Skip to content

Commit 40720ca

Browse files
drobinsondrobinson
committed
Import Magento Release 1.9.3.6
1 parent 5dde5ee commit 40720ca

File tree

68 files changed

+1785
-207
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

68 files changed

+1785
-207
lines changed

‎RELEASE_NOTES.txt

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,23 @@
1+
==== 1.9.3.6 ====
2+
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
3+
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
4+
] NOTE: Current Release Notes are maintained at: [
5+
] [
6+
] http://devdocs.magento.com/guides/m1x/ce19-ee114/ce1.9_release-notes.html [
7+
] [
8+
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
9+
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
10+
11+
==== 1.9.3.5 ====
12+
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
13+
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
14+
] NOTE: Current Release Notes are maintained at: [
15+
] [
16+
] http://devdocs.magento.com/guides/m1x/ce19-ee114/ce1.9_release-notes.html [
17+
] [
18+
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
19+
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
20+
121
==== 1.9.3.4 ====
222
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
323
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

‎app/Mage.php

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -171,7 +171,7 @@ public static function getVersionInfo()
171171
'major' => '1',
172172
'minor' => '9',
173173
'revision' => '3',
174-
'patch' => '4',
174+
'patch' => '6',
175175
'stability' => '',
176176
'number' => '',
177177
);

‎app/code/core/Mage/Admin/Model/Session.php

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -76,6 +76,7 @@ public function __construct($parameters = array())
7676
$parameters['factory'] : Mage::getModel('core/factory');
7777

7878
$this->init('admin');
79+
$this->logoutIndirect();
7980
}
8081

8182
/**
@@ -98,6 +99,21 @@ public function init($namespace, $sessionName = null)
9899
return $this;
99100
}
100101

102+
/**
103+
* Logout user if was logged not from admin
104+
*/
105+
protected function logoutIndirect()
106+
{
107+
$user = $this->getUser();
108+
if ($user) {
109+
$extraData = $user->getExtra();
110+
if (isset($extraData['indirect_login']) && $this->getIndirectLogin()) {
111+
$this->unsetData('user');
112+
$this->setIndirectLogin(false);
113+
}
114+
}
115+
}
116+
101117
/**
102118
* Try to login user in admin
103119
*

‎app/code/core/Mage/Adminhtml/Block/Notification/Grid/Renderer/Notice.php

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -43,7 +43,7 @@ class Mage_Adminhtml_Block_Notification_Grid_Renderer_Notice
4343
*/
4444
public function render(Varien_Object $row)
4545
{
46-
return '<span class="grid-row-title">' . $row->getTitle() . '</span>'
47-
. ($row->getDescription() ? '<br />' . $row->getDescription() : '');
46+
return '<span class="grid-row-title">' . $this->escapeHtml($row->getTitle()) . '</span>'
47+
. ($row->getDescription() ? '<br />' . $this->escapeHtml($row->getDescription()) : '');
4848
}
4949
}

‎app/code/core/Mage/Adminhtml/Block/Widget/Form/Container.php

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -108,7 +108,10 @@ public function getBackUrl()
108108

109109
public function getDeleteUrl()
110110
{
111-
return $this->getUrl('*/*/delete', array($this->_objectId => $this->getRequest()->getParam($this->_objectId)));
111+
return $this->getUrl('*/*/delete', array(
112+
$this->_objectId => $this->getRequest()->getParam($this->_objectId),
113+
Mage_Core_Model_Url::FORM_KEY => $this->getFormKey()
114+
));
112115
}
113116

114117
/**

‎app/code/core/Mage/Adminhtml/Controller/Action.php

Lines changed: 34 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -50,6 +50,13 @@ class Mage_Adminhtml_Controller_Action extends Mage_Core_Controller_Varien_Actio
5050
*/
5151
protected $_publicActions = array();
5252

