Merge pull request #1516 from magento-helix/MAGETWO-71868

MAGETWO-71868: Merge release branch into 2.0-develop
magento · Sep 25, 2017 · 5400465 · 5400465
2 parents 145eca3 + f4eeb17
commit 5400465
Show file tree

Hide file tree

Showing 546 changed files with 16,559 additions and 12,663 deletions.
diff --git a/app/code/Magento/AdminNotification/Controller/Adminhtml/Notification.php b/app/code/Magento/AdminNotification/Controller/Adminhtml/Notification.php
@@ -10,10 +10,7 @@
 abstract class Notification extends \Magento\Backend\App\AbstractAction
 {
     /**
-     * @return bool
+     * {@inheritdoc}
      */
-    protected function _isAllowed()
-    {
-        return $this->_authorization->isAllowed('Magento_AdminNotification::show_list');
-    }
+    const ADMIN_RESOURCE = 'Magento_AdminNotification::show_list';
 }
diff --git a/app/code/Magento/AdminNotification/Controller/Adminhtml/Notification/MarkAsRead.php b/app/code/Magento/AdminNotification/Controller/Adminhtml/Notification/MarkAsRead.php
@@ -8,6 +8,11 @@
 
 class MarkAsRead extends \Magento\AdminNotification\Controller\Adminhtml\Notification
 {
+    /**
+     * {@inheritdoc}
+     */
+    const ADMIN_RESOURCE = 'Magento_AdminNotification::mark_as_read';
+
     /**
      * @return void
      */
@@ -36,12 +41,4 @@ public function execute()
         }
         $this->_redirect('adminhtml/*/');
     }
-
-    /**
-     * @return bool
-     */
-    protected function _isAllowed()
-    {
-        return $this->_authorization->isAllowed('Magento_AdminNotification::mark_as_read');
-    }
 }
diff --git a/app/code/Magento/AdminNotification/Controller/Adminhtml/Notification/MassMarkAsRead.php b/app/code/Magento/AdminNotification/Controller/Adminhtml/Notification/MassMarkAsRead.php
@@ -8,6 +8,11 @@
 
 class MassMarkAsRead extends \Magento\AdminNotification\Controller\Adminhtml\Notification
 {
+    /**
+     * {@inheritdoc}
+     */
+    const ADMIN_RESOURCE = 'Magento_AdminNotification::mark_as_read';
+
     /**
      * @return void
      */
@@ -38,12 +43,4 @@ public function execute()
         }
         $this->_redirect('adminhtml/*/');
     }
-
-    /**
-     * @return bool
-     */
-    protected function _isAllowed()
-    {
-        return $this->_authorization->isAllowed('Magento_AdminNotification::mark_as_read');
-    }
 }
diff --git a/app/code/Magento/AdminNotification/Controller/Adminhtml/Notification/MassRemove.php b/app/code/Magento/AdminNotification/Controller/Adminhtml/Notification/MassRemove.php
@@ -8,6 +8,11 @@
 
 class MassRemove extends \Magento\AdminNotification\Controller\Adminhtml\Notification
 {
+    /**
+     * {@inheritdoc}
+     */
+    const ADMIN_RESOURCE = 'Magento_AdminNotification::adminnotification_remove';
+
     /**
      * @return void
      */
@@ -33,12 +38,4 @@ public function execute()
         }
         $this->getResponse()->setRedirect($this->_redirect->getRedirectUrl($this->getUrl('*')));
     }
-
-    /**
-     * @return bool
-     */
-    protected function _isAllowed()
-    {
-        return $this->_authorization->isAllowed('Magento_AdminNotification::adminnotification_remove');
-    }
 }
diff --git a/app/code/Magento/AdminNotification/Controller/Adminhtml/Notification/Remove.php b/app/code/Magento/AdminNotification/Controller/Adminhtml/Notification/Remove.php
@@ -8,6 +8,11 @@
 
