Skip to content

Commit 5f446e3

Browse files
danmooney2danmooney2
authored
Merge pull request #4412 from magento-obsessive-owls/MC-16926
2 parents 26ab857 + cb16f44 commit 5f446e3

File tree

61 files changed

+840
-228
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

61 files changed

+840
-228
lines changed

‎app/code/Magento/AdminNotification/Model/Feed.php‎

Lines changed: 13 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,11 @@ class Feed extends \Magento\Framework\Model\AbstractModel
2525

2626
const XML_LAST_UPDATE_PATH = 'system/adminnotification/last_update';
2727

28+
/**
29+
* @var \Magento\Framework\Escaper
30+
*/
31+
private $escaper;
32+
2833
/**
2934
* Feed url
3035
*
@@ -77,6 +82,7 @@ class Feed extends \Magento\Framework\Model\AbstractModel
7782
* @param \Magento\Framework\Model\ResourceModel\AbstractResource $resource
7883
* @param \Magento\Framework\Data\Collection\AbstractDb $resourceCollection
7984
* @param array $data
85+
* @param \Magento\Framework\Escaper|null $escaper
8086
* @SuppressWarnings(PHPMD.ExcessiveParameterList)
8187
*/
8288
public function __construct(
@@ -90,7 +96,8 @@ public function __construct(
9096
\Magento\Framework\UrlInterface $urlBuilder,
9197
\Magento\Framework\Model\ResourceModel\AbstractResource $resource = null,
9298
\Magento\Framework\Data\Collection\AbstractDb $resourceCollection = null,
93-
array $data = []
99+
array $data = [],
100+
\Magento\Framework\Escaper $escaper = null
94101
) {
95102
parent::__construct($context, $registry, $resource, $resourceCollection, $data);
96103
$this->_backendConfig = $backendConfig;
@@ -99,12 +106,16 @@ public function __construct(
99106
$this->_deploymentConfig = $deploymentConfig;
100107
$this->productMetadata = $productMetadata;
101108
$this->urlBuilder = $urlBuilder;
109+
$this->escaper = $escaper ?? \Magento\Framework\App\ObjectManager::getInstance()->get(
110+
\Magento\Framework\Escaper::class
111+
);
102112
}
103113

104114
/**
105115
* Init model
106116
*
107117
* @return void
118+
* phpcs:disable Magento2.CodeAnalysis.EmptyBlock
108119
*/
109120
protected function _construct()
110121
{
@@ -255,6 +266,6 @@ public function getFeedXml()
255266
*/
256267
private function escapeString(\SimpleXMLElement $data)
257268
{
258-
return htmlspecialchars((string)$data);
269+
return $this->escaper->escapeHtml((string)$data);
259270
}
260271
}

‎app/code/Magento/Analytics/Test/Unit/Block/Adminhtml/System/Config/CollectionTimeLabelTest.php‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -40,6 +40,15 @@ protected function setUp()
4040
->setMethods(['getComment', 'getHtmlId', 'getName'])
4141
->disableOriginalConstructor()
4242
->getMock();
43+
44+
$objectManager = new ObjectManager($this);
45+
$escaper = $objectManager->getObject(\Magento\Framework\Escaper::class);
46+
$objectManager->setBackwardCompatibleProperty(
47+
$this->abstractElementMock,
48+
'_escaper',
49+
$escaper
50+
);
51+
4352
$this->contextMock = $this->getMockBuilder(Context::class)
4453
->setMethods(['getLocaleDate'])
4554
->disableOriginalConstructor()

‎app/code/Magento/Analytics/Test/Unit/Block/Adminhtml/System/Config/SubscriptionStatusLabelTest.php‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -54,6 +54,15 @@ protected function setUp()
5454
->setMethods(['getComment', 'getHtmlId', 'getName'])
5555
->disableOriginalConstructor()
5656
->getMock();
57+
58+
$objectManager = new ObjectManager($this);
59+
$escaper = $objectManager->getObject(\Magento\Framework\Escaper::class);
60+
$objectManager->setBackwardCompatibleProperty(
61+
$this->abstractElementMock,
62+
'_escaper',
63+
$escaper
64+
);
65+
5766
$this->formMock = $this->getMockBuilder(Form::class)
5867
->disableOriginalConstructor()
5968
->getMock();

