From e8ef9fdb61deb43f36868583a07bcbc4d659bb3e Mon Sep 17 00:00:00 2001 From: Kateryna Muntianu Date: Fri, 6 Nov 2015 17:31:57 +0200 Subject: [PATCH 01/16] MAGETWO-45132: Fix failing functional autotests - Fixed intermittent error with verifying cart prices --- .../Constraint/AssertCatalogPriceRuleAppliedShoppingCart.php | 1 + 1 file changed, 1 insertion(+) diff --git a/dev/tests/functional/tests/app/Magento/CatalogRule/Test/Constraint/AssertCatalogPriceRuleAppliedShoppingCart.php b/dev/tests/functional/tests/app/Magento/CatalogRule/Test/Constraint/AssertCatalogPriceRuleAppliedShoppingCart.php index 252a96620ece4..6e4a853cc56ad 100644 --- a/dev/tests/functional/tests/app/Magento/CatalogRule/Test/Constraint/AssertCatalogPriceRuleAppliedShoppingCart.php +++ b/dev/tests/functional/tests/app/Magento/CatalogRule/Test/Constraint/AssertCatalogPriceRuleAppliedShoppingCart.php @@ -59,6 +59,7 @@ public function processAssert( ); } $checkoutCartPage->getTotalsBlock()->waitForShippingPriceBlock(); + $checkoutCartPage->getTotalsBlock()->waitForUpdatedTotals(); $actualPrices['sub_total'] = $checkoutCartPage->getTotalsBlock()->getSubtotal(); $actualPrices['grand_total'] = $checkoutCartPage->getTotalsBlock()->getGrandTotal(); $expectedPrices['sub_total'] = $cartPrice['sub_total']; From 24300a39804eca31fb35fba94470ab76ba5a7288 Mon Sep 17 00:00:00 2001 From: Kateryna Muntianu Date: Thu, 26 Nov 2015 18:31:22 +0200 Subject: [PATCH 02/16] MAGETWO-45132: Fix failing functional autotests - Updated CatalogRule test variation names - Updated test data --- ...ApplySeveralCatalogPriceRuleEntityTest.xml | 4 ++-- .../CreateCatalogPriceRuleEntityTest.xml | 4 ++-- .../Test/TestCase/CreateCatalogRuleTest.xml | 20 +++++++++---------- .../DeleteCatalogPriceRuleEntityTest.xml | 2 +- .../UpdateCatalogPriceRuleEntityTest.xml | 4 ++-- 5 files changed, 17 insertions(+), 17 deletions(-) diff --git a/dev/tests/functional/tests/app/Magento/CatalogRule/Test/TestCase/ApplySeveralCatalogPriceRuleEntityTest.xml b/dev/tests/functional/tests/app/Magento/CatalogRule/Test/TestCase/ApplySeveralCatalogPriceRuleEntityTest.xml index badfc6ea14f32..a5ffa45790bb4 100644 --- a/dev/tests/functional/tests/app/Magento/CatalogRule/Test/TestCase/ApplySeveralCatalogPriceRuleEntityTest.xml +++ b/dev/tests/functional/tests/app/Magento/CatalogRule/Test/TestCase/ApplySeveralCatalogPriceRuleEntityTest.xml @@ -7,7 +7,7 @@ --> - + catalog_price_rule_priority_0 - catalog_price_rule_priority_2 @@ -21,7 +21,7 @@ - + catalog_price_rule_priority_0 catalog_price_rule_priority_1_stop_further_rules catalog_price_rule_priority_2 diff --git a/dev/tests/functional/tests/app/Magento/CatalogRule/Test/TestCase/CreateCatalogPriceRuleEntityTest.xml b/dev/tests/functional/tests/app/Magento/CatalogRule/Test/TestCase/CreateCatalogPriceRuleEntityTest.xml index 4df5d75c7c0d7..2df1bbd0cdf89 100644 --- a/dev/tests/functional/tests/app/Magento/CatalogRule/Test/TestCase/CreateCatalogPriceRuleEntityTest.xml +++ b/dev/tests/functional/tests/app/Magento/CatalogRule/Test/TestCase/CreateCatalogPriceRuleEntityTest.xml @@ -7,7 +7,7 @@ --> - + CatalogPriceRule %isolation% Catalog Price Rule Description Active @@ -21,7 +21,7 @@ - + CatalogPriceRule %isolation% Catalog Price Rule Description Inactive diff --git a/dev/tests/functional/tests/app/Magento/CatalogRule/Test/TestCase/CreateCatalogRuleTest.xml