CVE-2023-48296: Insufficient Information (NVD-CWE-noinfo)
value: OroPlatform is a PHP Business Application Platform (BAP).  Navigation history, most viewed and favorite navigation items are returned to storefront user in JSON navigation response if ID of storefront user matches ID of back-office user. This vulnerability is fixed in 5.1.4.

CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-03-25T19:15Z
Repository: https://github.com/oroinc/orocommerce
Language: PHP
Files changed: src/Oro/Bundle/ProductBundle/EventListener/AttributeFormViewListener.php, src/Oro/Bundle/ProductBundle/EventListener/ProductMultiFileBlockListener.php, src/Oro/Bundle/ProductBundle/Resources/config/services.yml, src/Oro/Bundle/ProductBundle/Tests/Behat/Features/other/check_that_tabs_for_multiple_file_and_multiple_images_fields_are_displayed_correctly_on_product_pages.feature, src/Oro/Bundle/ProductBundle/Tests/Behat/Features/product-attributes/product_attributes_order.feature, src/Oro/Bundle/ProductBundle/Tests/Behat/behat.yml, src/Oro/Bundle/ProductBundle/Tests/Unit/EventListener/AttributeFormViewListenerTest.php, src/Oro/Bundle/ProductBundle/Tests/Unit/EventListener/ProductMultiFileBlockListenerTest.php
Commit date: 2023-12-06 15:43:19 +0200
Commit message: BB-22832: Multifile attribute is shown on product visibility page in back-office - 5.1 (#36428)


Diff: diff --git a/src/Oro/Bundle/ProductBundle/EventListener/AttributeFormViewListener.php b/src/Oro/Bundle/ProductBundle/EventListener/AttributeFormViewListener.php
index 63073394fe..c822b31cec 100644
--- a/src/Oro/Bundle/ProductBundle/EventListener/AttributeFormViewListener.php
+++ b/src/Oro/Bundle/ProductBundle/EventListener/AttributeFormViewListener.php
@@ -1,10 +1,9 @@
 <?php
 
 namespace Oro\Bundle\ProductBundle\EventListener;
 
-use Oro\Bundle\AttachmentBundle\Helper\FieldConfigHelper;
 use Oro\Bundle\CMSBundle\DBAL\Types\WYSIWYGType;
 use Oro\Bundle\EntityConfigBundle\Attribute\Entity\AttributeGroup;
 use Oro\Bundle\EntityConfigBundle\Entity\FieldConfigModel;
 use Oro\Bundle\EntityConfigBundle\EventListener\AttributeFormViewListener as BaseAttributeFormViewListener;
 use Oro\Bundle\EntityConfigBundle\Manager\AttributeManager;
@@ -196,16 +195,8 @@ class AttributeFormViewListener extends BaseAttributeFormViewListener
         return parent::renderAttributeViewData($twig, $entity, $attribute);
     }
 
     protected function isSeparateGroup(?string $type): bool
     {
-        return in_array(
-            (string)$type,
-            [
-                WYSIWYGType::TYPE,
-                FieldConfigHelper::MULTI_FILE_TYPE,
-                FieldConfigHelper::MULTI_IMAGE_TYPE
-            ],
-            true
-        );
+        return in_array((string)$type, [WYSIWYGType::TYPE], true);
     }
 }
diff --git a/src/Oro/Bundle/ProductBundle/EventListener/ProductMultiFileBlockListener.php b/src/Oro/Bundle/ProductBundle/EventListener/ProductMultiFileBlockListener.php
new file mode 100644
index 0000000000..5d3d1a2dc7
--- /dev/null
+++ b/src/Oro/Bundle/ProductBundle/EventListener/ProductMultiFileBlockListener.php
@@ -0,0 +1,25 @@
+<?php
+
+namespace Oro\Bundle\ProductBundle\EventListener;
+
+use Oro\Bundle\UIBundle\Event\BeforeFormRenderEvent;
+
+/**
+ * Stops adding additional fields or attributes to forms if they are on the specified pages
+ */
+class ProductMultiFileBlockListener
+{
+    private array $pages = [];
+
+    public function setPages(array $pages): void
+    {
+        $this->pages = $pages;
+    }
+
+    public function onBeforeFormRender(BeforeFormRenderEvent $event): void
+    {
+        if (in_array($event->getPageId(), $this->pages)) {
+            $event->stopPropagation();
+        }
+    }
+}
diff --git a/src/Oro/Bundle/ProductBundle/Resources/config/services.yml b/src/Oro/Bundle/ProductBundle/Resources/config/services.yml
index 0e6b1cc9a0..0bbecec35f 100644
--- a/src/Oro/Bundle/ProductBundle/Resources/config/services.yml
+++ b/src/Oro/Bundle/ProductBundle/Resources/config/services.yml
@@ -1096,10 +1096,19 @@ services:
         tags:
             - { name: kernel.event_listener, event: oro_ui.scroll_data.before.product-edit, method: onEdit, priority: -255 }
             - { name: kernel.event_listener, event: oro_ui.scroll_data.before.product-create-step-two, method: onEdit, priority: -255 }
             - { name: kernel.event_listener, event: oro_ui.scroll_data.before.product-view, method: onViewList, priority: -255 }
 
