Merge branch '2.4-develop' into Refactoring-AdminUpdateCategoryAndMak…

…eInactiveTest

# Conflicts:
#	app/code/Magento/Catalog/Test/Mftf/Test/AdminUpdateCategoryAndMakeInactiveTest.xml

.github/CONTRIBUTING.md

@@ -23,7 +23,7 @@ For more detailed information on contribution please read our [beginners guide](
 * Unit/integration test coverage
 * Proposed [documentation](https://devdocs.magento.com) updates. Documentation contributions can be submitted via the [devdocs GitHub](https://github.com/magento/devdocs).
 4. For larger features or changes, please [open an issue](https://github.com/magento/magento2/issues) to discuss the proposed changes prior to development. This may prevent duplicate or unnecessary effort and allow other contributors to provide input.
-5. All automated tests must pass (all builds on [Travis CI](https://travis-ci.org/magento/magento2) must be green).
+5. All automated tests must pass.
 
 ## Contribution process
 

.htaccess

@@ -238,15 +238,6 @@
             Require all denied
         </IfVersion>
     </Files>
-    <Files .travis.yml>
-        <IfVersion < 2.4>
-            order allow,deny
-            deny from all
-        </IfVersion>
-        <IfVersion >= 2.4>
-            Require all denied
-        </IfVersion>
-    </Files>
     <Files CHANGELOG.md>
         <IfVersion < 2.4>
             order allow,deny

.htaccess.sample

@@ -238,15 +238,6 @@
             Require all denied
         </IfVersion>
     </Files>
-    <Files .travis.yml>
-        <IfVersion < 2.4>
-            order allow,deny
-            deny from all
-        </IfVersion>
-        <IfVersion >= 2.4>
-            Require all denied
-        </IfVersion>
-    </Files>
     <Files CHANGELOG.md>
         <IfVersion < 2.4>
             order allow,deny

README.md

@@ -1,10 +1,9 @@
 <p align="center">
-  <a href="https://magento.com">
-    <img src="https://static.magento.com/sites/all/themes/magento/logo.svg" width="300px" alt="Magento" />
-  </a>
-</p>
-<p align="center">
-    <br /><br />
+    <a href="https://magento.com">
+        <img src="https://static.magento.com/sites/all/themes/magento/logo.svg" width="300px" alt="Magento Commerce" />
+    </a>
+    <br />
+    <br />
     <a href="https://www.codetriage.com/magento/magento2">
         <img src="https://www.codetriage.com/magento/magento2/badges/users.svg" alt="Open Source Helpers" />
     </a>

app/autoload.php

@@ -5,36 +5,48 @@
  * Copyright © Magento, Inc. All rights reserved.
  * See COPYING.txt for license details.
  */
+declare(strict_types=1);
+
 use Magento\Framework\Autoload\AutoloaderRegistry;
 use Magento\Framework\Autoload\ClassLoaderWrapper;
 
 /**
  * Shortcut constant for the root directory
  */
-define('BP', dirname(__DIR__));
+\define('BP', \dirname(__DIR__));
 
-define('VENDOR_PATH', BP . '/app/etc/vendor_path.php');
+\define('VENDOR_PATH', BP . '/app/etc/vendor_path.php');
 
-if (!file_exists(VENDOR_PATH)) {
+if (!\is_readable(VENDOR_PATH)) {
     throw new \Exception(
         'We can\'t read some files that are required to run the Magento application. '
          . 'This usually means file permissions are set incorrectly.'
     );
 }
 
-$vendorDir = require VENDOR_PATH;
-$vendorAutoload = BP . "/{$vendorDir}/autoload.php";
+$vendorAutoload = (
+    static function (): ?string {
+        $vendorDir = require VENDOR_PATH;
+
+        $vendorAutoload = BP . "/{$vendorDir}/autoload.php";
+        if (\is_readable($vendorAutoload)) {
+            return $vendorAutoload;
+        }
+
+        $vendorAutoload = "{$vendorDir}/autoload.php";
+        if (\is_readable($vendorAutoload)) {
+            return $vendorAutoload;
+        }
+
+        return null;
+    }
+)();
 
-/* 'composer install' validation */
-if (file_exists($vendorAutoload)) {
-    $composerAutoloader = include $vendorAutoload;
-} else if (file_exists("{$vendorDir}/autoload.php")) {
-	$vendorAutoload = "{$vendorDir}/autoload.php";
-	$composerAutoloader = include $vendorAutoload;
-} else {
+if ($vendorAutoload === null) {
     throw new \Exception(
         'Vendor autoload is not found. Please run \'composer install\' under application root directory.'
     );
 }
 
+$composerAutoloader = include $vendorAutoload;
 AutoloaderRegistry::registerAutoloader(new ClassLoaderWrapper($composerAutoloader));

app/code/Magento/AdminAnalytics/Test/Mftf/Test/AdminCheckAnalyticsTrackingTest.xml

@@ -0,0 +1,35 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+ /**
+  * Copyright © Magento, Inc. All rights reserved.
+  * See COPYING.txt for license details.
+  */
+-->
+
+<tests xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+       xsi:noNamespaceSchemaLocation="urn:magento:mftf:Test/etc/testSchema.xsd">
+    <test name="AdminCheckAnalyticsTrackingTest">
+        <annotations>
+            <stories value="AdminAnalytics Check Tracking."/>
+            <title value="AdminAnalytics Check Tracking."/>
+            <description value="AdminAnalytics Check Tracking."/>
+            <severity value="MINOR"/>
+            <testCaseId value="MC-36869"/>
+        </annotations>
+        <before>
+            <actionGroup ref="AdminLoginActionGroup" stepKey="LoginAsAdmin"/>
+            <magentoCLI command="config:set admin/usage/enabled 1" stepKey="enableAdminUsageTracking"/>
+            <actionGroup ref="CliCacheCleanActionGroup" stepKey="cleanInvalidatedCaches">
+                <argument name="tags" value="config full_page"/>
+            </actionGroup>
+            <reloadPage stepKey="pageReload"/>
+        </before>
+        <after>
+            <magentoCLI command="config:set admin/usage/enabled 0" stepKey="disableAdminUsageTracking"/>
+            <actionGroup ref="AdminLogoutActionGroup" stepKey="logout"/>
+        </after>
+
+        <waitForPageLoad stepKey="waitForPageReloaded"/>
+        <seeInPageSource html="var adminAnalyticsMetadata =" stepKey="seeInPageSource"/>
+    </test>
+</tests>

app/code/Magento/AdminAnalytics/etc/csp_whitelist.xml

@@ -0,0 +1,36 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+-->
+<csp_whitelist xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+        xsi:noNamespaceSchemaLocation="urn:magento:module:Magento_Csp:etc/csp_whitelist.xsd">
+        <policies>
+            <policy id="script-src">
+                <values>
+                    <value id="adobedtm" type="host">assets.adobedtm.com</value>
+                </values>
+            </policy>
+            <policy id="img-src">
+                <values>
+                    <value id="adobedtm" type="host">assets.adobedtm.com</value>
+                    <value id="omtrdc" type="host">amcglobal.sc.omtrdc.net</value>
+                    <value id="dpmdemdex" type="host">dpm.demdex.net</value>
+                    <value id="everesttech" type="host">cm.everesttech.net</value>
+                </values>
+            </policy>
+            <policy id="connect-src">
+                <values>
+                    <value id="dpmdemdex" type="host">dpm.demdex.net</value>
+                    <value id="omtrdc" type="host">amcglobal.sc.omtrdc.net</value>
+                </values>
+            </policy>
+            <policy id="frame-src">
+                <values>
+                    <value id="amcdemdex" type="host">fast.amc.demdex.net</value>
+                </values>
+            </policy>
+        </policies>
+</csp_whitelist>

app/code/Magento/AdminAnalytics/view/adminhtml/templates/notification.phtml

@@ -4,13 +4,21 @@
  * Copyright © Magento, Inc. All rights reserved.
  * See COPYING.txt for license details.
  */
+
+/** @var \Magento\Framework\View\Helper\SecureHtmlRenderer $secureRenderer */
 ?>
 
