Skip to content
This repository was archived by the owner on Nov 19, 2024. It is now read-only.

Commit 1ed39d1

Browse files
LeeSaferiteLeeSaferite
authored
Merge pull request #69 from willcodeforfood/magento-1.9
Import Magento Release 1.9.3.10
2 parents 6135503 + f1127a8 commit 1ed39d1

File tree

120 files changed

+762
-253
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

120 files changed

+762
-253
lines changed

‎RELEASE_NOTES.txt‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,13 @@
1+
==== 1.9.3.10 ====
2+
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
3+
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
4+
] NOTE: Current Release Notes are maintained at: [
5+
] [
6+
] http://devdocs.magento.com/guides/m1x/ce19-ee114/ce1.9_release-notes.html [
7+
] [
8+
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
9+
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
10+
111
==== 1.9.3.9 ====
212
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
313
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

‎app/Mage.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -171,7 +171,7 @@ public static function getVersionInfo()
171171
'major' => '1',
172172
'minor' => '9',
173173
'revision' => '3',
174-
'patch' => '9',
174+
'patch' => '10',
175175
'stability' => '',
176176
'number' => '',
177177
);

‎app/code/core/Mage/Admin/Model/User.php‎

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -66,6 +66,10 @@ class Mage_Admin_Model_User extends Mage_Core_Model_Abstract
6666
const XML_PATH_FORGOT_EMAIL_TEMPLATE = 'admin/emails/forgot_email_template';
6767
const XML_PATH_FORGOT_EMAIL_IDENTITY = 'admin/emails/forgot_email_identity';
6868
const XML_PATH_STARTUP_PAGE = 'admin/startup/page';
69+
70+
/** Configuration paths for notifications */
71+
const XML_PATH_ADDITIONAL_EMAILS = 'general/additional_notification_emails/admin_user_create';
72+
const XML_PATH_NOTIFICATION_EMAILS_TEMPLATE = 'admin/emails/admin_notification_email_template';
6973
/**#@-*/
7074

7175
/**
@@ -692,4 +696,53 @@ protected function _getDateNow($dayOnly = false)
692696
{
693697
return now($dayOnly);
694698
}
699+
700+
/**
701+
* Send notification to general Contact and additional emails when new admin user created.
702+
* You can declare additional emails in Mage_Core general/additional_notification_emails/admin_user_create node.
703+
*
704+
* @param $user
705+
* @return $this
706+
*/
707+
public function sendAdminNotification($user)
708+
{
709+
// define general contact Name and Email
710+
$generalContactName = Mage::getStoreConfig('trans_email/ident_general/name');
711+
$generalContactEmail = Mage::getStoreConfig('trans_email/ident_general/email');
712+
713+
// collect general and additional emails
714+
$emails = $this->getUserCreateAdditionalEmail();
715+
$emails[] = $generalContactEmail;
716+
717+
/** @var $mailer Mage_Core_Model_Email_Template_Mailer */
718+
$mailer = Mage::getModel('core/email_template_mailer');
719+
$emailInfo = Mage::getModel('core/email_info');
720+
$emailInfo->addTo(array_filter($emails), $generalContactName);
721+
$mailer->addEmailInfo($emailInfo);
722+
723+
// Set all required params and send emails
724+
$mailer->setSender(array(
725+
'name' => $generalContactName,
726+
'email' => $generalContactEmail,
727+
));
728+
$mailer->setStoreId(0);
729+
$mailer->setTemplateId(Mage::getStoreConfig(self::XML_PATH_NOTIFICATION_EMAILS_TEMPLATE));
730+
$mailer->setTemplateParams(array(
731+
'user' => $user,
732+
));
733+
$mailer->send();
734+
735+
return $this;
736+
}
737+
738+
/**
739+
* Get additional emails for notification from config.
740+
*
741+
* @return array
742+
*/
743+
public function getUserCreateAdditionalEmail()
744+
{
745+
$emails = str_replace(' ', '', Mage::getStoreConfig(self::XML_PATH_ADDITIONAL_EMAILS));
746+
return explode(',', $emails);
747+
}
695748
}

