Skip to content

Commit f47d494

Browse files
author
Sergey Kovalenko
committed
Merge remote-tracking branch 'remotes/origin/develop' into MAGETWO-56012
2 parents 94e035d + 522fad0 commit f47d494

File tree

126 files changed

+1109
-678
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

126 files changed

+1109
-678
lines changed

‎app/code/Magento/Bundle/Helper/Catalog/Product/Configuration.php

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -142,6 +142,7 @@ public function getBundleOptions(ItemInterface $item)
142142
. $this->pricingHelper->currency(
143143
$this->getSelectionFinalPrice($item, $bundleSelection)
144144
);
145+
$option['has_html'] = true;
145146
}
146147
}
147148

‎app/code/Magento/Bundle/Test/Unit/Helper/Catalog/Product/ConfigurationTest.php

Lines changed: 9 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -164,6 +164,9 @@ public function testGetBundleOptionsEmptyBundleSelectionIds()
164164
$this->assertEquals([], $this->helper->getBundleOptions($this->item));
165165
}
166166

167+
/**
168+
* @SuppressWarnings(PHPMD.ExcessiveMethodLength)
169+
*/
167170
public function testGetOptions()
168171
{
169172
$optionIds = 'a:1:{i:0;i:1;}';
@@ -254,8 +257,12 @@ public function testGetOptions()
254257

255258
$this->assertEquals(
256259
[
257-
0 => ['label' => 'title', 'value' => [0 => '1 x name <span class="price">$15.00</span>']],
258-
1 => ['label' => 'title', 'value' => 'value'],
260+
[
261+
'label' => 'title',
262+
'value' => ['1 x name <span class="price">$15.00</span>'],
263+
'has_html' => true,
264+
],
265+
['label' => 'title', 'value' => 'value'],
259266
],
260267
$this->helper->getOptions($this->item)
261268
);

‎app/code/Magento/Captcha/view/adminhtml/templates/default.phtml

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,7 @@
1919
id="captcha"
2020
class="admin__control-text"
2121
type="text"
22-
name="<?php /* @escapeNotVerified */ echo \Magento\Captcha\Helper\Data::INPUT_NAME_FIELD_VALUE ?>[<?php /* @escapeNotVerified */ echo $block->getFormId()?>]"
22+
name="<?php echo $block->escapeHtmlAttr(\Magento\Captcha\Helper\Data::INPUT_NAME_FIELD_VALUE) ?>[<?php echo $block->escapeHtml($block->getFormId())?>]"
2323
data-validate="{required:true}"/>
2424
<?php if ($captcha->isCaseSensitive()) :?>
2525
<div class="admin__field-note">
@@ -32,19 +32,19 @@
3232
<img
3333
id="captcha-reload"
3434
class="captcha-reload"
35-
src="<?php /* @escapeNotVerified */ echo $block->getViewFileUrl('Magento_Captcha::reload.png') ?>"
35+
src="<?php echo $block->escapeUrl($block->getViewFileUrl('Magento_Captcha::reload.png')) ?>"
3636
alt="<?php /* @escapeNotVerified */ echo __('Reload captcha') ?>"/>
3737
<img
38-
id="<?php /* @escapeNotVerified */ echo $block->getFormId() ?>"
39-
width="<?php /* @escapeNotVerified */ echo $block->getImgWidth() ?>"
40-
height="<?php /* @escapeNotVerified */ echo $block->getImgHeight() ?>"
41-
src="<?php /* @escapeNotVerified */ echo $captcha->getImgSrc() ?>" />
38+
id="<?php echo $block->escapeHtmlAttr($block->getFormId()) ?>"
39+
width="<?php /* @noEscape */ echo (float) $block->getImgWidth() ?>"
40+
height="<?php /* @noEscape */ echo (float) $block->getImgHeight() ?>"
41+
src="<?php echo $block->escapeUrl($captcha->getImgSrc()) ?>" />
4242
</div>
4343
<script>
4444
require(["prototype", "mage/captcha"], function(){
4545

4646
//<![CDATA[
47-
var captcha = new Captcha('<?php /* @escapeNotVerified */ echo $block->getRefreshUrl() ?>', '<?php /* @escapeNotVerified */ echo $block->getFormId() ?>');
47+
var captcha = new Captcha('<?php echo $block->escapeUrl($block->getRefreshUrl()) ?>', '<?php echo $block->escapeJs($block->getFormId()) ?>');
4848

