Merge pull request from GHSA-26rr-v2j2-25fh

Co-authored-by: Mark Lewis <markwlewis@Marks-MacBook-Pro.local>
OpenMage · Aug 26, 2021 · b99307d · b99307d
1 parent 02a14e8
commit b99307d
Showing 1 changed file with 4 additions and 1 deletion.
diff --git a/app/code/core/Mage/Core/Helper/Security.php b/app/code/core/Mage/Core/Helper/Security.php
@@ -21,7 +21,10 @@ class Mage_Core_Helper_Security
     public function validateAgainstBlockMethodBlacklist(Mage_Core_Block_Abstract $block, $method, array $args)
     {
         foreach ($this->invalidBlockActions as $action) {
-            if ($block instanceof $action['block'] && strtolower($action['method']) === strtolower($method)) {
+            $calledMethod = strtolower($method);
+            if (($block instanceof $action['block'] && strtolower($action['method']) === $calledMethod)
+                || ($block instanceof $action['block']
+                    && strtolower($action['block'] . '::' . $action['method']) === $calledMethod)) {
                 Mage::throwException(
                     sprintf('Action with combination block %s and method %s is forbidden.', get_class($block), $method)
                 );