Skip to content

Commit 58c1423

Browse files
zakdmazakdma
committed
Merge remote-tracking branch 'origin/2.3-develop' into 2.3-develop-pr2
2 parents abc3dfb + e2a1c5a commit 58c1423

File tree

32 files changed

+262
-76
lines changed

32 files changed

+262
-76
lines changed

‎app/code/Magento/Backend/Block/Widget/Grid/Column/Filter/Date.php‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -127,7 +127,7 @@ public function getHtml()
127127

128128
/**
129129
* @param string|null $index
130-
* @return string
130+
* @return array|string|int|float|null
131131
*/
132132
public function getEscapedValue($index = null)
133133
{
@@ -138,6 +138,11 @@ public function getEscapedValue($index = null)
138138
$this->_localeDate->getDateFormat(\IntlDateFormatter::SHORT)
139139
);
140140
}
141+
142+
if (is_string($value)) {
143+
return $this->escapeHtml($value);
144+
}
145+
141146
return $value;
142147
}
143148

‎app/code/Magento/Backend/Block/Widget/Grid/Column/Filter/Datetime.php‎

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -140,8 +140,8 @@ public function getHtml()
140140
/**
141141
* Return escaped value for calendar
142142
*
143-
* @param string $index
144-
* @return string
143+
* @param string|null $index
144+
* @return array|string|int|float|null
145145
*/
146146
public function getEscapedValue($index = null)
147147
{
@@ -150,6 +150,11 @@ public function getEscapedValue($index = null)
150150
if ($value instanceof \DateTimeInterface) {
151151
return $this->_localeDate->formatDateTime($value);
152152
}
153+
154+
if (is_string($value)) {
155+
return $this->escapeHtml($value);
156+
}
157+
153158
return $value;
154159
}
155160

‎app/code/Magento/Backend/Test/Unit/Block/Widget/Grid/Column/Filter/DateTest.php‎

Lines changed: 31 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,12 @@ class DateTest extends \PHPUnit\Framework\TestCase
3030
/** @var \Magento\Framework\Stdlib\DateTime\TimezoneInterface|\PHPUnit_Framework_MockObject_MockObject */
3131
protected $localeDateMock;
3232

33+
/** @var \Magento\Framework\Escaper|\PHPUnit_Framework_MockObject_MockObject */
34+
private $escaperMock;
35+
36+
/** @var \Magento\Backend\Block\Context|\PHPUnit_Framework_MockObject_MockObject */
37+
private $contextMock;
38+
3339
protected function setUp()
3440
{
3541
$this->mathRandomMock = $this->getMockBuilder(\Magento\Framework\Math\Random::class)
@@ -58,14 +64,26 @@ protected function setUp()
5864
->setMethods([])
5965
->getMock();
6066

67+
$this->escaperMock = $this->getMockBuilder(\Magento\Framework\Escaper::class)
68+
->disableOriginalConstructor()
69+
->getMock();
70+
71+
$this->contextMock = $this->getMockBuilder(\Magento\Backend\Block\Context::class)
72+
->disableOriginalConstructor()
73+
->getMock();
74+
75+
$this->contextMock->expects($this->once())->method('getEscaper')->willReturn($this->escaperMock);
76+
$this->contextMock->expects($this->once())->method('getLocaleDate')->willReturn($this->localeDateMock);
77+
6178
$objectManagerHelper = new \Magento\Framework\TestFramework\Unit\Helper\ObjectManager($this);
6279
$this->model = $objectManagerHelper->getObject(
6380
\Magento\Backend\Block\Widget\Grid\Column\Filter\Date::class,
6481
[
6582
'mathRandom' => $this->mathRandomMock,
6683
'localeResolver' => $this->localeResolverMock,
6784
'dateTimeFormatter' => $this->dateTimeFormatterMock,
68-
'localeDate' => $this->localeDateMock
85+
'localeDate' => $this->localeDateMock,
86+
'context' => $this->contextMock,
6987
]
7088
);
7189
$this->model->setColumn($this->columnMock);
@@ -98,4 +116,16 @@ public function testGetHtmlSuccessfulTimestamp()
98116
$this->assertContains('id="' . $uniqueHash . '_from" value="' . $yesterday->getTimestamp(), $output);
99117
$this->assertContains('id="' . $uniqueHash . '_to" value="' . $tomorrow->getTimestamp(), $output);
100118
}
119+
120+
public function testGetEscapedValueEscapeString()
121+
{
122+
$value = "\"><img src=x onerror=alert(2) />";
123+
$array = [
124+
'orig_from' => $value,
125+
'from' => $value,
126+
];
127+
$this->model->setValue($array);
128+
$this->escaperMock->expects($this->once())->method('escapeHtml')->with($value);
129+
$this->model->getEscapedValue('from');
130+
}
101131
}

