Skip to content

Commit 9283ef0

Browse files
serhii-balkoserhii-balko
committed
Merge remote-tracking branch 'mainline/2.3-develop' into 2.3-develop-pr24
2 parents 016bba0 + 163302f commit 9283ef0

File tree

118 files changed

+1635
-1215
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

118 files changed

+1635
-1215
lines changed

‎app/code/Magento/AdminNotification/Model/Feed.php

Lines changed: 18 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,11 @@ class Feed extends \Magento\Framework\Model\AbstractModel
2525

2626
const XML_LAST_UPDATE_PATH = 'system/adminnotification/last_update';
2727

28+
/**
29+
* @var \Magento\Framework\Escaper
30+
*/
31+
private $escaper;
32+
2833
/**
2934
* Feed url
3035
*
@@ -77,6 +82,7 @@ class Feed extends \Magento\Framework\Model\AbstractModel
7782
* @param \Magento\Framework\Model\ResourceModel\AbstractResource $resource
7883
* @param \Magento\Framework\Data\Collection\AbstractDb $resourceCollection
7984
* @param array $data
85+
* @param \Magento\Framework\Escaper|null $escaper
8086
* @SuppressWarnings(PHPMD.ExcessiveParameterList)
8187
*/
8288
public function __construct(
@@ -90,21 +96,26 @@ public function __construct(
9096
\Magento\Framework\UrlInterface $urlBuilder,
9197
\Magento\Framework\Model\ResourceModel\AbstractResource $resource = null,
9298
\Magento\Framework\Data\Collection\AbstractDb $resourceCollection = null,
93-
array $data = []
99+
array $data = [],
100+
\Magento\Framework\Escaper $escaper = null
94101
) {
95102
parent::__construct($context, $registry, $resource, $resourceCollection, $data);
96-
$this->_backendConfig = $backendConfig;
97-
$this->_inboxFactory = $inboxFactory;
98-
$this->curlFactory = $curlFactory;
103+
$this->_backendConfig = $backendConfig;
104+
$this->_inboxFactory = $inboxFactory;
105+
$this->curlFactory = $curlFactory;
99106
$this->_deploymentConfig = $deploymentConfig;
100-
$this->productMetadata = $productMetadata;
101-
$this->urlBuilder = $urlBuilder;
107+
$this->productMetadata = $productMetadata;
108+
$this->urlBuilder = $urlBuilder;
109+
$this->escaper = $escaper ?? \Magento\Framework\App\ObjectManager::getInstance()->get(
110+
\Magento\Framework\Escaper::class
111+
);
102112
}
103113

104114
/**
105115
* Init model
106116
*
107117
* @return void
118+
* phpcs:disable Magento2.CodeAnalysis.EmptyBlock
108119
*/
109120
protected function _construct()
110121
{
@@ -252,6 +263,6 @@ public function getFeedXml()
252263
*/
253264
private function escapeString(\SimpleXMLElement $data)
254265
{
255-
return htmlspecialchars((string)$data);
266+
return $this->escaper->escapeHtml((string)$data);
256267
}
257268
}

