Skip to content

Commit c68a963

Browse files
author
Alexander Akimov
authored
Merge pull request #2779 from magento-plankton/2.2.5-merged
[Plankton]: Merge 2.2.5 Release into 2.2-develop Branch
2 parents 9f0ef00 + 3f9af07 commit c68a963

File tree

199 files changed

+2552
-732
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

199 files changed

+2552
-732
lines changed

‎CHANGELOG.md

Lines changed: 144 additions & 0 deletions
Large diffs are not rendered by default.

‎app/code/Magento/AdminNotification/composer.json

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@
1111
"lib-libxml": "*"
1212
},
1313
"type": "magento2-module",
14-
"version": "100.2.2",
14+
"version": "100.2.3",
1515
"license": [
1616
"OSL-3.0",
1717
"AFL-3.0"

‎app/code/Magento/AdvancedPricingImportExport/composer.json

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@
1313
"magento/framework": "101.0.*"
1414
},
1515
"type": "magento2-module",
16-
"version": "100.2.2",
16+
"version": "100.2.3",
1717
"license": [
1818
"OSL-3.0",
1919
"AFL-3.0"

‎app/code/Magento/Analytics/composer.json

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@
1010
"magento/framework": "101.0.*"
1111
},
1212
"type": "magento2-module",
13-
"version": "100.2.1",
13+
"version": "100.2.2",
1414
"license": [
1515
"OSL-3.0",
1616
"AFL-3.0"

‎app/code/Magento/Authorization/composer.json

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@
77
"magento/framework": "101.0.*"
88
},
99
"type": "magento2-module",
10-
"version": "100.2.0",
10+
"version": "100.2.1",
1111
"license": [
1212
"OSL-3.0",
1313
"AFL-3.0"

‎app/code/Magento/Authorizenet/composer.json

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@
1616
"magento/module-config": "101.0.*"
1717
},
1818
"type": "magento2-module",
19-
"version": "100.2.0",
19+
"version": "100.2.1",
2020
"license": [
2121
"proprietary"
2222
],

‎app/code/Magento/Backend/composer.json

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@
2424
"magento/module-theme": "100.2.*"
2525
},
2626
"type": "magento2-module",
27-
"version": "100.2.4",
27+
"version": "100.2.5",
2828
"license": [
2929
"OSL-3.0",
3030
"AFL-3.0"

‎app/code/Magento/Backup/composer.json

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@
99
"magento/framework": "101.0.*"
1010
},
1111
"type": "magento2-module",
12-
"version": "100.2.3",
12+
"version": "100.2.4",
1313
"license": [
1414
"OSL-3.0",
1515
"AFL-3.0"

‎app/code/Magento/Braintree/composer.json

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,7 @@
2525
"magento/module-theme": "100.2.*"
2626
},
2727
"type": "magento2-module",
28-
"version": "100.2.4",
28+
"version": "100.2.5",
2929
"license": [
3030
"proprietary"
3131
],

‎app/code/Magento/Bundle/composer.json

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,7 @@
2626
"magento/module-sales-rule": "101.0.*"
2727
},
2828
"type": "magento2-module",
29-
"version": "100.2.3",
29+
"version": "100.2.4",
3030
"license": [
3131
"OSL-3.0",
3232
"AFL-3.0"

‎app/code/Magento/BundleImportExport/composer.json

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@
1212
"magento/framework": "101.0.*"
1313
},
1414
"type": "magento2-module",
15-
"version": "100.2.1",
15+
"version": "100.2.2",
1616
"license": [
1717
"OSL-3.0",
1818
"AFL-3.0"

‎app/code/Magento/CacheInvalidate/composer.json

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@
77
"magento/framework": "101.0.*"
88
},
99
"type": "magento2-module",
10-
"version": "100.2.0",
10+
"version": "100.2.1",
1111
"license": [
1212
"OSL-3.0",
1313
"AFL-3.0"

‎app/code/Magento/Captcha/composer.json

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@
1313
"zendframework/zend-session": "^2.7.3"
1414
},
1515
"type": "magento2-module",
16-
"version": "100.2.1",
16+
"version": "100.2.2",
1717
"license": [
1818
"OSL-3.0",
1919
"AFL-3.0"

‎app/code/Magento/Catalog/Model/ImageUploader.php

Lines changed: 18 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,8 @@
33
* Copyright © Magento, Inc. All rights reserved.
44
* See COPYING.txt for license details.
55
*/
6+
declare(strict_types=1);
7+
68
namespace Magento\Catalog\Model;
79

810
/**
@@ -64,6 +66,18 @@ class ImageUploader
6466
*/
6567
protected $allowedExtensions;
6668

