Skip to content

Commit 6801e95

Browse files
dvoskoboinikovdvoskoboinikov
authored
Merge pull request #4334 from magento-qwerty/MAGETWO-55809
Implemented Stories: - MAGETWO-55809: Eliminate @escapeNotVerified in Module Backend
2 parents 4dac65b + e5a1e81 commit 6801e95

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

63 files changed

+803
-956
lines changed

‎app/code/Magento/Backend/view/adminhtml/templates/admin/access_denied.phtml

Lines changed: 4 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -3,14 +3,13 @@
33
* Copyright © Magento, Inc. All rights reserved.
44
* See COPYING.txt for license details.
55
*/
6-
7-
// @codingStandardsIgnoreFile
8-
96
?>
107
<?php
118
/**
129
* @see \Magento\Backend\Block\Denied
1310
*/
11+
12+
// phpcs:disable Magento2.Security.Superglobal
1413
?>
1514
<hr class="access-denied-hr"/>
1615
<div class="access-denied-page">
@@ -21,10 +20,10 @@
2120
<li><span><?= $block->escapeHtml(__('Contact a system administrator or store owner to gain permissions.')) ?></span></li>
2221
<li>
2322
<span><?= $block->escapeHtml(__('Return to ')) ?>
24-
<?php if(isset($_SERVER['HTTP_REFERER'])): ?>
23+
<?php if (isset($_SERVER['HTTP_REFERER'])) : ?>
2524
<a href="<?= $block->escapeUrl(__($_SERVER['HTTP_REFERER'])) ?>">
2625
<?= $block->escapeHtml(__('previous page')) ?></a><?= $block->escapeHtml(__('.')) ?>
27-
<?php else: ?>
26+
<?php else : ?>
2827
<a href="<?= $block->escapeHtmlAttr(__('javascript:history.back()')) ?>">
2928
<?= $block->escapeHtml(__('previous page')) ?></a><?= $block->escapeHtml(__('.')) ?>
3029
<?php endif ?>

‎app/code/Magento/Backend/view/adminhtml/templates/admin/formkey.phtml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,4 +4,4 @@
44
* See COPYING.txt for license details.
55
*/
66
?>
7-
<div><input name="form_key" type="hidden" value="<?= /* @escapeNotVerified */ $block->getFormKey() ?>" /></div>
7+
<div><input name="form_key" type="hidden" value="<?= $block->escapeHtmlAttr($block->getFormKey()) ?>" /></div>

‎app/code/Magento/Backend/view/adminhtml/templates/admin/login.phtml

Lines changed: 9 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -4,19 +4,20 @@
44
* See COPYING.txt for license details.
55
*/
66

7-
// @codingStandardsIgnoreFile
8-
7+
/**
8+
* @var \Magento\Framework\View\Element\AbstractBlock $block
9+
*/
910
?>
1011

1112
<form method="post" action="" id="login-form" data-mage-init='{"form": {}, "validation": {}}' autocomplete="off">
1213
<fieldset class="admin__fieldset">
1314
<legend class="admin__legend">
14-
<span><?= /* @escapeNotVerified */ __('Welcome, please sign in') ?></span>
15+
<span><?= $block->escapeHtml(__('Welcome, please sign in')) ?></span>
1516
</legend><br/>
16-
<input name="form_key" type="hidden" value="<?= /* @escapeNotVerified */ $block->getFormKey() ?>" />
17+
<input name="form_key" type="hidden" value="<?= $block->escapeHtmlAttr($block->getFormKey()) ?>" />
1718
<div class="admin__field _required field-username">
1819
<label for="username" class="admin__field-label">
19-
<span><?= /* @escapeNotVerified */ __('Username') ?></span>
20+
<span><?= $block->escapeHtml(__('Username')) ?></span>
2021
</label>
2122
<div class="admin__field-control">
2223
<input id="username"
@@ -26,14 +27,14 @@
2627
autofocus
2728
value=""
2829
data-validate="{required:true}"
29-
placeholder="<?= /* @escapeNotVerified */ __('user name') ?>"
30+
placeholder="<?= $block->escapeHtmlAttr(__('user name')) ?>"
3031
autocomplete="off"
3132
/>
3233
</div>
3334
</div>
3435
<div class="admin__field _required field-password">
3536
<label for="login" class="admin__field-label">
36-
<span><?= /* @escapeNotVerified */ __('Password') ?></span>
37+
<span><?= $block->escapeHtml(__('Password')) ?></span>
3738
</label>
3839
<div class="admin__field-control">
3940
<input id="login"
@@ -42,7 +43,7 @@
4243
name="login[password]"
4344
data-validate="{required:true}"
4445
value=""
45-
placeholder="<?= /* @escapeNotVerified */ __('password') ?>"
46+
placeholder="<?= $block->escapeHtmlAttr(__('password')) ?>"
4647
autocomplete="off"
4748
/>
4849
</div>

