#!/bin/bash # Patch apllying tool template # v0.1.2 # (c) Copyright 2013. Magento Inc. # # DO NOT CHANGE ANY LINE IN THIS FILE. # 1. Check required system tools _check_installed_tools() { local missed="" until [ -z "$1" ]; do type -t $1 >/dev/null 2>/dev/null if (( $? != 0 )); then missed="$missed $1" fi shift done echo $missed } REQUIRED_UTILS='sed patch' MISSED_REQUIRED_TOOLS=`_check_installed_tools $REQUIRED_UTILS` if (( `echo $MISSED_REQUIRED_TOOLS | wc -w` > 0 )); then echo -e "Error! Some required system tools, that are utilized in this sh script, are not installed:\nTool(s) \"$MISSED_REQUIRED_TOOLS\" is(are) missed, please install it(them)." exit 1 fi # 2. Determine bin path for system tools CAT_BIN=`which cat` PATCH_BIN=`which patch` SED_BIN=`which sed` PWD_BIN=`which pwd` BASENAME_BIN=`which basename` BASE_NAME=`$BASENAME_BIN "$0"` # 3. Help menu if [ "$1" = "-?" -o "$1" = "-h" -o "$1" = "--help" ] then $CAT_BIN << EOFH Usage: sh $BASE_NAME [--help] [-R|--revert] [--list] Apply embedded patch. -R, --revert Revert previously applied embedded patch --list Show list of applied patches --help Show this help message EOFH exit 0 fi # 4. Get "revert" flag and "list applied patches" flag REVERT_FLAG= SHOW_APPLIED_LIST=0 if [ "$1" = "-R" -o "$1" = "--revert" ] then REVERT_FLAG=-R fi if [ "$1" = "--list" ] then SHOW_APPLIED_LIST=1 fi # 5. File pathes CURRENT_DIR=`$PWD_BIN`/ APP_ETC_DIR=`echo "$CURRENT_DIR""app/etc/"` APPLIED_PATCHES_LIST_FILE=`echo "$APP_ETC_DIR""applied.patches.list"` # 6. Show applied patches list if requested if [ "$SHOW_APPLIED_LIST" -eq 1 ] ; then echo -e "Applied/reverted patches list:" if [ -e "$APPLIED_PATCHES_LIST_FILE" ] then if [ ! -r "$APPLIED_PATCHES_LIST_FILE" ] then echo "ERROR: \"$APPLIED_PATCHES_LIST_FILE\" must be readable so applied patches list can be shown." exit 1 else $SED_BIN -n "/SUP-\|SUPEE-/p" $APPLIED_PATCHES_LIST_FILE fi else echo "" fi exit 0 fi # 7. Check applied patches track file and its directory _check_files() { if [ ! -e "$APP_ETC_DIR" ] then echo "ERROR: \"$APP_ETC_DIR\" must exist for proper tool work." exit 1 fi if [ ! -w "$APP_ETC_DIR" ] then echo "ERROR: \"$APP_ETC_DIR\" must be writeable for proper tool work." exit 1 fi if [ -e "$APPLIED_PATCHES_LIST_FILE" ] then if [ ! -w "$APPLIED_PATCHES_LIST_FILE" ] then echo "ERROR: \"$APPLIED_PATCHES_LIST_FILE\" must be writeable for proper tool work." exit 1 fi fi } _check_files # 8. Apply/revert patch # Note: there is no need to check files permissions for files to be patched. # "patch" tool will not modify any file if there is not enough permissions for all files to be modified. # Get start points for additional information and patch data SKIP_LINES=$((`$SED_BIN -n "/^__PATCHFILE_FOLLOWS__$/=" "$CURRENT_DIR""$BASE_NAME"` + 1)) ADDITIONAL_INFO_LINE=$(($SKIP_LINES - 3))p _apply_revert_patch() { DRY_RUN_FLAG= if [ "$1" = "dry-run" ] then DRY_RUN_FLAG=" --dry-run" echo "Checking if patch can be applied/reverted successfully..." fi PATCH_APPLY_REVERT_RESULT=`$SED_BIN -e '1,/^__PATCHFILE_FOLLOWS__$/d' "$CURRENT_DIR""$BASE_NAME" | $PATCH_BIN $DRY_RUN_FLAG $REVERT_FLAG -p0` PATCH_APPLY_REVERT_STATUS=$? if [ $PATCH_APPLY_REVERT_STATUS -eq 1 ] ; then echo -e "ERROR: Patch can't be applied/reverted successfully.\n\n$PATCH_APPLY_REVERT_RESULT" exit 1 fi if [ $PATCH_APPLY_REVERT_STATUS -eq 2 ] ; then echo -e "ERROR: Patch can't be applied/reverted successfully." exit 2 fi } REVERTED_PATCH_MARK= if [ -n "$REVERT_FLAG" ] then REVERTED_PATCH_MARK=" | REVERTED" fi _apply_revert_patch dry-run _apply_revert_patch # 9. Track patch applying result echo "Patch was applied/reverted successfully." ADDITIONAL_INFO=`$SED_BIN -n ""$ADDITIONAL_INFO_LINE"" "$CURRENT_DIR""$BASE_NAME"` APPLIED_REVERTED_ON_DATE=`date -u +"%F %T UTC"` APPLIED_REVERTED_PATCH_INFO=`echo -n "$APPLIED_REVERTED_ON_DATE"" | ""$ADDITIONAL_INFO""$REVERTED_PATCH_MARK"` echo -e "$APPLIED_REVERTED_PATCH_INFO\n$PATCH_APPLY_REVERT_RESULT\n\n" >> "$APPLIED_PATCHES_LIST_FILE" exit 0 PATCH_SUPEE-9767_CE_1.9.3.3_v2 | CE_1.9.3.3 | v2 | 6566db274beaeb9bcdb56a62e02cc2da532e618c | Thu Jun 22 04:30:03 2017 +0300 | v1.14.3.3..HEAD __PATCHFILE_FOLLOWS__ diff --git app/code/core/Mage/Admin/Model/Session.php app/code/core/Mage/Admin/Model/Session.php index 96095e2..1c0a434 100644 --- app/code/core/Mage/Admin/Model/Session.php +++ app/code/core/Mage/Admin/Model/Session.php @@ -138,6 +138,9 @@ class Mage_Admin_Model_Session extends Mage_Core_Model_Session_Abstract Mage::throwException(Mage::helper('adminhtml')->__('Invalid User Name or Password.')); } } catch (Mage_Core_Exception $e) { + $e->setMessage( + Mage::helper('adminhtml')->__('You did not sign in correctly or your account is temporarily disabled.') + ); Mage::dispatchEvent('admin_session_user_login_failed', array('user_name' => $username, 'exception' => $e)); if ($request && !$request->getParam('messageSent')) { diff --git app/code/core/Mage/Adminhtml/Block/Checkout/Formkey.php app/code/core/Mage/Adminhtml/Block/Checkout/Formkey.php new file mode 100644 index 0000000..cbf69ee --- /dev/null +++ app/code/core/Mage/Adminhtml/Block/Checkout/Formkey.php @@ -0,0 +1,52 @@ + Admin section + * + * @return string + */ + public function getSecurityAdminUrl() + { + return Mage::helper("adminhtml")->getUrl('adminhtml/system_config/edit/section/admin'); + } +} diff --git app/code/core/Mage/Adminhtml/Block/Notification/Symlink.php app/code/core/Mage/Adminhtml/Block/Notification/Symlink.php new file mode 100644 index 0000000..c4bc52f --- /dev/null +++ app/code/core/Mage/Adminhtml/Block/Notification/Symlink.php @@ -0,0 +1,36 @@ +_convertDate($value['from'], $value['locale']); + $value['from'] = $this->_convertDate($this->stripTags($value['from']), $value['locale']); } if (!empty($value['to'])) { $value['orig_to'] = $value['to']; - $value['to'] = $this->_convertDate($value['to'], $value['locale']); + $value['to'] = $this->_convertDate($this->stripTags($value['to']), $value['locale']); } } if (empty($value['from']) && empty($value['to'])) { diff --git app/code/core/Mage/Adminhtml/Model/Config/Data.php app/code/core/Mage/Adminhtml/Model/Config/Data.php index 6275005..0f35790 100644 --- app/code/core/Mage/Adminhtml/Model/Config/Data.php +++ app/code/core/Mage/Adminhtml/Model/Config/Data.php @@ -167,6 +167,9 @@ class Mage_Adminhtml_Model_Config_Data extends Varien_Object if (is_object($fieldConfig)) { $configPath = (string)$fieldConfig->config_path; if (!empty($configPath) && strrpos($configPath, '/') > 0) { + if (!Mage::getSingleton('admin/session')->isAllowed($configPath)) { + Mage::throwException('Access denied.'); + } // Extend old data with specified section group $groupPath = substr($configPath, 0, strrpos($configPath, '/')); if (!isset($oldConfigAdditionalGroups[$groupPath])) { diff --git app/code/core/Mage/Adminhtml/Model/System/Config/Backend/Symlink.php app/code/core/Mage/Adminhtml/Model/System/Config/Backend/Symlink.php new file mode 100644 index 0000000..d211255 --- /dev/null +++ app/code/core/Mage/Adminhtml/Model/System/Config/Backend/Symlink.php @@ -0,0 +1,44 @@ +setAllowRenameFiles(true); $uploader->setFilesDispersion(true); + $uploader->addValidateCallback( + Mage_Core_Model_File_Validator_Image::NAME, + Mage::getModel('core/file_validator_image'), + 'validate' + ); $result = $uploader->save( Mage::getSingleton('catalog/product_media_config')->getBaseTmpMediaPath() ); diff --git app/code/core/Mage/Checkout/controllers/MultishippingController.php app/code/core/Mage/Checkout/controllers/MultishippingController.php index a393d36..229e92d 100644 --- app/code/core/Mage/Checkout/controllers/MultishippingController.php +++ app/code/core/Mage/Checkout/controllers/MultishippingController.php @@ -233,6 +233,12 @@ class Mage_Checkout_MultishippingController extends Mage_Checkout_Controller_Act $this->_redirect('*/multishipping_address/newShipping'); return; } + + if ($this->isFormkeyValidationOnCheckoutEnabled() && !