b/dev/tests/functional/tests/app/Magento/CatalogRule/Test/TestCase/CreateCatalogRuleTest.xml index 7f7147a083837..4282453505e69 100644 --- a/dev/tests/functional/tests/app/Magento/CatalogRule/Test/TestCase/CreateCatalogRuleTest.xml +++ b/dev/tests/functional/tests/app/Magento/CatalogRule/Test/TestCase/CreateCatalogRuleTest.xml @@ -7,7 +7,7 @@ --> - + MAGETWO-23036 rule_name%isolation% Active @@ -28,7 +28,7 @@ - + customer_with_new_customer_group simple_10_dollar rule_name%isolation% @@ -53,7 +53,7 @@ - + product_with_custom_color_attribute Catalog Price Rule %isolation% Active @@ -61,13 +61,13 @@ NOT LOGGED IN attribute [%attribute_name%|is|%attribute_value%] - Apply as percentage of original - 50 - 280 - 285 - 280 - 280 - 280 + Adjust final price to discount value + 99.99 + 99.99 + 104.99 + 460.01 + 99.99 + 99.99 560 diff --git a/dev/tests/functional/tests/app/Magento/CatalogRule/Test/TestCase/DeleteCatalogPriceRuleEntityTest.xml b/dev/tests/functional/tests/app/Magento/CatalogRule/Test/TestCase/DeleteCatalogPriceRuleEntityTest.xml index 5a39558a81bc8..e1bead38cd69c 100644 --- a/dev/tests/functional/tests/app/Magento/CatalogRule/Test/TestCase/DeleteCatalogPriceRuleEntityTest.xml +++ b/dev/tests/functional/tests/app/Magento/CatalogRule/Test/TestCase/DeleteCatalogPriceRuleEntityTest.xml @@ -7,7 +7,7 @@ --> - + active_catalog_price_rule_with_conditions diff --git a/dev/tests/functional/tests/app/Magento/CatalogRule/Test/TestCase/UpdateCatalogPriceRuleEntityTest.xml b/dev/tests/functional/tests/app/Magento/CatalogRule/Test/TestCase/UpdateCatalogPriceRuleEntityTest.xml index df9f88edb2dd2..94f6b1265361d 100644 --- a/dev/tests/functional/tests/app/Magento/CatalogRule/Test/TestCase/UpdateCatalogPriceRuleEntityTest.xml +++ b/dev/tests/functional/tests/app/Magento/CatalogRule/Test/TestCase/UpdateCatalogPriceRuleEntityTest.xml @@ -7,7 +7,7 @@ --> - + active_catalog_price_rule_with_conditions New Catalog Price Rule Name %isolation% Inactive @@ -18,7 +18,7 @@ - + active_catalog_price_rule_with_conditions New Catalog Price Rule Name %isolation% New Catalog Price Rule Description %isolation% From b5ac66bf3c2cc0c6a090f1e0e0ea4fbb682dbe2f Mon Sep 17 00:00:00 2001 From: Vitalii Zabaznov Date: Fri, 27 Nov 2015 17:18:07 +0200 Subject: [PATCH 03/16] MAGETWO-45953: Internal error exposed with custom option file --- .../Option/Type/File/ValidatorFile.php | 19 +++++++++++++++++-- 1 file changed, 17 insertions(+), 2 deletions(-) diff --git a/app/code/Magento/Catalog/Model/Product/Option/Type/File/ValidatorFile.php b/app/code/Magento/Catalog/Model/Product/Option/Type/File/ValidatorFile.php index 1b3b2c5f0d8f3..da42abe5f06b7 100644 --- a/app/code/Magento/Catalog/Model/Product/Option/Type/File/ValidatorFile.php +++ b/app/code/Magento/Catalog/Model/Product/Option/Type/File/ValidatorFile.php @@ -57,22 +57,30 @@ class ValidatorFile extends Validator */ protected $product; + /** + * @var \Magento\Framework\Validator\File\IsImage + */ + protected $isImageValidator; + /** * @param \Magento\Framework\App\Config\ScopeConfigInterface $scopeConfig * @param \Magento\Framework\Filesystem $filesystem * @param \Magento\Framework\File\Size $fileSize * @param \Magento\Framework\HTTP\Adapter\FileTransferFactory $httpFactory + * @param \Magento\Framework\Validator\File\IsImage $isImageValidator * @throws \Magento\Framework\Exception\FileSystemException */ public function __construct( \Magento\Framework\App\Config\ScopeConfigInterface $scopeConfig, \Magento\Framework\Filesystem $filesystem, \Magento\Framework\File\Size $fileSize, - \Magento\Framework\HTTP\Adapter\FileTransferFactory $httpFactory + \Magento\Framework\HTTP\Adapter\FileTransferFactory $httpFactory, + \Magento\Framework\Validator\File\IsImage $isImageValidator ) { $this->mediaDirectory = $filesystem->getDirectoryWrite(DirectoryList::MEDIA); $this->filesystem = $filesystem; $this->httpFactory = $httpFactory; + $this->isImageValidator = $isImageValidator; parent::__construct($scopeConfig, $filesystem, $fileSize); } @@ -169,7 +177,14 @@ public function validate($processingParams, $option) $_height = 0; if ($tmpDirectory->isReadable($tmpDirectory->getRelativePath($fileInfo['tmp_name']))) { - $imageSize = getimagesize($fileInfo['tmp_name']); + if (filesize($fileInfo['tmp_name'])) { + if ($this->isImageValidator->isValid($fileInfo['tmp_name'])) { + $imageSize = getimagesize($fileInfo['tmp_name']); + } + } else { + throw new LocalizedException(__('You cannot upload empty file')); + } + if ($imageSize) { $_width = $imageSize[0]; $_height = $imageSize[1]; From de613aba01288e6d635d84c5e1b4a0b248ad0fa3 Mon Sep 17 00:00:00 2001 From: Vitalii Zabaznov Date: Fri, 27 Nov 2015 18:29:36 +0200 Subject: [PATCH 04/16] MAGETWO-45953: Internal error exposed with custom option file - fix message, and message to i18n --- .../Catalog/Model/Product/Option/Type/File/ValidatorFile.php | 2 +- app/code/Magento/Catalog/i18n/en_US.csv | 1 + 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/app/code/Magento/Catalog/Model/Product/Option/Type/File/ValidatorFile.php b/app/code/Magento/Catalog/Model/Product/Option/Type/File/ValidatorFile.php index da42abe5f06b7..a752284358b0c 100644 --- a/app/code/Magento/Catalog/Model/Product/Option/Type/File/ValidatorFile.php +++ b/app/code/Magento/Catalog/Model/Product/Option/Type/File/ValidatorFile.php @@ -182,7 +182,7 @@ public function validate($processingParams, $option) $imageSize = getimagesize($fileInfo['tmp_name']); } } else { - throw new LocalizedException(__('You cannot upload empty file')); + throw new LocalizedException(__('The file is empty. Please choose another one')); } if ($imageSize) { diff --git a/app/code/Magento/Catalog/i18n/en_US.csv b/app/code/Magento/Catalog/i18n/en_US.csv index 12c16c5b7234c..8580eb33942b2 100644 --- a/app/code/Magento/Catalog/i18n/en_US.csv +++ b/app/code/Magento/Catalog/i18n/en_US.csv @@ -699,3 +699,4 @@ Autosettings,Autosettings "Allow Gift Message","Allow Gift Message" "Meta Title","Meta Title" "Maximum 255 chars","Maximum 255 chars" +"The file is empty. Please choose another one","The file is empty. Please choose another one" From 0f47446aa7b12f3989be25e2985223d33d4fb4e2 Mon Sep 17 00:00:00 2001 From: Vitalii Zabaznov Date: Mon, 30 Nov 2015 13:59:29 +0200 Subject: [PATCH 05/16] MAGETWO-45953: Internal error exposed with custom option file --- .../Catalog/Model/Product/Option/Type/File/ValidatorFile.