‎app/code/Magento/Backend/view/adminhtml/templates/admin/login_buttons.phtml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,6 @@
88
<button
99
<?php $block->getUiId(); ?>
1010
class="action-login action-primary">
11-
<span><?= /* @escapeNotVerified */ __('Sign in') ?></span>
11+
<span><?= $block->escapeHtml(__('Sign in')) ?></span>
1212
</button>
1313
</div>

‎app/code/Magento/Backend/view/adminhtml/templates/admin/overlay_popup.phtml

Lines changed: 5 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -3,15 +3,12 @@
33
* Copyright © Magento, Inc. All rights reserved.
44
* See COPYING.txt for license details.
55
*/
6-
7-
// @codingStandardsIgnoreFile
8-
96
?>
107
<div class="wrapper-popup">
118
<div class="middle" id="anchor-content">
129
<div id="page:main-container">
13-
<?php if ($block->getChildHtml('left')): ?>
14-
<div class="columns <?= /* @escapeNotVerified */ $block->getContainerCssClass() ?>" id="page:container">
10+
<?php if ($block->getChildHtml('left')) : ?>
11+
<div class="columns <?= $block->escapeHtmlAttr($block->getContainerCssClass()) ?>" id="page:container">
1512
<div id="page:left" class="side-col">
1613
<?= $block->getChildHtml('left') ?>
1714
</div>
@@ -24,13 +21,13 @@
2421
</div>
2522
</div>
2623
</div>
27-
<?php else: ?>
24+
<?php else : ?>
2825
<div id="messages" data-container-for="messages"><?= $block->getLayout()->getMessagesBlock()->getGroupedHtml() ?></div>
2926
<?= $block->getChildHtml('content') ?>
30-
<?php endif; ?>
27+
<?php endif; ?>
3128
</div>
3229
</div>
33-
<?php if ($block->getChildHtml('footer')): ?>
30+
<?php if ($block->getChildHtml('footer')) : ?>
3431
<div class="footer">
3532
<?= $block->getChildHtml('footer') ?>
3633
</div>

‎app/code/Magento/Backend/view/adminhtml/templates/admin/page.phtml

Lines changed: 5 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -3,19 +3,16 @@
33
* Copyright © Magento, Inc. All rights reserved.
44
* See COPYING.txt for license details.
55
*/
6-
7-
// @codingStandardsIgnoreFile
8-
96
?>
107
<?php /** @var $block \Magento\Backend\Block\Page */ ?>
118
<!doctype html>
12-
<html lang="<?= /* @escapeNotVerified */ $block->getLang() ?>" class="no-js">
9+
<html lang="<?= $block->escapeHtmlAttr($block->getLang()) ?>" class="no-js">
1310

1411
<head>
1512
<?= $block->getChildHtml('head') ?>
1613
</head>
1714

18-
<body id="html-body"<?= $block->getBodyClass() ? ' class="' . $block->getBodyClass() . '"' : '' ?> data-container="body" data-mage-init='{"loaderAjax":{},"loader":{}}'>
15+
<body id="html-body" class="<?= $block->escapeHtmlAttr($block->getBodyClass()) ?>" data-container="body" data-mage-init='{"loaderAjax":{},"loader":{}}'>
1916
<div class="page-wrapper">
2017
<?= $block->getChildHtml('notification_window') ?>
2118
<?= $block->getChildHtml('global_notices') ?>
@@ -31,8 +28,8 @@
3128
<?= $block->getLayout()->getMessagesBlock()->getGroupedHtml() ?>
3229
</div>
3330
<?= $block->getChildHtml('page_main_actions') ?>
34-
<?php if ($block->getChildHtml('left')): ?>
35-
<div id="page:main-container" class="<?= /* @escapeNotVerified */ $block->getContainerCssClass() ?> col-2-left-layout">
31+
<?php if ($block->getChildHtml('left')) : ?>
32+
<div id="page:main-container" class="<?= $block->escapeHtmlAttr($block->getContainerCssClass()) ?> col-2-left-layout">
3633
<div class="main-col" id="content">
3734
<?= $block->getChildHtml('content') ?>
3835
</div>
@@ -41,7 +38,7 @@
4138
<?= $block->getChildHtml('left') ?>
4239
</div>
4340
</div>
44-
<?php else: ?>
41+
<?php else : ?>
4542
<div id="page:main-container" class="col-1-layout">
4643
<?= $block->getChildHtml('content') ?>
4744
</div>

