Merge branch '2.4-develop' into static_properties_serialization_fix

README.md

@@ -1,10 +1,9 @@
 <p align="center">
-  <a href="https://magento.com">
-    <img src="https://static.magento.com/sites/all/themes/magento/logo.svg" width="300px" alt="Magento" />
-  </a>
-</p>
-<p align="center">
-    <br /><br />
+    <a href="https://magento.com">
+        <img src="https://static.magento.com/sites/all/themes/magento/logo.svg" width="300px" alt="Magento Commerce" />
+    </a>
+    <br />
+    <br />
     <a href="https://www.codetriage.com/magento/magento2">
         <img src="https://www.codetriage.com/magento/magento2/badges/users.svg" alt="Open Source Helpers" />
     </a>

app/code/Magento/AdminAnalytics/etc/csp_whitelist.xml

@@ -0,0 +1,17 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+-->
+<csp_whitelist xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+        xsi:noNamespaceSchemaLocation="urn:magento:module:Magento_Csp:etc/csp_whitelist.xsd">
+        <policies>
+            <policy id="script-src">
+                <values>
+                    <value id="adobedtm" type="host">assets.adobedtm.com</value>
+                </values>
+            </policy>
+        </policies>
+</csp_whitelist>

app/code/Magento/AdminAnalytics/view/adminhtml/templates/notification.phtml

@@ -4,13 +4,21 @@
  * Copyright © Magento, Inc. All rights reserved.
  * See COPYING.txt for license details.
  */
+
+/** @var \Magento\Framework\View\Helper\SecureHtmlRenderer $secureRenderer */
 ?>
 
-<script>
+<?php
+$isAnaliticsVisible = $block->getNotification()->isAnalyticsVisible() ? 1 : 0;
+$isReleaseVisible = $block->getNotification()->isReleaseVisible() ? 1 : 0;
+$scriptString = <<<script
     define('analyticsPopupConfig', function () {
         return {
-            analyticsVisible: <?= $block->getNotification()->isAnalyticsVisible() ? 1 : 0; ?>,
-            releaseVisible: <?= $block->getNotification()->isReleaseVisible() ? 1 : 0; ?>,
+            analyticsVisible: {$isAnaliticsVisible},
+            releaseVisible: {$isReleaseVisible},
         }
     });
-</script>
+script;
+?>
+
+<?= /* @noEscape */ $secureRenderer->renderTag('script', [], $scriptString, false); ?>

app/code/Magento/AdminAnalytics/view/adminhtml/templates/tracking.phtml

@@ -3,13 +3,28 @@
  * Copyright © Magento, Inc. All rights reserved.
  * See COPYING.txt for license details.
  */
+
+/**
+ * @var \Magento\Framework\View\Helper\SecureHtmlRenderer $secureRenderer
+ */
 ?>
 
-<script src="<?= $block->escapeUrl($block->getTrackingUrl()) ?>" async></script>
-<script>
+<?= /* @noEscape */ $secureRenderer->renderTag(
+    'script',
+    [
+        'src' => '"' . $block->escapeJs($block->getTrackingUrl()) .'"',
+        'async' => true,
+    ],
+    '&nbsp;',
+    false
+) ?>
+
+<?php $scriptString = '
     var adminAnalyticsMetadata = {
-        "version": "<?= $block->escapeJs($block->getMetadata()->getMagentoVersion()) ?>",
-        "user": "<?= $block->escapeJs($block->getMetadata()->getCurrentUser()) ?>",
-        "mode": "<?= $block->escapeJs($block->getMetadata()->getMode()) ?>"
+        "version": "' . $block->escapeJs($block->getMetadata()->getMagentoVersion()) . '",
+        "user": "' . $block->escapeJs($block->getMetadata()->getCurrentUser()) . '",
+        "mode": "' . $block->escapeJs($block->getMetadata()->getMode()) . '"
     };
-</script>
+';
+?>
+<?= /* @noEscape */ $secureRenderer->renderTag('script', [], $scriptString, false); ?>

app/code/Magento/AdminNotification/Block/System/Messages.php

@@ -26,7 +26,7 @@ class Messages extends Template
 
     /**
      * @var JsonDataHelper
-     * @deprecated
+     * @deprecated 100.3.0
      */
     protected $jsonHelper;
 

app/code/Magento/AdminNotification/Controller/Adminhtml/System/Message/ListAction.php