4949
$('captcha-reload').observe('click', function () {
5050
captcha.refresh(this);

‎app/code/Magento/Captcha/view/frontend/templates/default.phtml

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -10,19 +10,19 @@
1010
<?php /* @var $captcha \Magento\Captcha\Model\DefaultModel */ ?>
1111
<?php /* @var $block \Magento\Captcha\Block\Captcha\DefaultCaptcha */ ?>
1212
<?php $captcha = $block->getCaptchaModel() ?>
13-
<div class="field captcha required" role="<?php /* @escapeNotVerified */ echo $block->getFormId()?>">
14-
<label for="captcha_<?php /* @escapeNotVerified */ echo $block->getFormId() ?>" class="label"><span><?php /* @escapeNotVerified */ echo __('Please type the letters below')?></span></label>
13+
<div class="field captcha required" role="<?php echo $block->escapeHtmlAttr($block->getFormId())?>">
14+
<label for="captcha_<?php echo $block->escapeHtmlAttr($block->getFormId()) ?>" class="label"><span><?php /* @escapeNotVerified */ echo __('Please type the letters below')?></span></label>
1515
<div class="control captcha">
16-
<input name="<?php /* @escapeNotVerified */ echo \Magento\Captcha\Helper\Data::INPUT_NAME_FIELD_VALUE ?>[<?php /* @escapeNotVerified */ echo $block->getFormId()?>]" type="text" class="input-text required-entry" data-validate="{required:true}" id="captcha_<?php /* @escapeNotVerified */ echo $block->getFormId() ?>" />
16+
<input name="<?php echo $block->escapeHtmlAttr(\Magento\Captcha\Helper\Data::INPUT_NAME_FIELD_VALUE) ?>[<?php echo $block->escapeHtmlAttr($block->getFormId())?>]" type="text" class="input-text required-entry" data-validate="{required:true}" id="captcha_<?php echo $block->escapeHtmlAttr($block->getFormId()) ?>" />
1717
<div class="nested">
1818
<div class="field captcha no-label"
19-
data-captcha="<?php /* @escapeNotVerified */ echo $block->getFormId()?>"
20-
id="captcha-container-<?php /* @escapeNotVerified */ echo $block->getFormId()?>"
21-
data-mage-init='{"captcha":{"url": "<?php /* @escapeNotVerified */ echo $block->getRefreshUrl()?>",
22-
"imageLoader": "<?php /* @escapeNotVerified */ echo $block->getViewFileUrl('images/loader-2.gif') ?>",
23-
"type": "<?php /* @escapeNotVerified */ echo $block->getFormId() ?>"}}'>
19+
data-captcha="<?php echo $block->escapeHtmlAttr($block->getFormId())?>"
20+
id="captcha-container-<?php echo $block->escapeHtmlAttr($block->getFormId())?>"
21+
data-mage-init='{"captcha":{"url": "<?php echo $block->escapeUrl($block->getRefreshUrl())?>",
22+
"imageLoader": "<?php echo $block->escapeUrl($block->getViewFileUrl('images/loader-2.gif')) ?>",
23+
"type": "<?php echo $block->escapeHtmlAttr($block->getFormId()) ?>"}}'>
2424
<div class="control captcha-image">
25-
<img alt="<?php /* @escapeNotVerified */ echo __('Please type the letters below')?>" class="captcha-img" height="<?php /* @escapeNotVerified */ echo $block->getImgHeight() ?>" src="<?php /* @escapeNotVerified */ echo $captcha->getImgSrc() ?>"/>
25+
<img alt="<?php /* @escapeNotVerified */ echo __('Please type the letters below')?>" class="captcha-img" height="<?php /* @noEscape */ echo (float) $block->getImgHeight() ?>" src="<?php echo $block->escapeUrl($captcha->getImgSrc()) ?>"/>
2626
<button type="button" class="action reload captcha-reload" title="<?php /* @escapeNotVerified */ echo __('Reload captcha') ?>"><span><?php /* @escapeNotVerified */ echo __('Reload captcha') ?></span></button>
2727
</div>
2828
</div>

‎app/code/Magento/Catalog/Block/Adminhtml/Category/Widget/Chooser.php

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -121,7 +121,7 @@ function (node, e) {
121121
}
122122
';
123123
} else {
124-
$chooserJsObject = $this->getId();
124+
$chooserJsObject = $this->escapeJs($this->getId());
125125
$js = '
126126
function (node, e) {
127127
' .