69+
/**
70+
* List of allowed image mime types
71+
*
72+
* @var array
73+
*/
74+
private $allowedMimeTypes = [
75+
'image/jpg',
76+
'image/jpeg',
77+
'image/gif',
78+
'image/png'
79+
];
80+
6781
/**
6882
* ImageUploader constructor
6983
*
@@ -218,6 +232,7 @@ public function moveFileFromTmp($imageName)
218232
* @return string[]
219233
*
220234
* @throws \Magento\Framework\Exception\LocalizedException
235+
* @throws \Exception
221236
*/
222237
public function saveFileToTmpDir($fileId)
223238
{
@@ -227,7 +242,9 @@ public function saveFileToTmpDir($fileId)
227242
$uploader = $this->uploaderFactory->create(['fileId' => $fileId]);
228243
$uploader->setAllowedExtensions($this->getAllowedExtensions());
229244
$uploader->setAllowRenameFiles(true);
230-
245+
if (!$uploader->checkMimeType($this->allowedMimeTypes)) {
246+
throw new \Magento\Framework\Exception\LocalizedException(__('File validation failed.'));
247+
}
231248
$result = $uploader->save($this->mediaDirectory->getAbsolutePath($baseTmpPath));
232249
unset($result['path']);
233250

‎app/code/Magento/Catalog/Model/Indexer/Category/Product/TableMaintainer.php

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@
1111
use Magento\Framework\Search\Request\Dimension;
1212
use Magento\Framework\DB\Adapter\AdapterInterface;
1313
use Magento\Catalog\Model\Indexer\Category\Product\AbstractAction;
14-
use Magento\Framework\Search\Request\IndexScopeResolverInterface as TableResolver;
14+
use Magento\Framework\Indexer\ScopeResolver\IndexScopeResolver as TableResolver;
1515

1616
/**
1717
* Class encapsulate logic of work with tables per store in Category Product indexer

‎app/code/Magento/Catalog/Model/Product/Gallery/UpdateHandler.php

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -32,6 +32,9 @@ protected function processDeletedImages($product, array &$images)
3232
foreach ($images as &$image) {
3333
if (!empty($image['removed'])) {
3434
if (!empty($image['value_id']) && !isset($picturesInOtherStores[$image['file']])) {
35+
if (preg_match('/\.\.(\\\|\/)/', $image['file'])) {
36+
continue;
37+
}
3538
$recordsToDelete[] = $image['value_id'];
3639
$catalogPath = $this->mediaConfig->getBaseMediaPath();
3740
$isFile = $this->mediaDirectory->isFile($catalogPath . $image['file']);

‎app/code/Magento/Catalog/Test/Unit/Model/ImageUploaderTest.php

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -114,6 +114,12 @@ protected function setUp()
114114
public function testSaveFileToTmpDir()
115115
{
116116
$fileId = 'file.jpg';
117+
$allowedMimeTypes = [
118+
'image/jpg',
119+
'image/jpeg',
120+
'image/gif',
121+
'image/png'
122+
];
117123
/** @var \Magento\MediaStorage\Model\File\Uploader|\PHPUnit_Framework_MockObject_MockObject $uploader */
118124
$uploader = $this->createMock(\Magento\MediaStorage\Model\File\Uploader::class);
119125
$this->uploaderFactoryMock->expects($this->once())->method('create')->willReturn($uploader);
@@ -123,6 +129,7 @@ public function testSaveFileToTmpDir()
123129
->willReturn($this->basePath);
124130
$uploader->expects($this->once())->method('save')->with($this->basePath)
125131
->willReturn(['tmp_name' => $this->baseTmpPath, 'file' => $fileId, 'path' => $this->basePath]);
132+
$uploader->expects($this->atLeastOnce())->method('checkMimeType')->with($allowedMimeTypes)->willReturn(true);
126133
$storeMock = $this->createPartialMock(
127134
\Magento\Store\Model\Store::class,
128135
['getBaseUrl']

‎app/code/Magento/Catalog/composer.json

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -34,7 +34,7 @@
3434
"magento/module-catalog-sample-data": "Sample Data version:100.2.*"
3535
},
3636
"type": "magento2-module",
37-
"version": "102.0.4",
37+
"version": "102.0.5",
3838
"license": [
3939
"OSL-3.0",
4040
"AFL-3.0"

