Skip to content

Commit b97b7d4

Browse files
author
Oleksii Korshenko
committed
Merge branch 'support' into 2.0
2 parents cce60a9 + 56793af commit b97b7d4

File tree

24 files changed

+417
-35
lines changed

24 files changed

+417
-35
lines changed

‎CHANGELOG.md

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,19 @@
1+
2.0.1
2+
=============
3+
* Fixed bugs:
4+
* Fixed an issue where can't deploy sample data after "composer create-project"
5+
* Fixed a security issue on user account page
6+
* Fixed a security issue on product page
7+
* Fixed an issue where possible edit someone else reviews
8+
* Fixed an issue where possible view order details for certain orders
9+
* Fixed an issue where catalog price rule isn't applied to product created using Web API
10+
* Fixed a potential vulnerability where possible insert SQL injection
11+
* Fixed a potential vulnerability on checkout page
12+
* Fixed an issue with upload empty file to custom option
13+
* Fixed an issue with performance on customer edit form
14+
* GitHub requests:
15+
* [#2519](https://github.com/magento/magento2/issues/2519) -- Fixed an issue where synonyms don't work with Magento 2.0
16+
117
2.0.0
218
=============
319
* Fixed bugs:

‎app/code/Magento/Catalog/Model/Product/Option/Type/File/Validator.php

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -100,6 +100,17 @@ protected function getValidatorErrors($errors, $fileInfo, $option)
100100
$this->fileSize->getMaxFileSizeInMb()
101101
);
102102
break;
103+
case \Zend_Validate_File_ImageSize::NOT_DETECTED:
104+
$result[] = __(
105+
"The file '%1' is empty. Please choose another one",
106+
$fileInfo['title']
107+
);
108+
break;
109+
default:
110+
$result[] = __(
111+
"The file '%1' is invalid. Please choose another one",
112+
$fileInfo['title']
113+
);
103114
}
104115
}
105116
return $result;

‎app/code/Magento/Catalog/Model/Product/Option/Type/File/ValidatorFile.php

Lines changed: 18 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -57,22 +57,30 @@ class ValidatorFile extends Validator
5757
*/
5858
protected $product;
5959

60+
/**
61+
* @var \Magento\Framework\Validator\File\IsImage
62+
*/
63+
protected $isImageValidator;
64+
6065
/**
6166
* @param \Magento\Framework\App\Config\ScopeConfigInterface $scopeConfig
6267
* @param \Magento\Framework\Filesystem $filesystem
6368
* @param \Magento\Framework\File\Size $fileSize
6469
* @param \Magento\Framework\HTTP\Adapter\FileTransferFactory $httpFactory
70+
* @param \Magento\Framework\Validator\File\IsImage $isImageValidator
6571
* @throws \Magento\Framework\Exception\FileSystemException
6672
*/
6773
public function __construct(
6874
\Magento\Framework\App\Config\ScopeConfigInterface $scopeConfig,
6975
\Magento\Framework\Filesystem $filesystem,
7076
\Magento\Framework\File\Size $fileSize,
71-
\Magento\Framework\HTTP\Adapter\FileTransferFactory $httpFactory
77+
\Magento\Framework\HTTP\Adapter\FileTransferFactory $httpFactory,
78+
\Magento\Framework\Validator\File\IsImage $isImageValidator
7279
) {
7380
$this->mediaDirectory = $filesystem->getDirectoryWrite(DirectoryList::MEDIA);
7481
$this->filesystem = $filesystem;
7582
$this->httpFactory = $httpFactory;
83+
$this->isImageValidator = $isImageValidator;
7684
parent::__construct($scopeConfig, $filesystem, $fileSize);
7785
}
7886

@@ -169,8 +177,15 @@ public function validate($processingParams, $option)
169177
$_height = 0;
170178

171179
if ($tmpDirectory->isReadable($tmpDirectory->getRelativePath($fileInfo['tmp_name']))) {
172-
$imageSize = getimagesize($fileInfo['tmp_name']);
173-
if ($imageSize) {
180+
if (filesize($fileInfo['tmp_name'])) {
181+
if ($this->isImageValidator->isValid($fileInfo['tmp_name'])) {
182+
$imageSize = getimagesize($fileInfo['tmp_name']);
183+
}
184+
} else {
185+
throw new LocalizedException(__('The file is empty. Please choose another one'));
186+
}
187+
188+
if (!empty($imageSize)) {
174189
$_width = $imageSize[0];
175190
$_height = $imageSize[1];
176191
}

