fix: avoid direct access to reviews list AJAX #33876

iparmentier · 2021-08-20T18:30:59Z

Description (*)

Do not know wether it is intentional,
But you can access directly to the reviews list Ajax controller however all others controllers for Ajax URL has a conditional test in code.

Fixed Issues (if relevant)

Why not restrain this page to Ajax only

Manual testing scenarios

You can give it a try :
/review/product/listAjax/id/9999
=> Display the raw output in the browser.

(9999 = product if from store)

Questions or comments

Give me your think,

Ilan Parmentier

Contribution checklist (*)

Pull request has a meaningful description of its purpose
All commits are accompanied by meaningful commit messages
All new or changed code is covered with unit/integration tests (if applicable)
README.md files for modified modules are updated and included in the pull request if any README.md predefined sections require an update
All automated tests passed successfully (all builds are green)

Resolved issues:

resolves [Issue] Avoid direct access to reviews list Ajax #37920: Avoid direct access to reviews list Ajax

Good evening, Do not know wether it is intentional, But you can access directly to the reviews list Ajax controller You can give it a try : /review/product/listAjax/id/111111616 => Display the raw output in the browser. Why not restrain this page to Ajax only. Give me your think, Ilan Parmentier

m2-assistant · 2021-08-20T18:31:02Z

Hi @mageho. Thank you for your contribution
Here are some useful tips how you can test your changes using Magento test environment.
Add the comment under your pull request to deploy test or vanilla Magento instance:

@magento give me test instance - deploy test instance based on PR changes
@magento give me 2.4-develop instance - deploy vanilla Magento instance

❗ Automated tests can be triggered manually with an appropriate comment:

@magento run all tests - run or re-run all required tests against the PR changes
@magento run <test-build(s)> - run or re-run specific test build(s)
For example: @magento run Unit Tests

<test-build(s)> is a comma-separated list of build names. Allowed build names are:

Database Compare
Functional Tests CE
Functional Tests EE,
Functional Tests B2B
Integration Tests
Magento Health Index
Sample Data Tests CE
Sample Data Tests EE
Sample Data Tests B2B
Static Tests
Unit Tests
WebAPI Tests
Semantic Version Checker

You can find more information about the builds here

ℹ️ Please run only needed test builds instead of all when developing. Please run all test builds before sending your PR for review.

For more details, please, review the Magento Contributor Guide documentation.

⚠️ According to the Magento Contribution requirements, all Pull Requests must go through the Community Contributions Triage process. Community Contributions Triage is a public meeting.

🕙 You can find the schedule on the Magento Community Calendar page.

📞 The triage of Pull Requests happens in the queue order. If you want to speed up the delivery of your contribution, please join the Community Contributions Triage session to discuss the appropriate ticket.

🎥 You can find the recording of the previous Community Contributions Triage on the Magento Youtube Channel

✏️ Feel free to post questions/proposals/feedback related to the Community Contributions Triage process to the corresponding Slack Channel

iparmentier · 2021-08-20T18:33:53Z

@magento give me test instance

magento-deployment-service · 2021-08-20T18:33:56Z

Hi @mageho. Thank you for your request. I'm working on Magento instance for you.

iparmentier · 2021-08-20T18:34:13Z

@magento run all tests

magento-automated-testing · 2021-08-20T18:34:17Z

The requested builds are added to the queue. You should be able to see them here within a few minutes. Please re-request them if they don't show in a reasonable amount of time.

magento-deployment-service · 2021-08-20T18:38:45Z

Hi @mageho, here is your Magento Instance: https://acd0f0eabc1b4ed373cab5920b6e8853.instances.magento-community.engineering
Admin access: https://acd0f0eabc1b4ed373cab5920b6e8853.instances.magento-community.engineering/admin_c8aa
Login: 406a3e8c
Password: c39c54401e4c

app/code/Magento/Review/Controller/Product/ListAjax.php

bgorski · 2021-08-21T14:30:23Z

@mageho thank you for your contribution! Indeed, this action can be accessed directly and if indexed by search engines, it may contribute to bad user experience. I had one change request though - please address it and I think we're good to go.

iparmentier · 2021-08-21T16:10:43Z

@bgorski Hello there, I did the modification by following your advice. We must be good to go. have a nice weekend.

bgorski

@mageho indeed we are - approving the PR. The next step is to wait for the core team to prioritize this and to perform manual testing.
Thank you for your contribution!

bgorski · 2021-08-21T19:42:05Z

@magento run all tests

magento-automated-testing · 2021-08-21T19:42:11Z

The requested builds are added to the queue. You should be able to see them here within a few minutes. Please re-request them if they don't show in a reasonable amount of time.

magento-engcom-team · 2021-08-21T19:43:31Z

Hi @bgorski, thank you for the review.
ENGCOM-9191 has been created to process this Pull Request
✳️ @bgorski, could you please add one of the following labels to the Pull Request?

