Merge pull request #9756 from magento-cia/cia-2.4.9-alpha1-develop-bugfix-04282025

pawan-adobe-security · web-flow · commit 5a689f657aa5 · 2025-04-29T13:14:34.000+05:30
Cia 2.4.9-alpha1-develop Bugfix 04282025
diff --git a/app/code/Magento/Cms/Test/Unit/Ui/Component/Listing/DataProviderTest.php b/app/code/Magento/Cms/Test/Unit/Ui/Component/Listing/DataProviderTest.php
@@ -1,6 +1,6 @@
 <?php
 /**
- * Copyright 2016 Adobe
+ * Copyright 2025 Adobe
  * All Rights Reserved.
  */
 declare(strict_types=1);
@@ -12,7 +12,7 @@
 use Magento\Framework\Api\Search\SearchCriteriaBuilder;
 use Magento\Framework\App\ObjectManager;
 use Magento\Framework\App\RequestInterface;
-use Magento\Framework\Authorization;
+use Magento\Framework\AuthorizationInterface;
 use Magento\Framework\ObjectManagerInterface;
 use Magento\Framework\View\Element\UiComponent\DataProvider\Reporting;
 use Magento\Ui\Component\Container;
@@ -23,49 +23,49 @@
 class DataProviderTest extends TestCase
 {
     /**
-     * @var Authorization|MockObject
+     * @var AuthorizationInterface|MockObject
      */
-    private $authorizationMock;
+    private AuthorizationInterface|MockObject $authorizationMock;
 
     /**
      * @var Reporting|MockObject
      */
-    private $reportingMock;
+    private Reporting|MockObject $reportingMock;
 
     /**
      * @var SearchCriteriaBuilder|MockObject
      */
-    private $searchCriteriaBuilderMock;
+    private SearchCriteriaBuilder|MockObject $searchCriteriaBuilderMock;
 
     /**
      * @var RequestInterface|MockObject
      */
-    private $requestInterfaceMock;
+    private RequestInterface|MockObject $requestInterfaceMock;
 
     /**
      * @var FilterBuilder|MockObject
      */
-    private $filterBuilderMock;
+    private FilterBuilder|MockObject $filterBuilderMock;
 
     /**
      * @var DataProvider
      */
-    private $dataProvider;
+    private DataProvider $dataProvider;
 
     /**
      * @var string
      */
-    private $name = 'cms_page_listing_data_source';
+    private string $name = 'cms_page_listing_data_source';
 
     /**
      * @var string
      */
-    private $primaryFieldName = 'page';
+    private string $primaryFieldName = 'page';
 
     /**
      * @var string
      */
-    private $requestFieldName = 'id';
+    private string $requestFieldName = 'id';
 
     /**
      * @var array
@@ -80,30 +80,20 @@ class DataProviderTest extends TestCase
 
     protected function setUp(): void
     {
-        $this->authorizationMock = $this->getMockBuilder(Authorization::class)
-            ->disableOriginalConstructor()
-            ->getMock();
+        $this->authorizationMock = $this->createMock(AuthorizationInterface::class);
 
-        $this->reportingMock = $this->getMockBuilder(Reporting::class)
-            ->disableOriginalConstructor()
-            ->getMock();
+        $this->reportingMock = $this->createMock(Reporting::class);
 
-        $this->searchCriteriaBuilderMock = $this->getMockBuilder(SearchCriteriaBuilder::class)
-            ->disableOriginalConstructor()
-            ->getMock();
+        $this->searchCriteriaBuilderMock = $this->createMock(SearchCriteriaBuilder::class);
 
-        $this->requestInterfaceMock = $this->getMockBuilder(RequestInterface::class)
-            ->disableOriginalConstructor()
-            ->getMockForAbstractClass();
+        $this->requestInterfaceMock = $this->createMock(RequestInterface::class);
 
