diff --git a/vendor/magento/module-customer/Plugin/AsyncRequestCustomerGroupAuthorization.php b/vendor/magento/module-customer/Plugin/AsyncRequestCustomerGroupAuthorization.php index 5b5c8ce1fc0c..295b33d2db14 100644 --- a/vendor/magento/module-customer/Plugin/AsyncRequestCustomerGroupAuthorization.php +++ b/vendor/magento/module-customer/Plugin/AsyncRequestCustomerGroupAuthorization.php @@ -9,7 +9,6 @@ namespace Magento\Customer\Plugin; use Magento\Customer\Api\Data\CustomerInterface; -use Magento\Framework\App\ObjectManager; use Magento\Framework\AuthorizationInterface; use Magento\Framework\Exception\AuthorizationException; use Magento\AsynchronousOperations\Model\MassSchedule; @@ -26,6 +25,13 @@ class AsyncRequestCustomerGroupAuthorization */ public const ADMIN_RESOURCE = 'Magento_Customer::manage'; + /** + * account create topic name + * + * @var string + */ + private const TOPIC_NAME = 'async.magento.customer.api.accountmanagementinterface.createaccount.post'; + /** * @var AuthorizationInterface */ @@ -60,6 +66,11 @@ public function beforePublishMass( string $groupId = null, string $userId = null ) { + // only apply the plugin on account create. + if ($topic !== self::TOPIC_NAME) { + return; + } + foreach ($entitiesArray as $entityParams) { foreach ($entityParams as $entity) { if ($entity instanceof CustomerInterface) { diff --git a/vendor/magento/module-quote/etc/webapi.xml b/vendor/magento/module-quote/etc/webapi.xml index 79d98968ea19..a7cce5b03a26 100644 --- a/vendor/magento/module-quote/etc/webapi.xml +++ b/vendor/magento/module-quote/etc/webapi.xml @@ -98,6 +98,9 @@ + + %customer_id% + diff --git a/vendor/magento/module-webapi-async/Controller/Rest/Asynchronous/InputParamsResolver.php b/vendor/magento/module-webapi-async/Controller/Rest/Asynchronous/InputParamsResolver.php index 6718087888bc..6e159eaddf16 100644 --- a/vendor/magento/module-webapi-async/Controller/Rest/Asynchronous/InputParamsResolver.php +++ b/vendor/magento/module-webapi-async/Controller/Rest/Asynchronous/InputParamsResolver.php @@ -8,10 +8,12 @@ namespace Magento\WebapiAsync\Controller\Rest\Asynchronous; +use Magento\Framework\Api\SimpleDataObjectConverter; use Magento\Framework\App\ObjectManager; use Magento\Framework\Exception\AuthorizationException; use Magento\Framework\Exception\InputException; use Magento\Framework\Exception\LocalizedException; +use Magento\Framework\Reflection\MethodsMap; use Magento\Framework\Webapi\Exception; use Magento\Framework\Webapi\Rest\Request as RestRequest; use Magento\Framework\Webapi\ServiceInputProcessor; @@ -24,6 +26,8 @@ /** * This class is responsible for retrieving resolved input data + * + * @SuppressWarnings(PHPMD.CouplingBetweenObjects) */ class InputParamsResolver { @@ -61,6 +65,11 @@ class InputParamsResolver */ private $inputArraySizeLimitValue; + /** + * @var MethodsMap + */ + private $methodsMap; + /** * Initialize dependencies. * @@ -72,6 +81,7 @@ class InputParamsResolver * @param WebapiInputParamsResolver $inputParamsResolver * @param bool $isBulk * @param InputArraySizeLimitValue|null $inputArraySizeLimitValue + * @param MethodsMap|null $methodsMap */ public function __construct( RestRequest $request, @@ -81,7 +91,8 @@ public function __construct( RequestValidator $requestValidator, WebapiInputParamsResolver $inputParamsResolver, bool $isBulk = false, - ?InputArraySizeLimitValue $inputArraySizeLimitValue = null + ?InputArraySizeLimitValue $inputArraySizeLimitValue = null, + ?MethodsMap $methodsMap = null ) { $this->request = $request; $this->paramsOverrider = $paramsOverrider; @@ -92,6 +103,8 @@ public function __construct( $this->isBulk = $isBulk; $this->inputArraySizeLimitValue = $inputArraySizeLimitValue ?? ObjectManager::getInstance() ->get(InputArraySizeLimitValue::class); + $this->methodsMap = $methodsMap ?? ObjectManager::getInstance() + ->get(MethodsMap::class); } /** @@ -119,7 +132,13 @@ public function resolve() $routeServiceMethod = $route->getServiceMethod(); $this->inputArraySizeLimitValue->set($route->getInputArraySizeLimit()); + $this->validateParameters($routeServiceClass, $routeServiceMethod, array_keys($route->getParameters())); + foreach ($inputData as $key => $singleEntityParams) { + if (!is_array($singleEntityParams)) { + continue; + } + $webapiResolvedParams[$key] = $this->resolveBulkItemParams( $singleEntityParams, $routeServiceClass, @@ -143,11 +162,22 @@ public function