Skip to content

Commit e367c18

Browse files
author
Korshenko, Olexii(okorshenko)
committed
Merge pull request #305 from okorshenko/2.0
Magneto 2.0.1 Bug Fixes (Combined)
2 parents e7f5b9f + b97b7d4 commit e367c18

File tree

79 files changed

+1106
-488
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

79 files changed

+1106
-488
lines changed

‎CHANGELOG.md

+16
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,19 @@
1+
2.0.1
2+
=============
3+
* Fixed bugs:
4+
* Fixed an issue where can't deploy sample data after "composer create-project"
5+
* Fixed a security issue on user account page
6+
* Fixed a security issue on product page
7+
* Fixed an issue where possible edit someone else reviews
8+
* Fixed an issue where possible view order details for certain orders
9+
* Fixed an issue where catalog price rule isn't applied to product created using Web API
10+
* Fixed a potential vulnerability where possible insert SQL injection
11+
* Fixed a potential vulnerability on checkout page
12+
* Fixed an issue with upload empty file to custom option
13+
* Fixed an issue with performance on customer edit form
14+
* GitHub requests:
15+
* [#2519](https://github.com/magento/magento2/issues/2519) -- Fixed an issue where synonyms don't work with Magento 2.0
16+
117
2.0.0
218
=============
319
* Fixed bugs:

‎app/code/Magento/Authorizenet/Test/Unit/Model/DirectpostTest.php

+1-1
Original file line numberDiff line numberDiff line change
@@ -331,7 +331,7 @@ public function testCheckResponseCodeFailure($responseCode)
331331
$this->dataHelperMock->expects($this->any())
332332
->method('wrapGatewayError')
333333
->with($reasonText)
334-
->willReturn(__('Gateway error: ' . $reasonText));
334+
->willReturn(__('Gateway error: %1', $reasonText));
335335

336336
$this->directpost->checkResponseCode();
337337
}

‎app/code/Magento/Backend/i18n/en_US.csv

+1-1
Original file line numberDiff line numberDiff line change
@@ -306,7 +306,7 @@ YTD,YTD
306306
"Maximum sender name length is 255. Please correct your settings.","Maximum sender name length is 255. Please correct your settings."
307307
"The file you're uploading exceeds the server size limit of %1 kilobytes.","The file you're uploading exceeds the server size limit of %1 kilobytes."
308308
"The base directory to upload file is not specified.","The base directory to upload file is not specified."
309-
"The specified image adapter cannot be used because of: ","The specified image adapter cannot be used because of: "
309+
"The specified image adapter cannot be used because of: %1","The specified image adapter cannot be used because of: %1"
310310
"Default scope","Default scope"
311311
"Base currency","Base currency"
312312
"Display default currency","Display default currency"

‎app/code/Magento/Backend/view/adminhtml/templates/page/js/require_js.phtml

+3
Original file line numberDiff line numberDiff line change
@@ -7,4 +7,7 @@
77
<script>
88
var BASE_URL = '<?php /* @escapeNotVerified */ echo $block->getUrl('*') ?>';
99
var FORM_KEY = '<?php /* @escapeNotVerified */ echo $block->getFormKey() ?>';
10+
var require = {
11+
"baseUrl": "<?php /* @escapeNotVerified */ echo $block->getViewFileUrl('/') ?>"
12+
};
1013
</script>

‎app/code/Magento/Catalog/Model/Product/Option/Type/File/Validator.php

+11
Original file line numberDiff line numberDiff line change
@@ -100,6 +100,17 @@ protected function getValidatorErrors($errors, $fileInfo, $option)
100100
$this->fileSize->getMaxFileSizeInMb()
101101
);
102102
break;
103+
case \Zend_Validate_File_ImageSize::NOT_DETECTED:
104+
$result[] = __(
105+
"The file '%1' is empty. Please choose another one",
106+
$fileInfo['title']
107+
);
108+
break;
109+
default:
110+
$result[] = __(
111+
"The file '%1' is invalid. Please choose another one",
112+
$fileInfo['title']
113+
);
103114
}
104115
}
105116
return $result;

‎app/code/Magento/Catalog/Model/Product/Option/Type/File/ValidatorFile.php

+18-3
Original file line numberDiff line numberDiff line change
@@ -57,22 +57,30 @@ class ValidatorFile extends Validator
5757
*/
5858
protected $product;
5959

