diff --git a/.github/CONTRIBUTING.md b/.github/CONTRIBUTING.md index 92a51eb84a4ab..89aea7299855c 100644 --- a/.github/CONTRIBUTING.md +++ b/.github/CONTRIBUTING.md @@ -1,18 +1,23 @@ # Contributing to Magento 2 code Contributions to the Magento 2 codebase are done using the fork & pull model. -This contribution model has contributors maintaining their own copy of the forked codebase (which can easily be synced with the main copy). The forked repository is then used to submit a request to the base repository to “pull” a set of changes. For more information on pull requests please refer to [GitHub Help](https://help.github.com/articles/about-pull-requests/). +This contribution model has contributors maintaining their own fork of the Magento 2 repository. +The forked repository is then used to submit a request to the base repository to “pull” a set of changes. +For more information on pull requests please refer to [GitHub Help](https://help.github.com/articles/about-pull-requests/). Contributions can take the form of new components or features, changes to existing features, tests, documentation (such as developer guides, user guides, examples, or specifications), bug fixes or optimizations. -The Magento 2 development team will review all issues and contributions submitted by the community of developers in the first in, first out order. During the review we might require clarifications from the contributor. If there is no response from the contributor within two weeks, the pull request will be closed. +The Magento 2 development team or community maintainers will review all issues and contributions submitted by the community of developers in the first in, first out order. +During the review we might require clarifications from the contributor. +If there is no response from the contributor within two weeks, the pull request will be closed. +For more detailed information on contribution please read our [beginners guide](https://github.com/magento/magento2/wiki/Getting-Started). ## Contribution requirements -1. Contributions must adhere to the [Magento coding standards](https://devdocs.magento.com/guides/v2.2/coding-standards/bk-coding-standards.html). +1. Contributions must adhere to the [Magento coding standards](https://devdocs.magento.com/guides/v2.3/coding-standards/bk-coding-standards.html). 2. Pull requests (PRs) must be accompanied by a meaningful description of their purpose. Comprehensive descriptions increase the chances of a pull request being merged quickly and without additional clarification requests. -3. Commits must be accompanied by meaningful commit messages. Please see the [Magento Pull Request Template](https://github.com/magento/magento2/blob/2.2-develop/.github/PULL_REQUEST_TEMPLATE.md) for more information. +3. Commits must be accompanied by meaningful commit messages. Please see the [Magento Pull Request Template](https://github.com/magento/magento2/blob/2.3-develop/.github/PULL_REQUEST_TEMPLATE.md) for more information. 4. PRs which include bug fixes must be accompanied with a step-by-step description of how to reproduce the bug. 3. PRs which include new logic or new features must be submitted along with: * Unit/integration test coverage @@ -22,15 +27,22 @@ The Magento 2 development team will review all issues and contributions submitte ## Contribution process -If you are a new GitHub user, we recommend that you create your own [free github account](https://github.com/signup/free). This will allow you to collaborate with the Magento 2 development team, fork the Magento 2 project and send pull requests. +If you are a new GitHub user, we recommend that you create your own [free github account](https://github.com/signup/free). +This will allow you to collaborate with the Magento 2 development team, fork the Magento 2 project and send pull requests. 1. Search current [listed issues](https://github.com/magento/magento2/issues) (open or closed) for similar proposals of intended contribution before starting work on a new contribution. 2. Review the [Contributor License Agreement](https://magento.com/legaldocuments/mca) if this is your first time contributing. 