Merge pull request #9289 from magento-cia/cia-2.4.8-beta2-develop-bugfix-10072024

Cia 2.4.8 beta2 develop bugfix 10072024

Author: pawan-adobe-security

app/code/Magento/Customer/Controller/Account/EditPost.php

@@ -237,17 +237,6 @@ public function execute()
             $customer = $this->getCustomerDataObject($this->session->getCustomerId());
             $customerCandidate = $this->populateNewCustomerDataObject($this->_request, $customer);
 
-            $attributeToDelete = (string)$this->_request->getParam('delete_attribute_value');
-            if ($attributeToDelete !== "") {
-                $attributesToDelete = $this->prepareAttributesToDelete($attributeToDelete);
-                foreach ($attributesToDelete as $attribute) {
-                    $uploadedValue = $this->_request->getParam($attribute . File::UPLOADED_FILE_SUFFIX);
-                    if ((string)$uploadedValue === "") {
-                        $this->deleteCustomerFileAttribute($customerCandidate, $attribute);
-                    }
-                }
-            }
-
             try {
                 // whether a customer enabled change email option
                 $isEmailChanged = $this->processChangeEmailRequest($customer);
@@ -310,26 +299,6 @@ public function execute()
         return $resultRedirect;
     }
 
-    /**
-     * Convert comma-separated list of attributes to delete into array
-     *
-     * @param string $attribute
-     * @return array
-     */
-    private function prepareAttributesToDelete(string $attribute) : array
-    {
-        $result = [];
-        if ($attribute !== "") {
-            if (str_contains($attribute, ',')) {
-                $result = explode(',', $attribute);
-            } else {
-                $result[] = $attribute;
-            }
-            $result = array_unique($result);
-        }
-        return $result;
-    }
-
     /**
      * Adds a complex success message if email confirmation is required
      *
@@ -484,38 +453,4 @@ private function disableAddressValidation($customer)
             $addressModel->setShouldIgnoreValidation(true);
         }
     }
-
-    /**
-     * Removes file attribute from customer entity and file from filesystem
-     *
-     * @param CustomerInterface $customerCandidateDataObject
-     * @param string $attributeToDelete
-     * @return void
-     * @throws FileSystemException
-     */
-    private function deleteCustomerFileAttribute(
-        CustomerInterface $customerCandidateDataObject,
-        string $attributeToDelete
-    ) : void {
-        if ($attributeToDelete !== '') {
-            $attributes = $this->prepareAttributesToDelete($attributeToDelete);
-            foreach ($attributes as $attr) {
-                $attributeValue = $customerCandidateDataObject->getCustomAttribute($attr);
-                if ($attributeValue!== null) {
-                    if ($attributeValue->getValue() !== '') {
-                        $mediaDirectory = $this->filesystem->getDirectoryWrite(DirectoryList::MEDIA);
-                        $fileName = $attributeValue->getValue();
-                        $path = $mediaDirectory->getAbsolutePath('customer' . $fileName);
-                        if ($fileName && $mediaDirectory->isFile($path)) {
-                            $mediaDirectory->delete($path);
-                        }
-                        $customerCandidateDataObject->setCustomAttribute(
-                            $attr,
-                            ''
-                        );
-                    }
-                }
-            }
-        }
-    }
 }

app/code/Magento/Customer/Model/Metadata/Form/File.php

@@ -314,7 +314,7 @@ public function compactValue($value)
         // Remove outdated file (in the case of file uploader UI component)
         if (!empty($this->_value)
             && (!empty($value['delete'])
-                || ($this->_entityTypeCode == 'customer' && empty($value)))
+                || ($this->_entityTypeCode === 'customer' && empty($value)))
         ) {
             $this->fileProcessor->removeUploadedFile($this->_value);
             return $value;

app/code/Magento/Customer/Test/Unit/Controller/Account/EditPostTest.php

@@ -240,7 +240,7 @@ public function testExecute()
             ->willReturn($customer);
 