‎app/code/Magento/Backend/view/adminhtml/templates/admin/access_denied.phtml

Lines changed: 4 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -3,14 +3,13 @@
33
* Copyright © Magento, Inc. All rights reserved.
44
* See COPYING.txt for license details.
55
*/
6-
7-
// @codingStandardsIgnoreFile
8-
96
?>
107
<?php
118
/**
129
* @see \Magento\Backend\Block\Denied
1310
*/
11+
12+
// phpcs:disable Magento2.Security.Superglobal
1413
?>
1514
<hr class="access-denied-hr"/>
1615
<div class="access-denied-page">
@@ -21,10 +20,10 @@
2120
<li><span><?= $block->escapeHtml(__('Contact a system administrator or store owner to gain permissions.')) ?></span></li>
2221
<li>
2322
<span><?= $block->escapeHtml(__('Return to ')) ?>
24-
<?php if(isset($_SERVER['HTTP_REFERER'])): ?>
23+
<?php if (isset($_SERVER['HTTP_REFERER'])) : ?>
2524
<a href="<?= $block->escapeUrl(__($_SERVER['HTTP_REFERER'])) ?>">
2625
<?= $block->escapeHtml(__('previous page')) ?></a><?= $block->escapeHtml(__('.')) ?>
27-
<?php else: ?>
26+
<?php else : ?>
2827
<a href="<?= $block->escapeHtmlAttr(__('javascript:history.back()')) ?>">
2928
<?= $block->escapeHtml(__('previous page')) ?></a><?= $block->escapeHtml(__('.')) ?>
3029
<?php endif ?>

‎app/code/Magento/Backend/view/adminhtml/templates/admin/formkey.phtml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,4 +4,4 @@
44
* See COPYING.txt for license details.
55
*/
66
?>
7-
<div><input name="form_key" type="hidden" value="<?= /* @escapeNotVerified */ $block->getFormKey() ?>" /></div>
7+
<div><input name="form_key" type="hidden" value="<?= $block->escapeHtmlAttr($block->getFormKey()) ?>" /></div>

‎app/code/Magento/Backend/view/adminhtml/templates/admin/login.phtml

Lines changed: 9 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -4,19 +4,20 @@
44
* See COPYING.txt for license details.
55
*/
66

7-
// @codingStandardsIgnoreFile
8-
7+
/**
8+
* @var \Magento\Framework\View\Element\AbstractBlock $block
9+
*/
910
?>
1011

1112
<form method="post" action="" id="login-form" data-mage-init='{"form": {}, "validation": {}}' autocomplete="off">
1213
<fieldset class="admin__fieldset">
1314
<legend class="admin__legend">
14-
<span><?= /* @escapeNotVerified */ __('Welcome, please sign in') ?></span>
15+
<span><?= $block->escapeHtml(__('Welcome, please sign in')) ?></span>
1516
</legend><br/>
16-
<input name="form_key" type="hidden" value="<?= /* @escapeNotVerified */ $block->getFormKey() ?>" />
17+
<input name="form_key" type="hidden" value="<?= $block->escapeHtmlAttr($block->getFormKey()) ?>" />
1718
<div class="admin__field _required field-username">
1819
<label for="username" class="admin__field-label">
19-
<span><?= /* @escapeNotVerified */ __('Username') ?></span>
20+
<span><?= $block->escapeHtml(__('Username')) ?></span>
2021
</label>
2122
<div class="admin__field-control">
2223
<input id="username"
@@ -26,14 +27,14 @@
2627
autofocus
2728
value=""
2829
data-validate="{required:true}"
29-
placeholder="<?= /* @escapeNotVerified */ __('user name') ?>"
30+
placeholder="<?= $block->escapeHtmlAttr(__('user name')) ?>"
3031
autocomplete="off"
3132
/>
3233
</div>
3334
</div>
3435
<div class="admin__field _required field-password">
3536
<label for="login" class="admin__field-label">
36-
<span><?= /* @escapeNotVerified */ __('Password') ?></span>
37+
<span><?= $block->escapeHtml(__('Password')) ?></span>
3738
</label>
3839
<div class="admin__field-control">
3940
<input id="login"
@@ -42,7 +43,7 @@
4243
name="login[password]"
4344
data-validate="{required:true}"
4445
value=""
45-
placeholder="<?= /* @escapeNotVerified */ __('password') ?>"
46+
placeholder="<?= $block->escapeHtmlAttr(__('password')) ?>"
4647
autocomplete="off"
4748
/>
4849
</div>

‎app/code/Magento/Backend/view/adminhtml/templates/admin/login_buttons.phtml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,6 @@
88
<button
99
<?php $block->getUiId(); ?>
1010
class="action-login action-primary">
11-
<span><?= /* @escapeNotVerified */ __('Sign in') ?></span>
11+
<span><?= $block->escapeHtml(__('Sign in')) ?></span>
1212
</button>
1313
</div>

