Skip to content
This repository was archived by the owner on Mar 27, 2019. It is now read-only.

Commit e375159

Browse files
razbakovrazbakov
authored
Merge pull request #59 from muhkuh2005/master
v1.9.3.3
2 parents b6d5eb9 + 9acf414 commit e375159

File tree

98 files changed

+12135
-74
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

98 files changed

+12135
-74
lines changed

‎README.md

+1-1
Original file line numberDiff line numberDiff line change
@@ -16,5 +16,5 @@ To generate `composer.json` and install magento for the first time run:
1616
```
1717
composer require magento-hackathon/magento-composer-installer ~3.0
1818
composer require aydin-hassan/magento-core-composer-installer ~1.2
19-
composer require firegento/magento ~1.9.2.4
19+
composer require firegento/magento ~1.9.3.3
2020
```

‎RELEASE_NOTES.txt

+10
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,13 @@
1+
==== 1.9.3.3 ====
2+
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
3+
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
4+
] NOTE: Current Release Notes are maintained at: [
5+
] [
6+
] http://devdocs.magento.com/guides/m1x/ce19-ee114/ce1.9_release-notes.html [
7+
] [
8+
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
9+
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
10+
111
==== 1.9.3.2 ====
212
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
313
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

‎app/Mage.php

+1-1
Original file line numberDiff line numberDiff line change
@@ -171,7 +171,7 @@ public static function getVersionInfo()
171171
'major' => '1',
172172
'minor' => '9',
173173
'revision' => '3',
174-
'patch' => '2',
174+
'patch' => '3',
175175
'stability' => '',
176176
'number' => '',
177177
);

‎app/code/core/Mage/Admin/Model/Session.php

+3
Original file line numberDiff line numberDiff line change
@@ -138,6 +138,9 @@ public function login($username, $password, $request = null)
138138
Mage::throwException(Mage::helper('adminhtml')->__('Invalid User Name or Password.'));
139139
}
140140
} catch (Mage_Core_Exception $e) {
141+
$e->setMessage(
142+
Mage::helper('adminhtml')->__('You did not sign in correctly or your account is temporarily disabled.')
143+
);
141144
Mage::dispatchEvent('admin_session_user_login_failed',
142145
array('user_name' => $username, 'exception' => $e));
143146
if ($request && !$request->getParam('messageSent')) {

‎app/code/core/Mage/Adminhtml/Block/Checkout/Formkey.php

+52
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
<?php
2+
/**
3+
* Magento
4+
*
5+
* NOTICE OF LICENSE
6+
*
7+
* This source file is subject to the Open Software License (OSL 3.0)
8+
* that is bundled with this package in the file LICENSE.txt.
9+
* It is also available through the world-wide-web at this URL:
10+
* http://opensource.org/licenses/osl-3.0.php
11+
* If you did not receive a copy of the license and are unable to
12+
* obtain it through the world-wide-web, please send an email
13+
* to license@magento.com so we can send you a copy immediately.
14+
*
15+
* DISCLAIMER
16+
*
17+
* Do not edit or add to this file if you wish to upgrade Magento to newer
18+
* versions in the future. If you wish to customize Magento for your
19+
* needs please refer to http://www.magento.com for more information.
20+
*
21+
* @category Mage
22+
* @package Mage_Adminhtml
23+
* @copyright Copyright (c) 2006-2017 X.commerce, Inc. and affiliates (http://www.magento.com)
24+
* @license http://opensource.org/licenses/osl-3.0.php Open Software License (OSL 3.0)
25+
*/
26+
27+
/**
28+
* Class Mage_Adminhtml_Block_Checkout_Formkey
29+
*/
30+
class Mage_Adminhtml_Block_Checkout_Formkey extends Mage_Adminhtml_Block_Template
31+
{
32+
/**
33+
* Check form key validation on checkout.
34+
* If disabled, show notice.
35+
*
36+
* @return boolean
37+
*/
38+
public function canShow()
39+
{
40+
return !Mage::getStoreConfigFlag('admin/security/validate_formkey_checkout');
41+
}
42+
43+
/**
44+
* Get url for edit Advanced -> Admin section
45+
*
46+
* @return string
47+
*/
48+
public function getSecurityAdminUrl()
49+
{
50+
return Mage::helper("adminhtml")->getUrl('adminhtml/system_config/edit/section/admin');
51+
}
52+
}