$this->_validateFormKey()) { + $this->_redirect('*/*/addresses'); + return; + } + try { if ($this->getRequest()->getParam('continue', false)) { $this->_getCheckout()->setCollectRatesFlag(true); @@ -353,6 +359,11 @@ class Mage_Checkout_MultishippingController extends Mage_Checkout_Controller_Act */ public function shippingPostAction() { + if ($this->isFormkeyValidationOnCheckoutEnabled() && !$this->_validateFormKey()) { + $this->_redirect('*/*/shipping'); + return; + } + $shippingMethods = $this->getRequest()->getPost('shipping_method'); try { Mage::dispatchEvent( @@ -462,6 +473,11 @@ class Mage_Checkout_MultishippingController extends Mage_Checkout_Controller_Act return $this; } + if ($this->isFormkeyValidationOnCheckoutEnabled() && !$this->_validateFormKey()) { + $this->_redirect('*/*/billing'); + return; + } + $this->_getState()->setActiveStep(Mage_Checkout_Model_Type_Multishipping_State::STEP_OVERVIEW); try { diff --git app/code/core/Mage/Checkout/controllers/OnepageController.php app/code/core/Mage/Checkout/controllers/OnepageController.php index 05cf6a9..f926b92 100644 --- app/code/core/Mage/Checkout/controllers/OnepageController.php +++ app/code/core/Mage/Checkout/controllers/OnepageController.php @@ -349,6 +349,7 @@ class Mage_Checkout_OnepageController extends Mage_Checkout_Controller_Action if ($this->_expireAjax()) { return; } + if ($this->getRequest()->isPost()) { $method = $this->getRequest()->getPost('method'); $result = $this->getOnepage()->saveCheckoutMethod($method); @@ -364,6 +365,11 @@ class Mage_Checkout_OnepageController extends Mage_Checkout_Controller_Action if ($this->_expireAjax()) { return; } + + if ($this->isFormkeyValidationOnCheckoutEnabled() && !$this->_validateFormKey()) { + return; + } + if ($this->getRequest()->isPost()) { $data = $this->getRequest()->getPost('billing', array()); $customerAddressId = $this->getRequest()->getPost('billing_address_id', false); @@ -406,6 +412,11 @@ class Mage_Checkout_OnepageController extends Mage_Checkout_Controller_Action if ($this->_expireAjax()) { return; } + + if ($this->isFormkeyValidationOnCheckoutEnabled() && !$this->_validateFormKey()) { + return; + } + if ($this->getRequest()->isPost()) { $data = $this->getRequest()->getPost('shipping', array()); $customerAddressId = $this->getRequest()->getPost('shipping_address_id', false); @@ -430,6 +441,11 @@ class Mage_Checkout_OnepageController extends Mage_Checkout_Controller_Action if ($this->_expireAjax()) { return; } + + if ($this->isFormkeyValidationOnCheckoutEnabled() && !$this->_validateFormKey()) { + return; + } + if ($this->getRequest()->isPost()) { $data = $this->getRequest()->getPost('shipping_method', ''); $result = $this->getOnepage()->saveShippingMethod($data); @@ -464,6 +480,11 @@ class Mage_Checkout_OnepageController extends Mage_Checkout_Controller_Action if ($this->_expireAjax()) { return; } + + if ($this->isFormkeyValidationOnCheckoutEnabled() && !$this->_validateFormKey()) { + return; + } + try { if (!$this->getRequest()->isPost()) { $this->_ajaxRedirectResponse(); diff --git app/code/core/Mage/Checkout/etc/system.xml app/code/core/Mage/Checkout/etc/system.xml index b3c6094..8479e9d 100644 --- app/code/core/Mage/Checkout/etc/system.xml +++ app/code/core/Mage/Checkout/etc/system.xml @@ -232,5 +232,23 @@ + + + + + + + select + adminhtml/system_config_source_yesno + 4 + Important! Enabling this option means + that your custom templates used in checkout process contain form_key output. + Otherwise checkout may not work.]]