Skip to content

Commit ee348f0

Browse files
author
Dmytro Voskoboinikov
committed
Merge branch 'merchant_beta' into MAGETWO-44160
2 parents 30c38a4 + 77fbc91 commit ee348f0

File tree

65 files changed

+3466
-1019
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

65 files changed

+3466
-1019
lines changed

‎app/code/Magento/Backend/Block/Widget/Grid.php

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -760,7 +760,7 @@ public function setSaveParametersInSession($flag)
760760
*/
761761
public function getJsObjectName()
762762
{
763-
return $this->getId() . 'JsObject';
763+
return preg_replace("~[^a-z0-9_]*~i", '', $this->getId()) . 'JsObject';
764764
}
765765

766766
/**

‎app/code/Magento/Backend/Block/Widget/Grid/Column/Filter/AbstractFilter.php

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -67,7 +67,7 @@ public function getColumn()
6767
*/
6868
protected function _getHtmlName()
6969
{
70-
return $this->getColumn()->getId();
70+
return $this->escapeHtml($this->getColumn()->getId());
7171
}
7272

7373
/**
@@ -77,7 +77,7 @@ protected function _getHtmlName()
7777
*/
7878
protected function _getHtmlId()
7979
{
80-
return $this->getColumn()->getHtmlId();
80+
return $this->escapeHtml($this->getColumn()->getHtmlId());
8181
}
8282

8383
/**
@@ -88,7 +88,7 @@ protected function _getHtmlId()
8888
*/
8989
public function getEscapedValue($index = null)
9090
{
91-
return htmlspecialchars((string)$this->getValue($index));
91+
return $this->escapeHtml((string)$this->getValue($index));
9292
}
9393

9494
/**

‎app/code/Magento/Backend/Test/Unit/Block/Widget/Grid/Column/Filter/TextTest.php

Lines changed: 68 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,68 @@
1+
<?php
2+
/**
3+
* Copyright © 2015 Magento. All rights reserved.
4+
* See COPYING.txt for license details.
5+
*/
6+
7+
namespace Magento\Backend\Test\Unit\Block\Widget\Grid\Column\Filter;
8+
9+
use Magento\Framework\TestFramework\Unit\Helper\ObjectManager as ObjectManagerHelper;
10+
11+
class TextTest extends \PHPUnit_Framework_TestCase
12+
{
13+
/** @var \Magento\Backend\Block\Widget\Grid\Column\Filter\Text*/
14+
protected $block;
15+
16+
/** @var ObjectManagerHelper */
17+
protected $objectManagerHelper;
18+
19+
/** @var \Magento\Backend\Block\Context|\PHPUnit_Framework_MockObject_MockObject */
20+
protected $context;
21+
22+
/** @var \Magento\Framework\DB\Helper|\PHPUnit_Framework_MockObject_MockObject */
23+
protected $helper;
24+
25+
/** @var \Magento\Framework\Escaper|\PHPUnit_Framework_MockObject_MockObject */
26+
protected $escaper;
27+
28+
protected function setUp()
29+
{
30+
$this->context = $this->getMockBuilder('Magento\Backend\Block\Context')
31+
->setMethods(['getEscaper'])
32+
->disableOriginalConstructor()
33+
->getMock();
34+
$this->escaper = $this->getMock('Magento\Framework\Escaper', ['escapeHtml'], [], '', false);
35+
$this->helper = $this->getMock('Magento\Framework\DB\Helper', [], [], '', false);
36+
37+
$this->context->expects($this->once())->method('getEscaper')->willReturn($this->escaper);
38+
39+
$this->objectManagerHelper = new ObjectManagerHelper($this);
40+
$this->block = $this->objectManagerHelper->getObject(
41+
'Magento\Backend\Block\Widget\Grid\Column\Filter\Text',
42+
[
43+
'context' => $this->context,
44+
'resourceHelper' => $this->helper
45+
]
46+
);
47+
}
48+
49+
public function testGetHtml()
50+
{
51+
$resultHtml = '<input type="text" name="escapedHtml" ' .
52+
'id="escapedHtml" value="escapedHtml" ' .
53+
'class="input-text admin__control-text no-changes" data-ui-id="filter-escapedhtml" />';
54+
55+
$column = $this->getMockBuilder('Magento\Backend\Block\Widget\Grid\Column')
56+
->setMethods(['getId', 'getHtmlId'])
57+
->disableOriginalConstructor()
58+
->getMock();
59+
60+
$this->block->setColumn($column);
61+
62+
$this->escaper->expects($this->any())->method('escapeHtml')->willReturn('escapedHtml');
63+
$column->expects($this->any())->method('getId')->willReturn('id');
64+
$column->expects($this->once())->method('getHtmlId')->willReturn('htmlId');
65+
66+
$this->assertEquals($resultHtml, $this->block->getHtml());
67+
}
68+
}

‎app/code/Magento/Backend/view/adminhtml/templates/widget/grid.phtml

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@ $numColumns = sizeof($block->getColumns());
2424
<?php if ($block->getCollection()): ?>
2525

