Skip to content
This repository was archived by the owner on Mar 27, 2019. It is now read-only.

Commit 9b95ab2

Browse files
author
Andreas Mautz
committed
Magento Community 1.9.3.10
Source https://magento.com/tech-resources/download#download2244
1 parent 04970bf commit 9b95ab2

File tree

324 files changed

+98386
-97877
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

324 files changed

+98386
-97877
lines changed

‎LICENSE.txt

+47-47
Large diffs are not rendered by default.

‎LICENSE_AFL.txt

+47-47
Large diffs are not rendered by default.

‎README.md

+1-1
Original file line numberDiff line numberDiff line change
@@ -16,5 +16,5 @@ To generate `composer.json` and install magento for the first time run:
1616
```
1717
composer require magento-hackathon/magento-composer-installer ~3.0
1818
composer require aydin-hassan/magento-core-composer-installer ~1.2
19-
composer require firegento/magento ~1.9.3.9
19+
composer require firegento/magento ~1.9.3.10
2020
```

‎RELEASE_NOTES.txt

+10
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,13 @@
1+
==== 1.9.3.10 ====
2+
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
3+
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
4+
] NOTE: Current Release Notes are maintained at: [
5+
] [
6+
] http://devdocs.magento.com/guides/m1x/ce19-ee114/ce1.9_release-notes.html [
7+
] [
8+
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
9+
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
10+
111
==== 1.9.3.9 ====
212
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
313
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

‎app/Mage.php

+1-1
Original file line numberDiff line numberDiff line change
@@ -171,7 +171,7 @@ public static function getVersionInfo()
171171
'major' => '1',
172172
'minor' => '9',
173173
'revision' => '3',
174-
'patch' => '9',
174+
'patch' => '10',
175175
'stability' => '',
176176
'number' => '',
177177
);

‎app/code/core/Mage/Admin/Model/User.php

+53
Original file line numberDiff line numberDiff line change
@@ -66,6 +66,10 @@ class Mage_Admin_Model_User extends Mage_Core_Model_Abstract
6666
const XML_PATH_FORGOT_EMAIL_TEMPLATE = 'admin/emails/forgot_email_template';
6767
const XML_PATH_FORGOT_EMAIL_IDENTITY = 'admin/emails/forgot_email_identity';
6868
const XML_PATH_STARTUP_PAGE = 'admin/startup/page';
69+
70+
/** Configuration paths for notifications */
71+
const XML_PATH_ADDITIONAL_EMAILS = 'general/additional_notification_emails/admin_user_create';
72+
const XML_PATH_NOTIFICATION_EMAILS_TEMPLATE = 'admin/emails/admin_notification_email_template';
6973
/**#@-*/
7074

7175
/**
@@ -692,4 +696,53 @@ protected function _getDateNow($dayOnly = false)
692696
{
693697
return now($dayOnly);
694698
}
699+
700+
/**
701+
* Send notification to general Contact and additional emails when new admin user created.
702+
* You can declare additional emails in Mage_Core general/additional_notification_emails/admin_user_create node.
703+
*
704+
* @param $user
705+
* @return $this
706+
*/
707+
public function sendAdminNotification($user)
708+
{
709+
// define general contact Name and Email
710+
$generalContactName = Mage::getStoreConfig('trans_email/ident_general/name');
711+
$generalContactEmail = Mage::getStoreConfig('trans_email/ident_general/email');
712+
713+
// collect general and additional emails
714+
$emails = $this->getUserCreateAdditionalEmail();
715+
$emails[] = $generalContactEmail;
716+
717+
/** @var $mailer Mage_Core_Model_Email_Template_Mailer */
718+
$mailer = Mage::getModel('core/email_template_mailer');
719+
$emailInfo = Mage::getModel('core/email_info');
720+
$emailInfo->addTo(array_filter($emails), $generalContactName);
721+
$mailer->addEmailInfo($emailInfo);
722+
723+
// Set all required params and send emails
724+
$mailer->setSender(array(
725+
'name' => $generalContactName,
726+
'email' => $generalContactEmail,
727+
));
728+
$mailer->setStoreId(0);
729+
$mailer->setTemplateId(Mage::getStoreConfig(self::XML_PATH_NOTIFICATION_EMAILS_TEMPLATE));
730+
$mailer->setTemplateParams(array(
731+
'user' => $user,
732+
));
733+
$mailer->send();
734+
735+
return $this;
736+
}
737+
738+
/**
739+
* Get additional emails for notification from config.
740+
*
741+
* @return array
742+
*/
743+
public function getUserCreateAdditionalEmail()
744+
{
745+
$emails = str_replace(' ', '', Mage::getStoreConfig(self::XML_PATH_ADDITIONAL_EMAILS));
746+
return explode(',', $emails);
747+
}
695748
}