‎app/code/Magento/Backend/Test/Unit/Block/Widget/Grid/Column/Filter/DatetimeTest.php‎

Lines changed: 33 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,12 @@ class DatetimeTest extends \PHPUnit\Framework\TestCase
3030
/** @var \Magento\Framework\Stdlib\DateTime\TimezoneInterface|\PHPUnit_Framework_MockObject_MockObject */
3131
protected $localeDateMock;
3232

33+
/** @var \Magento\Framework\Escaper|\PHPUnit_Framework_MockObject_MockObject */
34+
private $escaperMock;
35+
36+
/** @var \Magento\Backend\Block\Context|\PHPUnit_Framework_MockObject_MockObject */
37+
private $contextMock;
38+
3339
protected function setUp()
3440
{
3541
$this->mathRandomMock = $this->getMockBuilder(\Magento\Framework\Math\Random::class)
@@ -50,22 +56,34 @@ protected function setUp()
5056

5157
$this->columnMock = $this->getMockBuilder(\Magento\Backend\Block\Widget\Grid\Column::class)
5258
->disableOriginalConstructor()
53-
->setMethods(['getTimezone', 'getHtmlId', 'getId'])
59+
->setMethods(['getTimezone', 'getHtmlId', 'getId', 'getFilterTime'])
5460
->getMock();
5561

5662
$this->localeDateMock = $this->getMockBuilder(\Magento\Framework\Stdlib\DateTime\TimezoneInterface::class)
5763
->disableOriginalConstructor()
5864
->setMethods([])
5965
->getMock();
6066

67+
$this->escaperMock = $this->getMockBuilder(\Magento\Framework\Escaper::class)
68+
->disableOriginalConstructor()
69+
->getMock();
70+
71+
$this->contextMock = $this->getMockBuilder(\Magento\Backend\Block\Context::class)
72+
->disableOriginalConstructor()
73+
->getMock();
74+
75+
$this->contextMock->expects($this->once())->method('getEscaper')->willReturn($this->escaperMock);
76+
$this->contextMock->expects($this->once())->method('getLocaleDate')->willReturn($this->localeDateMock);
77+
6178
$objectManagerHelper = new \Magento\Framework\TestFramework\Unit\Helper\ObjectManager($this);
6279
$this->model = $objectManagerHelper->getObject(
6380
\Magento\Backend\Block\Widget\Grid\Column\Filter\Datetime::class,
6481
[
6582
'mathRandom' => $this->mathRandomMock,
6683
'localeResolver' => $this->localeResolverMock,
6784
'dateTimeFormatter' => $this->dateTimeFormatterMock,
68-
'localeDate' => $this->localeDateMock
85+
'localeDate' => $this->localeDateMock,
86+
'context' => $this->contextMock,
6987
]
7088
);
7189
$this->model->setColumn($this->columnMock);
@@ -98,4 +116,17 @@ public function testGetHtmlSuccessfulTimestamp()
98116
$this->assertContains('id="' . $uniqueHash . '_from" value="' . $yesterday->getTimestamp(), $output);
99117
$this->assertContains('id="' . $uniqueHash . '_to" value="' . $tomorrow->getTimestamp(), $output);
100118
}
119+
120+
public function testGetEscapedValueEscapeString()
121+
{
122+
$value = "\"><img src=x onerror=alert(2) />";
123+
$array = [
124+
'orig_from' => $value,
125+
'from' => $value,
126+
];
127+
$this->model->setValue($array);
128+
$this->escaperMock->expects($this->once())->method('escapeHtml')->with($value);
129+
$this->columnMock->expects($this->once())->method('getFilterTime')->willReturn(true);
130+
$this->model->getEscapedValue('from');
131+
}
101132
}