         $attr = 'attr1';
-        $this->request->expects($this->exactly(5))
+        $this->request->expects($this->exactly(3))
             ->method('getParam')
             ->willReturnCallback(
                 function ($arg) use ($attr) {

app/code/Magento/Downloadable/view/adminhtml/templates/sales/items/column/downloadable/name.phtml

@@ -10,27 +10,28 @@
 
 <?php
 /** @var \Magento\Catalog\Helper\Data  $catalogHelper */
+/** @var \Magento\Framework\Escaper $escaper */
 $catalogHelper = $block->getData('catalogHelper');
 if ($_item = $block->getItem()): ?>
-    <div class="product-title"><?= $block->escapeHtml($_item->getName()) ?></div>
+    <div class="product-title"><?= $escaper->escapeHtml($_item->getName()) ?></div>
     <div class="product-sku-block">
-        <span><?= $block->escapeHtml(__('SKU')) ?>:</span>
-        <?= /* @noEscape */ implode('<br />', $catalogHelper->splitSku($block->getSku())) ?>
+        <span><?= $escaper->escapeHtml(__('SKU')) ?>:</span>
+        <?= /* @noEscape */ implode('<br />', $catalogHelper->splitSku($escaper->escapeHtml($block->getSku()))) ?>
     </div>
     <?php if ($block->getOrderOptions()): ?>
         <dl class="item-options">
         <?php foreach ($block->getOrderOptions() as $_option): ?>
-            <dt><?= $block->escapeHtml($_option['label']) ?>:</dt>
+            <dt><?= $escaper->escapeHtml($_option['label']) ?>:</dt>
             <dd>
             <?php if (isset($_option['custom_view']) && $_option['custom_view']): ?>
-                <?= $block->escapeHtml($_option['value']) ?>
+                <?= $escaper->escapeHtml($_option['value']) ?>
             <?php else: ?>
-                <?= $block->escapeHtml($block->truncateString($_option['value'], 55, '', $_remainder)) ?>
+                <?= $escaper->escapeHtml($block->truncateString($_option['value'], 55, '', $_remainder)) ?>
                 <?php if ($_remainder):?>
-                    ... <span id="<?= $block->escapeHtmlAttr($_id = 'id' . uniqid()) ?>">
-                        <?= $block->escapeHtml($_remainder) ?>
+                    ... <span id="<?= $escaper->escapeHtmlAttr($_id = 'id' . uniqid()) ?>">
+                        <?= $escaper->escapeHtml($_remainder) ?>
                     </span>
-                    <?php $escapedId = /* @noEscape */ $block->escapeJs($_id);
+                    <?php $escapedId = /* @noEscape */ $escaper->escapeJs($_id);
                     $scriptString = <<<script
                         require(['prototype'], function(){
                             $('{$escapedId}').hide();
@@ -48,14 +49,14 @@ script;
     <?php endif; ?>
     <?php if ($block->getLinks()): ?>
         <dl class="item-options">
-            <dt><?= $block->escapeHtml($block->getLinksTitle()) ?>:</dt>
+            <dt><?= $escaper->escapeHtml($block->getLinksTitle()) ?>:</dt>
             <?php foreach ($block->getLinks()->getPurchasedItems() as $_link): ?>
-                <dd><?= $block->escapeHtml($_link->getLinkTitle()) ?>
-                    (<?= $block->escapeHtml($_link->getNumberOfDownloadsUsed() . ' / ' .
+                <dd><?= $escaper->escapeHtml($_link->getLinkTitle()) ?>
+                    (<?= $escaper->escapeHtml($_link->getNumberOfDownloadsUsed() . ' / ' .
                         ($_link->getNumberOfDownloadsBought() ? $_link->getNumberOfDownloadsBought() : __('U'))) ?>)
                 </dd>
             <?php endforeach; ?>
         </dl>
     <?php endif; ?>
-    <?= $block->escapeHtml($_item->getDescription()) ?>
+    <?= $escaper->escapeHtml($_item->getDescription()) ?>
 <?php endif; ?>

app/code/Magento/Quote/Model/BillingAddressManagement.php

@@ -7,17 +7,27 @@
 
 namespace Magento\Quote\Model;
 