‎app/code/core/Mage/Admin/etc/config.xml

+1
Original file line numberDiff line numberDiff line change
@@ -84,6 +84,7 @@
8484
<admin>
8585
<emails>
8686
<forgot_email_template>admin_emails_forgot_email_template</forgot_email_template>
87+
<admin_notification_email_template>admin_emails_admin_notification_email_template</admin_notification_email_template>
8788
<forgot_email_identity>general</forgot_email_identity>
8889
<password_reset_link_expiration_period>2</password_reset_link_expiration_period>
8990
</emails>

‎app/code/core/Mage/Adminhtml/Block/Catalog/Product/Edit/Tab/Super/Config.php

+1
Original file line numberDiff line numberDiff line change
@@ -154,6 +154,7 @@ public function getAttributesJson()
154154
} else {
155155
// Hide price if needed
156156
foreach ($attributes as &$attribute) {
157+
$attribute['label'] = $this->escapeHtml($attribute['label']);
157158
if (isset($attribute['values']) && is_array($attribute['values'])) {
158159
foreach ($attribute['values'] as &$attributeValue) {
159160
if (!$this->getCanReadPrice()) {

‎app/code/core/Mage/Adminhtml/Block/Widget/Grid/Massaction/Abstract.php

+2-2
Original file line numberDiff line numberDiff line change
@@ -190,7 +190,7 @@ public function getGridJsObjectName()
190190
public function getSelectedJson()
191191
{
192192
if($selected = $this->getRequest()->getParam($this->getFormFieldNameInternal())) {
193-
$selected = explode(',', $selected);
193+
$selected = explode(',', $this->quoteEscape($selected));
194194
return join(',', $selected);
195195
} else {
196196
return '';
@@ -205,7 +205,7 @@ public function getSelectedJson()
205205
public function getSelected()
206206
{
207207
if($selected = $this->getRequest()->getParam($this->getFormFieldNameInternal())) {
208-
$selected = explode(',', $selected);
208+
$selected = explode(',', $this->quoteEscape($selected));
209209
return $selected;
210210
} else {
211211
return array();

‎app/code/core/Mage/Adminhtml/Model/LayoutUpdate/Validator.php

+36-1
Original file line numberDiff line numberDiff line change
@@ -38,6 +38,7 @@ class Mage_Adminhtml_Model_LayoutUpdate_Validator extends Zend_Validate_Abstract
3838
{
3939
const XML_INVALID = 'invalidXml';
4040
const INVALID_TEMPLATE_PATH = 'invalidTemplatePath';
41+
const INVALID_BLOCK_NAME = 'invalidBlockName';
4142
const PROTECTED_ATTR_HELPER_IN_TAG_ACTION_VAR = 'protectedAttrHelperInActionVar';
4243