‎app/code/Magento/Catalog/Block/Adminhtml/Product/Widget/Chooser.php

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -202,7 +202,7 @@ function (node, e) {
202202
{jsObject}.categoryName = node.attributes.id != "none" ? node.text : false;
203203
}
204204
';
205-
$js = str_replace('{jsObject}', $this->getJsObjectName(), $js);
205+
$js = str_replace('{jsObject}', $this->escapeJs($this->getJsObjectName()), $js);
206206
return $js;
207207
}
208208

‎app/code/Magento/CatalogWidget/view/adminhtml/templates/product/widget/conditions.phtml

Lines changed: 10 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -6,16 +6,17 @@
66

77
// @codingStandardsIgnoreFile
88

9-
?>
10-
<?php
9+
/** @var \Magento\CatalogWidget\Block\Product\Widget\Conditions $block */
10+
1111
$element = $block->getElement();
12-
$fieldId = ($element->getHtmlContainerId()) ? ' id="' . $element->getHtmlContainerId() . '"' : '';
13-
$fieldClass = "field admin__field field-{$element->getId()} {$element->getCssClass()}";
14-
$fieldClass .= ($element->getRequired()) ? ' required' : '';
15-
$fieldAttributes = $fieldId . ' class="' . $fieldClass . '" ' . $block->getUiId('form-field', $element->getId());
12+
$fieldId = $element->getHtmlContainerId() ? ' id="' . $block->escapeHtmlAttr($element->getHtmlContainerId()) . '"' : '';
13+
$fieldClass = 'field admin__field field-' . $block->escapeHtmlAttr($element->getId()) . ' '
14+
. $block->escapeHtmlAttr($element->getCssClass());
15+
$fieldClass .= $element->getRequired() ? ' required' : '';
16+
$fieldAttributes = $fieldId . ' class="' . $fieldClass . '" '
17+
. $block->getUiId('form-field', $block->escapeHtmlAttr($element->getId()));
1618
?>
17-
18-
<div<?php /* @escapeNotVerified */ echo $fieldAttributes ?>>
19+
<div<?php /* @noEscape */ echo $fieldAttributes ?>>
1920
<?php echo $element->getLabelHtml() ?>
2021
<div class="control admin__field-control">
2122
<div class="rule-tree">
@@ -32,6 +33,6 @@ $fieldAttributes = $fieldId . ' class="' . $fieldClass . '" ' . $block->getUiId(
3233
"Magento_Rule/rules",
3334
"prototype"
3435
], function(VarienRulesForm){
35-
window.<?php echo $block->getHtmlId() ?> = new VarienRulesForm('<?php echo $block->getHtmlId() ?>', '<?php /* @escapeNotVerified */ echo $block->getNewChildUrl() ?>');
36+
window.<?php echo $block->escapeJs($block->getHtmlId()) ?> = new VarienRulesForm('<?php echo $block->escapeJs($block->getHtmlId()) ?>', '<?php echo $block->escapeUrl($block->getNewChildUrl()) ?>');
3637
});
3738
</script>

‎app/code/Magento/CatalogWidget/view/frontend/templates/product/widget/content/grid.phtml

Lines changed: 16 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -6,15 +6,9 @@
66

77
// @codingStandardsIgnoreFile
88

9+
/** @var \Magento\CatalogWidget\Block\Product\ProductsList $block */
910
?>
10-
<?php
11-
/**
12-
* Template for displaying products list widget
13-
*
14-
* @var $block \Magento\CatalogWidget\Block\Product\ProductsList
15-
*/
16-
?>
17-
<?php if ($exist = ($block->getProductCollection() && $block->getProductCollection()->getSize())):?>
11+
<?php if ($exist = ($block->getProductCollection() && $block->getProductCollection()->getSize())): ?>
1812
<?php
1913
$type = 'widget-product-grid';
2014

