CVE-2023-48296 (PHP, published 2024-03-25T19:15Z)
Description: value: OroPlatform is a PHP Business Application Platform (BAP).  Navigation history, most viewed and favorite navigation items are returned to storefront user in JSON navigation response if ID of storefront user matches ID of back-office user. This vulnerability is fixed in 5.1.4.

Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/oroinc/orocommerce
Files changed:
src/Oro/Bundle/ProductBundle/EventListener/AttributeFormViewListener.php
src/Oro/Bundle/ProductBundle/EventListener/ProductMultiFileBlockListener.php
src/Oro/Bundle/ProductBundle/Resources/config/services.yml
src/Oro/Bundle/ProductBundle/Tests/Behat/Features/other/check_that_tabs_for_multiple_file_and_multiple_images_fields_are_displayed_correctly_on_product_pages.feature
src/Oro/Bundle/ProductBundle/Tests/Behat/Features/product-attributes/product_attributes_order.feature
src/Oro/Bundle/ProductBundle/Tests/Behat/behat.yml
src/Oro/Bundle/ProductBundle/Tests/Unit/EventListener/AttributeFormViewListenerTest.php
src/Oro/Bundle/ProductBundle/Tests/Unit/EventListener/ProductMultiFileBlockListenerTest.php
Commit message: BB-22832: Multifile attribute is shown on product visibility page in back-office - 5.1 (#36428)



Vulnerable code:
use Oro\Bundle\AttachmentBundle\Helper\FieldConfigHelper;
        return in_array(
            (string)$type,
            [
                WYSIWYGType::TYPE,
                FieldConfigHelper::MULTI_FILE_TYPE,
                FieldConfigHelper::MULTI_IMAGE_TYPE
            ],
            true
        );
    And I should see "MultipleImages Field" goes after "MultipleFiles Field"
    And I should see "MultipleFiles Field" goes after "MultipleImages Field"
        locator: '//h4[contains(., "MultipleFiles")]/parent::*'
        locator: '//h4[contains(., "MultipleImages")]/parent::*'
                    'form' => ['is_enabled' => true]
                        'multiFileField' => [
                            'title' => 'translated multiFile field label',
                            'priority' => 501,
                        'multiImageField' => [
                            'title' => 'translated multiImage field label',
                            'priority' => 501,
                        'multiFileField' => [
                            'title' => 'translated multiFile field label',
                            'priority' => 501,
                        'multiImageField' => [
                            'title' => 'translated multiImage field label',
                            'priority' => 501,

Fixed code:
        return in_array((string)$type, [WYSIWYGType::TYPE], true);
<?php

namespace Oro\Bundle\ProductBundle\EventListener;

use Oro\Bundle\UIBundle\Event\BeforeFormRenderEvent;

/**
 * Stops adding additional fields or attributes to forms if they are on the specified pages
 */
class ProductMultiFileBlockListener
{
    private array $pages = [];

    public function setPages(array $pages): void
    {
        $this->pages = $pages;
    }

    public function onBeforeFormRender(BeforeFormRenderEvent $event): void
    {
        if (in_array($event->getPageId(), $this->pages)) {
            $event->stopPropagation();
        }
    }
}
    oro_product.event_listener.product_multi_file_block_listener:
        class: Oro\Bundle\ProductBundle\EventListener\ProductMultiFileBlockListener
        arguments:
            - '@oro_entity_config.provider.entity'
        calls:
            - [setPages, [['product-visibility-edit', 'product-create-step-one']]]
        tags:
            - { name: kernel.event_listener, event: entity_form.render.before, method: onBeforeFormRender, priority: -250 }

@regression
@ticket-BB-22832

Feature: Check that tabs for multiple file and multiple images fields are displayed correctly on product pages
  As an administrator, I want to make sure that:
  - entity fields are not displayed on the first step of product creation page and not on the product
    visibility page.
  - entity entity fields are displayed on product second step creation page, product edit page, product view page.
  - product attributes fields are not displayed on the first step of product creation page, second step of product
    creation page, product edit page, product view page, product visibility page if attributes not added to family.
  - product attributes fields are not displayed on the first step of product creation page, product visibility
    page if attributes added to family.
  - product attributes are displayed on product second step creation page, product edit page, product view page
    if attributes added to family.

