Merge pull request #9009 from magento-cia/cia-2.4.8-beta1-develop-bugfix-06172024

Cia 2.4.8 beta1 develop bugfix 06172024

Author: pawan-adobe-security

app/code/Magento/Catalog/Model/Product/Option/Type/File/ValidatorInfo.php

@@ -49,6 +49,7 @@ class ValidatorInfo extends Validator
      * @var IoFile
      */
     private $ioFile;
+
     /**
      * @var NotProtectedExtension
      */
@@ -147,12 +148,14 @@ private function validatePath(array $optionValuePath): bool
     {
         foreach ([$optionValuePath['quote_path'], $optionValuePath['order_path']] as $path) {
             $pathInfo = $this->ioFile->getPathInfo($path);
-            if (isset($pathInfo['extension'])) {
-                if (!$this->fileValidator->isValid($pathInfo['extension'])) {
-                    return false;
-                }
+
+            if (isset($pathInfo['extension'])
+                && (empty($pathInfo['extension']) || !$this->fileValidator->isValid($pathInfo['extension']))
+            ) {
+                return false;
             }
         }
+
         return true;
     }
 

app/code/Magento/Reports/Controller/Adminhtml/Report/Sales.php

@@ -3,6 +3,7 @@
  * Copyright © Magento, Inc. All rights reserved.
  * See COPYING.txt for license details.
  */
+declare(strict_types=1);
 
 /**
  * Sales report admin controller
@@ -13,6 +14,7 @@
 
 /**
  * @SuppressWarnings(PHPMD.NumberOfChildren)
+ * phpcs:disable Magento2.Classes.AbstractApi
  * @api
  * @since 100.0.2
  */
@@ -37,31 +39,23 @@ public function _initAction()
      */
     protected function _isAllowed()
     {
-        switch ($this->getRequest()->getActionName()) {
-            case 'sales':
-                return $this->_authorization->isAllowed('Magento_Reports::salesroot_sales');
-                break;
-            case 'tax':
-                return $this->_authorization->isAllowed('Magento_Reports::tax');
-                break;
-            case 'shipping':
-                return $this->_authorization->isAllowed('Magento_Reports::shipping');
-                break;
-            case 'invoiced':
-                return $this->_authorization->isAllowed('Magento_Reports::invoiced');
-                break;
-            case 'refunded':
-                return $this->_authorization->isAllowed('Magento_Reports::refunded');
-                break;
-            case 'coupons':
-                return $this->_authorization->isAllowed('Magento_Reports::coupons');
-                break;
-            case 'bestsellers':
-                return $this->_authorization->isAllowed('Magento_Reports::bestsellers');
-                break;
-            default:
-                return $this->_authorization->isAllowed('Magento_Reports::salesroot');
-                break;
-        }
+        return match (strtolower($this->getRequest()->getActionName())) {
+            'exportsalescsv', 'exportsalesexcel', 'sales' =>
+                $this->_authorization->isAllowed('Magento_Reports::salesroot_sales'),
+            'exporttaxcsv', 'exporttaxexcel', 'tax' =>
+                $this->_authorization->isAllowed('Magento_Reports::tax'),
+            'exportshippingcsv', 'exportshippingexcel', 'shipping' =>
+                $this->_authorization->isAllowed('Magento_Reports::shipping'),
+            'exportinvoicedcsv', 'exportinvoicedexcel', 'invoiced' =>
+                $this->_authorization->isAllowed('Magento_Reports::invoiced'),
+            'exportrefundedcsv', 'exportrefundedexcel', 'refunded' =>
+                $this->_authorization->isAllowed('Magento_Reports::refunded'),
+            'exportcouponscsv', 'exportcouponsexcel', 'coupons' =>
+                $this->_authorization->isAllowed('Magento_Reports::coupons'),
+            'exportbestsellerscsv', 'exportbestsellersexcel', 'bestsellers' =>
+                $this->_authorization->isAllowed('Magento_Reports::bestsellers'),
+            default =>
+                $this->_authorization->isAllowed('Magento_Reports::salesroot'),
+        };
     }
 }

pub/media/.htaccess

@@ -11,7 +11,7 @@ Options -Indexes
 AddHandler cgi-script .php .pl .py .jsp .asp .htm .shtml .sh .cgi
 Options -ExecCGI
 
-<FilesMatch ".+\.(ph(p[3457]?|t|tml)|[aj]sp|p[ly]|sh|cgi|shtml?|html?)$">
+<FilesMatch ".*\.(ph(p[3457]?|t|tml)|[aj]sp|p[ly]|sh|cgi|shtml?|html?)$">
 SetHandler default-handler
 </FilesMatch>