From 4654a07243259798bd83e976df37136a87d62443 Mon Sep 17 00:00:00 2001 From: Aleksey Razbakov Date: Thu, 13 Oct 2016 18:14:18 +0200 Subject: [PATCH 1/4] update magento version --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index 6956f8c0328..4a27ad9f86f 100644 --- a/README.md +++ b/README.md @@ -16,5 +16,5 @@ To generate `composer.json` and install magento for the first time run: ``` composer require magento-hackathon/magento-composer-installer ~3.0 composer require aydin-hassan/magento-core-composer-installer ~1.2 -composer require firegento/magento ~1.9.2.4 +composer require firegento/magento ~1.9.3 ``` From 7456f7b33a8c8ec0f62cbb93b7a9fd097759cd28 Mon Sep 17 00:00:00 2001 From: Aleksey Razbakov Date: Tue, 15 Nov 2016 15:39:33 +0100 Subject: [PATCH 2/4] add magento 1.9.3.1 --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index 4a27ad9f86f..30e9f36ff36 100644 --- a/README.md +++ b/README.md @@ -16,5 +16,5 @@ To generate `composer.json` and install magento for the first time run: ``` composer require magento-hackathon/magento-composer-installer ~3.0 composer require aydin-hassan/magento-core-composer-installer ~1.2 -composer require firegento/magento ~1.9.3 +composer require firegento/magento ~1.9.3.1 ``` From 998bd5cce6747a7d24134c1cedb756a7fe0a69bc Mon Sep 17 00:00:00 2001 From: Pascal Borkenhagen Date: Thu, 1 Jun 2017 10:02:57 +0200 Subject: [PATCH 3/4] Magento v1.9.3.3 --- RELEASE_NOTES.txt | 10 + app/Mage.php | 2 +- app/code/core/Mage/Admin/Model/Session.php | 3 + .../Mage/Adminhtml/Block/Checkout/Formkey.php | 52 + .../Adminhtml/Block/Notification/Symlink.php | 36 + .../Block/Widget/Grid/Column/Filter/Date.php | 4 +- .../core/Mage/Adminhtml/Model/Config/Data.php | 3 + .../Catalog/Product/GalleryController.php | 5 + .../controllers/MultishippingController.php | 16 + .../controllers/OnepageController.php | 25 + app/code/core/Mage/Checkout/etc/system.xml | 18 + .../Mage/Cms/Model/Wysiwyg/Images/Storage.php | 5 + .../Mage/Core/Controller/Front/Action.php | 10 + .../Mage/Core/Controller/Request/Http.php | 5 +- .../Mage/Core/Model/File/Validator/Image.php | 32 +- app/code/core/Mage/Core/etc/system.xml | 20 - .../Model/Convert/Adapter/Zend/Cache.php | 3 + .../Model/Convert/Container/Abstract.php | 55 +- .../Dataflow/Model/Convert/Parser/Csv.php | 10 +- .../Model/Convert/Parser/Xml/Excel.php | 7 +- .../ImportExport/Model/Import/Uploader.php | 5 + app/code/core/Mage/Paypal/Model/Config.php | 11 +- app/code/core/Mage/Paypal/Model/Ipn.php | 3 +- app/code/core/Mage/Sales/Model/Quote/Item.php | 5 +- .../Mage/Widget/Model/Widget/Instance.php | 6 +- .../core/Mage/XmlConnect/Helper/Image.php | 5 + .../Adminhtml/MobileController.php | 5 + .../adminhtml/default/default/layout/main.xml | 3 +- .../template/notification/formkey.phtml | 38 + .../template/notification/symlink.phtml | 34 + .../default/default/template/page/head.phtml | 2 +- .../template/checkout/cart/shipping.phtml | 1 + .../checkout/multishipping/billing.phtml | 1 + .../checkout/multishipping/shipping.phtml | 1 + .../template/checkout/onepage/billing.phtml | 1 + .../template/checkout/onepage/payment.phtml | 1 + .../template/checkout/onepage/shipping.phtml | 1 + .../checkout/onepage/shipping_method.phtml | 1 + .../persistent/checkout/onepage/billing.phtml | 1 + .../frontend/rwd/default/layout/page.xml | 2 +- .../template/checkout/cart/shipping.phtml | 1 + .../checkout/multishipping/addresses.phtml | 1 + .../checkout/multishipping/billing.phtml | 1 + .../template/checkout/onepage/payment.phtml | 1 + .../template/checkout/onepage/shipping.phtml | 1 + .../persistent/checkout/onepage/billing.phtml | 1 + app/etc/config.xml | 5 + app/locale/en_US/Mage_Adminhtml.csv | 2 + app/locale/en_US/Mage_Checkout.csv | 1 + app/locale/en_US/Mage_Core.csv | 1 + app/locale/en_US/Mage_Dataflow.csv | 2 + .../AssertUserAccessDeniedMessage.php | 2 +- .../AssertUserAccountInactiveMessage.php | 2 +- .../Constraint/AssertUserIsLockedMessage.php | 2 +- .../AssertUserWrongCredentialsMessage.php | 2 +- .../app/Mage/Paypal/Test/Block/Login.php | 3 +- downloader/Maged/Connect.php | 7 +- downloader/Maged/Controller.php | 41 +- downloader/Maged/Model/Session.php | 34 + js/lib/jquery/jquery-1.12.0.js | 11027 ++++++++++++++++ js/lib/jquery/jquery-1.12.0.min.js | 5 + js/lib/jquery/jquery-1.12.0.min.map | 1 + js/varien/payment.js | 2 +- skin/frontend/base/default/js/opcheckout.js | 2 +- var/package/Cm_RedisSession-1.9.3.3.xml | 18 + .../Interface_Adminhtml_Default-1.9.3.3.xml | 18 + ...nterface_Frontend_Base_Default-1.9.3.3.xml | 18 + .../Interface_Frontend_Default-1.9.3.3.xml | 18 + ...Interface_Frontend_Rwd_Default-1.9.3.3.xml | 18 + .../Interface_Install_Default-1.9.3.3.xml | 18 + var/package/Lib_Cm-1.9.3.3.xml | 18 + var/package/Lib_Credis-1.9.3.3.xml | 18 + var/package/Lib_Google_Checkout-1.9.3.3.xml | 18 + var/package/Lib_IDNA2-1.9.3.3.xml | 18 + var/package/Lib_Js_Calendar-1.51.1.9.xml | 18 + var/package/Lib_Js_Ext-1.9.3.3.xml | 18 + var/package/Lib_Js_Mage-1.9.3.3.xml | 18 + var/package/Lib_Js_Prototype-1.9.3.3.xml | 18 + var/package/Lib_Js_TinyMCE-3.5.11.8.xml | 18 + var/package/Lib_LinLibertineFont-2.8.14.9.xml | 18 + var/package/Lib_Mage-1.9.3.3.xml | 18 + var/package/Lib_Magento-1.9.3.3.xml | 18 + var/package/Lib_Pelago-1.9.3.3.xml | 18 + var/package/Lib_Phpseclib-1.9.3.3.xml | 18 + var/package/Lib_Unserialize-1.9.3.3.xml | 18 + var/package/Lib_Varien-1.9.3.3.xml | 18 + var/package/Lib_ZF-1.12.10.8.xml | 18 + var/package/Lib_ZF_Locale-1.12.10.8.xml | 19 + var/package/Mage_All_Latest-1.9.3.3.xml | 18 + var/package/Mage_Centinel-1.9.3.3.xml | 18 + var/package/Mage_Compiler-1.9.3.3.xml | 18 + var/package/Mage_Core_Adminhtml-1.9.3.3.xml | 18 + var/package/Mage_Core_Modules-1.9.3.3.xml | 18 + var/package/Mage_Downloader-1.9.3.3.xml | 18 + var/package/Mage_Locale_en_US-1.9.3.3.xml | 18 + var/package/Magento_Mobile-1.9.3.3.xml | 18 + var/package/Phoenix_Moneybookers-1.9.3.3.xml | 35 + 97 files changed, 12134 insertions(+), 73 deletions(-) create mode 100644 app/code/core/Mage/Adminhtml/Block/Checkout/Formkey.php create mode 100644 app/code/core/Mage/Adminhtml/Block/Notification/Symlink.php create mode 100644 app/design/adminhtml/default/default/template/notification/formkey.phtml create mode 100644 app/design/adminhtml/default/default/template/notification/symlink.phtml create mode 100644 js/lib/jquery/jquery-1.12.0.js create mode 100644 js/lib/jquery/jquery-1.12.0.min.js create mode 100644 js/lib/jquery/jquery-1.12.0.min.map create mode 100644 var/package/Cm_RedisSession-1.9.3.3.xml create mode 100644 var/package/Interface_Adminhtml_Default-1.9.3.3.xml create mode 100644 var/package/Interface_Frontend_Base_Default-1.9.3.3.xml create mode 100644 var/package/Interface_Frontend_Default-1.9.3.3.xml create mode 100644 var/package/Interface_Frontend_Rwd_Default-1.9.3.3.xml create mode 100644 var/package/Interface_Install_Default-1.9.3.3.xml create mode 100644 var/package/Lib_Cm-1.9.3.3.xml create mode 100644 var/package/Lib_Credis-1.9.3.3.xml create mode 100644 var/package/Lib_Google_Checkout-1.9.3.3.xml create mode 100644 var/package/Lib_IDNA2-1.9.3.3.xml create mode 100644 var/package/Lib_Js_Calendar-1.51.1.9.xml create mode 100644 var/package/Lib_Js_Ext-1.9.3.3.xml create mode 100644 var/package/Lib_Js_Mage-1.9.3.3.xml create mode 100644 var/package/Lib_Js_Prototype-1.9.3.3.xml create mode 100644 var/package/Lib_Js_TinyMCE-3.5.11.8.xml create mode 100644 var/package/Lib_LinLibertineFont-2.8.14.9.xml create mode 100644 var/package/Lib_Mage-1.9.3.3.xml create mode 100644 var/package/Lib_Magento-1.9.3.3.xml create mode 100644 var/package/Lib_Pelago-1.9.3.3.xml create mode 100644 var/package/Lib_Phpseclib-1.9.3.3.xml create mode 100644 var/package/Lib_Unserialize-1.9.3.3.xml create mode 100644 var/package/Lib_Varien-1.9.3.3.xml create mode 100644 var/package/Lib_ZF-1.12.10.8.xml create mode 100644 var/package/Lib_ZF_Locale-1.12.10.8.xml create mode 100644 var/package/Mage_All_Latest-1.9.3.3.xml create mode 100644 var/package/Mage_Centinel-1.9.3.3.xml create mode 100644 var/package/Mage_Compiler-1.9.3.3.xml create mode 100644 var/package/Mage_Core_Adminhtml-1.9.3.3.xml create mode 100644 var/package/Mage_Core_Modules-1.9.3.3.xml create mode 100644 var/package/Mage_Downloader-1.9.3.3.xml create mode 100644 var/package/Mage_Locale_en_US-1.9.3.3.xml create mode 100644 var/package/Magento_Mobile-1.9.3.3.xml create mode 100644 var/package/Phoenix_Moneybookers-1.9.3.3.xml diff --git a/RELEASE_NOTES.txt b/RELEASE_NOTES.txt index 0d64b5431d7..dfa077946fd 100644 --- a/RELEASE_NOTES.txt +++ b/RELEASE_NOTES.txt @@ -1,3 +1,13 @@ +==== 1.9.3.3 ==== +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +] NOTE: Current Release Notes are maintained at: [ +] [ +] http://devdocs.magento.com/guides/m1x/ce19-ee114/ce1.9_release-notes.html [ +] [ +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + ==== 1.9.3.2 ==== ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/app/Mage.php b/app/Mage.php index 1886fc16bdb..4ad1ca674ef 100644 --- a/app/Mage.php +++ b/app/Mage.php @@ -171,7 +171,7 @@ public static function getVersionInfo() 'major' => '1', 'minor' => '9', 'revision' => '3', - 'patch' => '2', + 'patch' => '3', 'stability' => '', 'number' => '', ); diff --git a/app/code/core/Mage/Admin/Model/Session.php b/app/code/core/Mage/Admin/Model/Session.php index 96095e266b3..1c0a434a235 100644 --- a/app/code/core/Mage/Admin/Model/Session.php +++ b/app/code/core/Mage/Admin/Model/Session.php @@ -138,6 +138,9 @@ public function login($username, $password, $request = null) Mage::throwException(Mage::helper('adminhtml')->__('Invalid User Name or Password.')); } } catch (Mage_Core_Exception $e) { + $e->setMessage( + Mage::helper('adminhtml')->__('You did not sign in correctly or your account is temporarily disabled.') + ); Mage::dispatchEvent('admin_session_user_login_failed', array('user_name' => $username, 'exception' => $e)); if ($request && !$request->getParam('messageSent')) { diff --git a/app/code/core/Mage/Adminhtml/Block/Checkout/Formkey.php b/app/code/core/Mage/Adminhtml/Block/Checkout/Formkey.php new file mode 100644 index 00000000000..cbf69ee9e79 --- /dev/null +++ b/app/code/core/Mage/Adminhtml/Block/Checkout/Formkey.php @@ -0,0 +1,52 @@ + Admin section + * + * @return string + */ + public function getSecurityAdminUrl() + { + return Mage::helper("adminhtml")->getUrl('adminhtml/system_config/edit/section/admin'); + } +} diff --git a/app/code/core/Mage/Adminhtml/Block/Notification/Symlink.php b/app/code/core/Mage/Adminhtml/Block/Notification/Symlink.php new file mode 100644 index 00000000000..c4bc52f1218 --- /dev/null +++ b/app/code/core/Mage/Adminhtml/Block/Notification/Symlink.php @@ -0,0 +1,36 @@ +_convertDate($value['from'], $value['locale']); + $value['from'] = $this->_convertDate($this->stripTags($value['from']), $value['locale']); } if (!empty($value['to'])) { $value['orig_to'] = $value['to']; - $value['to'] = $this->_convertDate($value['to'], $value['locale']); + $value['to'] = $this->_convertDate($this->stripTags($value['to']), $value['locale']); } } if (empty($value['from']) && empty($value['to'])) { diff --git a/app/code/core/Mage/Adminhtml/Model/Config/Data.php b/app/code/core/Mage/Adminhtml/Model/Config/Data.php index 62750055069..0f357906c48 100644 --- a/app/code/core/Mage/Adminhtml/Model/Config/Data.php +++ b/app/code/core/Mage/Adminhtml/Model/Config/Data.php @@ -167,6 +167,9 @@ public function save() if (is_object($fieldConfig)) { $configPath = (string)$fieldConfig->config_path; if (!empty($configPath) && strrpos($configPath, '/') > 0) { + if (!Mage::getSingleton('admin/session')->isAllowed($configPath)) { + Mage::throwException('Access denied.'); + } // Extend old data with specified section group $groupPath = substr($configPath, 0, strrpos($configPath, '/')); if (!isset($oldConfigAdditionalGroups[$groupPath])) { diff --git a/app/code/core/Mage/Adminhtml/controllers/Catalog/Product/GalleryController.php b/app/code/core/Mage/Adminhtml/controllers/Catalog/Product/GalleryController.php index 0120ce2c466..91a5ff8e3c2 100644 --- a/app/code/core/Mage/Adminhtml/controllers/Catalog/Product/GalleryController.php +++ b/app/code/core/Mage/Adminhtml/controllers/Catalog/Product/GalleryController.php @@ -42,6 +42,11 @@ public function uploadAction() Mage::helper('catalog/image'), 'validateUploadFile'); $uploader->setAllowRenameFiles(true); $uploader->setFilesDispersion(true); + $uploader->addValidateCallback( + Mage_Core_Model_File_Validator_Image::NAME, + Mage::getModel('core/file_validator_image'), + 'validate' + ); $result = $uploader->save( Mage::getSingleton('catalog/product_media_config')->getBaseTmpMediaPath() ); diff --git a/app/code/core/Mage/Checkout/controllers/MultishippingController.php b/app/code/core/Mage/Checkout/controllers/MultishippingController.php index a393d361a51..229e92d6b34 100644 --- a/app/code/core/Mage/Checkout/controllers/MultishippingController.php +++ b/app/code/core/Mage/Checkout/controllers/MultishippingController.php @@ -233,6 +233,12 @@ public function addressesPostAction() $this->_redirect('*/multishipping_address/newShipping'); return; } + + if ($this->isFormkeyValidationOnCheckoutEnabled() && !