https://helpx.adobe.com/security/products/magento/apsb23-50.html
The vulnerability with the highest CVSS score of 8.8 (CVE-2023-38218) states that it is an unauthenticated privilege escalation due to improper input validation.
If we look at the diff we see a number of security related changes. One of those changes is the following in Magento\Customer\Plugin\Webapi\Controller\Rest\ValidateCustomerData::validateInputData:
| <?php | |
| namespace App\Http\Controllers; | |
| use Psr\Http\Message\ServerRequestInterface; | |
| use App\Http\Controllers\Traits\UserByAccessToken; | |
| use League\OAuth2\Server\Exception\OAuthServerException; | |
| use Illuminate\Database\Eloquent\ModelNotFoundException; | |
| use \Laravel\Passport\Http\Controllers\AccessTokenController as ATC; |
| # Apache Server Configs v5.1.0 | MIT License | |
| # https://github.com/h5bp/server-configs-apache | |
| # (!) Using `.htaccess` files slows down Apache, therefore, if you have | |
| # access to the main server configuration file (which is usually | |
| # called `httpd.conf`), you should add this logic there. | |
| # | |
| # https://httpd.apache.org/docs/current/howto/htaccess.html | |
| # ###################################################################### |
| <?php | |
| /** | |
| * Product Attribute Installer | |
| */ | |
| try { | |
| /* @var $installer Mage_Catalog_Model_Resource_Setup */ | |
| $installer = $this; | |
| $installer->startSetup(); |
This article discusses the translation mechanism in Magento 2.x, and contrasts it with that of Magento 1.x. The intended audience is Magento developers who would like to better learn the Magento architecture.
The Magento 2.x source code described here has been available since Magento 2.0.0.0-dev46 release and can be viewed on the GitHub at https://github.com/magento/magento2/commit/0849373d7636cfa17b70b8188bfc36d13ae749c1 or later commits.
Magento 1.x can present the user interface in different languages without modifying the actual application source code—it translates the system messages, error messages, and labels for display in the UI. Some messages may be displayed in logs for a system administrator or a developer—those don't need to be translated. By convention, in the source code, the labels and system messages for UI are expressed in English (en_US).
| <?php | |
| //Possible color value | |
| $attribute = Mage::getModel('eav/config')->getAttribute('catalog_product', 'color'); //"color" is the attribute_code | |
| $allOptions = $attribute->getSource()->getAllOptions(true, true); | |
| foreach ($allOptions as $instance) { | |
| $id = $instance['value']; //id of the option | |
| $value = $instance['label']; //Label of the option | |
| } | |
| ?> |
| diff -rupN mage_org/app/code/core/Mage/Catalog/Model/Url.php src_shop/app/code/core/Mage/Catalog/Model/Url.php | |
| --- mage_org/app/code/core/Mage/Catalog/Model/Url.php 2013-11-19 00:48:25.679009391 +0100 | |
| +++ src_shop/app/code/core/Mage/Catalog/Model/Url.php 2013-11-19 00:49:24.188005601 +0100 | |
| @@ -643,13 +643,24 @@ class Mage_Catalog_Model_Url | |
| $this->_rewrite = $rewrite; | |
| return $requestPath; | |
| } | |
| + | |
| + // avoid unnecessary creation of new url_keys for duplicate url keys | |
| + $noSuffixPath = substr($requestPath, 0, -(strlen($suffix))); |
This is just a small post in response to [this tweet][tweet] by Julien Pauli (who by the way is the release manager for PHP 5.5). In the tweet he claims that objects use more memory than arrays in PHP. Even though it can be like that, it's not true in most cases. (Note: This only applies to PHP 5.4 or newer.)
The reason why it's easy to assume that objects are larger than arrays is because objects can be seen as an array of properties and a bit of additional information (like the class it belongs to). And as array + additional info > array it obviously follows that objects are larger. The thing is that in most cases PHP can optimize the array part of it away. So how does that work?
The key here is that objects usually have a predefined set of keys, whereas arrays don't:
