Merge pull request #3354 from magento-tsg/2.1.16-develop-pr58

[TSG] Backporting for 2.1 (pr58) (2.1.16)

Author: Alexander Akimov

app/code/Magento/AdminNotification/Block/Grid/Renderer/Actions.php

@@ -10,6 +10,9 @@
 
 namespace Magento\AdminNotification\Block\Grid\Renderer;
 
+/**
+ * Renderer class for action in the admin notifications grid
+ */
 class Actions extends \Magento\Backend\Block\Widget\Grid\Column\Renderer\AbstractRenderer
 {
     /**
@@ -39,9 +42,9 @@ public function __construct(
      */
     public function render(\Magento\Framework\DataObject $row)
     {
-        $readDetailsHtml = $row->getUrl() ? '<a class="action-details" target="_blank" href="' . $row->getUrl() . '">' . __(
-            'Read Details'
-        ) . '</a> | ' : '';
+        $readDetailsHtml = $row->getUrl() ? '<a class="action-details" target="_blank" href="' .
+            $this->escapeUrl($row->getUrl()) . '">' .
+            __('Read Details') . '</a> | ' : '';
 
         $markAsReadHtml = !$row->getIsRead() ? '<a class="action-mark" href="' . $this->getUrl(
             '*/*/markAsRead/',

app/code/Magento/Braintree/Model/Adminhtml/System/Config/CountryCreditCard.php

@@ -8,11 +8,13 @@
 use Magento\Framework\App\Cache\TypeListInterface;
 use Magento\Framework\App\Config\ScopeConfigInterface;
 use Magento\Framework\App\Config\Value;
+use Magento\Framework\App\ObjectManager;
 use Magento\Framework\Data\Collection\AbstractDb;
 use Magento\Framework\Math\Random;
 use Magento\Framework\Model\Context;
 use Magento\Framework\Model\ResourceModel\AbstractResource;
 use Magento\Framework\Registry;
+use Magento\Framework\Unserialize\SecureUnserializer;
 
 /**
  * Class CountryCreditCard
@@ -24,6 +26,11 @@ class CountryCreditCard extends Value
      */
     protected $mathRandom;
 
+    /**
+     * @var SecureUnserializer
+     */
+    private $secureUnserializer;
+
     /**
      * @param \Magento\Framework\Model\Context $context
      * @param \Magento\Framework\Registry $registry
@@ -33,6 +40,7 @@ class CountryCreditCard extends Value
      * @param \Magento\Framework\Model\ResourceModel\AbstractResource $resource
      * @param \Magento\Framework\Data\Collection\AbstractDb $resourceCollection
      * @param array $data
+     * @param SecureUnserializer|null $secureUnserializer
      */
     public function __construct(
         Context $context,
@@ -42,9 +50,11 @@ public function __construct(
         Random $mathRandom,
         AbstractResource $resource = null,
         AbstractDb $resourceCollection = null,
-        array $data = []
+        array $data = [],
+        SecureUnserializer $secureUnserializer = null
     ) {
         $this->mathRandom = $mathRandom;
+        $this->secureUnserializer = $secureUnserializer ?: ObjectManager::getInstance()->get(SecureUnserializer::class);
         parent::__construct($context, $registry, $config, $cacheTypeList, $resource, $resourceCollection, $data);
     }
 
@@ -58,7 +68,7 @@ public function beforeSave()
         $value = $this->getValue();
         if (!is_array($value)) {
             try {
-                $value = unserialize($value);
+                $value = $this->secureUnserializer->unserialize($value);
             } catch (\InvalidArgumentException $e) {
                 $value = [];
             }

app/code/Magento/Widget/Block/Adminhtml/Widget.php

@@ -16,7 +16,7 @@
 class Widget extends \Magento\Backend\Block\Widget\Form\Container
 {
     /**
-     * @return void
+     * @inheritdoc
      */
     protected function _construct()
     {
@@ -36,12 +36,16 @@ protected function _construct()
         $this->buttonList->update('save', 'region', 'footer');
         $this->buttonList->update('save', 'data_attribute', []);
 