$this->_validateFormKey()) { + $this->_redirect('*/*/addresses'); + return; + } + try { if ($this->getRequest()->getParam('continue', false)) { $this->_getCheckout()->setCollectRatesFlag(true); @@ -353,6 +359,11 @@ public function backToShippingAction() */ public function shippingPostAction() { + if ($this->isFormkeyValidationOnCheckoutEnabled() && !$this->_validateFormKey()) { + $this->_redirect('*/*/shipping'); + return; + } + $shippingMethods = $this->getRequest()->getPost('shipping_method'); try { Mage::dispatchEvent( @@ -462,6 +473,11 @@ public function overviewAction() return $this; } + if ($this->isFormkeyValidationOnCheckoutEnabled() && !$this->_validateFormKey()) { + $this->_redirect('*/*/billing'); + return; + } + $this->_getState()->setActiveStep(Mage_Checkout_Model_Type_Multishipping_State::STEP_OVERVIEW); try { diff --git a/app/code/core/Mage/Checkout/controllers/OnepageController.php b/app/code/core/Mage/Checkout/controllers/OnepageController.php index 05cf6a98edc..98bd359bc4d 100644 --- a/app/code/core/Mage/Checkout/controllers/OnepageController.php +++ b/app/code/core/Mage/Checkout/controllers/OnepageController.php @@ -349,6 +349,11 @@ public function saveMethodAction() if ($this->_expireAjax()) { return; } + + if ($this->isFormkeyValidationOnCheckoutEnabled() && !$this->_validateFormKey()) { + return; + } + if ($this->getRequest()->isPost()) { $method = $this->getRequest()->getPost('method'); $result = $this->getOnepage()->saveCheckoutMethod($method); @@ -364,6 +369,11 @@ public function saveBillingAction() if ($this->_expireAjax()) { return; } + + if ($this->isFormkeyValidationOnCheckoutEnabled() && !$this->_validateFormKey()) { + return; + } + if ($this->getRequest()->isPost()) { $data = $this->getRequest()->getPost('billing', array()); $customerAddressId = $this->getRequest()->getPost('billing_address_id', false); @@ -406,6 +416,11 @@ public function saveShippingAction() if ($this->_expireAjax()) { return; } + + if ($this->isFormkeyValidationOnCheckoutEnabled() && !$this->_validateFormKey()) { + return; + } + if ($this->getRequest()->isPost()) { $data = $this->getRequest()->getPost('shipping', array()); $customerAddressId = $this->getRequest()->getPost('shipping_address_id', false); @@ -430,6 +445,11 @@ public function saveShippingMethodAction() if ($this->_expireAjax()) { return; } + + if ($this->isFormkeyValidationOnCheckoutEnabled() && !$this->_validateFormKey()) { + return; + } + if ($this->getRequest()->isPost()) { $data = $this->getRequest()->getPost('shipping_method', ''); $result = $this->getOnepage()->saveShippingMethod($data); @@ -464,6 +484,11 @@ public function savePaymentAction() if ($this->_expireAjax()) { return; } + + if ($this->isFormkeyValidationOnCheckoutEnabled() && !$this->_validateFormKey()) { + return; + } + try { if (!$this->getRequest()->isPost()) { $this->_ajaxRedirectResponse(); diff --git a/app/code/core/Mage/Checkout/etc/system.xml b/app/code/core/Mage/Checkout/etc/system.xml index b3c609470ac..2da3e5b543d 100644 --- a/app/code/core/Mage/Checkout/etc/system.xml +++ b/app/code/core/Mage/Checkout/etc/system.xml @@ -232,5 +232,23 @@ + + + + + + + select + adminhtml/system_config_source_yesno + 4 + Important! Enabling this option means + that your custom templates used in checkout process contain form_key output. + Otherwise checkout may not work.]]> + 1 + + + + + diff --git a/app/code/core/Mage/Cms/Model/Wysiwyg/Images/Storage.php b/app/code/core/Mage/Cms/Model/Wysiwyg/Images/Storage.php index caae938195a..9a4133afb1d 100644 --- a/app/code/core/Mage/Cms/Model/Wysiwyg/Images/Storage.php +++ b/app/code/core/Mage/Cms/Model/Wysiwyg/Images/Storage.php @@ -283,6 +283,11 @@ public function uploadFile($targetPath, $type = null) } $uploader->setAllowRenameFiles(true); $uploader->setFilesDispersion(false); + $uploader->addValidateCallback( + Mage_Core_Model_File_Validator_Image::NAME, + Mage::getModel('core/file_validator_image'), + 'validate' + ); $result = $uploader->save($targetPath); if (!