‎app/code/core/Mage/Adminhtml/Block/Notification/Symlink.php

+36
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
<?php
2+
/**
3+
* Magento
4+
*
5+
* NOTICE OF LICENSE
6+
*
7+
* This source file is subject to the Open Software License (OSL 3.0)
8+
* that is bundled with this package in the file LICENSE.txt.
9+
* It is also available through the world-wide-web at this URL:
10+
* http://opensource.org/licenses/osl-3.0.php
11+
* If you did not receive a copy of the license and are unable to
12+
* obtain it through the world-wide-web, please send an email
13+
* to license@magento.com so we can send you a copy immediately.
14+
*
15+
* DISCLAIMER
16+
*
17+
* Do not edit or add to this file if you wish to upgrade Magento to newer
18+
* versions in the future. If you wish to customize Magento for your
19+
* needs please refer to http://www.magento.com for more information.
20+
*
21+
* @category Mage
22+
* @package Mage_Adminhtml
23+
* @copyright Copyright (c) 2006-2017 X.commerce, Inc. and affiliates (http://www.magento.com)
24+
* @license http://opensource.org/licenses/osl-3.0.php Open Software License (OSL 3.0)
25+
*/
26+
27+
class Mage_Adminhtml_Block_Notification_Symlink extends Mage_Adminhtml_Block_Template
28+
{
29+
/**
30+
* @return bool
31+
*/
32+
public function isSymlinkEnabled()
33+
{
34+
return Mage::getStoreConfigFlag(self::XML_PATH_TEMPLATE_ALLOW_SYMLINK);
35+
}
36+
}

‎app/code/core/Mage/Adminhtml/Block/Widget/Grid/Column/Filter/Date.php

+2-2
Original file line numberDiff line numberDiff line change
@@ -146,11 +146,11 @@ public function setValue($value)
146146
if (isset($value['locale'])) {
147147
if (!empty($value['from'])) {
148148
$value['orig_from'] = $value['from'];
149-
$value['from'] = $this->_convertDate($value['from'], $value['locale']);
149+
$value['from'] = $this->_convertDate($this->stripTags($value['from']), $value['locale']);
150150
}
151151
if (!empty($value['to'])) {
152152
$value['orig_to'] = $value['to'];
153-
$value['to'] = $this->_convertDate($value['to'], $value['locale']);
153+
$value['to'] = $this->_convertDate($this->stripTags($value['to']), $value['locale']);
154154
}
155155
}
156156
if (empty($value['from']) && empty($value['to'])) {

‎app/code/core/Mage/Adminhtml/Model/Config/Data.php

+3
Original file line numberDiff line numberDiff line change
@@ -167,6 +167,9 @@ public function save()
167167
if (is_object($fieldConfig)) {
168168
$configPath = (string)$fieldConfig->config_path;
169169
if (!empty($configPath) && strrpos($configPath, '/') > 0) {
170+
if (!Mage::getSingleton('admin/session')->isAllowed($configPath)) {
171+
Mage::throwException('Access denied.');
172+
}
170173
// Extend old data with specified section group
171174
$groupPath = substr($configPath, 0, strrpos($configPath, '/'));
172175
if (!isset($oldConfigAdditionalGroups[$groupPath])) {

‎app/code/core/Mage/Adminhtml/controllers/Catalog/Product/GalleryController.php

+5
Original file line numberDiff line numberDiff line change
@@ -42,6 +42,11 @@ public function uploadAction()
4242
Mage::helper('catalog/image'), 'validateUploadFile');
4343
$uploader->setAllowRenameFiles(true);
4444
$uploader->setFilesDispersion(true);
45+
$uploader->addValidateCallback(
46+
Mage_Core_Model_File_Validator_Image::NAME,
47+
Mage::getModel('core/file_validator_image'),
48+
'validate'
49+
);
4550
$result = $uploader->save(
4651
Mage::getSingleton('catalog/product_media_config')->getBaseTmpMediaPath()
4752
);

‎app/code/core/Mage/Checkout/controllers/MultishippingController.php

+16
Original file line numberDiff line numberDiff line change
@@ -233,6 +233,12 @@ public function addressesPostAction()
233233
$this->_redirect('*/multishipping_address/newShipping');
234234
return;
235235
}
236+
237+
if ($this->isFormkeyValidationOnCheckoutEnabled() && !$this->_validateFormKey()) {
238+
$this->_redirect('*/*/addresses');
239+
return;
240+
}
241+
236242
try {
237243
if ($this->getRequest()->getParam('continue', false)) {
238244
$this->_getCheckout()->setCollectRatesFlag(true);
@@ -353,6 +359,11 @@ public function backToShippingAction()
353359
*/
354360
public function shippingPostAction()
355361
{
362+
if ($this->isFormkeyValidationOnCheckoutEnabled() && !$this->_validateFormKey()) {
363+
$this->_redirect('*/*/shipping');
364+
return;
365+
}
366+
356367
$shippingMethods = $this->getRequest()->getPost('shipping_method');
357368
try {
358369
Mage::dispatchEvent(
@@ -462,6 +473,11 @@ public function overviewAction()
462473
return $this;
463474
}
464475