4344
/**
@@ -56,7 +57,18 @@ class Mage_Adminhtml_Model_LayoutUpdate_Validator extends Zend_Validate_Abstract
5657
'*//template',
5758
'*//@template',
5859
'//*[@method=\'setTemplate\']',
59-
'//*[@method=\'setDataUsingMethod\']//*[text() = \'template\']/../*'
60+
'//*[@method=\'setDataUsingMethod\']//*[contains(translate(text(),
61+
\'ABCDEFGHIJKLMNOPQRSTUVWXYZ\', \'abcdefghijklmnopqrstuvwxyz\'), \'template\')]/../*',
62+
);
63+
64+
/**
65+
* Disallowed template name
66+
*
67+
* @var array
68+
*/
69+
protected $_disallowedBlock = array(
70+
'Mage_Install_Block_End',
71+
'Mage_Rss_Block_Order_New',
6072
);
6173

6274
/**
@@ -91,6 +103,7 @@ protected function _initMessageTemplates()
91103
self::INVALID_TEMPLATE_PATH => Mage::helper('adminhtml')->__(
92104
'Invalid template path used in layout update.'
93105
),
106+
self::INVALID_BLOCK_NAME => Mage::helper('adminhtml')->__('Disallowed block name for frontend.'),
94107
);
95108
}
96109
return $this;
@@ -125,6 +138,10 @@ public function isValid($value)
125138
Mage::helper('adminhtml')->__('XML object is not instance of "Varien_Simplexml_Element".'));
126139
}
127140

141+
if ($value->xpath($this->_getXpathBlockValidationExpression())) {
142+
$this->_error(self::INVALID_BLOCK_NAME);
143+
return false;
144+
}
128145
// if layout update declare custom templates then validate their paths
129146
if ($templatePaths = $value->xpath($this->_getXpathValidationExpression())) {
130147
try {
@@ -154,6 +171,20 @@ protected function _getXpathValidationExpression() {
154171
return implode(" | ", $this->_disallowedXPathExpressions);
155172
}
156173

174+
/**
175+
* Returns xPath for validate incorrect block name
176+
*
177+
* @return string xPath for validate incorrect block name
178+
*/
179+
protected function _getXpathBlockValidationExpression() {
180+
$xpath = "";
181+
if (count($this->_disallowedBlock)) {
182+
$xpath = "//block[@type='";
183+
$xpath .= implode("'] | //block[@type='", $this->_disallowedBlock) . "']";
184+
}
185+
return $xpath;
186+
}
187+
157188
/**
158189
* Validate template path for preventing access to the directory above
159190
* If template path value has "../" @throws Exception
@@ -162,7 +193,11 @@ protected function _getXpathValidationExpression() {
162193
*/
163194
protected function _validateTemplatePath(array $templatePaths)
164195
{
196+
/**@var $path Varien_Simplexml_Element */
165197
foreach ($templatePaths as $path) {
198+
if ($path->hasChildren()) {
199+
$path = stripcslashes(trim((string) $path->children(), '"'));
200+
}
166201
if (strpos($path, '..' . DS) !== false) {
167202
throw new Exception();
168203
}

‎app/code/core/Mage/Adminhtml/controllers/Catalog/ProductController.php

+10
Original file line numberDiff line numberDiff line change
@@ -1031,6 +1031,16 @@ public function quickCreateAction()
10311031
}
10321032

10331033
$product->addData($this->getRequest()->getParam('simple_product', array()));
1034+
1035+
$productSku = $product->getSku();
1036+
if ($productSku && $productSku != Mage::helper('core')->stripTags($productSku)) {
1037+
$result['error'] = array(
1038+
'message' => $this->__('HTML tags are not allowed in SKU attribute.')
1039+
);
1040+
$this->getResponse()->setBody(Mage::helper('core')->jsonEncode($result));
1041+
return;
1042+
}
1043+
10341044
$product->setWebsiteIds($configurableProduct->getWebsiteIds());
10351045

10361046
$autogenerateOptions = array();

‎app/code/core/Mage/Adminhtml/controllers/Permissions/UserController.php

+6
Original file line numberDiff line numberDiff line change
@@ -101,6 +101,8 @@ public function saveAction()
101101