$result) { diff --git a/app/code/core/Mage/Core/Controller/Front/Action.php b/app/code/core/Mage/Core/Controller/Front/Action.php index da94389f091..3b6eb0883bc 100644 --- a/app/code/core/Mage/Core/Controller/Front/Action.php +++ b/app/code/core/Mage/Core/Controller/Front/Action.php @@ -188,4 +188,14 @@ protected function _isFormKeyEnabled() { return Mage::getStoreConfigFlag(self::XML_CSRF_USE_FLAG_CONFIG_PATH); } + + /** + * Check if form_key validation enabled on checkout process + * + * @return bool + */ + protected function isFormkeyValidationOnCheckoutEnabled() + { + return Mage::getStoreConfigFlag('admin/security/validate_formkey_checkout'); + } } diff --git a/app/code/core/Mage/Core/Controller/Request/Http.php b/app/code/core/Mage/Core/Controller/Request/Http.php index 26cddf119a7..6827e2017fd 100644 --- a/app/code/core/Mage/Core/Controller/Request/Http.php +++ b/app/code/core/Mage/Core/Controller/Request/Http.php @@ -148,7 +148,10 @@ public function setPathInfo($pathInfo = null) $baseUrl = $this->getBaseUrl(); $pathInfo = substr($requestUri, strlen($baseUrl)); - if ((null !== $baseUrl) && (false === $pathInfo)) { + if ($baseUrl && $pathInfo && (0 !== stripos($pathInfo, '/'))) { + $pathInfo = ''; + $this->setActionName('noRoute'); + } elseif ((null !== $baseUrl) && (false === $pathInfo)) { $pathInfo = ''; } elseif (null === $baseUrl) { $pathInfo = $requestUri; diff --git a/app/code/core/Mage/Core/Model/File/Validator/Image.php b/app/code/core/Mage/Core/Model/File/Validator/Image.php index ca925bfb86b..e24f8b983b4 100644 --- a/app/code/core/Mage/Core/Model/File/Validator/Image.php +++ b/app/code/core/Mage/Core/Model/File/Validator/Image.php @@ -88,10 +88,33 @@ public function setAllowedImageTypes(array $imageFileExtensions = array()) */ public function validate($filePath) { - $fileInfo = getimagesize($filePath); - if (is_array($fileInfo) and isset($fileInfo[2])) { - if ($this->isImageType($fileInfo[2])) { - return null; + list($imageWidth, $imageHeight, $fileType) = getimagesize($filePath); + if ($fileType) { + if ($this->isImageType($fileType)) { + //replace tmp image with re-sampled copy to exclude images with malicious data + $image = imagecreatefromstring(file_get_contents($filePath)); + if ($image !== false) { + $img = imagecreatetruecolor($imageWidth, $imageHeight); + imagecopyresampled($img, $image, 0, 0, 0, 0, $imageWidth, $imageHeight, $imageWidth, $imageHeight); + switch ($fileType) { + case IMAGETYPE_GIF: + imagegif($img, $filePath); + break; + case IMAGETYPE_JPEG: + imagejpeg($img, $filePath, 100); + break; + case IMAGETYPE_PNG: + imagepng($img, $filePath); + break; + default: + return; + } + imagedestroy($img); + imagedestroy($image); + return null; + } else { + throw Mage::exception('Mage_Core', Mage::helper('core')->__('Invalid image.')); + } } } throw Mage::exception('Mage_Core', Mage::helper('core')->__('Invalid MIME type.')); @@ -106,5 +129,4 @@ protected function isImageType($nImageType) { return in_array($nImageType, $this->_allowedImageTypes); } - } diff --git a/app/code/core/Mage/Core/etc/system.xml b/app/code/core/Mage/Core/etc/system.xml index 97b7b20602a..5dcd7b8e597 100644 --- a/app/code/core/Mage/Core/etc/system.xml +++ b/app/code/core/Mage/Core/etc/system.xml @@ -597,26 +597,6 @@ - text diff --git a/app/code/core/Mage/Dataflow/Model/Convert/Adapter/Zend/Cache.php b/app/code/core/Mage/Dataflow/Model/Convert/Adapter/Zend/Cache.php index 90f449c06db..0fe19b5d5cb 100644 --- a/app/code/core/Mage/Dataflow/Model/Convert/Adapter/Zend/Cache.php +++ b/app/code/core/Mage/Dataflow/Model/Convert/Adapter/Zend/Cache.php @@ -40,6 +40,9 @@ public function getResource() if (!$this->_resource) { $this->_resource = Zend_Cache::factory($this->getVar('frontend', 'Core'), $this->getVar('backend', 'File')); } + if ($this->_resource->getBackend() instanceof Zend_Cache_Backend_Static) { + throw new Exception(Mage::helper('dataflow')->__('Backend name "Static" not supported.')); + } return $this->_resource; } diff --git a/app/code/core/Mage/Dataflow/Model/Convert/Container/Abstract.php b/app/code/core/Mage/Dataflow/Model/Convert/Container/Abstract.php index c68824d2acd..594418c8528 100644 --- a/app/code/core/Mage/Dataflow/Model/Convert/Container/Abstract.php +++ b/app/code/core/Mage/Dataflow/Model/Convert/Container/Abstract.php @@ -47,6 +47,18 @@ abstract class Mage_Dataflow_Model_Convert_Container_Abstract protected $_position; + /** + * Detect serialization of data + * + * @param mixed $data + * @return bool + */ + protected function isSerialized($data) + { + $pattern = '/^a:\d+:\{(i:\d+;|s:\d+:\".