476+
if ($this->isFormkeyValidationOnCheckoutEnabled() && !$this->_validateFormKey()) {
477+
$this->_redirect('*/*/billing');
478+
return;
479+
}
480+
465481
$this->_getState()->setActiveStep(Mage_Checkout_Model_Type_Multishipping_State::STEP_OVERVIEW);
466482

467483
try {

‎app/code/core/Mage/Checkout/controllers/OnepageController.php

+25
Original file line numberDiff line numberDiff line change
@@ -349,6 +349,11 @@ public function saveMethodAction()
349349
if ($this->_expireAjax()) {
350350
return;
351351
}
352+
353+
if ($this->isFormkeyValidationOnCheckoutEnabled() && !$this->_validateFormKey()) {
354+
return;
355+
}
356+
352357
if ($this->getRequest()->isPost()) {
353358
$method = $this->getRequest()->getPost('method');
354359
$result = $this->getOnepage()->saveCheckoutMethod($method);
@@ -364,6 +369,11 @@ public function saveBillingAction()
364369
if ($this->_expireAjax()) {
365370
return;
366371
}
372+
373+
if ($this->isFormkeyValidationOnCheckoutEnabled() && !$this->_validateFormKey()) {
374+
return;
375+
}
376+
367377
if ($this->getRequest()->isPost()) {
368378
$data = $this->getRequest()->getPost('billing', array());
369379
$customerAddressId = $this->getRequest()->getPost('billing_address_id', false);
@@ -406,6 +416,11 @@ public function saveShippingAction()
406416
if ($this->_expireAjax()) {
407417
return;
408418
}
419+
420+
if ($this->isFormkeyValidationOnCheckoutEnabled() && !$this->_validateFormKey()) {
421+
return;
422+
}
423+
409424
if ($this->getRequest()->isPost()) {
410425
$data = $this->getRequest()->getPost('shipping', array());
411426
$customerAddressId = $this->getRequest()->getPost('shipping_address_id', false);
@@ -430,6 +445,11 @@ public function saveShippingMethodAction()
430445
if ($this->_expireAjax()) {
431446
return;
432447
}
448+
449+
if ($this->isFormkeyValidationOnCheckoutEnabled() && !$this->_validateFormKey()) {
450+
return;
451+
}
452+
433453
if ($this->getRequest()->isPost()) {
434454
$data = $this->getRequest()->getPost('shipping_method', '');
435455
$result = $this->getOnepage()->saveShippingMethod($data);
@@ -464,6 +484,11 @@ public function savePaymentAction()
464484
if ($this->_expireAjax()) {
465485
return;
466486
}
487+
488+
if ($this->isFormkeyValidationOnCheckoutEnabled() && !$this->_validateFormKey()) {
489+
return;
490+
}
491+
467492
try {
468493
if (!$this->getRequest()->isPost()) {
469494
$this->_ajaxRedirectResponse();

‎app/code/core/Mage/Checkout/etc/system.xml

+18
Original file line numberDiff line numberDiff line change
@@ -232,5 +232,23 @@
232232
</payment_failed>
233233
</groups>
234234
</checkout>
235+
<admin>
236+
<groups>
237+
<security>
238+
<fields>
239+
<validate_formkey_checkout translate="label">
240+
<label>Enable Form Key Validation On Checkout</label>
241+
<frontend_type>select</frontend_type>
242+
<source_model>adminhtml/system_config_source_yesno</source_model>
243+
<sort_order>4</sort_order>
244+
<comment><![CDATA[<strong style="color:red">Important!</strong> Enabling this option means
245+
that your custom templates used in checkout process contain form_key output.
246+
Otherwise checkout may not work.]]></comment>
247+
<show_in_default>1</show_in_default>
248+
</validate_formkey_checkout>
249+
</fields>
250+
</security>
251+
</groups>
252+
</admin>
235253
</sections>
236254
</config>

‎app/code/core/Mage/Cms/Model/Wysiwyg/Images/Storage.php

+5
Original file line numberDiff line numberDiff line change
@@ -283,6 +283,11 @@ public function uploadFile($targetPath, $type = null)
283283
}
284284
$uploader->setAllowRenameFiles(true);
285285
$uploader->setFilesDispersion(false);
286+
$uploader->addValidateCallback(
287+
Mage_Core_Model_File_Validator_Image::NAME,
288+
Mage::getModel('core/file_validator_image'),
289+
'validate'
290+
);
286291
$result = $uploader->save($targetPath);
287292

