by Shoaib Rehman | Feb 20, 2022 | Magento 2
Earlier this week, Adobe identified RCE vulnerability in both commerce and open source editions and released a security patch APSB22-12 marked as Critical Priority to be installed immediately.
What this means is if you are running your website on Adobe Commerce (2.3.3-p1-2.3.7-p2) or Magento Open Source (2.4.0-2.4.3-p1), then your website is at high risk and needs to be patched immediately.
There are two security patches to fix the potential vulnerability and you can download them from https://support.magento.com/hc/en-us/articles/4426353041293-Security-updates-available-for-Adobe-Commerce-APSB22-12- for your respective Magento versions.
Use the following attached patches, depending on your Adobe Commerce version:
2.4.3 – 2.4.3-p1:
2.3.4-p2 – 2.4.2-p2:
2.3.3-p1 – 2.3.4:
In order to stay up to date with the latest protections, you will need to apply two patches: MDVA-43395 patch first, and then MDVA-43443 on top of it.
The patches affect the following files:
./vendor/magento/framework/Filter/DirectiveProcessor/VarDirective.php
./vendor/magento/module-email/Model/Template/Filter.php
./vendor/magento/framework/Filter/DirectiveProcessor/DependDirective.php
./vendor/magento/framework/Filter/DirectiveProcessor/ForDirective.php
./vendor/magento/framework/Filter/DirectiveProcessor/IfDirective.php
./vendor/magento/framework/Filter/DirectiveProcessor/SimpleDirective.php
./vendor/magento/framework/Filter/DirectiveProcessor/VarDirective.php
How to apply a Magento Patch?
Once you have downloaded the appropriate patches, you can create a new directory called i.e. ./patches in your Magento root, upload patch files and run the following commands:
patch -p1 < patches/MDVA-43395_EE_2.4.3-p1_COMPOSER_v1.patch
patch -p1 < patches/MDVA-43443_EE_2.4.3-p1_COMPOSER_v1.patch
by Shoaib Rehman | Feb 20, 2022 | Magento 2
There are many times when you would want to add a custom <script> just before the opening head tag in Magento but no matter what you do, the script will always get added after Magento loads its requireJS which isn’t much helpful, but in this article, I will share the steps you can take to ensure that your script gets added right after the opening <head> tag – yes, even before Magento injects its requireJS.
By default Magento 2 uses the root.phtml file to setup head content accordingly, which is located in vendor/magento/module-theme/view/base/templates/root.phtml (unless it has been overridden in your custom theme). The content of the root.phtml is as follows:
<?php
<script>
var BASE_URL = '<?= $block->escapeUrl($block->getBaseUrl()) ?>';
var require = {
"baseUrl": "<?= /* @escapeNotVerified */ $block->getViewFileUrl('/') ?>"
};
</script>
This file contains the $requireJs variable and block and the require.js block is defined in vendor/Magento/module-theme/view/frontend/layout/default.xml content of which is as follows:
<block name="require.js" class="Magento\Framework\View\Element\Template" template="Magento_Theme::page/js/require_js.phtml" />
Now, there are two possible solutions to override the file:
- By overriding the file in your custom theme
- By creating a simple module (preferred)
Override require_js.phtml in your custom theme
To override the the file in your custom theme, copy require_js.phtml from vendor/magento/module-theme/view/frontend/templates/page/js to your theme app/design/frontend/{VENDOR}/{THEME_NAME}/Magento_Theme/templates/page/js/ and finally, put your custom JS code just above the requireJS block i.e.
<script>
console.log("Hello World!");
var require = {
"baseUrl": "<?php /* @escapeNotVerified */ echo $block->getViewFileUrl('/') ?>"
};
</script>
Override require_js.phtml in a custom module
Create default.xml in view/frontend/layout/ and add the following code:
<?xml version="1.0" ?>
<page xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:noNamespaceSchemaLocation="urn:magento:framework:View/Layout/etc/page_configuration.xsd">
<body>
<referenceBlock name="require.js">
<action method="setTemplate">
<argument name="template" xsi:type="string">Shoman_CustomScript::code.phtml</argument>
</action>
</referenceBlock>
</body>
</page>
As you can see, in the code above, we are setting a new template file code.phtml for the require.js block.
Next, go ahead and create the code.phtml file in ./view/frontend/templates and add the custom code as follows:
<?php
<!-- My Custom Script start -->
<script type="text/javascript">
console.log("Hello World!");
</script>
<!-- My Custom Script end -->
<script>
var BASE_URL = '<?= $block->escapeUrl($block->getBaseUrl()) ?>';
var require = {
"baseUrl": "<?= /* @escapeNotVerified */ $block->getViewFileUrl('/') ?>"
};
</script>
I have created a simple module that does the job already and you can download it from here: https://github.com/shoaibrehman/Magento2-OneTrust-Cookies – this module primarily focus on integrating OneTrust Cookie Policy script so feel free to replace the content of code.phtml file as per your needs or you can fork the module and modify it as per your needs!
