Skip to content

Commit ef078b6

Browse files
furseyevfurseyev
committed
Merge branch '2.3-develop' into feature/271-Customer-Attributes-Validation
2 parents 3641627 + 6e534ad commit ef078b6

File tree

859 files changed

+41489
-6456
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

859 files changed

+41489
-6456
lines changed

‎SECURITY.md

+10
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
# Reporting Security Issues
2+
3+
Magento values the contributions of the security research community, and we look forward to working with you to minimize risk to Magento merchants.
4+
5+
## Where should I report security issues?
6+
7+
We strongly encourage you to report all security issues privately via our [bug bounty program](https://hackerone.com/magento). Please provide us with relevant technical details and repro steps to expedite our investigation. If you prefer not to use HackerOne, email us directly at `[email protected]` with details and repro steps.
8+
9+
## Learning More About Security
10+
To learn more about securing a Magento store, please visit the [Security Center](https://magento.com/security).

‎app/code/Magento/AdminNotification/Model/Feed.php

+18-7
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,11 @@ class Feed extends \Magento\Framework\Model\AbstractModel
2525

2626
const XML_LAST_UPDATE_PATH = 'system/adminnotification/last_update';
2727

28+
/**
29+
* @var \Magento\Framework\Escaper
30+
*/
31+
private $escaper;
32+
2833
/**
2934
* Feed url
3035
*
@@ -77,6 +82,7 @@ class Feed extends \Magento\Framework\Model\AbstractModel
7782
* @param \Magento\Framework\Model\ResourceModel\AbstractResource $resource
7883
* @param \Magento\Framework\Data\Collection\AbstractDb $resourceCollection
7984
* @param array $data
85+
* @param \Magento\Framework\Escaper|null $escaper
8086
* @SuppressWarnings(PHPMD.ExcessiveParameterList)
8187
*/
8288
public function __construct(
@@ -90,21 +96,26 @@ public function __construct(
9096
\Magento\Framework\UrlInterface $urlBuilder,
9197
\Magento\Framework\Model\ResourceModel\AbstractResource $resource = null,
9298
\Magento\Framework\Data\Collection\AbstractDb $resourceCollection = null,
93-
array $data = []
99+
array $data = [],
100+
\Magento\Framework\Escaper $escaper = null
94101
) {
95102
parent::__construct($context, $registry, $resource, $resourceCollection, $data);
96-
$this->_backendConfig = $backendConfig;
97-
$this->_inboxFactory = $inboxFactory;
98-
$this->curlFactory = $curlFactory;
103+
$this->_backendConfig = $backendConfig;
104+
$this->_inboxFactory = $inboxFactory;
105+
$this->curlFactory = $curlFactory;
99106
$this->_deploymentConfig = $deploymentConfig;
100-
$this->productMetadata = $productMetadata;
101-
$this->urlBuilder = $urlBuilder;
107+
$this->productMetadata = $productMetadata;
108+
$this->urlBuilder = $urlBuilder;
109+
$this->escaper = $escaper ?? \Magento\Framework\App\ObjectManager::getInstance()->get(
110+
\Magento\Framework\Escaper::class
111+
);
102112
}
103113

104114
/**
105115
* Init model
106116
*
107117
* @return void
118+
* phpcs:disable Magento2.CodeAnalysis.EmptyBlock
108119
*/
109120
protected function _construct()
110121
{
@@ -252,6 +263,6 @@ public function getFeedXml()
252263
*/
253264
private function escapeString(\SimpleXMLElement $data)
254265
{
255-
return htmlspecialchars((string)$data);
266+
return $this->escaper->escapeHtml((string)$data);
256267
}
257268
}

‎app/code/Magento/AdminNotification/view/adminhtml/templates/notification/window.phtml

+5-7
Original file line numberDiff line numberDiff line change
@@ -4,10 +4,6 @@
44
* See COPYING.txt for license details.
55
*/
66