-        $this->filterBuilderMock = $this->getMockBuilder(FilterBuilder::class)
-            ->disableOriginalConstructor()
-            ->getMock();
+        $this->filterBuilderMock = $this->createMock(FilterBuilder::class);
 
         /** @var ObjectManagerInterface|MockObject $objectManagerMock */
-        $objectManagerMock = $this->getMockForAbstractClass(ObjectManagerInterface::class);
-        $objectManagerMock->expects($this->once())
-            ->method('get')
+        $objectManagerMock = $this->createMock(ObjectManagerInterface::class);
+        $objectManagerMock->method('get')
+            ->with(AuthorizationInterface::class)
             ->willReturn($this->authorizationMock);
         ObjectManager::setInstance($objectManagerMock);
 
@@ -121,15 +111,14 @@ protected function setUp(): void
     /**
      * @covers \Magento\Cms\Ui\Component\DataProvider::prepareMetadata
      */
-    public function testPrepareMetadata()
+    public function testPrepareMetadata(): void
     {
         $this->authorizationMock->expects($this->exactly(2))
             ->method('isAllowed')
             ->willReturnMap(
                 [
                     ['Magento_Cms::save', null, false],
                     ['Magento_Cms::save_design', null, false],
-
                 ]
             );
 
@@ -168,4 +157,24 @@ public function testPrepareMetadata()
             $this->dataProvider->prepareMetadata()
         );
     }
+
+    /**
+     * @covers \Magento\Cms\Ui\Component\DataProvider::prepareMetadata
+     */
+    public function testPrepareMetadataForCmsBlockListing(): void
+    {
+        $name = 'cms_block_listing_data_source';
+
+        $this->dataProvider = new DataProvider(
+            $name,
+            $this->primaryFieldName,
+            $this->requestFieldName,
+            $this->reportingMock,
+            $this->searchCriteriaBuilderMock,
+            $this->requestInterfaceMock,
+            $this->filterBuilderMock
+        );
+
+        $this->assertEquals([], $this->dataProvider->prepareMetadata());
+    }
 }
diff --git a/app/code/Magento/Cms/Ui/Component/DataProvider.php b/app/code/Magento/Cms/Ui/Component/DataProvider.php
@@ -16,10 +16,25 @@
 use Magento\Ui\Component\Container;
 
 /**
- * DataProvider for cms ui.
+ * DataProvider for cms blocks and pages listing ui components.
  */
 class DataProvider extends \Magento\Framework\View\Element\UiComponent\DataProvider\DataProvider
 {
+    /**
+     * Authorization resource for CMS Save
+     */
+    private const CMS_SAVE_RESOURCE = 'Magento_Cms::save';
+
+    /**
+     * Authorization resource for CMS save design resource
+     */
+    private const CMS_SAVE_DESIGN_RESOURCE = 'Magento_Cms::save_design';
+
+    /**
+     * Constant for CMS listing data source name
+     */
+    private const CMS_LISTING_DATA_SOURCE = 'cms_page_listing_data_source';
+
     /**
      * @var AuthorizationInterface
      */
@@ -107,38 +122,41 @@ public function prepareMetadata()
     {
         $metadata = [];
 
-        if (!$this->getAuthorizationInstance()->isAllowed('Magento_Cms::save')) {
-            $metadata = [
-                'cms_page_columns' => [
-                    'arguments' => [
-                        'data' => [
-                            'config' => [
-                                'editorConfig' => [
-                                    'enabled' => false
-                                ],
-                                'componentType' => Container::NAME
+        if ($this->name === self::CMS_LISTING_DATA_SOURCE) {
+
+            if (!$this->getAuthorizationInstance()->isAllowed(self::CMS_SAVE_RESOURCE)) {
+                $metadata = [
+                    'cms_page_columns' => [
+                        'arguments' => [
+                            'data' => [
+                                'config' => [
+                                    'editorConfig' => [
+                                        'enabled' => false
+                                    ],
+                                    'componentType' => Container::NAME
+                                ]
                             ]
                         ]
                     ]
-                ]
-            ];
-        }
+                ];
+            }
+
+            if (!$this->getAuthorizationInstance()->isAllowed(self::CMS_SAVE_DESIGN_RESOURCE)) {
 
