Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

脆弱性対応（4.1） #6255

Merged
merged 12 commits into from
Jul 29, 2024
Merged

脆弱性対応（4.1） #6255

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
12 commits
Select commit Hold shift + click to select a range
ccc5941
バリデーション追加
ji-eunsoo Mar 5, 2024
6602a58
バリデーション追加
ji-eunsoo Mar 5, 2024
dad834d
ubuntuバージョン更新
ji-eunsoo Mar 5, 2024
f5001de
composerバージョン更新
ji-eunsoo Mar 5, 2024
8dd7687
7.4以前では型宣言エラーが出るため削除
ji-eunsoo Mar 5, 2024
4b41b40
Dockerfile修正
ji-eunsoo Mar 7, 2024
108a4d8
Dockerfile修正
ji-eunsoo Mar 7, 2024
da6549f
E2Eテストが回るか確認
ji-eunsoo Mar 7, 2024
e18166a
アップデートに入力値の制限を追加
ji-eunsoo Apr 18, 2024
a5810f4
外部の入力値の削除
ji-eunsoo Apr 18, 2024
8dae817
バージョン更新
ji-eunsoo Jul 23, 2024
f1244fd
Merge pull request #16 from EC-CUBE/feat_php_pkg_Install_Issues_4.1
shinya Jul 23, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 6 additions & 4 deletions .github/workflows/coverage.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,7 +19,7 @@ jobs:
strategy:
fail-fast: false
matrix:
operating-system: [ ubuntu-18.04 ]
operating-system: [ ubuntu-22.04 ]
php: [ 7.4 ]
db: [ pgsql ]
include:
Expand Down Expand Up @@ -58,7 +58,9 @@ jobs:
php-version: ${{ matrix.php }}

- name: composer install
run: composer install --dev --no-interaction -o --apcu-autoloader
run: |
sudo composer self-update --2.2
composer install --dev --no-interaction -o --apcu-autoloader

- name: Setup pcov
run: |
Expand Down Expand Up @@ -96,7 +98,7 @@ jobs:
strategy:
fail-fast: false
matrix:
operating-system: [ ubuntu-18.04 ]
operating-system: [ ubuntu-22.04 ]
php: [ 7.4 ]
db: [ pgsql ]
group: [ admin01, admin02, admin03, front, installer ]
Expand Down Expand Up @@ -153,7 +155,7 @@ jobs:

- name: composer install
run: |
sudo composer selfupdate
sudo composer self-update --2.2
composer install --dev --no-interaction -o --apcu-autoloader
- name: Setup to EC-CUBE
env:
Expand Down
7 changes: 5 additions & 2 deletions .github/workflows/deny-test.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,7 +15,7 @@ on:
jobs:
deploy:
name: Deny check
runs-on: ubuntu-18.04
runs-on: ubuntu-22.04
services:
postgres:
image: postgres:14
Expand Down Expand Up @@ -47,7 +47,9 @@ jobs:
${{ runner.os }}-composer-

- name: Install to Composer
run: composer install --no-scripts --no-dev --no-interaction --optimize-autoloader
run: |
sudo composer self-update --2.2
composer install --no-scripts --no-dev --no-interaction --optimize-autoloader

- name: Translate to templates
run: php bin/template_jp.php
Expand Down Expand Up @@ -111,6 +113,7 @@ jobs:
echo ">>> Started chrome-driver"
sudo Xvfb -ac :99 -screen 0 1280x1024x24 > /dev/null 2>&1 &
echo ">>> Started xvfb"
sudo composer self-update --2.2
composer install --no-scripts --no-interaction --optimize-autoloader
echo "modules:
enabled:
Expand Down
4 changes: 3 additions & 1 deletion .github/workflows/deploy.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,7 +37,9 @@ jobs:
${{ runner.os }}-composer-

- name: Install to Composer
run: composer install --no-scripts --no-dev --no-interaction --optimize-autoloader
run: |
sudo composer self-update --2.2
composer install --no-scripts --no-dev --no-interaction --optimize-autoloader