7-
// @codingStandardsIgnoreFile
8-
9-
?>
10-
<?php
117
/**
128
* @see \Magento\AdminNotification\Block\Window
139
*/
@@ -19,11 +15,13 @@
1915
"autoOpen": true,
2016
"buttons": false,
2117
"modalClass": "modal-system-messages",
22-
"title": "<?= /* @escapeNotVerified */ $block->getHeaderText() ?>"
18+
"title": "<?= $block->escapeHtmlAttr($block->getHeaderText()) ?>"
2319
}
2420
}'>
2521
<li class="message message-warning warning">
26-
<?= /* @escapeNotVerified */ $block->getNoticeMessageText() ?><br/>
27-
<a href="<?= /* @escapeNotVerified */ $block->getNoticeMessageUrl() ?>"><?= /* @escapeNotVerified */ $block->getReadDetailsText() ?></a>
22+
<?= $block->escapeHtml($block->getNoticeMessageText()) ?><br/>
23+
<a href="<?= $block->escapeUrl($block->getNoticeMessageUrl()) ?>">
24+
<?= $block->escapeHtml($block->getReadDetailsText()) ?>
25+
</a>
2826
</li>
2927
</ul>

‎app/code/Magento/AdminNotification/view/adminhtml/templates/system/messages.phtml

+13-13
Original file line numberDiff line numberDiff line change
@@ -4,41 +4,41 @@
44
* See COPYING.txt for license details.
55
*/
66

7-
// @codingStandardsIgnoreFile
8-
7+
/** @var $block \Magento\AdminNotification\Block\System\Messages */
98
?>
10-
<?php /** @var $block \Magento\AdminNotification\Block\System\Messages */ ?>
119

1210
<?php $lastCritical = $block->getLastCritical();?>
13-
<div id="system_messages" class="message-system<?php if ($lastCritical): ?> message-system-unread<?php endif; ?>">
11+
<div id="system_messages"
12+
class="message-system<?php if ($lastCritical) : ?>
13+
message-system-unread<?php endif; ?>">
1414
<div class="message-system-inner">
15-
<?php if ($lastCritical): ?>
15+
<?php if ($lastCritical) : ?>
1616
<ul class="message-system-list">
1717
<li class="message message-warning error">
18-
<?= /* @escapeNotVerified */ $lastCritical->getText() ?>
18+
<?= $block->escapeHtml($lastCritical->getText()) ?>
1919
</li>
2020
</ul>
2121
<?php endif; ?>
2222
<div class="message-system-short">
2323
<span class="message-system-short-label">
24-
<?= /* @escapeNotVerified */ __('System Messages:') ?>
24+
<?= $block->escapeHtml(__('System Messages:')) ?>
2525
</span>
2626

27-
<?php if ($block->getCriticalCount()): ?>
27+
<?php if ($block->getCriticalCount()) : ?>
2828
<div class="message message-warning error">
2929
<a class="message-link" href="#" title="<?= $block->escapeHtml(__('Critical System Messages')) ?>">
30-
<?= /* @escapeNotVerified */ $block->getCriticalCount() ?>
30+
<?= (int) $block->getCriticalCount() ?>
3131
</a>
3232
</div>
33-
<?php endif;?>
33+
<?php endif; ?>
3434

35-
<?php if ($block->getMajorCount()): ?>
35+
<?php if ($block->getMajorCount()) : ?>
3636
<div class="message message-warning warning">
3737
<a class="message-link" href="#" title="<?= $block->escapeHtml(__('Major System Messages')) ?>">
38-
<?= /* @escapeNotVerified */ $block->getMajorCount() ?>
38+
<?= (int) $block->getMajorCount() ?>
3939
</a>
4040
</div>
41-
<?php endif;?>
41+
<?php endif; ?>
4242
</div>
4343
<div id="message-system-all" title="<?= $block->escapeHtml(__('System messages')) ?>" data-mage-init='<?= $block->escapeHtml($block->getSystemMessageDialogJson()) ?>'></div>
4444
</div>

‎app/code/Magento/AdminNotification/view/adminhtml/templates/system/messages/popup.phtml

+6-7
Original file line numberDiff line numberDiff line change
@@ -4,16 +4,15 @@
44
* See COPYING.txt for license details.
55
*/
66

7-
// @codingStandardsIgnoreFile
8-
7+
/** @var $block \Magento\AdminNotification\Block\System\Messages\UnreadMessagePopup */
98
?>
10-
<?php /** @var $block \Magento\AdminNotification\Block\System\Messages\UnreadMessagePopup */ ?>
119