‎app/code/Magento/Catalog/i18n/en_US.csv

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -699,3 +699,4 @@ Autosettings,Autosettings
699699
"Allow Gift Message","Allow Gift Message"
700700
"Meta Title","Meta Title"
701701
"Maximum 255 chars","Maximum 255 chars"
702+
"The file is empty. Please choose another one","The file is empty. Please choose another one"

‎app/code/Magento/Catalog/view/adminhtml/templates/catalog/product/composite/fieldset/options/type/file.phtml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -68,7 +68,7 @@ require(['prototype'], function(){
6868
</label>
6969
<div class="admin__field-control control">
7070
<?php if ($_fileExists): ?>
71-
<span class="<?php /* @escapeNotVerified */ echo $_fileNamed ?>"><?php /* @escapeNotVerified */ echo $_fileInfo->getTitle(); ?></span>
71+
<span class="<?php /* @noEscape */ echo $_fileNamed ?>"><?php echo $block->escapeHtml($_fileInfo->getTitle()); ?></span>
7272
<a href="javascript:void(0)" class="label" onclick="opFile<?php /* @escapeNotVerified */ echo $_rand; ?>.toggleFileChange($(this).next('.input-box'))">
7373
<?php /* @escapeNotVerified */ echo __('Change') ?>
7474
</a>&nbsp;
@@ -79,7 +79,7 @@ require(['prototype'], function(){
7979
<?php endif; ?>
8080
<div class="input-box" <?php echo $_fileExists ? 'style="display:none"' : '' ?>>
8181
<!-- ToDo UI: add appropriate file class when z-index issue in ui dialog will be resolved -->
82-
<input type="file" name="<?php /* @escapeNotVerified */ echo $_fileName; ?>" class="product-custom-option<?php echo $_option->getIsRequire() ? ' required-entry' : '' ?>" price="<?php /* @escapeNotVerified */ echo $block->getCurrencyPrice($_option->getPrice(true)) ?>" <?php echo $_fileExists ? 'disabled="disabled"' : '' ?>/>
82+
<input type="file" name="<?php /* @noEscape */ echo $_fileName; ?>" class="product-custom-option<?php echo $_option->getIsRequire() ? ' required-entry' : '' ?>" price="<?php /* @escapeNotVerified */ echo $block->getCurrencyPrice($_option->getPrice(true)) ?>" <?php echo $_fileExists ? 'disabled="disabled"' : '' ?>/>
8383
<input type="hidden" name="<?php /* @escapeNotVerified */ echo $_fieldNameAction; ?>" value="<?php /* @escapeNotVerified */ echo $_fieldValueAction; ?>" />
8484

8585
<?php if ($_option->getFileExtension()): ?>

‎app/code/Magento/Catalog/view/frontend/templates/product/view/options/type/file.phtml

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -17,14 +17,14 @@
1717
<?php $class = ($_option->getIsRequire()) ? ' required' : ''; ?>
1818