+    oro_product.event_listener.product_multi_file_block_listener:
+        class: Oro\Bundle\ProductBundle\EventListener\ProductMultiFileBlockListener
+        arguments:
+            - '@oro_entity_config.provider.entity'
+        calls:
+            - [setPages, [['product-visibility-edit', 'product-create-step-one']]]
+        tags:
+            - { name: kernel.event_listener, event: entity_form.render.before, method: onBeforeFormRender, priority: -250 }
+
     oro_product.provider.product_variant_availability_provider:
         class: 'Oro\Bundle\ProductBundle\Provider\ProductVariantAvailabilityProvider'
         arguments:
             - '@doctrine'
             - '@oro_product.provider.custom_field_provider'
diff --git a/src/Oro/Bundle/ProductBundle/Tests/Behat/Features/other/check_that_tabs_for_multiple_file_and_multiple_images_fields_are_displayed_correctly_on_product_pages.feature b/src/Oro/Bundle/ProductBundle/Tests/Behat/Features/other/check_that_tabs_for_multiple_file_and_multiple_images_fields_are_displayed_correctly_on_product_pages.feature
new file mode 100644
index 0000000000..214686ad65
--- /dev/null
+++ b/src/Oro/Bundle/ProductBundle/Tests/Behat/Features/other/check_that_tabs_for_multiple_file_and_multiple_images_fields_are_displayed_correctly_on_product_pages.feature
@@ -0,0 +1,348 @@
+@regression
+@ticket-BB-22832
+
+Feature: Check that tabs for multiple file and multiple images fields are displayed correctly on product pages
+  As an administrator, I want to make sure that:
+  - entity fields are not displayed on the first step of product creation page and not on the product
+    visibility page.
+  - entity entity fields are displayed on product second step creation page, product edit page, product view page.
+  - product attributes fields are not displayed on the first step of product creation page, second step of product
+    creation page, product edit page, product view page, product visibility page if attributes not added to family.
+  - product attributes fields are not displayed on the first step of product creation page, product visibility
+    page if attributes added to family.
+  - product attributes are displayed on product second step creation page, product edit page, product view page
+    if attributes added to family.
+
+  Scenario: Authenticate
+    Given I login as administrator
+    And go to Products / Product Attributes
+
+  Scenario Outline: Create Multiple Files attributes
+    Given I click "Create Attribute"
+    When I fill form with:
+      | Field name | <Name>         |
+      | Type       | Multiple Files |
+    And click "Continue"
+    And fill form with:
+      | Label             | <Name>    |
+      | Stored Externally | No        |
+      | File Size (MB)    | 10        |
+      | Use DAM           | <Use DAM> |
+      | File Applications | [default] |
+    And save and close form
+    Then I should see "Attribute was successfully saved" flash message
+    Examples:
+      | Name                         | Use DAM |
+      | multiple_files_attribute     | No      |
+      | multiple_files_dam_attribute | Yes     |
+
+  Scenario Outline: Create Multiple Images attribute
+    Given I click "Create Attribute"
+    When I fill form with:
+      | Field name | <Name>          |
+      | Type       | Multiple Images |
+    And click "Continue"
+    And fill form with:
+      | Label             | <Name>    |
+      | Stored Externally | No        |
+      | File Size (MB)    | 10        |
+      | Thumbnail Width   | 1024      |
+      | Thumbnail Height  | 1024      |
+      | Use DAM           | <Use DAM> |
+      | File Applications | [default] |
+    And save and close form
+    Then I should see "Attribute was successfully saved" flash message
+    Examples:
+      | Name                          | Use DAM |
+      | multiple_images_attribute     | No      |
+      | multiple_images_dam_attribute | Yes     |
+
+  Scenario: Create fields
+    Given I go to System/ Entities/ Entity Management
+    And I filter "Name" as is equal to "Product"
+    And I click view Product in grid
+
+  Scenario Outline: Create Multiple Files fields
+    Given I click "Create field"
+    When I fill form with:
+      | Field name   | <Name>         |
+      | Storage type | Table column   |
+      | Type         | Multiple Files |
+    And click "Continue"
+    And fill form with:
+      | Label             | <Name>    |
+      | Stored Externally | No        |
+      | File Size (MB)    | 10        |
+      | Use DAM           | <Use DAM> |
+      | File Applications | [default] |
+    And save and close form
+    Then I should see "Field saved" flash message
+    Examples:
+      | Name                     | Use DAM |
+      | multiple_files_field     | No      |
+      | multiple_files_dam_field | Yes     |
+
+  Scenario Outline: Create Multiple Images fields
+    Given I click "Create field"
+    When I fill form with:
+      | Field name | <Name>          |
+      | Type       | Multiple Images |
+    And click "Continue"
+    And fill form with:
+      | Label             | <Name>    |
+      | Stored Externally | No        |
+      | File Size (MB)    | 10        |
+      | Thumbnail Width   | 1024      |
+      | Thumbnail Height  | 1024      |
+      | Use DAM           | <Use DAM> |
+      | File Applications | [default] |
+    And save and close form
+    Then I should see "Field saved" flash message
+    Examples:
+      | Name                      | Use DAM |
+      | multiple_images_field     | No      |
+      | multiple_images_dam_field | Yes     |
+
+  Scenario: Update schema
+    Given I click update schema
+    Then I should see Schema updated flash message
+
+  Scenario: Check for fields and missing attributes on product creation pages
+    Given I go to Products/ Products
+    When I click "Create Product"
+    Then I should see "General"
+    # At the first step of creating a product, we should not see additional fields and attributes.
+    # Check product attribute on first product create page.
+    And should not see "multiple_files_attribute"
+    And should not see "multiple_files_dam_attribute"
+    And should not see "multiple_images_attribute"
+    And should not see "multiple_images_dam_attribute"
+    # Check extend field on first product create page.
+    And should not see "multiple_files_field"
+    And should not see "multiple_files_dam_field"
+    And should not see "multiple_images_field"
+    And should not see "multiple_images_dam_field"
+    When I fill "ProductForm Step One" with:
+      | Type           | Simple  |
+      | Product Family | Default |
+    And click "Continue"
+    # Attributes is not displayed because they are not added to the product family.
+    # Check product attribute on second product create page.
+    Then I should not see "multiple_files_attribute"
+    And should not see "multiple_files_dam_attribute"
+    And should not see "multiple_images_attribute"
+    And should not see "multiple_images_dam_attribute"
+    # Check extend field on second product create page
+    And should see "multiple_files_field"
+    And should see "multiple_files_dam_field"
+    And should see "multiple_images_field"
+    And should see "multiple_images_dam_field"
+    When I fill "ProductForm" with:
+      | Sku  | ORO_PRODUCT_1 |
+      | Name | ORO_PRODUCT_1 |
+    And save and close form
+    Then I should see "Product has been saved" flash message
+
+  Scenario: Check for fields and missing attributes on product edit page
+    Given I click "Edit"
+    # Check product attribute on product edit page
+    Then I should not see "multiple_files_attribute"
+    And should not see "multiple_files_dam_attribute"
+    And should not see "multiple_images_attribute"
+    And should not see "multiple_images_dam_attribute"
+    # Check extend field on product edit page
+    And should see "multiple_files_field"
+    And should see "multiple_files_dam_field"
+    And should see "multiple_images_field"
+    And should see "multiple_images_dam_field"
+    When I save and close form
+    Then I should see "Product has been saved" flash message
+
+  Scenario: Check for fields and missing attributes on product view page
+    # Check product attribute on product view page
+    Given I should not see "multiple_files_attribute"
+    And should not see "multiple_files_dam_attribute"
+    And should not see "multiple_images_attribute"
+    And should not see "multiple_images_dam_attribute"
+    # Check extend field on product view page
+    And should see "multiple_files_field"
+    And should see "multiple_files_dam_field"
+    And should see "multiple_images_field"
+    And should see "multiple_images_dam_field"
+
+  Scenario: Check for fields and missing attributes on product visibility page
+    Given I click "More actions"
+    When I click "Manage Visibility"