60+
/**
61+
* @var \Magento\Framework\Validator\File\IsImage
62+
*/
63+
protected $isImageValidator;
64+
6065
/**
6166
* @param \Magento\Framework\App\Config\ScopeConfigInterface $scopeConfig
6267
* @param \Magento\Framework\Filesystem $filesystem
6368
* @param \Magento\Framework\File\Size $fileSize
6469
* @param \Magento\Framework\HTTP\Adapter\FileTransferFactory $httpFactory
70+
* @param \Magento\Framework\Validator\File\IsImage $isImageValidator
6571
* @throws \Magento\Framework\Exception\FileSystemException
6672
*/
6773
public function __construct(
6874
\Magento\Framework\App\Config\ScopeConfigInterface $scopeConfig,
6975
\Magento\Framework\Filesystem $filesystem,
7076
\Magento\Framework\File\Size $fileSize,
71-
\Magento\Framework\HTTP\Adapter\FileTransferFactory $httpFactory
77+
\Magento\Framework\HTTP\Adapter\FileTransferFactory $httpFactory,
78+
\Magento\Framework\Validator\File\IsImage $isImageValidator
7279
) {
7380
$this->mediaDirectory = $filesystem->getDirectoryWrite(DirectoryList::MEDIA);
7481
$this->filesystem = $filesystem;
7582
$this->httpFactory = $httpFactory;
83+
$this->isImageValidator = $isImageValidator;
7684
parent::__construct($scopeConfig, $filesystem, $fileSize);
7785
}
7886

@@ -169,8 +177,15 @@ public function validate($processingParams, $option)
169177
$_height = 0;
170178

171179
if ($tmpDirectory->isReadable($tmpDirectory->getRelativePath($fileInfo['tmp_name']))) {
172-
$imageSize = getimagesize($fileInfo['tmp_name']);
173-
if ($imageSize) {
180+
if (filesize($fileInfo['tmp_name'])) {
181+
if ($this->isImageValidator->isValid($fileInfo['tmp_name'])) {
182+
$imageSize = getimagesize($fileInfo['tmp_name']);
183+
}
184+
} else {
185+
throw new LocalizedException(__('The file is empty. Please choose another one'));
186+
}
187+
188+
if (!empty($imageSize)) {
174189
$_width = $imageSize[0];
175190
$_height = $imageSize[1];
176191
}

‎app/code/Magento/Catalog/i18n/en_US.csv

+1
Original file line numberDiff line numberDiff line change
@@ -699,3 +699,4 @@ Autosettings,Autosettings
699699
"Allow Gift Message","Allow Gift Message"
700700
"Meta Title","Meta Title"
701701
"Maximum 255 chars","Maximum 255 chars"
702+
"The file is empty. Please choose another one","The file is empty. Please choose another one"

‎app/code/Magento/Catalog/view/adminhtml/templates/catalog/product/composite/fieldset/options/type/file.phtml

+2-2
Original file line numberDiff line numberDiff line change
@@ -68,7 +68,7 @@ require(['prototype'], function(){
6868
</label>
6969
<div class="admin__field-control control">
7070
<?php if ($_fileExists): ?>
71-
<span class="<?php /* @escapeNotVerified */ echo $_fileNamed ?>"><?php /* @escapeNotVerified */ echo $_fileInfo->getTitle(); ?></span>
71+
<span class="<?php /* @noEscape */ echo $_fileNamed ?>"><?php echo $block->escapeHtml($_fileInfo->getTitle()); ?></span>
7272
<a href="javascript:void(0)" class="label" onclick="opFile<?php /* @escapeNotVerified */ echo $_rand; ?>.toggleFileChange($(this).next('.input-box'))">
7373
<?php /* @escapeNotVerified */ echo __('Change') ?>
7474
</a>&nbsp;
@@ -79,7 +79,7 @@ require(['prototype'], function(){
7979
<?php endif; ?>
8080
<div class="input-box" <?php echo $_fileExists ? 'style="display:none"' : '' ?>>
8181
<!-- ToDo UI: add appropriate file class when z-index issue in ui dialog will be resolved -->
82-
<input type="file" name="<?php /* @escapeNotVerified */ echo $_fileName; ?>" class="product-custom-option<?php echo $_option->getIsRequire() ? ' required-entry' : '' ?>" price="<?php /* @escapeNotVerified */ echo $block->getCurrencyPrice($_option->getPrice(true)) ?>" <?php echo $_fileExists ? 'disabled="disabled"' : '' ?>/>
82+
<input type="file" name="<?php /* @noEscape */ echo $_fileName; ?>" class="product-custom-option<?php echo $_option->getIsRequire() ? ' required-entry' : '' ?>" price="<?php /* @escapeNotVerified */ echo $block->getCurrencyPrice($_option->getPrice(true)) ?>" <?php echo $_fileExists ? 'disabled="disabled"' : '' ?>/>
8383
<input type="hidden" name="<?php /* @escapeNotVerified */ echo $_fieldNameAction; ?>" value="<?php /* @escapeNotVerified */ echo $_fieldValueAction; ?>" />
8484