1919
<div class="field file<?php /* @escapeNotVerified */ echo $class; ?>">
20-
<label class="label" for="<?php /* @escapeNotVerified */ echo $_fileName; ?>" id="<?php /* @escapeNotVerified */ echo $_fileName; ?>-label">
20+
<label class="label" for="<?php /* @noEscape */ echo $_fileName; ?>" id="<?php /* @noEscape */ echo $_fileName; ?>-label">
2121
<span><?php echo $block->escapeHtml($_option->getTitle()) ?></span>
2222
<?php /* @escapeNotVerified */ echo $block->getFormatedPrice() ?>
2323
</label>
2424
<?php if ($_fileExists): ?>
2525
<div class="control">
26-
<span class="<?php /* @escapeNotVerified */ echo $_fileNamed ?>"><?php /* @escapeNotVerified */ echo $_fileInfo->getTitle(); ?></span>
27-
<a href="javascript:void(0)" class="label" id="change-<?php /* @escapeNotVerified */ echo $_fileName ?>" >
26+
<span class="<?php /* @noEscape */ echo $_fileNamed ?>"><?php echo $block->escapeHtml($_fileInfo->getTitle()); ?></span>
27+
<a href="javascript:void(0)" class="label" id="change-<?php /* @noEscape */ echo $_fileName ?>" >
2828
<?php /* @escapeNotVerified */ echo __('Change') ?>
2929
</a>
3030
<?php if (!$_option->getIsRequire()): ?>
@@ -35,8 +35,8 @@
3535
<?php endif; ?>
3636
<div class="control" id="input-box-<?php /* @escapeNotVerified */ echo $_fileName ?>"
3737
data-mage-init='{"priceOptionFile":{
38-
"fileName":"<?php /* @escapeNotVerified */ echo $_fileName ?>",
39-
"fileNamed":"<?php /* @escapeNotVerified */ echo $_fileNamed ?>",
38+
"fileName":"<?php /* @noEscape */ echo $_fileName ?>",
39+
"fileNamed":"<?php /* @noEscape */ echo $_fileNamed ?>",
4040
"fieldNameAction":"<?php /* @escapeNotVerified */ echo $_fieldNameAction ?>",
4141
"changeFileSelector":"#change-<?php /* @escapeNotVerified */ echo $_fileName ?>",
4242
"deleteFileSelector":"#delete-<?php /* @escapeNotVerified */ echo $_fileName ?>"}

‎app/code/Magento/CatalogRule/Plugin/Indexer/Product/Save/ApplyRulesAfterReindex.php

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
<?php
2+
/**
3+
* Copyright © 2015 Magento. All rights reserved.
4+
* See COPYING.txt for license details.
5+
*/
6+
namespace Magento\CatalogRule\Plugin\Indexer\Product\Save;
7+
8+
use Magento\CatalogRule\Model\Indexer\Product\ProductRuleProcessor;
9+
10+
class ApplyRulesAfterReindex
11+
{
12+
/**
13+
* @var ProductRuleProcessor
14+
*/
15+
protected $productRuleProcessor;
16+
17+
/**
18+
* @param ProductRuleProcessor $productRuleProcessor
19+
*/
20+
public function __construct(ProductRuleProcessor $productRuleProcessor)
21+
{
22+
$this->productRuleProcessor = $productRuleProcessor;
23+
}
24+
25+
/**
26+
* Apply catalog rules after product resource model save
27+
*
28+
* @param \Magento\Catalog\Model\Product $subject
29+
* @param callable $proceed
30+
* @return \Magento\Catalog\Model\Product
31+
*/
32+
public function aroundReindex(
33+
\Magento\Catalog\Model\Product $subject,
34+
callable $proceed
35+
) {
36+
$proceed();
37+
$this->productRuleProcessor->reindexRow($subject->getId());
38+
return;
39+
}
40+
}

‎app/code/Magento/CatalogRule/etc/webapi_rest/di.xml

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
<?xml version="1.0"?>
2+
<!--
3+
/**
4+
* Copyright © 2015 Magento. All rights reserved.
5+
* See COPYING.txt for license details.
6+
*/
7+
-->
8+
<config xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="urn:magento:framework:ObjectManager/etc/config.xsd">
9+
<type name="Magento\Catalog\Model\Product">
10+
<plugin name="apply_catalog_rules_after_product_save_and_reindex" type="Magento\CatalogRule\Plugin\Indexer\Product\Save\ApplyRulesAfterReindex"/>
11+
</type>
12+
</config>

