Skip to content

Commit 8552a51

Browse files
author
Tymchynskyi, Viktor(vtymchynskyi)
committed
Merge pull request #587 from magento-mpi/MAGETWO-33490
[MPI] Magento Framework protects against XSS attacks
2 parents b51f3e0 + 1e8ba20 commit 8552a51

File tree

766 files changed

+6385
-5708
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

766 files changed

+6385
-5708
lines changed

‎app/code/Magento/AdminNotification/view/adminhtml/templates/notification/window.phtml

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -13,19 +13,19 @@
1313
*/
1414
?>
1515
<div data-mage-init='{"modalPopup": {}}' class="fade critical-notification">
16-
<div class="popup popup-<?php echo preg_replace('#[^a-z0-9]+#', '-', strtolower($block->getSeverityText())) ?>">
16+
<div class="popup popup-<?php /* @escapeNotVerified */ echo preg_replace('#[^a-z0-9]+#', '-', strtolower($block->getSeverityText())) ?>">
1717
<div class="popup-inner">
1818
<div class="popup-header">
19-
<div class="popup-title"><?php echo $block->getHeaderText(); ?></div>
19+
<div class="popup-title"><?php /* @escapeNotVerified */ echo $block->getHeaderText(); ?></div>
2020
</div>
2121
<div class="popup-content">
22-
<span><?php echo $block->getSeverityText();?></span>
22+
<span><?php /* @escapeNotVerified */ echo $block->getSeverityText();?></span>
2323

24-
<p class="message-text"><?php echo $block->getNoticeMessageText(); ?></p>
24+
<p class="message-text"><?php /* @escapeNotVerified */ echo $block->getNoticeMessageText(); ?></p>
2525

26-
<a href="<?php echo $block->getNoticeMessageUrl(); ?>"><?php echo $block->getReadDetailsText(); ?></a>
26+
<a href="<?php /* @escapeNotVerified */ echo $block->getNoticeMessageUrl(); ?>"><?php /* @escapeNotVerified */ echo $block->getReadDetailsText(); ?></a>
2727
</div>
28-
<span class="action close" data-dismiss="popup" title="<?php echo $block->escapeHtml(__('Close popup'));?>"><?php echo __('Close'); ?></span>
28+
<span class="action close" data-dismiss="popup" title="<?php echo $block->escapeHtml(__('Close popup'));?>"><?php /* @escapeNotVerified */ echo __('Close'); ?></span>
2929
</div>
3030
</div>
3131
</div>

‎app/code/Magento/AdminNotification/view/adminhtml/templates/system/messages.phtml

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -15,27 +15,27 @@
1515
<?php if ($lastCritical): ?>
1616
<ul class="message-system-list">
1717
<li class="message message-warning error">
18-
<?php echo $lastCritical->getText();?>
18+
<?php /* @escapeNotVerified */ echo $lastCritical->getText();?>
1919
</li>
2020
</ul>
2121
<?php endif; ?>
2222
<div class="message-system-short">
2323
<span class="message-system-short-label">
24-
<?php echo __('System Messages:')?>
24+
<?php /* @escapeNotVerified */ echo __('System Messages:')?>
2525
</span>
2626

2727
<?php if ($block->getCriticalCount()): ?>
2828
<div class="message message-warning error">
2929
<a class="message-link" href="#" title="<?php echo $block->escapeHtml(__('Critical System Messages'));?>">
30-
<?php echo $block->getCriticalCount();?>
30+
<?php /* @escapeNotVerified */ echo $block->getCriticalCount();?>
3131
</a>
3232
</div>
3333
<?php endif;?>
3434

3535
<?php if ($block->getMajorCount()): ?>
3636
<div class="message message-warning warning">
3737
<a class="message-link" href="#" title="<?php echo $block->escapeHtml(__('Major System Messages'));?>">
38-
<?php echo $block->getMajorCount();?>
38+
<?php /* @escapeNotVerified */ echo $block->getMajorCount();?>
3939
</a>
4040
</div>
4141
<?php endif;?>

