Skip to content

Commit d08fda5

Browse files
nathanjosiahnathanjosiah
committed
Merge branch 'develop' of github.com:magento-cia/security-package into imported-magento-security-package-286
2 parents dfca94a + 57aeec6 commit d08fda5

File tree

130 files changed

+4015
-159
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

130 files changed

+4015
-159
lines changed

‎README.md‎

Lines changed: 13 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -2,24 +2,26 @@
22
Welcome to Magento 2 installation! We're glad you chose to install Magento 2, a cutting-edge, feature-rich eCommerce solution that gets results.
33

44
## Magento System Requirements
5-
[Magento System Requirements](https://devdocs.magento.com/guides/v2.3/install-gde/system-requirements.html).
5+
* [Magento System Requirements](https://devdocs.magento.com/guides/v2.4/install-gde/system-requirements.html)
66

77
## Install Magento
88

9-
* [Installation Guide](https://devdocs.magento.com/guides/v2.3/install-gde/bk-install-guide.html).
9+
* [Installation Guide](https://devdocs.magento.com/guides/v2.4/install-gde/bk-install-guide.html)
1010

1111
<h2>Contributing to the Magento 2 Code Base</h2>
1212
Contributions can take the form of new components or features, changes to existing features, tests, documentation (such as developer guides, user guides, examples, or specifications), bug fixes, optimizations, or just good suggestions.
1313

1414
To learn about how to make a contribution, click [here][1].
1515

16-
To learn about issues, click [here][2]. To open an issue, click [here][3].
16+
To learn about issues, click [here][2].
17+
18+
To open an issue, click [here][3].
1719

1820
To suggest documentation improvements, click [here][4].
1921

20-
[1]: <https://devdocs.magento.com/guides/v2.3/contributor-guide/contributing.html>
21-
[2]: <https://devdocs.magento.com/guides/v2.3/contributor-guide/contributing.html#report>
22-
[3]: <https://github.com/magento/security-package/issues>
22+
[1]: https://devdocs.magento.com/contributor-guide/contributing.html
23+
[2]: https://devdocs.magento.com/contributor-guide/contributing.html#report
24+
[3]: https://github.com/magento/security-package/issues
2325
[4]: <https://devdocs.magento.com>
2426

2527
<h3>Community Maintainers</h3>
@@ -37,7 +39,7 @@ Magento is thankful for any contribution that can improve our code base, documen
3739

3840
### Labels Applied by the Magento Team
3941
We apply labels to public Pull Requests and Issues to help other participants retrieve additional information about current progress, component assignments, Magento release lines, and much more.
40-
Please review the [Code Contributions guide](https://devdocs.magento.com/guides/v2.3/contributor-guide/contributing.html#labels) for detailed information on labels used in Magento 2 repositories.
42+
Please review the [Code Contributions guide](https://devdocs.magento.com/contributor-guide/contributing.html#labels) for detailed information on labels used in Magento 2 repositories.
4143

4244
## Reporting Security Issues
4345

@@ -50,7 +52,7 @@ Stay up-to-date on the latest security news and patches for Magento by signing u
5052
Each Magento source file included in this distribution is licensed under OSL 3.0 or the Magento Enterprise Edition (MEE) license.
5153

5254
[Open Software License (OSL 3.0)](https://opensource.org/licenses/osl-3.0.php).
53-
Please see [LICENSE.txt](https://github.com/magento/security-package/blob/2.3-develop/LICENSE.txt) for the full text of the OSL 3.0 license or contact [email protected] for a copy.
55+
Please see [LICENSE.txt](https://github.com/magento/security-package/blob/develop/LICENSE.txt) for the full text of the OSL 3.0 license or contact [email protected] for a copy.
5456

5557
Subject to Licensee's payment of fees and compliance with the terms and conditions of the MEE License, the MEE License supersedes the OSL 3.0 license for each source file.
5658
Please see LICENSE_EE.txt for the full text of the MEE License or visit https://magento.com/legal/terms/enterprise.
@@ -62,6 +64,6 @@ To connect with Magento and the Community, join us on the [Magento Community Eng
6264