‎app/code/Magento/CatalogSearch/Model/Adapter/Mysql/Filter/Preprocessor.php

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -107,7 +107,7 @@ private function processQueryWithField(FilterInterface $filter, $isNegation, $qu
107107
$query
108108
);
109109
} elseif ($filter->getField() === 'category_ids') {
110-
return 'category_ids_index.category_id = ' . $filter->getValue();
110+
return 'category_ids_index.category_id = ' . (int) $filter->getValue();
111111
} elseif ($attribute->isStatic()) {
112112
$alias = $this->tableMapper->getMappingAlias($filter);
113113
$resultQuery = str_replace(
@@ -194,10 +194,10 @@ private function processTermSelect(FilterInterface $filter, $isNegation)
194194
$value = sprintf(
195195
'%s IN (%s)',
196196
($isNegation ? 'NOT' : ''),
197-
implode(',', $filter->getValue())
197+
implode(',', array_map([$this->connection, 'quote'], $filter->getValue()))
198198
);
199199
} else {
200-
$value = ($isNegation ? '!' : '') . '= ' . $filter->getValue();
200+
$value = ($isNegation ? '!' : '') . '= ' . $this->connection->quote($filter->getValue());
201201
}
202202
$resultQuery = sprintf(
203203
'%1$s.value %2$s',

‎app/code/Magento/CatalogSearch/Test/Unit/Model/Adapter/Mysql/Filter/PreprocessorTest.php

Lines changed: 21 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -104,7 +104,7 @@ protected function setUp()
104104
->getMock();
105105
$this->connection = $this->getMockBuilder('\Magento\Framework\DB\Adapter\AdapterInterface')
106106
->disableOriginalConstructor()
107-
->setMethods(['select', 'getIfNullSql'])
107+
->setMethods(['select', 'getIfNullSql', 'quote'])
108108
->getMockForAbstractClass();
109109
$this->select = $this->getMockBuilder('\Magento\Framework\DB\Select')
110110
->disableOriginalConstructor()
@@ -170,9 +170,25 @@ public function testProcessPrice()
170170
$this->assertSame($expectedResult, $this->removeWhitespaces($actualResult));
171171
}
172172

173-
public function testProcessCategoryIds()
173+
/**
174+
* @return array
175+
*/
176+
public function processCategoryIdsDataProvider()
177+
{
178+
return [
179+
['5', 'category_ids_index.category_id = 5'],
180+
[3, 'category_ids_index.category_id = 3'],
181+
["' and 1 = 0", 'category_ids_index.category_id = 0'],
182+
];
183+
}
184+
185+
/**
186+
* @param string|int $categoryId
187+
* @param string $expectedResult
188+
* @dataProvider processCategoryIdsDataProvider
189+
*/
190+
public function testProcessCategoryIds($categoryId, $expectedResult)
174191
{
175-
$expectedResult = 'category_ids_index.category_id = FilterValue';
176192
$isNegation = false;
177193
$query = 'SELECT category_ids FROM catalog_product_entity';
178194

@@ -182,7 +198,7 @@ public function testProcessCategoryIds()
182198

183199
$this->filter->expects($this->once())
184200
->method('getValue')
185-
->will($this->returnValue('FilterValue'));
201+
->will($this->returnValue($categoryId));
186202

187203
$this->config->expects($this->exactly(1))
188204
->method('getAttribute')
@@ -249,6 +265,7 @@ public function testProcessTermFilter($frontendInput, $fieldValue, $isNegation,
249265
->method('getValue')
250266
->willReturn($fieldValue);
251267

268+
$this->connection->expects($this->atLeastOnce())->method('quote')->willReturnArgument(0);
252269
$actualResult = $this->target->process($this->filter, $isNegation, 'This filter is not depends on used query');
253270
$this->assertSame($expected, $this->removeWhitespaces($actualResult));
254271
}

‎app/code/Magento/Checkout/Controller/Cart/Delete.php

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,10 @@ class Delete extends \Magento\Checkout\Controller\Cart
1515
*/
1616
public function execute()
1717
{
18+
if (!$this->_formKeyValidator->validate($this->getRequest())) {
19+
return $this->resultRedirectFactory->create()->setPath('*/*/');
20+
}
21+
1822
$id = (int)$this->getRequest()->getParam('id');
1923
if ($id) {
2024
try {

‎app/code/Magento/Review/Controller/Product/Post.php

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -37,10 +37,10 @@ public function execute()
3737
$data = $this->getRequest()->getPostValue();
3838
$rating = $this->getRequest()->getParam('ratings', []);
3939
}
40-
4140
if (($product = $this->initProduct()) && !empty($data)) {
4241
/** @var \Magento\Review\Model\Review $review */
4342
$review = $this->reviewFactory->create()->setData($data);
43+
$review->unsetData('review_id');
4444