3. Create and test your work. -4. Fork the Magento 2 repository according to the [Fork A Repository instructions](https://devdocs.magento.com/guides/v2.2/contributor-guide/contributing.html#fork) and when you are ready to send us a pull request – follow the [Create A Pull Request instructions](https://devdocs.magento.com/guides/v2.2/contributor-guide/contributing.html#pull_request). +4. Fork the Magento 2 repository according to the [Fork A Repository instructions](https://devdocs.magento.com/guides/v2.3/contributor-guide/contributing.html#fork) and when you are ready to send us a pull request – follow the [Create A Pull Request instructions](https://devdocs.magento.com/guides/v2.3/contributor-guide/contributing.html#pull_request). 5. Once your contribution is received the Magento 2 development team will review the contribution and collaborate with you as needed. ## Code of Conduct Please note that this project is released with a Contributor Code of Conduct. We expect you to agree to its terms when participating in this project. The full text is available in the repository [Wiki](https://github.com/magento/magento2/wiki/Magento-Code-of-Conduct). + +## Connecting with Community! + +If you have any questions, join us in [#beginners](https://magentocommeng.slack.com/messages/CH8BGFX9D) Slack chat. If you are not on our slack, [click here](http://tinyurl.com/engcom-slack) to join. + +Need to find a project? Check out the [Slack Channels](https://github.com/magento/magento2/wiki/Slack-Channels) (with listed project info) and the [Magento Community Portal](https://opensource.magento.com/). diff --git a/.github/PULL_REQUEST_TEMPLATE.md b/.github/PULL_REQUEST_TEMPLATE.md index f191bd9aaba67..11da06ee704c6 100644 --- a/.github/PULL_REQUEST_TEMPLATE.md +++ b/.github/PULL_REQUEST_TEMPLATE.md @@ -21,7 +21,6 @@ There could be 1 or more issues linked here and it will help us find some more information about the reasoning behind this change. --> 1. magento/magento2#: Issue title -2. ... ### Manual testing scenarios (*) + ### Contribution checklist (*) - [ ] Pull request has a meaningful description of its purpose - [ ] All commits are accompanied by meaningful commit messages - [ ] All new or changed code is covered with unit/integration tests (if applicable) - - [ ] All automated tests passed successfully (all builds on Travis CI are green) + - [ ] All automated tests passed successfully (all builds are green) diff --git a/.travis.yml b/.travis.yml.sample similarity index 100% rename from .travis.yml rename to .travis.yml.sample diff --git a/README.md b/README.md index ecd457a4f1aef..73154c18d891d 100644 --- a/README.md +++ b/README.md @@ -1,4 +1,3 @@ -[![Build Status](https://travis-ci.org/magento/magento2.svg?branch=2.3-develop)](https://travis-ci.org/magento/magento2) [![Open Source Helpers](https://www.codetriage.com/magento/magento2/badges/users.svg)](https://www.codetriage.com/magento/magento2) [![Gitter](https://badges.gitter.im/Join%20Chat.svg)](https://gitter.im/magento/magento2?utm_source=badge&utm_medium=badge&utm_campaign=pr-badge) [![Crowdin](https://d322cqt584bo4o.cloudfront.net/magento-2/localized.svg)](https://crowdin.com/project/magento-2) diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 0000000000000..2b06199e5f95a --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,10 @@ +# Reporting Security Issues + +Magento values the contributions of the security research community, and we look forward to working with you to minimize risk to Magento merchants. + +## Where should I report security issues? + +We strongly encourage you to report all security issues privately via our [bug bounty program](https://hackerone.com/magento). Please provide us with relevant technical details and repro steps to expedite our investigation. If you prefer not to use HackerOne, email us directly at `psirt@adobe.com` with details and repro steps. + +## Learning More About Security +To learn more about securing a Magento store, please visit the [Security Center](https://magento.com/security). diff --git a/app/code/Magento/AdminNotification/Model/Feed.php b/app/code/Magento/AdminNotification/Model/Feed.php index d3b0b8501c864..b99a8bbbc9031 100644 --- a/app/code/Magento/AdminNotification/Model/Feed.php +++ b/app/code/Magento/AdminNotification/Model/Feed.php @@ -5,6 +5,8 @@ */ namespace Magento\AdminNotification\Model; +use