Skip to content

Commit 56a0bb7

Browse files
mrprabhu92mrprabhu92
authored
Merge pull request #10073 from magento-cia/cia-2.4.9-alpha3-develop-bugfix-09042025
Cia 2.4.9 alpha3 develop bugfix 09042025
2 parents bfb07f5 + ebd2a8f commit 56a0bb7

File tree

28 files changed

+591
-160
lines changed

28 files changed

+591
-160
lines changed

‎app/code/Magento/Backend/Block/Cache.php‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
<?php
22
/**
3-
* Copyright 2013 Adobe
3+
* Copyright 2011 Adobe
44
* All Rights Reserved.
55
*/
66
namespace Magento\Backend\Block;
@@ -35,7 +35,11 @@ protected function _construct()
3535
}
3636

3737
if ($this->_authorization->isAllowed('Magento_Backend::flush_cache_storage')) {
38-
$message = __('The cache storage may contain additional data. Are you sure that you want to flush it?');
38+
$message = $this->escapeJs(
39+
$this->escapeHtml(
40+
__('The cache storage may contain additional data. Are you sure that you want to flush it?')
41+
)
42+
);
3943
$this->buttonList->add(
4044
'flush_system',
4145
[

‎app/code/Magento/Backend/Block/System/Design/Edit.php‎

Lines changed: 22 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,13 @@
11
<?php
22
/**
3-
* Copyright 2013 Adobe
3+
* Copyright 2011 Adobe
44
* All Rights Reserved.
55
*/
66
namespace Magento\Backend\Block\System\Design;
77

8+
use Magento\Framework\Escaper;
9+
use Magento\Framework\App\ObjectManager;
10+
811
/**
912
* Edit store design schedule block.
1013
*/
@@ -16,25 +19,35 @@ class Edit extends \Magento\Backend\Block\Widget
1619
protected $_template = 'Magento_Backend::system/design/edit.phtml';
1720

1821
/**
19-
* Core registry
22+
* Application data storage
2023
*
2124
* @var \Magento\Framework\Registry
2225
*/
2326
protected $_coreRegistry = null;
2427

28+
/**
29+
* Escaper for secure output rendering
30+
*
31+
* @var Escaper
32+
*/
33+
private $escaper;
34+
2535
/**
2636
* @inheritdoc
2737
*
2838
* @param \Magento\Backend\Block\Template\Context $context
2939
* @param \Magento\Framework\Registry $registry
3040
* @param array $data
41+
* @param Escaper|null $escaper
3142
*/
3243
public function __construct(
3344
\Magento\Backend\Block\Template\Context $context,
3445
\Magento\Framework\Registry $registry,
35-
array $data = []
46+
array $data = [],
47+
?Escaper $escaper = null
3648
) {
3749
$this->_coreRegistry = $registry;
50+
$this->escaper = $escaper ?? ObjectManager::getInstance()->get(Escaper::class);
3851
parent::__construct($context, $data);
3952
}
4053

@@ -66,14 +79,17 @@ protected function _prepareLayout()
6679
);
6780

6881
if ($this->getDesignChangeId()) {
82+
$confirmMessage = $this->escaper->escapeJs(
83+
$this->escaper->escapeHtml(__('Are you sure?'))
84+
);
85+
$deleteOnClick = 'deleteConfirm(\'' . $confirmMessage . '\', \'' .
86+
$this->getDeleteUrl() . '\', {data: {}})';
6987
$this->getToolbar()->addChild(
7088
'delete_button',
7189
\Magento\Backend\Block\Widget\Button::class,
7290
[
7391
'label' => __('Delete'),
74-
'onclick' => 'deleteConfirm(\'' . __(
75-
'Are you sure?'
76-
) . '\', \'' . $this->getDeleteUrl() . '\', {data: {}})',
92+
'onclick' => $deleteOnClick,
7793
'class' => 'delete'
7894
]
7995
);