+\";|N;|O:\d+:\"\w+\":\d+:\{\w:\d+:)+|^O:\d+:\"\w+\":\d+:\{s:\d+:\"/'; + return (is_string($data) && preg_match($pattern, $data)); + } + public function getVar($key, $default=null) { if (!isset($this->_vars[$key]) || (!is_array($this->_vars[$key]) && strlen($this->_vars[$key]) == 0)) { @@ -102,13 +114,45 @@ public function getData() public function setData($data) { - if ($this->getProfile()) { - $this->getProfile()->getContainer()->setData($data); + if ($this->validateDataSerialized($data)) { + if ($this->getProfile()) { + $this->getProfile()->getContainer()->setData($data); + } + + $this->_data = $data; } - $this->_data = $data; + return $this; } + /** + * Validate serialized data + * + * @param mixed $data + * @return bool + */ + public function validateDataSerialized($data = null) + { + if (is_null($data)) { + $data = $this->getData(); + } + + $result = true; + if ($this->isSerialized($data)) { + try { + $dataArray = Mage::helper('core/unserializeArray')->unserialize($data); + } catch (Exception $e) { + $result = false; + $this->addException( + "Invalid data, expecting serialized array.", + Mage_Dataflow_Model_Convert_Exception::FATAL + ); + } + } + + return $result; + } + public function validateDataString($data=null) { if (is_null($data)) { @@ -140,7 +184,10 @@ public function validateDataGrid($data=null) if (count($data)==0) { return true; } - $this->addException("Invalid data type, expecting 2D grid array.", Mage_Dataflow_Model_Convert_Exception::FATAL); + $this->addException( + "Invalid data type, expecting 2D grid array.", + Mage_Dataflow_Model_Convert_Exception::FATAL + ); } return true; } diff --git a/app/code/core/Mage/Dataflow/Model/Convert/Parser/Csv.php b/app/code/core/Mage/Dataflow/Model/Convert/Parser/Csv.php index 960b2e5f462..229293101d2 100644 --- a/app/code/core/Mage/Dataflow/Model/Convert/Parser/Csv.php +++ b/app/code/core/Mage/Dataflow/Model/Convert/Parser/Csv.php @@ -62,13 +62,15 @@ public function parse() $adapter = Mage::getModel($adapterName); } catch (Exception $e) { - $message = Mage::helper('dataflow')->__('Declared adapter %s was not found.', $adapterName); + $message = Mage::helper('dataflow') + ->__('Declared adapter %s was not found.', $adapterName); $this->addException($message, Mage_Dataflow_Model_Convert_Exception::FATAL); return $this; } if (!method_exists($adapter, $adapterMethod)) { - $message = Mage::helper('dataflow')->__('Method "%s" not defined in adapter %s.', $adapterMethod, $adapterName); + $message = Mage::helper('dataflow') + ->__('Method "%s" not defined in adapter %s.', $adapterMethod, $adapterName); $this->addException($message, Mage_Dataflow_Model_Convert_Exception::FATAL); return $this; } @@ -77,8 +79,8 @@ public function parse() $batchIoAdapter = $this->getBatchModel()->getIoAdapter(); if (Mage::app()->getRequest()->getParam('files')) { - $file = Mage::app()->getConfig()->getTempVarDir().'/import/' - . urldecode(Mage::app()->getRequest()->getParam('files')); + $file = Mage::app()->getConfig()->getTempVarDir() . '/import/' + . str_replace('../', '', urldecode(Mage::app()->getRequest()->getParam('files'))); $this->_copy($file); } diff --git a/app/code/core/Mage/Dataflow/Model/Convert/Parser/Xml/Excel.php b/app/code/core/Mage/Dataflow/Model/Convert/Parser/Xml/Excel.php index f25b007b15a..09609636619 100644 --- a/app/code/core/Mage/Dataflow/Model/Convert/Parser/Xml/Excel.php +++ b/app/code/core/Mage/Dataflow/Model/Convert/Parser/Xml/Excel.php @@ -69,7 +69,8 @@ public function parse() } if (!method_exists($adapter, $adapterMethod)) { - $message = Mage::helper('dataflow')->__('Method "%s" was not defined in adapter %s.', $adapterMethod, $adapterName); + $message = Mage::helper('dataflow') + ->__('Method "%s" was not defined in adapter %s.', $adapterMethod, $adapterName); $this->addException($message, Mage_Dataflow_Model_Convert_Exception::FATAL); return $this; } @@ -78,8 +79,8 @@ public function parse() $batchIoAdapter = $this->getBatchModel()->getIoAdapter(); if (Mage::app()->getRequest()->getParam('files')) { - $file = Mage::app()->getConfig()->getTempVarDir().'