Skip to content

Commit 9ae6c5d

Browse files
pawan-adobe-securitypawan-adobe-security
authored
Merge pull request #9020 from magento-cia/cia-2.4.8-beta1-develop-bugfix-06202024
Cia 2.4.8 beta1 develop bugfix 06202024
2 parents cc137f9 + 3c28ae8 commit 9ae6c5d

File tree

19 files changed

+107
-28
lines changed

19 files changed

+107
-28
lines changed

‎app/code/Magento/Newsletter/Controller/Adminhtml/Queue.php

Lines changed: 12 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -18,5 +18,16 @@ abstract class Queue extends \Magento\Backend\App\Action
1818
*
1919
* @see _isAllowed()
2020
*/
21-
const ADMIN_RESOURCE = 'Magento_Newsletter::queue';
21+
public const ADMIN_RESOURCE = 'Magento_Newsletter::queue';
22+
23+
/**
24+
* Checks the acl permission
25+
*
26+
* @return bool
27+
*/
28+
protected function _isAllowed()
29+
{
30+
return ($this->_authorization->isAllowed(self::ADMIN_RESOURCE) &&
31+
$this->_authorization->isAllowed('Magento_Newsletter::template'));
32+
}
2233
}

‎app/code/Magento/Sales/Block/Adminhtml/Order/View.php

Lines changed: 1 addition & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -16,29 +16,21 @@
1616
class View extends \Magento\Backend\Block\Widget\Form\Container
1717
{
1818
/**
19-
* Block group
20-
*
2119
* @var string
2220
*/
2321
protected $_blockGroup = 'Magento_Sales';
2422

2523
/**
26-
* Core registry
27-
*
2824
* @var \Magento\Framework\Registry
2925
*/
3026
protected $_coreRegistry = null;
3127

3228
/**
33-
* Sales config
34-
*
3529
* @var \Magento\Sales\Model\Config
3630
*/
3731
protected $_salesConfig;
3832

3933
/**
40-
* Reorder helper
41-
*
4234
* @var \Magento\Sales\Helper\Reorder
4335
*/
4436
protected $_reorderHelper;
@@ -121,7 +113,7 @@ protected function _construct()
121113
);
122114
}
123115

124-
if ($this->_isAllowedAction('Magento_Sales::emails') && !$order->isCanceled()) {
116+
if ($this->_isAllowedAction('Magento_Sales::email') && !$order->isCanceled()) {
125117
$message = __('Are you sure you want to send an order email to customer?');
126118
$this->addButton(
127119
'send_notification',

‎app/code/Magento/Sales/Controller/Adminhtml/Order/Creditmemo/Cancel.php

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -6,15 +6,16 @@
66
namespace Magento\Sales\Controller\Adminhtml\Order\Creditmemo;
77

88
use Magento\Backend\App\Action;
9+
use Magento\Framework\App\Action\HttpPostActionInterface;
910

10-
class Cancel extends \Magento\Backend\App\Action
11+
class Cancel extends \Magento\Backend\App\Action implements HttpPostActionInterface
1112
{
1213
/**
1314
* Authorization level of a basic admin session
1415
*
1516
* @see _isAllowed()
1617
*/
17-
const ADMIN_RESOURCE = 'Magento_Sales::sales_creditmemo';
18+
public const ADMIN_RESOURCE = 'Magento_Sales::creditmemo';
1819

1920
/**
2021
* @var \Magento\Backend\Model\View\Result\ForwardFactory

‎app/code/Magento/Sales/Controller/Adminhtml/Order/Creditmemo/NewAction.php

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@ class NewAction extends \Magento\Backend\App\Action implements HttpGetActionInte
1515
*
1616
* @see _isAllowed()
1717
*/
18-
const ADMIN_RESOURCE = 'Magento_Sales::sales_creditmemo';
18+
public const ADMIN_RESOURCE = 'Magento_Sales::creditmemo';
1919

2020
/**
2121
* @var \Magento\Sales\Controller\Adminhtml\Order\CreditmemoLoader

‎app/code/Magento/Sales/Controller/Adminhtml/Order/Creditmemo/Save.php

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@ class Save extends \Magento\Backend\App\Action implements HttpPostActionInterfac
1818
*
1919
* @see _isAllowed()
2020
*/
21-
public const ADMIN_RESOURCE = 'Magento_Sales::sales_creditmemo';
21+
public const ADMIN_RESOURCE = 'Magento_Sales::creditmemo';
2222

