Skip to content

Commit 6fa92aa

Browse files
pawan-adobe-securitypawan-adobe-security
committed
Merge branch 'AC-13672' into cia-2.4.8-develop-bugfix-03052025
2 parents ba410df + dbf52ee commit 6fa92aa

File tree

3 files changed

+100
-60
lines changed

3 files changed

+100
-60
lines changed

‎app/code/Magento/Review/Controller/Product.php‎

Lines changed: 78 additions & 53 deletions
Original file line numberDiff line numberDiff line change
@@ -1,127 +1,156 @@
11
<?php
22
/**
3-
* Copyright © Magento, Inc. All rights reserved.
4-
* See COPYING.txt for license details.
3+
* Copyright 2025 Adobe
4+
* All Rights Reserved.
55
*/
6+
declare(strict_types=1);
7+
68
namespace Magento\Review\Controller;
79

10+
use Magento\Catalog\Api\CategoryRepositoryInterface;
11+
use Magento\Catalog\Api\ProductRepositoryInterface;
12+
use Magento\Catalog\Model\Design;
813
use Magento\Catalog\Model\Product as CatalogProduct;
14+
use Magento\Customer\Model\Session;
15+
use Magento\Customer\Model\Url;
16+
use Magento\Framework\App\Action\Action;
17+
use Magento\Framework\App\Action\Context;
18+
use Magento\Framework\App\ObjectManager;
19+
use Magento\Framework\Registry;
920
use Magento\Framework\App\RequestInterface;
21+
use Magento\Framework\Data\Form\FormKey\Validator;
22+
use Magento\Framework\Exception\LocalizedException;
1023
use Magento\Framework\Exception\NoSuchEntityException;
24+
use Magento\Framework\Session\Generic;
25+
use Magento\Review\Helper\Data;
26+
use Magento\Review\Model\RatingFactory;
1127
use Magento\Review\Model\Review;
28+
use Magento\Review\Model\Review\Config as ReviewsConfig;
29+
use Magento\Review\Model\ReviewFactory;
30+
use Magento\Store\Model\StoreManagerInterface;
31+
use Psr\Log\LoggerInterface;
1232

1333
/**
1434
* Review controller
1535
*
1636
* @SuppressWarnings(PHPMD.CouplingBetweenObjects)
1737
*/
18-
abstract class Product extends \Magento\Framework\App\Action\Action
38+
abstract class Product extends Action
1939
{
2040
/**
21-
* Core registry
41+
* Core Registry class
2242
*
23-
* @var \Magento\Framework\Registry
43+
* @var Registry
2444
*/
2545
protected $coreRegistry = null;
2646

2747
/**
2848
* Customer session model
2949
*
30-
* @var \Magento\Customer\Model\Session
50+
* @var Session
3151
*/
3252
protected $customerSession;
3353

3454
/**
3555
* Generic session
3656
*
37-
* @var \Magento\Framework\Session\Generic
57+
* @var Generic
3858
*/
3959
protected $reviewSession;
4060

4161
/**
4262
* Catalog category model
4363
*
44-
* @var \Magento\Catalog\Api\CategoryRepositoryInterface
64+
* @var CategoryRepositoryInterface
4565
*/
4666
protected $categoryRepository;
4767

4868
/**
49-
* Logger
69+
* Logger for adding logs
5070
*
51-
* @var \Psr\Log\LoggerInterface
71+
* @var LoggerInterface
5272
*/
5373
protected $logger;
5474

5575
/**
5676
* Catalog product model
5777
*
58-
* @var \Magento\Catalog\Api\ProductRepositoryInterface
78+
* @var ProductRepositoryInterface
5979
*/
6080
protected $productRepository;
6181

6282
/**
6383
* Review model
6484
*
65-
* @var \Magento\Review\Model\ReviewFactory
85+
* @var ReviewFactory
6686
*/
6787
protected $reviewFactory;
6888

6989
/**
7090
* Rating model
7191
*
72-
* @var \Magento\Review\Model\RatingFactory
92+
* @var RatingFactory
7393
*/
7494
protected $ratingFactory;
7595

7696
/**
7797
* Catalog design model
7898
*
79-
* @var \Magento\Catalog\Model\Design
99+
* @var Design
80100
*/
81101
protected $catalogDesign;
82102

83103
/**
84104
* Core model store manager interface
85105
*
86-
* @var \Magento\Store\Model\StoreManagerInterface
106+
* @var StoreManagerInterface
87107
*/
88108
protected $storeManager;
89109

90110
/**
91111
* Core form key validator
92112
*
93-
* @var \Magento\Framework\Data\Form\FormKey\Validator
113+
* @var Validator
94114
*/
95115
protected $formKeyValidator;
96116

