2.0.0.0-dev74

* Pricing Improvements:
  * Added price calculation component to library
  * Eliminated price calculation from blocks and templates and implemented new calculation models for the following product types:
     * Bundle
     * Simple/Virtual
     * Grouped
     * Downloadable
  * Resolved price calculation dependencies on the Tax and Weee modules
* Themes update:
  * Updated the look&feel of the Admin theme
* Fixed bugs:
  * Fixed an issue with the inability to save product with grouped price when Price Scope = Website
  * Fixed an issue with fatal error on attempt to edit product from wishlist in stores with multiple store views
  * Fixed an issue where it was impossible to add to a wishlist a product with custom quantity
  * Fixed an issue where JS validation was skipped during CMS page creation
  * Fixed an issue with the New Customer Address Attribute page and the New Customer Attribute page having the same title
  * Fixed an issue where a form was submitted two times during CMS page creation
  * Fixed an issue where a fatal error appeared when trying to edit product in a wishlist in stores with multiple store views
  * Fixed an issue with inability to change page layout for categories
  * Fixed an issue where the Quantity drop-down list box was disabled for bundle products
  * Fixed an issue where inactive Related Products rules were applied
  * Fixed a clickjacking vulnerability
  * Fixed bugs and added improvements in the Blank theme
  * Fixed an issue where the Flat Rate shipping method was not enabled by default
  * Fixed an issue with incorrect order of products on the Add Product split button
  * Fixed an issue with saving the tier price attribute value
  * Fixed an issue with creating integration from config file
  * Fixed an issue where the Cookie Restriction Mode = Yes configuration was not applied
  * Fixed an issue where it was impossible to perform ajax actions from backend grids in Internet Explorer
  * Fixed the improper usage of DIRECTORY_SEPARATOR
  * Fixed an issue where it was impossible to add new address on customer's account page if default address had been already set
  * Fixed an issue where setting memory_limit to -1 caused installation failure
  * Fixed an issue where the configuration of Admin Session Lifetime was not applied correctly
  * Fixed an issue where Scheduled Export was not performed if exporting to remote FTP server
  * Fixed the wrong default value for PHP memory_limit
  * Fixed an issue where frontend messages were not displayed when FPC was turned off
  * Fixed the position of page action buttons on the Categories page in the backend
  * Improved backend grids UI
* Framework Improvements:
  * Simplified Search related Data Objects
  * Moved lib/Magento/* to lib/Magento/Framework/*
    * Moved lib/Magento/App to lib/Magento/Framework/App
* Refactored the following modules to use Customer service:
  * PayPalRecurringPayment
  * RecurringPayment
  * Multishipping
  * Paypal
* Customer Service usage:
  * Implemented Service Context Provider
  * Restructured webapi.xml
  * Renamed createAccount to createCustomer in CustomerAccountService
  * Implemented Caching strategy for the Customer service
* GitHub requests:
  * [magento#488] (magento#488) -- Converted several grids from Magento\Sales module to new layout XML config format

Author: magento-team

.htaccess

@@ -32,7 +32,7 @@
 ## adjust memory limit
 
 #    php_value memory_limit 64M
-    php_value memory_limit 2048M
+    php_value memory_limit 768M
     php_value max_execution_time 18000
 
 ############################################
@@ -47,20 +47,27 @@
     #php_flag zlib.output_compression on
 
 ###########################################
-# disable user agent verification to not break multiple image upload
+## disable user agent verification to not break multiple image upload
 
     php_flag suhosin.session.cryptua off
 
 </IfModule>
 
 <IfModule mod_security.c>
 ###########################################
-# disable POST processing to not break multiple image upload
+## disable POST processing to not break multiple image upload
 
     SecFilterEngine Off
     SecFilterScanPOST Off
 </IfModule>
 
+<IfModule mod_headers.c>
+############################################
+## prevent clickjacking
+
+    Header set X-Frame-Options SAMEORIGIN
+</IfModule>
+
 <IfModule mod_deflate.c>
 
 ############################################
@@ -173,11 +180,11 @@
 ## Deny access to release notes to prevent disclosure of the installed Magento version
 
     <Files RELEASE_NOTES.txt>
-        order allow,deny
-        deny from all
+        Order allow,deny
+        Deny from all
     </Files>
 ############################################
 ## If running in cluster environment, uncomment this
 ## http://developer.yahoo.com/performance/rules.html#etags
 
-    #FileETag none
+    #FileETag none

.htaccess.sample

@@ -31,7 +31,6 @@
 ############################################
 ## adjust memory limit
 
-#    php_value memory_limit 64M
     php_value memory_limit 128M
     php_value max_execution_time 18000
 
@@ -47,20 +46,27 @@
     #php_flag zlib.output_compression on
 
 ###########################################
-# disable user agent verification to not break multiple image upload
+## disable user agent verification to not break multiple image upload
 
     php_flag suhosin.session.cryptua off
 
 </IfModule>
 
 <IfModule mod_security.c>
 ###########################################
-# disable POST processing to not break multiple image upload
+## disable POST processing to not break multiple image upload
 