 class Remove extends \Magento\AdminNotification\Controller\Adminhtml\Notification
 {
+    /**
+     * {@inheritdoc}
+     */
+    const ADMIN_RESOURCE = 'Magento_AdminNotification::adminnotification_remove';
+
     /**
      * @return void
      */
@@ -35,12 +40,4 @@ public function execute()
         }
         $this->_redirect('adminhtml/*/');
     }
-
-    /**
-     * @return bool
-     */
-    protected function _isAllowed()
-    {
-        return $this->_authorization->isAllowed('Magento_AdminNotification::adminnotification_remove');
-    }
 }
diff --git a/app/code/Magento/AdminNotification/Controller/Adminhtml/System/Message/ListAction.php b/app/code/Magento/AdminNotification/Controller/Adminhtml/System/Message/ListAction.php
@@ -8,6 +8,13 @@
 
 class ListAction extends \Magento\Backend\App\AbstractAction
 {
+    /**
+     * Authorization level of a basic admin session.
+     *
+     * @see _isAllowed()
+     */
+    const ADMIN_RESOURCE = 'Magento_AdminNotification::show_list';
+
     /**
      * @var \Magento\Framework\Json\Helper\Data
      */

diff --git a/app/code/Magento/AdminNotification/Model/Feed.php b/app/code/Magento/AdminNotification/Model/Feed.php
@@ -146,9 +146,9 @@ public function checkUpdate()
                     $feedData[] = [
                         'severity' => (int)$item->severity,
                         'date_added' => date('Y-m-d H:i:s', $itemPublicationDate),
-                        'title' => (string)$item->title,
-                        'description' => (string)$item->description,
-                        'url' => (string)$item->link,
+                        'title' => $this->escapeString($item->title),
+                        'description' => $this->escapeString($item->description),
+                        'url' => $this->escapeString($item->link),
                     ];
                 }
             }
@@ -244,4 +244,15 @@ public function getFeedXml()
 
         return $xml;
     }
+
+    /**
+     * Converts incoming data to string format and escapes special characters.
+     *
+     * @param \SimpleXMLElement $data
+     * @return string
+     */
+    private function escapeString(\SimpleXMLElement $data)
+    {
+        return htmlspecialchars((string)$data);
+    }
 }
diff --git a/app/code/Magento/AdminNotification/Test/Unit/Model/FeedTest.php b/app/code/Magento/AdminNotification/Test/Unit/Model/FeedTest.php
@@ -52,13 +52,25 @@ class FeedTest extends \PHPUnit_Framework_TestCase
 
     protected function setUp()
     {
-        $this->inboxFactory = $this->getMock('Magento\AdminNotification\Model\InboxFactory', ['create'], [], '', false);
-        $this->curlFactory = $this->getMock('Magento\Framework\HTTP\Adapter\CurlFactory', ['create'], [], '', false);
-        $this->curl = $this->getMockBuilder('Magento\Framework\HTTP\Adapter\Curl')
+        $this->inboxFactory = $this->getMock(
+            \Magento\AdminNotification\Model\InboxFactory::class,
+            ['create'],
+            [],
+            '',
+            false
+        );
+        $this->curlFactory = $this->getMock(
+            \Magento\Framework\HTTP\Adapter\CurlFactory::class,
+            ['create'],
+            [],
+            '',
+            false
+        );
+        $this->curl = $this->getMockBuilder(\Magento\Framework\HTTP\Adapter\Curl::class)
             ->disableOriginalConstructor()->getMock();
-        $this->appState = $this->getMock('Magento\Framework\App\State', ['getInstallDate'], [], '', false);
+        $this->appState = $this->getMock(\Magento\Framework\App\State::class, ['getInstallDate'], [], '', false);
         $this->inboxModel = $this->getMock(
-            'Magento\AdminNotification\Model\Inbox',
+            \Magento\AdminNotification\Model\Inbox::class,
             [
                 '__wakeup',
                 'parse'
@@ -68,15 +80,15 @@ protected function setUp()
             false
         );
         $this->backendConfig = $this->getMock(
-            'Magento\Backend\App\ConfigInterface',
+            \Magento\Backend\App\ConfigInterface::class,
             [
                 'getValue',
                 'setValue',
                 'isSetFlag'
             ]
         );
         $this->cacheManager = $this->getMock(
-            'Magento\Framework\App\CacheInterface',
+            \Magento\Framework\App\CacheInterface::class,
             [
                 'load',
                 'getFrontend',
@@ -86,15 +98,15 @@ protected function setUp()
             ]
         );
 