8585
<?php if ($_option->getFileExtension()): ?>

‎app/code/Magento/Catalog/view/adminhtml/web/js/new-category-dialog.js

+33-11
Original file line numberDiff line numberDiff line change
@@ -83,20 +83,42 @@ define([
8383
var thisButton = $(e.currentTarget);
8484

8585
thisButton.prop('disabled', true);
86+
87+
var postData = {
88+
general: {
89+
name: $('#new_category_name').val(),
90+
is_active: 1,
91+
include_in_menu: 1
92+
},
93+
parent: $('#new_category_parent').val(),
94+
use_config: ['available_sort_by', 'default_sort_by'],
95+
form_key: FORM_KEY,
96+
return_session_messages_only: 1
97+
};
98+
99+
var fields = {};
100+
101+
$.each($(newCategoryForm).serializeArray(), function(_, field) {
102+
if (
103+
field.name &&
104+
field.name != 'new_category_name' &&
105+
field.name != 'new_category_parent'
106+
) {
107+
if (fields.hasOwnProperty(field.name)) {
108+
fields[field.name] = $.makeArray(fields[field.name]);
109+
fields[field.name].push(field.value);
110+
}
111+
else {
112+
fields[field.name] = field.value;
113+
}
114+
}
115+
});
116+
$.extend(postData, fields);
117+
86118
$.ajax({
87119
type: 'POST',
88120
url: widget.options.saveCategoryUrl,
89-
data: {
90-
general: {
91-
name: $('#new_category_name').val(),
92-
is_active: 1,
93-
include_in_menu: 1
94-
},
95-
parent: $('#new_category_parent').val(),
96-
use_config: ['available_sort_by', 'default_sort_by'],
97-
form_key: FORM_KEY,
98-
return_session_messages_only: 1
99-
},
121+
data: postData,
100122
dataType: 'json',
101123
context: $('body')
102124
}).success(function (data) {

‎app/code/Magento/Catalog/view/frontend/templates/product/view/options/type/file.phtml

+5-5
Original file line numberDiff line numberDiff line change
@@ -17,14 +17,14 @@
1717
<?php $class = ($_option->getIsRequire()) ? ' required' : ''; ?>
1818

1919
<div class="field file<?php /* @escapeNotVerified */ echo $class; ?>">
20-
<label class="label" for="<?php /* @escapeNotVerified */ echo $_fileName; ?>" id="<?php /* @escapeNotVerified */ echo $_fileName; ?>-label">
20+
<label class="label" for="<?php /* @noEscape */ echo $_fileName; ?>" id="<?php /* @noEscape */ echo $_fileName; ?>-label">
2121
<span><?php echo $block->escapeHtml($_option->getTitle()) ?></span>
2222
<?php /* @escapeNotVerified */ echo $block->getFormatedPrice() ?>
2323
</label>
2424
<?php if ($_fileExists): ?>
2525
<div class="control">
26-
<span class="<?php /* @escapeNotVerified */ echo $_fileNamed ?>"><?php /* @escapeNotVerified */ echo $_fileInfo->getTitle(); ?></span>
27-
<a href="javascript:void(0)" class="label" id="change-<?php /* @escapeNotVerified */ echo $_fileName ?>" >
26+
<span class="<?php /* @noEscape */ echo $_fileNamed ?>"><?php echo $block->escapeHtml($_fileInfo->getTitle()); ?></span>
27+
<a href="javascript:void(0)" class="label" id="change-<?php /* @noEscape */ echo $_fileName ?>" >
2828
<?php /* @escapeNotVerified */ echo __('Change') ?>
2929
</a>
3030
<?php if (!$_option->getIsRequire()): ?>
@@ -35,8 +35,8 @@
3535
<?php endif; ?>
3636
<div class="control" id="input-box-<?php /* @escapeNotVerified */ echo $_fileName ?>"
3737
data-mage-init='{"priceOptionFile":{
38-
"fileName":"<?php /* @escapeNotVerified */ echo $_fileName ?>",
39-
"fileNamed":"<?php /* @escapeNotVerified */ echo $_fileNamed ?>",
38+
"fileName":"<?php /* @noEscape */ echo $_fileName ?>",
39+
"fileNamed":"<?php /* @noEscape */ echo $_fileNamed ?>",
4040
"fieldNameAction":"<?php /* @escapeNotVerified */ echo $_fieldNameAction ?>",
4141
"changeFileSelector":"#change-<?php /* @escapeNotVerified */ echo $_fileName ?>",
4242
"deleteFileSelector":"#delete-<?php /* @escapeNotVerified */ echo $_fileName ?>"}

