Skip to content

Commit cfd5f0e

Browse files
author
Momotenko,Natalia(nmomotenko)
committed
Merge pull request #323 from magento-sparta/MDVA-57_SECURITY_BUNDLE
[SUPPORT] Merchant Beta Security Bundle (MDVA-57)
2 parents 9bc1996 + 33bf8fc commit cfd5f0e

File tree

85 files changed

+1906
-510
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

85 files changed

+1906
-510
lines changed

‎CHANGELOG.md

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,25 @@
1+
1.0.0-beta10
2+
=============
3+
* Fixed bugs:
4+
* Fixed an issue with accessing to admin login form through unsecure url, when secure urls are enabled
5+
* Fixed an issue with possibility to make CSRF attack through GET requests
6+
* Fixed an issue with possibility to make XSS attack to the backend
7+
* Fixed an issue where possible edit someone else customer addresses
8+
* Fixed an issue where possible view order details for certain orders
9+
* Fixed an issue where XSS Payload could been saved into Admin Panel
10+
* Fixed an issue where CSRF token is not generated on some admin pages
11+
* Fixed an issue with ability to inject XSS into orders
12+
* Fixed an issue with ability to inject XSS through the some payment methods
13+
* Fixed an issue with abilitu to inject XSS into some headers
14+
* Removed a CSRF vulnerability in checkout
15+
* Fixed a security issue on user account page
16+
* Fixed an issue with upload empty file to custom option
17+
* Fixed an issue where possible edit someone else reviews
18+
* Fixed a potential security issue with frontend captcha
19+
* Fixed a potential vulnerability where possible insert SQL injection
20+
* Fixed an issue with BaseURL in static files
21+
* USPS January 17, 2016 API Changes
22+
123
1.0.0-beta9
224
=============
325
* Fixed bugs:

‎app/code/Magento/Backend/App/Action/Plugin/Authentication.php

Lines changed: 21 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -63,6 +63,11 @@ class Authentication
6363
*/
6464
protected $resultRedirectFactory;
6565

66+
/**
67+
* @var \Magento\Framework\Data\Form\FormKey\Validator
68+
*/
69+
protected $formKeyValidator;
70+
6671
/**
6772
* @param \Magento\Backend\Model\Auth $auth
6873
* @param \Magento\Backend\Model\UrlInterface $url
@@ -72,6 +77,7 @@ class Authentication
7277
* @param \Magento\Backend\Model\UrlInterface $backendUrl
7378
* @param \Magento\Framework\Controller\Result\RedirectFactory $resultRedirectFactory
7479
* @param \Magento\Backend\App\BackendAppList $backendAppList
80+
* @param \Magento\Framework\Data\Form\FormKey\Validator $formKeyValidator
7581
*/
7682
public function __construct(
7783
\Magento\Backend\Model\Auth $auth,
@@ -81,7 +87,8 @@ public function __construct(
8187
\Magento\Framework\Message\ManagerInterface $messageManager,
8288
\Magento\Backend\Model\UrlInterface $backendUrl,
8389
\Magento\Framework\Controller\Result\RedirectFactory $resultRedirectFactory,
84-
\Magento\Backend\App\BackendAppList $backendAppList
90+
\Magento\Backend\App\BackendAppList $backendAppList,
91+
\Magento\Framework\Data\Form\FormKey\Validator $formKeyValidator
8592
) {
8693
$this->_auth = $auth;
8794
$this->_url = $url;
@@ -91,11 +98,12 @@ public function __construct(
9198
$this->backendUrl = $backendUrl;
9299
$this->resultRedirectFactory = $resultRedirectFactory;
93100
$this->backendAppList = $backendAppList;
101+
$this->formKeyValidator = $formKeyValidator;
94102
}
95103