> + 1 + + + + + diff --git app/code/core/Mage/Cms/Model/Wysiwyg/Images/Storage.php app/code/core/Mage/Cms/Model/Wysiwyg/Images/Storage.php index caae938..9a4133a 100644 --- app/code/core/Mage/Cms/Model/Wysiwyg/Images/Storage.php +++ app/code/core/Mage/Cms/Model/Wysiwyg/Images/Storage.php @@ -283,6 +283,11 @@ class Mage_Cms_Model_Wysiwyg_Images_Storage extends Varien_Object } $uploader->setAllowRenameFiles(true); $uploader->setFilesDispersion(false); + $uploader->addValidateCallback( + Mage_Core_Model_File_Validator_Image::NAME, + Mage::getModel('core/file_validator_image'), + 'validate' + ); $result = $uploader->save($targetPath); if (!$result) { diff --git app/code/core/Mage/Core/Controller/Front/Action.php app/code/core/Mage/Core/Controller/Front/Action.php index da94389..3b6eb08 100644 --- app/code/core/Mage/Core/Controller/Front/Action.php +++ app/code/core/Mage/Core/Controller/Front/Action.php @@ -188,4 +188,14 @@ class Mage_Core_Controller_Front_Action extends Mage_Core_Controller_Varien_Acti { return Mage::getStoreConfigFlag(self::XML_CSRF_USE_FLAG_CONFIG_PATH); } + + /** + * Check if form_key validation enabled on checkout process + * + * @return bool + */ + protected function isFormkeyValidationOnCheckoutEnabled() + { + return Mage::getStoreConfigFlag('admin/security/validate_formkey_checkout'); + } } diff --git app/code/core/Mage/Core/Controller/Request/Http.php app/code/core/Mage/Core/Controller/Request/Http.php index 26cddf1..6827e20 100644 --- app/code/core/Mage/Core/Controller/Request/Http.php +++ app/code/core/Mage/Core/Controller/Request/Http.php @@ -148,7 +148,10 @@ class Mage_Core_Controller_Request_Http extends Zend_Controller_Request_Http $baseUrl = $this->getBaseUrl(); $pathInfo = substr($requestUri, strlen($baseUrl)); - if ((null !== $baseUrl) && (false === $pathInfo)) { + if ($baseUrl && $pathInfo && (0 !== stripos($pathInfo, '/'))) { + $pathInfo = ''; + $this->setActionName('noRoute'); + } elseif ((null !== $baseUrl) && (false === $pathInfo)) { $pathInfo = ''; } elseif (null === $baseUrl) { $pathInfo = $requestUri; diff --git app/code/core/Mage/Core/Model/File/Validator/Image.php app/code/core/Mage/Core/Model/File/Validator/Image.php index ca925bf..9d57202 100644 --- app/code/core/Mage/Core/Model/File/Validator/Image.php +++ app/code/core/Mage/Core/Model/File/Validator/Image.php @@ -88,10 +88,51 @@ class Mage_Core_Model_File_Validator_Image */ public function validate($filePath) { - $fileInfo = getimagesize($filePath); - if (is_array($fileInfo) and isset($fileInfo[2])) { - if ($this->isImageType($fileInfo[2])) { - return null; + list($imageWidth, $imageHeight, $fileType) = getimagesize($filePath); + if ($fileType) { + if ($this->isImageType($fileType)) { + //replace tmp image with re-sampled copy to exclude images with malicious data + $image = imagecreatefromstring(file_get_contents($filePath)); + if ($image !== false) { + $img = imagecreatetruecolor($imageWidth, $imageHeight); + imagealphablending($img, false); + imagecopyresampled($img, $image, 0, 0, 0, 0, $imageWidth, $imageHeight, $imageWidth, $imageHeight); + imagesavealpha($img, true); + + switch ($fileType) { + case IMAGETYPE_GIF: + $transparencyIndex = imagecolortransparent($image); + if ($transparencyIndex >= 0) { + imagecolortransparent($img, $transparencyIndex); + for ($y = 0; $y < $imageHeight; ++$y) { + for ($x = 0; $x < $imageWidth; ++$x) { + if (((imagecolorat($img, $x, $y) >> 24) & 0x7F)) { + imagesetpixel($img, $x, $y, $transparencyIndex); + } + } + } + } + if (!imageistruecolor($image)) { + imagetruecolortopalette($img, false, imagecolorstotal($image)); + } + imagegif($img, $filePath); + break; + case IMAGETYPE_JPEG: + imagejpeg($img, $filePath, 100); + break; + case IMAGETYPE_PNG: + imagepng($img, $filePath); + break; + default: + break; + } + + imagedestroy($img); + imagedestroy($image); + return null; + } else { + throw Mage::exception('Mage_Core', Mage::helper('core')->__('Invalid