-        $this->deploymentConfig = $this->getMockBuilder('Magento\Framework\App\DeploymentConfig')
+        $this->deploymentConfig = $this->getMockBuilder(\Magento\Framework\App\DeploymentConfig::class)
             ->disableOriginalConstructor()->getMock();
         $this->objectManagerHelper = new ObjectManagerHelper($this);
 
-        $this->productMetadata = $this->getMock('Magento\Framework\App\ProductMetadata');
-        $this->urlBuilder = $this->getMock('Magento\Framework\UrlInterface');
+        $this->productMetadata = $this->getMock(\Magento\Framework\App\ProductMetadata::class);
+        $this->urlBuilder = $this->getMock(\Magento\Framework\UrlInterface::class);
 
         $this->feed = $this->objectManagerHelper->getObject(
-            'Magento\AdminNotification\Model\Feed',
+            \Magento\AdminNotification\Model\Feed::class,
             [
                 'backendConfig' => $this->backendConfig,
                 'cacheManager' => $this->cacheManager,
@@ -145,8 +157,27 @@ public function testCheckUpdate($callInbox, $curlRequest)
             ->will($this->returnValue('Sat, 6 Sep 2014 16:46:11 UTC'));
         if ($callInbox) {
             $this->inboxFactory->expects($this->once())->method('create')
-                ->will(($this->returnValue($this->inboxModel)));
-            $this->inboxModel->expects($this->once())->method('parse')->will($this->returnSelf());
+                ->will($this->returnValue($this->inboxModel));
+            $this->inboxModel->expects($this->once())
+                ->method('parse')
+                ->with(
+                    $this->callback(
+                        function ($data) {
+                            $fieldsToCheck = ['title', 'description', 'url'];
+                            return array_reduce(
+                                $fieldsToCheck,
+                                function ($initialValue, $item) use ($data) {
+                                    $haystack = (isset($data[0][$item]) ? $data[0][$item] : false);
+                                    return $haystack
+                                        ? $initialValue && !strpos($haystack, '<') && !strpos($haystack, '>')
+                                        : true;
+                                },
+                                true
+                            );
+                        }
+                    )
+                )
+                ->will($this->returnSelf());
         } else {
             $this->inboxFactory->expects($this->never())->method('create');
             $this->inboxModel->expects($this->never())->method('parse');
@@ -196,7 +227,27 @@ public function checkUpdateDataProvider()
                                 </item>
                             </channel>
                         </rss>'
-            ]
+            ],
+            [
+                true,
+                // @codingStandardsIgnoreStart
+                'HEADER
+
+                <?xml version="1.0" encoding="utf-8" ?>
+                        <rss version="2.0" xmlns:atom="http://www.w3.org/2005/Atom">
+                            <channel>
+                                <title>MagentoCommerce</title>
+                                <item>
+                                    <title><![CDATA[<script>alert("Hello!");</script>Test Title]]></title>
+                                    <link><![CDATA[http://magento.com/feed_url<script>alert("Hello!");</script>]]></link>
+                                    <severity>4</severity>
+                                    <description><![CDATA[Test <script>alert("Hello!");</script>Description]]></description>
+                                    <pubDate>Tue, 20 Jun 2017 13:14:47 UTC</pubDate>
+                                </item>
+                            </channel>
+                        </rss>'
+                // @codingStandardsIgnoreEnd
+            ],
         ];
     }
 }
diff --git a/app/code/Magento/AdminNotification/composer.json b/app/code/Magento/AdminNotification/composer.json
@@ -10,7 +10,7 @@
         "lib-libxml": "*"
     },
     "type": "magento2-module",
-    "version": "100.0.6",
+    "version": "100.0.7",
     "license": [
         "OSL-3.0",
         "AFL-3.0"