Magento\Framework\Escaper; +use Magento\Framework\App\ObjectManager; use Magento\Framework\Config\ConfigOptionsListConstants; /** @@ -25,6 +27,11 @@ class Feed extends \Magento\Framework\Model\AbstractModel const XML_LAST_UPDATE_PATH = 'system/adminnotification/last_update'; + /** + * @var Escaper + */ + private $escaper; + /** * Feed url * @@ -77,6 +84,7 @@ class Feed extends \Magento\Framework\Model\AbstractModel * @param \Magento\Framework\Model\ResourceModel\AbstractResource $resource * @param \Magento\Framework\Data\Collection\AbstractDb $resourceCollection * @param array $data + * @param Escaper|null $escaper * @SuppressWarnings(PHPMD.ExcessiveParameterList) */ public function __construct( @@ -90,21 +98,26 @@ public function __construct( \Magento\Framework\UrlInterface $urlBuilder, \Magento\Framework\Model\ResourceModel\AbstractResource $resource = null, \Magento\Framework\Data\Collection\AbstractDb $resourceCollection = null, - array $data = [] + array $data = [], + Escaper $escaper = null ) { parent::__construct($context, $registry, $resource, $resourceCollection, $data); - $this->_backendConfig = $backendConfig; - $this->_inboxFactory = $inboxFactory; - $this->curlFactory = $curlFactory; + $this->_backendConfig = $backendConfig; + $this->_inboxFactory = $inboxFactory; + $this->curlFactory = $curlFactory; $this->_deploymentConfig = $deploymentConfig; - $this->productMetadata = $productMetadata; - $this->urlBuilder = $urlBuilder; + $this->productMetadata = $productMetadata; + $this->urlBuilder = $urlBuilder; + $this->escaper = $escaper ?? ObjectManager::getInstance()->get( + Escaper::class + ); } /** * Init model * * @return void + * phpcs:disable Magento2.CodeAnalysis.EmptyBlock */ protected function _construct() { @@ -252,6 +265,6 @@ public function getFeedXml() */ private function escapeString(\SimpleXMLElement $data) { - return htmlspecialchars((string)$data); + return $this->escaper->escapeHtml((string)$data); } } diff --git a/app/code/Magento/AdminNotification/view/adminhtml/templates/notification/window.phtml b/app/code/Magento/AdminNotification/view/adminhtml/templates/notification/window.phtml index 3f79e803ccca2..b4f19bda36cbf 100644 --- a/app/code/Magento/AdminNotification/view/adminhtml/templates/notification/window.phtml +++ b/app/code/Magento/AdminNotification/view/adminhtml/templates/notification/window.phtml @@ -4,10 +4,6 @@ * See COPYING.txt for license details. */ -// @codingStandardsIgnoreFile - -?> -getHeaderText() ?>" + "title": "escapeHtmlAttr($block->getHeaderText()) ?>" } }'>
  • - getNoticeMessageText() ?>
    - getReadDetailsText() ?> + escapeHtml($block->getNoticeMessageText()) ?>
    + + escapeHtml($block->getReadDetailsText()) ?> +
    • diff --git a/app/code/Magento/AdminNotification/view/adminhtml/templates/system/messages.phtml b/app/code/Magento/AdminNotification/view/adminhtml/templates/system/messages.phtml index 01d6fdcb29571..22512b9055f95 100644 --- a/app/code/Magento/AdminNotification/view/adminhtml/templates/system/messages.phtml +++ b/app/code/Magento/AdminNotification/view/adminhtml/templates/system/messages.phtml @@ -4,41 +4,41 @@ * See COPYING.txt for license details. */ -// @codingStandardsIgnoreFile - +/** @var $block \Magento\AdminNotification\Block\System\Messages */ ?> - getLastCritical();?> -
    +
    - +
    • - getText() ?> + escapeHtml($lastCritical->getText()) ?>
    - + escapeHtml(__('System Messages:')) ?> - getCriticalCount()): ?> + getCriticalCount()) : ?>
    - getCriticalCount() ?> + getCriticalCount() ?>
    - + - getMajorCount()): ?> + getMajorCount()) : ?>
    - getMajorCount() ?> + getMajorCount() ?>
    - +
    diff --git a/app/code/Magento/AdminNotification/view/adminhtml/templates/system/messages/popup.phtml b/app/code/Magento/AdminNotification/view/adminhtml/templates/system/messages/popup.phtml index 0448daaf17644..494e60865623b 100644 --- a/app/code/Magento/AdminNotification/view/adminhtml/templates/system/messages/popup.phtml +++ b/app/code/Magento/AdminNotification/view/adminhtml/templates/system/messages/popup.phtml @@ -4,16 +4,15 @@ * See COPYING.txt for license details. */ -// @codingStandardsIgnoreFile - +/** @var $block \Magento\AdminNotification\Block\System\Messages\UnreadMessagePopup */ ?> - -