@@ -17,7 +17,7 @@ class ListAction extends \Magento\Backend\App\AbstractAction
 
     /**
      * @var \Magento\Framework\Json\Helper\Data
-     * @deprecated
+     * @deprecated 100.3.0
      */
     protected $jsonHelper;
 

app/code/Magento/AdminNotification/etc/csp_whitelist.xml

@@ -0,0 +1,18 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+-->
+<csp_whitelist xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+               xsi:noNamespaceSchemaLocation="urn:magento:module:Magento_Csp:etc/csp_whitelist.xsd">
+    <policies>
+        <policy id="img-src">
+            <values>
+                <value id="commerce_widgets" type="host">widgets.magentocommerce.com</value>
+            </values>
+        </policy>
+    </policies>
+</csp_whitelist>
+

app/code/Magento/AdminNotification/view/adminhtml/templates/notification/window.phtml

@@ -6,10 +6,10 @@
 
 /**
  * @see \Magento\AdminNotification\Block\Window
+ * @var \Magento\Framework\View\Helper\SecureHtmlRenderer $secureRenderer
  */
 ?>
 <ul class="message-system-list"
-    style="display: none;"
     data-mage-init='{
         "Magento_Ui/js/modal/modal": {
             "autoOpen": true,
@@ -25,3 +25,4 @@
         </a>
     </li>
 </ul>
+<?= /* @noEscape */ $secureRenderer->renderStyleAsTag('display:none', '.message-system-list'); ?>

app/code/Magento/AdminNotification/view/adminhtml/templates/system/messages/popup.phtml

@@ -5,18 +5,20 @@
  */
 
 /** @var $block \Magento\AdminNotification\Block\System\Messages\UnreadMessagePopup */
+/** @var \Magento\Framework\View\Helper\SecureHtmlRenderer $secureRenderer */
 ?>
 
-<div style="display:none" id="system_messages_list" data-role="system_messages_list"
+<div id="system_messages_list" data-role="system_messages_list"
      title="<?= $block->escapeHtmlAttr($block->getPopupTitle()) ?>">
     <ul class="message-system-list messages">
-        <?php foreach ($block->getUnreadMessages() as $message) : ?>
+        <?php foreach ($block->getUnreadMessages() as $message): ?>
             <li class="message message-warning <?= $block->escapeHtmlAttr($block->getItemClass($message)) ?>">
                 <?= $block->escapeHtml($message->getText()) ?>
             </li>
         <?php endforeach;?>
     </ul>
 </div>
+<?= /* @noEscape */ $secureRenderer->renderStyleAsTag('display:none', '#system_messages_list'); ?>
 
 <script type="text/x-magento-init">
     {

app/code/Magento/AdvancedPricingImportExport/Model/Export/AdvancedPricing.php

@@ -381,7 +381,7 @@ private function prepareExportData(
      * @param array $exportData
      * @return array
      * @SuppressWarnings(PHPMD.UnusedLocalVariable)
-     * @deprecated
+     * @deprecated 100.3.0
      * @see prepareExportData
      */
     protected function correctExportData($exportData)
@@ -510,7 +510,7 @@ private function fetchTierPrices(array $productIds): array
      * @return array|bool
      * @SuppressWarnings(PHPMD.NPathComplexity)
      * @SuppressWarnings(PHPMD.CyclomaticComplexity)
-     * @deprecated
+     * @deprecated 100.3.0
      * @see fetchTierPrices
      */
     protected function getTierPrices(array $listSku, $table)

app/code/Magento/AdvancedSearch/Model/Client/ClientResolver.php

@@ -20,7 +20,7 @@ class ClientResolver
      *
      * @var ScopeConfigInterface
      * @since 100.1.0
-     * @deprecated since it is not used anymore
+     * @deprecated 100.3.0 since it is not used anymore
      */
     protected $scopeConfig;
 
@@ -56,14 +56,14 @@ class ClientResolver
      *
      * @var string
      * @since 100.1.0
-     * @deprecated since it is not used anymore
+     * @deprecated 100.3.0 since it is not used anymore
      */
     protected $path;
 