‎app/code/Magento/Catalog/view/adminhtml/requirejs-config.js

Lines changed: 7 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -6,12 +6,13 @@
66
var config = {
77
map: {
88
'*': {
9-
categoryForm: 'Magento_Catalog/catalog/category/form',
10-
newCategoryDialog: 'Magento_Catalog/js/new-category-dialog',
11-
categoryTree: 'Magento_Catalog/js/category-tree',
12-
productGallery: 'Magento_Catalog/js/product-gallery',
13-
baseImage: 'Magento_Catalog/catalog/base-image-uploader',
14-
productAttributes: 'Magento_Catalog/catalog/product-attributes'
9+
categoryForm: 'Magento_Catalog/catalog/category/form',
10+
newCategoryDialog: 'Magento_Catalog/js/new-category-dialog',
11+
categoryTree: 'Magento_Catalog/js/category-tree',
12+
productGallery: 'Magento_Catalog/js/product-gallery',
13+
baseImage: 'Magento_Catalog/catalog/base-image-uploader',
14+
productAttributes: 'Magento_Catalog/catalog/product-attributes',
15+
categoryCheckboxTree: 'Magento_Catalog/js/category-checkbox-tree'
1516
}
1617
},
1718
deps: [

‎app/code/Magento/Catalog/view/adminhtml/templates/catalog/category/checkboxes/tree.phtml

Lines changed: 22 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -10,26 +10,28 @@
1010
*/
1111
?>
1212

13-
<?php $_divId = 'tree-div_' . time() ?>
14-
<div id="<?= /* @escapeNotVerified */ $_divId ?>" class="tree"></div>
13+
<?php $divId = $block->escapeHtml('tree-div_' . time()) ?>
14+
<div id="<?= /* @noEscape */ $divId ?>" class="tree"></div>
1515
<script id="ie-deferred-loader" defer="defer" src="//:"></script>
1616

17-
<script>
18-
require(["Magento_Catalog/js/category-checkbox-tree"], function (element) {
19-
element({
20-
"dataUrl": "<?= /* @escapeNotVerified */ $block->getLoadTreeUrl() ?>" ,
21-
"divId": "<?= /* @escapeNotVerified */$_divId ?>",
22-
"rootVisible": <?php if ($block->getRoot()->getIsVisible()): ?>true<?php else : ?>false<?php endif; ?>,
23-
"useAjax": <?= /* @escapeNotVerified */ $block->getUseAjax() ?>,
24-
"currentNodeId": <?= (int)$block->getCategoryId() ?>,
25-
"jsFormObject": <?= /* @escapeNotVerified */ $block->getJsFormObject() ?>,
26-
"name": "<?= /* @escapeNotVerified */ htmlentities($block->getRoot()->getName()) ?>",
27-
"checked": "<?= /* @escapeNotVerified */ $block->getRoot()->getChecked() ?>",
28-
"allowDrop": <?php if ($block->getRoot()->getIsVisible()): ?>true<?php else : ?>false<?php endif; ?>,
29-
"rootId": <?= (int)$block->getRoot()->getId() ?>,
30-
"expanded": <?= (int)$block->getIsWasExpanded() ?>,
31-
"categoryId": <?= (int)$block->getCategoryId() ?>,
32-
"treeJson": <?= /* @escapeNotVerified */ $block->getTreeJson() ?>
33-
});
34-
})
17+
<script type="text/x-magento-init">
18+
{
19+
"*": {
20+
"categoryCheckboxTree": {
21+
"dataUrl": "<?= $block->escapeUrl($block->getLoadTreeUrl()) ?>",
22+
"divId": "<?= /* @noEscape */ $divId ?>",
23+
"rootVisible": <?= /* @noEscape */ $block->getRoot()->getIsVisible() ? 'true' : 'false' ?>,
24+
"useAjax": <?= $block->escapeHtml($block->getUseAjax()) ?>,
25+
"currentNodeId": <?= (int)$block->getCategoryId() ?>,
26+
"jsFormObject": "<?= /* @noEscape */ $block->getJsFormObject() ?>",
27+
"name": "<?= $block->escapeHtml($block->getRoot()->getName()) ?>",
28+
"checked": "<?= $block->escapeHtml($block->getRoot()->getChecked()) ?>",
29+
"allowdDrop": <?= /* @noEscape */ $block->getRoot()->getIsVisible() ? 'true' : 'false' ?>,
30+
"rootId": <?= (int)$block->getRoot()->getId() ?>,
31+
"expanded": <?= (int)$block->getIsWasExpanded() ?>,
32+
"categoryId": <?= (int)$block->getCategoryId() ?>,
33+
"treeJson": <?= /* @noEscape */ $block->getTreeJson() ?>
34+
}
35+
}
36+
}
3537
</script>

‎app/code/Magento/Catalog/view/adminhtml/web/js/category-checkbox-tree.js

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -12,15 +12,14 @@ define([
1212
'use strict';
1313