2323
/**
2424
* @var \Magento\Sales\Controller\Adminhtml\Order\CreditmemoLoader

‎app/code/Magento/Sales/Controller/Adminhtml/Order/Creditmemo/Start.php

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@ class Start extends \Magento\Backend\App\Action implements HttpGetActionInterfac
1414
*
1515
* @see _isAllowed()
1616
*/
17-
const ADMIN_RESOURCE = 'Magento_Sales::sales_creditmemo';
17+
public const ADMIN_RESOURCE = 'Magento_Sales::creditmemo';
1818

1919
/**
2020
* Start create creditmemo action

‎app/code/Magento/Sales/Controller/Adminhtml/Order/Creditmemo/UpdateQty.php

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@ class UpdateQty extends \Magento\Backend\App\Action implements HttpPostActionInt
1515
*
1616
* @see _isAllowed()
1717
*/
18-
const ADMIN_RESOURCE = 'Magento_Sales::sales_creditmemo';
18+
public const ADMIN_RESOURCE = 'Magento_Sales::creditmemo';
1919

2020
/**
2121
* @var \Magento\Sales\Controller\Adminhtml\Order\CreditmemoLoader

‎app/code/Magento/Sales/Controller/Adminhtml/Order/Creditmemo/VoidAction.php

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -6,15 +6,16 @@
66
namespace Magento\Sales\Controller\Adminhtml\Order\Creditmemo;
77

88
use Magento\Backend\App\Action;
9+
use Magento\Framework\App\Action\HttpPostActionInterface;
910

10-
class VoidAction extends Action
11+
class VoidAction extends Action implements HttpPostActionInterface
1112
{
1213
/**
1314
* Authorization level of a basic admin session
1415
*
1516
* @see _isAllowed()
1617
*/
17-
const ADMIN_RESOURCE = 'Magento_Sales::sales_creditmemo';
18+
public const ADMIN_RESOURCE = 'Magento_Sales::creditmemo';
1819

1920
/**
2021
* @var \Magento\Sales\Controller\Adminhtml\Order\CreditmemoLoader

‎app/code/Magento/Sales/ViewModel/Order/Create/SidebarPermissionCheck.php

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
<?php
2+
/**
3+
* Copyright © Magento, Inc. All rights reserved.
4+
* See COPYING.txt for license details.
5+
*/
6+
declare(strict_types=1);
7+
8+
namespace Magento\Sales\ViewModel\Order\Create;
9+
10+
use Magento\Framework\AuthorizationInterface;
11+
use Magento\Framework\View\Element\Block\ArgumentInterface;
12+
13+
/**
14+
* Sidebar block permission check
15+
*/
16+
class SidebarPermissionCheck implements ArgumentInterface
17+
{
18+
/**
19+
* @var AuthorizationInterface
20+
*/
21+
private $authorization;
22+
23+
/**
24+
* Permissions constructor.
25+
*
26+
* @param AuthorizationInterface $authorization
27+
*/
28+
public function __construct(AuthorizationInterface $authorization)
29+
{
30+
$this->authorization = $authorization;
31+
}
32+
33+
/**
34+
* To check customer permission
35+
*
36+
* @return bool
37+
*/
38+
public function isAllowed(): bool
39+
{
40+
return $this->authorization->isAllowed('Magento_Customer::customer');
41+
}
42+
}

‎app/code/Magento/Sales/view/adminhtml/layout/sales_order_create_index.xml

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -36,6 +36,9 @@
3636
</block>
3737
<block class="Magento\Sales\Block\Adminhtml\Order\Create\Data" template="Magento_Sales::order/create/data.phtml" name="data">
3838
<block class="Magento\Sales\Block\Adminhtml\Order\Create\Sidebar" template="Magento_Sales::order/create/sidebar.phtml" name="sidebar">
39+
<arguments>
40+
<argument name="sideBarPermissionCheck" xsi:type="object">Magento\Sales\ViewModel\Order\Create\SidebarPermissionCheck</argument>
41+
</arguments>
3942
<block class="Magento\Sales\Block\Adminhtml\Order\Create\Sidebar\Cart" template="Magento_Sales::order/create/sidebar/items.phtml" name="cart"/>
4043
<block class="Magento\Sales\Block\Adminhtml\Order\Create\Sidebar\Wishlist" template="Magento_Sales::order/create/sidebar/items.phtml" name="wishlist"/>
4144
<block class="Magento\Sales\Block\Adminhtml\Order\Create\Sidebar\Reorder" template="Magento_Sales::order/create/sidebar/items.phtml" name="reorder"/>