‎app/code/Magento/Backend/Block/Widget/Form/Container.php‎

Lines changed: 13 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
<?php
22
/**
3-
* Copyright 2013 Adobe
3+
* Copyright 2011 Adobe
44
* All Rights Reserved.
55
*/
66
namespace Magento\Backend\Block\Widget\Form;
@@ -13,7 +13,8 @@
1313
* Backend form container block
1414
*
1515
* @api
16-
* @deprecated 100.2.0 in favour of UI component implementation
16+
* @deprecated 100.2.0 Use UI components for form rendering instead of this legacy form container
17+
* @see \Magento\Ui\Component\Form
1718
* @SuppressWarnings(PHPMD.NumberOfChildren)
1819
* @since 100.0.2
1920
*/
@@ -45,14 +46,14 @@ class Container extends \Magento\Backend\Block\Widget\Container
4546
protected $_blockGroup = 'Magento_Backend';
4647

4748
/**
48-
* @var string
49+
* @var string
4950
*/
50-
const PARAM_BLOCK_GROUP = 'block_group';
51+
public const PARAM_BLOCK_GROUP = 'block_group';
5152

5253
/**
53-
* @var string
54+
* @var string
5455
*/
55-
const PARAM_MODE = 'mode';
56+
public const PARAM_MODE = 'mode';
5657

5758
/**
5859
* @var string
@@ -111,14 +112,17 @@ protected function _construct()
111112
$objId = (int)$this->getRequest()->getParam($this->_objectId);
112113

113114
if (!empty($objId)) {
115+
$confirmMessage = $this->escapeJs(
116+
$this->escapeHtml(__('Are you sure you want to do this?'))
117+
);
118+
$deleteOnClick = 'deleteConfirm(\'' . $confirmMessage . '\', \'' .
119+
$this->getDeleteUrl() . '\', {data: {}})';
114120
$this->addButton(
115121
'delete',
116122
[
117123
'label' => __('Delete'),
118124
'class' => 'delete',
119-
'onclick' => 'deleteConfirm(\'' . __(
120-
'Are you sure you want to do this?'
121-
) . '\', \'' . $this->getDeleteUrl() . '\', {data: {}})'
125+
'onclick' => $deleteOnClick
122126
]
123127
);
124128
}

‎app/code/Magento/Catalog/Block/Adminhtml/Category/Edit/DeleteButton.php‎

Lines changed: 36 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -7,12 +7,37 @@
77

88
use Magento\Framework\View\Element\UiComponent\Control\ButtonProviderInterface;
99
use Magento\Catalog\Block\Adminhtml\Category\AbstractCategory;
10+
use Magento\Framework\Escaper;
1011

11-
/**
12-
* Class DeleteButton
13-
*/
1412
class DeleteButton extends AbstractCategory implements ButtonProviderInterface
1513
{
14+
/**
15+
* Escaper for secure output rendering
16+
*
17+
* @var Escaper
18+
*/
19+
private $escaper;
20+
21+
/**
22+
* Constructor
23+
*
24+
* @param \Magento\Backend\Block\Template\Context $context
25+
* @param \Magento\Catalog\Model\ResourceModel\Category\Tree $categoryTree
26+
* @param \Magento\Framework\Registry $registry
27+
* @param \Magento\Catalog\Model\CategoryFactory $categoryFactory
28+
* @param array $data
29+
*/
30+
public function __construct(
31+
\Magento\Backend\Block\Template\Context $context,
32+
\Magento\Catalog\Model\ResourceModel\Category\Tree $categoryTree,
33+
\Magento\Framework\Registry $registry,
34+
\Magento\Catalog\Model\CategoryFactory $categoryFactory,
35+
array $data = []
36+
) {
37+
$this->escaper = $context->getEscaper();
38+
parent::__construct($context, $categoryTree, $registry, $categoryFactory, $data);
39+
}
40+
1641
/**
1742
* Delete button
1843
*
@@ -24,11 +49,13 @@ public function getButtonData()
2449
$categoryId = (int)$category->getId();
2550