‎app/code/Magento/CatalogRule/Plugin/Indexer/Product/Save/ApplyRulesAfterReindex.php

+40
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
<?php
2+
/**
3+
* Copyright © 2015 Magento. All rights reserved.
4+
* See COPYING.txt for license details.
5+
*/
6+
namespace Magento\CatalogRule\Plugin\Indexer\Product\Save;
7+
8+
use Magento\CatalogRule\Model\Indexer\Product\ProductRuleProcessor;
9+
10+
class ApplyRulesAfterReindex
11+
{
12+
/**
13+
* @var ProductRuleProcessor
14+
*/
15+
protected $productRuleProcessor;
16+
17+
/**
18+
* @param ProductRuleProcessor $productRuleProcessor
19+
*/
20+
public function __construct(ProductRuleProcessor $productRuleProcessor)
21+
{
22+
$this->productRuleProcessor = $productRuleProcessor;
23+
}
24+
25+
/**
26+
* Apply catalog rules after product resource model save
27+
*
28+
* @param \Magento\Catalog\Model\Product $subject
29+
* @param callable $proceed
30+
* @return \Magento\Catalog\Model\Product
31+
*/
32+
public function aroundReindex(
33+
\Magento\Catalog\Model\Product $subject,
34+
callable $proceed
35+
) {
36+
$proceed();
37+
$this->productRuleProcessor->reindexRow($subject->getId());
38+
return;
39+
}
40+
}

‎app/code/Magento/CatalogRule/etc/webapi_rest/di.xml

+12
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
<?xml version="1.0"?>
2+
<!--
3+
/**
4+
* Copyright © 2015 Magento. All rights reserved.
5+
* See COPYING.txt for license details.
6+
*/
7+
-->
8+
<config xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="urn:magento:framework:ObjectManager/etc/config.xsd">
9+
<type name="Magento\Catalog\Model\Product">
10+
<plugin name="apply_catalog_rules_after_product_save_and_reindex" type="Magento\CatalogRule\Plugin\Indexer\Product\Save\ApplyRulesAfterReindex"/>
11+
</type>
12+
</config>

‎app/code/Magento/CatalogSearch/Model/Adapter/Mysql/Filter/Preprocessor.php

+3-3
Original file line numberDiff line numberDiff line change
@@ -107,7 +107,7 @@ private function processQueryWithField(FilterInterface $filter, $isNegation, $qu
107107
$query
108108
);
109109
} elseif ($filter->getField() === 'category_ids') {
110-
return 'category_ids_index.category_id = ' . $filter->getValue();
110+
return 'category_ids_index.category_id = ' . (int) $filter->getValue();
111111
} elseif ($attribute->isStatic()) {
112112
$alias = $this->tableMapper->getMappingAlias($filter);
113113
$resultQuery = str_replace(
@@ -194,10 +194,10 @@ private function processTermSelect(FilterInterface $filter, $isNegation)
194194
$value = sprintf(
195195
'%s IN (%s)',
196196
($isNegation ? 'NOT' : ''),
197-
implode(',', $filter->getValue())
197+
implode(',', array_map([$this->connection, 'quote'], $filter->getValue()))
198198
);
199199
} else {
200-
$value = ($isNegation ? '!' : '') . '= ' . $filter->getValue();
200+
$value = ($isNegation ? '!' : '') . '= ' . $this->connection->quote($filter->getValue());
201201
}
202202
$resultQuery = sprintf(
203203
'%1$s.value %2$s',

‎app/code/Magento/CatalogSearch/Test/Unit/Model/Adapter/Mysql/Filter/PreprocessorTest.php