53+
/**
54+
*Array of actions which can't be processed without form key validation
55+
*
56+
* @var array
57+
*/
58+
protected $_forcedFormKeyActions = array();
59+
5360
/**
5461
* Used module name in current adminhtml controller
5562
*/
@@ -162,7 +169,7 @@ public function preDispatch()
162169
$_isValidSecretKey = true;
163170
$_keyErrorMsg = '';
164171
if (Mage::getSingleton('admin/session')->isLoggedIn()) {
165-
if ($this->getRequest()->isPost()) {
172+
if ($this->getRequest()->isPost() || $this->_checkIsForcedFormKeyAction()) {
166173
$_isValidFormKey = $this->_validateFormKey();
167174
$_keyErrorMsg = Mage::helper('adminhtml')->__('Invalid Form Key. Please refresh the page.');
168175
} elseif (Mage::getSingleton('adminhtml/url')->useSecretKey()) {
@@ -179,6 +186,9 @@ public function preDispatch()
179186
'message' => $_keyErrorMsg
180187
)));
181188
} else {
189+
if ($_keyErrorMsg != ''){
190+
Mage::getSingleton('adminhtml/session')->addError($_keyErrorMsg);
191+
}
182192
$this->_redirect( Mage::getSingleton('admin/session')->getUser()->getStartupPageUrl() );
183193
}
184194
return $this;
@@ -397,4 +407,27 @@ protected function _validateCurrentPassword($password)
397407
$user = Mage::getSingleton('admin/session')->getUser();
398408
return $user->validateCurrentPassword($password);
399409
}
410+
411+
/**
412+
* Check forced use form key for action
413+
*
414+
* @return bool
415+
*/
416+
protected function _checkIsForcedFormKeyAction()
417+
{
418+
return in_array($this->getRequest()->getActionName(), $this->_forcedFormKeyActions);
419+
}
420+
421+
/**
422+
* Set actions name for forced use form key
423+
*
424+
* @param array | string $actionNames - action names for forced use form key
425+
*/
426+
protected function _setForcedFormKeyActions($actionNames)
427+
{
428+
$actionNames = (is_array($actionNames)) ? $actionNames: (array)$actionNames;
429+
$actionNames = array_merge($this->_forcedFormKeyActions, $actionNames);
430+
$actionNames = array_unique($actionNames);
431+
$this->_forcedFormKeyActions = $actionNames;
432+
}
400433
}

‎app/code/core/Mage/Adminhtml/Model/LayoutUpdate/Validator.php

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -37,6 +37,7 @@
3737
class Mage_Adminhtml_Model_LayoutUpdate_Validator extends Zend_Validate_Abstract
3838
{
3939
const XML_INVALID = 'invalidXml';
40+
const INVALID_TEMPLATE_PATH = 'invalidTemplatePath';
4041
const PROTECTED_ATTR_HELPER_IN_TAG_ACTION_VAR = 'protectedAttrHelperInActionVar';
4142

4243
/**
@@ -75,6 +76,9 @@ protected function _initMessageTemplates()
7576
self::PROTECTED_ATTR_HELPER_IN_TAG_ACTION_VAR =>
7677
Mage::helper('adminhtml')->__('Helper attributes should not be used in custom layout updates.'),
7778
self::XML_INVALID => Mage::helper('adminhtml')->__('XML data is invalid.'),
79+
self::INVALID_TEMPLATE_PATH => Mage::helper('adminhtml')->__(
80+
'Invalid template path used in layout update.'
81+
),
7882
);
7983
}
8084
return $this;
@@ -109,6 +113,15 @@ public function isValid($value)
109113
Mage::helper('adminhtml')->__('XML object is not instance of "Varien_Simplexml_Element".'));
110114
}
111115

116+
// if layout update declare custom templates then validate their paths
117+
if ($templatePaths = $value->xpath('*//template | *//@template | //*[@method=\'setTemplate\']/*')) {
118+
try {
119+
$this->_validateTemplatePath($templatePaths);
120+
} catch (Exception $e) {
121+
$this->_error(self::INVALID_TEMPLATE_PATH);
122+
return false;
123+
}
124+
}
112125
$this->_setValue($value);
113126

114127
foreach ($this->_protectedExpressions as $key => $xpr) {
@@ -119,4 +132,19 @@ public function isValid($value)
119132
}
120133
return true;
121134
}
135+
136+
/**
137+
* Validate template path for preventing access to the directory above
138+
* If template path value has "../" @throws Exception
139+
*
140+
* @param $templatePaths | array
141+
*/
142+
protected function _validateTemplatePath(array $templatePaths)
143+
{
144+
foreach ($templatePaths as $path) {
145+
if (strpos($path, '../') !== false) {
146+
throw new Exception();
147+
}
148+
}
149+
}
122150
}