‎app/code/Magento/Analytics/Test/Unit/Block/Adminhtml/System/Config/VerticalTest.php‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -39,6 +39,15 @@ protected function setUp()
3939
->setMethods(['getComment', 'getLabel', 'getHint', 'getHtmlId', 'getName'])
4040
->disableOriginalConstructor()
4141
->getMock();
42+
43+
$objectManager = new ObjectManager($this);
44+
$escaper = $objectManager->getObject(\Magento\Framework\Escaper::class);
45+
$objectManager->setBackwardCompatibleProperty(
46+
$this->abstractElementMock,
47+
'_escaper',
48+
$escaper
49+
);
50+
4251
$this->contextMock = $this->getMockBuilder(Context::class)
4352
->disableOriginalConstructor()
4453
->getMock();

‎app/code/Magento/Catalog/Block/Adminhtml/Product/Edit.php‎

Lines changed: 42 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -3,17 +3,22 @@
33
* Copyright © Magento, Inc. All rights reserved.
44
* See COPYING.txt for license details.
55
*/
6+
namespace Magento\Catalog\Block\Adminhtml\Product;
67

78
/**
89
* Customer edit block
910
*
1011
* @author Magento Core Team <[email protected]>
1112
* @SuppressWarnings(PHPMD.CouplingBetweenObjects)
13+
* @SuppressWarnings(PHPMD.RequestAwareBlockMethod)
1214
*/
13-
namespace Magento\Catalog\Block\Adminhtml\Product;
14-
1515
class Edit extends \Magento\Backend\Block\Widget
1616
{
17+
/**
18+
* @var \Magento\Framework\Escaper
19+
*/
20+
private $escaper;
21+
1722
/**
1823
* @var string
1924
*/
@@ -47,6 +52,7 @@ class Edit extends \Magento\Backend\Block\Widget
4752
* @param \Magento\Eav\Model\Entity\Attribute\SetFactory $attributeSetFactory
4853
* @param \Magento\Framework\Registry $registry
4954
* @param \Magento\Catalog\Helper\Product $productHelper
55+
* @param \Magento\Framework\Escaper $escaper
5056
* @param array $data
5157
*/
5258
public function __construct(
@@ -55,16 +61,20 @@ public function __construct(
5561
\Magento\Eav\Model\Entity\Attribute\SetFactory $attributeSetFactory,
5662
\Magento\Framework\Registry $registry,
5763
\Magento\Catalog\Helper\Product $productHelper,
64+
\Magento\Framework\Escaper $escaper,
5865
array $data = []
5966
) {
6067
$this->_productHelper = $productHelper;
6168
$this->_attributeSetFactory = $attributeSetFactory;
6269
$this->_coreRegistry = $registry;
6370
$this->jsonEncoder = $jsonEncoder;
71+
$this->escaper = $escaper;
6472
parent::__construct($context, $data);
6573
}
6674

6775
/**
76+
* Edit Product constructor
77+
*
6878
* @return void
6979
*/
7080
protected function _construct()
@@ -144,6 +154,8 @@ protected function _prepareLayout()
144154
}
145155

146156
/**
157+
* Retrieve back button html
158+
*
147159
* @return string
148160
*/
149161
public function getBackButtonHtml()
@@ -152,6 +164,8 @@ public function getBackButtonHtml()
152164
}
153165

154166
/**
167+
* Retrieve cancel button html
168+
*
155169
* @return string
156170
*/
157171
public function getCancelButtonHtml()
@@ -160,6 +174,8 @@ public function getCancelButtonHtml()
160174
}
161175

162176
/**
177+
* Retrieve save button html
178+
*
163179
* @return string
164180
*/
165181
public function getSaveButtonHtml()
@@ -168,6 +184,8 @@ public function getSaveButtonHtml()
168184
}
169185

170186
/**
187+
* Retrieve save and edit button html
188+
*
171189
* @return string
172190
*/
173191
public function getSaveAndEditButtonHtml()
@@ -176,6 +194,8 @@ public function getSaveAndEditButtonHtml()
176194
}
177195

178196
/**
197+
* Retrieve delete button html
198+
*
179199
* @return string
180200
*/
181201
public function getDeleteButtonHtml()
@@ -194,6 +214,8 @@ public function getSaveSplitButtonHtml()
194214
}
195215

196216
/**
217+
* Retrieve validation url
218+
*
197219
* @return string
198220
*/
199221
public function getValidationUrl()
@@ -202,6 +224,8 @@ public function getValidationUrl()
202224
}
203225

204226
/**
227+
* Retrieve save url
228+
*
205229
* @return string
206230
*/
207231
public function getSaveUrl()
@@ -210,6 +234,8 @@ public function getSaveUrl()
210234
}
211235