96104
/**
97105
* @param \Magento\Backend\App\AbstractAction $subject
98-
* @param callable $proceed
106+
* @param \Closure $proceed
99107
* @param \Magento\Framework\App\RequestInterface $request
100108
*
101109
* @return mixed
@@ -144,8 +152,17 @@ public function aroundDispatch(
144152
protected function _processNotLoggedInUser(\Magento\Framework\App\RequestInterface $request)
145153
{
146154
$isRedirectNeeded = false;
147-
if ($request->getPost('login') && $this->_performLogin($request)) {
148-
$isRedirectNeeded = $this->_redirectIfNeededAfterLogin($request);
155+
if ($request->getPost('login')) {
156+
if ($this->formKeyValidator->validate($request)) {
157+
if ($this->_performLogin($request)) {
158+
$isRedirectNeeded = $this->_redirectIfNeededAfterLogin($request);
159+
}
160+
} else {
161+
$this->_actionFlag->set('', \Magento\Framework\App\ActionInterface::FLAG_NO_DISPATCH, true);
162+
$this->_response->setRedirect($this->_url->getCurrentUrl());
163+
$this->messageManager->addError(__('Invalid Form Key. Please refresh the page.'));
164+
$isRedirectNeeded = true;
165+
}
149166
}
150167
if (!$isRedirectNeeded && !$request->isForwarded()) {
151168
if ($request->getParam('isIframe')) {

‎app/code/Magento/Backend/App/Router.php

Lines changed: 0 additions & 96 deletions
Original file line numberDiff line numberDiff line change
@@ -10,21 +10,11 @@
1010

1111
class Router extends \Magento\Framework\App\Router\Base
1212
{
13-
/**
14-
* @var \Magento\Backend\App\ConfigInterface
15-
*/
16-
protected $_backendConfig;
17-
1813
/**
1914
* @var \Magento\Framework\UrlInterface $url
2015
*/
2116
protected $_url;
2217

23-
/**
24-
* @var \Magento\Framework\App\Config\ScopeConfigInterface
25-
*/
26-
protected $_coreConfig;
27-
2818
/**
2919
* List of required request parameters
3020
* Order sensitive
@@ -46,92 +36,6 @@ class Router extends \Magento\Framework\App\Router\Base
4636
*/
4737
protected $pathPrefix = \Magento\Backend\App\Area\FrontNameResolver::AREA_CODE;
4838

49-
/**
50-
* @param \Magento\Framework\App\Router\ActionList $actionList
51-
* @param \Magento\Framework\App\ActionFactory $actionFactory
52-
* @param \Magento\Framework\App\DefaultPathInterface $defaultPath
53-
* @param \Magento\Framework\App\ResponseFactory $responseFactory
54-
* @param \Magento\Framework\App\Route\ConfigInterface $routeConfig
55-
* @param \Magento\Framework\UrlInterface $url
56-
* @param string $routerId
57-
* @param \Magento\Framework\Code\NameBuilder $nameBuilder
58-
* @param \Magento\Framework\App\Router\PathConfigInterface $pathConfig
59-
* @param \Magento\Framework\App\Config\ScopeConfigInterface $coreConfig
60-
* @param \Magento\Backend\App\ConfigInterface $backendConfig
61-
*
62-
* @SuppressWarnings(PHPMD.ExcessiveParameterList)
63-
*/
64-
public function __construct(
65-
\Magento\Framework\App\Router\ActionList $actionList,
66-
\Magento\Framework\App\ActionFactory $actionFactory,
67-
\Magento\Framework\App\DefaultPathInterface $defaultPath,
68-
\Magento\Framework\App\ResponseFactory $responseFactory,
69-
\Magento\Framework\App\Route\ConfigInterface $routeConfig,
70-
\Magento\Framework\UrlInterface $url,
71-
$routerId,
72-
\Magento\Framework\Code\NameBuilder $nameBuilder,
73-
\Magento\Framework\App\Router\PathConfigInterface $pathConfig,
74-
\Magento\Framework\App\Config\ScopeConfigInterface $coreConfig,
75-
\Magento\Backend\App\ConfigInterface $backendConfig
76-
) {
77-
parent::__construct(
78-
$actionList,
79-
$actionFactory,
80-
$defaultPath,
81-
$responseFactory,
82-
$routeConfig,
83-
$url,
84-
$routerId,
85-
$nameBuilder,
86-
$pathConfig
87-
);
88-
$this->_coreConfig = $coreConfig;
89-
$this->_backendConfig = $backendConfig;
90-
$this->_url = $url;
91-
}
92-
93-
/**
94-
* Get router default request path
95-
* @return string
96-
*/
97-
protected function _getDefaultPath()
98-
{
99-
return (string)$this->_backendConfig->getValue('web/default/admin');
100-
}
101-
102-
/**
103-
* Check whether URL for corresponding path should use https protocol
104-
*
105-
* @param string $path
106-
* @return bool
107-
* @SuppressWarnings(PHPMD.UnusedFormalParameter)
108-
*/
109-
protected function _shouldBeSecure($path)
110-
{
111-
return substr(
112-
(string)$this->_coreConfig->getValue('web/unsecure/base_url', 'default'),
113-
0,
114-
5
115-
) === 'https' || $this->_backendConfig->isSetFlag(
116-
'web/secure/use_in_adminhtml'
117-
) && substr(
118-
(string)$this->_coreConfig->getValue('web/secure/base_url', 'default'),
119-
0,
120-
5
121-
) === 'https';
122-
}
123-
124-
/**
125-
* Retrieve current secure url
126-
*
127-
* @param \Magento\Framework\App\RequestInterface $request
128-
* @return string
129-
*/
130-
protected function _getCurrentSecureUrl($request)
131-
{
132-
return $this->_url->getBaseUrl('link', true) . ltrim($request->getPathInfo(), '/');
133-
}
134-
13539
/**
13640
* Check whether redirect should be used for secure routes
13741
*