‎app/code/core/Mage/Adminhtml/controllers/CustomerController.php

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -33,6 +33,16 @@
3333
*/
3434
class Mage_Adminhtml_CustomerController extends Mage_Adminhtml_Controller_Action
3535
{
36+
/**
37+
* Controller predispatch method
38+
*
39+
* @return Mage_Adminhtml_Controller_Action
40+
*/
41+
public function preDispatch()
42+
{
43+
$this->_setForcedFormKeyActions('delete');
44+
return parent::preDispatch();
45+
}
3646

3747
protected function _initCustomer($idFieldName = 'id')
3848
{

‎app/code/core/Mage/Adminhtml/controllers/Newsletter/QueueController.php

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -63,6 +63,10 @@ public function indexAction()
6363
*/
6464
public function dropAction ()
6565
{
66+
$request = $this->getRequest();
67+
if ($request->getParam('text') && !$request->getPost('text')) {
68+
$this->getResponse()->setRedirect($this->getUrl('*/newsletter_queue'));
69+
}
6670
$this->loadLayout('newsletter_queue_preview');
6771
$this->renderLayout();
6872
}

‎app/code/core/Mage/Adminhtml/controllers/Newsletter/TemplateController.php

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -142,6 +142,10 @@ public function editAction ()
142142
*/
143143
public function dropAction ()
144144
{
145+
$request = $this->getRequest();
146+
if ($request->getParam('text') && !$request->getPost('text')) {
147+
$this->getResponse()->setRedirect($this->getUrl('*/newsletter_template'));
148+
}
145149
$this->loadLayout('newsletter_template_preview');
146150
$this->renderLayout();
147151
}

‎app/code/core/Mage/Checkout/controllers/CartController.php

Lines changed: 13 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -284,14 +284,16 @@ public function addAction()
284284
public function addgroupAction()
285285
{
286286
$orderItemIds = $this->getRequest()->getParam('order_items', array());
287+
$customerId = $this->_getCustomerSession()->getCustomerId();
287288

288-
if (!is_array($orderItemIds) || !$this->_validateFormKey()) {
289+
if (!is_array($orderItemIds) || !$this->_validateFormKey() || !$customerId) {
289290
$this->_goBack();
290291
return;
291292
}
292293

293294
$itemsCollection = Mage::getModel('sales/order_item')
294295
->getCollection()
296+
->addFilterByCustomerId($customerId)
295297
->addIdFilter($orderItemIds)
296298
->load();
297299
/* @var $itemsCollection Mage_Sales_Model_Mysql4_Order_Item_Collection */
@@ -709,4 +711,14 @@ public function ajaxUpdateAction()
709711
$this->getResponse()->setHeader('Content-type', 'application/json');
710712
$this->getResponse()->setBody(Mage::helper('core')->jsonEncode($result));
711713
}
714+
715+
/**
716+
* Get customer session model
717+
*
718+
* @return Mage_Customer_Model_Session
719+
*/
720+
protected function _getCustomerSession()
721+
{
722+
return Mage::getSingleton('customer/session');
723+
}
712724
}

‎app/code/core/Mage/Core/Model/Email/Template/Abstract.php

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -235,8 +235,11 @@ protected function _getCssFileContent($filename)
235235
'_theme' => $theme,
236236
)
237237
);
238+
$filePath = realpath($filePath);
239+
$positionSkinDirectory = strpos($filePath, Mage::getBaseDir('skin'));
240+
$validator = new Zend_Validate_File_Extension('css');
238241

239-
if (is_readable($filePath)) {
242+
if ($validator->isValid($filePath) && $positionSkinDirectory !== false && is_readable($filePath)) {
240243
return (string) file_get_contents($filePath);
241244
}
242245

‎app/code/core/Mage/Core/Model/File/Validator/Image.php

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -91,6 +91,13 @@ public function validate($filePath)
9191
list($imageWidth, $imageHeight, $fileType) = getimagesize($filePath);
9292
if ($fileType) {
9393
if ($this->isImageType($fileType)) {
94+
/**
95+
* if 'general/reprocess_images/active' false then skip image reprocessing.
96+
* NOTE: If you turn off images reprocessing, then your upload images process may cause security risks.
97+
*/
98+
if (!Mage::getStoreConfigFlag('general/reprocess_images/active')) {
99+
return null;
100+
}
94101
//replace tmp image with re-sampled copy to exclude images with malicious data
95102
$image = imagecreatefromstring(file_get_contents($filePath));
96103
if ($image !== false) {

