Skip to content
This repository was archived by the owner on Nov 19, 2024. It is now read-only.

Commit 7185e6f

Browse files
drobinsondrobinson
authored
Merge pull request #49 from tjons/magento-1.9
Import Magento Release 1.9.3.3
2 parents 505e8e9 + 6f7586f commit 7185e6f

File tree

101 files changed

+11729
-280
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

101 files changed

+11729
-280
lines changed

‎RELEASE_NOTES.txt‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,13 @@
1+
==== 1.9.3.3 ====
2+
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
3+
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
4+
] NOTE: Current Release Notes are maintained at: [
5+
] [
6+
] http://devdocs.magento.com/guides/m1x/ce19-ee114/ce1.9_release-notes.html [
7+
] [
8+
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
9+
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
10+
111
==== 1.9.3.2 ====
212
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
313
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

‎app/Mage.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -171,7 +171,7 @@ public static function getVersionInfo()
171171
'major' => '1',
172172
'minor' => '9',
173173
'revision' => '3',
174-
'patch' => '2',
174+
'patch' => '3',
175175
'stability' => '',
176176
'number' => '',
177177
);

‎app/code/core/Mage/Admin/Model/Session.php‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -138,6 +138,9 @@ public function login($username, $password, $request = null)
138138
Mage::throwException(Mage::helper('adminhtml')->__('Invalid User Name or Password.'));
139139
}
140140
} catch (Mage_Core_Exception $e) {
141+
$e->setMessage(
142+
Mage::helper('adminhtml')->__('You did not sign in correctly or your account is temporarily disabled.')
143+
);
141144
Mage::dispatchEvent('admin_session_user_login_failed',
142145
array('user_name' => $username, 'exception' => $e));
143146
if ($request && !$request->getParam('messageSent')) {

‎app/code/core/Mage/Adminhtml/Block/Checkout/Formkey.php‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
<?php
2+
/**
3+
* Magento
4+
*
5+
* NOTICE OF LICENSE
6+
*
7+
* This source file is subject to the Open Software License (OSL 3.0)
8+
* that is bundled with this package in the file LICENSE.txt.
9+
* It is also available through the world-wide-web at this URL:
10+
* http://opensource.org/licenses/osl-3.0.php
11+
* If you did not receive a copy of the license and are unable to
12+
* obtain it through the world-wide-web, please send an email
13+
* to [email protected] so we can send you a copy immediately.
14+
*
15+
* DISCLAIMER
16+
*
17+
* Do not edit or add to this file if you wish to upgrade Magento to newer
18+
* versions in the future. If you wish to customize Magento for your
19+
* needs please refer to http://www.magento.com for more information.
20+
*
21+
* @category Mage
22+
* @package Mage_Adminhtml
23+
* @copyright Copyright (c) 2006-2017 X.commerce, Inc. and affiliates (http://www.magento.com)
24+
* @license http://opensource.org/licenses/osl-3.0.php Open Software License (OSL 3.0)
25+
*/
26+
27+
/**
28+
* Class Mage_Adminhtml_Block_Checkout_Formkey
29+
*/
30+
class Mage_Adminhtml_Block_Checkout_Formkey extends Mage_Adminhtml_Block_Template
31+
{
32+
/**
33+
* Check form key validation on checkout.
34+
* If disabled, show notice.
35+
*
36+
* @return boolean
37+
*/
38+
public function canShow()
39+
{
40+
return !Mage::getStoreConfigFlag('admin/security/validate_formkey_checkout');
41+
}
42+
43+
/**
44+
* Get url for edit Advanced -> Admin section
45+
*
46+
* @return string
47+
*/
48+
public function getSecurityAdminUrl()
49+
{
50+
return Mage::helper("adminhtml")->getUrl('adminhtml/system_config/edit/section/admin');
51+
}
52+
}

‎app/code/core/Mage/Adminhtml/Block/Notification/Symlink.php‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
<?php
2+
/**
3+
* Magento
4+
*
5+
* NOTICE OF LICENSE
6+
*
7+
* This source file is subject to the Open Software License (OSL 3.0)
8+
* that is bundled with this package in the file LICENSE.txt.
9+
* It is also available through the world-wide-web at this URL:
10+
* http://opensource.org/licenses/osl-3.0.php
11+
* If you did not receive a copy of the license and are unable to
12+
* obtain it through the world-wide-web, please send an email
13+
* to [email protected] so we can send you a copy immediately.
14+
*
15+
* DISCLAIMER
16+
*
17+
* Do not edit or add to this file if you wish to upgrade Magento to newer
18+
* versions in the future. If you wish to customize Magento for your
19+
* needs please refer to http://www.magento.com for more information.
20+
*
21+
* @category Mage
22+
* @package Mage_Adminhtml
23+
* @copyright Copyright (c) 2006-2017 X.commerce, Inc. and affiliates (http://www.magento.com)
24+
* @license http://opensource.org/licenses/osl-3.0.php Open Software License (OSL 3.0)
25+
*/
26+
27+
class Mage_Adminhtml_Block_Notification_Symlink extends Mage_Adminhtml_Block_Template
28+
{
29+
/**
30+
* @return bool
31+
*/
32+
public function isSymlinkEnabled()
33+
{
34+
return Mage::getStoreConfigFlag(self::XML_PATH_TEMPLATE_ALLOW_SYMLINK);
35+
}
36+
}

