AC-9924 AC-11581 AC-12392 improve ACL check

Author: tranthienbinh1989

app/code/Magento/Backend/Controller/Adminhtml/System/Design.php

@@ -14,10 +14,10 @@ abstract class Design extends Action
      *
      * @see _isAllowed()
      */
-    const ADMIN_RESOURCE = 'Magento_Backend::schedule';
+    public const ADMIN_RESOURCE = 'Magento_Backend::schedule';
 
     /**
-     * Core registry
+     * Core registry instance
      *
      * @var \Magento\Framework\Registry
      */

app/code/Magento/Quote/etc/webapi.xml

@@ -13,7 +13,6 @@
         <service class="Magento\Quote\Api\CartRepositoryInterface" method="get"/>
         <resources>
             <resource ref="Magento_Cart::manage" />
-            <resource ref="Magento_Customer::customer" />
         </resources>
     </route>
     <route url="/V1/carts/search" method="GET">

app/code/Magento/Sales/Controller/Adminhtml/Order/Invoice/Cancel.php

@@ -6,7 +6,10 @@
  */
 namespace Magento\Sales\Controller\Adminhtml\Order\Invoice;
 
-class Cancel extends \Magento\Sales\Controller\Adminhtml\Invoice\AbstractInvoice\View
+use Magento\Framework\App\Action\HttpPostActionInterface;
+use Magento\Sales\Controller\Adminhtml\Invoice\AbstractInvoice\View;
+
+class Cancel extends View implements HttpPostActionInterface
 {
     /**
      * Authorization level of a basic admin session

app/code/Magento/Sales/Controller/Adminhtml/Order/Invoice/Capture.php

@@ -6,7 +6,10 @@
  */
 namespace Magento\Sales\Controller\Adminhtml\Order\Invoice;
 
-class Capture extends \Magento\Sales\Controller\Adminhtml\Invoice\AbstractInvoice\View
+use Magento\Framework\App\Action\HttpPostActionInterface;
+use Magento\Sales\Controller\Adminhtml\Invoice\AbstractInvoice\View;
+
+class Capture extends View implements HttpPostActionInterface
 {
     /**
      * Authorization level of a basic admin session

app/code/Magento/Sales/Controller/Adminhtml/Order/Invoice/UpdateQty.php

@@ -18,7 +18,8 @@
 use Magento\Sales\Controller\Adminhtml\Invoice\AbstractInvoice\View as AbstractView;
 
 /**
- * Class UpdateQty
+ * Class UpdateQty to update invoice items qty
+ *
  * @SuppressWarnings(PHPMD.CouplingBetweenObjects)
  */
 class UpdateQty extends AbstractView implements HttpPostActionInterface

app/code/Magento/Sales/Controller/Adminhtml/Order/Invoice/VoidAction.php

@@ -6,7 +6,10 @@
  */
 namespace Magento\Sales\Controller\Adminhtml\Order\Invoice;
 
-class VoidAction extends \Magento\Sales\Controller\Adminhtml\Invoice\AbstractInvoice\View
+use Magento\Framework\App\Action\HttpPostActionInterface;
+use Magento\Sales\Controller\Adminhtml\Invoice\AbstractInvoice\View;
+
+class VoidAction extends View implements HttpPostActionInterface
 {
     /**
      * Authorization level of a basic admin session

dev/tests/integration/testsuite/Magento/Sales/Controller/Adminhtml/Order/Invoice/SaveTest.php

@@ -33,6 +33,11 @@ class SaveTest extends AbstractInvoiceControllerTest
     /** @var Item */
     private $orderItemResource;
 
+    /**
+     * @var string
+     */
+    protected $resource = "Magento_Sales::invoice";
+
     /**
      * @inheritdoc
      */