Skip to content

Commit 7251aa9

Browse files
NadiyaSshiftedreality
authored andcommitted
MAGECLOUD-4606: Review Hotfixes List and Add All Missing for 2.1.4+ (#8)
1 parent 382df44 commit 7251aa9

14 files changed

+3619
-0
lines changed

patches.json

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -205,6 +205,35 @@
205205
"Fix pagebuilder module": {
206206
"2.3.1": "MDVA-22979__fix_pagebuilder_module__2.3.1.patch",
207207
"2.3.2": "MDVA-22979__fix_pagebuilder_module__2.3.2.patch"
208+
},
209+
"Fix XSS in order history": {
210+
"2.2.0 - 2.2.6": "PRODSECBUG-2233__fix_xss_in_order_history__2.2.0.patch",
211+
"2.2.7 - 2.2.8": "PRODSECBUG-2233__fix_xss_in_order_history__2.2.7.patch",
212+
"2.3.0 - 2.3.1": "PRODSECBUG-2233__fix_xss_in_order_history__2.3.0.patch"
213+
},
214+
"Pass Store View scope in the Async/Bulk Web API": {
215+
"2.3.1": "MAGETWO-99902__pass_store_view_scope_in_async_web_api__2.3.1.patch",
216+
">=2.3.2 <2.3.3": "MAGETWO-99902__pass_store_view_scope_in_async_web_api__2.3.2.patch"
217+
},
218+
"Admin path disclosure bug": {
219+
"2.1.4 - 2.1.17": "PRODSECBUG-2432__admin_path_disclosure_bug__2.1.4.patch",
220+
"2.2.0 - 2.2.8": "PRODSECBUG-2432__admin_path_disclosure_bug__2.2.0.patch",
221+
"2.3.0 - 2.3.1": "PRODSECBUG-2432__admin_path_disclosure_bug__2.3.0.patch"
222+
},
223+
"Transaction MD5 hash field is removed by Authorize.net": {
224+
"2.2.0 - 2.2.7": "MAGETWO-98129__transaction_field_is_removed_by_authorize_net__2.2.0.patch"
225+
},
226+
"Customer attributes issue": {
227+
"2.2.6": "MAGETWO-95591__customer_attributes_issue__2.2.6.patch"
228+
},
229+
"Optimize retrieving product attributes": {
230+
"2.2.5": "MAGETWO-93083__optimize_retrieving_product_attributes__2.2.5.patch"
231+
},
232+
"Cannot change the applied theme": {
233+
"2.2.5": "MAGETWO-93036__cannot_change_the_applied_theme__2.2.5.patch"
234+
},
235+
"Fix for multi-site configuration issue": {
236+
"2.2.4": "MAGETWO-92926__fix_for_multi-site_configuration_issue__2.2.4.patch"
208237
}
209238
},
210239
"monolog/monolog": {
Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
diff -Nuar a/app/etc/di.xml b/app/etc/di.xml
2+
--- a/app/etc/di.xml
3+
+++ b/app/etc/di.xml
4+
@@ -232,6 +233,11 @@
5+
<argument name="pathInfoProcessor" xsi:type="object">Magento\Backend\App\Request\PathInfoProcessor\Proxy</argument>
6+
</arguments>
7+
</type>
8+
+ <type name="Magento\Framework\App\Response\Http">
9+
+ <arguments>
10+
+ <argument name="sessionConfig" xsi:type="object">Magento\Framework\Session\Config\ConfigInterface\Proxy</argument>
11+
+ </arguments>
12+
+ </type>
13+
<preference for="Magento\Framework\Session\SaveHandlerInterface" type="Magento\Framework\Session\SaveHandler" />
14+
<type name="Magento\Framework\Session\SaveHandlerFactory">
15+
<arguments>
Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
diff -Nuar a/vendor/magento/module-email/Model/AbstractTemplate.php b/vendor/magento/module-email/Model/AbstractTemplate.php
2+
--- a/vendor/magento/module-email/Model/AbstractTemplate.php
3+
+++ b/vendor/magento/module-email/Model/AbstractTemplate.php
4+
@@ -534,10 +534,9 @@ protected function cancelDesignConfig()
5+
*/
6+
public function setForcedArea($templateId)
7+
{
8+
- if ($this->area) {
9+
- throw new \LogicException(__('Area is already set'));
10+
+ if (!isset($this->area)) {
11+
+ $this->area = $this->emailConfig->getTemplateArea($templateId);
12+
}
13+
- $this->area = $this->emailConfig->getTemplateArea($templateId);
14+
return $this;
15+
}
16+
Lines changed: 181 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,181 @@
1+
diff -Nuar a/vendor/magento/module-catalog/Model/Product.php b/vendor/magento/module-catalog/Model/Product.php
2+
--- a/vendor/magento/module-catalog/Model/Product.php
3+
+++ b/vendor/magento/module-catalog/Model/Product.php
4+
@@ -12,6 +12,7 @@
5+
use Magento\Catalog\Model\Product\Attribute\Backend\Media\EntryConverterPool;
6+
use Magento\Framework\Api\AttributeValueFactory;
7+
use Magento\Framework\App\Filesystem\DirectoryList;
8+