+    # Check product attribute on product visibility page
+    Then I should not see "multiple_files_attribute"
+    And should not see "multiple_files_dam_attribute"
+    And should not see "multiple_images_attribute"
+    And should not see "multiple_images_dam_attribute"
+    # Check extend field on product visibility page
+    And should not see "multiple_files_field"
+    And should not see "multiple_files_dam_field"
+    And should not see "multiple_images_field"
+    And should not see "multiple_images_dam_field"
+
+  Scenario: Update product family with new attributes
+    When I go to Products/ Product Families
+    And I click "Edit" on row "default_family" in grid
+    And click "Add"
+    And fill "Attributes Group Form" with:
+      | Attribute Groups Label0      | Multiple Fields Attributes                                                                                         |
+      | Attribute Groups Visible0    | true                                                                                                               |
+      | Attribute Groups Attributes0 | [multiple_files_attribute, multiple_files_dam_attribute, multiple_images_attribute, multiple_images_dam_attribute] |
+    And save and close form
+    Then I should see "Successfully updated" flash message
+
+  Scenario: Check for fields and attributes on product creation pages
+    Given I go to Products/ Products
+    When I click "Create Product"
+    # Check product attribute on first product create page
+    Then I should not see "Multiple Fields Attributes"
+    And should not see "multiple_files_attribute"
+    And should not see "multiple_files_dam_attribute"
+    And should not see "multiple_images_attribute"
+    And should not see "multiple_images_dam_attribute"
+    # Check extend field on first product create page
+    And should not see "multiple_files_field"
+    And should not see "multiple_files_dam_field"
+    And should not see "multiple_images_field"
+    And should not see "multiple_images_dam_field"
+    And fill "ProductForm Step One" with:
+      | Type           | Simple  |
+      | Product Family | Default |
+    When I click "Continue"
+    # Check product attribute on second product create page
+    Then I should see "Multiple Fields Attributes"
+    # Check if the attributes are displayed (attributes fields do not have names except for family tab)
+    And should not see "multiple_files_attribute"
+    And should not see "multiple_files_dam_attribute"
+    And should not see "multiple_images_attribute"
+    And should not see "multiple_images_dam_attribute"
+    # Check extend field on second product create page
+    And should see "multiple_files_field"
+    And should see "multiple_files_dam_field"
+    And should see "multiple_images_field"
+    And should see "multiple_images_dam_field"
+    When I fill "ProductForm" with:
+      | Sku  | ORO_PRODUCT_2 |
+      | Name | ORO_PRODUCT_2 |
+    And save and close form
+    Then I should see "Product has been saved" flash message
+
+  Scenario: Check for fields and attributes on product edit page
+    Given I click "Edit"
+    # Check product attribute on product edit page
+    Then I should see "Multiple Fields Attributes"
+    # Check if the attributes are displayed (attributes fields do not have names except for family tab)
+    And should not see "multiple_files_attribute"
+    And should not see "multiple_files_dam_attribute"
+    And should not see "multiple_images_attribute"
+    And should not see "multiple_images_dam_attribute"
+    # Check extend field on product edit page
+    And should see "multiple_files_field"
+    And should see "multiple_files_dam_field"
+    And should see "multiple_images_field"
+    And should see "multiple_images_dam_field"
+    When I save and close form
+    Then I should see "Product has been saved" flash message
+
+  Scenario: Check for fields and attributes on product view page
+    # Check product attribute on product view page
+    Given I should see "Multiple Fields Attributes"
+    # Check if the attributes are displayed (attributes fields do not have names except for family tab)
+    And should not see "multiple_files_attribute"
+    And should not see "multiple_files_dam_attribute"
+    And should not see "multiple_images_attribute"
+    And should not see "multiple_images_dam_attribute"
+    # Check extend field on product view page
+    And should see "multiple_files_field"
+    And should see "multiple_files_dam_field"
+    And should see "multiple_images_field"
+    And should see "multiple_images_dam_field"
+
+  Scenario: Check for fields and attributes on product visibility page
+    Given I click "More actions"
+    When I click "Manage Visibility"
+    # Check product attribute on product visibility page
+    Then I should not see "Multiple Fields Attributes"
+    And should not see "multiple_files_attribute"
+    And should not see "multiple_files_dam_attribute"
+    And should not see "multiple_images_attribute"
+    And should not see "multiple_images_dam_attribute"
+    # Check extend field on product visibility page
+    And should not see "multiple_files_field"
+    And should not see "multiple_files_dam_field"
+    And should not see "multiple_images_field"
+    And should not see "multiple_images_dam_field"
+
+  Scenario: Create product and check fields and attributes
+    Given I go to Products/ Products
+    When I click "Create Product"
+    And fill "ProductForm Step One" with:
+      | Type           | Simple  |
+      | Product Family | Default |
+    And click "Continue"
+    And fill "ProductForm" with:
+      | Sku                       | ORO_PRODUCT_30 |
+      | Name                      | ORO_PRODUCT_30 |
+      | Multiple Files Attribute  | example.pdf    |
+      | Multiple Images Attribute | 300x300.png    |
+      | Multiple Files Field      | example2.pdf   |
+      | Multiple Images Field     | blue-dot.jpg   |
+
+    And click "Multiple Files DAM Attribute"
+    And fill "Digital Asset Dialog Form" with:
+      | File  | example.pdf                  |
+      | Title | Multiple Files DAM Attribute |
+    And click "Upload"
+    And click on example.pdf in grid
+
+    And click "Multiple Images DAM Attribute"
+    And fill "Digital Asset Dialog Form" with:
+      | File  | 300x300.png                   |
+      | Title | Multiple Images DAM Attribute |
+    And click "Upload"
+    And click on 300x300.png in grid
+
+    And click "Multiple Files DAM Field"
+    And fill "Digital Asset Dialog Form" with:
+      | File  | example2.pdf             |
+      | Title | Multiple Files DAM Field |
+    And click "Upload"
+    And click on example2.pdf in grid
+
+    And click "Multiple Images DAM Field"
+    And fill "Digital Asset Dialog Form" with:
+      | File  | blue-dot.jpg              |
+      | Title | Multiple Images DAM Field |
+    And click "Upload"
+    And click on blue-dot.jpg in grid
+
+    And save and close form
+    Then I should see "Product has been saved" flash message
+    And should see following "Multiple Files Attribute Grid" grid:
+      | File Name   |
+      | example.pdf |
+    And should see following "Multiple Images Attribute Grid" grid:
+      | Name        |
+      | 300x300.png |
+    And should see following "Multiple Files Field Grid" grid:
+      | File Name    |
+      | example2.pdf |
+    And should see following "Multiple Images Field Grid" grid:
+      | Name         |
+      | blue-dot.jpg |
+    And should see following "Multiple Files DAM Attribute Grid" grid:
+      | File Name   |
+      | example.pdf |
+    And should see following "Multiple Images DAM Attribute Grid" grid:
+      | Name        |
+      | 300x300.png |
+    And should see following "Multiple Files DAM Field Grid" grid:
+      | File Name    |
+      | example2.pdf |
+    And should see following "Multiple Images DAM Field Grid" grid:
+      | Name         |
+      | blue-dot.jpg |
diff --git a/src/Oro/Bundle/ProductBundle/Tests/Behat/Features/product-attributes/product_attributes_order.feature b/src/Oro/Bundle/ProductBundle/Tests/Behat/Features/product-attributes/product_attributes_order.feature
index 7142caf355..a2cfc5de1e 100644
--- a/src/Oro/Bundle/ProductBundle/Tests/Behat/Features/product-attributes/product_attributes_order.feature
+++ b/src/Oro/Bundle/ProductBundle/Tests/Behat/Features/product-attributes/product_attributes_order.feature
@@ -85,11 +85,11 @@ Feature: Product attributes order
       | MultipleFiles 1  | example2.pdf |
       | MultipleImages 1 | cat2.jpg     |
     And I save and close form
     Then I should see "Product has been saved" flash message
     And I should see "Drawing Backoffice Field" goes after "Document Backoffice Field"
-    And I should see "MultipleImages Field" goes after "MultipleFiles Field"
+    And I should see "MultipleImages Backoffice Field" goes after "MultipleFiles Backoffice Field"
 