6365
We have channels for each project. These channels are recommended for new members:
6466

65-
- [general](https://magentocommeng.slack.com/messages/C4YS78WE6): Open chat for introductions and Magento 2 questions
66-
- [github](https://magentocommeng.slack.com/messages/C7KB93M32): Support for GitHub issues, pull requests, and processes
67-
- [public-backlog](https://magentocommeng.slack.com/messages/CCV3J3RV5): Discussions of the Magento 2 backlog
67+
- [general](https://magentocommeng.slack.com/archives/C4YS78WE6): Open chat for introductions and Magento 2 questions
68+
- [github](https://magentocommeng.slack.com/archives/C7KB93M32): Support for GitHub issues, pull requests, and processes
69+
- [public-backlog](https://magentocommeng.slack.com/archives/CCV3J3RV5): Discussions of the Magento 2 backlog

‎ReCaptchaAdminUi/README.md‎

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1,7 @@
1-
Please refer to: https://github.com/magento/security-package
1+
# Magento reCAPTCHA
2+
3+
Google reCAPTCHA ensures that a human being, rather than a computer (or “bot”), is interacting with your website. Unlike the standard Magento CAPTCHA, Google reCAPTCHA provides enhanced security with a selection of different display options and methods. Additional website traffic information is available in the dashboard of your Google reCAPTCHA account.
4+
5+
This module provides the reCAPTCHA UI files related to views in the admin panel.
6+
7+
For more information please visit the [Magento document for reCAPTCHA](https://docs.magento.com/user-guide/stores/security-google-recaptcha.html).

‎ReCaptchaAdminUi/etc/di.xml‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,4 +18,11 @@
1818
</argument>
1919
</arguments>
2020
</virtualType>
21+
<type name="Magento\ReCaptchaUi\Model\CaptchaTypeResolver">
22+
<arguments>
23+
<argument name="resolvers" xsi:type="array">
24+
<item name="admin" xsi:type="object">Magento\ReCaptchaAdminUi\Model\CaptchaTypeResolver</item>
25+
</argument>
26+
</arguments>
27+
</type>
2128
</config>

‎ReCaptchaCheckout/Block/LayoutProcessor/Checkout/Onepage.php‎

Lines changed: 15 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -40,11 +40,7 @@ public function __construct(
4040
}
4141

4242
/**
43-
* {@inheritdoc}
44-
*
45-
* @param array $jsLayout
46-
* @return array
47-
* @throws InputException
43+
* @inheritDoc
4844
*/
4945
public function process($jsLayout)
5046
{
@@ -76,6 +72,20 @@ public function process($jsLayout)
7672
unset($jsLayout['components']['checkout']['children']['authentication']['children']['recaptcha']);
7773
}
7874
}
75+
$key = 'place_order';
76+
if ($this->isCaptchaEnabled->isCaptchaEnabledFor($key)) {
77+
$jsLayout['components']['checkout']['children']['steps']['children']['billing-step']['children']
78+
['payment']['children']['beforeMethods']['children']['place-order-recaptcha-container']['children']
79+
['place-order-recaptcha']['settings'] = $this->captchaUiConfigResolver->get($key);
80+
} else {
81+
if (isset($jsLayout['components']['checkout']['children']['steps']['children']['billing-step']['children']
82+
['payment']['children']['beforeMethods']['children']['place-order-recaptcha'])) {
83+
unset($jsLayout['components']['checkout']['children']['steps']['children']['billing-step']['children']
84+
['payment']['children']['beforeMethods']['children']['place-order-recaptcha-container']
85+
['children']['place-order-recaptcha']);
86+
}
87+
}
88+
7989
return $jsLayout;
8090
}
8191
}