  Scenario: Authenticate
    Given I login as administrator
    And go to Products / Product Attributes

  Scenario Outline: Create Multiple Files attributes
    Given I click "Create Attribute"
    When I fill form with:
      | Field name | <Name>         |
      | Type       | Multiple Files |
    And click "Continue"
    And fill form with:
      | Label             | <Name>    |
      | Stored Externally | No        |
      | File Size (MB)    | 10        |
      | Use DAM           | <Use DAM> |
      | File Applications | [default] |
    And save and close form
    Then I should see "Attribute was successfully saved" flash message
    Examples:
      | Name                         | Use DAM |
      | multiple_files_attribute     | No      |
      | multiple_files_dam_attribute | Yes     |

  Scenario Outline: Create Multiple Images attribute
    Given I click "Create Attribute"
    When I fill form with:
      | Field name | <Name>          |
      | Type       | Multiple Images |
    And click "Continue"
    And fill form with:
      | Label             | <Name>    |
      | Stored Externally | No        |
      | File Size (MB)    | 10        |
      | Thumbnail Width   | 1024      |
      | Thumbnail Height  | 1024      |
      | Use DAM           | <Use DAM> |
      | File Applications | [default] |
    And save and close form
    Then I should see "Attribute was successfully saved" flash message
    Examples:
      | Name                          | Use DAM |
      | multiple_images_attribute     | No      |
      | multiple_images_dam_attribute | Yes     |

  Scenario: Create fields
    Given I go to System/ Entities/ Entity Management
    And I filter "Name" as is equal to "Product"
    And I click view Product in grid

  Scenario Outline: Create Multiple Files fields
    Given I click "Create field"
    When I fill form with:
      | Field name   | <Name>         |
      | Storage type | Table column   |
      | Type         | Multiple Files |
    And click "Continue"
    And fill form with:
      | Label             | <Name>    |
      | Stored Externally | No        |
      | File Size (MB)    | 10        |
      | Use DAM           | <Use DAM> |
      | File Applications | [default] |
    And save and close form
    Then I should see "Field saved" flash message
    Examples:
      | Name                     | Use DAM |
      | multiple_files_field     | No      |
      | multiple_files_dam_field | Yes     |

  Scenario Outline: Create Multiple Images fields
    Given I click "Create field"
    When I fill form with:
      | Field name | <Name>          |
      | Type       | Multiple Images |
    And click "Continue"
    And fill form with:
      | Label             | <Name>    |
      | Stored Externally | No        |
      | File Size (MB)    | 10        |
      | Thumbnail Width   | 1024      |
      | Thumbnail Height  | 1024      |
      | Use DAM           | <Use DAM> |
      | File Applications | [default] |
    And save and close form
    Then I should see "Field saved" flash message
    Examples:
      | Name                      | Use DAM |
      | multiple_images_field     | No      |
      | multiple_images_dam_field | Yes     |

  Scenario: Update schema
    Given I click update schema
    Then I should see Schema updated flash message

  Scenario: Check for fields and missing attributes on product creation pages
    Given I go to Products/ Products
    When I click "Create Product"
    Then I should see "General"
    # At the first step of creating a product, we should not see additional fields and attributes.
    # Check product attribute on first product create page.
    And should not see "multiple_files_attribute"
    And should not see "multiple_files_dam_attribute"
    And should not see "multiple_images_attribute"
    And should not see "multiple_images_dam_attribute"
    # Check extend field on first product create page.
    And should not see "multiple_files_field"
    And should not see "multiple_files_dam_field"
    And should not see "multiple_images_field"
    And should not see "multiple_images_dam_field"
    When I fill "ProductForm Step One" with:
      | Type           | Simple  |
      | Product Family | Default |
    And click "Continue"
    # Attributes is not displayed because they are not added to the product family.
    # Check product attribute on second product create page.
    Then I should not see "multiple_files_attribute"
    And should not see "multiple_files_dam_attribute"
    And should not see "multiple_images_attribute"
    And should not see "multiple_images_dam_attribute"
    # Check extend field on second product create page
    And should see "multiple_files_field"
    And should see "multiple_files_dam_field"
    And should see "multiple_images_field"
    And should see "multiple_images_dam_field"
    When I fill "ProductForm" with:
      | Sku  | ORO_PRODUCT_1 |
      | Name | ORO_PRODUCT_1 |
    And save and close form
    Then I should see "Product has been saved" flash message

  Scenario: Check for fields and missing attributes on product edit page
    Given I click "Edit"
    # Check product attribute on product edit page
    Then I should not see "multiple_files_attribute"
    And should not see "multiple_files_dam_attribute"
    And should not see "multiple_images_attribute"
    And should not see "multiple_images_dam_attribute"
    # Check extend field on product edit page
    And should see "multiple_files_field"
    And should see "multiple_files_dam_field"
    And should see "multiple_images_field"
    And should see "multiple_images_dam_field"
    When I save and close form
    Then I should see "Product has been saved" flash message

  Scenario: Check for fields and missing attributes on product view page
    # Check product attribute on product view page
    Given I should not see "multiple_files_attribute"
    And should not see "multiple_files_dam_attribute"
    And should not see "multiple_images_attribute"
    And should not see "multiple_images_dam_attribute"
    # Check extend field on product view page
    And should see "multiple_files_field"
    And should see "multiple_files_dam_field"
    And should see "multiple_images_field"
    And should see "multiple_images_dam_field"