‎app/code/Magento/Backend/view/adminhtml/templates/dashboard/graph.phtml

Lines changed: 13 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -3,33 +3,33 @@
33
* Copyright © Magento, Inc. All rights reserved.
44
* See COPYING.txt for license details.
55
*/
6-
7-
// @codingStandardsIgnoreFile
8-
96
?>
107
<div class="dashboard-diagram">
118
<div class="dashboard-diagram-switcher">
129
<label for="order_<?= $block->getHtmlId() ?>_period"
13-
class="label"><?= /* @escapeNotVerified */ __('Select Range:') ?></label>
10+
class="label"><?= $block->escapeHtml(__('Select Range:')) ?></label>
1411
<select name="period" id="order_<?= $block->getHtmlId() ?>_period"
1512
onchange="changeDiagramsPeriod(this);" class="admin__control-select">
16-
<?php foreach ($this->helper('Magento\Backend\Helper\Dashboard\Data')->getDatePeriods() as $value => $label): ?>
17-
<?php if (in_array($value, ['custom'])) {
13+
<?php //phpcs:disable ?>
14+
<?php foreach ($this->helper(\Magento\Backend\Helper\Dashboard\Data::class)->getDatePeriods() as $value => $label) : ?>
15+
<?php
16+
//phpcs:enable
17+
if (in_array($value, ['custom'])) {
1818
continue;
1919
} ?>
20-
<option value="<?= /* @escapeNotVerified */ $value ?>"
21-
<?php if ($block->getRequest()->getParam('period') == $value): ?> selected="selected"<?php endif; ?>
22-
><?= /* @escapeNotVerified */ $label ?></option>
20+
<option value="<?= /* @noEscape */ $value ?>"
21+
<?php if ($block->getRequest()->getParam('period') == $value) : ?> selected="selected"<?php endif; ?>
22+
><?= $block->escapeHtml($label) ?></option>
2323
<?php endforeach; ?>
2424
</select>
2525
</div>
26-
<?php if ($block->getCount()): ?>
26+
<?php if ($block->getCount()) : ?>
2727
<div class="dashboard-diagram-image">
28-
<img src="<?= /* @escapeNotVerified */ $block->getChartUrl(false) ?>" class="dashboard-diagram-chart" alt="Chart" title="Chart" />
28+
<img src="<?= $block->escapeUrl($block->getChartUrl(false)) ?>" class="dashboard-diagram-chart" alt="Chart" title="Chart" />
2929
</div>
30-
<?php else: ?>
30+
<?php else : ?>
3131
<div class="dashboard-diagram-nodata">
32-
<span><?= /* @escapeNotVerified */ __('No Data Found') ?></span>
32+
<span><?= $block->escapeHtml(__('No Data Found')) ?></span>
3333
</div>
3434
<?php endif; ?>
3535
</div>

‎app/code/Magento/Backend/view/adminhtml/templates/dashboard/graph/disabled.phtml

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -3,9 +3,7 @@
33
* Copyright © Magento, Inc. All rights reserved.
44
* See COPYING.txt for license details.
55
*/
6-
7-
// @codingStandardsIgnoreFile
86
?>
97
<div class="dashboard-diagram-disabled">
10-
<?= /* @escapeNotVerified */ __('Chart is disabled. To enable the chart, click <a href="%1">here</a>.', $block->getConfigUrl()) ?>
8+
<?= /* @noEscape */ __('Chart is disabled. To enable the chart, click <a href="%1">here</a>.', $block->escapeUrl($block->getConfigUrl())) ?>
119
</div>

‎app/code/Magento/Backend/view/adminhtml/templates/dashboard/grid.phtml

Lines changed: 40 additions & 43 deletions
Original file line numberDiff line numberDiff line change
@@ -3,90 +3,87 @@
33
* Copyright © Magento, Inc. All rights reserved.
44
* See COPYING.txt for license details.
55
*/
6-
7-
// @codingStandardsIgnoreFile
8-
96
?>
107
<?php
118