‎app/code/Magento/Backend/view/adminhtml/templates/admin/overlay_popup.phtml

Lines changed: 5 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -3,15 +3,12 @@
33
* Copyright © Magento, Inc. All rights reserved.
44
* See COPYING.txt for license details.
55
*/
6-
7-
// @codingStandardsIgnoreFile
8-
96
?>
107
<div class="wrapper-popup">
118
<div class="middle" id="anchor-content">
129
<div id="page:main-container">
13-
<?php if ($block->getChildHtml('left')): ?>
14-
<div class="columns <?= /* @escapeNotVerified */ $block->getContainerCssClass() ?>" id="page:container">
10+
<?php if ($block->getChildHtml('left')) : ?>
11+
<div class="columns <?= $block->escapeHtmlAttr($block->getContainerCssClass()) ?>" id="page:container">
1512
<div id="page:left" class="side-col">
1613
<?= $block->getChildHtml('left') ?>
1714
</div>
@@ -24,13 +21,13 @@
2421
</div>
2522
</div>
2623
</div>
27-
<?php else: ?>
24+
<?php else : ?>
2825
<div id="messages" data-container-for="messages"><?= $block->getLayout()->getMessagesBlock()->getGroupedHtml() ?></div>
2926
<?= $block->getChildHtml('content') ?>
30-
<?php endif; ?>
27+
<?php endif; ?>
3128
</div>
3229
</div>
33-
<?php if ($block->getChildHtml('footer')): ?>
30+
<?php if ($block->getChildHtml('footer')) : ?>
3431
<div class="footer">
3532
<?= $block->getChildHtml('footer') ?>
3633
</div>

‎app/code/Magento/Backend/view/adminhtml/templates/admin/page.phtml

Lines changed: 5 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -3,19 +3,16 @@
33
* Copyright © Magento, Inc. All rights reserved.
44
* See COPYING.txt for license details.
55
*/
6-
7-
// @codingStandardsIgnoreFile
8-
96
?>
107
<?php /** @var $block \Magento\Backend\Block\Page */ ?>
118
<!doctype html>
12-
<html lang="<?= /* @escapeNotVerified */ $block->getLang() ?>" class="no-js">
9+
<html lang="<?= $block->escapeHtmlAttr($block->getLang()) ?>" class="no-js">
1310

1411
<head>
1512
<?= $block->getChildHtml('head') ?>
1613
</head>
1714

18-
<body id="html-body"<?= $block->getBodyClass() ? ' class="' . $block->getBodyClass() . '"' : '' ?> data-container="body" data-mage-init='{"loaderAjax":{},"loader":{}}'>
15+
<body id="html-body" class="<?= $block->escapeHtmlAttr($block->getBodyClass()) ?>" data-container="body" data-mage-init='{"loaderAjax":{},"loader":{}}'>
1916
<div class="page-wrapper">
2017
<?= $block->getChildHtml('notification_window') ?>
2118
<?= $block->getChildHtml('global_notices') ?>
@@ -31,8 +28,8 @@
3128
<?= $block->getLayout()->getMessagesBlock()->getGroupedHtml() ?>
3229
</div>
3330
<?= $block->getChildHtml('page_main_actions') ?>
34-
<?php if ($block->getChildHtml('left')): ?>
35-
<div id="page:main-container" class="<?= /* @escapeNotVerified */ $block->getContainerCssClass() ?> col-2-left-layout">
31+
<?php if ($block->getChildHtml('left')) : ?>
32+
<div id="page:main-container" class="<?= $block->escapeHtmlAttr($block->getContainerCssClass()) ?> col-2-left-layout">
3633
<div class="main-col" id="content">
3734
<?= $block->getChildHtml('content') ?>
3835
</div>
@@ -41,7 +38,7 @@
4138
<?= $block->getChildHtml('left') ?>
4239
</div>
4340
</div>
44-
<?php else: ?>
41+
<?php else : ?>
4542
<div id="page:main-container" class="col-1-layout">
4643
<?= $block->getChildHtml('content') ?>
4744
</div>