  Scenario: Check for fields and missing attributes on product visibility page
    Given I click "More actions"
    When I click "Manage Visibility"
    # Check product attribute on product visibility page
    Then I should not see "multiple_files_attribute"
    And should not see "multiple_files_dam_attribute"
    And should not see "multiple_images_attribute"
    And should not see "multiple_images_dam_attribute"
    # Check extend field on product visibility page
    And should not see "multiple_files_field"
    And should not see "multiple_files_dam_field"
    And should not see "multiple_images_field"
    And should not see "multiple_images_dam_field"

  Scenario: Update product family with new attributes
    When I go to Products/ Product Families
    And I click "Edit" on row "default_family" in grid
    And click "Add"
    And fill "Attributes Group Form" with:
      | Attribute Groups Label0      | Multiple Fields Attributes                                                                                         |
      | Attribute Groups Visible0    | true                                                                                                               |
      | Attribute Groups Attributes0 | [multiple_files_attribute, multiple_files_dam_attribute, multiple_images_attribute, multiple_images_dam_attribute] |
    And save and close form
    Then I should see "Successfully updated" flash message

  Scenario: Check for fields and attributes on product creation pages
    Given I go to Products/ Products
    When I click "Create Product"
    # Check product attribute on first product create page
    Then I should not see "Multiple Fields Attributes"
    And should not see "multiple_files_attribute"
    And should not see "multiple_files_dam_attribute"
    And should not see "multiple_images_attribute"
    And should not see "multiple_images_dam_attribute"
    # Check extend field on first product create page
    And should not see "multiple_files_field"
    And should not see "multiple_files_dam_field"
    And should not see "multiple_images_field"
    And should not see "multiple_images_dam_field"
    And fill "ProductForm Step One" with:
      | Type           | Simple  |
      | Product Family | Default |
    When I click "Continue"
    # Check product attribute on second product create page
    Then I should see "Multiple Fields Attributes"
    # Check if the attributes are displayed (attributes fields do not have names except for family tab)
    And should not see "multiple_files_attribute"
    And should not see "multiple_files_dam_attribute"
    And should not see "multiple_images_attribute"
    And should not see "multiple_images_dam_attribute"
    # Check extend field on second product create page
    And should see "multiple_files_field"
    And should see "multiple_files_dam_field"
    And should see "multiple_images_field"
    And should see "multiple_images_dam_field"
    When I fill "ProductForm" with:
      | Sku  | ORO_PRODUCT_2 |
      | Name | ORO_PRODUCT_2 |
    And save and close form
    Then I should see "Product has been saved" flash message

  Scenario: Check for fields and attributes on product edit page
    Given I click "Edit"
    # Check product attribute on product edit page
    Then I should see "Multiple Fields Attributes"
    # Check if the attributes are displayed (attributes fields do not have names except for family tab)
    And should not see "multiple_files_attribute"
    And should not see "multiple_files_dam_attribute"
    And should not see "multiple_images_attribute"
    And should not see "multiple_images_dam_attribute"
    # Check extend field on product edit page
    And should see "multiple_files_field"
    And should see "multiple_files_dam_field"
    And should see "multiple_images_field"
    And should see "multiple_images_dam_field"
    When I save and close form
    Then I should see "Product has been saved" flash message

  Scenario: Check for fields and attributes on product view page
    # Check product attribute on product view page
    Given I should see "Multiple Fields Attributes"
    # Check if the attributes are displayed (attributes fields do not have names except for family tab)
    And should not see "multiple_files_attribute"
    And should not see "multiple_files_dam_attribute"
    And should not see "multiple_images_attribute"
    And should not see "multiple_images_dam_attribute"
    # Check extend field on product view page
    And should see "multiple_files_field"
    And should see "multiple_files_dam_field"
    And should see "multiple_images_field"
    And should see "multiple_images_dam_field"

  Scenario: Check for fields and attributes on product visibility page
    Given I click "More actions"
    When I click "Manage Visibility"
    # Check product attribute on product visibility page
    Then I should not see "Multiple Fields Attributes"
    And should not see "multiple_files_attribute"
    And should not see "multiple_files_dam_attribute"
    And should not see "multiple_images_attribute"
    And should not see "multiple_images_dam_attribute"
    # Check extend field on product visibility page
    And should not see "multiple_files_field"
    And should not see "multiple_files_dam_field"
    And should not see "multiple_images_field"
    And should not see "multiple_images_dam_field"