+use Magento\Customer\Api\AddressRepositoryInterface;
 use Magento\Framework\App\ObjectManager;
 use Magento\Framework\Exception\InputException;
 use Magento\Quote\Api\BillingAddressManagementInterface;
+use Magento\Quote\Api\CartRepositoryInterface;
 use Magento\Quote\Api\Data\AddressInterface;
 use Psr\Log\LoggerInterface as Logger;
 
 /**
  * Quote billing address write service object.
+ * @SuppressWarnings(PHPMD.CouplingBetweenObjects)
  */
 class BillingAddressManagement implements BillingAddressManagementInterface
 {
+    /**
+     * Billing address lock const
+     *
+     * @var string
+     */
+    private const CART_BILLING_ADDRESS_LOCK = 'cart_billing_address_lock_';
+
     /**
      * Validator.
      *
@@ -35,12 +45,12 @@ class BillingAddressManagement implements BillingAddressManagementInterface
     /**
      * Quote repository object.
      *
-     * @var \Magento\Quote\Api\CartRepositoryInterface
+     * @var CartRepositoryInterface
      */
     protected $quoteRepository;
 
     /**
-     * @var \Magento\Customer\Api\AddressRepositoryInterface
+     * @var AddressRepositoryInterface
      */
     protected $addressRepository;
 
@@ -49,24 +59,33 @@ class BillingAddressManagement implements BillingAddressManagementInterface
      */
     private $shippingAddressAssignment;
 
+    /**
+     * @var CartAddressMutexInterface
+     */
+    private $cartAddressMutex;
+
     /**
      * Constructs a quote billing address service object.
      *
-     * @param \Magento\Quote\Api\CartRepositoryInterface $quoteRepository Quote repository.
+     * @param CartRepositoryInterface $quoteRepository Quote repository.
      * @param QuoteAddressValidator $addressValidator Address validator.
      * @param Logger $logger Logger.
-     * @param \Magento\Customer\Api\AddressRepositoryInterface $addressRepository
+     * @param AddressRepositoryInterface $addressRepository
+     * @param CartAddressMutexInterface|null $cartAddressMutex
      */
     public function __construct(
-        \Magento\Quote\Api\CartRepositoryInterface $quoteRepository,
+        CartRepositoryInterface $quoteRepository,
         QuoteAddressValidator $addressValidator,
         Logger $logger,
-        \Magento\Customer\Api\AddressRepositoryInterface $addressRepository
+        AddressRepositoryInterface $addressRepository,
+        ?CartAddressMutexInterface $cartAddressMutex = null
     ) {
         $this->addressValidator = $addressValidator;
         $this->logger = $logger;
         $this->quoteRepository = $quoteRepository;
         $this->addressRepository = $addressRepository;
+        $this->cartAddressMutex = $cartAddressMutex ??
+            ObjectManager::getInstance()->get(CartAddressMutex::class);
     }
 