12-
<div style="display:none" id="system_messages_list" data-role="system_messages_list" title="<?= $block->escapeHtml($block->getPopupTitle()) ?>">
10+
<div style="display:none" id="system_messages_list" data-role="system_messages_list"
11+
title="<?= $block->escapeHtmlAttr($block->getPopupTitle()) ?>">
1312
<ul class="message-system-list messages">
14-
<?php foreach ($block->getUnreadMessages() as $message): ?>
15-
<li class="message message-warning <?= /* @escapeNotVerified */ $block->getItemClass($message) ?>">
16-
<?= /* @escapeNotVerified */ $message->getText() ?>
13+
<?php foreach ($block->getUnreadMessages() as $message) : ?>
14+
<li class="message message-warning <?= $block->escapeHtmlAttr($block->getItemClass($message)) ?>">
15+
<?= $block->escapeHtml($message->getText()) ?>
1716
</li>
1817
<?php endforeach;?>
1918
</ul>

‎app/code/Magento/AdminNotification/view/adminhtml/templates/toolbar_entry.phtml

+44-47
Original file line numberDiff line numberDiff line change
@@ -4,81 +4,78 @@
44
* See COPYING.txt for license details.
55
*/
66

7-
// @codingStandardsIgnoreFile
7+
/** @var $this \Magento\AdminNotification\Block\ToolbarEntry */
88