+21-4
Original file line numberDiff line numberDiff line change
@@ -104,7 +104,7 @@ protected function setUp()
104104
->getMock();
105105
$this->connection = $this->getMockBuilder('\Magento\Framework\DB\Adapter\AdapterInterface')
106106
->disableOriginalConstructor()
107-
->setMethods(['select', 'getIfNullSql'])
107+
->setMethods(['select', 'getIfNullSql', 'quote'])
108108
->getMockForAbstractClass();
109109
$this->select = $this->getMockBuilder('\Magento\Framework\DB\Select')
110110
->disableOriginalConstructor()
@@ -170,9 +170,25 @@ public function testProcessPrice()
170170
$this->assertSame($expectedResult, $this->removeWhitespaces($actualResult));
171171
}
172172

173-
public function testProcessCategoryIds()
173+
/**
174+
* @return array
175+
*/
176+
public function processCategoryIdsDataProvider()
177+
{
178+
return [
179+
['5', 'category_ids_index.category_id = 5'],
180+
[3, 'category_ids_index.category_id = 3'],
181+
["' and 1 = 0", 'category_ids_index.category_id = 0'],
182+
];
183+
}
184+
185+
/**
186+
* @param string|int $categoryId
187+
* @param string $expectedResult
188+
* @dataProvider processCategoryIdsDataProvider
189+
*/
190+
public function testProcessCategoryIds($categoryId, $expectedResult)
174191
{
175-
$expectedResult = 'category_ids_index.category_id = FilterValue';
176192
$isNegation = false;
177193
$query = 'SELECT category_ids FROM catalog_product_entity';
178194

@@ -182,7 +198,7 @@ public function testProcessCategoryIds()
182198

183199
$this->filter->expects($this->once())
184200
->method('getValue')
185-
->will($this->returnValue('FilterValue'));
201+
->will($this->returnValue($categoryId));
186202

187203
$this->config->expects($this->exactly(1))
188204
->method('getAttribute')
@@ -249,6 +265,7 @@ public function testProcessTermFilter($frontendInput, $fieldValue, $isNegation,
249265
->method('getValue')
250266
->willReturn($fieldValue);
251267

268+
$this->connection->expects($this->atLeastOnce())->method('quote')->willReturnArgument(0);
252269
$actualResult = $this->target->process($this->filter, $isNegation, 'This filter is not depends on used query');
253270
$this->assertSame($expected, $this->removeWhitespaces($actualResult));
254271
}

‎app/code/Magento/Checkout/Controller/Cart/Delete.php

+4
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,10 @@ class Delete extends \Magento\Checkout\Controller\Cart
1515
*/
1616
public function execute()
1717
{
18+
if (!$this->_formKeyValidator->validate($this->getRequest())) {
19+
return $this->resultRedirectFactory->create()->setPath('*/*/');
20+
}
21+
1822
$id = (int)$this->getRequest()->getParam('id');
1923
if ($id) {
2024
try {

‎app/code/Magento/Checkout/view/frontend/web/js/model/address-converter.js

+3
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,9 @@ define(
1212
function($, address, customerData, mageUtils) {
1313
'use strict';
1414
var countryData = customerData.get('directory-data');
15+
if (_.isEmpty(countryData())) {
16+
countryData(customerData.reload(['directory-data'], false));
17+
}
1518

1619
return {
1720
/**

‎app/code/Magento/Checkout/view/frontend/web/js/view/billing-address.js

+4
Original file line numberDiff line numberDiff line change
@@ -50,6 +50,10 @@ define(
5050
});
5151
addressOptions.push(newAddressOption);
5252

53+
if (_.isEmpty(countryData())) {
54+
countryData(customerData.reload(['directory-data'], false));
55+
}
56+
5357
return Component.extend({
5458
defaults: {
5559
template: 'Magento_Checkout/billing-address'

‎app/code/Magento/Checkout/view/frontend/web/js/view/shipping-address/address-renderer/default.js

+4
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,10 @@ define([
1515
], function($, ko, Component, selectShippingAddressAction, quote, formPopUpState, checkoutData, customerData) {
1616
'use strict';
1717
var countryData = customerData.get('directory-data');
18+
if (_.isEmpty(countryData())) {
19+
countryData(customerData.reload(['directory-data'], false));
20+
}
21+
1822
return Component.extend({
1923
defaults: {
2024
template: 'Magento_Checkout/shipping-address/address-renderer/default'

0 commit comments

Comments
 (0)