‎app/code/Magento/Sales/view/adminhtml/layout/sales_order_create_load_block_data.xml

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,9 @@
1111
<referenceContainer name="content">
1212
<block class="Magento\Sales\Block\Adminhtml\Order\Create\Data" template="Magento_Sales::order/create/data.phtml" name="data">
1313
<block class="Magento\Sales\Block\Adminhtml\Order\Create\Sidebar" template="Magento_Sales::order/create/sidebar.phtml" name="sidebar">
14+
<arguments>
15+
<argument name="sideBarPermissionCheck" xsi:type="object">Magento\Sales\ViewModel\Order\Create\SidebarPermissionCheck</argument>
16+
</arguments>
1417
<block class="Magento\Sales\Block\Adminhtml\Order\Create\Sidebar\Cart" template="Magento_Sales::order/create/sidebar/items.phtml" name="cart"/>
1518
<block class="Magento\Sales\Block\Adminhtml\Order\Create\Sidebar\Wishlist" template="Magento_Sales::order/create/sidebar/items.phtml" name="wishlist"/>
1619
<block class="Magento\Sales\Block\Adminhtml\Order\Create\Sidebar\Reorder" template="Magento_Sales::order/create/sidebar/items.phtml" name="reorder"/>

‎app/code/Magento/Sales/view/adminhtml/layout/sales_order_create_load_block_sidebar.xml

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,9 @@
99
<body>
1010
<referenceContainer name="content">
1111
<block class="Magento\Sales\Block\Adminhtml\Order\Create\Sidebar" template="Magento_Sales::order/create/sidebar.phtml" name="sidebar">
12+
<arguments>
13+
<argument name="sideBarPermissionCheck" xsi:type="object">Magento\Sales\ViewModel\Order\Create\SidebarPermissionCheck</argument>
14+
</arguments>
1215
<block class="Magento\Sales\Block\Adminhtml\Order\Create\Sidebar\Cart" template="Magento_Sales::order/create/sidebar/items.phtml" name="cart"/>
1316
<block class="Magento\Sales\Block\Adminhtml\Order\Create\Sidebar\Wishlist" template="Magento_Sales::order/create/sidebar/items.phtml" name="wishlist"/>
1417
<block class="Magento\Sales\Block\Adminhtml\Order\Create\Sidebar\Reorder" template="Magento_Sales::order/create/sidebar/items.phtml" name="reorder"/>

‎app/code/Magento/Sales/view/adminhtml/templates/order/create/sidebar.phtml

Lines changed: 18 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -4,19 +4,32 @@
44
* See COPYING.txt for license details.
55
*/
66

7+
use Magento\Framework\Escaper;
8+
use Magento\Framework\View\Helper\SecureHtmlRenderer;
9+
use Magento\Sales\Block\Adminhtml\Order\Create\Sidebar;
10+
use Magento\Sales\ViewModel\Order\Create\SidebarPermissionCheck;
11+
712
/**
8-
* @var \Magento\Sales\Block\Adminhtml\Order\Create\Sidebar $block
9-
* @var \Magento\Framework\View\Helper\SecureHtmlRenderer $secureRenderer
13+
* @var Sidebar $block
14+
* @var SecureHtmlRenderer $secureRenderer
15+
* @var Escaper $escaper
1016
*/
17+
18+
/**
19+
* @var SidebarPermissionCheck $sideBarPermissionCheck
20+
*/
21+
$sideBarPermissionCheck = $block->getData('sideBarPermissionCheck');
22+
1123
?>
24+
<?php if ($sideBarPermissionCheck->isAllowed()): ?>
1225
<div class="customer-current-activity-inner">
13-
<h4 class="customer-activity-title"><?= $block->escapeHtml(__('Customer\'s Activities')) ?></h4>
26+
<h4 class="customer-activity-title"><?= $escaper->escapeHtml(__('Customer\'s Activities')) ?></h4>
1427
<div class="create-order-sidebar-container">
1528
<?= $block->getChildHtml('top_button') ?>
1629
<?php foreach ($block->getLayout()->getChildBlocks($block->getNameInLayout()) as $_alias => $_child): ?>
1730
<?php if ($_alias != 'top_button' && $_alias != 'bottom_button'): ?>
1831
<?php if ($block->canDisplay($_child)): ?>
19-
<div class="order-sidebar-block" id="order-sidebar_<?= $block->escapeHtmlAttr($_alias) ?>">
32+
<div class="order-sidebar-block" id="order-sidebar_<?= $escaper->escapeHtmlAttr($_alias) ?>">
2033
<?= $block->getChildHtml($_alias) ?>
2134
</div>
2235
<?php endif; ?>
@@ -25,6 +38,7 @@
2538
<?= $block->getChildHtml('bottom_button') ?>
2639
</div>
2740
</div>
41+
<?php endif; ?>
2842
<?php $scriptString = <<<script
2943
require([
3044
"prototype",