+use Magento\Framework\App\ObjectManager;
9+
use Magento\Framework\DataObject\IdentityInterface;
10+
use Magento\Framework\Pricing\SaleableInterface;
11+
12+
@@ -270,6 +271,7 @@ class Product extends \Magento\Catalog\Model\AbstractModel implements
13+
14+
/**
15+
* @var \Magento\Catalog\Api\ProductAttributeRepositoryInterface
16+
+ * @deprecated Not used anymore due to performance issue (loaded all product attributes)
17+
*/
18+
protected $metadataService;
19+
20+
@@ -346,6 +348,11 @@ class Product extends \Magento\Catalog\Model\AbstractModel implements
21+
*/
22+
protected $linkTypeProvider;
23+
24+
+ /**
25+
+ * @var \Magento\Eav\Model\Config
26+
+ */
27+
+ private $eavConfig;
28+
+
29+
/**
30+
* Product constructor.
31+
* @param \Magento\Framework\Model\Context $context
32+
@@ -383,7 +390,7 @@ class Product extends \Magento\Catalog\Model\AbstractModel implements
33+
* @param \Magento\Framework\Api\DataObjectHelper $dataObjectHelper
34+
* @param \Magento\Framework\Api\ExtensionAttribute\JoinProcessorInterface $joinProcessor
35+
* @param array $data
36+
- *
37+
+ * @param \Magento\Eav\Model\Config|null $config
38+
* @SuppressWarnings(PHPMD.ExcessiveParameterList)
39+
* @SuppressWarnings(PHPMD.UnusedFormalParameter)
40+
*/
41+
@@ -422,7 +429,8 @@ public function __construct(
42+
EntryConverterPool $mediaGalleryEntryConverterPool,
43+
\Magento\Framework\Api\DataObjectHelper $dataObjectHelper,
44+
\Magento\Framework\Api\ExtensionAttribute\JoinProcessorInterface $joinProcessor,
45+
- array $data = []
46+
+ array $data = [],
47+
+ \Magento\Eav\Model\Config $config = null
48+
) {
49+
$this->metadataService = $metadataService;
50+
$this->_itemOptionFactory = $itemOptionFactory;
51+
@@ -461,6 +469,7 @@ public function __construct(
52+
$resourceCollection,
53+
$data
54+
);
55+
+ $this->eavConfig = $config ?? ObjectManager::getInstance()->get(\Magento\Eav\Model\Config::class);
56+
}
57+
58+
/**
59+
@@ -474,12 +483,18 @@ protected function _construct()
60+
}
61+
62+
/**
63+
- * {@inheritdoc}
64+
+ * Get a list of custom attribute codes that belongs to product attribute set. If attribute set not specified for
65+
+ * product will return all attribute codes
66+
+ *
67+
+ * @return string[]
68+
*/
69+
protected function getCustomAttributesCodes()
70+
{
71+
if ($this->customAttributesCodes === null) {
72+
- $this->customAttributesCodes = $this->getEavAttributesCodes($this->metadataService);
73+
+ $this->customAttributesCodes = array_keys($this->eavConfig->getEntityAttributes(
74+
+ self::ENTITY,
75+
+ $this
76+
+ ));
77+
$this->customAttributesCodes = array_diff($this->customAttributesCodes, $this->interfaceAttributes);
78+
}
79+
return $this->customAttributesCodes;
80+
diff -Nuar a/vendor/magento/module-catalog/Plugin/Model/ResourceModel/ReadSnapshotPlugin.php b/vendor/magento/module-catalog/Plugin/Model/ResourceModel/ReadSnapshotPlugin.php
81+
--- a/vendor/magento/module-catalog/Plugin/Model/ResourceModel/ReadSnapshotPlugin.php
82+
+++ b/vendor/magento/module-catalog/Plugin/Model/ResourceModel/ReadSnapshotPlugin.php
83+
@@ -58,7 +58,9 @@ public function afterExecute(ReadSnapshot $subject, array $entityData, $entityTy
84+
$globalAttributes = [];
85+
$attributesMap = [];
86+
$eavEntityType = $metadata->getEavEntityType();
87+
- $attributes = (null === $eavEntityType) ? [] : $this->config->getEntityAttributes($eavEntityType);
88+
+ $attributes = null === $eavEntityType
89+
+ ? []
90+
+ : $this->config->getEntityAttributes($eavEntityType, new \Magento\Framework\DataObject($entityData));
91+
92+
/** @var \Magento\Eav\Model\Entity\Attribute\AbstractAttribute $attribute */
93+
foreach ($attributes as $attribute) {
94+
diff -Nuar a/vendor/magento/module-eav/Model/ResourceModel/ReadHandler.php b/vendor/magento/module-eav/Model/ResourceModel/ReadHandler.php
95+
--- a/vendor/magento/module-eav/Model/ResourceModel/ReadHandler.php
96+
+++ b/vendor/magento/module-eav/Model/ResourceModel/ReadHandler.php
97+
@@ -5,6 +5,7 @@
98+
*/
99+
namespace Magento\Eav\Model\ResourceModel;
100+
101+
