Skip to content

Commit ecc1eec

Browse files
dvoskoboinikovdvoskoboinikov
authored
Merge pull request #2957 from magento-qwerty/2.1.15-bugfixes-010818
Fixed issues: - MAGETWO-93150: Fixed incorrect behavior of customer form - MAGETWO-93085: Order cannot be reordered with a file option - MAGETWO-72050: Prevent wrong behavior of upload function in admin panel - MAGETWO-93271: [Backport for 2.1.x] Product Video feature not GDPR compliant - MAGETWO-88659: Incorrect category attributes displaying - MAGETWO-92177: Wrong behavior of the list action - MAGETWO-92174: Wrong product grid behavior in admin panel
2 parents 24c016e + 310a1f2 commit ecc1eec

File tree

30 files changed

+267
-952
lines changed

30 files changed

+267
-952
lines changed

‎app/code/Magento/Catalog/Controller/Adminhtml/Category/Image/Upload.php‎

Lines changed: 0 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -53,14 +53,6 @@ public function execute()
5353
$imageId = $this->_request->getParam('param_name', 'image');
5454
try {
5555
$result = $this->imageUploader->saveFileToTmpDir($imageId);
56-
57-
$result['cookie'] = [
58-
'name' => $this->_getSession()->getName(),
59-
'value' => $this->_getSession()->getSessionId(),
60-
'lifetime' => $this->_getSession()->getCookieLifetime(),
61-
'path' => $this->_getSession()->getCookiePath(),
62-
'domain' => $this->_getSession()->getCookieDomain(),
63-
];
6456
} catch (\Exception $e) {
6557
$result = ['error' => $e->getMessage(), 'errorcode' => $e->getCode()];
6658
}

‎app/code/Magento/Catalog/Controller/Adminhtml/Product/MassDelete.php‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,7 @@
99
use Magento\Framework\Controller\ResultFactory;
1010
use Magento\Catalog\Controller\Adminhtml\Product\Builder;
1111
use Magento\Backend\App\Action\Context;
12+
use Magento\Framework\Exception\NotFoundException;
1213
use Magento\Ui\Component\MassAction\Filter;
1314
use Magento\Catalog\Model\ResourceModel\Product\CollectionFactory;
1415

@@ -45,9 +46,14 @@ public function __construct(
4546

4647
/**
4748
* @return \Magento\Backend\Model\View\Result\Redirect
49+
* @throws NotFoundException
50+
* @throws \Magento\Framework\Exception\LocalizedException
4851
*/
4952
public function execute()
5053
{
54+
if (!$this->getRequest()->isPost()) {
55+
throw new NotFoundException(__('Page not found'));
56+
}
5157
$collection = $this->filter->getCollection($this->collectionFactory->create());
5258
$productDeleted = 0;
5359
foreach ($collection->getItems() as $product) {

‎app/code/Magento/Catalog/Model/Product/Option/Type/File/ExistingValidate.php‎

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
<?php
2+
/**
3+
* Copyright © Magento, Inc. All rights reserved.
4+
* See COPYING.txt for license details.
5+
*/
6+
7+
namespace Magento\Catalog\Model\Product\Option\Type\File;
8+
9+
/**
10+
* Validator for existing (already saved) files.
11+
*/
12+
class ExistingValidate extends \Zend_Validate
13+
{
14+
/**
15+
* @inheritDoc
16+
*
17+
* @param string $value File's full path.
18+
* @param string|null $originalName Original file's name (when uploaded).
19+
*/
20+
public function isValid($value, $originalName = null)
21+
{
22+
$this->_messages = [];
23+
$this->_errors = [];
24+
25+
if (!is_string($value)) {
26+
$this->_messages[] = __('Full file path is expected.')->render();
27+
return false;
28+
}
29+
30+
$result = true;
31+
$fileInfo = null;
32+
if ($originalName) {
33+
$fileInfo = ['name' => $originalName];
34+
}
35+
foreach ($this->_validators as $element) {
36+
$validator = $element['instance'];
37+
if ($validator->isValid($value, $fileInfo)) {
38+
continue;
39+
}
40+
$result = false;
41+
$messages = $validator->getMessages();
42+
$this->_messages = array_merge($this->_messages, $messages);
43+
$this->_errors = array_merge($this->_errors, array_keys($messages));
44+
if ($element['breakChainOnFailure']) {
45+
break;
46+
}
47+
}
48+
return $result;
49+
}
50+
}

‎app/code/Magento/Catalog/Model/Product/Option/Type/File/ValidateFactory.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,6 @@ class ValidateFactory
1313
*/
1414
public function create()
1515
{
16-
return new \Zend_Validate();
16+
return new ExistingValidate();
1717
}
1818
}

