 +18,19 @@
1818
use Magento\Sales\Controller\Adminhtml\Invoice\AbstractInvoice\View as AbstractView;
1919

2020
/**
21-
* Class UpdateQty
21+
* Class UpdateQty to update invoice items qty
22+
*
2223
* @SuppressWarnings(PHPMD.CouplingBetweenObjects)
2324
*/
2425
class UpdateQty extends AbstractView implements HttpPostActionInterface
2526
{
27+
/**
28+
* Authorization level of a basic admin session
29+
*
30+
* @see _isAllowed()
31+
*/
32+
public const ADMIN_RESOURCE = 'Magento_Sales::invoice';
33+
2634
/**
2735
* @var JsonFactory
2836
*/

‎app/code/Magento/Sales/Controller/Adminhtml/Order/Invoice/VoidAction.php

Lines changed: 11 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,8 +6,18 @@
66
*/
77
namespace Magento\Sales\Controller\Adminhtml\Order\Invoice;
88

9-
class VoidAction extends \Magento\Sales\Controller\Adminhtml\Invoice\AbstractInvoice\View
9+
use Magento\Framework\App\Action\HttpPostActionInterface;
10+
use Magento\Sales\Controller\Adminhtml\Invoice\AbstractInvoice\View;
11+
12+
class VoidAction extends View implements HttpPostActionInterface
1013
{
14+
/**
15+
* Authorization level of a basic admin session
16+
*
17+
* @see _isAllowed()
18+
*/
19+
public const ADMIN_RESOURCE = 'Magento_Sales::invoice';
20+
1121
/**
1222
* Void invoice action
1323
*

0 commit comments

Comments
 (0)