‎app/code/core/Mage/Admin/etc/config.xml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -84,6 +84,7 @@
8484
<admin>
8585
<emails>
8686
<forgot_email_template>admin_emails_forgot_email_template</forgot_email_template>
87+
<admin_notification_email_template>admin_emails_admin_notification_email_template</admin_notification_email_template>
8788
<forgot_email_identity>general</forgot_email_identity>
8889
<password_reset_link_expiration_period>2</password_reset_link_expiration_period>
8990
</emails>

‎app/code/core/Mage/Adminhtml/Block/Catalog/Product/Edit/Tab/Super/Config.php‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -154,6 +154,7 @@ public function getAttributesJson()
154154
} else {
155155
// Hide price if needed
156156
foreach ($attributes as &$attribute) {
157+
$attribute['label'] = $this->escapeHtml($attribute['label']);
157158
if (isset($attribute['values']) && is_array($attribute['values'])) {
158159
foreach ($attribute['values'] as &$attributeValue) {
159160
if (!$this->getCanReadPrice()) {

‎app/code/core/Mage/Adminhtml/Block/Widget/Grid/Massaction/Abstract.php‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -190,7 +190,7 @@ public function getGridJsObjectName()
190190
public function getSelectedJson()
191191
{
192192
if($selected = $this->getRequest()->getParam($this->getFormFieldNameInternal())) {
193-
$selected = explode(',', $selected);
193+
$selected = explode(',', $this->quoteEscape($selected));
194194
return join(',', $selected);
195195
} else {
196196
return '';
@@ -205,7 +205,7 @@ public function getSelectedJson()
205205
public function getSelected()
206206
{
207207
if($selected = $this->getRequest()->getParam($this->getFormFieldNameInternal())) {
208-
$selected = explode(',', $selected);
208+
$selected = explode(',', $this->quoteEscape($selected));
209209
return $selected;
210210
} else {
211211
return array();

‎app/code/core/Mage/Adminhtml/Model/LayoutUpdate/Validator.php‎

Lines changed: 36 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -38,6 +38,7 @@ class Mage_Adminhtml_Model_LayoutUpdate_Validator extends Zend_Validate_Abstract
3838
{
3939
const XML_INVALID = 'invalidXml';
4040
const INVALID_TEMPLATE_PATH = 'invalidTemplatePath';
41+
const INVALID_BLOCK_NAME = 'invalidBlockName';
4142
const PROTECTED_ATTR_HELPER_IN_TAG_ACTION_VAR = 'protectedAttrHelperInActionVar';
4243

4344
/**
@@ -56,7 +57,18 @@ class Mage_Adminhtml_Model_LayoutUpdate_Validator extends Zend_Validate_Abstract
5657
'*//template',
5758
'*//@template',
5859
'//*[@method=\'setTemplate\']',
59-
'//*[@method=\'setDataUsingMethod\']//*[text() = \'template\']/../*'
60+
'//*[@method=\'setDataUsingMethod\']//*[contains(translate(text(),
61+
\'ABCDEFGHIJKLMNOPQRSTUVWXYZ\', \'abcdefghijklmnopqrstuvwxyz\'), \'template\')]/../*',
62+
);
63+
64+
/**
65+
* Disallowed template name
66+
*
67+
* @var array
68+
*/
69+
protected $_disallowedBlock = array(
70+
'Mage_Install_Block_End',
71+
'Mage_Rss_Block_Order_New',
6072
);
6173

6274
/**
@@ -91,6 +103,7 @@ protected function _initMessageTemplates()
91103
self::INVALID_TEMPLATE_PATH => Mage::helper('adminhtml')->__(
92104
'Invalid template path used in layout update.'
93105
),
106+
self::INVALID_BLOCK_NAME => Mage::helper('adminhtml')->__('Disallowed block name for frontend.'),
94107
);
95108
}
96109
return $this;
@@ -125,6 +138,10 @@ public function isValid($value)
125138
Mage::helper('adminhtml')->__('XML object is not instance of "Varien_Simplexml_Element".'));
126139
}
127140

