Merge branch 2.3-develop into ENGCOM-4595-magento-magento2-21948

Author: magento-engcom-team

.gitignore

@@ -48,6 +48,8 @@ atlassian*
 /pub/media/import/*
 !/pub/media/import/.htaccess
 /pub/media/logo/*
+/pub/media/custom_options/*
+!/pub/media/custom_options/.htaccess
 /pub/media/theme/*
 /pub/media/theme_customization/*
 !/pub/media/theme_customization/.htaccess

.htaccess

@@ -27,6 +27,11 @@
     #AddType x-mapp-php5 .php
     #AddHandler x-mapp-php5 .php
 
+############################################
+## enable usage of methods arguments in backtrace
+
+    SetEnv MAGE_DEBUG_SHOW_ARGS 1
+
 ############################################
 ## default index file
 
@@ -364,6 +369,15 @@
             Require all denied
         </IfVersion>
     </Files>
+    <Files .user.ini>
+        <IfVersion < 2.4>
+            order allow,deny
+            deny from all
+        </IfVersion>
+        <IfVersion >= 2.4>
+            Require all denied
+        </IfVersion>
+    </Files>
 
 # For 404s and 403s that aren't handled by the application, show plain 404 response
 ErrorDocument 404 /pub/errors/404.php

.htaccess.sample

@@ -27,6 +27,11 @@
     #AddType x-mapp-php5 .php
     #AddHandler x-mapp-php5 .php
 
+############################################
+## enable usage of methods arguments in backtrace
+
+    SetEnv MAGE_DEBUG_SHOW_ARGS 1
+
 ############################################
 ## default index file
 
@@ -341,6 +346,15 @@
             Require all denied
         </IfVersion>
     </Files>
+    <Files .user.ini>
+        <IfVersion < 2.4>
+            order allow,deny
+            deny from all
+        </IfVersion>
+        <IfVersion >= 2.4>
+            Require all denied
+        </IfVersion>
+    </Files>
 
 # For 404s and 403s that aren't handled by the application, show plain 404 response
 ErrorDocument 404 /pub/errors/404.php

app/bootstrap.php

@@ -8,6 +8,7 @@
  * Environment initialization
  */
 error_reporting(E_ALL);
+stream_wrapper_unregister('phar');
 #ini_set('display_errors', 1);
 
 /* PHP version validation */

app/code/Magento/AdminNotification/Block/Grid/Renderer/Actions.php

@@ -8,6 +8,11 @@
 
 namespace Magento\AdminNotification\Block\Grid\Renderer;
 
+/**
+ * Renderer class for action in the admin notifications grid
+ *
+ * @package Magento\AdminNotification\Block\Grid\Renderer
+ */
 class Actions extends \Magento\Backend\Block\Widget\Grid\Column\Renderer\AbstractRenderer
 {
     /**
@@ -37,7 +42,9 @@ public function __construct(
      */
     public function render(\Magento\Framework\DataObject $row)
     {
-        $readDetailsHtml = $row->getUrl() ? '<a class="action-details" target="_blank" href="' . $row->getUrl() . '">' .
+        $readDetailsHtml = $row->getUrl() ? '<a class="action-details" target="_blank" href="' .
+            $this->escapeUrl($row->getUrl())
+            . '">' .
             __('Read Details') . '</a>' : '';
 
         $markAsReadHtml = !$row->getIsRead() ? '<a class="action-mark" href="' . $this->getUrl(

app/code/Magento/Analytics/Test/Unit/Block/Adminhtml/System/Config/AdditionalCommentTest.php

@@ -39,6 +39,15 @@ protected function setUp()
             ->setMethods(['getComment', 'getLabel'])
             ->disableOriginalConstructor()
             ->getMock();
+
+        $objectManager = new ObjectManager($this);
+        $escaper = $objectManager->getObject(\Magento\Framework\Escaper::class);
+        $reflection = new \ReflectionClass($this->abstractElementMock);
+        $reflection_property = $reflection->getProperty('_escaper');
+        $reflection_property->setAccessible(true);
+        $reflection_property->setValue($this->abstractElementMock, $escaper);
+
+        $this->abstractElementMock->setEscaper($escaper);
         $this->contextMock = $this->getMockBuilder(Context::class)
             ->disableOriginalConstructor()
             ->getMock();

app/code/Magento/Analytics/Test/Unit/Block/Adminhtml/System/Config/CollectionTimeLabelTest.php

