diff --git a/app/code/Magento/AdminNotification/Model/Feed.php b/app/code/Magento/AdminNotification/Model/Feed.php index 1766425fb19b1..5a4f7d5ddd390 100644 --- a/app/code/Magento/AdminNotification/Model/Feed.php +++ b/app/code/Magento/AdminNotification/Model/Feed.php @@ -25,6 +25,11 @@ class Feed extends \Magento\Framework\Model\AbstractModel const XML_LAST_UPDATE_PATH = 'system/adminnotification/last_update'; + /** + * @var \Magento\Framework\Escaper + */ + private $escaper; + /** * Feed url * @@ -77,6 +82,7 @@ class Feed extends \Magento\Framework\Model\AbstractModel * @param \Magento\Framework\Model\ResourceModel\AbstractResource $resource * @param \Magento\Framework\Data\Collection\AbstractDb $resourceCollection * @param array $data + * @param \Magento\Framework\Escaper|null $escaper * @SuppressWarnings(PHPMD.ExcessiveParameterList) */ public function __construct( @@ -90,7 +96,8 @@ public function __construct( \Magento\Framework\UrlInterface $urlBuilder, \Magento\Framework\Model\ResourceModel\AbstractResource $resource = null, \Magento\Framework\Data\Collection\AbstractDb $resourceCollection = null, - array $data = [] + array $data = [], + \Magento\Framework\Escaper $escaper = null ) { parent::__construct($context, $registry, $resource, $resourceCollection, $data); $this->_backendConfig = $backendConfig; @@ -99,12 +106,16 @@ public function __construct( $this->_deploymentConfig = $deploymentConfig; $this->productMetadata = $productMetadata; $this->urlBuilder = $urlBuilder; + $this->escaper = $escaper ?? \Magento\Framework\App\ObjectManager::getInstance()->get( + \Magento\Framework\Escaper::class + ); } /** * Init model * * @return void + * phpcs:disable Magento2.CodeAnalysis.EmptyBlock */ protected function _construct() { @@ -255,6 +266,6 @@ public function getFeedXml() */ private function escapeString(\SimpleXMLElement $data) { - return htmlspecialchars((string)$data); + return $this->escaper->escapeHtml((string)$data); } } diff --git a/app/code/Magento/AdminNotification/composer.json b/app/code/Magento/AdminNotification/composer.json index 14afd21079f34..618191a84d6b8 100644 --- a/app/code/Magento/AdminNotification/composer.json +++ b/app/code/Magento/AdminNotification/composer.json @@ -2,7 +2,7 @@ "name": "magento/module-admin-notification", "description": "N/A", "require": { - "php": "~7.0.13|~7.1.0", + "php": "~7.0.13|~7.1.0|~7.2.0", "magento/module-store": "100.2.*", "magento/module-backend": "100.2.*", "magento/module-media-storage": "100.2.*", diff --git a/app/code/Magento/AdminNotification/view/adminhtml/templates/notification/window.phtml b/app/code/Magento/AdminNotification/view/adminhtml/templates/notification/window.phtml index 3f79e803ccca2..6f403d8fbd36b 100644 --- a/app/code/Magento/AdminNotification/view/adminhtml/templates/notification/window.phtml +++ b/app/code/Magento/AdminNotification/view/adminhtml/templates/notification/window.phtml @@ -4,10 +4,6 @@ * See COPYING.txt for license details. */ -// @codingStandardsIgnoreFile - -?> -getHeaderText() ?>" + "title": "escapeHtmlAttr($block->getHeaderText()) ?>" } }'>
  • - getNoticeMessageText() ?>
    - getReadDetailsText() ?> + escapeHtml($block->getNoticeMessageText()) ?>
    + escapeHtml($block->getReadDetailsText()) ?>
  • diff --git a/app/code/Magento/AdminNotification/view/adminhtml/templates/system/messages.phtml b/app/code/Magento/AdminNotification/view/adminhtml/templates/system/messages.phtml index 01d6fdcb29571..60e3d63473596 100644 --- a/app/code/Magento/AdminNotification/view/adminhtml/templates/system/messages.phtml +++ b/app/code/Magento/AdminNotification/view/adminhtml/templates/system/messages.phtml @@ -4,41 +4,39 @@ * See COPYING.txt for license details. */ -// @codingStandardsIgnoreFile - +/** @var $block \Magento\AdminNotification\Block\System\Messages */ ?> - getLastCritical();?> -
    +
    - +
    • - getText() ?> + escapeHtml($lastCritical->getText()) ?>
    - + escapeHtml(__('System Messages:')) ?> - getCriticalCount()): ?> + getCriticalCount()) : ?> - + - getMajorCount()): ?> - - + getMajorCount()) : ?> + +
    diff --git a/app/code/Magento/AdminNotification/view/adminhtml/templates/system/messages/popup.phtml b/app/code/Magento/AdminNotification/view/adminhtml/templates/system/messages/popup.phtml index 0448daaf17644..6673ad7a18b38 100644 --- a/app/code/Magento/AdminNotification/view/adminhtml/templates/system/messages/popup.phtml +++ b/app/code/Magento/AdminNotification/view/adminhtml/templates/system/messages/popup.phtml @@ -4,16 +4,14 @@ * See COPYING.txt for license details. */ -// @codingStandardsIgnoreFile - +/** @var $block \Magento\AdminNotification\Block\System\Messages\UnreadMessagePopup */ ?> - -