‎app/code/Magento/Catalog/view/frontend/templates/product/list.phtml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -77,7 +77,7 @@ $_helper = $this->helper('Magento\Catalog\Helper\Output');
7777
<div class="actions-primary"<?= strpos($pos, $viewMode . '-primary') ? $position : '' ?>>
7878
<?php if ($_product->isSaleable()): ?>
7979
<?php $postParams = $block->getAddToCartPostParams($_product); ?>
80-
<form data-role="tocart-form" data-product-sku="<?= /* @NoEscape */ $_product->getSku() ?>" action="<?= /* @NoEscape */ $postParams['action'] ?>" method="post">
80+
<form data-role="tocart-form" data-product-sku="<?= $block->escapeHtml($_product->getSku()) ?>" action="<?= /* @NoEscape */ $postParams['action'] ?>" method="post">
8181
<input type="hidden" name="product" value="<?= /* @escapeNotVerified */ $postParams['data']['product'] ?>">
8282
<input type="hidden" name="<?= /* @escapeNotVerified */ Action::PARAM_NAME_URL_ENCODED ?>" value="<?= /* @escapeNotVerified */ $postParams['data'][Action::PARAM_NAME_URL_ENCODED] ?>">
8383
<?= $block->getBlockHtml('formkey') ?>

‎app/code/Magento/Catalog/view/frontend/templates/product/view/form.phtml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@
1616
<?php $_product = $block->getProduct(); ?>
1717

1818
<div class="product-add-form">
19-
<form data-product-sku="<?= /* @NoEscape */ $_product->getSku() ?>"
19+
<form data-product-sku="<?= $block->escapeHtml($_product->getSku()) ?>"
2020
action="<?= /* @NoEscape */ $block->getSubmitUrl($_product) ?>" method="post"
2121
id="product_addtocart_form"<?php if ($_product->getOptions()): ?> enctype="multipart/form-data"<?php endif; ?>>
2222
<input type="hidden" name="product" value="<?= /* @escapeNotVerified */ $_product->getId() ?>" />

‎app/code/Magento/Checkout/Block/Cart/Shipping.php‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -74,7 +74,8 @@ public function getJsLayout()
7474
foreach ($this->layoutProcessors as $processor) {
7575
$this->jsLayout = $processor->process($this->jsLayout);
7676
}
77-
return $this->serializer->serialize($this->jsLayout);
77+
78+
return json_encode($this->jsLayout, JSON_HEX_TAG);
7879
}
7980

8081
/**
@@ -94,6 +95,6 @@ public function getBaseUrl()
9495
*/
9596
public function getSerializedCheckoutConfig()
9697
{
97-
return $this->serializer->serialize($this->getCheckoutConfig());
98+
return json_encode($this->getCheckoutConfig(), JSON_HEX_TAG);
9899
}
99100
}

‎app/code/Magento/Checkout/Block/Cart/Totals.php‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -69,7 +69,8 @@ public function getJsLayout()
6969
foreach ($this->layoutProcessors as $processor) {
7070
$this->jsLayout = $processor->process($this->jsLayout);
7171
}
72-
return parent::getJsLayout();
72+
73+
return json_encode($this->jsLayout, JSON_HEX_TAG);
7374
}
7475

7576
/**

‎app/code/Magento/Checkout/Block/Onepage.php‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -77,7 +77,8 @@ public function getJsLayout()
7777
foreach ($this->layoutProcessors as $processor) {
7878
$this->jsLayout = $processor->process($this->jsLayout);
7979
}
80-
return $this->serializer->serialize($this->jsLayout);
80+
81+
return json_encode($this->jsLayout, JSON_HEX_TAG);
8182
}
8283

8384
/**
@@ -119,6 +120,6 @@ public function getBaseUrl()
119120
*/
120121
public function getSerializedCheckoutConfig()
121122
{
122-
return $this->serializer->serialize($this->getCheckoutConfig());
123+
return json_encode($this->getCheckoutConfig(), JSON_HEX_TAG);
123124
}
124125
}

‎app/code/Magento/Checkout/Test/Unit/Block/Cart/ShippingTest.php‎

Lines changed: 0 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -99,9 +99,6 @@ public function testGetJsLayout()
9999
->with($this->layout)
100100
->willReturn($layoutProcessed);
101101

102-
$this->serializer->expects($this->once())->method('serialize')->will(
103-
$this->returnValue($jsonLayoutProcessed)
104-
);
105102
$this->assertEquals(
106103
$jsonLayoutProcessed,
107104
$this->model->getJsLayout()
@@ -121,9 +118,6 @@ public function testGetSerializedCheckoutConfig()
121118
{
122119
$checkoutConfig = ['checkout', 'config'];
123120
$this->configProvider->expects($this->once())->method('getConfig')->willReturn($checkoutConfig);
124-
$this->serializer->expects($this->once())->method('serialize')->will(
125-
$this->returnValue(json_encode($checkoutConfig))
126-
);
127121

128122
$this->assertEquals(json_encode($checkoutConfig), $this->model->getSerializedCheckoutConfig());
129123
}

0 commit comments

Comments
 (0)