@@ -46,6 +46,14 @@ protected function setUp()
             ->setMethods(['getComment'])
             ->disableOriginalConstructor()
             ->getMock();
+
+        $objectManager = new ObjectManager($this);
+        $escaper = $objectManager->getObject(\Magento\Framework\Escaper::class);
+        $reflection = new \ReflectionClass($this->abstractElementMock);
+        $reflection_property = $reflection->getProperty('_escaper');
+        $reflection_property->setAccessible(true);
+        $reflection_property->setValue($this->abstractElementMock, $escaper);
+
         $this->contextMock = $this->getMockBuilder(Context::class)
             ->setMethods(['getLocaleDate'])
             ->disableOriginalConstructor()

app/code/Magento/Analytics/Test/Unit/Block/Adminhtml/System/Config/SubscriptionStatusLabelTest.php

@@ -51,6 +51,14 @@ protected function setUp()
             ->setMethods(['getComment'])
             ->disableOriginalConstructor()
             ->getMock();
+
+        $objectManager = new ObjectManager($this);
+        $escaper = $objectManager->getObject(\Magento\Framework\Escaper::class);
+        $reflection = new \ReflectionClass($this->abstractElementMock);
+        $reflection_property = $reflection->getProperty('_escaper');
+        $reflection_property->setAccessible(true);
+        $reflection_property->setValue($this->abstractElementMock, $escaper);
+
         $this->formMock = $this->getMockBuilder(Form::class)
             ->disableOriginalConstructor()
             ->getMock();

app/code/Magento/Analytics/Test/Unit/Block/Adminhtml/System/Config/VerticalTest.php

@@ -39,6 +39,14 @@ protected function setUp()
             ->setMethods(['getComment', 'getLabel', 'getHint'])
             ->disableOriginalConstructor()
             ->getMock();
+
+        $objectManager = new ObjectManager($this);
+        $escaper = $objectManager->getObject(\Magento\Framework\Escaper::class);
+        $reflection = new \ReflectionClass($this->abstractElementMock);
+        $reflection_property = $reflection->getProperty('_escaper');
+        $reflection_property->setAccessible(true);
+        $reflection_property->setValue($this->abstractElementMock, $escaper);
+
         $this->contextMock = $this->getMockBuilder(Context::class)
             ->disableOriginalConstructor()
             ->getMock();

app/code/Magento/Backend/Block/Widget/Form/Container.php

@@ -56,6 +56,8 @@ class Container extends \Magento\Backend\Block\Widget\Container
     protected $_template = 'Magento_Backend::widget/form/container.phtml';
 
     /**
+     * Initialize form.
+     *
      * @return void
      */
     protected function _construct()
@@ -83,7 +85,7 @@ protected function _construct()
             -1
         );
 
-        $objId = $this->getRequest()->getParam($this->_objectId);
+        $objId = (int)$this->getRequest()->getParam($this->_objectId);
 
         if (!empty($objId)) {
             $this->addButton(
@@ -151,11 +153,13 @@ public function getBackUrl()
     }
 
     /**
+     * Get URL for delete button.
+     *
      * @return string
      */
     public function getDeleteUrl()
     {
-        return $this->getUrl('*/*/delete', [$this->_objectId => $this->getRequest()->getParam($this->_objectId)]);
+        return $this->getUrl('*/*/delete', [$this->_objectId => (int)$this->getRequest()->getParam($this->_objectId)]);
     }
 
     /**
@@ -183,6 +187,8 @@ public function getFormActionUrl()
     }
 
     /**
+     * Get form HTML.
+     *
      * @return string
      */
     public function getFormHtml()
@@ -192,6 +198,8 @@ public function getFormHtml()
     }
 
     /**
+     * Get form init scripts.
+     *
      * @return string
      */
     public function getFormInitScripts()
@@ -203,6 +211,8 @@ public function getFormInitScripts()
     }
 
     /**
+     * Get form scripts.
+     *
      * @return string
      */
     public function getFormScripts()
@@ -214,6 +224,8 @@ public function getFormScripts()
     }
 
     /**
+     * Get header width.
+     *
      * @return string
      */
     public function getHeaderWidth()
@@ -222,6 +234,8 @@ public function getHeaderWidth()
     }
 
     /**
+     * Get header css class.
+     *
      * @return string
      */
     public function getHeaderCssClass()
@@ -230,6 +244,8 @@ public function getHeaderCssClass()
     }
 
     /**
+     * Get header HTML.
+     *
      * @return string
      */
     public function getHeaderHtml()