Skip to content

Commit fd5b947

Browse files
spinschcolinmollenhour
spinsch
authored and
colinmollenhour
committed
Patch SUPEE-10570 / Upgrade 1.9.3.8
1 parent 0e7f77e commit fd5b947

File tree

65 files changed

+363
-84
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

65 files changed

+363
-84
lines changed

‎RELEASE_NOTES.txt‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,13 @@
1+
==== 1.9.3.8 ====
2+
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
3+
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
4+
] NOTE: Current Release Notes are maintained at: [
5+
] [
6+
] http://devdocs.magento.com/guides/m1x/ce19-ee114/ce1.9_release-notes.html [
7+
] [
8+
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
9+
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
10+
111
==== 1.9.3.7 ====
212
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
313
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

‎app/Mage.php‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -171,7 +171,7 @@ public static function getVersionInfo()
171171
'major' => '1',
172172
'minor' => '9',
173173
'revision' => '3',
174-
'patch' => '7',
174+
'patch' => '8',
175175
'stability' => '',
176176
'number' => '',
177177
);
@@ -844,6 +844,7 @@ public static function log($message, $level = null, $file = '', $forceLog = fals
844844
$message = print_r($message, true);
845845
}
846846

847+
$message = addcslashes($message, '<?');
847848
$loggers[$file]->log($message, $level);
848849
}
849850
catch (Exception $e) {

‎app/code/core/Mage/Admin/Helper/Block.php‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -56,4 +56,14 @@ public function isTypeAllowed($type)
5656
{
5757
return isset($this->_allowedTypes[$type]);
5858
}
59+
60+
/**
61+
* Get disallowed names for block
62+
*
63+
* @return bool
64+
*/
65+
public function getDisallowedBlockNames()
66+
{
67+
return Mage::getResourceModel('admin/block')->getDisallowedBlockNames();
68+
}
5969
}

‎app/code/core/Mage/Admin/Model/Block.php‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -53,6 +53,10 @@ public function validate()
5353
if (!Zend_Validate::is($this->getBlockName(), 'NotEmpty')) {
5454
$errors[] = Mage::helper('adminhtml')->__('Block Name is required field.');
5555
}
56+
$disallowedBlockNames = Mage::helper('admin/block')->getDisallowedBlockNames();
57+
if (in_array($this->getBlockName(), $disallowedBlockNames)) {
58+
$errors[] = Mage::helper('adminhtml')->__('Block Name is disallowed.');
59+
}
5660
if (!Zend_Validate::is($this->getBlockName(), 'Regex', array('/^[-_a-zA-Z0-9\/]*$/'))) {
5761
$errors[] = Mage::helper('adminhtml')->__('Block Name is incorrect.');
5862
}

‎app/code/core/Mage/Admin/Model/Resource/Block.php‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -38,6 +38,13 @@ class Mage_Admin_Model_Resource_Block extends Mage_Core_Model_Resource_Db_Abstra
3838
*/
3939
const CACHE_ID = 'permission_block';
4040

41+
/**
42+
* Disallowed names for block
43+
*
44+
* @var array
45+
*/
46+
protected $disallowedBlockNames = array('install/end');
47+
4148
/**
4249
* Define main table
4350
*
@@ -70,6 +77,10 @@ protected function _generateCache()
7077
/** @var Mage_Admin_Model_Resource_Block_Collection $collection */
7178
$collection = Mage::getResourceModel('admin/block_collection');
7279
$collection->addFieldToFilter('is_allowed', array('eq' => 1));
80+
$disallowedBlockNames = $this->getDisallowedBlockNames();
81+
if (is_array($disallowedBlockNames) && count($disallowedBlockNames) > 0) {
82+
$collection->addFieldToFilter('block_name', array('nin' => $disallowedBlockNames));
83+
}
7384
$data = $collection->getColumnValues('block_name');
7485
$data = array_flip($data);
7586
Mage::app()->saveCache(
@@ -98,4 +109,14 @@ protected function _afterDelete(Mage_Core_Model_Abstract $object)
98109
$this->_generateCache();
99110
return parent::_afterDelete($object);
100111
}
112+
113+
/**
114+
* Get disallowed names for block
115+
*
116+
* @return array
117+
*/
118+
public function getDisallowedBlockNames()
119+
{
120+
return $this->disallowedBlockNames;
121+
}
101122
}

‎app/code/core/Mage/Admin/Model/User.php‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -379,14 +379,15 @@ public function authenticate($username, $password)
379379
/**
380380
* Login user
381381
*
382-
* @param string $login
382+
* @param string $username
383383
* @param string $password
384384
* @return Mage_Admin_Model_User
385385
*/
386386
public function login($username, $password)
387387
{
388388
if ($this->authenticate($username, $password)) {
389389
$this->getResource()->recordLogin($this);
390+
Mage::getSingleton('core/session')->renewFormKey();
390391
}
391392
return $this;
392393
}

‎app/code/core/Mage/Adminhtml/Block/Catalog/Product/Grid.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -161,7 +161,7 @@ protected function _prepareColumns()
161161
if ($store->getId()) {
162162
$this->addColumn('custom_name',
163163
array(
164-
'header'=> Mage::helper('catalog')->__('Name in %s', $store->getName()),
164+
'header'=> Mage::helper('catalog')->__('Name in %s', $this->escapeHtml($store->getName())),
165165
'index' => 'custom_name',
166166
));
167167
}

‎app/code/core/Mage/Adminhtml/Block/Newsletter/Template/Grid/Renderer/Sender.php‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -38,10 +38,10 @@ public function render(Varien_Object $row)
3838
{
3939
$str = '';
4040
if($row->getTemplateSenderName()) {
41-
$str .= htmlspecialchars($row->getTemplateSenderName()) . ' ';
41+
$str .= $this->escapeHtml($row->getTemplateSenderName()) . ' ';
4242
}
4343
if($row->getTemplateSenderEmail()) {
44-
$str .= '[' . $row->getTemplateSenderEmail() . ']';
44+
$str .= '[' .$this->escapeHtml($row->getTemplateSenderEmail()) . ']';
4545
}
4646
if($str == '') {
4747
$str .= '---';

‎app/code/core/Mage/Adminhtml/Block/Sales/Order/Grid.php‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -78,6 +78,7 @@ protected function _prepareColumns()
7878
'type' => 'store',
7979
'store_view'=> true,
8080
'display_deleted' => true,
81+
'escape' => true,
8182
));
8283
}
8384

‎app/code/core/Mage/Adminhtml/Block/Sales/Order/View/Info.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -64,7 +64,7 @@ public function getOrderStoreName()
6464
$store->getGroup()->getName(),
6565
$store->getName()
6666
);
67-
return implode('<br/>', $name);
67+
return implode('<br/>', array_map(array($this, 'escapeHtml'), $name));
6868
}
6969
return null;
7070
}

0 commit comments

Comments
 (0)