#26110: Bundle products options input validation

Author: Michal Derlatka

app/code/Magento/Bundle/Model/Product/Type.php

@@ -416,16 +416,13 @@ public function beforeSave($product)
         if ($product->getCanSaveBundleSelections()) {
             $product->canAffectOptions(true);
             $selections = $product->getBundleSelectionsData();
-            if ($selections && !empty($selections)) {
-                $options = $product->getBundleOptionsData();
-                if ($options) {
-                    foreach ($options as $option) {
-                        if (empty($option['delete']) || 1 != (int)$option['delete']) {
-                            $product->setTypeHasOptions(true);
-                            if (1 == (int)$option['required']) {
-                                $product->setTypeHasRequiredOptions(true);
-                                break;
-                            }
+            if (!empty($selections) && $options = $product->getBundleOptionsData()) {
+                foreach ($options as $option) {
+                    if (empty($option['delete']) || 1 != (int)$option['delete']) {
+                        $product->setTypeHasOptions(true);
+                        if (1 == (int)$option['required']) {
+                            $product->setTypeHasRequiredOptions(true);
+                            break;
                         }
                     }
                 }
@@ -461,7 +458,7 @@ public function getOptionsIds($product)
      * Retrieve bundle option collection
      *
      * @param \Magento\Catalog\Model\Product $product
-     * @return Collection
+     * @return \Magento\Bundle\Model\ResourceModel\Option\Collection
      */
     public function getOptionsCollection($product)
     {
@@ -532,10 +529,10 @@ public function getSelectionsCollection($optionIds, $product)
      * Example: the catalog inventory validation of decimal qty can change qty to int,
      * so need to change quote item qty option value too.
      *
-     * @param   array $options
-     * @param   \Magento\Framework\DataObject $option
-     * @param   mixed $value
-     * @param   \Magento\Catalog\Model\Product $product
+     * @param  array $options
+     * @param  \Magento\Framework\DataObject $option
+     * @param  mixed $value
+     * @param  \Magento\Catalog\Model\Product $product
      * @return $this
      */
     public function updateQtyOption($options, \Magento\Framework\DataObject $option, $value, $product)
@@ -894,7 +891,7 @@ public function getSelectionsByIds($selectionIds, $product)
      *
      * @param array $optionIds
      * @param \Magento\Catalog\Model\Product $product
-     * @return Collection
+     * @return \Magento\Bundle\Model\ResourceModel\Option\Collection
      */
     public function getOptionsByIds($optionIds, $product)
     {
@@ -1191,9 +1188,11 @@ public function canConfigure($product)
      * @return void
      * @SuppressWarnings(PHPMD.UnusedFormalParameter)
      */
+    // @codingStandardsIgnoreStart
     public function deleteTypeSpecificData(\Magento\Catalog\Model\Product $product)
     {
     }
+    // @codingStandardsIgnoreEnd
 
     /**
      * Return array of specific to type product entities
@@ -1203,18 +1202,19 @@ public function deleteTypeSpecificData(\Magento\Catalog\Model\Product $product)
      */
     public function getIdentities(\Magento\Catalog\Model\Product $product)
     {
-        $identities = parent::getIdentities($product);
+        $identities = [];
+        $identities[] = parent::getIdentities($product);
         /** @var \Magento\Bundle\Model\Option $option */
         foreach ($this->getOptions($product) as $option) {
             if ($option->getSelections()) {
                 /** @var \Magento\Catalog\Model\Product $selection */
                 foreach ($option->getSelections() as $selection) {
-                    $identities = array_merge($identities, $selection->getIdentities());
+                    $identities[] = $selection->getIdentities();
                 }
             }
         }
 
-        return $identities;
+        return array_merge([], ...$identities);
     }
 