‎app/code/core/Mage/Adminhtml/Block/Widget/Grid/Column/Filter/Date.php‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -146,11 +146,11 @@ public function setValue($value)
146146
if (isset($value['locale'])) {
147147
if (!empty($value['from'])) {
148148
$value['orig_from'] = $value['from'];
149-
$value['from'] = $this->_convertDate($value['from'], $value['locale']);
149+
$value['from'] = $this->_convertDate($this->stripTags($value['from']), $value['locale']);
150150
}
151151
if (!empty($value['to'])) {
152152
$value['orig_to'] = $value['to'];
153-
$value['to'] = $this->_convertDate($value['to'], $value['locale']);
153+
$value['to'] = $this->_convertDate($this->stripTags($value['to']), $value['locale']);
154154
}
155155
}
156156
if (empty($value['from']) && empty($value['to'])) {

‎app/code/core/Mage/Adminhtml/Model/Config/Data.php‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -167,6 +167,9 @@ public function save()
167167
if (is_object($fieldConfig)) {
168168
$configPath = (string)$fieldConfig->config_path;
169169
if (!empty($configPath) && strrpos($configPath, '/') > 0) {
170+
if (!Mage::getSingleton('admin/session')->isAllowed($configPath)) {
171+
Mage::throwException('Access denied.');
172+
}
170173
// Extend old data with specified section group
171174
$groupPath = substr($configPath, 0, strrpos($configPath, '/'));
172175
if (!isset($oldConfigAdditionalGroups[$groupPath])) {

‎app/code/core/Mage/Adminhtml/controllers/Catalog/Product/GalleryController.php‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -42,6 +42,11 @@ public function uploadAction()
4242
Mage::helper('catalog/image'), 'validateUploadFile');
4343
$uploader->setAllowRenameFiles(true);
4444
$uploader->setFilesDispersion(true);
45+
$uploader->addValidateCallback(
46+
Mage_Core_Model_File_Validator_Image::NAME,
47+
Mage::getModel('core/file_validator_image'),
48+
'validate'
49+
);
4550
$result = $uploader->save(
4651
Mage::getSingleton('catalog/product_media_config')->getBaseTmpMediaPath()
4752
);

‎app/code/core/Mage/Checkout/controllers/MultishippingController.php‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -233,6 +233,12 @@ public function addressesPostAction()
233233
$this->_redirect('*/multishipping_address/newShipping');
234234
return;
235235
}
236+
237+
if ($this->isFormkeyValidationOnCheckoutEnabled() && !$this->_validateFormKey()) {
238+
$this->_redirect('*/*/addresses');
239+
return;
240+
}
241+
236242
try {
237243
if ($this->getRequest()->getParam('continue', false)) {
238244
$this->_getCheckout()->setCollectRatesFlag(true);
@@ -353,6 +359,11 @@ public function backToShippingAction()
353359
*/
354360
public function shippingPostAction()
355361
{
362+
if ($this->isFormkeyValidationOnCheckoutEnabled() && !$this->_validateFormKey()) {
363+
$this->_redirect('*/*/shipping');
364+
return;
365+
}
366+
356367
$shippingMethods = $this->getRequest()->getPost('shipping_method');
357368
try {
358369
Mage::dispatchEvent(
@@ -462,6 +473,11 @@ public function overviewAction()
462473
return $this;
463474
}
464475

476+
if ($this->isFormkeyValidationOnCheckoutEnabled() && !$this->_validateFormKey()) {
477+
$this->_redirect('*/*/billing');
478+
return;
479+
}
480+
465481
$this->_getState()->setActiveStep(Mage_Checkout_Model_Type_Multishipping_State::STEP_OVERVIEW);
466482

467483
try {

‎app/code/core/Mage/Checkout/controllers/OnepageController.php‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -349,6 +349,11 @@ public function saveMethodAction()
349349
if ($this->_expireAjax()) {
350350
return;
351351
}
352+
353+
if ($this->isFormkeyValidationOnCheckoutEnabled() && !$this->_validateFormKey()) {
354+
return;
355+
}
356+
352357
if ($this->getRequest()->isPost()) {
353358
$method = $this->getRequest()->getPost('method');
354359
$result = $this->getOnepage()->saveCheckoutMethod($method);
@@ -364,6 +369,11 @@ public function saveBillingAction()
364369
if ($this->_expireAjax()) {
365370
return;
366371
}
372+
373+
if ($this->isFormkeyValidationOnCheckoutEnabled() && !$this->_validateFormKey()) {
374+
return;
375+
}
376+
367377
if ($this->getRequest()->isPost()) {
368378
$data = $this->getRequest()->getPost('billing', array());
369379
$customerAddressId = $this->getRequest()->getPost('billing_address_id', false);
@@ -406,6 +416,11 @@ public function saveShippingAction()
406416
if ($this->_expireAjax()) {
407417
return;
408418
}
419+
420+
if ($this->isFormkeyValidationOnCheckoutEnabled() && !$this->_validateFormKey()) {
421+
return;
422+
}
423+
409424
if ($this->getRequest()->isPost()) {
410425
$data = $this->getRequest()->getPost('shipping', array());
411426
$customerAddressId = $this->getRequest()->getPost('shipping_address_id', false);
@@ -430,6 +445,11 @@ public function saveShippingMethodAction()
430445
if ($this->_expireAjax()) {
431446
return;
432447
}
448+
449+
if ($this->isFormkeyValidationOnCheckoutEnabled() && !$this->_validateFormKey()) {
450+
return;
451+
}
452+
433453
if ($this->getRequest()->isPost()) {
434454
$data = $this->getRequest()->getPost('shipping_method', '');
435455
$result = $this->getOnepage()->saveShippingMethod($data);
@@ -464,6 +484,11 @@ public function savePaymentAction()
464484
if ($this->_expireAjax()) {
465485
return;
466486
}
487+
488+
if ($this->isFormkeyValidationOnCheckoutEnabled() && !$this->_validateFormKey()) {
489+
return;
490+
}
491+
467492
try {
468493
if (!$this->getRequest()->isPost()) {
469494
$this->_ajaxRedirectResponse();

0 commit comments

Comments
 (0)