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/app/code/Magento/Catalog/Model/Product/Option/Type/File/ValidatorFile.php b/app/code/Magento/Catalog/Model/Product/Option/Type/File/ValidatorFile.php index a752284358b0c..118c82f9f8665 100644 --- a/app/code/Magento/Catalog/Model/Product/Option/Type/File/ValidatorFile.php +++ b/app/code/Magento/Catalog/Model/Product/Option/Type/File/ValidatorFile.php @@ -185,7 +185,7 @@ public function validate($processingParams, $option) throw new LocalizedException(__('The file is empty. Please choose another one')); } - if ($imageSize) { + if (!empty($imageSize)) { $_width = $imageSize[0]; $_height = $imageSize[1]; } From fe075512b3d7c8cf703674d89efe6a82f364823f Mon Sep 17 00:00:00 2001 From: Vitalii Zabaznov Date: Mon, 30 Nov 2015 19:03:06 +0200 Subject: [PATCH 06/16] MAGETWO-45954: Stored XSS through custom options --- .../catalog/product/composite/fieldset/options/type/file.phtml | 2 +- .../frontend/templates/product/view/options/type/file.phtml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/app/code/Magento/Catalog/view/adminhtml/templates/catalog/product/composite/fieldset/options/type/file.phtml b/app/code/Magento/Catalog/view/adminhtml/templates/catalog/product/composite/fieldset/options/type/file.phtml index 644226409aa72..0e44b0639f4dd 100644 --- a/app/code/Magento/Catalog/view/adminhtml/templates/catalog/product/composite/fieldset/options/type/file.phtml +++ b/app/code/Magento/Catalog/view/adminhtml/templates/catalog/product/composite/fieldset/options/type/file.phtml @@ -68,7 +68,7 @@ require(['prototype'], function(){
- getTitle(); ?> + escapeHtml($_fileInfo->getTitle()); ?>   diff --git a/app/code/Magento/Catalog/view/frontend/templates/product/view/options/type/file.phtml b/app/code/Magento/Catalog/view/frontend/templates/product/view/options/type/file.phtml index a7c60b9f3a920..9b9a7e3f998b9 100644 --- a/app/code/Magento/Catalog/view/frontend/templates/product/view/options/type/file.phtml +++ b/app/code/Magento/Catalog/view/frontend/templates/product/view/options/type/file.phtml @@ -23,7 +23,7 @@
- getTitle(); ?> + escapeHtml($_fileInfo->getTitle()); ?> From 26540a24be6788f0fbce1402d1c86b29a84c65de Mon Sep 17 00:00:00 2001 From: Vitalii Zabaznov Date: Thu, 3 Dec 2015 13:38:33 +0200 Subject: [PATCH 07/16] MAGETWO-45954: Stored XSS through custom options - fix CS --- .../product/composite/fieldset/options/type/file.phtml | 4 ++-- .../templates/product/view/options/type/file.phtml | 10 +++++----- 2 files changed, 7 insertions(+), 7 deletions(-) diff --git a/app/code/Magento/Catalog/view/adminhtml/templates/catalog/product/composite/fieldset/options/type/file.phtml b/app/code/Magento/Catalog/view/adminhtml/templates/catalog/product/composite/fieldset/options/type/file.phtml index 0e44b0639f4dd..861a4e9a0424a 100644 --- a/app/code/Magento/Catalog/view/adminhtml/templates/catalog/product/composite/fieldset/options/type/file.phtml +++ b/app/code/Magento/Catalog/view/adminhtml/templates/catalog/product/composite/fieldset/options/type/file.phtml @@ -68,7 +68,7 @@ require(['prototype'], function(){
- escapeHtml($_fileInfo->getTitle()); ?> + escapeHtml($_fileInfo->getTitle()); ?>   @@ -79,7 +79,7 @@ require(['prototype'], function(){
> - /> + /> getFileExtension()): ?> diff --git a/app/code/Magento/Catalog/view/frontend/templates/product/view/options/type/file.phtml b/app/code/Magento/Catalog/view/frontend/templates/product/view/options/type/file.phtml index 9b9a7e3f998b9..7ced840c1060a 100644 --- a/app/code/Magento/Catalog/view/frontend/templates/product/view/options/type/file.phtml +++ b/app/code/Magento/Catalog/view/frontend/templates/product/view/options/type/file.phtml @@ -17,14 +17,14 @@ getIsRequire()) ? ' required' : ''; ?>
-