     /**
@@ -75,8 +94,29 @@ public function __construct(
      */
     public function assign($cartId, AddressInterface $address, $useForShipping = false)
     {
-        /** @var \Magento\Quote\Model\Quote $quote */
+        /** @var Quote $quote */
         $quote = $this->quoteRepository->getActive($cartId);
+        $billingAddressId = (int) $quote->getBillingAddress()->getId();
+
+        return $this->cartAddressMutex->execute(
+            self::CART_BILLING_ADDRESS_LOCK.$billingAddressId,
+            $this->assignBillingAddress(...),
+            $billingAddressId,
+            [$address, $quote, $useForShipping]
+        );
+    }
+
+    /**
+     * Assign billing address to cart
+     *
+     * @param AddressInterface $address
+     * @param Quote $quote
+     * @param bool $useForShipping
+     * @return mixed
+     * @throws InputException
+     */
+    private function assignBillingAddress(AddressInterface $address, Quote $quote, bool $useForShipping = false)
+    {
         $address->setCustomerId($quote->getCustomerId());
         $quote->removeAddress($quote->getBillingAddress()->getId());
         $quote->setBillingAddress($address);
@@ -85,9 +125,10 @@ public function assign($cartId, AddressInterface $address, $useForShipping = fal
             $quote->setDataChanges(true);
             $this->quoteRepository->save($quote);
         } catch (\Exception $e) {
-            $this->logger->critical($e);
+            $this->logger->critical($e->getMessage());
             throw new InputException(__('The address failed to save. Verify the address and try again.'));
         }
+
         return $quote->getBillingAddress()->getId();
     }
 

app/code/Magento/Quote/Model/CartAddressMutex.php

@@ -0,0 +1,58 @@
+<?php
+/************************************************************************
+ *
+ * Copyright 2024 Adobe
+ * All Rights Reserved.
+ *
+ * NOTICE: All information contained herein is, and remains
+ * the property of Adobe and its suppliers, if any. The intellectual
+ * and technical concepts contained herein are proprietary to Adobe
+ * and its suppliers and are protected by all applicable intellectual
+ * property laws, including trade secret and copyright laws.
+ * Dissemination of this information or reproduction of this material
+ * is strictly forbidden unless prior written permission is obtained
+ * from Adobe.
+ * ************************************************************************
+ */
+declare(strict_types=1);
+
+namespace Magento\Quote\Model;
+
+use Magento\Framework\Lock\LockManagerInterface;
+
+/**
+ * @inheritDoc
+ */
+class CartAddressMutex implements CartAddressMutexInterface
+{
+    /**
+     * @var LockManagerInterface
+     */
+    private $lockManager;
+
+    /**
+     * @param LockManagerInterface $lockManager
+     */
+    public function __construct(
+        LockManagerInterface $lockManager,
+    ) {
+        $this->lockManager = $lockManager;
+    }
+
+    /**
+     * @inheritDoc
+     */
+    public function execute(string $lockName, callable $callable, int $result, array $args = [])
+    {
+        if (!$this->lockManager->lock($lockName, 0)) {
+            return $result;
+        }
+        try {
+            $result = $callable(...$args);
+        } finally {
+            $this->lockManager->unlock($lockName);
+        }
+
+        return $result;
+    }
+}

app/code/Magento/Quote/Model/CartAddressMutexInterface.php

@@ -0,0 +1,36 @@
+<?php
+/************************************************************************
+ *
+ * Copyright 2024 Adobe
+ * All Rights Reserved.
+ *
+ * NOTICE: All information contained herein is, and remains
+ * the property of Adobe and its suppliers, if any. The intellectual
+ * and technical concepts contained herein are proprietary to Adobe
+ * and its suppliers and are protected by all applicable intellectual
+ * property laws, including trade secret and copyright laws.
+ * Dissemination of this information or reproduction of this material
+ * is strictly forbidden unless prior written permission is obtained
+ * from Adobe.
+ * ************************************************************************
+ */
+declare(strict_types=1);
+
+namespace Magento\Quote\Model;
+
+/**
+ * Intended to prevent race conditions during quote address processing by concurrent requests.
+ */
+interface CartAddressMutexInterface
+{
+    /**
+     * Acquires a lock for quote address, executes callable and releases the lock after.
+     *
+     * @param string $lockName
+     * @param callable $callable
+     * @param int $result
+     * @param array $args
+     * @return mixed
+     */
+    public function execute(string $lockName, callable $callable, int $result, array $args = []);
+}