‎app/code/Magento/Catalog/Model/Product/Option/Type/File/ValidatorFile.php‎

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -164,8 +164,14 @@ public function validate($processingParams, $option)
164164
$filePath = $dispersion;
165165

166166
$tmpDirectory = $this->filesystem->getDirectoryRead(DirectoryList::SYS_TMP);
167-
$fileHash = $this->random->getRandomString(32);
168-
$filePath .= '/' . $fileHash;
167+
$fileHash = hash(
168+
'md5',
169+
$tmpDirectory->readFile(
170+
$tmpDirectory->getRelativePath($fileInfo['tmp_name'])
171+
)
172+
);
173+
$fileRandomName = $this->random->getRandomString(32);
174+
$filePath .= '/' . $fileRandomName;
169175
$fileFullPath = $this->mediaDirectory->getAbsolutePath($this->quotePath . $filePath);
170176

171177
$upload->addFilter(new \Zend_Filter_File_Rename(['target' => $fileFullPath, 'overwrite' => true]));

‎app/code/Magento/Catalog/Model/Product/Option/Type/File/ValidatorInfo.php‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,9 @@
66

77
namespace Magento\Catalog\Model\Product\Option\Type\File;
88

9+
/**
10+
* Validator for existing files.
11+
*/
912
class ValidatorInfo extends Validator
1013
{
1114
/**
@@ -90,7 +93,7 @@ public function validate($optionValue, $option)
9093
}
9194

9295
$result = false;
93-
if ($validatorChain->isValid($this->fileFullPath)) {
96+
if ($validatorChain->isValid($this->fileFullPath, $optionValue['title'])) {
9497
$result = $this->rootDirectory->isReadable($this->fileRelativePath)
9598
&& isset($optionValue['secret_key'])
9699
&& $this->buildSecretKey($this->fileRelativePath) == $optionValue['secret_key'];

‎app/code/Magento/Catalog/Test/Unit/Controller/Adminhtml/Category/Image/UploadTest.php‎

Lines changed: 3 additions & 35 deletions
Original file line numberDiff line numberDiff line change
@@ -45,20 +45,6 @@ protected function setUp()
4545
*/
4646
public function testExecute($name, $savedName)
4747
{
48-
$cookieName = 'testName';
49-
$sessionId = 'testSessionId';
50-
$lifetime = 'testLifetime';
51-
$path = 'testPath';
52-
$domain = 'testDomain';
53-
$data = [
54-
'cookie' => [
55-
'name' => $cookieName,
56-
'value' => $sessionId,
57-
'lifetime' => $lifetime,
58-
'path' => $path,
59-
'domain' => $domain
60-
]
61-
];
6248
$request = $this->objectManager->getObject(Request::class);
6349
$uploader = $this->getMockBuilder(ImageUploader::class)
6450
->disableOriginalConstructor()
@@ -71,37 +57,19 @@ public function testExecute($name, $savedName)
7157
$resultFactory->expects($this->once())
7258
->method('create')
7359
->will($this->returnValue(new DataObject()));
74-
$session = $this->getMockBuilder(\Magento\Backend\Model\Session::class)
75-
->disableOriginalConstructor()
76-
->getMock();
77-
$session->expects($this->once())
78-
->method('getName')
79-
->willReturn($cookieName);
80-
$session->expects($this->once())
81-
->method('getSessionId')
82-
->willReturn($sessionId);
83-
$session->expects($this->once())
84-
->method('getCookieLifeTime')
85-
->willReturn($lifetime);
86-
$session->expects($this->once())
87-
->method('getCookiePath')
88-
->willReturn($path);
89-
$session->expects($this->once())
90-
->method('getCookieDomain')
91-
->willReturn($domain);
60+
9261
$model = $this->objectManager->getObject(Model::class, [
9362
'request' => $request,
9463
'resultFactory' => $resultFactory,
95-
'imageUploader' => $uploader,
96-
'_session' => $session
64+
'imageUploader' => $uploader
9765
]);
9866
$uploader->expects($this->once())
9967
->method('saveFileToTmpDir')
10068
->with($savedName)
10169
->will($this->returnValue([]));
10270
$request->setParam('param_name', $name);
10371
$result = $model->execute();
104-
$this->assertSame($data, $result->getData());
72+
$this->assertSame([], $result->getData());
10573
}
10674

10775
/**

‎app/code/Magento/Cms/Model/Wysiwyg/Images/Storage.php‎

Lines changed: 0 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -496,14 +496,6 @@ public function uploadFile($targetPath, $type = null)
496496
// create thumbnail
497497
$this->resizeFile($targetPath . '/' . $uploader->getUploadedFileName(), true);
498498

