Merge branch 'MC-39360' of https://github.com/magento-performance/magento2ce into MC-39033

Author: shiftedreality

app/code/Magento/CatalogImportExport/Model/Import/Product.php

@@ -1965,7 +1965,7 @@ private function getAlreadyExistedImage(array $imageRow, string $columnImage, st
         if (filter_var($columnImage, FILTER_VALIDATE_URL)) {
             $hash = $this->getFileHash($columnImage);
         } else {
-            $path = $importDir . DS . $columnImage;
+            $path = $importDir . DIRECTORY_SEPARATOR . $columnImage;
             $hash = $this->isFileExists($path) ? $this->getFileHash($path) : '';
         }
 
@@ -1991,7 +1991,7 @@ function ($exists, $file) use ($hash) {
     private function addImageHashes(array &$images): void
     {
         $productMediaPath = $this->filesystem->getDirectoryRead(DirectoryList::MEDIA)
-            ->getAbsolutePath(DS . 'catalog' . DS . 'product');
+            ->getAbsolutePath(DIRECTORY_SEPARATOR . 'catalog' . DIRECTORY_SEPARATOR . 'product');
 
         foreach ($images as $storeId => $skus) {
             foreach ($skus as $sku => $files) {
@@ -2188,7 +2188,7 @@ private function getImportDir(): string
         $dirAddon = $dirConfig[DirectoryList::MEDIA][DirectoryList::PATH];
 
         return empty($this->_parameters[Import::FIELD_NAME_IMG_FILE_DIR])
-            ? $dirAddon . DS . $this->_mediaDirectory->getRelativePath('import')
+            ? $dirAddon . DIRECTORY_SEPARATOR . $this->_mediaDirectory->getRelativePath('import')
             : $this->_parameters[Import::FIELD_NAME_IMG_FILE_DIR];
     }
 

app/code/Magento/MediaStorage/App/Media.php

@@ -187,7 +187,9 @@ public function launch(): ResponseInterface
             $this->mediaDirectoryPath = $config->getMediaDirectory();
             $allowedResources = $config->getAllowedResources();
             $isAllowed = $this->isAllowed;
-            if (!$isAllowed($this->relativeFileName, $allowedResources)) {
+            $fileAbsolutePath = $this->directoryPub->getAbsolutePath($this->relativeFileName);
+            $fileRelativePath = str_replace(rtrim($this->mediaDirectoryPath, '/') . '/', '', $fileAbsolutePath);
+            if (!$isAllowed($fileRelativePath, $allowedResources)) {
                 throw new LogicException('The path is not allowed: ' . $this->relativeFileName);
             }
         }

app/code/Magento/MediaStorage/Test/Unit/App/MediaTest.php

@@ -118,7 +118,7 @@ public function testProcessRequestCreatesConfigFileMediaDirectoryIsNotProvided()
             ->method('getAbsolutePath')
             ->with(null)
             ->willReturn(self::MEDIA_DIRECTORY);
-        $this->directoryPubMock->expects(self::once())
+        $this->directoryPubMock->expects(self::exactly(2))
             ->method('getAbsolutePath')
             ->with(self::RELATIVE_FILE_PATH)
             ->willReturn($filePath);
@@ -154,7 +154,7 @@ public function testProcessRequestReturnsFileIfItsProperlySynchronized(): void
             ->method('isReadable')
             ->with(self::RELATIVE_FILE_PATH)
             ->willReturn(true);
-        $this->directoryPubMock->expects(self::once())
+        $this->directoryPubMock->expects(self::exactly(2))
             ->method('getAbsolutePath')
             ->with(self::RELATIVE_FILE_PATH)
             ->willReturn($filePath);
@@ -214,10 +214,15 @@ public function testCatchException(bool $isDeveloper, int $setBodyCalls): void
 
     public function testExceptionWhenIsAllowedReturnsFalse(): void
     {
+        $filePath = '/absolute/path/to/test/file.png';
         $this->directoryMediaMock->expects(self::once())
             ->method('getAbsolutePath')
             ->with(null)
             ->willReturn(self::MEDIA_DIRECTORY);
+        $this->directoryPubMock->expects(self::once())
+            ->method('getAbsolutePath')
+            ->with(self::RELATIVE_FILE_PATH)
+            ->willReturn($filePath);
         $this->configMock->expects(self::once())
             ->method('save');
 

dev/tests/integration/testsuite/Magento/CatalogImportExport/Model/Import/ImportWithSharedImagesTest.php

@@ -202,7 +202,7 @@ private function updateUploader(): void
         $rootDirectory = $this->fileSystem->getDirectoryWrite(DirectoryList::ROOT);
         $destDir = $rootDirectory->getRelativePath(
             $this->appParams[DirectoryList::MEDIA][DirectoryList::PATH]
-            . DS . $this->mediaConfig->getBaseMediaPath()
+            . DIRECTORY_SEPARATOR . $this->mediaConfig->getBaseMediaPath()
         );
         $tmpDir = $rootDirectory->getRelativePath(
             $this->appParams[DirectoryList::MEDIA][DirectoryList::PATH]
@@ -226,7 +226,7 @@ private function moveImages(string $fileName): void
             $this->appParams[DirectoryList::MEDIA][DirectoryList::PATH]
         );
         $fixtureDir = realpath(__DIR__ . '/../../_files');
-        $tmpFilePath = $rootDirectory->getAbsolutePath($tmpDir . DS . $fileName);
+        $tmpFilePath = $rootDirectory->getAbsolutePath($tmpDir . DIRECTORY_SEPARATOR . $fileName);
         $this->fileDriver->createDirectory($tmpDir);
         $rootDirectory->getDriver()->copy(
             $fixtureDir . DIRECTORY_SEPARATOR . $fileName,