Label	Description
`Auto-Tests: Covered`	All changes in Pull Request is covered by auto-tests
`Auto-Tests: Not Covered`	Changes in Pull Request requires coverage by auto-tests
`Auto-Tests: Not Required`	Changes in Pull Request does not require coverage by auto-tests

bgorski · 2021-08-22T10:00:11Z

@magento run Unit Tests, Functional Tests CE, Functional Tests B2B

engcom-Lima · 2023-08-25T10:18:02Z

@magento run all tests

magento-automated-testing · 2023-08-25T10:18:09Z

The requested builds are added to the queue. You should be able to see them here within a few minutes. Please message the #magento-devops slack channel if they don't show in a reasonable amount of time and a representative will look into any issues.

engcom-Lima · 2023-08-25T10:18:29Z

@magento give me test instance

magento-deployment-service · 2023-08-25T10:18:33Z

Hi @engcom-Lima. Thank you for your request. I'm working on Magento instance for you.

magento-deployment-service · 2023-08-25T10:24:47Z

Hi @engcom-Lima, here is your Magento Instance: https://acd0f0eabc1b4ed373cab5920b6e8853.instances-prod.magento-community.engineering
Admin access: https://acd0f0eabc1b4ed373cab5920b6e8853.instances-prod.magento-community.engineering/admin_48e7
Login: b11bca4d
Password: 0d0a260d535b

engcom-Lima · 2023-08-25T13:03:36Z

✔️ QA Passed

Preconditions:

Install fresh Magento 2.4-develop and PHP 8.1

Manual testing scenario:

Add /review/product/listAjax/id/{productID} after the instance frontend URL and hit.

Before: ✖️ Showing the reviews list.

After: ✔️ Now no direct access to reviews list.

Builds are failed. Hence, moving this PR to Extended Testing.

engcom-Lima · 2023-08-25T13:06:43Z

@magento create issue

engcom-Charlie · 2024-10-10T18:09:37Z

@magento run all tests

engcom-Charlie · 2024-10-14T06:37:12Z

@magento run Functional Tests B2B, Functional Tests CE, Functional Tests EE, Static Tests

engcom-Charlie · 2024-10-14T10:36:06Z

@magento run all tests

engcom-Charlie · 2024-10-14T16:33:13Z

@magento run Functional Tests B2B, Unit Tests

engcom-Charlie · 2024-10-15T05:30:55Z

The functional B2B test failures are not consistent in recent 2 builds on same code. The failures are not part of PR or not failing because of PR changes, seems to be flaky. Hence moving it to Merge in Progress.

Run 1:
https://public-results-storage-prod.magento-testing-service.engineering/reports/magento/magento2/pull/33876/cb4b10365d4ff3f9dbced57c13e3de5c/Functional/allure-report-b2b/index.html#categories/e874bb47202994ea819dd7cbe4bd2bbb/889461fc9b54c415/

Run 2:
https://public-results-storage-prod.magento-testing-service.engineering/reports/magento/magento2/pull/33876/f7ec58b11a8b881a673ce380a6a97aef/Functional/console-error-logs.html

magento-engcom-team added Component: Review Release Line: 2.4 labels Aug 20, 2021

m2-community-project bot added the Progress: pending review label Aug 20, 2021

bgorski self-requested a review August 21, 2021 14:22

bgorski self-assigned this Aug 21, 2021

m2-community-project bot added Progress: review and removed Progress: pending review labels Aug 21, 2021

bgorski requested changes Aug 21, 2021

View reviewed changes

app/code/Magento/Review/Controller/Product/ListAjax.php Outdated Show resolved Hide resolved

m2-community-project bot added Progress: needs update and removed Progress: review labels Aug 21, 2021