   Scenario: Check attributes order on store front
     Given I proceed as the Buyer
     And I login as AmandaRCole@example.org buyer
     When I type "SKU123" in "search"
@@ -112,11 +112,11 @@ Feature: Product attributes order
     When I click "Edit" on row "SKU123" in grid
     Then I should see "Document Field" goes after "Drawing Field"
     And I should see "MultipleFiles Field" goes after "MultipleImages Field"
     When I save and close form
     Then I should see "Document Backoffice Field" goes after "Drawing Backoffice Field"
-    And I should see "MultipleFiles Field" goes after "MultipleImages Field"
+    And I should see "MultipleFiles Backoffice Field" goes after "MultipleImages Backoffice Field"
 
   Scenario: Check attributes order on store front
     Given I proceed as the Buyer
     When I reload the page
     Then I should see "Document Storefront Field" goes after "Drawing Storefront Field"
diff --git a/src/Oro/Bundle/ProductBundle/Tests/Behat/behat.yml b/src/Oro/Bundle/ProductBundle/Tests/Behat/behat.yml
index 2af92846cb..043fc032b2 100644
--- a/src/Oro/Bundle/ProductBundle/Tests/Behat/behat.yml
+++ b/src/Oro/Bundle/ProductBundle/Tests/Behat/behat.yml
@@ -1529,16 +1529,26 @@ oro_behat_extension:
         locator: '//div[contains(@class, "responsive-cell")]/div[contains(@class, "attribute-item") and .//label[contains(., "Document")]]'
 
     MultipleFiles Field:
       selector:
         type: xpath
-        locator: '//h4[contains(., "MultipleFiles")]/parent::*'
+        locator: '//div[contains(@id,"MultipleFiles") and contains(@class,"file-collection")]/parent::*'
+
+    MultipleFiles Backoffice Field:
+      selector:
+        type: xpath
+        locator: '//div[contains(@id,"grid-MultipleFiles")]/parent::*'
 
     MultipleImages Field:
       selector:
         type: xpath
-        locator: '//h4[contains(., "MultipleImages")]/parent::*'
+        locator: '//div[contains(@id,"MultipleImages") and contains(@class,"file-collection")]/parent::*'
+
+    MultipleImages Backoffice Field:
+      selector:
+        type: xpath
+        locator: '//div[contains(@id,"grid-MultipleImages")]/parent::*'
 