‎app/code/Magento/AdminNotification/view/adminhtml/templates/system/messages/popup.phtml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -12,8 +12,8 @@
1212
<div id="system_messages_list" title="<?php echo $block->escapeHtml($block->getPopupTitle()); ?>">
1313
<ul class="message-system-list">
1414
<?php foreach ($block->getUnreadMessages() as $message): ?>
15-
<li class="message message-warning <?php echo $block->getItemClass($message);?>">
16-
<?php echo $message->getText();?>
15+
<li class="message message-warning <?php /* @escapeNotVerified */ echo $block->getItemClass($message);?>">
16+
<?php /* @escapeNotVerified */ echo $message->getText();?>
1717
</li>
1818
<?php endforeach;?>
1919
</ul>

‎app/code/Magento/AdminNotification/view/adminhtml/templates/toolbar_entry.phtml

Lines changed: 15 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -15,25 +15,25 @@
1515
<div
1616
data-mage-init='{"toolbarEntry": {}}'
1717
class="notifications-wrapper admin__action-dropdown-wrap"
18-
data-notification-count="<?php echo $notificationCount; ?>">
18+
data-notification-count="<?php /* @escapeNotVerified */ echo $notificationCount; ?>">
1919
<?php if ($notificationCount > 0) : ?>
2020
<a
21-
href="<?php echo $block->getUrl('adminhtml/notification/index'); ?>"
21+
href="<?php /* @escapeNotVerified */ echo $block->getUrl('adminhtml/notification/index'); ?>"
2222
class="notifications-action admin__action-dropdown"
2323
data-mage-init='{"dropdown":{}}'
24-
title="<?php echo __('Notifications'); ?>"
24+
title="<?php /* @escapeNotVerified */ echo __('Notifications'); ?>"
2525
data-toggle="dropdown">
2626
<span class="notifications-counter">
27-
<?php echo ($notificationCount > $notificationCounterMax) ? $notificationCounterMax . '+' : $notificationCount; ?>
27+
<?php /* @escapeNotVerified */ echo ($notificationCount > $notificationCounterMax) ? $notificationCounterMax . '+' : $notificationCount; ?>
2828
</span>
2929
</a>
3030
<ul
3131
class="admin__action-dropdown-menu"
32-
data-mark-as-read-url="<?php echo $block->getUrl('adminhtml/notification/ajaxMarkAsRead'); ?>">
32+
data-mark-as-read-url="<?php /* @escapeNotVerified */ echo $block->getUrl('adminhtml/notification/ajaxMarkAsRead'); ?>">
3333
<?php foreach ($block->getLatestUnreadNotifications() as $notification) : ?>
3434
<?php /** @var $notification \Magento\AdminNotification\Model\Inbox*/ ?>
3535
<li class="notifications-entry<?php if ($notification->getSeverity() == 1): ?> notifications-critical<?php endif; ?>"
36-
data-notification-id="<?php echo $notification->getId(); ?>"
36+
data-notification-id="<?php /* @escapeNotVerified */ echo $notification->getId(); ?>"
3737