2626
<?php if ($block->canDisplayContainer()): ?>
27-
<div id="<?php echo $block->getId() ?>" data-grid-id="<?php echo $block->getId() ?>">
27+
<div id="<?php echo $block->escapeHtml($block->getId()) ?>" data-grid-id="<?php echo $block->escapeHtml($block->getId()) ?>">
2828
<?php else: ?>
2929
<?php echo $block->getLayout()->getMessagesBlock()->getGroupedHtml() ?>
3030
<?php endif; ?>
@@ -50,17 +50,17 @@ $numColumns = sizeof($block->getColumns());
5050
<?php endif; ?>
5151
<?php $countRecords = $block->getCollection()->getSize(); ?>
5252
<div class="admin__control-support-text">
53-
<span id="<?php echo $block->getHtmlId() ?>-total-count" <?php echo $block->getUiId('total-count') ?>>
53+
<span id="<?php echo $block->escapeHtml($block->getHtmlId()) ?>-total-count" <?php echo $block->getUiId('total-count') ?>>
5454
<?php echo $countRecords ?>
5555
</span>
5656
<?php echo __('records found') ?>
57-
<span id="<?php echo $block->getHtmlId() ?>_massaction-count"
57+
<span id="<?php echo $block->escapeHtml($block->getHtmlId()) ?>_massaction-count"
5858
class="mass-select-info _empty"><strong data-role="counter">0</strong> <span><?php echo __('selected') ?></span></span>
5959
</div>
6060
<?php if ($block->getPagerVisibility()): ?>
6161
<div class="admin__data-grid-pager-wrap">
6262
<select name="<?php echo $block->getVarNameLimit() ?>"
63-
id="<?php echo $block->getHtmlId()?>_page-limit"
63+
id="<?php echo $block->escapeHtml($block->getHtmlId())?>_page-limit"
6464
onchange="<?php echo $block->getJsObjectName() ?>.loadByElement(this)" <?php echo $block->getUiId('per-page') ?>
6565
class="admin__control-select">
6666
<option value="20"<?php if ($block->getCollection()->getPageSize() == 20): ?>
@@ -79,7 +79,7 @@ $numColumns = sizeof($block->getColumns());
7979
selected="selected"<?php endif; ?>>200
8080
</option>
8181
</select>
82-
<label for="<?php echo $block->getHtmlId()?>_page-limit"
82+
<label for="<?php echo $block->escapeHtml($block->getHtmlId())?>_page-limit"
8383
class="admin__control-support-text"><?php echo __('per page') ?></label>
8484
<div class="admin__data-grid-pager">
8585
<?php $_curPage = $block->getCollection()->getCurPage() ?>
@@ -96,13 +96,13 @@ $numColumns = sizeof($block->getColumns());
9696
<?php endif; ?>
9797

9898
<input type="text"
99-
id="<?php echo $block->getHtmlId()?>_page-current"
99+
id="<?php echo $block->escapeHtml($block->getHtmlId())?>_page-current"
100100
name="<?php echo $block->getVarNamePage() ?>"
101101
value="<?php echo $_curPage ?>"
102102
class="admin__control-text"
103103
onkeypress="<?php echo $block->getJsObjectName() ?>.inputPage(event, '<?php echo $_lastPage ?>')" <?php echo $block->getUiId('current-page') ?> />
104104

105-
<label class="admin__control-support-text" for="<?php echo $block->getHtmlId()
105+
<label class="admin__control-support-text" for="<?php echo $block->escapeHtml($block->getHtmlId())
106106
?>_page-current">
107107
<?php echo __('of %1', '<span>' . $block->getCollection()->getLastPageNumber() . '</span>') ?>
108108
</label>
@@ -122,13 +122,13 @@ $numColumns = sizeof($block->getColumns());
122122
</div>
123123
<div class="admin__data-grid-wrap">
124124
<?php if ($block->getGridCssClass()): ?>
125-
<table class="<?php echo $block->getGridCssClass() ?> data-grid" id="<?php echo $block->getId() ?>_table">
125+
<table class="<?php echo $block->getGridCssClass() ?> data-grid" id="<?php echo $block->escapeHtml($block->getId()) ?>_table">
126126
<!-- Rendering column set -->
127127
<?php echo $block->getChildHtml('grid.columnSet'); ?>
128128
</table>
129129
<?php else: ?>
130130

131-
<table class="data-grid" id="<?php echo $block->getId() ?>_table">
131+
<table class="data-grid" id="<?php echo $block->escapeHtml($block->getId()) ?>_table">
132132
<!-- Rendering column set -->
133133
<?php echo $block->getChildHtml('grid.columnSet'); ?>
134134
</table>
@@ -161,7 +161,7 @@ $numColumns = sizeof($block->getColumns());
161161
registry.get('<?php echo $block->getDependencyJsObject() ?>', function (<?php echo $block->getDependencyJsObject() ?>) {
162162
<?php endif; ?>
163163

164-
<?php echo $block->getJsObjectName() ?> = new varienGrid('<?php echo $block->getId() ?>', '<?php echo $block->getGridUrl() ?>', '<?php echo $block->getVarNamePage() ?>', '<?php echo $block->getVarNameSort() ?>', '<?php echo $block->getVarNameDir() ?>', '<?php echo $block->getVarNameFilter() ?>');
164+
<?php echo $block->getJsObjectName() ?> = new varienGrid('<?php echo $block->escapeHtml($block->getId()) ?>', '<?php echo $block->getGridUrl() ?>', '<?php echo $block->getVarNamePage() ?>', '<?php echo $block->getVarNameSort() ?>', '<?php echo $block->getVarNameDir() ?>', '<?php echo $block->getVarNameFilter() ?>');
165165
<?php echo $block->getJsObjectName() ?>.useAjax = <?php echo $block->getUseAjax() ? 'true' : 'false' ?>;
166166
<?php if ($block->getRowClickCallback()): ?>
167167
<?php echo $block->getJsObjectName() ?>.rowClickCallback = <?php echo $block->getRowClickCallback() ?>;

0 commit comments

Comments
 (0)