     Drawing Storefront Field:
       selector:
         type: xpath
         locator: '//span[contains(@class, "product-view-attribute") and contains(., "Drawing")]/parent::div/parent::div'
diff --git a/src/Oro/Bundle/ProductBundle/Tests/Unit/EventListener/AttributeFormViewListenerTest.php b/src/Oro/Bundle/ProductBundle/Tests/Unit/EventListener/AttributeFormViewListenerTest.php
index 169c1ab435..725d773933 100644
--- a/src/Oro/Bundle/ProductBundle/Tests/Unit/EventListener/AttributeFormViewListenerTest.php
+++ b/src/Oro/Bundle/ProductBundle/Tests/Unit/EventListener/AttributeFormViewListenerTest.php
@@ -141,11 +141,12 @@ class AttributeFormViewListenerTest extends \PHPUnit\Framework\TestCase
             [
                 'id' => 1,
                 'fieldName' => 'someField',
                 'data' => [
                     'view' => ['is_displayable' => true],
-                    'form' => ['is_enabled' => true]
+                    'form' => ['is_enabled' => true],
+                    'attribute' => ['is_attribute' => true],
                 ]
             ]
         );
 
         $inventoryStatus = $this->getEntity(FieldConfigModel::class, ['id' => 1, 'fieldName' => 'inventory_status']);
@@ -500,21 +501,20 @@ class AttributeFormViewListenerTest extends \PHPUnit\Framework\TestCase
                                         'someField' => 'field template'
                                     ],
                                 ],
                             ],
                         ],
-                        'multiFileField' => [
-                            'title' => 'translated multiFile field label',
+                        'group1' => [
+                            'title' => 'Group1Title',
                             'useSubBlockDivider' => true,
                             'subblocks' => [
                                 [
                                     'data' => [
                                         'multiFileField' => 'expected template data'
                                     ],
                                 ],
                             ],
-                            'priority' => 501,
                         ],
                     ],
                 ],
             ],
             'move multiImage attribute field to own group' => [
@@ -570,21 +570,20 @@ class AttributeFormViewListenerTest extends \PHPUnit\Framework\TestCase
                                         'someField' => 'field template'
                                     ],
                                 ],
                             ],
                         ],
-                        'multiImageField' => [
-                            'title' => 'translated multiImage field label',
+                        'group1' => [
+                            'title' => 'Group1Title',
                             'useSubBlockDivider' => true,
                             'subblocks' => [
                                 [
                                     'data' => [
                                         'multiImageField' => 'expected template data'
                                     ],
                                 ],
                             ],
-                            'priority' => 501,
                         ],
                     ],
                 ],
             ],
         ];
@@ -930,21 +929,20 @@ class AttributeFormViewListenerTest extends \PHPUnit\Framework\TestCase
                                         'someField' => 'field template'
                                     ],
                                 ],
                             ],
                         ],
-                        'multiFileField' => [
-                            'title' => 'translated multiFile field label',
+                        'group1' => [
+                            'title' => 'Group1Title',
                             'useSubBlockDivider' => true,
                             'subblocks' => [
                                 [
                                     'data' => [
                                         'multiFileField' => 'expected template data'
                                     ],
                                 ],
                             ],
-                            'priority' => 501,
                         ],
                     ],
                 ],
             ],
             'move multiImage attribute field to own group' => [
@@ -1001,21 +999,20 @@ class AttributeFormViewListenerTest extends \PHPUnit\Framework\TestCase
                                         'someField' => 'field template'
                                     ],
                                 ],
                             ],
                         ],
-                        'multiImageField' => [
-                            'title' => 'translated multiImage field label',
+                        'group1' => [
+                            'title' => 'Group1Title',
                             'useSubBlockDivider' => true,
                             'subblocks' => [
                                 [
                                     'data' => [
                                         'multiImageField' => 'expected template data'
                                     ],
                                 ],
                             ],
-                            'priority' => 501,
                         ],
                     ],
                 ],
             ],
         ];
diff --git a/src/Oro/Bundle/ProductBundle/Tests/Unit/EventListener/ProductMultiFileBlockListenerTest.php b/src/Oro/Bundle/ProductBundle/Tests/Unit/EventListener/ProductMultiFileBlockListenerTest.php
new file mode 100644
index 0000000000..2e83de504d
--- /dev/null
+++ b/src/Oro/Bundle/ProductBundle/Tests/Unit/EventListener/ProductMultiFileBlockListenerTest.php
@@ -0,0 +1,45 @@
+<?php
+
+namespace Oro\Bundle\ProductBundle\Tests\Unit\EventListener;
+
+use Oro\Bundle\ProductBundle\EventListener\ProductMultiFileBlockListener;
+use Oro\Bundle\UIBundle\Event\BeforeFormRenderEvent;
+use Symfony\Component\Form\FormView;
+use Twig\Environment;
+
+class ProductMultiFileBlockListenerTest extends \PHPUnit\Framework\TestCase
+{
+    /** @var ProductMultiFileBlockListener */
+    private $productMultiFileBlockListener;
+
+    protected function setUp(): void
+    {
+        $this->productMultiFileBlockListener = new ProductMultiFileBlockListener();
+    }
+
+    /**
+     * @dataProvider dataProvider
+     */
+    public function testOnBeforeFormRender(string $pageId, bool $expected): void
+    {
+        $event = new BeforeFormRenderEvent(
+            $this->createMock(FormView::class),
+            [],
+            $this->createMock(Environment::class),
+            null,
+        );
+        $event->setPageId('valid-page-id');
+
+        $this->productMultiFileBlockListener->setPages([$pageId]);
+        $this->productMultiFileBlockListener->onBeforeFormRender($event);
+        self::assertEquals($event->isPropagationStopped(), $expected);
+    }
+
+    public function dataProvider(): array
+    {
+        return [
+            ['pageId' => 'non-valid-page-id', 'expected' => false],
+            ['pageId' => 'valid-page-id', 'expected' => true],
+        ];
+    }
+}