12-
$numColumns = sizeof($block->getColumns());
9+
$numColumns = count($block->getColumns());
1310
?>
14-
<?php if ($block->getCollection()): ?>
11+
<?php if ($block->getCollection()) : ?>
1512
<div class="dashboard-item-content">
16-
<?php if ($block->getCollection()->getSize()>0): ?>
17-
<table class="admin__table-primary dashboard-data" id="<?= /* @escapeNotVerified */ $block->getId() ?>_table">
13+
<?php if ($block->getCollection()->getSize() > 0) : ?>
14+
<table class="admin__table-primary dashboard-data" id="<?= $block->escapeHtmlAttr($block->getId()) ?>_table">
1815
<?php
1916
/* This part is commented to remove all <col> tags from the code. */
2017
/* foreach ($block->getColumns() as $_column): ?>
2118
<col <?= $_column->getHtmlProperty() ?> />
2219
<?php endforeach; */ ?>
23-
<?php if ($block->getHeadersVisibility() || $block->getFilterVisibility()): ?>
20+
<?php if ($block->getHeadersVisibility() || $block->getFilterVisibility()) : ?>
2421
<thead>
25-
<?php if ($block->getHeadersVisibility()): ?>
22+
<?php if ($block->getHeadersVisibility()) : ?>
2623
<tr>
27-
<?php foreach ($block->getColumns() as $_column): ?>
24+
<?php foreach ($block->getColumns() as $_column) : ?>
2825
<?= $_column->getHeaderHtml() ?>
2926
<?php endforeach; ?>
3027
</tr>
3128
<?php endif; ?>
3229
</thead>
3330
<?php endif; ?>
34-
<?php if (!$block->getIsCollapsed()): ?>
31+
<?php if (!$block->getIsCollapsed()) : ?>
3532
<tbody>
36-
<?php foreach ($block->getCollection() as $_index => $_item): ?>
37-
<tr title="<?= /* @escapeNotVerified */ $block->getRowUrl($_item) ?>">
38-
<?php $i = 0; foreach ($block->getColumns() as $_column): ?>
39-
<td class="<?= /* @escapeNotVerified */ $_column->getCssProperty() ?> <?= ++$i == $numColumns ? 'last' : '' ?>"><?= (($_html = $_column->getRowField($_item)) != '' ? $_html : '&nbsp;') ?></td>
33+
<?php foreach ($block->getCollection() as $_index => $_item) : ?>
34+
<tr title="<?= $block->escapeHtmlAttr($block->getRowUrl($_item)) ?>">
35+
<?php $i = 0; foreach ($block->getColumns() as $_column) : ?>
36+
<td class="<?= $block->escapeHtmlAttr($_column->getCssProperty()) ?> <?= /* @noEscape */ ++$i == $numColumns ? 'last' : '' ?>"><?= /* @noEscape */ (($_html = $_column->getRowField($_item)) != '' ? $_html : '&nbsp;') ?></td>
4037
<?php endforeach; ?>
4138
</tr>
4239
<?php endforeach; ?>
4340
</tbody>
4441
<?php endif; ?>
4542
</table>
46-
<?php else: ?>
47-
<div class="<?= /* @escapeNotVerified */ $block->getEmptyTextClass() ?>"><?= /* @escapeNotVerified */ $block->getEmptyText() ?></div>
43+
<?php else : ?>
44+
<div class="<?= $block->escapeHtmlAttr($block->getEmptyTextClass()) ?>"><?= $block->escapeHtml($block->getEmptyText()) ?></div>
4845
<?php endif; ?>
4946
</div>
50-
<?php if ($block->canDisplayContainer()): ?>
47+
<?php if ($block->canDisplayContainer()) : ?>
5148
<script>
5249
var deps = [];
5350

54-
<?php if ($block->getDependencyJsObject()): ?>
51+
<?php if ($block->getDependencyJsObject()) : ?>
5552
deps.push('uiRegistry');
56-
<?php endif; ?>
53+
<?php endif; ?>
5754

58-
<?php if (strpos($block->getRowClickCallback(), 'order.') !== false): ?>
55+
<?php if (strpos($block->getRowClickCallback(), 'order.') !== false) : ?>
5956
deps.push('Magento_Sales/order/create/form');
60-
<?php endif; ?>
57+
<?php endif; ?>
6158

6259
deps.push('mage/adminhtml/grid');
6360

6461
require(deps, function(<?= ($block->getDependencyJsObject() ? 'registry' : '') ?>){
65-
<?php //TODO: getJsObjectName and getRowClickCallback has unexpected behavior. Should be removed ?>
62+
<?php //TODO: getJsObjectName and getRowClickCallback has unexpected behavior. Should be removed ?>
6663

67-
<?php if ($block->getDependencyJsObject()): ?>
68-
registry.get('<?= /* @escapeNotVerified */ $block->getDependencyJsObject() ?>', function (<?= /* @escapeNotVerified */ $block->getDependencyJsObject() ?>) {
69-
<?php endif; ?>
64+
<?php if ($block->getDependencyJsObject()) : ?>
65+
registry.get('<?= $block->escapeJs($block->getDependencyJsObject()) ?>', function (<?= $block->escapeJs($block->getDependencyJsObject()) ?>) {
66+
<?php endif; ?>
7067