‎app/code/Magento/Backend/Block/Store/Switcher.php

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -211,7 +211,7 @@ public function isWebsiteSelected(\Magento\Store\Model\Website $website)
211211
public function getWebsiteId()
212212
{
213213
if (!$this->hasData('website_id')) {
214-
$this->setData('website_id', $this->getRequest()->getParam($this->getWebsiteVarName()));
214+
$this->setData('website_id', (int)$this->getRequest()->getParam($this->getWebsiteVarName()));
215215
}
216216
return $this->getData('website_id');
217217
}
@@ -289,7 +289,7 @@ public function isStoreGroupSelected(\Magento\Store\Model\Group $group)
289289
public function getStoreGroupId()
290290
{
291291
if (!$this->hasData('store_group_id')) {
292-
$this->setData('store_group_id', $this->getRequest()->getParam($this->getStoreGroupVarName()));
292+
$this->setData('store_group_id', (int)$this->getRequest()->getParam($this->getStoreGroupVarName()));
293293
}
294294
return $this->getData('store_group_id');
295295
}
@@ -339,7 +339,7 @@ public function getStores($group)
339339
public function getStoreId()
340340
{
341341
if (!$this->hasData('store_id')) {
342-
$this->setData('store_id', $this->getRequest()->getParam($this->getStoreVarName()));
342+
$this->setData('store_id', (int)$this->getRequest()->getParam($this->getStoreVarName()));
343343
}
344344
return $this->getData('store_id');
345345
}