@@ -30,27 +24,28 @@
3024
$templateType = \Magento\Catalog\Block\Product\ReviewRendererInterface::DEFAULT_VIEW;
3125
$description = false;
3226
?>
33-
<div class="block widget block-products-list <?php /* @escapeNotVerified */ echo $mode; ?>">
34-
<?php if ($title):?>
27+
<div class="block widget block-products-list <?php /* @noEscape */ echo $mode; ?>">
28+
<?php if ($title): ?>
3529
<div class="block-title">
36-
<strong><?php /* @escapeNotVerified */ echo $title; ?></strong>
30+
<strong><?php echo $block->escapeHtml($title); ?></strong>
3731
</div>
3832
<?php endif ?>
3933
<div class="block-content">
40-
<?php /* @escapeNotVerified */ echo '<!-- ' . $image . '-->' ?>
41-
<div class="products-<?php /* @escapeNotVerified */ echo $mode; ?> <?php /* @escapeNotVerified */ echo $mode; ?>">
42-
<ol class="product-items <?php /* @escapeNotVerified */ echo $type; ?>">
34+
<?php /* @noEscape */ echo '<!-- ' . $image . '-->' ?>
35+
<div class="products-<?php /* @noEscape */ echo $mode; ?> <?php /* @noEscape */ echo $mode; ?>">
36+
<ol class="product-items <?php /* @noEscape */ echo $type; ?>">
4337
<?php $iterator = 1; ?>
4438
<?php foreach ($items as $_item): ?>
45-
<?php /* @escapeNotVerified */ echo($iterator++ == 1) ? '<li class="product-item">' : '</li><li class="product-item">' ?>
39+
<?php if ($iterator++ != 1): ?></li><?php endif ?>
40+
<li class="product-item">
4641
<div class="product-item-info">
47-
<a href="<?php /* @escapeNotVerified */ echo $block->getProductUrl($_item) ?>" class="product-item-photo">
42+
<a href="<?php echo $block->escapeUrl($block->getProductUrl($_item)) ?>" class="product-item-photo">
4843
<?php echo $block->getImage($_item, $image)->toHtml(); ?>
4944
</a>
5045
<div class="product-item-details">
5146
<strong class="product-item-name">
5247
<a title="<?php echo $block->escapeHtml($_item->getName()) ?>"
53-
href="<?php /* @escapeNotVerified */ echo $block->getProductUrl($_item) ?>"
48+
href="<?php echo $block->escapeUrl($block->getProductUrl($_item)) ?>"
5449
class="product-item-link">
5550
<?php echo $block->escapeHtml($_item->getName()) ?>
5651
</a>
@@ -70,7 +65,7 @@
7065
<?php if ($_item->isSaleable()): ?>
7166
<?php if ($_item->getTypeInstance()->hasRequiredOptions($_item)): ?>
7267
<button class="action tocart primary"
73-
data-mage-init='{"redirectUrl":{"url":"<?php /* @escapeNotVerified */ echo $block->getAddToCartUrl($_item) ?>"}}'
68+
data-mage-init='{"redirectUrl":{"url":"<?php echo $block->escapeUrl($block->getAddToCartUrl($_item)) ?>"}}'
7469
type="button" title="<?php /* @escapeNotVerified */ echo __('Add to Cart') ?>">
7570
<span><?php /* @escapeNotVerified */ echo __('Add to Cart') ?></span>
7671
</button>
@@ -80,7 +75,7 @@
8075
$postData = $postDataHelper->getPostData($block->getAddToCartUrl($_item), ['product' => $_item->getEntityId()])
8176
?>
8277
<button class="action tocart primary"
83-
data-post='<?php /* @escapeNotVerified */ echo $postData; ?>'
78+
data-post='<?php /* @noEscape */ echo $postData; ?>'
8479
type="button" title="<?php /* @escapeNotVerified */ echo __('Add to Cart') ?>">
8580
<span><?php /* @escapeNotVerified */ echo __('Add to Cart') ?></span>
8681
</button>
@@ -98,7 +93,7 @@
9893
<div class="actions-secondary" data-role="add-to-links">
9994
<?php if ($this->helper('Magento\Wishlist\Helper\Data')->isAllow() && $showWishlist): ?>
10095
<a href="#"
101-
data-post='<?php /* @escapeNotVerified */ echo $block->getAddToWishlistParams($_item); ?>'
96+
data-post='<?php /* @noEscape */ echo $block->getAddToWishlistParams($_item); ?>'
10297
class="action towishlist" data-action="add-to-wishlist"
10398
title="<?php /* @escapeNotVerified */ echo __('Add to Wish List') ?>">
10499
<span><?php /* @escapeNotVerified */ echo __('Add to Wish List') ?></span>
@@ -107,7 +102,7 @@
107102
<?php if ($block->getAddToCompareUrl() && $showCompare): ?>
108103
<?php $compareHelper = $this->helper('Magento\Catalog\Helper\Product\Compare');?>
109104
<a href="#" class="action tocompare"
110-
data-post='<?php /* @escapeNotVerified */ echo $compareHelper->getPostDataParams($_item);?>'
105+
data-post='<?php /* @noEscape */ echo $compareHelper->getPostDataParams($_item);?>'
111106
title="<?php /* @escapeNotVerified */ echo __('Add to Compare') ?>">
112107
<span><?php /* @escapeNotVerified */ echo __('Add to Compare') ?></span>
113108
</a>