1414
return function (config) {
15-
1615
var tree,
1716
options = {
1817
dataUrl: config.dataUrl,
1918
divId: config.divId,
2019
rootVisible: config.rootVisible,
2120
useAjax: config.useAjax,
2221
currentNodeId: config.currentNodeId,
23-
jsFormObject: config.jsFormObject,
22+
jsFormObject: window[config.jsFormObject],
2423
name: config.name,
2524
checked: config.checked,
2625
allowDrop: config.allowDrop,
@@ -60,8 +59,8 @@ define([
6059
*/
6160
loadTree: function (config, firstLoad) {// eslint-disable-line no-shadow
6261
parameters = config.parameters,
63-
data = config.data,
64-
root = new Ext.tree.TreeNode(parameters);// eslint-disable-line no-undef
62+
data = config.data,
63+
root = new Ext.tree.TreeNode(parameters);// eslint-disable-line no-undef
6564

6665
if (typeof parameters.rootVisible != 'undefined') {
6766
this.rootVisible = parameters.rootVisible * 1;

‎app/code/Magento/CatalogAnalytics/composer.json

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@
77
"magento/module-catalog": "102.0.*"
88
},
99
"type": "magento2-module",
10-
"version": "100.2.0",
10+
"version": "100.2.1",
1111
"license": [
1212
"OSL-3.0",
1313
"AFL-3.0"

‎app/code/Magento/CatalogImportExport/Model/Import/Uploader.php

Lines changed: 17 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -7,12 +7,14 @@
77

88
use Magento\Framework\App\Filesystem\DirectoryList;
99
use Magento\Framework\Filesystem\DriverPool;
10+
use Magento\Framework\App\ObjectManager;
1011

1112
/**
1213
* Import entity product model
1314
*
1415
* @api
1516
* @since 100.0.2
17+
* @SuppressWarnings(PHPMD.CouplingBetweenObjects)
1618
*/
1719
class Uploader extends \Magento\MediaStorage\Model\File\Uploader
1820
{
@@ -94,6 +96,11 @@ class Uploader extends \Magento\MediaStorage\Model\File\Uploader
9496
*/
9597
protected $_coreFileStorage;
9698

99+
/**
100+
* @var \Magento\Framework\App\Filesystem\DirectoryResolver
101+
*/
102+
private $directoryResolver;
103+
97104
/**
98105
* @param \Magento\MediaStorage\Helper\File\Storage\Database $coreFileStorageDb
99106
* @param \Magento\MediaStorage\Helper\File\Storage $coreFileStorage
@@ -102,6 +109,7 @@ class Uploader extends \Magento\MediaStorage\Model\File\Uploader
102109
* @param \Magento\Framework\Filesystem $filesystem
103110
* @param \Magento\Framework\Filesystem\File\ReadFactory $readFactory
104111
* @param null $filePath
112+
* @param \Magento\Framework\App\Filesystem\DirectoryResolver|null $directoryResolver
105113
* @throws \Magento\Framework\Exception\LocalizedException
106114
*/
107115
public function __construct(
@@ -111,7 +119,8 @@ public function __construct(
111119
\Magento\MediaStorage\Model\File\Validator\NotProtectedExtension $validator,
112120
\Magento\Framework\Filesystem $filesystem,
113121
\Magento\Framework\Filesystem\File\ReadFactory $readFactory,
114-
$filePath = null
122+
$filePath = null,
123+
\Magento\Framework\App\Filesystem\DirectoryResolver $directoryResolver = null
115124
) {
116125
if ($filePath !== null) {
117126
$this->_setUploadFile($filePath);
@@ -122,6 +131,8 @@ public function __construct(
122131
$this->_validator = $validator;
123132
$this->_directory = $filesystem->getDirectoryWrite(DirectoryList::ROOT);
124133
$this->_readFactory = $readFactory;
134+
$this->directoryResolver = $directoryResolver
135+
?: ObjectManager::getInstance()->get(\Magento\Framework\App\Filesystem\DirectoryResolver::class);
125136
}
126137

127138
/**
@@ -232,6 +243,7 @@ protected function _validateFile()
232243

233244
$fileExtension = pathinfo($filePath, PATHINFO_EXTENSION);
234245
if (!$this->checkAllowedExtension($fileExtension)) {
246+
$this->_directory->delete($filePath);
235247
throw new \Exception('Disallowed file type.');
236248
}
237249
//run validate callbacks
@@ -277,7 +289,10 @@ public function getTmpDir()
277289
*/
278290
public function setTmpDir($path)
279291
{
280-
if (is_string($path) && $this->_directory->isReadable($path)) {
292+
if (is_string($path)
293+
&& $this->_directory->isReadable($path)
294+
&& $this->directoryResolver->validatePath($this->_directory->getAbsolutePath($path), DirectoryList::ROOT)
295+
) {
281296
$this->_tmpDir = $path;
282297
return true;
283298
}

0 commit comments

Comments
 (0)