-        if (!$this->getAuthorizationInstance()->isAllowed('Magento_Cms::save_design')) {
-
-            foreach ($this->pageLayoutColumns as $column) {
-                $metadata['cms_page_columns']['children'][$column] = [
-                    'arguments' => [
-                        'data' => [
-                            'config' => [
-                                'editor' => [
-                                    'editorType' => false
-                                ],
-                                'componentType' => Container::NAME
+                foreach ($this->pageLayoutColumns as $column) {
+                    $metadata['cms_page_columns']['children'][$column] = [
+                        'arguments' => [
+                            'data' => [
+                                'config' => [
+                                    'editor' => [
+                                        'editorType' => false
+                                    ],
+                                    'componentType' => Container::NAME
+                                ]
                             ]
                         ]
-                    ]
-                ];
+                    ];
+                }
             }
         }
 
diff --git a/app/code/Magento/Quote/Plugin/ValidateQuoteOrigOrder.php b/app/code/Magento/Quote/Plugin/ValidateQuoteOrigOrder.php
@@ -1,7 +1,17 @@
 <?php
-/**
- * Copyright 2024 Adobe
+/************************************************************************
+ * Copyright 2025 Adobe
  * All Rights Reserved.
+ *
+ * NOTICE: All information contained herein is, and remains
+ * the property of Adobe and its suppliers, if any. The intellectual
+ * and technical concepts contained herein are proprietary to Adobe
+ * and its suppliers and are protected by all applicable intellectual
+ * property laws, including trade secret and copyright laws.
+ * Dissemination of this information or reproduction of this material
+ * is strictly forbidden unless prior written permission is obtained
+ * from Adobe.
+ * ***********************************************************************
  */
 
 declare(strict_types=1);
@@ -45,10 +55,10 @@ public function beforeSave(
         CartRepositoryInterface $cartRepository,
         CartInterface $quote
     ): void {
-        if ($orderId = $quote->getOrigOrderId()) {
-            $order = $this->orderRepository->get($orderId);
+        if ($quote->getOrigOrderId() && $quote->getCustomerId()) {
+            $order = $this->orderRepository->get((int)$quote->getOrigOrderId());
             $orderCustomer = (int)$order->getCustomerId();
-            if ($quote->getCustomerId() !== $orderCustomer) {
+            if ((int)$quote->getCustomerId() !== $orderCustomer) {
                 throw new NoSuchEntityException(__('Please check input parameters.'));
             }
         }
diff --git a/app/code/Magento/Quote/etc/di.xml b/app/code/Magento/Quote/etc/di.xml
@@ -184,4 +184,7 @@
             </argument>
         </arguments>
     </type>
+    <type name="Magento\Quote\Api\CartRepositoryInterface">
+        <plugin name="quoteValidateOrderId" type="Magento\Quote\Plugin\ValidateQuoteOrigOrder"/>
+    </type>
 </config>
diff --git a/app/code/Magento/Quote/etc/webapi_rest/di.xml b/app/code/Magento/Quote/etc/webapi_rest/di.xml
@@ -20,9 +20,6 @@
         <plugin name="updateQuoteStoreId" type="Magento\Quote\Model\Quote\Plugin\UpdateQuoteStoreId" />
         <plugin name="validateQuoteAddress" type="Magento\Quote\Plugin\QuoteAddress" />
     </type>
-    <type name="Magento\Quote\Api\CartRepositoryInterface">
-        <plugin name="quoteValidateOrderId" type="Magento\Quote\Plugin\ValidateQuoteOrigOrder"/>
-    </type>
     <type name="Magento\Quote\Model\QuoteValidator">
         <plugin name="error_redirect_processor" type="Magento\Quote\Plugin\Webapi\Model\ErrorRedirectProcessor" />
     </type>