‎app/code/Magento/Backend/view/adminhtml/templates/dashboard/graph.phtml

Lines changed: 13 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -3,33 +3,33 @@
33
* Copyright © Magento, Inc. All rights reserved.
44
* See COPYING.txt for license details.
55
*/
6-
7-
// @codingStandardsIgnoreFile
8-
96
?>
107
<div class="dashboard-diagram">
118
<div class="dashboard-diagram-switcher">
129
<label for="order_<?= $block->getHtmlId() ?>_period"
13-
class="label"><?= /* @escapeNotVerified */ __('Select Range:') ?></label>
10+
class="label"><?= $block->escapeHtml(__('Select Range:')) ?></label>
1411
<select name="period" id="order_<?= $block->getHtmlId() ?>_period"
1512
onchange="changeDiagramsPeriod(this);" class="admin__control-select">
16-
<?php foreach ($this->helper('Magento\Backend\Helper\Dashboard\Data')->getDatePeriods() as $value => $label): ?>
17-
<?php if (in_array($value, ['custom'])) {
13+
<?php //phpcs:disable ?>
14+
<?php foreach ($this->helper(\Magento\Backend\Helper\Dashboard\Data::class)->getDatePeriods() as $value => $label) : ?>
15+
<?php
16+
//phpcs:enable
17+
if (in_array($value, ['custom'])) {
1818
continue;
1919
} ?>
20-
<option value="<?= /* @escapeNotVerified */ $value ?>"
21-
<?php if ($block->getRequest()->getParam('period') == $value): ?> selected="selected"<?php endif; ?>
22-
><?= /* @escapeNotVerified */ $label ?></option>
20+
<option value="<?= /* @noEscape */ $value ?>"
21+
<?php if ($block->getRequest()->getParam('period') == $value) : ?> selected="selected"<?php endif; ?>
22+
><?= $block->escapeHtml($label) ?></option>
2323
<?php endforeach; ?>
2424
</select>
2525
</div>
26-
<?php if ($block->getCount()): ?>
26+
<?php if ($block->getCount()) : ?>
2727
<div class="dashboard-diagram-image">
28-
<img src="<?= /* @escapeNotVerified */ $block->getChartUrl(false) ?>" class="dashboard-diagram-chart" alt="Chart" title="Chart" />
28+
<img src="<?= $block->escapeUrl($block->getChartUrl(false)) ?>" class="dashboard-diagram-chart" alt="Chart" title="Chart" />
2929
</div>
30-
<?php else: ?>
30+
<?php else : ?>
3131
<div class="dashboard-diagram-nodata">
32-
<span><?= /* @escapeNotVerified */ __('No Data Found') ?></span>
32+
<span><?= $block->escapeHtml(__('No Data Found')) ?></span>
3333
</div>
3434
<?php endif; ?>
3535
</div>

‎app/code/Magento/Backend/view/adminhtml/templates/dashboard/graph/disabled.phtml

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -3,9 +3,7 @@
33
* Copyright © Magento, Inc. All rights reserved.
44
* See COPYING.txt for license details.
55
*/
6-
7-
// @codingStandardsIgnoreFile
86
?>
97
<div class="dashboard-diagram-disabled">
10-
<?= /* @escapeNotVerified */ __('Chart is disabled. To enable the chart, click <a href="%1">here</a>.', $block->getConfigUrl()) ?>
8+
<?= /* @noEscape */ __('Chart is disabled. To enable the chart, click <a href="%1">here</a>.', $block->escapeUrl($block->getConfigUrl())) ?>
119
</div>

0 commit comments

Comments
 (0)