288293
if (!$result) {

‎app/code/core/Mage/Core/Controller/Front/Action.php

+10
Original file line numberDiff line numberDiff line change
@@ -188,4 +188,14 @@ protected function _isFormKeyEnabled()
188188
{
189189
return Mage::getStoreConfigFlag(self::XML_CSRF_USE_FLAG_CONFIG_PATH);
190190
}
191+
192+
/**
193+
* Check if form_key validation enabled on checkout process
194+
*
195+
* @return bool
196+
*/
197+
protected function isFormkeyValidationOnCheckoutEnabled()
198+
{
199+
return Mage::getStoreConfigFlag('admin/security/validate_formkey_checkout');
200+
}
191201
}

‎app/code/core/Mage/Core/Controller/Request/Http.php

+4-1
Original file line numberDiff line numberDiff line change
@@ -148,7 +148,10 @@ public function setPathInfo($pathInfo = null)
148148
$baseUrl = $this->getBaseUrl();
149149
$pathInfo = substr($requestUri, strlen($baseUrl));
150150

151-
if ((null !== $baseUrl) && (false === $pathInfo)) {
151+
if ($baseUrl && $pathInfo && (0 !== stripos($pathInfo, '/'))) {
152+
$pathInfo = '';
153+
$this->setActionName('noRoute');
154+
} elseif ((null !== $baseUrl) && (false === $pathInfo)) {
152155
$pathInfo = '';
153156
} elseif (null === $baseUrl) {
154157
$pathInfo = $requestUri;

‎app/code/core/Mage/Core/Model/File/Validator/Image.php

+27-5
Original file line numberDiff line numberDiff line change
@@ -88,10 +88,33 @@ public function setAllowedImageTypes(array $imageFileExtensions = array())
8888
*/
8989
public function validate($filePath)
9090
{
91-
$fileInfo = getimagesize($filePath);
92-
if (is_array($fileInfo) and isset($fileInfo[2])) {
93-
if ($this->isImageType($fileInfo[2])) {
94-
return null;
91+
list($imageWidth, $imageHeight, $fileType) = getimagesize($filePath);
92+
if ($fileType) {
93+
if ($this->isImageType($fileType)) {
94+
//replace tmp image with re-sampled copy to exclude images with malicious data
95+
$image = imagecreatefromstring(file_get_contents($filePath));
96+
if ($image !== false) {
97+
$img = imagecreatetruecolor($imageWidth, $imageHeight);
98+
imagecopyresampled($img, $image, 0, 0, 0, 0, $imageWidth, $imageHeight, $imageWidth, $imageHeight);
99+
switch ($fileType) {
100+
case IMAGETYPE_GIF:
101+
imagegif($img, $filePath);
102+
break;
103+
case IMAGETYPE_JPEG:
104+
imagejpeg($img, $filePath, 100);
105+
break;
106+
case IMAGETYPE_PNG:
107+
imagepng($img, $filePath);
108+
break;
109+
default:
110+
return;
111+
}
112+
imagedestroy($img);
113+
imagedestroy($image);
114+
return null;
115+
} else {
116+
throw Mage::exception('Mage_Core', Mage::helper('core')->__('Invalid image.'));
117+
}
95118
}
96119
}
97120
throw Mage::exception('Mage_Core', Mage::helper('core')->__('Invalid MIME type.'));
@@ -106,5 +129,4 @@ protected function isImageType($nImageType)
106129
{
107130
return in_array($nImageType, $this->_allowedImageTypes);
108131
}
109-
110132
}

‎app/code/core/Mage/Core/etc/system.xml

-20
Original file line numberDiff line numberDiff line change
@@ -597,26 +597,6 @@
597597
</template_hints_blocks>
598598
</fields>
599599
</debug>
600-
<template translate="label">
601-
<label>Template Settings</label>
602-
<frontend_type>text</frontend_type>
603-
<sort_order>25</sort_order>
604-
<show_in_default>1</show_in_default>
605-
<show_in_website>1</show_in_website>
606-
<show_in_store>1</show_in_store>
607-
<fields>
608-
<allow_symlink translate="label comment">
609-
<label>Allow Symlinks</label>
610-
<frontend_type>select</frontend_type>
611-
<source_model>adminhtml/system_config_source_yesno</source_model>
612-
<sort_order>10</sort_order>
613-
<show_in_default>1</show_in_default>
614-
<show_in_website>1</show_in_website>
615-
<show_in_store>1</show_in_store>
616-
<comment>Warning! Enabling this feature is not recommended on production environments because it represents a potential security risk.</comment>
617-
</allow_symlink>
618-
</fields>
619-
</template>
620600
<translate_inline translate="label">
621601
<label>Translate Inline</label>
622602
<frontend_type>text</frontend_type>

0 commit comments

Comments
 (0)