Vulnerable code: use Oro\Bundle\AttachmentBundle\Helper\FieldConfigHelper;
        return in_array(
            (string)$type,
            [
                WYSIWYGType::TYPE,
                FieldConfigHelper::MULTI_FILE_TYPE,
                FieldConfigHelper::MULTI_IMAGE_TYPE
            ],
            true
        );
    And I should see "MultipleImages Field" goes after "MultipleFiles Field"
    And I should see "MultipleFiles Field" goes after "MultipleImages Field"
        locator: '//h4[contains(., "MultipleFiles")]/parent::*'
        locator: '//h4[contains(., "MultipleImages")]/parent::*'
                    'form' => ['is_enabled' => true]
                        'multiFileField' => [
                            'title' => 'translated multiFile field label',
                            'priority' => 501,
                        'multiImageField' => [
                            'title' => 'translated multiImage field label',
                            'priority' => 501,
                        'multiFileField' => [
                            'title' => 'translated multiFile field label',
                            'priority' => 501,
                        'multiImageField' => [
                            'title' => 'translated multiImage field label',
                            'priority' => 501,
Fixed code:         return in_array((string)$type, [WYSIWYGType::TYPE], true);
<?php

namespace Oro\Bundle\ProductBundle\EventListener;

use Oro\Bundle\UIBundle\Event\BeforeFormRenderEvent;

/**
 * Stops adding additional fields or attributes to forms if they are on the specified pages
 */
class ProductMultiFileBlockListener
{
    private array $pages = [];

    public function setPages(array $pages): void
    {
        $this->pages = $pages;
    }

    public function onBeforeFormRender(BeforeFormRenderEvent $event): void
    {
        if (in_array($event->getPageId(), $this->pages)) {
            $event->stopPropagation();
        }
    }
}
    oro_product.event_listener.product_multi_file_block_listener:
        class: Oro\Bundle\ProductBundle\EventListener\ProductMultiFileBlockListener
        arguments:
            - '@oro_entity_config.provider.entity'
        calls:
            - [setPages, [['product-visibility-edit', 'product-create-step-one']]]
        tags:
            - { name: kernel.event_listener, event: entity_form.render.before, method: onBeforeFormRender, priority: -250 }

@regression
@ticket-BB-22832

Feature: Check that tabs for multiple file and multiple images fields are displayed correctly on product pages
  As an administrator, I want to make sure that:
  - entity fields are not displayed on the first step of product creation page and not on the product
    visibility page.
  - entity entity fields are displayed on product second step creation page, product edit page, product view page.
  - product attributes fields are not displayed on the first step of product creation page, second step of product
    creation page, product edit page, product view page, product visibility page if attributes not added to family.
  - product attributes fields are not displayed on the first step of product creation page, product visibility
    page if attributes added to family.
  - product attributes are displayed on product second step creation page, product edit page, product view page
    if attributes added to family.

  Scenario: Authenticate
    Given I login as administrator
    And go to Products / Product Attributes

  Scenario Outline: Create Multiple Files attributes
    Given I click "Create Attribute"
    When I fill form with:
      | Field name | <Name>         |
      | Type       | Multiple Files |
    And click "Continue"
    And fill form with:
      | Label             | <Name>    |
      | Stored Externally | No        |
      | File Size (MB)    | 10        |
      | Use DAM           | <Use DAM> |
      | File Applications | [default] |
    And save and close form
    Then I should see "Attribute was successfully saved" flash message
    Examples:
      | Name                         | Use DAM |
      | multiple_files_attribute     | No      |
      | multiple_files_dam_attribute | Yes     |

  Scenario Outline: Create Multiple Images attribute
    Given I click "Create Attribute"
    When I fill form with:
      | Field name | <Name>          |
      | Type       | Multiple Images |
    And click "Continue"
    And fill form with:
      | Label             | <Name>    |
      | Stored Externally | No        |
      | File Size (MB)    | 10        |
      | Thumbnail Width   | 1024      |
      | Thumbnail Height  | 1024      |
      | Use DAM           | <Use DAM> |
      | File Applications | [default] |
    And save and close form
    Then I should see "Attribute was successfully saved" flash message
    Examples:
      | Name                          | Use DAM |
      | multiple_images_attribute     | No      |
      | multiple_images_dam_attribute | Yes     |

  Scenario: Create fields
    Given I go to System/ Entities/ Entity Management
    And I filter "Name" as is equal to "Product"
    And I click view Product in grid

  Scenario Outline: Create Multiple Files fields
    Given I click "Create field"
    When I fill form with:
      | Field name   | <Name>         |
      | Storage type | Table column   |
      | Type         | Multiple Files |
    And click "Continue"
    And fill form with:
      | Label             | <Name>    |
      | Stored Externally | No        |
      | File Size (MB)    | 10        |
      | Use DAM           | <Use DAM> |
      | File Applications | [default] |
    And save and close form
    Then I should see "Field saved" flash message
    Examples:
      | Name                     | Use DAM |
      | multiple_files_field     | No      |
      | multiple_files_dam_field | Yes     |

  Scenario Outline: Create Multiple Images fields
    Given I click "Create field"
    When I fill form with:
      | Field name | <Name>          |
      | Type       | Multiple Images |
    And click "Continue"
    And fill form with:
      | Label             | <Name>    |
      | Stored Externally | No        |
      | File Size (MB)    | 10        |
      | Thumbnail Width   | 1024      |
      | Thumbnail Height  | 1024      |
      | Use DAM           | <Use DAM> |
      | File Applications | [default] |
    And save and close form
    Then I should see "Field saved" flash message
    Examples:
      | Name                      | Use DAM |
      | multiple_images_field     | No      |
      | multiple_images_dam_field | Yes     |