+use Magento\Framework\DataObject;
102+
use Magento\Framework\EntityManager\MetadataPool;
103+
use Magento\Framework\EntityManager\Operation\AttributeInterface;
104+
use Magento\Framework\Model\Entity\ScopeInterface;
105+
@@ -59,13 +60,29 @@ public function __construct(
106+
* @param string $entityType
107+
* @return \Magento\Eav\Api\Data\AttributeInterface[]
108+
* @throws \Exception if for unknown entity type
109+
+ * @deprecated Not used anymore
110+
+ * @see ReadHandler::getEntityAttributes
111+
*/
112+
protected function getAttributes($entityType)
113+
{
114+
$metadata = $this->metadataPool->getMetadata($entityType);
115+
$eavEntityType = $metadata->getEavEntityType();
116+
- $attributes = (null === $eavEntityType) ? [] : $this->config->getAttributes($eavEntityType);
117+
- return $attributes;
118+
+ return null === $eavEntityType ? [] : $this->config->getEntityAttributes($eavEntityType);
119+
+ }
120+
+
121+
+ /**
122+
+ * Get attribute of given entity type
123+
+ *
124+
+ * @param string $entityType
125+
+ * @param DataObject $entity
126+
+ * @return \Magento\Eav\Api\Data\AttributeInterface[]
127+
+ * @throws \Exception if for unknown entity type
128+
+ */
129+
+ private function getEntityAttributes(string $entityType, DataObject $entity): array
130+
+ {
131+
+ $metadata = $this->metadataPool->getMetadata($entityType);
132+
+ $eavEntityType = $metadata->getEavEntityType();
133+
+ return null === $eavEntityType ? [] : $this->config->getEntityAttributes($eavEntityType, $entity);
134+
}
135+
136+
/**
137+
@@ -105,7 +122,7 @@ public function execute($entityType, $entityData, $arguments = [])
138+
$selects = [];
139+
140+
/** @var \Magento\Eav\Model\Entity\Attribute\AbstractAttribute $attribute */
141+
- foreach ($this->getAttributes($entityType) as $attribute) {
142+
+ foreach ($this->getEntityAttributes($entityType, new DataObject($entityData)) as $attribute) {
143+
if (!$attribute->isStatic()) {
144+
$attributeTables[$attribute->getBackend()->getTable()][] = $attribute->getAttributeId();
145+
$attributesMap[$attribute->getAttributeId()] = $attribute->getAttributeCode();
146+
diff -Nuar a/vendor/magento/module-swatches/Model/Plugin/ProductImage.php b/vendor/magento/module-swatches/Model/Plugin/ProductImage.php
147+
--- a/vendor/magento/module-swatches/Model/Plugin/ProductImage.php
148+
+++ b/vendor/magento/module-swatches/Model/Plugin/ProductImage.php
149+
@@ -69,7 +69,7 @@ public function beforeGetImage(
150+
&& ($location == self::CATEGORY_PAGE_GRID_LOCATION || $location == self::CATEGORY_PAGE_LIST_LOCATION)) {
151+
$request = $this->request->getParams();
152+
if (is_array($request)) {
153+
- $filterArray = $this->getFilterArray($request);
154+
+ $filterArray = $this->getFilterArray($request, $product);
155+
if (!empty($filterArray)) {
156+
$product = $this->loadSimpleVariation($product, $filterArray);
157+
}
158+
@@ -99,16 +99,18 @@ protected function loadSimpleVariation(\Magento\Catalog\Model\Product $parentPro
159+
* Get filters from request
160+
*
161+
* @param array $request
162+
+ * @param \Magento\Catalog\Model\Product $product
163+
* @return array
164+
*/
165+
- protected function getFilterArray(array $request)
166+
+ private function getFilterArray(array $request, \Magento\Catalog\Model\Product $product)
167+
{
168+
$filterArray = [];
169+
- $attributeCodes = $this->eavConfig->getEntityAttributeCodes(\Magento\Catalog\Model\Product::ENTITY);
170+
+ $attributes = $this->eavConfig->getEntityAttributes(\Magento\Catalog\Model\Product::ENTITY, $product);
171+
+
172+
foreach ($request as $code => $value) {
173+
- if (in_array($code, $attributeCodes)) {
174+
- $attribute = $this->eavConfig->getAttribute(\Magento\Catalog\Model\Product::ENTITY, $code);
175+
- if ($attribute->getId() && $this->canReplaceImageWithSwatch($attribute)) {
176+
+ if (isset($attributes[$code])) {
177+
+ $attribute = $attributes[$code];
178+
+ if ($this->canReplaceImageWithSwatch($attribute)) {
179+
$filterArray[$code] = $value;
180+
}
181+
}

0 commit comments

Comments
 (0)