‎app/code/Magento/Shipping/Controller/Adminhtml/Order/Shipment/NewAction.php

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@ class NewAction extends \Magento\Backend\App\Action implements HttpGetActionInte
1717
*
1818
* @see _isAllowed()
1919
*/
20-
const ADMIN_RESOURCE = 'Magento_Sales::shipment';
20+
public const ADMIN_RESOURCE = 'Magento_Sales::ship';
2121

2222
/**
2323
* @var \Magento\Shipping\Controller\Adminhtml\Order\ShipmentLoader

‎app/code/Magento/Shipping/Controller/Adminhtml/Order/Shipment/Save.php

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,7 @@ class Save extends \Magento\Backend\App\Action implements HttpPostActionInterfac
2222
*
2323
* @see _isAllowed()
2424
*/
25-
const ADMIN_RESOURCE = 'Magento_Sales::shipment';
25+
public const ADMIN_RESOURCE = 'Magento_Sales::ship';
2626

2727
/**
2828
* @var \Magento\Shipping\Controller\Adminhtml\Order\ShipmentLoader

‎app/code/Magento/Shipping/Controller/Adminhtml/Order/Shipment/Start.php

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@ class Start extends \Magento\Backend\App\Action implements HttpGetActionInterfac
1515
*
1616
* @see _isAllowed()
1717
*/
18-
const ADMIN_RESOURCE = 'Magento_Sales::shipment';
18+
public const ADMIN_RESOURCE = 'Magento_Sales::ship';
1919

2020
/**
2121
* Start create shipment action

‎app/code/Magento/Shipping/etc/acl.xml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@
1313
<resource id="Magento_Backend::stores_settings">
1414
<resource id="Magento_Config::config">
1515
<resource id="Magento_Shipping::config_shipping" title="Shipping Settings Section" translate="title" sortOrder="5" />
16-
<resource id="Magento_Shipping::shipping_policy" title="Shipping Policy Parameters Section" translate="title" sortOrder="5" />
16+
<resource id="Magento_Shipping::shipping_policy" title="Shipping Policy Parameters Section" translate="title" sortOrder="5" disabled="true" />
1717
<resource id="Magento_Shipping::carriers" title="Delivery Methods Section" translate="title" sortOrder="5" />
1818
</resource>
1919
</resource>

‎dev/tests/integration/testsuite/Magento/Sales/Controller/Adminhtml/Order/Creditmemo/SaveTest.php

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,11 @@
2121
*/
2222
class SaveTest extends AbstractCreditmemoControllerTest
2323
{
24+
/**
25+
* @var string
26+
*/
27+
protected $resource = 'Magento_Sales::creditmemo';
28+
2429
/**
2530
* @var string
2631
*/

‎dev/tests/integration/testsuite/Magento/Shipping/Controller/Adminhtml/Order/Shipment/SaveTest.php

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,11 @@
1818
*/
1919
class SaveTest extends AbstractShipmentControllerTest
2020
{
21+
/**
22+
* @var string
23+
*/
24+
protected $resource = 'Magento_Sales::ship';
25+
2126
/**
2227
* @var string
2328
*/
@@ -105,8 +110,7 @@ private function prepareRequest(array $params = [])
105110
]
106111
);
107112

108-
$data = $params ?? [];
109-
$this->getRequest()->setPostValue($data);
113+
$this->getRequest()->setPostValue($params);
110114

111115
return $order;
112116
}

0 commit comments

Comments
 (0)