‎app/code/Magento/Cms/view/adminhtml/templates/browser/content.phtml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@
1717
<div class="insert-actions">
1818
<?php echo $block->getButtonsHtml() ?>
1919
</div>
20-
<div class="title"><?php /* @escapeNotVerified */ echo $block->getHeaderText() ?></div>
20+
<div class="title"><?php echo $block->escapeHtml($block->getHeaderText()) ?></div>
2121
</div>
2222
</div>
2323
<div id="error-message" data-action="show-error"></div>

‎app/code/Magento/Cms/view/adminhtml/templates/browser/content/files.phtml

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -14,16 +14,16 @@ $_height = $block->getImagesHeight();
1414
?>
1515
<?php if ($block->getFilesCount() > 0): ?>
1616
<?php foreach ($block->getFiles() as $file): ?>
17-
<div data-row="file" class="filecnt" id="<?php /* @escapeNotVerified */ echo $block->getFileId($file) ?>">
18-
<p class="nm" style="height:<?php /* @escapeNotVerified */ echo $_height ?>px;width:<?php /* @escapeNotVerified */ echo $_width ?>px;">
17+
<div data-row="file" class="filecnt" id="<?php echo $block->escapeHtmlAttr($block->getFileId($file)) ?>">
18+
<p class="nm" style="height:<?php echo $block->escapeHtmlAttr($_height) ?>px;width:<?php echo $block->escapeHtmlAttr($_width) ?>px;">
1919
<?php if ($block->getFileThumbUrl($file)):?>
20-
<img src="<?php /* @escapeNotVerified */ echo $block->getFileThumbUrl($file) ?>" alt="<?php /* @escapeNotVerified */ echo $block->getFileName($file) ?>"/>
20+
<img src="<?php echo $block->escapeHtmlAttr($block->getFileThumbUrl($file)) ?>" alt="<?php echo $block->escapeHtmlAttr($block->getFileName($file)) ?>"/>
2121
<?php endif; ?>
2222
</p>
2323
<?php if ($block->getFileWidth($file)): ?>
24-
<small><?php /* @escapeNotVerified */ echo $block->getFileWidth($file) ?>x<?php /* @escapeNotVerified */ echo $block->getFileHeight($file) ?> <?php /* @escapeNotVerified */ echo __('px.') ?></small><br/>
24+
<small><?php echo $block->escapeHtml($block->getFileWidth($file)) ?>x<?php echo $block->escapeHtml($block->getFileHeight($file)) ?> <?php /* @escapeNotVerified */ echo __('px.') ?></small><br/>
2525
<?php endif; ?>
26-
<small><?php /* @escapeNotVerified */ echo $block->getFileShortName($file); ?></small>
26+
<small><?php echo $block->escapeHtml($block->getFileShortName($file)); ?></small>
2727
</div>
2828
<?php endforeach; ?>
2929
<?php else: ?>

0 commit comments

Comments
 (0)