212236
/**
237+
* Retrieve save and continue url
238+
*
213239
* @return string
214240
*/
215241
public function getSaveAndContinueUrl()
@@ -221,6 +247,8 @@ public function getSaveAndContinueUrl()
221247
}
222248

223249
/**
250+
* Retrieve product id
251+
*
224252
* @return mixed
225253
*/
226254
public function getProductId()
@@ -229,6 +257,8 @@ public function getProductId()
229257
}
230258

231259
/**
260+
* Retrieve product set id
261+
*
232262
* @return mixed
233263
*/
234264
public function getProductSetId()
@@ -241,6 +271,8 @@ public function getProductSetId()
241271
}
242272

243273
/**
274+
* Retrieve duplicate url
275+
*
244276
* @return string
245277
*/
246278
public function getDuplicateUrl()
@@ -249,6 +281,8 @@ public function getDuplicateUrl()
249281
}
250282

251283
/**
284+
* Retrieve product header
285+
*
252286
* @deprecated 101.1.0
253287
* @return string
254288
*/
@@ -263,6 +297,8 @@ public function getHeader()
263297
}
264298

265299
/**
300+
* Get product attribute set name
301+
*
266302
* @return string
267303
*/
268304
public function getAttributeSetName()
@@ -275,11 +311,14 @@ public function getAttributeSetName()
275311
}
276312

277313
/**
314+
* Retrieve id of selected tab
315+
*
278316
* @return string
279317
*/
280318
public function getSelectedTabId()
281319
{
282-
return addslashes(htmlspecialchars($this->getRequest()->getParam('tab')));
320+
// phpcs:ignore Magento2.Functions.DiscouragedFunction
321+
return addslashes($this->escaper->escapeHtml($this->getRequest()->getParam('tab')));
283322
}
284323

285324
/**

‎app/code/Magento/Customer/Block/Adminhtml/Edit/Tab/Newsletter/Grid/Renderer/Action.php‎

Lines changed: 19 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,11 @@
1010
*/
1111
class Action extends \Magento\Backend\Block\Widget\Grid\Column\Renderer\AbstractRenderer
1212
{
13+
/**
14+
* @var \Magento\Framework\Escaper
15+
*/
16+
private $escaper;
17+
1318
/**
1419
* Core registry
1520
*
@@ -21,17 +26,24 @@ class Action extends \Magento\Backend\Block\Widget\Grid\Column\Renderer\Abstract
2126
* @param \Magento\Backend\Block\Context $context
2227
* @param \Magento\Framework\Registry $registry
2328
* @param array $data
29+
* @param \Magento\Framework\Escaper|null $escaper
2430
*/
2531
public function __construct(
2632
\Magento\Backend\Block\Context $context,
2733
\Magento\Framework\Registry $registry,
28-
array $data = []
34+
array $data = [],
35+
\Magento\Framework\Escaper $escaper = null
2936
) {
3037
$this->_coreRegistry = $registry;
38+
$this->escaper = $escaper ?? \Magento\Framework\App\ObjectManager::getInstance()->get(
39+
\Magento\Framework\Escaper::class
40+
);
3141
parent::__construct($context, $data);
3242
}
3343

3444
/**
45+
* Render actions
46+
*
3547
* @param \Magento\Framework\DataObject $row
3648
* @return string
3749
*/
@@ -57,15 +69,20 @@ public function render(\Magento\Framework\DataObject $row)
5769
}
5870

5971
/**
72+
* Retrieve escaped value
73+
*
6074
* @param string $value
6175
* @return string
6276
*/
6377
protected function _getEscapedValue($value)
6478
{
65-
return addcslashes(htmlspecialchars($value), '\\\'');
79+
// phpcs:ignore Magento2.Functions.DiscouragedFunction
80+
return addcslashes($this->escaper->escapeHtml($value), '\\\'');
6681
}
6782

6883
/**
84+
* Actions to html
85+
*
6986
* @param array $actions
7087
* @return string
7188
*/

‎app/code/Magento/Customer/Block/Adminhtml/Edit/Tab/Wishlist/Grid/Renderer/Description.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,6 @@ class Description extends \Magento\Backend\Block\Widget\Grid\Column\Renderer\Abs
1818
*/
1919
public function render(\Magento\Framework\DataObject $row)
2020
{
21-
return nl2br(htmlspecialchars($row->getData($this->getColumn()->getIndex())));
21+
return nl2br($this->escapeHtml($row->getData($this->getColumn()->getIndex())));
2222
}
2323
}

0 commit comments

Comments
 (0)