  Scenario: Update schema
    Given I click update schema
    Then I should see Schema updated flash message

  Scenario: Check for fields and missing attributes on product creation pages
    Given I go to Products/ Products
    When I click "Create Product"
    Then I should see "General"
    # At the first step of creating a product, we should not see additional fields and attributes.
    # Check product attribute on first product create page.
    And should not see "multiple_files_attribute"
    And should not see "multiple_files_dam_attribute"
    And should not see "multiple_images_attribute"
    And should not see "multiple_images_dam_attribute"
    # Check extend field on first product create page.
    And should not see "multiple_files_field"
    And should not see "multiple_files_dam_field"
    And should not see "multiple_images_field"
    And should not see "multiple_images_dam_field"
    When I fill "ProductForm Step One" with:
      | Type           | Simple  |
      | Product Family | Default |
    And click "Continue"
    # Attributes is not displayed because they are not added to the product family.
    # Check product attribute on second product create page.
    Then I should not see "multiple_files_attribute"
    And should not see "multiple_files_dam_attribute"
    And should not see "multiple_images_attribute"
    And should not see "multiple_images_dam_attribute"
    # Check extend field on second product create page
    And should see "multiple_files_field"
    And should see "multiple_files_dam_field"
    And should see "multiple_images_field"
    And should see "multiple_images_dam_field"
    When I fill "ProductForm" with:
      | Sku  | ORO_PRODUCT_1 |
      | Name | ORO_PRODUCT_1 |
    And save and close form
    Then I should see "Product has been saved" flash message

  Scenario: Check for fields and missing attributes on product edit page
    Given I click "Edit"
    # Check product attribute on product edit page
    Then I should not see "multiple_files_attribute"
    And should not see "multiple_files_dam_attribute"
    And should not see "multiple_images_attribute"
    And should not see "multiple_images_dam_attribute"
    # Check extend field on product edit page
    And should see "multiple_files_field"
    And should see "multiple_files_dam_field"
    And should see "multiple_images_field"
    And should see "multiple_images_dam_field"
    When I save and close form
    Then I should see "Product has been saved" flash message

  Scenario: Check for fields and missing attributes on product view page
    # Check product attribute on product view page
    Given I should not see "multiple_files_attribute"
    And should not see "multiple_files_dam_attribute"
    And should not see "multiple_images_attribute"
    And should not see "multiple_images_dam_attribute"
    # Check extend field on product view page
    And should see "multiple_files_field"
    And should see "multiple_files_dam_field"
    And should see "multiple_images_field"
    And should see "multiple_images_dam_field"

  Scenario: Check for fields and missing attributes on product visibility page
    Given I click "More actions"
    When I click "Manage Visibility"
    # Check product attribute on product visibility page
    Then I should not see "multiple_files_attribute"
    And should not see "multiple_files_dam_attribute"
    And should not see "multiple_images_attribute"
    And should not see "multiple_images_dam_attribute"
    # Check extend field on product visibility page
    And should not see "multiple_files_field"
    And should not see "multiple_files_dam_field"
    And should not see "multiple_images_field"
    And should not see "multiple_images_dam_field"

  Scenario: Update product family with new attributes
    When I go to Products/ Product Families
    And I click "Edit" on row "default_family" in grid
    And click "Add"
    And fill "Attributes Group Form" with:
      | Attribute Groups Label0      | Multiple Fields Attributes                                                                                         |
      | Attribute Groups Visible0    | true                                                                                                               |
      | Attribute Groups Attributes0 | [multiple_files_attribute, multiple_files_dam_attribute, multiple_images_attribute, multiple_images_dam_attribute] |
    And save and close form
    Then I should see "Successfully updated" flash message

  Scenario: Check for fields and attributes on product creation pages
    Given I go to Products/ Products
    When I click "Create Product"
    # Check product attribute on first product create page
    Then I should not see "Multiple Fields Attributes"
    And should not see "multiple_files_attribute"
    And should not see "multiple_files_dam_attribute"
    And should not see "multiple_images_attribute"
    And should not see "multiple_images_dam_attribute"
    # Check extend field on first product create page
    And should not see "multiple_files_field"
    And should not see "multiple_files_dam_field"
    And should not see "multiple_images_field"
    And should not see "multiple_images_dam_field"
    And fill "ProductForm Step One" with:
      | Type           | Simple  |
      | Product Family | Default |
    When I click "Continue"
    # Check product attribute on second product create page
    Then I should see "Multiple Fields Attributes"
    # Check if the attributes are displayed (attributes fields do not have names except for family tab)
    And should not see "multiple_files_attribute"
    And should not see "multiple_files_dam_attribute"
    And should not see "multiple_images_attribute"
    And should not see "multiple_images_dam_attribute"
    # Check extend field on second product create page
    And should see "multiple_files_field"
    And should see "multiple_files_dam_field"
    And should see "multiple_images_field"
    And should see "multiple_images_dam_field"
    When I fill "ProductForm" with:
      | Sku  | ORO_PRODUCT_2 |
      | Name | ORO_PRODUCT_2 |
    And save and close form
    Then I should see "Product has been saved" flash message

  Scenario: Check for fields and attributes on product edit page
    Given I click "Edit"
    # Check product attribute on product edit page
    Then I should see "Multiple Fields Attributes"
    # Check if the attributes are displayed (attributes fields do not have names except for family tab)
    And should not see "multiple_files_attribute"
    And should not see "multiple_files_dam_attribute"
    And should not see "multiple_images_attribute"
    And should not see "multiple_images_dam_attribute"
    # Check extend field on product edit page
    And should see "multiple_files_field"
    And should see "multiple_files_dam_field"
    And should see "multiple_images_field"
    And should see "multiple_images_dam_field"
    When I save and close form
    Then I should see "Product has been saved" flash message