499-
$result['cookie'] = [
500-
'name' => $this->getSession()->getName(),
501-
'value' => $this->getSession()->getSessionId(),
502-
'lifetime' => $this->getSession()->getCookieLifetime(),
503-
'path' => $this->getSession()->getCookiePath(),
504-
'domain' => $this->getSession()->getCookieDomain(),
505-
];
506-
507499
return $result;
508500
}
509501

‎app/code/Magento/Cms/Test/Unit/Model/Wysiwyg/Images/StorageTest.php‎

Lines changed: 1 addition & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -471,14 +471,7 @@ public function testUploadFile()
471471
$thumbnailDestination = $thumbnailTargetPath . '/' . $fileName;
472472
$type = 'image';
473473
$result = [
474-
'result',
475-
'cookie' => [
476-
'name' => 'session_name',
477-
'value' => '1',
478-
'lifetime' => '50',
479-
'path' => 'cookie/path',
480-
'domain' => 'cookie_domain',
481-
],
474+
'result'
482475
];
483476
$uploader = $this->getMockBuilder(\Magento\MediaStorage\Model\File\Uploader::class)
484477
->disableOriginalConstructor()
@@ -538,17 +531,6 @@ public function testUploadFile()
538531

539532
$this->adapterFactoryMock->expects($this->atLeastOnce())->method('create')->willReturn($image);
540533

541-
$this->sessionMock->expects($this->atLeastOnce())->method('getName')
542-
->willReturn($result['cookie']['name']);
543-
$this->sessionMock->expects($this->atLeastOnce())->method('getSessionId')
544-
->willReturn($result['cookie']['value']);
545-
$this->sessionMock->expects($this->atLeastOnce())->method('getCookieLifetime')
546-
->willReturn($result['cookie']['lifetime']);
547-
$this->sessionMock->expects($this->atLeastOnce())->method('getCookiePath')
548-
->willReturn($result['cookie']['path']);
549-
$this->sessionMock->expects($this->atLeastOnce())->method('getCookieDomain')
550-
->willReturn($result['cookie']['domain']);
551-
552534
$this->assertEquals($result, $this->imagesStorage->uploadFile($targetPath, $type));
553535
}
554536
}

‎app/code/Magento/Customer/Controller/Account/EditPost.php‎

Lines changed: 10 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,7 @@
2020
use Magento\Framework\Exception\InputException;
2121
use Magento\Framework\Exception\InvalidEmailOrPasswordException;
2222
use Magento\Framework\Exception\State\UserLockedException;
23+
use Magento\Framework\Escaper;
2324

2425
/**
2526
* Class EditPost
@@ -70,28 +71,34 @@ class EditPost extends \Magento\Customer\Controller\AbstractAccount
7071
*/
7172
private $customerMapper;
7273

74+
/** @var Escaper */
75+
private $escaper;
76+
7377
/**
7478
* @param Context $context
7579
* @param Session $customerSession
7680
* @param AccountManagementInterface $customerAccountManagement
7781
* @param CustomerRepositoryInterface $customerRepository
7882
* @param Validator $formKeyValidator
7983
* @param CustomerExtractor $customerExtractor
84+
* @param Escaper|null $escaper
8085
*/
8186
public function __construct(
8287
Context $context,
8388
Session $customerSession,
8489
AccountManagementInterface $customerAccountManagement,
8590
CustomerRepositoryInterface $customerRepository,
8691
Validator $formKeyValidator,
87-
CustomerExtractor $customerExtractor
92+
CustomerExtractor $customerExtractor,
93+
Escaper $escaper = null
8894
) {
8995
parent::__construct($context);
9096
$this->session = $customerSession;
9197
$this->customerAccountManagement = $customerAccountManagement;
9298
$this->customerRepository = $customerRepository;
9399
$this->formKeyValidator = $formKeyValidator;
94100
$this->customerExtractor = $customerExtractor;
101+
$this->escaper = $escaper ?: ObjectManager::getInstance()->get(Escaper::class);
95102
}
96103

97104
/**
@@ -173,9 +180,9 @@ public function execute()
173180
$this->messageManager->addError($message);
174181
return $resultRedirect->setPath('customer/account/login');
175182
} catch (InputException $e) {
176-
$this->messageManager->addError($e->getMessage());
183+
$this->messageManager->addErrorMessage($this->escaper->escapeHtml($e->getMessage()));
177184
foreach ($e->getErrors() as $error) {
178-
$this->messageManager->addError($error->getMessage());
185+
$this->messageManager->addErrorMessage($this->escaper->escapeHtml($error->getMessage()));
179186
}
180187
} catch (\Magento\Framework\Exception\LocalizedException $e) {
181188
$this->messageManager->addError($e->getMessage());

0 commit comments

Comments
 (0)