data-notification-severity="<?php if ($notification->getSeverity() == 1): ?>1<?php endif; ?>">
3838
<?php
3939
$notificationDescription = $block->escapeHtml($notification->getDescription());
@@ -45,40 +45,40 @@
4545
<?php if (strlen($notificationDescription) > $notificationDescriptionLength) : ?>
4646
<p class="notifications-entry-description _cutted">
4747
<span class="notifications-entry-description-start">
48-
<?php echo substr($notificationDescription, 0, $notificationDescriptionLength); ?>
48+
<?php /* @escapeNotVerified */ echo substr($notificationDescription, 0, $notificationDescriptionLength); ?>
4949
</span>
5050
<span class="notifications-entry-description-end">
51-
<?php echo substr($notificationDescription, $notificationDescriptionLength); ?>
51+
<?php /* @escapeNotVerified */ echo substr($notificationDescription, $notificationDescriptionLength); ?>
5252
</span>
5353
</p>
5454
<?php else : ?>
5555
<p class="notifications-entry-description">
56-
<?php echo $notificationDescription; ?>
56+
<?php /* @escapeNotVerified */ echo $notificationDescription; ?>
5757
</p>
5858
<?php endif; ?>
5959
<time class="notifications-entry-time">
60-
<?php echo $block->formatNotificationDate($notification->getDateAdded()); ?>
60+
<?php /* @escapeNotVerified */ echo $block->formatNotificationDate($notification->getDateAdded()); ?>
6161
</time>
6262
<button
6363
type="button"
6464
class="notifications-close"
65-
title="<?php echo __('Close'); ?>"
65+
title="<?php /* @escapeNotVerified */ echo __('Close'); ?>"
6666
></button>
6767
</li>
6868
<?php endforeach; ?>
6969
<li class="notifications-entry notifications-entry-last">
7070
<a
71-
href="<?php echo $block->getUrl('adminhtml/notification/index'); ?>"
71+
href="<?php /* @escapeNotVerified */ echo $block->getUrl('adminhtml/notification/index'); ?>"
7272
class="action-tertiary action-more">
73-
<?php echo __('See All (') ?><span class="notifications-counter"><?php echo $notificationCount ?></span><?php echo __(' unread)'); ?>
73+
<?php /* @escapeNotVerified */ echo __('See All (') ?><span class="notifications-counter"><?php /* @escapeNotVerified */ echo $notificationCount ?></span><?php /* @escapeNotVerified */ echo __(' unread)'); ?>
7474
</a>
7575
</li>
7676
</ul>
7777
<?php else : ?>
7878
<a
7979
class="notifications-action admin__action-dropdown"
80-
href="<?php echo $block->getUrl('adminhtml/notification/index'); ?>"
81-
title="<?php echo __('Notifications'); ?>">
80+
href="<?php /* @escapeNotVerified */ echo $block->getUrl('adminhtml/notification/index'); ?>"
81+
title="<?php /* @escapeNotVerified */ echo __('Notifications'); ?>">
8282
</a>
8383
<?php endif; ?>
8484
</div>