4545
$validate = $review->validate();
4646
if ($validate === true) {

‎app/code/Magento/Review/Test/Unit/Controller/Product/PostTest.php

Lines changed: 8 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -127,7 +127,7 @@ public function setUp()
127127
'\Magento\Review\Model\Review',
128128
[
129129
'setData', 'validate', 'setEntityId', 'getEntityIdByCode', 'setEntityPkValue', 'setStatusId',
130-
'setCustomerId', 'setStoreId', 'setStores', 'save', 'getId', 'aggregate'
130+
'setCustomerId', 'setStoreId', 'setStores', 'save', 'getId', 'aggregate', 'unsetData'
131131
],
132132
[],
133133
'',
@@ -219,7 +219,10 @@ public function setUp()
219219
*/
220220
public function testExecute()
221221
{
222-
$ratingsData = ['ratings' => [1 => 1]];
222+
$reviewData = [
223+
'ratings' => [1 => 1],
224+
'review_id' => 2
225+
];
223226
$productId = 1;
224227
$customerId = 1;
225228
$storeId = 1;
@@ -230,7 +233,7 @@ public function testExecute()
230233
->willReturn(true);
231234
$this->reviewSession->expects($this->any())->method('getFormData')
232235
->with(true)
233-
->willReturn($ratingsData);
236+
->willReturn($reviewData);
234237
$this->request->expects($this->at(0))->method('getParam')
235238
->with('category', false)
236239
->willReturn(false);
@@ -260,7 +263,7 @@ public function testExecute()
260263
->with('product', $product)
261264
->willReturnSelf();
262265
$this->review->expects($this->once())->method('setData')
263-
->with($ratingsData)
266+
->with($reviewData)
264267
->willReturnSelf();
265268
$this->review->expects($this->once())->method('validate')
266269
->willReturn(true);
@@ -270,6 +273,7 @@ public function testExecute()
270273
$this->review->expects($this->once())->method('setEntityId')
271274
->with(1)
272275
->willReturnSelf();
276+
$this->review->expects($this->once())->method('unsetData')->with('review_id');
273277
$product->expects($this->exactly(2))
274278
->method('getId')
275279
->willReturn($productId);

‎app/code/Magento/Sales/Helper/Guest.php

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -176,7 +176,7 @@ public function loadValidOrder(App\RequestInterface $request)
176176
$errors = true;
177177
if (!empty($protectCode) && !empty($incrementId)) {
178178
$order->loadByIncrementId($incrementId);
179-
if ($order->getProtectCode() == $protectCode) {
179+
if ($order->getProtectCode() === $protectCode) {
180180
// renew cookie
181181
$this->setGuestViewCookie($fromCookie);
182182
$errors = false;

‎app/code/Magento/SampleData/Console/Command/SampleDataDeployCommand.php

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -80,7 +80,7 @@ protected function execute(InputInterface $input, OutputInterface $output)
8080
$sampleDataPackages = $this->sampleDataDependency->getSampleDataPackages();
8181
if (!empty($sampleDataPackages)) {
8282
$baseDir = $this->filesystem->getDirectoryRead(DirectoryList::ROOT)->getAbsolutePath();
83-
$commonArgs = ['--working-dir' => $baseDir, '--no-interaction' => 1, '--no-progress' => 1];
83+
$commonArgs = ['--working-dir' => $baseDir, '--no-progress' => 1];
8484
$packages = [];
8585
foreach ($sampleDataPackages as $name => $version) {
8686
$packages[] = "$name:$version";

‎app/code/Magento/Search/Model/Query.php

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -172,6 +172,12 @@ public function getSuggestCollection()
172172
public function loadByQuery($text)
173173
{
174174
$this->_getResource()->loadByQuery($this, $text);
175+
176+
$synonymFor = $this->getSynonymFor();
177+
if (!empty($synonymFor)) {
178+
$this->setQueryText($synonymFor);
179+
}
180+
175181
$this->_afterLoad();
176182
$this->setOrigData();
177183
return $this;

0 commit comments

Comments
 (0)