image.')); + } } } throw Mage::exception('Mage_Core', Mage::helper('core')->__('Invalid MIME type.')); @@ -106,5 +147,4 @@ class Mage_Core_Model_File_Validator_Image { return in_array($nImageType, $this->_allowedImageTypes); } - } diff --git app/code/core/Mage/Core/etc/config.xml app/code/core/Mage/Core/etc/config.xml index 15114c5..c0ee1a2 100644 --- app/code/core/Mage/Core/etc/config.xml +++ app/code/core/Mage/Core/etc/config.xml @@ -28,7 +28,7 @@ - 1.6.0.6 + 1.6.0.6.1.2 diff --git app/code/core/Mage/Core/etc/system.xml app/code/core/Mage/Core/etc/system.xml index 97b7b20..964a806 100644 --- app/code/core/Mage/Core/etc/system.xml +++ app/code/core/Mage/Core/etc/system.xml @@ -601,18 +601,19 @@ text 25 - 1 - 1 - 1 + 0 + 0 + 0 select adminhtml/system_config_source_yesno + adminhtml/system_config_backend_symlink 10 - 1 - 1 - 1 + 0 + 0 + 0 Warning! Enabling this feature is not recommended on production environments because it represents a potential security risk. diff --git app/code/core/Mage/Core/sql/core_setup/upgrade-1.6.0.6.1.1-1.6.0.6.1.2.php app/code/core/Mage/Core/sql/core_setup/upgrade-1.6.0.6.1.1-1.6.0.6.1.2.php new file mode 100644 index 0000000..c3a50a5 --- /dev/null +++ app/code/core/Mage/Core/sql/core_setup/upgrade-1.6.0.6.1.1-1.6.0.6.1.2.php @@ -0,0 +1,40 @@ +startSetup(); +$connection = $installer->getConnection(); + +$connection->delete( + $this->getTable('core_config_data'), + $connection->prepareSqlCondition('path', array( + 'like' => 'dev/template/allow_symlink' + )) +); + +$installer->endSetup(); diff --git app/code/core/Mage/Dataflow/Model/Convert/Adapter/Zend/Cache.php app/code/core/Mage/Dataflow/Model/Convert/Adapter/Zend/Cache.php index 90f449c..0fe19b5 100644 --- app/code/core/Mage/Dataflow/Model/Convert/Adapter/Zend/Cache.php +++ app/code/core/Mage/Dataflow/Model/Convert/Adapter/Zend/Cache.php @@ -40,6 +40,9 @@ class Mage_Dataflow_Model_Convert_Adapter_Zend_Cache extends Mage_Dataflow_Model if (!$this->_resource) { $this->_resource = Zend_Cache::factory($this->getVar('frontend', 'Core'), $this->getVar('backend', 'File')); } + if ($this->_resource->getBackend() instanceof Zend_Cache_Backend_Static) { + throw new Exception(Mage::helper('dataflow')->__('Backend name "Static" not supported.')); + } return $this->_resource; } diff --git app/code/core/Mage/Dataflow/Model/Convert/Container/Abstract.php app/code/core/Mage/Dataflow/Model/Convert/Container/Abstract.php index c68824d..594418c 100644 --- app/code/core/Mage/Dataflow/Model/Convert/Container/Abstract.php +++ app/code/core/Mage/Dataflow/Model/Convert/Container/Abstract.php @@ -47,6 +47,18 @@ abstract class Mage_Dataflow_Model_Convert_Container_Abstract protected $_position; + /** + * Detect serialization of data + * + * @param mixed $data + * @return bool + */ + protected function isSerialized($data) + { + $pattern = '/^a:\d+:\{(i:\d+;|s:\d+:\".+\";|N;|O:\d+:\"\w+\":\d+:\{\w:\d+:)+|^O:\d+:\"\w+\":\d+:\{s:\d+:\"/'; + return (is_string($data) && preg_match($pattern, $data)); + } + public function getVar($key, $default=null) { if (!isset($this->_vars[$key]) || (!is_array($this->_vars[$key]) && strlen($this->_vars[$key]) == 0)) { @@ -102,13 +114,45 @@ abstract class Mage_Dataflow_Model_Convert_Container_Abstract public function setData($data) { - if ($this->getProfile()) { - $this->getProfile()->getContainer()->setData($data); + if ($this->validateDataSerialized($data)) { + if ($this->getProfile()) { + $this->getProfile()->getContainer()->setData($data); + } + + $this->_data = $data; } - $this->_data = $data; + return $this; } + /** + * Validate serialized data + * + * @param mixed $data + * @return bool + */ + public function validateDataSerialized($data = null) + { + if (is_null($data)) { + $data = $this->getData(); + } + + $result = true; + if ($this->isSerialized($data)) { + try { + $dataArray = Mage::helper('core/unserializeArray')->unserialize($data); + } catch (Exception $e) { + $result = false; + $this->addException( + "Invalid data, expecting serialized array.", + Mage_Dataflow_Model_Convert_Exception::FATAL + ); + } + } + + return $result; + } + public function validateDataString($data=null) { if (is_null($data)) { @@ -140,7 +184,10 @@ abstract class Mage_Dataflow_Model_Convert_Container_Abstract if (count($data)==0) { return true; } - $this->addException("Invalid data type, expecting 2D grid array.", Mage_Dataflow_Model_Convert_Exception::FATAL); + $this->addException( + "Invalid data type, expecting 2D grid array.", + Mage_Dataflow_Model_Convert_Exception::FATAL + ); } return true; } diff --git app/code/core/Mage/Dataflow/Model/Convert/Parser/Csv.php app/code/core/Mage/Dataflow/Model/Convert/Parser/Csv.php index 960b2e5..2292931 100644 --- app/code/core/Mage/Dataflow/Model/Convert/Parser/Csv.php +++ app/code/core/Mage/Dataflow/Model/Convert/Parser/Csv.php @@ -62,13 +62,15 @@ class Mage_Dataflow_Model_Convert_Parser_Csv extends Mage_Dataflow_Model_Convert $adapter = Mage::getModel($adapterName); } catch (Exception $e) { - $message = Mage::helper('dataflow')->__('Declared adapter %s was not found.', $adapterName); + $message = Mage::helper('dataflow') + ->__('Declared adapter %s was not found.', $adapterName); $this->addException($message, Mage_Dataflow_Model_Convert_Exception::FATAL); return $this; } if (!method_exists($adapter, $adapterMethod)) { - $message = Mage::helper('dataflow')->__('Method "%s" not defined in adapter %s.', $adapterMethod, $adapterName); + $message = Mage::helper('dataflow') + ->__('Method "%s" not defined in adapter %s.', $adapterMethod, $adapterName); $this->addException($message, Mage_Dataflow_Model_Convert_Exception::FATAL); return $this; } @@ -77,8 +79,8 @@ class Mage_Dataflow_Model_Convert_Parser_Csv extends Mage_Dataflow_Model_Convert $batchIoAdapter = $this->getBatchModel()->getIoAdapter(); if (Mage::app()->getRequest()->getParam('files')) { - $file = Mage::app()->getConfig()->getTempVarDir().'/import/' - . urldecode(Mage::app()->getRequest()->getParam('files')); + $file = Mage::app()->getConfig()->getTempVarDir() . '/import/' + . str_replace('../', '', urldecode(Mage::app()->getRequest()->getParam('files'))); $this->_copy($file); } diff --git app/code/core/Mage/Dataflow/Model/Convert/Parser/Xml/Excel.php app/code/core/Mage/Dataflow/Model/Convert/Parser/Xml/Excel.php index f25b007..0960963 100644 --- app/code/core/Mage/Dataflow/Model/Convert/Parser/Xml/Excel.php +++ app/code/core/Mage/Dataflow/Model/Convert/Parser/Xml/Excel.php @@ -69,7 +69,8 @@ class Mage_Dataflow_Model_Convert_Parser_Xml_Excel extends Mage_Dataflow_Model_C } if (!method_exists($adapter, $adapterMethod)) { - $message = Mage::helper('dataflow')->__('Method "%s" was not defined in adapter %s.', $adapterMethod, $adapterName); + $message = Mage::helper('dataflow') + ->__('Method "%s" was not defined in adapter %s.', $adapterMethod, $adapterName); $this->addException($message, Mage_Dataflow_Model_Convert_Exception::FATAL); return $this; } @@ -78,8 +79,8 @@ class Mage_Dataflow_Model_Convert_Parser_Xml_Excel extends Mage_Dataflow_Model_C $batchIoAdapter = $this->getBatchModel()->getIoAdapter(); if (Mage::app()->getRequest()->getParam('files')) { - $file = Mage::app()->getConfig()->getTempVarDir().'