- name: Translate to templates
run: php bin/template_jp.php
Expand Down
6 changes: 4 additions & 2 deletions .github/workflows/dockerbuild.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,7 +20,7 @@ jobs:
strategy:
fail-fast: false
matrix:
operating-system: [ ubuntu-18.04 ]
operating-system: [ ubuntu-22.04 ]
php: [ 7.4 ]
db: [ pgsql ]
group: [ admin01 ]
Expand Down Expand Up @@ -63,7 +63,9 @@ jobs:
php-version: ${{ matrix.php }}

- name: composer install
run: composer install --dev --no-interaction -o --apcu-autoloader
run: |
sudo composer self-update --2.2
composer install --dev --no-interaction -o --apcu-autoloader
- name: Setup to EC-CUBE
env:
APP_ENV: ${{ matrix.app_env }}
Expand Down
6 changes: 4 additions & 2 deletions .github/workflows/e2e-bc-test.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,7 +20,7 @@ jobs:
fail-fast: false
matrix:
version: [ 4.0.0, 4.0.1, 4.0.2, 4.0.3, 4.0.4, 4.0.5 ]
operating-system: [ ubuntu-18.04 ]
operating-system: [ ubuntu-22.04 ]
php: [ 7.4 ]
db: [ pgsql ]
group: [ front ]
Expand Down Expand Up @@ -78,7 +78,9 @@ jobs:
php-version: ${{ matrix.php }}

- name: composer install
run: composer install --dev --no-interaction -o --apcu-autoloader
run: |
sudo composer self-update --2.2
composer install --dev --no-interaction -o --apcu-autoloader
- name: Setup to EC-CUBE
env:
APP_ENV: ${{ matrix.app_env }}
Expand Down
9 changes: 7 additions & 2 deletions .github/workflows/e2e-test.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,7 +19,7 @@ jobs:
strategy:
fail-fast: false
matrix:
operating-system: [ ubuntu-18.04 ]
operating-system: [ ubuntu-22.04 ]
php: [ 7.4 ]
db: [ pgsql ]
group: [ admin01, admin02, admin03, front, installer ]
Expand Down Expand Up @@ -75,7 +75,9 @@ jobs:
php-version: ${{ matrix.php }}

- name: composer install
run: composer install --dev --no-interaction -o --apcu-autoloader
run: |
sudo composer self-update --2.2
composer install --dev --no-interaction -o --apcu-autoloader
- name: Setup to EC-CUBE
env:
APP_ENV: ${{ matrix.app_env }}
Expand All @@ -91,6 +93,9 @@ jobs:
- name: setup-chromedriver
uses: nanasess/setup-chromedriver@master

- name: Install fonts
run: sudo apt install fonts-ipafont fonts-ipaexfont

- name: Run chromedriver
run: |
export DISPLAY=:99
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/penetration-test.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,7 @@ jobs:
strategy:
fail-fast: false
matrix:
operating-system: [ ubuntu-18.04 ]
operating-system: [ ubuntu-22.04 ]
group:
- 'test/front_login/contact.test.ts'
- 'test/front_guest/contact.test.ts'
Expand Down
4 changes: 3 additions & 1 deletion .github/workflows/phpstan.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,6 +27,8 @@ jobs:
with:
php-version: '7.4'
- name: composer install
run: composer install --dev --no-interaction -o --apcu-autoloader
run: |
sudo composer self-update --2.2
composer install --dev --no-interaction -o --apcu-autoloader
- name: PHPStan
run: vendor/bin/phpstan analyze src/ --error-format=github
24 changes: 16 additions & 8 deletions .github/workflows/plugin-test.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,7 +19,7 @@ jobs:
strategy:
fail-fast: false
matrix:
operating-system: [ ubuntu-18.04 ]
operating-system: [ ubuntu-22.04 ]
php: [ 7.4 ]
db: [ pgsql, mysql ]
method:
Expand Down Expand Up @@ -83,7 +83,9 @@ jobs:
php-version: ${{ matrix.php }}