9-
?>
10-
<?php /** @var $this \Magento\AdminNotification\Block\ToolbarEntry */ ?>
11-
<?php
129
$notificationCount = $block->getUnreadNotificationCount();
1310
$notificationCounterMax = $block->getNotificationCounterMax();
1411
?>
1512
<div
1613
data-mage-init='{"toolbarEntry": {}}'
1714
class="notifications-wrapper admin__action-dropdown-wrap"
18-
data-notification-count="<?= /* @escapeNotVerified */ $notificationCount ?>">
15+
data-notification-count="<?= (int)$notificationCount ?>">
1916
<?php if ($notificationCount > 0) : ?>
2017
<a
21-
href="<?= /* @escapeNotVerified */ $block->getUrl('adminhtml/notification/index') ?>"
18+
href="<?= $block->escapeUrl($block->getUrl('adminhtml/notification/index')) ?>"
2219
class="notifications-action admin__action-dropdown"
2320
data-mage-init='{"dropdown":{}}'
24-
title="<?= /* @escapeNotVerified */ __('Notifications') ?>"
21+
title="<?= $block->escapeHtmlAttr(__('Notifications')) ?>"
2522
data-toggle="dropdown">
2623
<span class="notifications-counter">
27-
<?= /* @escapeNotVerified */ ($notificationCount > $notificationCounterMax) ? $notificationCounterMax . '+' : $notificationCount ?>
24+
<?= /* @noEscape */ ($notificationCount > $notificationCounterMax) ? (int)$notificationCounterMax . '+' : (int)$notificationCount ?>
2825
</span>
2926
</a>
3027
<ul
3128
class="admin__action-dropdown-menu"
32-
data-mark-as-read-url="<?= /* @escapeNotVerified */ $block->getUrl('adminhtml/notification/ajaxMarkAsRead') ?>">
29+
data-mark-as-read-url="<?= $block->escapeUrl($block->getUrl('adminhtml/notification/ajaxMarkAsRead')) ?>">
3330
<?php foreach ($block->getLatestUnreadNotifications() as $notification) : ?>
34-
<?php /** @var $notification \Magento\AdminNotification\Model\Inbox*/ ?>
35-
<li class="notifications-entry<?php if ($notification->getSeverity() == 1): ?> notifications-critical<?php endif; ?>"
36-
data-notification-id="<?= /* @escapeNotVerified */ $notification->getId() ?>"
37-
data-notification-severity="<?php if ($notification->getSeverity() == 1): ?>1<?php endif; ?>">
38-
<?php
39-
$notificationDescription = $block->escapeHtml($notification->getDescription());
40-
$notificationDescriptionLength = $block->getNotificationDescriptionLength();
41-
?>
42-
<strong class="notifications-entry-title">
43-
<?= $block->escapeHtml($notification->getTitle()) ?>
44-
</strong>
45-
<?php if (strlen($notificationDescription) > $notificationDescriptionLength) : ?>
46-
<p class="notifications-entry-description _cutted">
47-
<span class="notifications-entry-description-start">
48-
<?= /* @escapeNotVerified */ substr($notificationDescription, 0, $notificationDescriptionLength) ?>
49-
</span>
50-
<span class="notifications-entry-description-end">
51-
<?= /* @escapeNotVerified */ substr($notificationDescription, $notificationDescriptionLength) ?>
52-
</span>
53-
</p>
54-
<?php else : ?>
55-
<p class="notifications-entry-description">
56-
<?= /* @escapeNotVerified */ $notificationDescription ?>
57-
</p>
58-
<?php endif; ?>
59-
<time class="notifications-entry-time">
60-
<?= /* @escapeNotVerified */ $block->formatNotificationDate($notification->getDateAdded()) ?>
61-
</time>
62-
<button
63-
type="button"
64-
class="notifications-close"
65-
title="<?= /* @escapeNotVerified */ __('Close') ?>"
66-
></button>
67-
</li>
31+
<?php /** @var $notification \Magento\AdminNotification\Model\Inbox */ ?>
32+
<li class="notifications-entry<?php if ($notification->getSeverity() == 1) : ?> notifications-critical<?php endif; ?>"
33+
data-notification-id="<?= $block->escapeHtmlAttr($notification->getId()) ?>"
34+
data-notification-severity="<?php if ($notification->getSeverity() == 1) : ?>1<?php endif; ?>">
35+
<?php
36+
$notificationDescription = $notification->getDescription();
37+
$notificationDescriptionLength = $block->getNotificationDescriptionLength();
38+
?>
39+
<strong class="notifications-entry-title">
40+
<?= $block->escapeHtml($notification->getTitle()) ?>
41+
</strong>
42+
<?php if (strlen($notificationDescription) > $notificationDescriptionLength) : ?>
43+
<p class="notifications-entry-description _cutted">
44+
<span class="notifications-entry-description-start">
45+
<?= $block->escapeHtml(substr($notificationDescription, 0, $notificationDescriptionLength)) ?>
46+
</span>
47+
<span class="notifications-entry-description-end">
48+
<?= $block->escapeHtml(substr($notificationDescription, $notificationDescriptionLength)) ?>
49+
</span>
50+
</p>
51+
<?php else : ?>
52+
<p class="notifications-entry-description">
53+
<?= $block->escapeHtml($notificationDescription) ?>
54+
</p>
55+
<?php endif; ?>
56+
<time class="notifications-entry-time">
57+
<?= $block->escapeHtml($block->formatNotificationDate($notification->getDateAdded())) ?>
58+
</time>
59+
<button
60+
type="button"
61+
class="notifications-close"
62+
title="<?= $block->escapeHtmlAttr(__('Close')) ?>"
63+
></button>
64+
</li>
6865
<?php endforeach; ?>
6966
<li class="notifications-entry notifications-entry-last">
7067
<a
71-
href="<?= /* @escapeNotVerified */ $block->getUrl('adminhtml/notification/index') ?>"
68+
href="<?= $block->escapeUrl($block->getUrl('adminhtml/notification/index')) ?>"
7269
class="action-tertiary action-more">
73-
<?= /* @escapeNotVerified */ __('See All (') ?><span class="notifications-counter"><?= /* @escapeNotVerified */ $notificationCount ?></span><?= /* @escapeNotVerified */ __(' unread)') ?>
70+
<?= $block->escapeHtml(__('See All (')) ?><span class="notifications-counter"><?= (int)$notificationCount ?></span><?= $block->escapeHtml(__(' unread)')) ?>
7471
</a>
7572
</li>
7673
</ul>
7774
<?php else : ?>
7875
<a
7976
class="notifications-action admin__action-dropdown"
80-
href="<?= /* @escapeNotVerified */ $block->getUrl('adminhtml/notification/index') ?>"
81-
title="<?= /* @escapeNotVerified */ __('Notifications') ?>">
77+
href="<?= $block->escapeUrl($block->getUrl('adminhtml/notification/index')) ?>"
78+
title="<?= $block->escapeHtmlAttr(__('Notifications')) ?>">
8279
</a>
8380
<?php endif; ?>
8481
</div>

0 commit comments

Comments
 (0)