diff --git a/CHANGELOG.md b/CHANGELOG.md index 29ac5ca8e9578..b6e1eb16a0df2 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,3 +1,19 @@ +2.0.1 +============= +* Fixed bugs: + * Fixed an issue where can't deploy sample data after "composer create-project" + * Fixed a security issue on user account page + * Fixed a security issue on product page + * Fixed an issue where possible edit someone else reviews + * Fixed an issue where possible view order details for certain orders + * Fixed an issue where catalog price rule isn't applied to product created using Web API + * Fixed a potential vulnerability where possible insert SQL injection + * Fixed a potential vulnerability on checkout page + * Fixed an issue with upload empty file to custom option + * Fixed an issue with performance on customer edit form +* GitHub requests: + * [#2519](https://github.com/magento/magento2/issues/2519) -- Fixed an issue where synonyms don't work with Magento 2.0 + 2.0.0 ============= * Fixed bugs: diff --git a/app/code/Magento/Authorizenet/Test/Unit/Model/DirectpostTest.php b/app/code/Magento/Authorizenet/Test/Unit/Model/DirectpostTest.php index 3726d4e5108ae..925dd324a9e8f 100644 --- a/app/code/Magento/Authorizenet/Test/Unit/Model/DirectpostTest.php +++ b/app/code/Magento/Authorizenet/Test/Unit/Model/DirectpostTest.php @@ -331,7 +331,7 @@ public function testCheckResponseCodeFailure($responseCode) $this->dataHelperMock->expects($this->any()) ->method('wrapGatewayError') ->with($reasonText) - ->willReturn(__('Gateway error: ' . $reasonText)); + ->willReturn(__('Gateway error: %1', $reasonText)); $this->directpost->checkResponseCode(); } diff --git a/app/code/Magento/Backend/i18n/en_US.csv b/app/code/Magento/Backend/i18n/en_US.csv index 6e16f6a6e7ec6..0c5586948801f 100644 --- a/app/code/Magento/Backend/i18n/en_US.csv +++ b/app/code/Magento/Backend/i18n/en_US.csv @@ -306,7 +306,7 @@ YTD,YTD "Maximum sender name length is 255. Please correct your settings.","Maximum sender name length is 255. Please correct your settings." "The file you're uploading exceeds the server size limit of %1 kilobytes.","The file you're uploading exceeds the server size limit of %1 kilobytes." "The base directory to upload file is not specified.","The base directory to upload file is not specified." -"The specified image adapter cannot be used because of: ","The specified image adapter cannot be used because of: " +"The specified image adapter cannot be used because of: %1","The specified image adapter cannot be used because of: %1" "Default scope","Default scope" "Base currency","Base currency" "Display default currency","Display default currency" diff --git a/app/code/Magento/Backend/view/adminhtml/templates/page/js/require_js.phtml b/app/code/Magento/Backend/view/adminhtml/templates/page/js/require_js.phtml index 4997592a10c5b..933220342339b 100644 --- a/app/code/Magento/Backend/view/adminhtml/templates/page/js/require_js.phtml +++ b/app/code/Magento/Backend/view/adminhtml/templates/page/js/require_js.phtml @@ -7,4 +7,7 @@ diff --git a/app/code/Magento/Catalog/Model/Product/Option/Type/File/Validator.php b/app/code/Magento/Catalog/Model/Product/Option/Type/File/Validator.php index f0e4ef3ef504b..a22a32c6fad6e 100644 --- a/app/code/Magento/Catalog/Model/Product/Option/Type/File/Validator.php +++ b/app/code/Magento/Catalog/Model/Product/Option/Type/File/Validator.php @@ -100,6 +100,17 @@ protected function getValidatorErrors($errors, $fileInfo, $option) $this->fileSize->getMaxFileSizeInMb() ); break; + case \Zend_Validate_File_ImageSize::NOT_DETECTED: + $result[] = __( + "The file '%1' is empty. Please choose another one", + $fileInfo['title'] + ); + break; + default: + $result[] = __( + "The file '%1' is invalid. Please choose another one", + $fileInfo['title'] + ); } } return $result; diff --git a/app/code/Magento/Catalog/Model/Product/Option/Type/File/ValidatorFile.php b/app/code/Magento/Catalog/Model/Product/Option/Type/File/ValidatorFile.php index 1b3b2c5f0d8f3..118c82f9f8665 100644 --- a/app/code/Magento/Catalog/Model/Product/Option/Type/File/ValidatorFile.php +++ b/app/code/Magento/Catalog/Model/Product/Option/Type/File/ValidatorFile.php @@ -57,22 +57,30 @@ class ValidatorFile extends Validator */ protected $product; + /** + * @var \Magento\Framework\Validator\File\IsImage + */ + protected $isImageValidator; + /** * @param \Magento\Framework\App\Config\ScopeConfigInterface $scopeConfig * @param \Magento\Framework\Filesystem $filesystem * @param \Magento\Framework\File\Size $fileSize * @param \Magento\Framework\HTTP\Adapter\FileTransferFactory $httpFactory + * @param \Magento\Framework\Validator\File\IsImage $isImageValidator * @throws \Magento\Framework\Exception\FileSystemException */ public function __construct( \Magento\Framework\App\Config\ScopeConfigInterface $scopeConfig, \Magento\Framework\Filesystem $filesystem, \Magento\Framework\File\Size $fileSize, - \Magento\Framework\HTTP\Adapter\FileTransferFactory $httpFactory + \Magento\Framework\HTTP\Adapter\FileTransferFactory $httpFactory, + \Magento\Framework\Validator\File\IsImage $isImageValidator ) { $this->mediaDirectory = $filesystem->getDirectoryWrite(DirectoryList::MEDIA); $this->filesystem = $filesystem; $this->httpFactory = $httpFactory; + $this->isImageValidator = $isImageValidator; parent::__construct($scopeConfig, $filesystem, $fileSize); } @@ -169,8 +177,15 @@ public function validate($processingParams, $option) $_height = 0; if ($tmpDirectory->isReadable($tmpDirectory->getRelativePath($fileInfo['tmp_name']))) { - $imageSize = getimagesize($fileInfo['tmp_name']); - if ($imageSize) { + if (filesize($fileInfo['tmp_name'])) { + if ($this->isImageValidator->isValid($fileInfo['tmp_name'])) { + $imageSize = getimagesize($fileInfo['tmp_name']); + } + } else { + throw new LocalizedException(__('The file is empty. Please choose another one')); + } + + if (!empty($imageSize)) { $_width = $imageSize[0]; $_height = $imageSize[1]; } diff --git a/app/code/Magento/Catalog/i18n/en_US.csv b/app/code/Magento/Catalog/i18n/en_US.csv index 12c16c5b7234c..8580eb33942b2 100644 --- a/app/code/Magento/Catalog/i18n/en_US.csv +++ b/app/code/Magento/Catalog/i18n/en_US.csv @@ -699,3 +699,4 @@ Autosettings,Autosettings "Allow Gift Message","Allow Gift Message" "Meta Title","Meta Title" "Maximum 255 chars","Maximum 255 chars" +"The file is empty. Please choose another one","The file is empty. Please choose another one" diff --git a/app/code/Magento/Catalog/view/adminhtml/templates/catalog/product/composite/fieldset/options/type/file.phtml b/app/code/Magento/Catalog/view/adminhtml/templates/catalog/product/composite/fieldset/options/type/file.phtml index 644226409aa72..861a4e9a0424a 100644 --- a/app/code/Magento/Catalog/view/adminhtml/templates/catalog/product/composite/fieldset/options/type/file.phtml +++ b/app/code/Magento/Catalog/view/adminhtml/templates/catalog/product/composite/fieldset/options/type/file.phtml @@ -68,7 +68,7 @@ require(['prototype'], function(){
- getTitle(); ?> + escapeHtml($_fileInfo->getTitle()); ?>   @@ -79,7 +79,7 @@ require(['prototype'], function(){
> - /> + /> getFileExtension()): ?> diff --git a/app/code/Magento/Catalog/view/adminhtml/web/js/new-category-dialog.js b/app/code/Magento/Catalog/view/adminhtml/web/js/new-category-dialog.js index 44f3371cf9371..7bc01bfccb8ea 100644 --- a/app/code/Magento/Catalog/view/adminhtml/web/js/new-category-dialog.js +++ b/app/code/Magento/Catalog/view/adminhtml/web/js/new-category-dialog.js @@ -83,20 +83,42 @@ define([ var thisButton = $(e.currentTarget); thisButton.prop('disabled', true); + + var postData = { + general: { + name: $('#new_category_name').val(), + is_active: 1, + include_in_menu: 1 + }, + parent: $('#new_category_parent').val(), + use_config: ['available_sort_by', 'default_sort_by'], + form_key: FORM_KEY, + return_session_messages_only: 1 + }; + + var fields = {}; + + $.each($(newCategoryForm).serializeArray(), function(_, field) { + if ( + field.name && + field.name != 'new_category_name' && + field.name != 'new_category_parent' + ) { + if (fields.hasOwnProperty(field.name)) { + fields[field.name] = $.makeArray(fields[field.name]); + fields[field.name].push(field.value); + } + else { + fields[field.name] = field.value; + } + } + }); + $.extend(postData, fields); + $.ajax({ type: 'POST', url: widget.options.saveCategoryUrl, - data: { - general: { - name: $('#new_category_name').val(), - is_active: 1, - include_in_menu: 1 - }, - parent: $('#new_category_parent').val(), - use_config: ['available_sort_by', 'default_sort_by'], - form_key: FORM_KEY, - return_session_messages_only: 1 - }, + data: postData, dataType: 'json', context: $('body') }).success(function (data) { diff --git a/app/code/Magento/Catalog/view/frontend/templates/product/view/options/type/file.phtml b/app/code/Magento/Catalog/view/frontend/templates/product/view/options/type/file.phtml index a7c60b9f3a920..7ced840c1060a 100644 --- a/app/code/Magento/Catalog/view/frontend/templates/product/view/options/type/file.phtml +++ b/app/code/Magento/Catalog/view/frontend/templates/product/view/options/type/file.phtml @@ -17,14 +17,14 @@ getIsRequire()) ? ' required' : ''; ?>
-