2651
if ($categoryId && !in_array($categoryId, $this->getRootIds()) && $category->isDeleteable()) {
52+
$confirmMessage = $this->escaper->escapeJs(
53+
$this->escaper->escapeHtml(__('Are you sure you want to delete this category?'))
54+
);
2755
return [
2856
'id' => 'delete',
2957
'label' => __('Delete'),
30-
'on_click' => "deleteConfirm('" .__('Are you sure you want to delete this category?') ."', '"
31-
. $this->getDeleteUrl() . "', {data: {}})",
58+
'on_click' => "deleteConfirm('" . $confirmMessage . "', '" . $this->getDeleteUrl() . "', {data: {}})",
3259
'class' => 'delete',
3360
'sort_order' => 10
3461
];
@@ -38,6 +65,8 @@ public function getButtonData()
3865
}
3966

4067
/**
68+
* Get the delete URL for category
69+
*
4170
* @param array $args
4271
* @return string
4372
*/
@@ -48,6 +77,8 @@ public function getDeleteUrl(array $args = [])
4877
}
4978

5079
/**
80+
* Get default URL parameters
81+
*
5182
* @return array
5283
*/
5384
protected function getDefaultUrlParams()

‎app/code/Magento/CatalogRule/Block/Adminhtml/Edit/DeleteButton.php‎

Lines changed: 29 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -6,26 +6,49 @@
66
namespace Magento\CatalogRule\Block\Adminhtml\Edit;
77

88
use Magento\Framework\View\Element\UiComponent\Control\ButtonProviderInterface;
9+
use Magento\Framework\Escaper;
910

10-
/**
11-
* Class DeleteButton
12-
*/
1311
class DeleteButton extends GenericButton implements ButtonProviderInterface
1412
{
1513
/**
14+
* Escaper for secure output rendering
15+
*
16+
* @var Escaper
17+
*/
18+
private $escaper;
19+
20+
/**
21+
* Constructor
22+
*
23+
* @param \Magento\Backend\Block\Widget\Context $context
24+
* @param \Magento\Framework\Registry $registry
25+
*/
26+
public function __construct(
27+
\Magento\Backend\Block\Widget\Context $context,
28+
\Magento\Framework\Registry $registry
29+
) {
30+
$this->escaper = $context->getEscaper();
31+
parent::__construct($context, $registry);
32+
}
33+
34+
/**
35+
* Get the delete button data
36+
*
1637
* @return array
1738
*/
1839
public function getButtonData()
1940
{
2041
$data = [];
2142
$ruleId = $this->getRuleId();
2243
if ($ruleId && $this->canRender('delete')) {
44+
$confirmMessage = $this->escaper->escapeJs(
45+
$this->escaper->escapeHtml(__('Are you sure you want to do this?'))
46+
);
47+
$deleteUrl = $this->urlBuilder->getUrl('*/*/delete', ['id' => $ruleId]);
2348
$data = [
2449
'label' => __('Delete Rule'),
2550
'class' => 'delete',
26-
'on_click' => 'deleteConfirm(\'' . __(
27-
'Are you sure you want to do this?'
28-
) . '\', \'' . $this->urlBuilder->getUrl('*/*/delete', ['id' => $ruleId]) . '\', {data: {}})',
51+
'on_click' => 'deleteConfirm(\'' . $confirmMessage . '\', \'' . $deleteUrl . '\', {data: {}})',
2952
'sort_order' => 20,
3053
];
3154
}

‎app/code/Magento/CatalogRule/Block/Adminhtml/Edit/GenericButton.php‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -11,14 +11,14 @@
1111
class GenericButton
1212
{
1313
/**
14-
* Url Builder
14+
* Service for generating URLs
1515
*
1616
* @var \Magento\Framework\UrlInterface
1717
*/
1818
protected $urlBuilder;
1919

2020
/**
21-
* Registry
21+
* Application data storage
2222
*
2323
* @var \Magento\Framework\Registry
2424
*/

0 commit comments

Comments
 (0)