71-
<?= /* @escapeNotVerified */ $block->getJsObjectName() ?> = new varienGrid('<?= /* @escapeNotVerified */ $block->getId() ?>', '<?= /* @escapeNotVerified */ $block->getGridUrl() ?>', '<?= /* @escapeNotVerified */ $block->getVarNamePage() ?>', '<?= /* @escapeNotVerified */ $block->getVarNameSort() ?>', '<?= /* @escapeNotVerified */ $block->getVarNameDir() ?>', '<?= /* @escapeNotVerified */ $block->getVarNameFilter() ?>');
72-
<?= /* @escapeNotVerified */ $block->getJsObjectName() ?>.useAjax = '<?= /* @escapeNotVerified */ $block->getUseAjax() ?>';
73-
<?php if ($block->getRowClickCallback()): ?>
74-
<?= /* @escapeNotVerified */ $block->getJsObjectName() ?>.rowClickCallback = <?= /* @escapeNotVerified */ $block->getRowClickCallback() ?>;
75-
<?php endif; ?>
76-
<?php if ($block->getCheckboxCheckCallback()): ?>
77-
<?= /* @escapeNotVerified */ $block->getJsObjectName() ?>.checkboxCheckCallback = <?= /* @escapeNotVerified */ $block->getCheckboxCheckCallback() ?>;
78-
<?php endif; ?>
79-
<?php if ($block->getRowInitCallback()): ?>
80-
<?= /* @escapeNotVerified */ $block->getJsObjectName() ?>.initRowCallback = <?= /* @escapeNotVerified */ $block->getRowInitCallback() ?>;
81-
<?= /* @escapeNotVerified */ $block->getJsObjectName() ?>.rows.each(function(row){<?= /* @escapeNotVerified */ $block->getRowInitCallback() ?>(<?= /* @escapeNotVerified */ $block->getJsObjectName() ?>, row)});
82-
<?php endif; ?>
83-
<?php if ($block->getMassactionBlock()->isAvailable()): ?>
84-
<?= /* @escapeNotVerified */ $block->getMassactionBlock()->getJavaScript() ?>
85-
<?php endif ?>
68+
<?= $block->escapeJs($block->getJsObjectName()) ?> = new varienGrid('<?= $block->escapeJs($block->getId()) ?>', '<?= $block->escapeJs($block->getGridUrl()) ?>', '<?= $block->escapeJs($block->getVarNamePage()) ?>', '<?= $block->escapeJs($block->getVarNameSort()) ?>', '<?= $block->escapeJs($block->getVarNameDir()) ?>', '<?= $block->escapeJs($block->getVarNameFilter()) ?>');
69+
<?= $block->escapeJs($block->getJsObjectName()) ?>.useAjax = '<?= $block->escapeJs($block->getUseAjax()) ?>';
70+
<?php if ($block->getRowClickCallback()) : ?>
71+
<?= $block->escapeJs($block->getJsObjectName()) ?>.rowClickCallback = <?= /* @noEscape */ $block->getRowClickCallback() ?>;
72+
<?php endif; ?>
73+
<?php if ($block->getCheckboxCheckCallback()) : ?>
74+
<?= $block->escapeJs($block->getJsObjectName()) ?>.checkboxCheckCallback = <?= /* @noEscape */ $block->getCheckboxCheckCallback() ?>;
75+
<?php endif; ?>
76+
<?php if ($block->getRowInitCallback()) : ?>
77+
<?= $block->escapeJs($block->getJsObjectName()) ?>.initRowCallback = <?= /* @noEscape */ $block->getRowInitCallback() ?>;
78+
<?= $block->escapeJs($block->getJsObjectName()) ?>.rows.each(function(row){<?= /* @noEscape */ $block->getRowInitCallback() ?>(<?= $block->escapeJs($block->getJsObjectName()) ?>, row)});
79+
<?php endif; ?>
80+
<?php if ($block->getMassactionBlock()->isAvailable()) : ?>
81+
<?= /* @noEscape */ $block->getMassactionBlock()->getJavaScript() ?>
82+
<?php endif ?>
8683

87-
<?php if ($block->getDependencyJsObject()): ?>
84+
<?php if ($block->getDependencyJsObject()) : ?>
8885
});
89-
<?php endif; ?>
86+
<?php endif; ?>
9087

9188
});
9289
</script>

0 commit comments

Comments
 (0)