     SecFilterEngine Off
     SecFilterScanPOST Off
 </IfModule>
 
+<IfModule mod_headers.c>
+############################################
+## prevent clickjacking
+
+    Header set X-Frame-Options SAMEORIGIN
+</IfModule>
+
 <IfModule mod_deflate.c>
 
 ############################################
@@ -118,6 +124,12 @@
 
     RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]
 
+############################################
+## TRACE and TRACK HTTP methods disabled to prevent XSS attacks
+
+    RewriteCond %{REQUEST_METHOD} ^TRAC[EK]
+    RewriteRule .* - [L,R=405]
+
 ############################################
 ## always send 404 on missing files in these folders
 
@@ -161,6 +173,14 @@
     Order allow,deny
     Allow from all
 
+###########################################
+## Deny access to release notes to prevent disclosure of the installed Magento version
+
+    <Files RELEASE_NOTES.txt>
+        Order allow,deny
+        Deny from all
+    </Files>
+
 ############################################
 ## If running in cluster environment, uncomment this
 ## http://developer.yahoo.com/performance/rules.html#etags

CHANGELOG.md

@@ -1,3 +1,60 @@
+2.0.0.0-dev74
+=============
+* Pricing Improvements:
+  * Added price calculation component to library
+  * Eliminated price calculation from blocks and templates and implemented new calculation models for the following product types:
+     * Bundle
+     * Simple/Virtual
+     * Grouped
+     * Downloadable
+  * Resolved price calculation dependencies on the Tax and Weee modules
+* Themes update:
+  * Updated the look&feel of the Admin theme
+* Fixed bugs:
+  * Fixed an issue with the inability to save product with grouped price when Price Scope = Website
+  * Fixed an issue with fatal error on attempt to edit product from wishlist in stores with multiple store views
+  * Fixed an issue where it was impossible to add to a wishlist a product with custom quantity
+  * Fixed an issue where JS validation was skipped during CMS page creation
+  * Fixed an issue with the New Customer Address Attribute page and the New Customer Attribute page having the same title
+  * Fixed an issue where a form was submitted two times during CMS page creation
+  * Fixed an issue where a fatal error appeared when trying to edit product in a wishlist in stores with multiple store views
+  * Fixed an issue with inability to change page layout for categories
+  * Fixed an issue where the Quantity drop-down list box was disabled for bundle products
+  * Fixed an issue where inactive Related Products rules were applied
+  * Fixed a clickjacking vulnerability
+  * Fixed bugs and added improvements in the Blank theme
+  * Fixed an issue where the Flat Rate shipping method was not enabled by default
+  * Fixed an issue with incorrect order of products on the Add Product split button
+  * Fixed an issue with saving the tier price attribute value
+  * Fixed an issue with creating integration from config file
+  * Fixed an issue where the Cookie Restriction Mode = Yes configuration was not applied
+  * Fixed an issue where it was impossible to perform ajax actions from backend grids in Internet Explorer
+  * Fixed the improper usage of DIRECTORY_SEPARATOR
+  * Fixed an issue where it was impossible to add new address on customer's account page if default address had been already set
+  * Fixed an issue where setting memory_limit to -1 caused installation failure
+  * Fixed an issue where the configuration of Admin Session Lifetime was not applied correctly
+  * Fixed an issue where Scheduled Export was not performed if exporting to remote FTP server
+  * Fixed the wrong default value for PHP memory_limit
+  * Fixed an issue where frontend messages were not displayed when FPC was turned off
+  * Fixed the position of page action buttons on the Categories page in the backend
+  * Improved backend grids UI
+* Framework Improvements:
+  * Simplified Search related Data Objects
+  * Moved lib/Magento/* to lib/Magento/Framework/*
+    * Moved lib/Magento/App to lib/Magento/Framework/App
+* Refactored the following modules to use Customer service:
+  * PayPalRecurringPayment
+  * RecurringPayment
+  * Multishipping
+  * Paypal
+* Customer Service usage:
+  * Implemented Service Context Provider
+  * Restructured webapi.xml
+  * Renamed createAccount to createCustomer in CustomerAccountService
+  * Implemented Caching strategy for the Customer service
+* GitHub requests:
+  * [#488] (https://github.com/magento/magento2/issues/488) -- Converted several grids from Magento\Sales module to new layout XML config format
+
 2.0.0.0-dev73
 =============
 * Framework Improvements:

app/code/Magento/AdminNotification/Block/Grid/Renderer/Actions.php

@@ -54,28 +54,28 @@ public function __construct(
      */
     public function render(\Magento\Object $row)
     {
-        $readDetailsHtml = $row->getUrl() ? '<a target="_blank" href="' . $row->getUrl() . '">' . __(
+        $readDetailsHtml = $row->getUrl() ? '<a class="action-details" target="_blank" href="' . $row->getUrl() . '">' . __(
             'Read Details'
-        ) . '</a> | ' : '';
+        ) . '</a>' : '';
 