‎app/code/core/Mage/Core/Model/Session/Abstract/Varien.php

Lines changed: 18 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -136,19 +136,24 @@ public function start($sessionName=null)
136136
if (Mage::app()->getFrontController()->getRequest()->isSecure() && empty($cookieParams['secure'])) {
137137
// secure cookie check to prevent MITM attack
138138
$secureCookieName = $sessionName . '_cid';
139-
if (isset($_SESSION[self::SECURE_COOKIE_CHECK_KEY])
140-
&& $_SESSION[self::SECURE_COOKIE_CHECK_KEY] !== md5($cookie->get($secureCookieName))
141-
) {
142-
session_regenerate_id(false);
143-
$sessionHosts = $this->getSessionHosts();
144-
$currentCookieDomain = $cookie->getDomain();
145-
foreach (array_keys($sessionHosts) as $host) {
146-
// Delete cookies with the same name for parent domains
147-
if (strpos($currentCookieDomain, $host) > 0) {
148-
$cookie->delete($this->getSessionName(), null, $host);
139+
if (isset($_SESSION[self::SECURE_COOKIE_CHECK_KEY])) {
140+
if ($_SESSION[self::SECURE_COOKIE_CHECK_KEY] !== md5($cookie->get($secureCookieName))) {
141+
session_regenerate_id(false);
142+
$sessionHosts = $this->getSessionHosts();
143+
$currentCookieDomain = $cookie->getDomain();
144+
foreach (array_keys($sessionHosts) as $host) {
145+
// Delete cookies with the same name for parent domains
146+
if (strpos($currentCookieDomain, $host) > 0) {
147+
$cookie->delete($this->getSessionName(), null, $host);
148+
}
149149
}
150+
$_SESSION = array();
151+
} else {
152+
/**
153+
* Renew secure cookie expiration time if secure id did not change
154+
*/
155+
$cookie->renew($secureCookieName, null, null, null, true, null);
150156
}
151-
$_SESSION = array();
152157
}
153158
if (!isset($_SESSION[self::SECURE_COOKIE_CHECK_KEY])) {
154159
$checkId = Mage::helper('core')->getRandomString(16);
@@ -158,8 +163,8 @@ public function start($sessionName=null)
158163
}
159164

160165
/**
161-
* Renew cookie expiration time if session id did not change
162-
*/
166+
* Renew cookie expiration time if session id did not change
167+
*/
163168
if ($cookie->get(session_name()) == $this->getSessionId()) {
164169
$cookie->renew(session_name());
165170
}

‎app/code/core/Mage/Core/etc/config.xml

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -467,6 +467,9 @@
467467
</protected>
468468
</public_files_valid_paths>
469469
</file>
470+
<reprocess_images>
471+
<active>1</active>
472+
</reprocess_images>
470473
</general>
471474
</default>
472475
<stores>

‎app/code/core/Mage/Rss/Helper/Data.php

Lines changed: 10 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -74,14 +74,23 @@ public function authFrontend()
7474
*/
7575
public function authAdmin($path)
7676
{
77-
if (!$this->_rssSession->isAdminLoggedIn()) {
77+
if (!$this->_rssSession->isAdminLoggedIn() || !$this->_adminSession->isLoggedIn()) {
7878
list($username, $password) = $this->authValidate();
7979
Mage::getSingleton('adminhtml/url')->setNoSecret(true);
8080
$user = $this->_adminSession->login($username, $password);
8181
} else {
8282
$user = $this->_rssSession->getAdmin();
8383
}
8484
if ($user && $user->getId() && $user->getIsActive() == '1' && $this->_adminSession->isAllowed($path)) {
85+
$adminUserExtra = $user->getExtra();
86+
if ($adminUserExtra && !is_array($adminUserExtra)) {
87+
$adminUserExtra = Mage::helper('core/unserializeArray')->unserialize($user->getExtra());
88+
}
89+
if (!isset($adminUserExtra['indirect_login'])) {
90+
$adminUserExtra = array_merge($adminUserExtra, array('indirect_login' => true));
91+
$user->saveExtra($adminUserExtra);
92+
}
93+
$this->_adminSession->setIndirectLogin(true);
8594
$this->_rssSession->setAdmin($user);
8695
} else {
8796
$this->authFailed();

0 commit comments

Comments
 (0)