Skip to content

Commit 40720ca

Browse files
drobinsondrobinson
committed
Import Magento Release 1.9.3.6
1 parent 5dde5ee commit 40720ca

File tree

68 files changed

+1785
-207
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

68 files changed

+1785
-207
lines changed

‎RELEASE_NOTES.txt

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,23 @@
1+
==== 1.9.3.6 ====
2+
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
3+
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
4+
] NOTE: Current Release Notes are maintained at: [
5+
] [
6+
] http://devdocs.magento.com/guides/m1x/ce19-ee114/ce1.9_release-notes.html [
7+
] [
8+
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
9+
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
10+
11+
==== 1.9.3.5 ====
12+
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
13+
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
14+
] NOTE: Current Release Notes are maintained at: [
15+
] [
16+
] http://devdocs.magento.com/guides/m1x/ce19-ee114/ce1.9_release-notes.html [
17+
] [
18+
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
19+
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
20+
121
==== 1.9.3.4 ====
222
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
323
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

‎app/Mage.php

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -171,7 +171,7 @@ public static function getVersionInfo()
171171
'major' => '1',
172172
'minor' => '9',
173173
'revision' => '3',
174-
'patch' => '4',
174+
'patch' => '6',
175175
'stability' => '',
176176
'number' => '',
177177
);

‎app/code/core/Mage/Admin/Model/Session.php

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -76,6 +76,7 @@ public function __construct($parameters = array())
7676
$parameters['factory'] : Mage::getModel('core/factory');
7777

7878
$this->init('admin');
79+
$this->logoutIndirect();
7980
}
8081

8182
/**
@@ -98,6 +99,21 @@ public function init($namespace, $sessionName = null)
9899
return $this;
99100
}
100101

102+
/**
103+
* Logout user if was logged not from admin
104+
*/
105+
protected function logoutIndirect()
106+
{
107+
$user = $this->getUser();
108+
if ($user) {
109+
$extraData = $user->getExtra();
110+
if (isset($extraData['indirect_login']) && $this->getIndirectLogin()) {
111+
$this->unsetData('user');
112+
$this->setIndirectLogin(false);
113+
}
114+
}
115+
}
116+
101117
/**
102118
* Try to login user in admin
103119
*

‎app/code/core/Mage/Adminhtml/Block/Notification/Grid/Renderer/Notice.php

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -43,7 +43,7 @@ class Mage_Adminhtml_Block_Notification_Grid_Renderer_Notice
4343
*/
4444
public function render(Varien_Object $row)
4545
{
46-
return '<span class="grid-row-title">' . $row->getTitle() . '</span>'
47-
. ($row->getDescription() ? '<br />' . $row->getDescription() : '');
46+
return '<span class="grid-row-title">' . $this->escapeHtml($row->getTitle()) . '</span>'
47+
. ($row->getDescription() ? '<br />' . $this->escapeHtml($row->getDescription()) : '');
4848
}
4949
}

‎app/code/core/Mage/Adminhtml/Block/Widget/Form/Container.php

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -108,7 +108,10 @@ public function getBackUrl()
108108

109109
public function getDeleteUrl()
110110
{
111-
return $this->getUrl('*/*/delete', array($this->_objectId => $this->getRequest()->getParam($this->_objectId)));
111+
return $this->getUrl('*/*/delete', array(
112+
$this->_objectId => $this->getRequest()->getParam($this->_objectId),
113+
Mage_Core_Model_Url::FORM_KEY => $this->getFormKey()
114+
));
112115
}
113116

114117
/**

‎app/code/core/Mage/Adminhtml/Controller/Action.php

Lines changed: 34 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -50,6 +50,13 @@ class Mage_Adminhtml_Controller_Action extends Mage_Core_Controller_Varien_Actio
5050
*/
5151
protected $_publicActions = array();
5252

53+
/**
54+
*Array of actions which can't be processed without form key validation
55+
*
56+
* @var array
57+
*/
58+
protected $_forcedFormKeyActions = array();
59+
5360
/**
5461
* Used module name in current adminhtml controller
5562
*/
@@ -162,7 +169,7 @@ public function preDispatch()
162169
$_isValidSecretKey = true;
163170
$_keyErrorMsg = '';
164171
if (Mage::getSingleton('admin/session')->isLoggedIn()) {
165-
if ($this->getRequest()->isPost()) {
172+
if ($this->getRequest()->isPost() || $this->_checkIsForcedFormKeyAction()) {
166173
$_isValidFormKey = $this->_validateFormKey();
167174
$_keyErrorMsg = Mage::helper('adminhtml')->__('Invalid Form Key. Please refresh the page.');
168175
} elseif (Mage::getSingleton('adminhtml/url')->useSecretKey()) {
@@ -179,6 +186,9 @@ public function preDispatch()
179186
'message' => $_keyErrorMsg
180187
)));
181188
} else {
189+
if ($_keyErrorMsg != ''){
190+
Mage::getSingleton('adminhtml/session')->addError($_keyErrorMsg);
191+
}
182192
$this->_redirect( Mage::getSingleton('admin/session')->getUser()->getStartupPageUrl() );
183193
}
184194
return $this;
@@ -397,4 +407,27 @@ protected function _validateCurrentPassword($password)
397407
$user = Mage::getSingleton('admin/session')->getUser();
398408
return $user->validateCurrentPassword($password);
399409
}
410+
411+
/**
412+
* Check forced use form key for action
413+
*
414+
* @return bool
415+
*/
416+
protected function _checkIsForcedFormKeyAction()
417+
{
418+
return in_array($this->getRequest()->getActionName(), $this->_forcedFormKeyActions);
419+
}
420+
421+
/**
422+
* Set actions name for forced use form key
423+
*
424+
* @param array | string $actionNames - action names for forced use form key
425+
*/
426+
protected function _setForcedFormKeyActions($actionNames)
427+
{
428+
$actionNames = (is_array($actionNames)) ? $actionNames: (array)$actionNames;
429+
$actionNames = array_merge($this->_forcedFormKeyActions, $actionNames);
430+
$actionNames = array_unique($actionNames);
431+
$this->_forcedFormKeyActions = $actionNames;
432+
}
400433
}