diff --git a/app/code/Magento/AdminNotification/etc/config.xml b/app/code/Magento/AdminNotification/etc/config.xml
@@ -12,7 +12,7 @@
                 <feed_url>notifications.magentocommerce.com/magento2/community/notifications.rss</feed_url>
                 <popup_url>widgets.magentocommerce.com/notificationPopup</popup_url>
                 <severity_icons_url>widgets.magentocommerce.com/%s/%s.gif</severity_icons_url>
-                <use_https>0</use_https>
+                <use_https>1</use_https>
                 <frequency>1</frequency>
                 <last_update>0</last_update>
             </adminnotification>

diff --git a/app/code/Magento/Authorizenet/Controller/Directpost/Payment/BackendResponse.php b/app/code/Magento/Authorizenet/Controller/Directpost/Payment/BackendResponse.php
@@ -6,16 +6,6 @@
  */
 namespace Magento\Authorizenet\Controller\Directpost\Payment;
 
-class BackendResponse extends \Magento\Authorizenet\Controller\Directpost\Payment
+class BackendResponse extends \Magento\Authorizenet\Controller\Directpost\Payment\Response
 {
-    /**
-     * Response action.
-     * Action for Authorize.net SIM Relay Request.
-     *
-     * @return void
-     */
-    public function execute()
-    {
-        $this->_responseAction('adminhtml');
-    }
 }
diff --git a/app/code/Magento/Authorizenet/Model/Source/Cctype.php b/app/code/Magento/Authorizenet/Model/Source/Cctype.php
@@ -17,6 +17,6 @@ class Cctype extends PaymentCctype
      */
     public function getAllowedTypes()
     {
-        return ['VI', 'MC', 'AE', 'DI', 'OT'];
+        return ['VI', 'MC', 'AE', 'DI'];
     }
 }
diff --git a/app/code/Magento/Authorizenet/composer.json b/app/code/Magento/Authorizenet/composer.json
@@ -13,7 +13,7 @@
         "magento/framework": "100.0.*"
     },
     "type": "magento2-module",
-    "version": "100.0.8",
+    "version": "100.0.9",
     "license": [
         "proprietary"
     ],

diff --git a/...nto/Authorizenet/view/frontend/layout/authorizenet_directpost_payment_backendresponse.xml b/...nto/Authorizenet/view/frontend/layout/authorizenet_directpost_payment_backendresponse.xml
@@ -7,6 +7,6 @@
 -->
 <layout xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="urn:magento:framework:View/Layout/etc/layout_generic.xsd">
     <container name="root">
-        <block class="Magento\Payment\Block\Transparent\Iframe" name="authorizenet_directpost_iframe" template="Magento_Payment::transparent/iframe.phtml"/>
+        <block class="Magento\Payment\Block\Transparent\Iframe" name="authorizenet_directpost_iframe" template="Magento_Payment::transparent/backend-iframe.phtml"/>
     </container>
 </layout>
diff --git a/app/code/Magento/Backend/App/AbstractAction.php b/app/code/Magento/Backend/App/AbstractAction.php
@@ -102,7 +102,7 @@ public function __construct(Action\Context $context)
      */
     protected function _isAllowed()
     {
-        return $this->_authorization->isAllowed(self::ADMIN_RESOURCE);
+        return $this->_authorization->isAllowed(static::ADMIN_RESOURCE);
     }
 
     /**
-Original file line number
+Diff line change
@@ Expand Up / @@ -102,7 +102,7 @@ public function __construct(Action\Context $context) @@
          */
         protected function _isAllowed()
         {
-            return $this->_authorization->isAllowed(self::ADMIN_RESOURCE);
+            return $this->_authorization->isAllowed(static::ADMIN_RESOURCE);
         }
         /**
@@ Expand Down @@