getInputData() $inputData = $this->request->getRequestData(); $httpMethod = $this->request->getHttpMethod(); - if ($httpMethod == RestRequest::HTTP_METHOD_DELETE) { + if ($httpMethod === RestRequest::HTTP_METHOD_DELETE) { $requestBodyParams = $this->request->getBodyParams(); $inputData = array_merge($requestBodyParams, $inputData); } - return $inputData; + + return array_map(function ($singleEntityParams) { + if (is_array($singleEntityParams)) { + $singleEntityParams = $this->filterInputData($singleEntityParams); + $singleEntityParams = $this->paramsOverrider->override( + $singleEntityParams, + $this->getRoute()->getParameters() + ); + } + + return $singleEntityParams; + }, $inputData); } /** @@ -180,4 +210,65 @@ private function resolveBulkItemParams(array $inputData, string $serviceClass, s { return $this->serviceInputProcessor->process($serviceClass, $serviceMethod, $inputData); } + + /** + * Validates InputData + * + * @param array $inputData + * @return array + */ + private function filterInputData(array $inputData): array + { + $result = []; + + $data = array_filter($inputData, function ($k) use (&$result) { + $key = is_string($k) ? strtolower(str_replace('_', "", $k)) : $k; + return !isset($result[$key]) && ($result[$key] = true); + }, ARRAY_FILTER_USE_KEY); + + return array_map(function ($value) { + return is_array($value) ? $this->filterInputData($value) : $value; + }, $data); + } + + /** + * Validate that parameters are really used in the current request. + * + * @param string $serviceClassName + * @param string $serviceMethodName + * @param array $paramOverriders + */ + private function validateParameters( + string $serviceClassName, + string $serviceMethodName, + array $paramOverriders + ): void { + //phpcs:ignore CopyPaste + $methodParams = $this->methodsMap->getMethodParams($serviceClassName, $serviceMethodName); + foreach ($paramOverriders as $key => $param) { + $arrayKeys = explode('.', $param ?? ''); + $value = array_shift($arrayKeys); + + foreach ($methodParams as $serviceMethodParam) { + $serviceMethodParamName = $serviceMethodParam[MethodsMap::METHOD_META_NAME]; + $serviceMethodType = $serviceMethodParam[MethodsMap::METHOD_META_TYPE]; + + $camelCaseValue = SimpleDataObjectConverter::snakeCaseToCamelCase($value); + if ($serviceMethodParamName === $value || $serviceMethodParamName === $camelCaseValue) { + if (count($arrayKeys) > 0) { + $camelCaseKey = SimpleDataObjectConverter::snakeCaseToCamelCase('set_' . $arrayKeys[0]); + $this->validateParameters($serviceMethodType, $camelCaseKey, [implode('.', $arrayKeys)]); + } + unset($paramOverriders[$key]); + break; + } + } + } + + if (!empty($paramOverriders)) { + $message = 'The current request does not expect the next parameters: ' + . implode(', ', $paramOverriders); + throw new \UnexpectedValueException(__($message)->__toString()); + } + } } diff --git a/dev/tests/api-functional/testsuite/Magento/Quote/Api/GuestCartManagementTest.php b/dev/tests/api-functional/testsuite/Magento/Quote/Api/GuestCartManagementTest.php index 68cc2c2b2315..6f08b21f3812 100644 --- a/dev/tests/api-functional/testsuite/Magento/Quote/Api/GuestCartManagementTest.php +++ b/dev/tests/api-functional/testsuite/Magento/Quote/Api/GuestCartManagementTest.php @@ -354,7 +354,7 @@ public function testPlaceOrder() public function testAssignCustomerByGuestUser() { $this->expectException(\Exception::class); - $this->expectExceptionMessage('You don\'t have the correct permissions to assign the customer to the cart.'); + $this->expectExceptionMessage('Enter and try again.'); /** @var $quote \Magento\Quote\Model\Quote */ $quote = $this->objectManager->create(\Magento\Quote\Model\Quote::class)->load('test01', 'reserved_order_id'); diff --git a/dev/tests/static/testsuite/Magento/Test/Php/_files/phpcpd/blacklist/common.txt b/dev/tests/static/testsuite/Magento/Test/Php/_files/phpcpd/blacklist/common.txt index 08ba4bba28c6..c9d07aa2abed 100644 --- a/dev/tests/static/testsuite/Magento/Test/Php/_files/phpcpd/blacklist/common.txt +++ b/dev/tests/static/testsuite/Magento/Test/Php/_files/phpcpd/blacklist/common.txt @@ -111,3 +111,4 @@ app/code/Magento/ConfigurableProduct/view/adminhtml/templates/catalog/product/ed app/code/Magento/GoogleGtag app/code/Magento/AdminAdobeIms/Observer/AuthObserver app/code/Magento/OpenSearch/SearchAdapter/Adapter +app/code/Magento/WebapiAsync/Controller/Rest/Asynchronous/InputParamsResolver.php