97117
/**
98-
* @param \Magento\Framework\App\Action\Context $context
99-
* @param \Magento\Framework\Registry $coreRegistry
100-
* @param \Magento\Customer\Model\Session $customerSession
101-
* @param \Magento\Catalog\Api\CategoryRepositoryInterface $categoryRepository
102-
* @param \Psr\Log\LoggerInterface $logger
103-
* @param \Magento\Catalog\Api\ProductRepositoryInterface $productRepository
104-
* @param \Magento\Review\Model\ReviewFactory $reviewFactory
105-
* @param \Magento\Review\Model\RatingFactory $ratingFactory
106-
* @param \Magento\Catalog\Model\Design $catalogDesign
107-
* @param \Magento\Framework\Session\Generic $reviewSession
108-
* @param \Magento\Store\Model\StoreManagerInterface $storeManager
109-
* @param \Magento\Framework\Data\Form\FormKey\Validator $formKeyValidator
118+
* Review config
119+
*
120+
* @var ReviewsConfig
121+
*/
122+
protected $reviewsConfig;
123+
124+
/**
125+
* @param Context $context
126+
* @param Registry $coreRegistry
127+
* @param Session $customerSession
128+
* @param CategoryRepositoryInterface $categoryRepository
129+
* @param LoggerInterface $logger
130+
* @param ProductRepositoryInterface $productRepository
131+
* @param ReviewFactory $reviewFactory
132+
* @param RatingFactory $ratingFactory
133+
* @param Design $catalogDesign
134+
* @param Generic $reviewSession
135+
* @param StoreManagerInterface $storeManager
136+
* @param Validator $formKeyValidator
137+
* @param ReviewsConfig $reviewsConfig
110138
* @SuppressWarnings(PHPMD.ExcessiveParameterList)
111139
*/
112140
public function __construct(
113-
\Magento\Framework\App\Action\Context $context,
114-
\Magento\Framework\Registry $coreRegistry,
115-
\Magento\Customer\Model\Session $customerSession,
116-
\Magento\Catalog\Api\CategoryRepositoryInterface $categoryRepository,
117-
\Psr\Log\LoggerInterface $logger,
118-
\Magento\Catalog\Api\ProductRepositoryInterface $productRepository,
119-
\Magento\Review\Model\ReviewFactory $reviewFactory,
120-
\Magento\Review\Model\RatingFactory $ratingFactory,
121-
\Magento\Catalog\Model\Design $catalogDesign,
122-
\Magento\Framework\Session\Generic $reviewSession,
123-
\Magento\Store\Model\StoreManagerInterface $storeManager,
124-
\Magento\Framework\Data\Form\FormKey\Validator $formKeyValidator
141+
Context $context,
142+
Registry $coreRegistry,
143+
Session $customerSession,
144+
CategoryRepositoryInterface $categoryRepository,
145+
LoggerInterface $logger,
146+
ProductRepositoryInterface $productRepository,
147+
ReviewFactory $reviewFactory,
148+
RatingFactory $ratingFactory,
149+
Design $catalogDesign,
150+
Generic $reviewSession,
151+
StoreManagerInterface $storeManager,
152+
Validator $formKeyValidator,
153+
ReviewsConfig $reviewsConfig = null
125154
) {
126155
$this->storeManager = $storeManager;
127156
$this->coreRegistry = $coreRegistry;
@@ -134,7 +163,7 @@ public function __construct(
134163
$this->ratingFactory = $ratingFactory;
135164
$this->catalogDesign = $catalogDesign;
136165
$this->formKeyValidator = $formKeyValidator;
137-
166+
$this->reviewsConfig = $reviewsConfig ?: ObjectManager::getInstance()->get(ReviewsConfig::class);
138167
parent::__construct($context);
139168
}
140169

@@ -146,7 +175,7 @@ public function __construct(
146175
*/
147176
public function dispatch(RequestInterface $request)
148177
{
149-
$allowGuest = $this->_objectManager->get(\Magento\Review\Helper\Data::class)->getIsGuestAllowToWrite();
178+
$allowGuest = $this->_objectManager->get(Data::class)->getIsGuestAllowToWrite();
150179
if (!$request->isDispatched()) {
151180
return parent::dispatch($request);
152181
}
@@ -161,7 +190,7 @@ public function dispatch(RequestInterface $request)
161190
$this->_redirect->getRefererUrl()
162191
);
163192
$this->getResponse()->setRedirect(
164-
$this->_objectManager->get(\Magento\Customer\Model\Url::class)->getLoginUrl()
193+
$this->_objectManager->get(Url::class)->getLoginUrl()
165194
);
166195
}
167196
}
@@ -196,7 +225,7 @@ protected function initProduct()
196225
'review_controller_product_init_after',
197226
['product' => $product, 'controller_action' => $this]
198227
);
199-
} catch (\Magento\Framework\Exception\LocalizedException $e) {
228+
} catch (LocalizedException $e) {
200229
$this->logger->critical($e);
201230
return false;
202231
}
@@ -205,8 +234,7 @@ protected function initProduct()
205234
}
206235