     /**
@@ -1261,7 +1261,7 @@ protected function getBeforeQty($product, $selection)
      *
      * @param \Magento\Catalog\Model\Product $product
      * @param bool $isStrictProcessMode
-     * @param Collection $optionsCollection
+     * @param \Magento\Bundle\Model\ResourceModel\Option\Collection $optionsCollection
      * @param int[] $options
      * @return void
      * @throws \Magento\Framework\Exception\LocalizedException
@@ -1331,7 +1331,7 @@ private function isSelectedOptionValid($option, $options): bool
      *
      * @param \Magento\Bundle\Model\ResourceModel\Selection\Collection $selections
      * @param bool $skipSaleableCheck
-     * @param Collection $optionsCollection
+     * @param \Magento\Bundle\Model\ResourceModel\Option\Collection $optionsCollection
      * @param int[] $options
      * @return void
      * @throws \Magento\Framework\Exception\LocalizedException
@@ -1387,16 +1387,18 @@ protected function checkIsResult($_result)
      */
     protected function mergeSelectionsWithOptions($options, $selections)
     {
+        $selections = [];
+
         foreach ($options as $option) {
             $optionSelections = $option->getSelections();
             if ($option->getRequired() && is_array($optionSelections) && count($optionSelections) == 1) {
-                $selections = array_merge($selections, $optionSelections);
+                $selections[] = $optionSelections;
             } else {
                 $selections = [];
                 break;
             }
         }
 
-        return $selections;
+        return array_merge([], ...$selections);
     }
 }

dev/tests/integration/testsuite/Magento/Bundle/_files/product_with_multiple_options_radio_select.php

@@ -4,9 +4,13 @@
  * See COPYING.txt for license details.
  */
 
-require __DIR__ . '/../../../Magento/Catalog/_files/multiple_products.php';
+use Magento\Catalog\Model\Product;
+use Magento\TestFramework\Helper\Bootstrap;
+use Magento\TestFramework\Workaround\Override\Fixture\Resolver;
 
-$objectManager = \Magento\TestFramework\Helper\Bootstrap::getObjectManager();
+Resolver::getInstance()->requireDataFixture('Magento/Catalog/_files/multiple_products.php');
+
+$objectManager = Bootstrap::getObjectManager();
 
 $productIds = range(10, 12, 1);
 foreach ($productIds as $productId) {
@@ -24,8 +28,8 @@
     $stockItem->save();
 }
 
-/** @var $product \Magento\Catalog\Model\Product */
-$product = $objectManager->create(\Magento\Catalog\Model\Product::class);
+/** @var $product Product */
+$product = $objectManager->create(Product::class);
 $product->setTypeId(\Magento\Catalog\Model\Product\Type::TYPE_BUNDLE)
     ->setId(3)
     ->setAttributeSetId(4)
@@ -35,7 +39,6 @@
     ->setVisibility(\Magento\Catalog\Model\Product\Visibility::VISIBILITY_BOTH)
     ->setStatus(\Magento\Catalog\Model\Product\Attribute\Source\Status::STATUS_ENABLED)
     ->setStockData(['use_config_manage_stock' => 1, 'qty' => 100, 'is_qty_decimal' => 0, 'is_in_stock' => 1])
-    ->setPriceView(1)
     ->setPriceType(1)
     ->setPrice(10.0)
     ->setShipmentType(0)

dev/tests/integration/testsuite/Magento/Bundle/_files/product_with_multiple_options_radio_select_rollback.php

@@ -3,11 +3,16 @@
  * Copyright © Magento, Inc. All rights reserved.
  * See COPYING.txt for license details.
  */
+use Magento\TestFramework\Helper\Bootstrap;
+use Magento\TestFramework\Workaround\Override\Fixture\Resolver;
 
-require __DIR__ . '/../../../Magento/Catalog/_files/multiple_products_rollback.php';
+Resolver::getInstance()->requireDataFixture('Magento/Catalog/_files/multiple_products_rollback.php');
 
+$objectManager = Bootstrap::getObjectManager();
 /** @var \Magento\Framework\Registry $registry */
-$registry = \Magento\TestFramework\Helper\Bootstrap::getObjectManager()->get(\Magento\Framework\Registry::class);
+$registry = $objectManager->get(\Magento\Framework\Registry::class);
+/** @var \Magento\Catalog\Api\ProductRepositoryInterface $productRepository */
+$productRepository = $objectManager->create(\Magento\Catalog\Api\ProductRepositoryInterface::class);
 
 $registry->unregister('isSecureArea');
 $registry->register('isSecureArea', true);