‎app/code/Magento/Backend/Controller/Adminhtml/Auth/Login.php

Lines changed: 24 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -38,11 +38,30 @@ public function execute()
3838
if ($this->_auth->getAuthStorage()->isFirstPageAfterLogin()) {
3939
$this->_auth->getAuthStorage()->setIsFirstPageAfterLogin(true);
4040
}
41-
/** @var \Magento\Backend\Model\View\Result\Redirect $resultRedirect */
42-
$resultRedirect = $this->resultRedirectFactory->create();
43-
$resultRedirect->setPath($this->_backendUrl->getStartupPageUrl());
44-
return $resultRedirect;
41+
return $this->getRedirect($this->_backendUrl->getStartupPageUrl());
4542
}
46-
return $this->resultPageFactory->create();
43+
44+
$requestUrl = $this->getRequest()->getUri();
45+
$backendUrl = $this->getUrl('*');
46+
// redirect according to rewrite rule
47+
if ($requestUrl != $backendUrl) {
48+
return $this->getRedirect($backendUrl);
49+
} else {
50+
return $this->resultPageFactory->create();
51+
}
52+
}
53+
54+
/**
55+
* Get redirect response
56+
*
57+
* @param string $path
58+
* @return \Magento\Backend\Model\View\Result\Redirect
59+
*/
60+
private function getRedirect($path)
61+
{
62+
/** @var \Magento\Backend\Model\View\Result\Redirect $resultRedirect */
63+
$resultRedirect = $this->resultRedirectFactory->create();
64+
$resultRedirect->setPath($path);
65+
return $resultRedirect;
4766
}
4867
}

‎app/code/Magento/Backend/Model/AdminPathConfig.php

Lines changed: 89 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,89 @@
1+
<?php
2+
/**
3+
* Copyright © 2015 Magento. All rights reserved.
4+
* See COPYING.txt for license details.
5+
*/
6+
namespace Magento\Backend\Model;
7+
8+
use Magento\Framework\App\Router\PathConfigInterface;
9+
use Magento\Store\Model\Store;
10+
11+
/**
12+
* Path config to be used in adminhtml area
13+
*/
14+
class AdminPathConfig implements PathConfigInterface
15+
{
16+
/**
17+
* @var \Magento\Framework\App\Config\ScopeConfigInterface
18+
*/
19+
protected $coreConfig;
20+
21+
/**
22+
* @var \Magento\Backend\App\ConfigInterface
23+
*/
24+
protected $backendConfig;
25+
26+
/**
27+
* @var \Magento\Framework\UrlInterface
28+
*/
29+
protected $url;
30+
31+
/**
32+
* Constructor
33+
*
34+
* @param \Magento\Framework\App\Config\ScopeConfigInterface $coreConfig
35+
* @param \Magento\Backend\App\ConfigInterface $backendConfig
36+
* @param \Magento\Framework\UrlInterface $url
37+
*/
38+
public function __construct(
39+
\Magento\Framework\App\Config\ScopeConfigInterface $coreConfig,
40+
\Magento\Backend\App\ConfigInterface $backendConfig,
41+
\Magento\Framework\UrlInterface $url
42+
) {
43+
$this->coreConfig = $coreConfig;
44+
$this->backendConfig = $backendConfig;
45+
$this->url = $url;
46+
}
47+
48+
/**
49+
* {@inheritdoc}
50+
*
51+
* @param \Magento\Framework\App\RequestInterface $request
52+
* @return string
53+
*/
54+
public function getCurrentSecureUrl(\Magento\Framework\App\RequestInterface $request)
55+
{
56+
return $this->url->getBaseUrl('link', true) . ltrim($request->getPathInfo(), '/');
57+
}
58+
59+
/**
60+
* {@inheritdoc}
61+
*
62+
* @param string $path
63+
* @return bool
64+
*/
65+
public function shouldBeSecure($path)
66+
{
67+
return substr(
68+
(string)$this->coreConfig->getValue(Store::XML_PATH_UNSECURE_BASE_URL, 'default'),
69+
0,
70+
5
71+
) === 'https'
72+
|| $this->backendConfig->isSetFlag(Store::XML_PATH_SECURE_IN_ADMINHTML)
73+
&& substr(
74+
(string)$this->coreConfig->getValue(Store::XML_PATH_SECURE_BASE_URL, 'default'),
75+
0,
76+
5
77+
) === 'https';
78+
}
79+
80+
/**
81+
* {@inheritdoc}
82+
*
83+
* @return string
84+
*/
85+
public function getDefaultPath()
86+
{
87+
return $this->backendConfig->getValue('web/default/admin');
88+
}
89+
}

0 commit comments

Comments
 (0)