‎ReCaptchaCheckout/Model/WebapiConfigProvider.php‎

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
<?php
2+
/**
3+
* Copyright © Magento, Inc. All rights reserved.
4+
* See COPYING.txt for license details.
5+
*/
6+
declare(strict_types=1);
7+
8+
namespace Magento\ReCaptchaCheckout\Model;
9+
10+
use Magento\ReCaptchaUi\Model\IsCaptchaEnabledInterface;
11+
use Magento\ReCaptchaUi\Model\ValidationConfigResolverInterface;
12+
use Magento\ReCaptchaValidationApi\Api\Data\ValidationConfigInterface;
13+
use Magento\ReCaptchaWebapiApi\Api\Data\EndpointInterface;
14+
use Magento\ReCaptchaWebapiApi\Api\WebapiValidationConfigProviderInterface;
15+
16+
/**
17+
* Provide checkout related endpoint configuration.
18+
*/
19+
class WebapiConfigProvider implements WebapiValidationConfigProviderInterface
20+
{
21+
private const CAPTCHA_ID = 'place_order';
22+
23+
/**
24+
* @var IsCaptchaEnabledInterface
25+
*/
26+
private $isEnabled;
27+
28+
/**
29+
* @var ValidationConfigResolverInterface
30+
*/
31+
private $configResolver;
32+
33+
/**
34+
* @param IsCaptchaEnabledInterface $isEnabled
35+
* @param ValidationConfigResolverInterface $configResolver
36+
*/
37+
public function __construct(IsCaptchaEnabledInterface $isEnabled, ValidationConfigResolverInterface $configResolver)
38+
{
39+
$this->isEnabled = $isEnabled;
40+
$this->configResolver = $configResolver;
41+
}
42+
43+
/**
44+
* @inheritDoc
45+
*/
46+
public function getConfigFor(EndpointInterface $endpoint): ?ValidationConfigInterface
47+
{
48+
//phpcs:disable Magento2.PHP.LiteralNamespaces
49+
if ($endpoint->getServiceMethod() === 'savePaymentInformationAndPlaceOrder'
50+
|| $endpoint->getServiceClass() === 'Magento\QuoteGraphQl\Model\Resolver\SetPaymentAndPlaceOrder'
51+
|| $endpoint->getServiceClass() === 'Magento\QuoteGraphQl\Model\Resolver\PlaceOrder'
52+
) {
53+
if ($this->isEnabled->isCaptchaEnabledFor(self::CAPTCHA_ID)) {
54+
return $this->configResolver->get(self::CAPTCHA_ID);
55+
}
56+
}
57+
//phpcs:enable Magento2.PHP.LiteralNamespaces
58+
59+
return null;
60+
}
61+
}

‎ReCaptchaCheckout/README.md‎

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1,7 @@
1-
Please refer to: https://github.com/magento/security-package
1+
# Magento reCAPTCHA
2+
3+
Google reCAPTCHA ensures that a human being, rather than a computer (or “bot”), is interacting with your website. Unlike the standard Magento CAPTCHA, Google reCAPTCHA provides enhanced security with a selection of different display options and methods. Additional website traffic information is available in the dashboard of your Google reCAPTCHA account.
4+
5+
This module provides the reCAPTCHA implementations related to checkout.
6+
7+
For more information please visit the [Magento document for reCAPTCHA](https://docs.magento.com/user-guide/stores/security-google-recaptcha.html).