     /**
      * Config Scope
      * @since 100.1.0
-     * @deprecated since it is not used anymore
+     * @deprecated 100.3.0 since it is not used anymore
      */
     protected $scope;
 

app/code/Magento/Analytics/Model/Connector/Http/ConverterInterface.php

@@ -9,30 +9,35 @@
  * Represents converter interface for http request and response body.
  *
  * @api
+ * @since 100.2.0
  */
 interface ConverterInterface
 {
     /**
      * @param string $body
      *
      * @return array
+     * @since 100.2.0
      */
     public function fromBody($body);
 
     /**
      * @param array $data
      *
      * @return string
+     * @since 100.2.0
      */
     public function toBody(array $data);
 
     /**
      * @return string
+     * @since 100.2.0
      */
     public function getContentTypeHeader();
 
     /**
      * @return string
+     * @since 100.3.0
      */
     public function getContentMediaType(): string;
 }

app/code/Magento/Analytics/Model/ReportWriter.php

@@ -3,14 +3,15 @@
  * Copyright © Magento, Inc. All rights reserved.
  * See COPYING.txt for license details.
  */
+declare(strict_types=1);
+
 namespace Magento\Analytics\Model;
 
 use Magento\Analytics\ReportXml\DB\ReportValidator;
 use Magento\Framework\Filesystem\Directory\WriteInterface;
 
 /**
  * Writes reports in files in csv format
- * @inheritdoc
  */
 class ReportWriter implements ReportWriterInterface
 {
@@ -54,7 +55,7 @@ public function __construct(
     }
 
     /**
-     * {@inheritdoc}
+     * @inheritdoc
      */
     public function write(WriteInterface $directory, $path)
     {
@@ -81,7 +82,7 @@ public function write(WriteInterface $directory, $path)
                     $headers = array_keys($row);
                     $stream->writeCsv($headers);
                 }
-                $stream->writeCsv($row);
+                $stream->writeCsv($this->prepareRow($row));
             }
             $stream->unlock();
             $stream->close();
@@ -98,4 +99,18 @@ public function write(WriteInterface $directory, $path)
 
         return true;
     }
+
+    /**
+     * Replace wrong symbols in row
+     *
+     * @param array $row
+     * @return array
+     */
+    private function prepareRow(array $row): array
+    {
+        $row = preg_replace('/(?<!\\\\)"/', '\\"', $row);
+        $row = preg_replace('/[\\\\]+/', '\\', $row);
+
+        return $row;
+    }
 }

app/code/Magento/Analytics/ReportXml/Query.php

@@ -81,7 +81,6 @@ public function getConfig()
      * @link http://php.net/manual/en/jsonserializable.jsonserialize.php
      * @return mixed data which can be serialized by <b>json_encode</b>,
      * which is a value of any type other than a resource.
-     * @since 5.4.0
      */
     public function jsonSerialize()
     {

app/code/Magento/Analytics/Test/Unit/Block/Adminhtml/System/Config/CollectionTimeLabelTest.php

@@ -59,7 +59,7 @@ class CollectionTimeLabelTest extends TestCase
     protected function setUp(): void
     {
         $this->abstractElementMock = $this->getMockBuilder(AbstractElement::class)
-            ->setMethods(['getComment'])
+            ->setMethods(['getComment', 'getElementHtml'])
             ->disableOriginalConstructor()
             ->getMock();
 

app/code/Magento/Analytics/Test/Unit/Block/Adminhtml/System/Config/SubscriptionStatusLabelTest.php

@@ -49,7 +49,7 @@ protected function setUp(): void
         $this->subscriptionStatusProviderMock = $this->createMock(SubscriptionStatusProvider::class);
         $this->contextMock = $this->createMock(Context::class);
         $this->abstractElementMock = $this->getMockBuilder(AbstractElement::class)
-            ->setMethods(['getComment'])
+            ->setMethods(['getComment', 'getElementHtml'])
             ->disableOriginalConstructor()
             ->getMock();
 

app/code/Magento/Analytics/Test/Unit/Block/Adminhtml/System/Config/VerticalTest.php

@@ -41,7 +41,7 @@ class VerticalTest extends TestCase
     protected function setUp(): void
     {
         $this->abstractElementMock = $this->getMockBuilder(AbstractElement::class)
-            ->setMethods(['getComment', 'getLabel', 'getHint'])
+            ->setMethods(['getComment', 'getLabel', 'getHint', 'getElementHtml'])
             ->disableOriginalConstructor()
             ->getMock();