102102
$id = $this->getRequest()->getParam('user_id');
103103
$model = Mage::getModel('admin/user')->load($id);
104+
// @var $isNew flag for detecting new admin user creation.
105+
$isNew = !$model->getId() ? true : false;
104106
if (!$model->getId() && $id) {
105107
Mage::getSingleton('adminhtml/session')->addError($this->__('This user no longer exists.'));
106108
$this->_redirect('*/*/');
@@ -139,6 +141,10 @@ public function saveAction()
139141

140142
try {
141143
$model->save();
144+
// Send notification to General and additional contacts (if declared) that a new admin user was created.
145+
if (Mage::getStoreConfigFlag('admin/security/crate_admin_user_notification') && $isNew) {
146+
Mage::getModel('admin/user')->sendAdminNotification($model);
147+
}
142148
if ( $uRoles = $this->getRequest()->getParam('roles', false) ) {
143149
/*parse_str($uRoles, $uRoles);
144150
$uRoles = array_keys($uRoles);*/

‎app/code/core/Mage/Adminhtml/etc/config.xml

+5
Original file line numberDiff line numberDiff line change
@@ -54,6 +54,11 @@
5454
<file>admin_password_reset_confirmation.html</file>
5555
<type>html</type>
5656
</admin_emails_forgot_email_template>
57+
<admin_emails_admin_notification_email_template>
58+
<label>New Admin User Create Notification</label>
59+
<file>admin_new_user_notification.html</file>
60+
<type>html</type>
61+
</admin_emails_admin_notification_email_template>
5762
</email>
5863
</template>
5964
<events>

‎app/code/core/Mage/Checkout/Model/Api/Resource/Customer.php

+1-1
Original file line numberDiff line numberDiff line change
@@ -152,7 +152,7 @@ protected function _prepareNewCustomerQuote(Mage_Sales_Model_Quote $quote)
152152
$customer->setPasswordCreatedAt(time());
153153
$quote->setCustomer($customer)
154154
->setCustomerId(true);
155-
155+
$quote->setPasswordHash('');
156156
return $this;
157157
}
158158

‎app/code/core/Mage/Checkout/Model/Type/Onepage.php

+1
Original file line numberDiff line numberDiff line change
@@ -734,6 +734,7 @@ protected function _prepareNewCustomerQuote()
734734
$customer->setPasswordCreatedAt($passwordCreatedTime);
735735
$quote->setCustomer($customer)
736736
->setCustomerId(true);
737+
$quote->setPasswordHash('');
737738
}
738739

739740
/**

‎app/code/core/Mage/Cms/Model/Wysiwyg/Images/Storage.php

+10-7
Original file line numberDiff line numberDiff line change
@@ -283,20 +283,23 @@ public function uploadFile($targetPath, $type = null)
283283
}
284284
$uploader->setAllowRenameFiles(true);
285285
$uploader->setFilesDispersion(false);
286-
$uploader->addValidateCallback(
287-
Mage_Core_Model_File_Validator_Image::NAME,
288-
Mage::getModel('core/file_validator_image'),
289-
'validate'
290-
);
286+
if ($type == 'image') {
287+
$uploader->addValidateCallback(
288+
Mage_Core_Model_File_Validator_Image::NAME,
289+
Mage::getModel('core/file_validator_image'),
290+
'validate'
291+
);
292+
}
291293
$result = $uploader->save($targetPath);
292294

293295
if (!$result) {
294296
Mage::throwException( Mage::helper('cms')->__('Cannot upload file.') );
295297
}
296298

297299
// create thumbnail
298-
$this->resizeFile($targetPath . DS . $uploader->getUploadedFileName(), true);
299-
300+
if ($type == 'image') {
301+
$this->resizeFile($targetPath . DS . $uploader->getUploadedFileName(), true);
302+
}
300303
$result['cookie'] = array(
301304
'name' => session_name(),
302305
'value' => $this->getSession()->getSessionId(),