‎app/code/core/Mage/Adminhtml/Model/LayoutUpdate/Validator.php

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -37,6 +37,7 @@
3737
class Mage_Adminhtml_Model_LayoutUpdate_Validator extends Zend_Validate_Abstract
3838
{
3939
const XML_INVALID = 'invalidXml';
40+
const INVALID_TEMPLATE_PATH = 'invalidTemplatePath';
4041
const PROTECTED_ATTR_HELPER_IN_TAG_ACTION_VAR = 'protectedAttrHelperInActionVar';
4142

4243
/**
@@ -75,6 +76,9 @@ protected function _initMessageTemplates()
7576
self::PROTECTED_ATTR_HELPER_IN_TAG_ACTION_VAR =>
7677
Mage::helper('adminhtml')->__('Helper attributes should not be used in custom layout updates.'),
7778
self::XML_INVALID => Mage::helper('adminhtml')->__('XML data is invalid.'),
79+
self::INVALID_TEMPLATE_PATH => Mage::helper('adminhtml')->__(
80+
'Invalid template path used in layout update.'
81+
),
7882
);
7983
}
8084
return $this;
@@ -109,6 +113,15 @@ public function isValid($value)
109113
Mage::helper('adminhtml')->__('XML object is not instance of "Varien_Simplexml_Element".'));
110114
}
111115

116+
// if layout update declare custom templates then validate their paths
117+
if ($templatePaths = $value->xpath('*//template | *//@template | //*[@method=\'setTemplate\']/*')) {
118+
try {
119+
$this->_validateTemplatePath($templatePaths);
120+
} catch (Exception $e) {
121+
$this->_error(self::INVALID_TEMPLATE_PATH);
122+
return false;
123+
}
124+
}
112125
$this->_setValue($value);
113126

114127
foreach ($this->_protectedExpressions as $key => $xpr) {
@@ -119,4 +132,19 @@ public function isValid($value)
119132
}
120133
return true;
121134
}
135+
136+
/**
137+
* Validate template path for preventing access to the directory above
138+
* If template path value has "../" @throws Exception
139+
*
140+
* @param $templatePaths | array
141+
*/
142+
protected function _validateTemplatePath(array $templatePaths)
143+
{
144+
foreach ($templatePaths as $path) {
145+
if (strpos($path, '../') !== false) {
146+
throw new Exception();
147+
}
148+
}
149+
}
122150
}

‎app/code/core/Mage/Adminhtml/controllers/CustomerController.php

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -33,6 +33,16 @@
3333
*/
3434
class Mage_Adminhtml_CustomerController extends Mage_Adminhtml_Controller_Action
3535
{
36+
/**
37+
* Controller predispatch method
38+
*
39+
* @return Mage_Adminhtml_Controller_Action
40+
*/
41+
public function preDispatch()
42+
{
43+
$this->_setForcedFormKeyActions('delete');
44+
return parent::preDispatch();
45+
}
3646

3747
protected function _initCustomer($idFieldName = 'id')
3848
{

‎app/code/core/Mage/Adminhtml/controllers/Newsletter/QueueController.php

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -63,6 +63,10 @@ public function indexAction()
6363
*/
6464
public function dropAction ()
6565
{
66+
$request = $this->getRequest();
67+
if ($request->getParam('text') && !$request->getPost('text')) {
68+
$this->getResponse()->setRedirect($this->getUrl('*/newsletter_queue'));
69+
}
6670
$this->loadLayout('newsletter_queue_preview');
6771
$this->renderLayout();
6872
}

‎app/code/core/Mage/Adminhtml/controllers/Newsletter/TemplateController.php

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -142,6 +142,10 @@ public function editAction ()
142142
*/
143143
public function dropAction ()
144144
{
145+
$request = $this->getRequest();
146+
if ($request->getParam('text') && !$request->getPost('text')) {
147+
$this->getResponse()->setRedirect($this->getUrl('*/newsletter_template'));
148+
}
145149
$this->loadLayout('newsletter_template_preview');
146150
$this->renderLayout();
147151
}

0 commit comments

Comments
 (0)