141+
if ($value->xpath($this->_getXpathBlockValidationExpression())) {
142+
$this->_error(self::INVALID_BLOCK_NAME);
143+
return false;
144+
}
128145
// if layout update declare custom templates then validate their paths
129146
if ($templatePaths = $value->xpath($this->_getXpathValidationExpression())) {
130147
try {
@@ -154,6 +171,20 @@ protected function _getXpathValidationExpression() {
154171
return implode(" | ", $this->_disallowedXPathExpressions);
155172
}
156173

174+
/**
175+
* Returns xPath for validate incorrect block name
176+
*
177+
* @return string xPath for validate incorrect block name
178+
*/
179+
protected function _getXpathBlockValidationExpression() {
180+
$xpath = "";
181+
if (count($this->_disallowedBlock)) {
182+
$xpath = "//block[@type='";
183+
$xpath .= implode("'] | //block[@type='", $this->_disallowedBlock) . "']";
184+
}
185+
return $xpath;
186+
}
187+
157188
/**
158189
* Validate template path for preventing access to the directory above
159190
* If template path value has "../" @throws Exception
@@ -162,7 +193,11 @@ protected function _getXpathValidationExpression() {
162193
*/
163194
protected function _validateTemplatePath(array $templatePaths)
164195
{
196+
/**@var $path Varien_Simplexml_Element */
165197
foreach ($templatePaths as $path) {
198+
if ($path->hasChildren()) {
199+
$path = stripcslashes(trim((string) $path->children(), '"'));
200+
}
166201
if (strpos($path, '..' . DS) !== false) {
167202
throw new Exception();
168203
}

‎app/code/core/Mage/Adminhtml/controllers/Catalog/ProductController.php‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1031,6 +1031,16 @@ public function quickCreateAction()
10311031
}
10321032

10331033
$product->addData($this->getRequest()->getParam('simple_product', array()));
1034+
1035+
$productSku = $product->getSku();
1036+
if ($productSku && $productSku != Mage::helper('core')->stripTags($productSku)) {
1037+
$result['error'] = array(
1038+
'message' => $this->__('HTML tags are not allowed in SKU attribute.')
1039+
);
1040+
$this->getResponse()->setBody(Mage::helper('core')->jsonEncode($result));
1041+
return;
1042+
}
1043+
10341044
$product->setWebsiteIds($configurableProduct->getWebsiteIds());
10351045

10361046
$autogenerateOptions = array();

‎app/code/core/Mage/Adminhtml/controllers/Permissions/UserController.php‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -101,6 +101,8 @@ public function saveAction()
101101

102102
$id = $this->getRequest()->getParam('user_id');
103103
$model = Mage::getModel('admin/user')->load($id);
104+
// @var $isNew flag for detecting new admin user creation.
105+
$isNew = !$model->getId() ? true : false;
104106
if (!$model->getId() && $id) {
105107
Mage::getSingleton('adminhtml/session')->addError($this->__('This user no longer exists.'));
106108
$this->_redirect('*/*/');
@@ -139,6 +141,10 @@ public function saveAction()
139141

140142
try {
141143
$model->save();
144+
// Send notification to General and additional contacts (if declared) that a new admin user was created.
145+
if (Mage::getStoreConfigFlag('admin/security/crate_admin_user_notification') && $isNew) {
146+
Mage::getModel('admin/user')->sendAdminNotification($model);
147+
}
142148
if ( $uRoles = $this->getRequest()->getParam('roles', false) ) {
143149
/*parse_str($uRoles, $uRoles);
144150
$uRoles = array_keys($uRoles);*/

‎app/code/core/Mage/Adminhtml/etc/config.xml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -54,6 +54,11 @@
5454
<file>admin_password_reset_confirmation.html</file>
5555
<type>html</type>
5656
</admin_emails_forgot_email_template>
57+
<admin_emails_admin_notification_email_template>
58+
<label>New Admin User Create Notification</label>
59+
<file>admin_new_user_notification.html</file>
60+
<type>html</type>
61+
</admin_emails_admin_notification_email_template>
5762
</email>
5863
</template>
5964
<events>

0 commit comments

Comments
 (0)