207236
/**
208-
* Load product model with data by passed id.
209-
* Return false if product was not loaded or has incorrect status.
237+
* Load product model with data by passed id. Return false if product was not loaded or has incorrect status.
210238
*
211239
* @param int $productId
212240
* @return bool|CatalogProduct
@@ -216,16 +244,13 @@ protected function loadProduct($productId)
216244
if (!$productId) {
217245
return false;
218246
}
219-
220247
try {
221248
$product = $this->productRepository->getById($productId);
222249

223-
if (!in_array($this->storeManager->getStore()->getWebsiteId(), $product->getWebsiteIds())) {
224-
throw new NoSuchEntityException();
225-
}
226-
227-
if (!$product->isVisibleInCatalog() || !$product->isVisibleInSiteVisibility()) {
228-
throw new NoSuchEntityException();
250+
if ((!in_array($this->storeManager->getStore()->getWebsiteId(), $product->getWebsiteIds()))
251+
|| (!$product->isVisibleInCatalog() || !$product->isVisibleInSiteVisibility())
252+
) {
253+
return false;
229254
}
230255
} catch (NoSuchEntityException $noEntityException) {
231256
return false;

‎app/code/Magento/Review/Controller/Product/Post.php‎

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,10 @@
11
<?php
22
/**
3-
* Copyright © Magento, Inc. All rights reserved.
4-
* See COPYING.txt for license details.
3+
* Copyright 2025 Adobe
4+
* All Rights Reserved.
55
*/
6+
declare(strict_types=1);
7+
68
namespace Magento\Review\Controller\Product;
79

810
use Magento\Framework\App\Action\HttpPostActionInterface as HttpPostActionInterface;
@@ -11,7 +13,7 @@
1113
use Magento\Review\Model\Review;
1214

1315
/**
14-
* Class Post
16+
* Class Post for posting the review
1517
*/
1618
class Post extends ProductController implements HttpPostActionInterface
1719
{
@@ -26,7 +28,7 @@ public function execute()
2628
{
2729
/** @var \Magento\Framework\Controller\Result\Redirect $resultRedirect */
2830
$resultRedirect = $this->resultFactory->create(ResultFactory::TYPE_REDIRECT);
29-
if (!$this->formKeyValidator->validate($this->getRequest())) {
31+
if (!$this->formKeyValidator->validate($this->getRequest()) || false === $this->reviewsConfig->isEnabled()) {
3032
$resultRedirect->setUrl($this->_redirect->getRefererUrl());
3133
return $resultRedirect;
3234
}

‎app/code/Magento/Review/Test/Unit/Controller/Product/PostTest.php‎

Lines changed: 16 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
<?php
22
/**
3-
* Copyright © Magento, Inc. All rights reserved.
4-
* See COPYING.txt for license details.
3+
* Copyright 2025 Adobe
4+
* All Rights Reserved.
55
*/
66
declare(strict_types=1);
77

@@ -25,6 +25,7 @@
2525
use Magento\Review\Model\RatingFactory;
2626
use Magento\Review\Model\Review;
2727
use Magento\Review\Model\ReviewFactory;
28+
use Magento\Review\Model\Review\Config;
2829
use Magento\Store\Model\Store;
2930
use Magento\Store\Model\StoreManagerInterface;
3031
use PHPUnit\Framework\MockObject\MockObject;
@@ -121,6 +122,11 @@ class PostTest extends TestCase
121122
*/
122123
protected $resultRedirectMock;
123124

125+
/**
126+
* @var Config|MockObject
127+
*/
128+
protected $reviewsConfig;
129+
124130
/**
125131
* @inheritDoc
126132
*
@@ -135,6 +141,10 @@ protected function setUp(): void
135141
Validator::class,
136142
['validate']
137143
);
144+
$this->reviewsConfig = $this->createPartialMock(
145+
Config::class,
146+
['isEnabled']
147+
);
138148
$this->reviewSession = $this->getMockBuilder(Generic::class)
139149
->addMethods(['getFormData', 'getRedirectUrl'])
140150
->disableOriginalConstructor()
@@ -211,7 +221,8 @@ protected function setUp(): void
211221
'customerSession' => $this->customerSession,
212222
'ratingFactory' => $ratingFactory,
213223
'storeManager' => $storeManager,
214-
'context' => $this->context
224+
'context' => $this->context,
225+
'reviewsConfig' => $this->reviewsConfig
215226
]
216227
);
217228
}
@@ -234,6 +245,8 @@ public function testExecute(): void
234245
$this->formKeyValidator->expects($this->any())->method('validate')
235246
->with($this->request)
236247
->willReturn(true);
248+
$this->reviewsConfig->expects($this->any())->method('isEnabled')
249+
->willReturn(true);
237250
$this->reviewSession->expects($this->any())->method('getFormData')
238251
->with(true)
239252
->willReturn($reviewData);

0 commit comments

Comments
 (0)