- name: composer install
run: composer install --dev --no-interaction -o --apcu-autoloader
run: |
sudo composer self-update --2.2
composer install --dev --no-interaction -o --apcu-autoloader

- name: Setup to EC-CUBE
env:
Expand Down Expand Up @@ -163,7 +165,7 @@ jobs:
strategy:
fail-fast: false
matrix:
operating-system: [ ubuntu-18.04 ]
operating-system: [ ubuntu-22.04 ]
php: [ 7.4 ]
db: [ pgsql, mysql ]
method:
Expand Down Expand Up @@ -225,7 +227,9 @@ jobs:
php-version: ${{ matrix.php }}

- name: Install to Composer
run: composer install --dev --no-interaction -o --apcu-autoloader
run: |
sudo composer self-update --2.2
composer install --dev --no-interaction -o --apcu-autoloader

- name: Setup to EC-CUBE
env:
Expand Down Expand Up @@ -305,7 +309,7 @@ jobs:
strategy:
fail-fast: false
matrix:
operating-system: [ ubuntu-18.04 ]
operating-system: [ ubuntu-22.04 ]
php: [ 7.4 ]
db: [ pgsql, mysql ]
method:
Expand Down Expand Up @@ -367,7 +371,9 @@ jobs:
php-version: ${{ matrix.php }}

- name: Install to Composer
run: composer install --dev --no-interaction -o --apcu-autoloader
run: |
sudo composer self-update --2.2
composer install --dev --no-interaction -o --apcu-autoloader

- name: Setup to EC-CUBE
env:
Expand Down Expand Up @@ -447,7 +453,7 @@ jobs:
strategy:
fail-fast: false
matrix:
operating-system: [ ubuntu-18.04 ]
operating-system: [ ubuntu-22.04 ]
php: [ 7.4 ]
db: [ pgsql, mysql ]
method:
Expand Down Expand Up @@ -512,7 +518,9 @@ jobs:
php-version: ${{ matrix.php }}

- name: Install to Composer
run: composer install --dev --no-interaction -o --apcu-autoloader
run: |
sudo composer self-update --2.2
composer install --dev --no-interaction -o --apcu-autoloader

- name: Setup to EC-CUBE
env:
Expand Down
6 changes: 4 additions & 2 deletions .github/workflows/unit-test.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,7 +19,7 @@ jobs:
strategy:
fail-fast: false
matrix:
operating-system: [ ubuntu-18.04 ]
operating-system: [ ubuntu-22.04 ]
php: [ '7.3', '7.4' ]
db: [ mysql, pgsql, sqlite3 ]
include:
Expand Down Expand Up @@ -72,7 +72,9 @@ jobs:
php-version: ${{ matrix.php }}

- name: composer install
run: composer install --dev --no-interaction -o --apcu-autoloader
run: |
sudo composer self-update --2.2
composer install --dev --no-interaction -o --apcu-autoloader

- name: Setup EC-CUBE
env:
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/vaddy-1.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@ on:
jobs:
vaddy:
name: VAddy
runs-on: ubuntu-18.04
runs-on: ubuntu-22.04
strategy:
matrix:
include:
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/vaddy-2.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@ on:
jobs:
vaddy:
name: VAddy
runs-on: ubuntu-18.04
runs-on: ubuntu-22.04
strategy:
matrix:
include:
Expand Down
2 changes: 1 addition & 1 deletion Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -73,7 +73,7 @@ RUN curl -sS https://getcomposer.org/installer \
&& mv composer.phar /usr/bin/composer

# 全体コピー前にcomposer installを先行完了させる(docker cache利用によるリビルド速度向上)

RUN composer self-update --2.2
RUN composer config -g repos.packagist composer https://packagist.jp
COPY composer.json ${APACHE_DOCUMENT_ROOT}/composer.json
COPY composer.lock ${APACHE_DOCUMENT_ROOT}/composer.lock
Expand Down
3 changes: 2 additions & 1 deletion codeception/_envs/github_action.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,6 +8,7 @@ modules:
chromeOptions:
prefs:
download.default_directory: '%GITHUB_WORKSPACE%/codeception/_support/_downloads'
wait: 30
MailCatcher:
url: '127.0.0.1'
port: 1080
port: 1080
6 changes: 6 additions & 0 deletions codeception/acceptance/EA07BasicinfoCest.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -166,16 +166,22 @@ public function basicinfo_支払方法削除(AcceptanceTester $I)
// 削除用の支払い方法の登録
PaymentManagePage::go($I)
->新規入力();