-<script>
+<?php
+$isAnaliticsVisible = $block->getNotification()->isAnalyticsVisible() ? 1 : 0;
+$isReleaseVisible = $block->getNotification()->isReleaseVisible() ? 1 : 0;
+$scriptString = <<<script
     define('analyticsPopupConfig', function () {
         return {
-            analyticsVisible: <?= $block->getNotification()->isAnalyticsVisible() ? 1 : 0; ?>,
-            releaseVisible: <?= $block->getNotification()->isReleaseVisible() ? 1 : 0; ?>,
+            analyticsVisible: {$isAnaliticsVisible},
+            releaseVisible: {$isReleaseVisible},
         }
     });
-</script>
+script;
+?>
+
+<?= /* @noEscape */ $secureRenderer->renderTag('script', [], $scriptString, false); ?>

app/code/Magento/AdminAnalytics/view/adminhtml/templates/tracking.phtml

@@ -3,13 +3,28 @@
  * Copyright © Magento, Inc. All rights reserved.
  * See COPYING.txt for license details.
  */
+
+/**
+ * @var \Magento\Framework\View\Helper\SecureHtmlRenderer $secureRenderer
+ */
 ?>
 
-<script src="<?= $block->escapeUrl($block->getTrackingUrl()) ?>" async></script>
-<script>
+<?= /* @noEscape */ $secureRenderer->renderTag(
+    'script',
+    [
+        'src' => $block->getTrackingUrl(),
+        'async' => true,
+    ],
+    '&nbsp;',
+    false
+) ?>
+
+<?php $scriptString = '
     var adminAnalyticsMetadata = {
-        "version": "<?= $block->escapeJs($block->getMetadata()->getMagentoVersion()) ?>",
-        "user": "<?= $block->escapeJs($block->getMetadata()->getCurrentUser()) ?>",
-        "mode": "<?= $block->escapeJs($block->getMetadata()->getMode()) ?>"
+        "version": "' . $block->escapeJs($block->getMetadata()->getMagentoVersion()) . '",
+        "user": "' . $block->escapeJs($block->getMetadata()->getCurrentUser()) . '",
+        "mode": "' . $block->escapeJs($block->getMetadata()->getMode()) . '"
     };
-</script>
+';
+?>
+<?= /* @noEscape */ $secureRenderer->renderTag('script', [], $scriptString, false); ?>

app/code/Magento/AdminNotification/Block/System/Messages.php

@@ -26,7 +26,7 @@ class Messages extends Template
 
     /**
      * @var JsonDataHelper
-     * @deprecated
+     * @deprecated 100.3.0
      */
     protected $jsonHelper;
 

app/code/Magento/AdminNotification/Controller/Adminhtml/System/Message/ListAction.php

@@ -17,7 +17,7 @@ class ListAction extends \Magento\Backend\App\AbstractAction
 
     /**
      * @var \Magento\Framework\Json\Helper\Data
-     * @deprecated
+     * @deprecated 100.3.0
      */
     protected $jsonHelper;
 

app/code/Magento/AdminNotification/Test/Mftf/Section/AdminNotificationToolbarSection.xml

@@ -0,0 +1,15 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+ /**
+  * Copyright © Magento, Inc. All rights reserved.
+  * See COPYING.txt for license details.
+  */
+-->
+
+<sections xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+          xsi:noNamespaceSchemaLocation="urn:magento:mftf:Page/etc/SectionObject.xsd">
+    <section name="AdminNotificationToolbarSection">
+        <element name="notification" type="block" selector=".notifications-wrapper.admin__action-dropdown-wrap"/>
+        <element name="notificationCounter" type="block" selector=".notifications-action.admin__action-dropdown .notifications-counter"/>
+    </section>
+</sections>

app/code/Magento/AdminNotification/Test/Mftf/Test/AdminSystemNotificationToolbarBlockAclTest.xml