Update ListAjax.php

4be563b

m2-community-project bot added Progress: review and removed Progress: needs update labels Aug 21, 2021

bgorski approved these changes Aug 21, 2021

View reviewed changes

m2-community-project bot added Progress: ready for testing and removed Progress: review labels Aug 21, 2021

bgorski added the Auto-Tests: Not Required Changes in Pull Request does not require coverage by auto-tests label Aug 21, 2021

engcom-Lima assigned engcom-Lima and unassigned engcom-Lima Aug 25, 2023

m2-community-project bot added Progress: testing in progress and removed Progress: ready for testing labels Aug 25, 2023

m2-community-project bot added Progress: extended testing and removed Progress: testing in progress labels Aug 25, 2023

m2-assistant bot mentioned this pull request Aug 25, 2023

[Issue] Avoid direct access to reviews list Ajax #37920

Open

5 tasks

m2-community-project bot added Progress: ready for testing Progress: extended testing and removed Progress: extended testing Progress: ready for testing labels Aug 25, 2023

engcom-Charlie self-assigned this Oct 10, 2024

m2-community-project bot added Progress: ready for testing and removed Progress: extended testing labels Oct 10, 2024

Merge branch '2.4-develop' into patch-11

696c0da

Fixed static test failure

bc27dd4

iparmentier changed the title ~~Avoid direct access to reviews list Ajax~~ fix: avoid direct access to reviews list AJAX Apr 18, 2025

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix: avoid direct access to reviews list AJAX #33876

fix: avoid direct access to reviews list AJAX #33876

iparmentier commented Aug 20, 2021 •

edited by m2-assistant bot

Loading

m2-assistant bot commented Aug 20, 2021

iparmentier commented Aug 20, 2021

magento-deployment-service bot commented Aug 20, 2021

iparmentier commented Aug 20, 2021

magento-automated-testing bot commented Aug 20, 2021

magento-deployment-service bot commented Aug 20, 2021

bgorski commented Aug 21, 2021

iparmentier commented Aug 21, 2021

bgorski left a comment

bgorski commented Aug 21, 2021

magento-automated-testing bot commented Aug 21, 2021

magento-engcom-team commented Aug 21, 2021

bgorski commented Aug 22, 2021

engcom-Lima commented Aug 25, 2023

magento-automated-testing bot commented Aug 25, 2023

engcom-Lima commented Aug 25, 2023

magento-deployment-service bot commented Aug 25, 2023

magento-deployment-service bot commented Aug 25, 2023

engcom-Lima commented Aug 25, 2023

engcom-Lima commented Aug 25, 2023

engcom-Charlie commented Oct 10, 2024

engcom-Charlie commented Oct 14, 2024

engcom-Charlie commented Oct 14, 2024

engcom-Charlie commented Oct 14, 2024

engcom-Charlie commented Oct 15, 2024

fix: avoid direct access to reviews list AJAX #33876

Are you sure you want to change the base?

fix: avoid direct access to reviews list AJAX #33876

Conversation

iparmentier commented Aug 20, 2021 • edited by m2-assistant bot Loading

Description (*)

Fixed Issues (if relevant)

Manual testing scenarios

Questions or comments

Contribution checklist (*)

Resolved issues:

m2-assistant bot commented Aug 20, 2021

iparmentier commented Aug 20, 2021

magento-deployment-service bot commented Aug 20, 2021

iparmentier commented Aug 20, 2021

magento-automated-testing bot commented Aug 20, 2021

magento-deployment-service bot commented Aug 20, 2021

bgorski commented Aug 21, 2021

iparmentier commented Aug 21, 2021

bgorski left a comment

Choose a reason for hiding this comment

bgorski commented Aug 21, 2021

magento-automated-testing bot commented Aug 21, 2021

magento-engcom-team commented Aug 21, 2021

bgorski commented Aug 22, 2021

engcom-Lima commented Aug 25, 2023

magento-automated-testing bot commented Aug 25, 2023

engcom-Lima commented Aug 25, 2023

magento-deployment-service bot commented Aug 25, 2023

magento-deployment-service bot commented Aug 25, 2023

engcom-Lima commented Aug 25, 2023

✔️ QA Passed

engcom-Lima commented Aug 25, 2023

engcom-Charlie commented Oct 10, 2024

engcom-Charlie commented Oct 14, 2024

engcom-Charlie commented Oct 14, 2024

engcom-Charlie commented Oct 14, 2024

engcom-Charlie commented Oct 15, 2024

iparmentier commented Aug 20, 2021 •

edited by m2-assistant bot

Loading