ACP2E-3501: VAPT: Business Logic Error - future date as customer date of birth

Author: veloraven

app/code/Magento/Customer/Model/Validator/Dob.php

@@ -9,13 +9,28 @@
 
 use DateTimeZone;
 use Magento\Customer\Model\Customer;
+use Magento\Framework\Stdlib\DateTime\TimezoneInterface;
 use Magento\Framework\Validator\AbstractValidator;
+use Magento\Store\Model\ScopeInterface;
 
 /**
  * Customer dob field validator.
  */
 class Dob extends AbstractValidator
 {
+    /**
+     * @var TimezoneInterface
+     */
+    private $timezone;
+
+    /**
+     * @param TimezoneInterface $timezone
+     */
+    public function __construct(TimezoneInterface $timezone)
+    {
+        $this->timezone = $timezone;
+    }
+
     /**
      * Validate dob field.
      *
@@ -24,7 +39,9 @@ class Dob extends AbstractValidator
      */
     public function isValid($customer): bool
     {
-        $timezone = new DateTimeZone($customer->getStore()->getConfig('general/locale/timezone'));
+        $storeId = (int)$customer->getStoreId();
+        $timezone = new DateTimeZone($this->timezone->getConfigTimezone(ScopeInterface::SCOPE_STORE, $storeId));
+
         if (!$this->isValidDob($customer->getDob(), $timezone)) {
             $this->_addMessages([['dob' => 'The Date of Birth should not be greater than today.']]);
         }
@@ -36,7 +53,7 @@ public function isValid($customer): bool
      * Check if specified dob is not in the future
      *
      * @param string|null $dobValue
-     * @param DateTimeZone $timezone
+     * @param DateTimeZone|null $timezone
      * @return bool
      */
     private function isValidDob(?string $dobValue, ?DateTimeZone $timezone = null): bool

dev/tests/integration/testsuite/Magento/CustomerImportExport/Model/Export/CustomerTest.php

@@ -1,7 +1,7 @@
 <?php
 /**
- * Copyright 2012 Adobe
- * All Rights Reserved.
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
  */
 
 namespace Magento\CustomerImportExport\Model\Export;
@@ -69,12 +69,12 @@ protected function setUp(): void
     }
 
     /**
-     * Export with Multi Websites "Customer Main File".
+     * Export "Customer Main File".
      *
-     * @magentoDataFixture Magento/Customer/_files/import_export/customers_with_websites.php
+     * @magentoDataFixture Magento/Customer/_files/import_export/customers.php
      * @return void
      */
-    public function testExportWithMultiWebsites(): void
+    public function testExport()
     {
         $this->processCustomerAttribute();
         $expectedAttributes = $this->getExpectedAttributes();
@@ -83,12 +83,12 @@ public function testExportWithMultiWebsites(): void
     }
 
     /**
-     * Export "Customer Main File".
+     * Export with Multi Websites "Customer Main File".
      *
-     * @magentoDataFixture Magento/Customer/_files/import_export/customers.php
+     * @magentoDataFixture Magento/Customer/_files/import_export/customers_with_websites.php
      * @return void
      */
-    public function testExport()
+    public function testExportWithMultiWebsites(): void
     {
         $this->processCustomerAttribute();
         $expectedAttributes = $this->getExpectedAttributes();