‎ReCaptchaCheckout/Test/Api/GuestPaymentInformationManagementTest.php‎

Lines changed: 89 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,89 @@
1+
<?php
2+
/**
3+
* Copyright © Magento, Inc. All rights reserved.
4+
* See COPYING.txt for license details.
5+
*/
6+
declare(strict_types=1);
7+
8+
namespace Magento\ReCaptchaCheckout\Test\Api;
9+
10+
use Magento\Framework\Webapi\Rest\Request;
11+
use Magento\Quote\Model\Quote;
12+
use Magento\Quote\Model\QuoteFactory;
13+
use Magento\TestFramework\Helper\Bootstrap;
14+
use Magento\TestFramework\TestCase\WebapiAbstract;
15+
16+
/**
17+
* Test that checkout APIs are covered with ReCaptcha
18+
*/
19+
class GuestPaymentInformationManagementTest extends WebapiAbstract
20+
{
21+
private const API_ROUTE = '/V1/guest-carts/%s/payment-information';
22+
23+
/**
24+
* @var QuoteFactory
25+
*/
26+
private $quoteFactory;
27+
28+
/**
29+
* @inheritDoc
30+
*/
31+
protected function setUp(): void
32+
{
33+
parent::setUp();
34+
35+
$this->_markTestAsRestOnly();
36+
$objectManager = Bootstrap::getObjectManager();
37+
$this->quoteFactory = $objectManager->get(QuoteFactory::class);
38+
}
39+
40+
/**
41+
* @magentoApiDataFixture Magento/Checkout/_files/quote_with_check_payment.php
42+
* @magentoConfigFixture default_store customer/captcha/enable 0
43+
* @magentoConfigFixture base_website recaptcha_frontend/type_invisible/public_key test_public_key
44+
* @magentoConfigFixture base_website recaptcha_frontend/type_invisible/private_key test_private_key
45+
* @magentoConfigFixture base_website recaptcha_frontend/type_for/place_order invisible
46+
*/
47+
public function testRequired(): void
48+
{
49+
$this->expectException(\Throwable::class);
50+
$this->expectExceptionCode(400);
51+
$this->expectExceptionMessage('{"message":"ReCaptcha validation failed, please try again"}');
52+
53+
/** @var Quote $quote */
54+
$quote = $this->quoteFactory->create();
55+
$quote->load('test_order_1', 'reserved_order_id');
56+
$cartId = $quote->getId();
57+
$payment = $quote->getPayment();
58+
$address = $quote->getBillingAddress();
59+
$addressData = [];
60+
$addressProperties = [
61+
'city', 'company', 'countryId', 'firstname', 'lastname', 'postcode',
62+
'region', 'regionCode', 'regionId', 'saveInAddressBook', 'street', 'telephone', 'email'
63+
];
64+
foreach ($addressProperties as $property) {
65+
$method = 'get' . $property;
66+
$addressData[$property] = $address->$method();
67+
}
68+
69+
$serviceInfo = [
70+
'rest' => [
71+
'resourcePath' => sprintf(self::API_ROUTE, $cartId),
72+
'httpMethod' => Request::HTTP_METHOD_POST,
73+
'token' => null
74+
],
75+
];
76+
$requestData = [
77+
'cart_id' => $cartId,
78+
'billingAddress' => $addressData,
79+
'email' => $quote->getCustomerEmail(),
80+
'paymentMethod' => [
81+
'additional_data' => $payment->getAdditionalData(),
82+
'method' => $payment->getMethod(),
83+
'po_number' => $payment->getPoNumber()
84+
]
85+
];
86+
87+
$this->_webApiCall($serviceInfo, $requestData);
88+
}
89+
}

