https://helpx.adobe.com/security/products/magento/apsb23-50.html
The vulnerability with the highest CVSS score of 8.8 (CVE-2023-38218) states that it is an unauthenticated privilege escalation due to improper input validation.
If we look at the diff we see a number of security related changes. One of those changes is the following in Magento\Customer\Plugin\Webapi\Controller\Rest\ValidateCustomerData::validateInputData:
| <?php | |
| declare(strict_types=1); | |
| #[Attribute(Attribute::TARGET_FUNCTION | Attribute::TARGET_METHOD | Attribute::IS_REPEATABLE)] | |
| final class Option | |
| { | |
| public function __construct( | |
| public string|null $short = null, | |
| public string|null $long = null, | |
| public bool $required = false, |
| """ | |
| This script formats a magento product export file, and sets each | |
| additional_attribute as a new column in a target file | |
| """ | |
| import csv | |
| # real files | |
| source_file = './catalog_product_20210316_044037.csv' | |
| target_file = './catalog_product_20210316_044037_formatted.csv' |
Magento 2.3.7 and 2.4.2 ship with composer v2 support out of the box but as far as I can see the only thing that needs to happen is to use some more modern versions of certain composer plugins which are used by certain dependencies of Magento.
This means we should be able to add composer v2 support to older Magento2 versions as well if we get a bit creative.
See below for diffs of the composer.json files you can apply to your projects, be sure to keep a mental note of these things, they will need to maintained by yourself in case newer versions of these modules are released. And if one day you update to Magento 2.3.7 or 2.4.2 or higher, you can remove these changes again.
| (ns example.core | |
| (:require [clojure.test :refer :all] | |
| [clojure.test.check :as tc] | |
| [clojure.test.check.generators :as gen] | |
| [clojure.test.check.properties :as prop])) | |
| ;; ----------------------------------------------------------------------- | |
| ;; Application code to test | |
| (defn includes? [needle haystack] |
| #!/bin/bash | |
| # stop on errors | |
| set -e | |
| # turn on debugging if you're running into issues | |
| #set -x | |
| # Static variables | |
| ENVIRONMENT=$1 | |
| RED='\033[0;31m' | |
| NC='\033[0m' # No Color |
| /* | |
| Run the following query to get a set of queries that will purge all tables of email addresses. The queries that are output from | |
| this should be manually reviewed to remove queries for any unnecessary tables and can then be run manually or via a Magerun "db:query" | |
| to include it as a part of a scripted cloning process. | |
| IMPORTANT: Make sure to update the @db_name variable | |
| What the resulting query will do: | |
| -- Replace the emails in Magento with dummy emails (unless email is one of the whitelisted domains) in order to prevent emails erroneously being sent to customers. | |
| -- Make all emails with @example.com and use and MD5 of the original domain of the email as the tag for the email. This is important in case we have two emails with the | |
| -- same "local part" but different "domain part". For example, bob.smith@yahoo.com would become bob.smith+c9d12f@example.com |
| /*<?php | |
| //*/public class PhpJava { public static void main(String[] args) { System.out.printf("/*%s", | |
| //\u000A\u002F\u002A | |
| class PhpJava { | |
| static function main() { | |
| echo(//\u000A\u002A\u002F | |
| "Hello World!"); | |
| }} | |
| //\u000A\u002F\u002A | |
| PhpJava::main(); |
| # ------------------------------------------------------------------------------ | |
| # FILE: m2.plugin.zsh | |
| # DESCRIPTION: oh-my-zsh m2 autocomplete file. Adapted from composer plugin | |
| # AUTHOR: Sam Tay (sam.chong.tay@gmail.com) | |
| # VERSION: 1.0.0 | |
| # ------------------------------------------------------------------------------ | |
| # Keep this up to date by checking bin-magento list --raw --no-ansi | |
| _bin_magento_get_command_list () { | |
| bin-magento --raw --no-ansi list | sed "s/[[:space:]].*//g" |