‎app/code/Magento/Authorizenet/view/adminhtml/templates/directpost/iframe.phtml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -22,9 +22,9 @@ $helper = $block->getHelper('adminhtml');
2222
window.top.location="<?php echo $block->escapeUrl($params['redirect_parent']) ?>";
2323
<?php endif; ?>
2424
<?php if (isset($params['error_msg'])): ?>
25-
window.top.directPostModel.showError(<?php echo json_encode((array)$params['error_msg']) ?>);
25+
window.top.directPostModel.showError(<?php /* @escapeNotVerified */ echo json_encode((array)$params['error_msg']) ?>);
2626
<?php if (isset($params['x_invoice_num'])): ?>
27-
window.top.directPostModel.successUrl="<?php echo $helper->getSuccessOrderUrl($params) ?>";
27+
window.top.directPostModel.successUrl="<?php /* @escapeNotVerified */ echo $helper->getSuccessOrderUrl($params) ?>";
2828
<?php endif; ?>
2929
<?php endif; ?>
3030
</script>

‎app/code/Magento/Authorizenet/view/adminhtml/templates/directpost/info.phtml

Lines changed: 29 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -18,71 +18,71 @@ $_controller = $block->getRequest()->getControllerName();
1818
$_orderUrl = $this->helper('Magento\Authorizenet\Helper\Backend\Data')->getPlaceOrderAdminUrl();
1919
?>
2020
<!-- IFRAME for request to our server -->
21-
<iframe id="order-directpost-iframe" allowtransparency="true" frameborder="0" name="iframeSubmitOrder" style="display:none;width:100%;background-color:transparent" src="<?php echo $block->getViewFileUrl('blank.html') ?>"></iframe>
21+
<iframe id="order-directpost-iframe" allowtransparency="true" frameborder="0" name="iframeSubmitOrder" style="display:none;width:100%;background-color:transparent" src="<?php /* @escapeNotVerified */ echo $block->getViewFileUrl('blank.html') ?>"></iframe>
2222
<!-- IFRAME for request to Authorize.net -->
23-
<iframe id="directpost-iframe" allowtransparency="true" frameborder="0" name="iframeDirectPost" style="display:none;width:100%;background-color:transparent" src="<?php echo $block->getViewFileUrl('blank.html') ?>"></iframe>
24-
<fieldset class="admin__fieldset payment-method" id="payment_form_<?php echo $_code ?>" style="display:none;">
23+
<iframe id="directpost-iframe" allowtransparency="true" frameborder="0" name="iframeDirectPost" style="display:none;width:100%;background-color:transparent" src="<?php /* @escapeNotVerified */ echo $block->getViewFileUrl('blank.html') ?>"></iframe>
24+
<fieldset class="admin__fieldset payment-method" id="payment_form_<?php /* @escapeNotVerified */ echo $_code ?>" style="display:none;">
2525
<div class="admin__field _required">
26-
<label for="<?php echo $_code ?>_cc_type"
27-
class="admin__field-label"><span><?php echo __('Credit Card Type') ?></span></label>
26+
<label for="<?php /* @escapeNotVerified */ echo $_code ?>_cc_type"
27+
class="admin__field-label"><span><?php /* @escapeNotVerified */ echo __('Credit Card Type') ?></span></label>
2828
<div class="admin__field-control">
29-
<select id="<?php echo $_code ?>_cc_type"
29+
<select id="<?php /* @escapeNotVerified */ echo $_code ?>_cc_type"
3030
name="payment[cc_type]"
3131
class="required-entry validate-cc-type-select admin__control-select">
3232
<?php $_ccType = $_form->getInfoData('cc_type') ?>
3333
<option value=""></option>
3434
<?php foreach ($_form->getCcAvailableTypes() as $_typeCode => $_typeName): ?>
35-
<option value="<?php echo $_typeCode ?>"
36-
<?php if ($_typeCode == $_ccType): ?>selected="selected"<?php endif ?>><?php echo $_typeName ?></option>
35+
<option value="<?php /* @escapeNotVerified */ echo $_typeCode ?>"
36+
<?php if ($_typeCode == $_ccType): ?>selected="selected"<?php endif ?>><?php /* @escapeNotVerified */ echo $_typeName ?></option>
3737
<?php endforeach ?>
3838
</select>
3939
</div>
4040
</div>
4141
<div class="admin__field _required">
42-
<label for="<?php echo $_code ?>_cc_number"
43-
class="admin__field-label"><span><?php echo __('Credit Card Number') ?></span></label>
42+
<label for="<?php /* @escapeNotVerified */ echo $_code ?>_cc_number"
43+
class="admin__field-label"><span><?php /* @escapeNotVerified */ echo __('Credit Card Number') ?></span></label>
4444

4545
<div class="admin__field-control">
46-
<input type="text" id="<?php echo $_code ?>_cc_number"
46+
<input type="text" id="<?php /* @escapeNotVerified */ echo $_code ?>_cc_number"
4747
name="payment[cc_number]"
4848
class="input-text required-entry validate-cc-number admin__control-text"
49-
value="<?php echo $block->getInfoData('cc_number') ?>"/>
49+
value="<?php /* @escapeNotVerified */ echo $block->getInfoData('cc_number') ?>"/>
5050
</div>
5151
</div>
5252
<div class="admin__field _required">
53-
<label for="<?php echo $_code ?>_expiration"
54-
class="admin__field-label"><span><?php echo __('Expiration Date') ?></span></label>
53+
<label for="<?php /* @escapeNotVerified */ echo $_code ?>_expiration"
54+
class="admin__field-label"><span><?php /* @escapeNotVerified */ echo __('Expiration Date') ?></span></label>
5555