/import/' - . urldecode(Mage::app()->getRequest()->getParam('files')); + $file = Mage::app()->getConfig()->getTempVarDir() . '/import/' + . str_replace('../', '', urldecode(Mage::app()->getRequest()->getParam('files'))); $this->_copy($file); } diff --git a/app/code/core/Mage/ImportExport/Model/Import/Uploader.php b/app/code/core/Mage/ImportExport/Model/Import/Uploader.php index 3211d371315..76667e858a1 100644 --- a/app/code/core/Mage/ImportExport/Model/Import/Uploader.php +++ b/app/code/core/Mage/ImportExport/Model/Import/Uploader.php @@ -61,6 +61,11 @@ public function init() $this->setAllowedExtensions(array_keys($this->_allowedMimeTypes)); $this->addValidateCallback('catalog_product_image', Mage::helper('catalog/image'), 'validateUploadFile'); + $this->addValidateCallback( + Mage_Core_Model_File_Validator_Image::NAME, + Mage::getModel('core/file_validator_image'), + 'validate' + ); $this->_uploadType = self::SINGLE_STYLE; } diff --git a/app/code/core/Mage/Paypal/Model/Config.php b/app/code/core/Mage/Paypal/Model/Config.php index 511846c74bd..7691a805f68 100644 --- a/app/code/core/Mage/Paypal/Model/Config.php +++ b/app/code/core/Mage/Paypal/Model/Config.php @@ -717,6 +717,16 @@ public function getPaypalUrl(array $params = array()) ); } + /** + * Get postback endpoint URL. + * + * @return string + */ + public function getPostbackUrl() + { + return sprintf('https://ipnpb.%spaypal.com/cgi-bin/webscr', $this->sandboxFlag ? 'sandbox.' : ''); + } + /** * Whether Express Checkout button should be rendered dynamically * @@ -1588,4 +1598,3 @@ public function getBmlSize($section) return Mage::getStoreConfig('payment/paypal_express_bml/'.$section.'_size', $this->_storeId); } } - diff --git a/app/code/core/Mage/Paypal/Model/Ipn.php b/app/code/core/Mage/Paypal/Model/Ipn.php index 1def7cf0a68..974a7eb339f 100644 --- a/app/code/core/Mage/Paypal/Model/Ipn.php +++ b/app/code/core/Mage/Paypal/Model/Ipn.php @@ -129,11 +129,12 @@ public function processIpnRequest(array $request, Zend_Http_Client_Adapter_Inter * Post back to PayPal to check whether this request is a valid one * * @param Zend_Http_Client_Adapter_Interface $httpAdapter + * @throws Exception */ protected function _postBack(Zend_Http_Client_Adapter_Interface $httpAdapter) { $postbackQuery = http_build_query($this->_request) . '&cmd=_notify-validate'; - $postbackUrl = $this->_config->getPaypalUrl(); + $postbackUrl = $this->_config->getPostbackUrl(); $this->_debugData['postback_to'] = $postbackUrl; $httpAdapter->setConfig(array('verifypeer' => $this->_config->verifyPeer)); diff --git a/app/code/core/Mage/Sales/Model/Quote/Item.php b/app/code/core/Mage/Sales/Model/Quote/Item.php index d4133439f38..f105beac95c 100644 --- a/app/code/core/Mage/Sales/Model/Quote/Item.php +++ b/app/code/core/Mage/Sales/Model/Quote/Item.php @@ -500,8 +500,9 @@ public function compare($item) /** @var Unserialize_Parser $parser */ $parser = Mage::helper('core/unserializeArray'); - $_itemOptionValue = $parser->unserialize($itemOptionValue); - $_optionValue = $parser->unserialize($optionValue); + $_itemOptionValue = + is_numeric($itemOptionValue) ? $itemOptionValue : $parser->unserialize($itemOptionValue); + $_optionValue = is_numeric($optionValue) ? $optionValue : $parser->unserialize($optionValue); if (is_array($_itemOptionValue) && is_array($_optionValue)) { $itemOptionValue = $_itemOptionValue; diff --git a/app/code/core/Mage/Widget/Model/Widget/Instance.php b/app/code/core/Mage/Widget/Model/Widget/Instance.php index c5512058485..e5d0134298a 100644 --- a/app/code/core/Mage/Widget/Model/Widget/Instance.php +++ b/app/code/core/Mage/Widget/Model/Widget/Instance.php @@ -347,7 +347,11 @@ public function getStoreIds() public function getWidgetParameters() { if (is_string($this->getData('widget_parameters'))) { - return unserialize($this->getData('widget_parameters')); + try { + return Mage::helper('core/unserializeArray')->unserialize($this->getData('widget_parameters')); + } catch (Exception $e) { + Mage::logException($e); + } } return (is_array($this->getData('widget_parameters'))) ? $this->getData('widget_parameters') : array(); } diff --git a/app/code/core/Mage/XmlConnect/Helper/Image.php b/app/code/core/Mage/XmlConnect/Helper/Image.php index e8d6e295802..38d8ed37240 100644 --- a/app/code/core/Mage/XmlConnect/Helper/Image.php +++ b/app/code/core/Mage/XmlConnect/Helper/Image.php @@ -100,6 +100,11 @@ public function handleUpload($field) $uploader = Mage::getModel('core/file_uploader', $field); $uploader->setAllowedExtensions(array('jpg', 'jpeg', 'gif', 'png')); $uploader->setAllowRenameFiles(true); + $uploader->addValidateCallback( + Mage_Core_Model_File_Validator_Image::NAME, + Mage::getModel('core/file_validator_image'), + 'validate' + ); $uploader->save($uploadDir); $uploadedFilename = $uploader->getUploadedFileName(); $uploadedFilename = $this->_getResizedFilename($field, $uploadedFilename, true); diff --git a/app/code/core/Mage/XmlConnect/controllers/Adminhtml/MobileController.php b/app/code/core/Mage/XmlConnect/controllers/Adminhtml/MobileController.php index 28d4fae2022..3e00f38ac5a 100644 --- a/app/code/core/Mage/XmlConnect/controllers/Adminhtml/MobileController.php +++ b/app/code/core/Mage/XmlConnect/controllers/Adminhtml/MobileController.php @@ -1393,6 +1393,11 @@ public function uploadImagesAction() /** @var $uploader Mage_Core_Model_File_Uploader */ $uploader = Mage::getModel('core/file_uploader', $imageModel->getImageType()); $uploader->setAllowRenameFiles(true)->setAllowedExtensions(array('jpg', 'jpeg', 'gif', 'png')); + $uploader->addValidateCallback( + Mage_Core_Model_File_Validator_Image::NAME, + Mage::getModel('core/file_validator_image'), + 'validate' + ); $result = $uploader->save(Mage_XmlConnect_Model_Images::getBasePath(), $newFileName); $result['thumbnail'] = Mage::getModel('xmlconnect/images')->getCustomSizeImageUrl( $result['file'], diff --git a/app/design/adminhtml/default/default/layout/main.xml b/app/design/adminhtml/default/default/layout/main.xml index 7fc3eadd789..78ba06dc760 100644 --- a/app/design/adminhtml/default/default/layout/main.xml +++ b/app/design/adminhtml/default/default/layout/main.xml @@ -119,7 +119,8 @@ Default layout, loads most of the pages - + + diff --git a/app/design/adminhtml/default/default/template/notification/formkey.phtml b/app/design/adminhtml/default/default/template/notification/formkey.phtml new file mode 100644 index 00000000000..7d348fc638c --- /dev/null +++ b/app/design/adminhtml/default/default/template/notification/formkey.phtml @@ -0,0 +1,38 @@ + +canShow()): ?> +
+ Important: + Formkey validation on checkout disabled. This may expose security risks. + We strongly recommend to Enable Form Key Validation On Checkout in + Admin / Security Section, + for protect your own checkout process. +
+ diff --git a/app/design/adminhtml/default/default/template/notification/symlink.phtml b/app/design/adminhtml/default/default/template/notification/symlink.phtml new file mode 100644 index 00000000000..6d13cb5f79f --- /dev/null +++ b/app/design/adminhtml/default/default/template/notification/symlink.phtml @@ -0,0 +1,34 @@ + +isSymlinkEnabled()): ?> +
+ helper('adminhtml')->__('Symlinks are enabled. This may expose security risks. We strongly recommend to disable them.')?> +
+ diff --git a/app/design/adminhtml/default/default/template/page/head.phtml b/app/design/adminhtml/default/default/template/page/head.phtml index dd1f8d484e1..c2b8ff96fdf 100644 --- a/app/design/adminhtml/default/default/template/page/head.phtml +++ b/app/design/adminhtml/default/default/template/page/head.phtml @@ -33,7 +33,7 @@ var BLANK_URL = 'getJsUrl() ?>blank.html'; var BLANK_IMG = 'getJsUrl() ?>spacer.gif'; var BASE_URL = 'getUrl('*') ?>'; - var SKIN_URL = 'getSkinUrl() ?>'; + var SKIN_URL = 'jsQuoteEscape($this->getSkinUrl()) ?>'; var FORM_KEY = 'getFormKey() ?>'; diff --git a/app/design/frontend/base/default/template/checkout/cart/shipping.phtml b/app/design/frontend/base/default/template/checkout/cart/shipping.phtml index 7290aee5bb5..df021834823 100644 --- a/app/design/frontend/base/default/template/checkout/cart/shipping.phtml +++ b/app/design/frontend/base/default/template/checkout/cart/shipping.phtml @@ -109,6 +109,7 @@
+ getBlockHtml('formkey') ?> - + diff --git a/app/design/frontend/rwd/default/template/checkout/cart/shipping.phtml b/app/design/frontend/rwd/default/template/checkout/cart/shipping.phtml index f4a0e3d4285..e293822471a 100644 --- a/app/design/frontend/rwd/default/template/checkout/cart/shipping.phtml +++ b/app/design/frontend/rwd/default/template/checkout/cart/shipping.phtml @@ -120,6 +120,7 @@ __('Update Total') ?> + getBlockHtml('formkey') ?>