@@ -0,0 +1,64 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+ /**
+  * Copyright © Magento, Inc. All rights reserved.
+  * See COPYING.txt for license details.
+  */
+-->
+
+<tests xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+       xsi:noNamespaceSchemaLocation="urn:magento:mftf:Test/etc/testSchema.xsd">
+    <test name="AdminSystemNotificationToolbarBlockAclTest">
+        <annotations>
+            <features value="AdminNotification"/>
+            <stories value="Acl notification toolbar"/>
+            <title value="Admin system notification toolbar block acl test"/>
+            <description value="Admin should not see system notification toolbar block if acl not restricted"/>
+            <severity value="MAJOR"/>
+            <testCaseId value="MC-36011"/>
+            <group value="menu"/>
+        </annotations>
+        <before>
+            <actionGroup ref="AdminLoginActionGroup" stepKey="LoginAsAdmin"/>
+
+            <actionGroup ref="AdminFillUserRoleRequiredDataActionGroup" stepKey="fillUserRoleRequiredData">
+                <argument name="User" value="adminRole"/>
+                <argument name="restrictedRole" value="Stores"/>
+            </actionGroup>
+            <actionGroup ref="AdminUserClickRoleResourceTabActionGroup" stepKey="goToRoleResourcesTab" />
+            <actionGroup ref="AdminAddRestrictedRoleActionGroup" stepKey="addRestrictedRoleStores">
+                <argument name="User" value="adminRole"/>
+                <argument name="restrictedRole" value="Products"/>
+            </actionGroup>
+            <actionGroup ref="AdminUserSaveRoleActionGroup" stepKey="saveUserRole" />
+
+            <actionGroup ref="AdminCreateUserActionGroup" stepKey="createAdminUser">
+                <argument name="role" value="adminRole"/>
+                <argument name="User" value="admin2"/>
+            </actionGroup>
+
+            <actionGroup ref="AdminLogoutActionGroup" stepKey="logoutOfAdmin"/>
+        </before>
+        <after>
+            <actionGroup ref="AdminLogoutActionGroup" stepKey="logoutAsSaleRoleUser"/>
+            <actionGroup ref="AdminLoginActionGroup" stepKey="loginAsAdmin"/>
+            <!--Delete created data-->
+            <actionGroup ref="AdminUserOpenAdminRolesPageActionGroup" stepKey="navigateToUserRoleGrid"/>
+            <actionGroup ref="AdminDeleteRoleActionGroup" stepKey="deleteUserRole">
+                <argument name="role" value="adminRole"/>
+            </actionGroup>
+            <actionGroup ref="AdminOpenAdminUsersPageActionGroup" stepKey="goToAllUsersPage"/>
+            <actionGroup ref="AdminDeleteNewUserActionGroup" stepKey="deleteUser">
+                <argument name="userName" value="{{admin2.username}}"/>
+            </actionGroup>
+        </after>
+
+        <actionGroup ref="AdminLoginActionGroup" stepKey="loginAsNewUser">
+            <argument name="username" value="{{admin2.username}}"/>
+            <argument name="password" value="{{admin2.password}}"/>
+        </actionGroup>
+
+        <waitForPageLoad stepKey="waitBeforePageLoad"/>
+        <dontSeeElement selector="{{AdminNotificationToolbarSection.notification}}" stepKey="doNotSeeNotificationBellIcon"/>
+    </test>
+</tests>

app/code/Magento/AdminNotification/etc/csp_whitelist.xml

@@ -0,0 +1,18 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+-->
+<csp_whitelist xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+               xsi:noNamespaceSchemaLocation="urn:magento:module:Magento_Csp:etc/csp_whitelist.xsd">
+    <policies>
+        <policy id="img-src">
+            <values>
+                <value id="commerce_widgets" type="host">widgets.magentocommerce.com</value>
+            </values>
+        </policy>
+    </policies>
+</csp_whitelist>
+

app/code/Magento/AdminNotification/view/adminhtml/layout/default.xml

@@ -20,7 +20,11 @@
                    template="Magento_AdminNotification::notification/window.phtml"/>
         </referenceContainer>
         <referenceContainer name="header">
-            <block class="Magento\AdminNotification\Block\ToolbarEntry" name="notification.messages" before="user" template="Magento_AdminNotification::toolbar_entry.phtml"/>
+            <block class="Magento\AdminNotification\Block\ToolbarEntry"
+                   name="notification.messages"
+                   before="user"
+                   aclResource="Magento_AdminNotification::show_toolbar"
+                   template="Magento_AdminNotification::toolbar_entry.phtml"/>
         </referenceContainer>
     </body>
 </page>

app/code/Magento/AdminNotification/view/adminhtml/templates/notification/window.phtml

@@ -6,10 +6,10 @@
 
 /**
  * @see \Magento\AdminNotification\Block\Window
+ * @var \Magento\Framework\View\Helper\SecureHtmlRenderer $secureRenderer
  */
 ?>
 <ul class="message-system-list"
-    style="display: none;"
     data-mage-init='{
         "Magento_Ui/js/modal/modal": {
             "autoOpen": true,
@@ -25,3 +25,4 @@
         </a>
     </li>
 </ul>
+<?= /* @noEscape */ $secureRenderer->renderStyleAsTag('display:none', '.message-system-list'); ?>