  Scenario: Create product and check fields and attributes
    Given I go to Products/ Products
    When I click "Create Product"
    And fill "ProductForm Step One" with:
      | Type           | Simple  |
      | Product Family | Default |
    And click "Continue"
    And fill "ProductForm" with:
      | Sku                       | ORO_PRODUCT_30 |
      | Name                      | ORO_PRODUCT_30 |
      | Multiple Files Attribute  | example.pdf    |
      | Multiple Images Attribute | 300x300.png    |
      | Multiple Files Field      | example2.pdf   |
      | Multiple Images Field     | blue-dot.jpg   |

    And click "Multiple Files DAM Attribute"
    And fill "Digital Asset Dialog Form" with:
      | File  | example.pdf                  |
      | Title | Multiple Files DAM Attribute |
    And click "Upload"
    And click on example.pdf in grid

    And click "Multiple Images DAM Attribute"
    And fill "Digital Asset Dialog Form" with:
      | File  | 300x300.png                   |
      | Title | Multiple Images DAM Attribute |
    And click "Upload"
    And click on 300x300.png in grid

    And click "Multiple Files DAM Field"
    And fill "Digital Asset Dialog Form" with:
      | File  | example2.pdf             |
      | Title | Multiple Files DAM Field |
    And click "Upload"
    And click on example2.pdf in grid

    And click "Multiple Images DAM Field"
    And fill "Digital Asset Dialog Form" with:
      | File  | blue-dot.jpg              |
      | Title | Multiple Images DAM Field |
    And click "Upload"
    And click on blue-dot.jpg in grid

    And save and close form
    Then I should see "Product has been saved" flash message
    And should see following "Multiple Files Attribute Grid" grid:
      | File Name   |
      | example.pdf |
    And should see following "Multiple Images Attribute Grid" grid:
      | Name        |
      | 300x300.png |
    And should see following "Multiple Files Field Grid" grid:
      | File Name    |
      | example2.pdf |
    And should see following "Multiple Images Field Grid" grid:
      | Name         |
      | blue-dot.jpg |
    And should see following "Multiple Files DAM Attribute Grid" grid:
      | File Name   |
      | example.pdf |
    And should see following "Multiple Images DAM Attribute Grid" grid:
      | Name        |
      | 300x300.png |
    And should see following "Multiple Files DAM Field Grid" grid:
      | File Name    |
      | example2.pdf |
    And should see following "Multiple Images DAM Field Grid" grid:
      | Name         |
      | blue-dot.jpg |
    And I should see "MultipleImages Backoffice Field" goes after "MultipleFiles Backoffice Field"
    And I should see "MultipleFiles Backoffice Field" goes after "MultipleImages Backoffice Field"
        locator: '//div[contains(@id,"MultipleFiles") and contains(@class,"file-collection")]/parent::*'

    MultipleFiles Backoffice Field:
      selector:
        type: xpath
        locator: '//div[contains(@id,"grid-MultipleFiles")]/parent::*'
        locator: '//div[contains(@id,"MultipleImages") and contains(@class,"file-collection")]/parent::*'

    MultipleImages Backoffice Field:
      selector:
        type: xpath
        locator: '//div[contains(@id,"grid-MultipleImages")]/parent::*'
                    'form' => ['is_enabled' => true],
                    'attribute' => ['is_attribute' => true],
                        'group1' => [
                            'title' => 'Group1Title',
                        'group1' => [
                            'title' => 'Group1Title',
                        'group1' => [
                            'title' => 'Group1Title',
                        'group1' => [
                            'title' => 'Group1Title',
<?php

namespace Oro\Bundle\ProductBundle\Tests\Unit\EventListener;

use Oro\Bundle\ProductBundle\EventListener\ProductMultiFileBlockListener;
use Oro\Bundle\UIBundle\Event\BeforeFormRenderEvent;
use Symfony\Component\Form\FormView;
use Twig\Environment;

class ProductMultiFileBlockListenerTest extends \PHPUnit\Framework\TestCase
{
    /** @var ProductMultiFileBlockListener */
    private $productMultiFileBlockListener;

    protected function setUp(): void
    {
        $this->productMultiFileBlockListener = new ProductMultiFileBlockListener();
    }

    /**
     * @dataProvider dataProvider
     */
    public function testOnBeforeFormRender(string $pageId, bool $expected): void
    {
        $event = new BeforeFormRenderEvent(
            $this->createMock(FormView::class),
            [],
            $this->createMock(Environment::class),
            null,
        );
        $event->setPageId('valid-page-id');

        $this->productMultiFileBlockListener->setPages([$pageId]);
        $this->productMultiFileBlockListener->onBeforeFormRender($event);
        self::assertEquals($event->isPropagationStopped(), $expected);
    }

    public function dataProvider(): array
    {
        return [
            ['pageId' => 'non-valid-page-id', 'expected' => false],
            ['pageId' => 'valid-page-id', 'expected' => true],
        ];
    }
}