  Scenario: Check for fields and attributes on product view page
    # Check product attribute on product view page
    Given I should see "Multiple Fields Attributes"
    # Check if the attributes are displayed (attributes fields do not have names except for family tab)
    And should not see "multiple_files_attribute"
    And should not see "multiple_files_dam_attribute"
    And should not see "multiple_images_attribute"
    And should not see "multiple_images_dam_attribute"
    # Check extend field on product view page
    And should see "multiple_files_field"
    And should see "multiple_files_dam_field"
    And should see "multiple_images_field"
    And should see "multiple_images_dam_field"

  Scenario: Check for fields and attributes on product visibility page
    Given I click "More actions"
    When I click "Manage Visibility"
    # Check product attribute on product visibility page
    Then I should not see "Multiple Fields Attributes"
    And should not see "multiple_files_attribute"
    And should not see "multiple_files_dam_attribute"
    And should not see "multiple_images_attribute"
    And should not see "multiple_images_dam_attribute"
    # Check extend field on product visibility page
    And should not see "multiple_files_field"
    And should not see "multiple_files_dam_field"
    And should not see "multiple_images_field"
    And should not see "multiple_images_dam_field"

  Scenario: Create product and check fields and attributes
    Given I go to Products/ Products
    When I click "Create Product"
    And fill "ProductForm Step One" with:
      | Type           | Simple  |
      | Product Family | Default |
    And click "Continue"
    And fill "ProductForm" with:
      | Sku                       | ORO_PRODUCT_30 |
      | Name                      | ORO_PRODUCT_30 |
      | Multiple Files Attribute  | example.pdf    |
      | Multiple Images Attribute | 300x300.png    |
      | Multiple Files Field      | example2.pdf   |
      | Multiple Images Field     | blue-dot.jpg   |

    And click "Multiple Files DAM Attribute"
    And fill "Digital Asset Dialog Form" with:
      | File  | example.pdf                  |
      | Title | Multiple Files DAM Attribute |
    And click "Upload"
    And click on example.pdf in grid

    And click "Multiple Images DAM Attribute"
    And fill "Digital Asset Dialog Form" with:
      | File  | 300x300.png                   |
      | Title | Multiple Images DAM Attribute |
    And click "Upload"
    And click on 300x300.png in grid

    And click "Multiple Files DAM Field"
    And fill "Digital Asset Dialog Form" with:
      | File  | example2.pdf             |
      | Title | Multiple Files DAM Field |
    And click "Upload"
    And click on example2.pdf in grid

    And click "Multiple Images DAM Field"
    And fill "Digital Asset Dialog Form" with:
      | File  | blue-dot.jpg              |
      | Title | Multiple Images DAM Field |
    And click "Upload"
    And click on blue-dot.jpg in grid

    And save and close form
    Then I should see "Product has been saved" flash message
    And should see following "Multiple Files Attribute Grid" grid:
      | File Name   |
      | example.pdf |
    And should see following "Multiple Images Attribute Grid" grid:
      | Name        |
      | 300x300.png |
    And should see following "Multiple Files Field Grid" grid:
      | File Name    |
      | example2.pdf |
    And should see following "Multiple Images Field Grid" grid:
      | Name         |
      | blue-dot.jpg |
    And should see following "Multiple Files DAM Attribute Grid" grid:
      | File Name   |
      | example.pdf |
    And should see following "Multiple Images DAM Attribute Grid" grid:
      | Name        |
      | 300x300.png |
    And should see following "Multiple Files DAM Field Grid" grid:
      | File Name    |
      | example2.pdf |
    And should see following "Multiple Images DAM Field Grid" grid:
      | Name         |
      | blue-dot.jpg |
    And I should see "MultipleImages Backoffice Field" goes after "MultipleFiles Backoffice Field"
    And I should see "MultipleFiles Backoffice Field" goes after "MultipleImages Backoffice Field"
        locator: '//div[contains(@id,"MultipleFiles") and contains(@class,"file-collection")]/parent::*'

    MultipleFiles Backoffice Field:
      selector:
        type: xpath
        locator: '//div[contains(@id,"grid-MultipleFiles")]/parent::*'
        locator: '//div[contains(@id,"MultipleImages") and contains(@class,"file-collection")]/parent::*'

    MultipleImages Backoffice Field:
      selector:
        type: xpath
        locator: '//div[contains(@id,"grid-MultipleImages")]/parent::*'
                    'form' => ['is_enabled' => true],
                    'attribute' => ['is_attribute' => true],
                        'group1' => [
                            'title' => 'Group1Title',
                        'group1' => [
                            'title' => 'Group1Title',
                        'group1' => [
                            'title' => 'Group1Title',
                        'group1' => [
                            'title' => 'Group1Title',
<?php

namespace Oro\Bundle\ProductBundle\Tests\Unit\EventListener;

use Oro\Bundle\ProductBundle\EventListener\ProductMultiFileBlockListener;
use Oro\Bundle\UIBundle\Event\BeforeFormRenderEvent;
use Symfony\Component\Form\FormView;
use Twig\Environment;

class ProductMultiFileBlockListenerTest extends \PHPUnit\Framework\TestCase
{
    /** @var ProductMultiFileBlockListener */
    private $productMultiFileBlockListener;

    protected function setUp(): void
    {
        $this->productMultiFileBlockListener = new ProductMultiFileBlockListener();
    }

    /**
     * @dataProvider dataProvider
     */
    public function testOnBeforeFormRender(string $pageId, bool $expected): void
    {
        $event = new BeforeFormRenderEvent(
            $this->createMock(FormView::class),
            [],
            $this->createMock(Environment::class),
            null,
        );
        $event->setPageId('valid-page-id');

        $this->productMultiFileBlockListener->setPages([$pageId]);
        $this->productMultiFileBlockListener->onBeforeFormRender($event);
        self::assertEquals($event->isPropagationStopped(), $expected);
    }

    public function dataProvider(): array
    {
        return [
            ['pageId' => 'non-valid-page-id', 'expected' => false],
            ['pageId' => 'valid-page-id', 'expected' => true],
        ];
    }
}