/import/' - . urldecode(Mage::app()->getRequest()->getParam('files')); + $file = Mage::app()->getConfig()->getTempVarDir() . '/import/' + . str_replace('../', '', urldecode(Mage::app()->getRequest()->getParam('files'))); $this->_copy($file); } diff --git app/code/core/Mage/ImportExport/Model/Import/Uploader.php app/code/core/Mage/ImportExport/Model/Import/Uploader.php index 3211d37..76667e8 100644 --- app/code/core/Mage/ImportExport/Model/Import/Uploader.php +++ app/code/core/Mage/ImportExport/Model/Import/Uploader.php @@ -61,6 +61,11 @@ class Mage_ImportExport_Model_Import_Uploader extends Mage_Core_Model_File_Uploa $this->setAllowedExtensions(array_keys($this->_allowedMimeTypes)); $this->addValidateCallback('catalog_product_image', Mage::helper('catalog/image'), 'validateUploadFile'); + $this->addValidateCallback( + Mage_Core_Model_File_Validator_Image::NAME, + Mage::getModel('core/file_validator_image'), + 'validate' + ); $this->_uploadType = self::SINGLE_STYLE; } diff --git app/code/core/Mage/Sales/Model/Quote/Item.php app/code/core/Mage/Sales/Model/Quote/Item.php index d413343..f105bea 100644 --- app/code/core/Mage/Sales/Model/Quote/Item.php +++ app/code/core/Mage/Sales/Model/Quote/Item.php @@ -500,8 +500,9 @@ class Mage_Sales_Model_Quote_Item extends Mage_Sales_Model_Quote_Item_Abstract /** @var Unserialize_Parser $parser */ $parser = Mage::helper('core/unserializeArray'); - $_itemOptionValue = $parser->unserialize($itemOptionValue); - $_optionValue = $parser->unserialize($optionValue); + $_itemOptionValue = + is_numeric($itemOptionValue) ? $itemOptionValue : $parser->unserialize($itemOptionValue); + $_optionValue = is_numeric($optionValue) ? $optionValue : $parser->unserialize($optionValue); if (is_array($_itemOptionValue) && is_array($_optionValue)) { $itemOptionValue = $_itemOptionValue; diff --git app/code/core/Mage/Widget/Model/Widget/Instance.php app/code/core/Mage/Widget/Model/Widget/Instance.php index c551205..e5d0134 100644 --- app/code/core/Mage/Widget/Model/Widget/Instance.php +++ app/code/core/Mage/Widget/Model/Widget/Instance.php @@ -347,7 +347,11 @@ class Mage_Widget_Model_Widget_Instance extends Mage_Core_Model_Abstract public function getWidgetParameters() { if (is_string($this->getData('widget_parameters'))) { - return unserialize($this->getData('widget_parameters')); + try { + return Mage::helper('core/unserializeArray')->unserialize($this->getData('widget_parameters')); + } catch (Exception $e) { + Mage::logException($e); + } } return (is_array($this->getData('widget_parameters'))) ? $this->getData('widget_parameters') : array(); } diff --git app/code/core/Mage/XmlConnect/Helper/Image.php app/code/core/Mage/XmlConnect/Helper/Image.php index e8d6e29..38d8ed3 100644 --- app/code/core/Mage/XmlConnect/Helper/Image.php +++ app/code/core/Mage/XmlConnect/Helper/Image.php @@ -100,6 +100,11 @@ class Mage_XmlConnect_Helper_Image extends Mage_Core_Helper_Abstract $uploader = Mage::getModel('core/file_uploader', $field); $uploader->setAllowedExtensions(array('jpg', 'jpeg', 'gif', 'png')); $uploader->setAllowRenameFiles(true); + $uploader->addValidateCallback( + Mage_Core_Model_File_Validator_Image::NAME, + Mage::getModel('core/file_validator_image'), + 'validate' + ); $uploader->save($uploadDir); $uploadedFilename = $uploader->getUploadedFileName(); $uploadedFilename = $this->_getResizedFilename($field, $uploadedFilename, true); diff --git app/code/core/Mage/XmlConnect/controllers/Adminhtml/MobileController.php app/code/core/Mage/XmlConnect/controllers/Adminhtml/MobileController.php index 28d4fae..dd567ab 100644 --- app/code/core/Mage/XmlConnect/controllers/Adminhtml/MobileController.php +++ app/code/core/Mage/XmlConnect/controllers/Adminhtml/MobileController.php @@ -567,7 +567,7 @@ class Mage_XmlConnect_Adminhtml_MobileController extends Mage_Adminhtml_Controll $result = $themesHelper->deleteTheme($themeId); if ($result) { $response = array( - 'message' => $this->__('Theme has been delete.'), + 'message' => $this->__('Theme has been deleted.'), 'themes' => $themesHelper->getAllThemesArray(true), 'themeSelector' => $themesHelper->getThemesSelector(), 'selectedTheme' => $themesHelper->getDefaultThemeName() @@ -1393,6 +1393,11 @@ class Mage_XmlConnect_Adminhtml_MobileController extends Mage_Adminhtml_Controll /** @var $uploader Mage_Core_Model_File_Uploader */ $uploader = Mage::getModel('core/file_uploader', $imageModel->getImageType()); $uploader->setAllowRenameFiles(true)->setAllowedExtensions(array('jpg', 'jpeg', 'gif', 'png')); + $uploader->addValidateCallback( + Mage_Core_Model_File_Validator_Image::NAME, + Mage::getModel('core/file_validator_image'), + 'validate' + ); $result = $uploader->save(Mage_XmlConnect_Model_Images::getBasePath(), $newFileName); $result['thumbnail'] = Mage::getModel('xmlconnect/images')->getCustomSizeImageUrl( $result['file'], diff --git app/design/adminhtml/default/default/layout/main.xml app/design/adminhtml/default/default/layout/main.xml index 7fc3ead..19d95fe 100644 --- app/design/adminhtml/default/default/layout/main.xml +++ app/design/adminhtml/default/default/layout/main.xml @@ -119,6 +119,8 @@ Default layout, loads most of the pages + + diff --git app/design/adminhtml/default/default/template/notification/formkey.phtml app/design/adminhtml/default/default/template/notification/formkey.phtml new file mode 100644 index 0000000..7d348fc --- /dev/null +++ app/design/adminhtml/default/default/template/notification/formkey.phtml @@ -0,0 +1,38 @@ + +canShow()): ?> +
+ Important: + Formkey validation on checkout disabled. This may expose security risks. + We strongly recommend to Enable Form Key Validation On Checkout in + Admin / Security Section, + for protect your own checkout process. +
+ diff --git app/design/adminhtml/default/default/template/notification/symlink.phtml app/design/adminhtml/default/default/template/notification/symlink.phtml new file mode 100644 index 0000000..6d13cb5 --- /dev/null +++ app/design/adminhtml/default/default/template/notification/symlink.phtml @@ -0,0 +1,34 @@ + +isSymlinkEnabled()): ?> +
+ helper('adminhtml')->__('Symlinks are enabled. This may expose security risks. We strongly recommend to disable them.')?> +
+ diff --git app/design/adminhtml/default/default/template/oauth/authorize/head-simple.phtml app/design/adminhtml/default/default/template/oauth/authorize/head-simple.phtml index 9ad6cdff..348ffbf 100644 --- app/design/adminhtml/default/default/template/oauth/authorize/head-simple.phtml +++ app/design/adminhtml/default/default/template/oauth/authorize/head-simple.phtml @@ -42,7 +42,7 @@ var BLANK_URL = 'getJsUrl() ?>blank.html'; var BLANK_IMG = 'getJsUrl() ?>spacer.gif'; var BASE_URL = 'getUrl('*') ?>'; - var SKIN_URL = 'getSkinUrl() ?>'; + var SKIN_URL = 'jsQuoteEscape($this->getSkinUrl()) ?>'; var FORM_KEY = 'getFormKey() ?>'; //]]> diff --git app/design/adminhtml/default/default/template/page/head.phtml app/design/adminhtml/default/default/template/page/head.phtml index dd1f8d4..c2b8ff9 100644 --- app/design/adminhtml/default/default/template/page/head.phtml +++ app/design/adminhtml/default/default/template/page/head.phtml @@ -33,7 +33,7 @@ var BLANK_URL = 'getJsUrl() ?>blank.html'; var BLANK_IMG = 'getJsUrl() ?>spacer.gif'; var BASE_URL = 'getUrl('*') ?>'; - var SKIN_URL = 'getSkinUrl() ?>'; + var SKIN_URL = 'jsQuoteEscape($this->getSkinUrl()) ?>'; var FORM_KEY = 'getFormKey() ?>'; diff --git app/design/frontend/base/default/template/checkout/cart/shipping.phtml app/design/frontend/base/default/template/checkout/cart/shipping.phtml index 7290aee..df02183 100644 --- app/design/frontend/base/default/template/checkout/cart/shipping.phtml +++ app/design/frontend/base/default/template/checkout/cart/shipping.phtml @@ -109,6 +109,7 @@
+ getBlockHtml('formkey') ?> - + diff --git app/design/frontend/rwd/default/template/checkout/cart/shipping.phtml app/design/frontend/rwd/default/template/checkout/cart/shipping.phtml index f4a0e3d..e293822 100644 --- app/design/frontend/rwd/default/template/checkout/cart/shipping.phtml +++ app/design/frontend/rwd/default/template/checkout/cart/shipping.phtml @@ -120,6 +120,7 @@ __('Update Total') ?> + getBlockHtml('formkey') ?>