5656
<div class="admin__field-control">
57-
<select id="<?php echo $_code ?>_expiration"
57+
<select id="<?php /* @escapeNotVerified */ echo $_code ?>_expiration"
5858
name="payment[cc_exp_month]"
5959
class="validate-cc-exp required-entry admin__control-select admin__control-select-month">
6060
<?php $_ccExpMonth = $_form->getInfoData('cc_exp_month') ?>
6161
<?php foreach ($_form->getCcMonths() as $k => $v): ?>
62-
<option value="<?php echo $k ?>"
63-
<?php if ($k == $_ccExpMonth): ?>selected="selected"<?php endif ?>><?php echo $v ?></option>
62+
<option value="<?php /* @escapeNotVerified */ echo $k ?>"
63+
<?php if ($k == $_ccExpMonth): ?>selected="selected"<?php endif ?>><?php /* @escapeNotVerified */ echo $v ?></option>
6464
<?php endforeach ?>
6565
</select>
6666
<?php $_ccExpYear = $_form->getInfoData('cc_exp_year') ?>
67-
<select id="<?php echo $_code ?>_expiration_yr"
67+
<select id="<?php /* @escapeNotVerified */ echo $_code ?>_expiration_yr"
6868
name="payment[cc_exp_year]"
6969
class="required-entry admin__control-select admin__control-select-year">
7070
<?php foreach ($_form->getCcYears() as $k => $v): ?>
71-
<option value="<?php echo $k ? $k : '' ?>"
72-
<?php if ($k == $_ccExpYear): ?>selected="selected"<?php endif ?>><?php echo $v ?></option>
71+
<option value="<?php /* @escapeNotVerified */ echo $k ? $k : '' ?>"
72+
<?php if ($k == $_ccExpYear): ?>selected="selected"<?php endif ?>><?php /* @escapeNotVerified */ echo $v ?></option>
7373
<?php endforeach ?>
7474
</select>
7575
</div>
7676
</div>
7777
<?php if ($_form->hasVerification()): ?>
7878
<div class="admin__field _required">
79-
<label for="<?php echo $_code ?>_cc_cid"><span><?php echo __('Card Verification Number') ?></span></label>
79+
<label for="<?php /* @escapeNotVerified */ echo $_code ?>_cc_cid"><span><?php /* @escapeNotVerified */ echo __('Card Verification Number') ?></span></label>
8080

8181
<div class="admin__field-control">
8282
<input type="text"
8383
class="required-entry input-text validate-cc-cvn admin__control-text"
84-
id="<?php echo $_code ?>_cc_cid" name="payment[cc_cid]"
85-
value="<?php echo $block->getInfoData('cc_cid') ?>"/>
84+
id="<?php /* @escapeNotVerified */ echo $_code ?>_cc_cid" name="payment[cc_cid]"
85+
value="<?php /* @escapeNotVerified */ echo $block->getInfoData('cc_cid') ?>"/>
8686
</div>
8787
</div>
8888
<?php endif; ?>
@@ -98,19 +98,19 @@ $_orderUrl = $this->helper('Magento\Authorizenet\Helper\Backend\Data')->getPlace
9898
/**
9999
* Disable card server validation in admin
100100
*/
101-
order.addExcludedPaymentMethod('<?php echo $_code ?>');
101+
order.addExcludedPaymentMethod('<?php /* @escapeNotVerified */ echo $_code ?>');
102102

103103
<?php if (!$block->isAjaxRequest()): ?>
104104
document.observe('dom:loaded', function(){
105105
<?php endif; ?>
106106

107107
directPostModel = new directPost(
108-
'<?php echo $_code ?>',
108+
'<?php /* @escapeNotVerified */ echo $_code ?>',
109109
'directpost-iframe',
110-
'<?php echo $_controller ?>',
111-
'<?php echo $_orderUrl ?>',
112-
'<?php echo $_method->getCgiUrl() ?>',
113-
'<?php echo $block->getUrl('*/*/save', ['_secure' => $block->getRequest()->isSecure()]) ?>');
110+
'<?php /* @escapeNotVerified */ echo $_controller ?>',
111+
'<?php /* @escapeNotVerified */ echo $_orderUrl ?>',
112+
'<?php /* @escapeNotVerified */ echo $_method->getCgiUrl() ?>',
113+
'<?php /* @escapeNotVerified */ echo $block->getUrl('*/*/save', ['_secure' => $block->getRequest()->isSecure()]) ?>');
114114

115115
<?php if (!$block->isAjaxRequest()): ?>
116116
});

0 commit comments

Comments
 (0)