‎app/code/core/Mage/Core/etc/config.xml

+5
Original file line numberDiff line numberDiff line change
@@ -471,6 +471,11 @@
471471
<reprocess_images>
472472
<active>1</active>
473473
</reprocess_images>
474+
<!-- Additional email for notifications -->
475+
<additional_notification_emails>
476+
<!-- On creating a new admin user. You can specify several emails separated by commas. -->
477+
<admin_user_create></admin_user_create>
478+
</additional_notification_emails>
474479
</general>
475480
</default>
476481
<stores>

‎app/code/core/Mage/Core/etc/system.xml

+10
Original file line numberDiff line numberDiff line change
@@ -1219,6 +1219,16 @@
12191219
<show_in_website>0</show_in_website>
12201220
<show_in_store>0</show_in_store>
12211221
</extensions_compatibility_mode>
1222+
<crate_admin_user_notification translate="label comment">
1223+
<label>New Admin User Create Notification</label>
1224+
<comment>This setting enable notification when new admin user created.</comment>
1225+
<frontend_type>select</frontend_type>
1226+
<sort_order>10</sort_order>
1227+
<source_model>adminhtml/system_config_source_enabledisable</source_model>
1228+
<show_in_default>1</show_in_default>
1229+
<show_in_website>0</show_in_website>
1230+
<show_in_store>0</show_in_store>
1231+
</crate_admin_user_notification>
12221232
</fields>
12231233
</security>
12241234
<dashboard translate="label">

‎app/code/core/Mage/Customer/Helper/Data.php

+11
Original file line numberDiff line numberDiff line change
@@ -459,6 +459,17 @@ public function generateResetPasswordLinkToken()
459459
return Mage::helper('core')->uniqHash();
460460
}
461461

462+
/**
463+
* Generate unique token based on customer Id for reset password confirmation link
464+
*
465+
* @param $customerId
466+
* @return string
467+
*/
468+
public function generateResetPasswordLinkCustomerId($customerId)
469+
{
470+
return md5(uniqid($customerId . microtime() . mt_rand(), true));
471+
}
472+
462473
/**
463474
* Retrieve customer reset password link expiration period in days
464475
*

‎app/code/core/Mage/Customer/Model/Customer.php

+23
Original file line numberDiff line numberDiff line change
@@ -57,6 +57,7 @@ class Mage_Customer_Model_Customer extends Mage_Core_Model_Abstract
5757
const EXCEPTION_INVALID_EMAIL_OR_PASSWORD = 2;
5858
const EXCEPTION_EMAIL_EXISTS = 3;
5959
const EXCEPTION_INVALID_RESET_PASSWORD_LINK_TOKEN = 4;
60+
const EXCEPTION_INVALID_RESET_PASSWORD_LINK_CUSTOMER_ID = 5;
6061
/**#@-*/
6162

6263
/**#@+
@@ -1390,6 +1391,28 @@ public function changeResetPasswordLinkToken($newResetPasswordLinkToken) {
13901391
return $this;
13911392
}
13921393

1394+
/**
1395+
* Change reset password link customer Id
1396+
*
1397+
* Stores new reset password link customer Id
1398+
*
1399+
* @param string $newResetPasswordLinkCustomerId
1400+
* @return Mage_Customer_Model_Customer
1401+
* @throws Mage_Core_Exception
1402+
*/
1403+
public function changeResetPasswordLinkCustomerId($newResetPasswordLinkCustomerId)
1404+
{
1405+
if (!is_string($newResetPasswordLinkCustomerId) || empty($newResetPasswordLinkCustomerId)) {
1406+
throw Mage::exception(
1407+
'Mage_Core',
1408+
Mage::helper('customer')->__('Invalid password reset customer Id.'),
1409+
self::EXCEPTION_INVALID_RESET_PASSWORD_LINK_CUSTOMER_ID
1410+
);
1411+
}
1412+
$this->_getResource()->changeResetPasswordLinkCustomerId($this, $newResetPasswordLinkCustomerId);
1413+
return $this;
1414+
}
1415+
13931416
/**
13941417
* Check if current reset password link token is expired
13951418
*

0 commit comments

Comments
 (0)