$I->wait(10);

PaymentEditPage::at($I)
->入力_支払方法('dummy payment')
->登録();

$I->wait(10);
// 削除
$page = PaymentManagePage::go($I);
$before = $page->一覧_件数取得();
$page->一覧_削除(1);
$I->see('削除しました', PaymentEditPage::$登録完了メッセージ);

$I->wait(10);

$after = PaymentManagePage::go($I)->一覧_件数取得();
$I->assertEquals($before - 1, $after);
}
Expand Down
6 changes: 6 additions & 0 deletions codeception/acceptance/EA08SysteminfoCest.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -318,16 +318,22 @@ public function systeminfo_セキュリティ管理SSL(AcceptanceTester $I)
$I->amOnUrl($httpBaseUrl);
$I->assertRegExp('/^http:\/\//', $I->executeJS('return location.href'), 'httpsにリダイレクトされない');

$I->wait(10);

$config = Fixtures::get('config');
$httpsBaseUrl = str_replace('http://', 'https://', $httpBaseUrl);
$I->amOnUrl($httpsBaseUrl.$config['eccube_admin_route'].'/setting/system/security');
$I->checkOption(['id' => 'admin_security_force_ssl']);
$I->click('#page_admin_setting_system_security form div.c-contentsArea__cols > div.c-conversionArea > div > div > div:nth-child(2) > div > div > button');

$I->wait(10);

// httpでアクセスしたらhttpsにリダイレクトされる
$I->amOnUrl($httpBaseUrl);
$I->assertRegExp('/^https:\/\//', $I->executeJS('return location.href'), 'httpsにリダイレクトされる');

$I->wait(10);

// 後続テストのために戻しておく
$I->amOnUrl($httpsBaseUrl.$config['eccube_admin_route'].'/setting/system/security');
$I->uncheckOption(['id' => 'admin_security_force_ssl']);
Expand Down
9 changes: 9 additions & 0 deletions codeception/acceptance/EF02ProductCest.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -49,10 +49,15 @@ public function product_商品一覧ソート(AcceptanceTester $I)
// TOPページ>商品一覧（ヘッダーのいずれかのカテゴリを選択）へ遷移
$topPage->カテゴリ選択(['新入荷']);

$I->wait(10);

// 各商品のサムネイルが表示される デフォルトは価格順
$products = $I->grabMultiple(['xpath' => "//*[@class='ec-shelfGrid__item']/a/p[2]"]);
$pPos = 0;
$fPos = 0;

$I->wait(10);

foreach ($products as $key => $product) {
if ($product == 'チェリーアイスサンド') {
$pPos = $key;
Expand All @@ -68,10 +73,14 @@ public function product_商品一覧ソート(AcceptanceTester $I)
->表示件数設定(40)
->表示順設定('価格が高い順');

$I->wait(10);
// 変更されたソート条件に従い、商品がソートされる
$products = $I->grabMultiple(['xpath' => "//*[@class='ec-shelfGrid__item']/a/p[2]"]);
$pPos = 0;
$fPos = 0;

$I->wait(10);

foreach ($products as $key => $product) {
if ($product == 'チェリーアイスサンド') {
$pPos = $key;
Expand Down
2 changes: 1 addition & 1 deletion package-lock.json
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

2 changes: 1 addition & 1 deletion package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
{
"name": "eccube",
"version": "4.1.2-p3",
"version": "4.1.2-p4",
"description": "EC-CUBE EC open platform.",
"main": "index.js",
"directories": {
Expand Down
Loading
Loading