-        $this->_formScripts[] = 'require(["mage/adminhtml/wysiwyg/widget"], function(){wWidget = new WysiwygWidget.Widget(' .
-            '"widget_options_form", "select_widget_type", "widget_options", "' .
-            $this->getUrl(
-                'adminhtml/*/loadOptions'
-            ) . '", "' . $this->getRequest()->getParam(
-                'widget_target_id'
-            ) . '");});';
+        $this->_formScripts[] = <<<EOJS
+ 	 		require(['mage/adminhtml/wysiwyg/widget'], function() {
+ 	 		    wWidget = new WysiwygWidget.Widget(
+ 	 		        'widget_options_form',
+ 	 		        'select_widget_type',
+ 	 		        'widget_options',
+ 	 		        '{$this->getUrl('adminhtml/*/loadOptions')}',
+ 	 		        '{$this->_escaper->escapeJs((string)$this->getRequest()->getParam('widget_target_id'))}'
+ 	 		    );
+ 	 		});
+EOJS;
     }
 }

dev/tests/integration/testsuite/Magento/CatalogImportExport/Model/Import/UploaderTest.php

@@ -46,6 +46,7 @@ protected function setUp()
         $mediaPath = $appParams[DirectoryList::MEDIA][DirectoryList::PATH];
         $this->directory = $filesystem->getDirectoryWrite(DirectoryList::ROOT);
         $tmpDir = $this->directory->getRelativePath($mediaPath . '/import');
+        $this->directory->create($tmpDir);
         $this->uploader->setTmpDir($tmpDir);
 
         parent::setUp();
@@ -79,4 +80,16 @@ public function testMoveWithInvalidFile()
 
         $this->assertFalse($this->directory->isExist($this->uploader->getTmpDir() . '/' . $fileName));
     }
+
+    /**
+     * @inheritdoc
+     */
+    public static function tearDownAfterClass()
+    {
+        $filesystem = \Magento\TestFramework\Helper\Bootstrap::getObjectManager()
+            ->get(\Magento\Framework\Filesystem::class);
+        /** @var \Magento\Framework\Filesystem\Directory\WriteInterface $directory */
+        $directory = $filesystem->getDirectoryWrite(DirectoryList::MEDIA);
+        $directory->delete('import');
+    }
 }

dev/tests/integration/testsuite/Magento/Framework/App/Filesystem/DirectoryResolverTest.php

@@ -6,6 +6,7 @@
 
 namespace Magento\Framework\App\Filesystem;
 
+use Magento\Framework\App\Filesystem\DirectoryList;
 use Magento\TestFramework\Helper\Bootstrap;
 
 /**
@@ -24,9 +25,9 @@ class DirectoryResolverTest extends \PHPUnit_Framework_TestCase
     private $directoryResolver;
 
     /**
-     * @var \Magento\Framework\Filesystem\Directory\WriteInterface
+     * @var \Magento\Framework\Filesystem
      */
-    private $directory;
+    private $filesystem;
 
     /**
      * @inheritdoc
@@ -36,9 +37,7 @@ protected function setUp()
         $this->objectManager = Bootstrap::getObjectManager();
         $this->directoryResolver = $this->objectManager
             ->create(\Magento\Framework\App\Filesystem\DirectoryResolver::class);
-        /** @var \Magento\Framework\Filesystem $filesystem */
-        $filesystem = $this->objectManager->create(\Magento\Framework\Filesystem::class);
-        $this->directory = $filesystem->getDirectoryWrite(\Magento\Framework\App\Filesystem\DirectoryList::MEDIA);
+        $this->filesystem = $this->objectManager->create(\Magento\Framework\Filesystem::class);
     }
 
     /**
@@ -47,10 +46,12 @@ protected function setUp()
      * @param bool $expectation
      * @dataProvider validatePathDataProvider
      * @magentoAppIsolation enabled
+     * @return void
      */
     public function testValidatePath($path, $directoryConfig, $expectation)
     {
-        $path = $this->directory->getAbsolutePath($path);
+        $directory = $this->filesystem->getDirectoryWrite(DirectoryList::MEDIA);
+        $path = $directory->getAbsolutePath() .'/' .$path;
         $this->assertEquals($expectation, $this->directoryResolver->validatePath($path, $directoryConfig));
     }
 
@@ -60,7 +61,8 @@ public function testValidatePath($path, $directoryConfig, $expectation)
      */
     public function testValidatePathWithException()
     {
-        $path = $this->directory->getAbsolutePath();
+        $directory = $this->filesystem->getDirectoryWrite(DirectoryList::MEDIA);
+        $path = $directory->getAbsolutePath();
         $this->directoryResolver->validatePath($path, 'wrong_dir');
     }
 
@@ -76,7 +78,7 @@ public function validatePathDataProvider()
                 true,
             ],
             [
-                 '/../../pub/',
+                '/../../pub/',
                 DirectoryList::MEDIA,
                 false,
             ],