‎ReCaptchaCheckout/Test/Api/PaymentInformationManagementTest.php‎

Lines changed: 97 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,97 @@
1+
<?php
2+
/**
3+
* Copyright © Magento, Inc. All rights reserved.
4+
* See COPYING.txt for license details.
5+
*/
6+
declare(strict_types=1);
7+
8+
namespace Magento\ReCaptchaCheckout\Test\Api;
9+
10+
use Magento\Framework\Webapi\Rest\Request;
11+
use Magento\Integration\Api\CustomerTokenServiceInterface;
12+
use Magento\Quote\Model\Quote;
13+
use Magento\Quote\Model\QuoteFactory;
14+
use Magento\TestFramework\Helper\Bootstrap;
15+
use Magento\TestFramework\TestCase\WebapiAbstract;
16+
17+
/**
18+
* Test that checkout APIs are covered with ReCaptcha
19+
*/
20+
class PaymentInformationManagementTest extends WebapiAbstract
21+
{
22+
private const API_ROUTE = '/V1/carts/mine/payment-information';
23+
24+
/**
25+
* @var QuoteFactory
26+
*/
27+
private $quoteFactory;
28+
29+
/**
30+
* @var CustomerTokenServiceInterface
31+
*/
32+
private $tokenService;
33+
34+
/**
35+
* @inheritDoc
36+
*/
37+
protected function setUp(): void
38+
{
39+
parent::setUp();
40+
41+
$this->_markTestAsRestOnly();
42+
$objectManager = Bootstrap::getObjectManager();
43+
$this->quoteFactory = $objectManager->get(QuoteFactory::class);
44+
$this->tokenService = $objectManager->get(CustomerTokenServiceInterface::class);
45+
}
46+
47+
/**
48+
* @magentoApiDataFixture Magento/Checkout/_files/customer_quote_ready_for_order.php
49+
* @magentoConfigFixture default_store customer/captcha/enable 0
50+
* @magentoConfigFixture base_website recaptcha_frontend/type_invisible/public_key test_public_key
51+
* @magentoConfigFixture base_website recaptcha_frontend/type_invisible/private_key test_private_key
52+
* @magentoConfigFixture base_website recaptcha_frontend/type_for/place_order invisible
53+
*/
54+
public function testRequired(): void
55+
{
56+
$this->expectException(\Throwable::class);
57+
$this->expectExceptionCode(400);
58+
$this->expectExceptionMessage('{"message":"ReCaptcha validation failed, please try again"}');
59+
60+
/** @var Quote $quote */
61+
$quote = $this->quoteFactory->create();
62+
$quote->load('55555555', 'reserved_order_id');
63+
$cartId = $quote->getId();
64+
$payment = $quote->getPayment();
65+
$address = $quote->getBillingAddress();
66+
$addressData = [];
67+
$addressProperties = [
68+
'city', 'company', 'countryId', 'firstname', 'lastname', 'postcode',
69+
'region', 'regionCode', 'regionId', 'saveInAddressBook', 'street', 'telephone', 'email'
70+
];
71+
foreach ($addressProperties as $property) {
72+
$method = 'get' . $property;
73+
$addressData[$property] = $address->$method();
74+
}
75+
$token = $this->tokenService->createCustomerAccessToken('[email protected]', 'password');
76+
77+
$serviceInfo = [
78+
'rest' => [
79+
'resourcePath' => self::API_ROUTE,
80+
'httpMethod' => Request::HTTP_METHOD_POST,
81+
'token' => $token
82+
],
83+
];
84+
$requestData = [
85+
'cart_id' => $cartId,
86+
'billingAddress' => $addressData,
87+
'email' => $quote->getCustomerEmail(),
88+
'paymentMethod' => [
89+
'additional_data' => $payment->getAdditionalData(),
90+
'method' => $payment->getMethod(),
91+
'po_number' => $payment->getPoNumber()
92+
]
93+
];
94+
95+
$this->_webApiCall($serviceInfo, $requestData);
96+
}
97+
}

‎ReCaptchaCheckout/composer.json‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,12 @@
55
"php": "~7.3.0||~7.4.0",
66
"magento/framework": "*",
77
"magento/module-checkout": "*",
8-
"magento/module-re-captcha-ui": "*"
8+
"magento/module-re-captcha-ui": "*",
9+
"magento/module-re-captcha-validation-api": "*",
10+
"magento/module-re-captcha-admin-ui": "*",
11+
"magento/module-re-captcha-frontend-ui": "*",
12+
"magento/module-re-captcha-webapi-api": "*",
13+
"magento/module-re-captcha-webapi-ui": "*"
914
},
1015
"type": "magento2-module",
1116
"license": "OSL-3.0",

0 commit comments

Comments
 (0)