-        $markAsReadHtml = !$row->getIsRead() ? '<a href="' . $this->getUrl(
+        $markAsReadHtml = !$row->getIsRead() ? '<a class="action-mark" href="' . $this->getUrl(
             '*/*/markAsRead/',
             array('_current' => true, 'id' => $row->getId())
         ) . '">' . __(
             'Mark as Read'
-        ) . '</a> | ' : '';
+        ) . '</a>' : '';
 
         $encodedUrl = $this->_urlHelper->getEncodedUrl();
         return sprintf(
-            '%s%s<a href="%s" onClick="deleteConfirm(\'%s\', this.href); return false;">%s</a>',
+            '%s%s<a class="action-delete" href="%s" onClick="deleteConfirm(\'%s\', this.href); return false;">%s</a>',
             $readDetailsHtml,
             $markAsReadHtml,
             $this->getUrl(
                 '*/*/remove/',
                 array(
                     '_current' => true,
                     'id' => $row->getId(),
-                    \Magento\App\Action\Action::PARAM_NAME_URL_ENCODED => $encodedUrl
+                    \Magento\Framework\App\Action\Action::PARAM_NAME_URL_ENCODED => $encodedUrl
                 )
             ),
             __('Are you sure?'),

app/code/Magento/AdminNotification/Helper/Data.php

@@ -32,7 +32,7 @@
  * @package    Magento_AdminNotification
  * @author      Magento Core Team <[email protected]>
  */
-class Data extends \Magento\App\Helper\AbstractHelper
+class Data extends \Magento\Framework\App\Helper\AbstractHelper
 {
     const XML_PATH_POPUP_URL = 'system/adminnotification/popup_url';
 
@@ -65,7 +65,7 @@ class Data extends \Magento\App\Helper\AbstractHelper
     protected $_unreadNoticeCounts;
 
     /**
-     * @var \Magento\App\Config\ScopeConfigInterface
+     * @var \Magento\Framework\App\Config\ScopeConfigInterface
      */
     protected $_scopeConfig;
 
@@ -75,13 +75,13 @@ class Data extends \Magento\App\Helper\AbstractHelper
     protected $_inboxFactory;
 
     /**
-     * @param \Magento\App\Helper\Context $context
-     * @param \Magento\App\Config\ScopeConfigInterface $scopeConfig
+     * @param \Magento\Framework\App\Helper\Context $context
+     * @param \Magento\Framework\App\Config\ScopeConfigInterface $scopeConfig
      * @param \Magento\AdminNotification\Model\InboxFactory $inboxFactory
      */
     public function __construct(
-        \Magento\App\Helper\Context $context,
-        \Magento\App\Config\ScopeConfigInterface $scopeConfig,
+        \Magento\Framework\App\Helper\Context $context,
+        \Magento\Framework\App\Config\ScopeConfigInterface $scopeConfig,
         \Magento\AdminNotification\Model\InboxFactory $inboxFactory
     ) {
         parent::__construct($context);

app/code/Magento/AdminNotification/Model/Survey.php

@@ -54,15 +54,15 @@ class Survey
     protected $_flagFactory;
 
     /**
-     * @var \Magento\App\RequestInterface
+     * @var \Magento\Framework\App\RequestInterface
      */
     protected $_request;
 
     /**
      * @param \Magento\FlagFactory $flagFactory
-     * @param \Magento\App\RequestInterface $request
+     * @param \Magento\Framework\App\RequestInterface $request
      */
-    public function __construct(\Magento\FlagFactory $flagFactory, \Magento\App\RequestInterface $request)
+    public function __construct(\Magento\FlagFactory $flagFactory, \Magento\Framework\App\RequestInterface $request)
     {
         $this->_request = $request;
         $this->_flagFactory = $flagFactory;

app/code/Magento/AdminNotification/Model/System/Message/Baseurl.php

@@ -31,7 +31,7 @@ class Baseurl implements \Magento\AdminNotification\Model\System\MessageInterfac
     protected $_urlBuilder;
 
     /**
-     * @var \Magento\App\Config\ScopeConfigInterface
+     * @var \Magento\Framework\App\Config\ScopeConfigInterface
      */
     protected $_config;
 
@@ -41,21 +41,21 @@ class Baseurl implements \Magento\AdminNotification\Model\System\MessageInterfac
     protected $_storeManager;
 
     /**
-     * @var \Magento\App\Config\ValueFactory
+     * @var \Magento\Framework\App\Config\ValueFactory
      */
     protected $_configValueFactory;
 
     /**
-     * @param \Magento\App\Config\ScopeConfigInterface $config
+     * @param \Magento\Framework\App\Config\ScopeConfigInterface $config
      * @param \Magento\Store\Model\StoreManagerInterface $storeManager
      * @param \Magento\UrlInterface $urlBuilder
-     * @param \Magento\App\Config\ValueFactory $configValueFactory
+     * @param \Magento\Framework\App\Config\ValueFactory $configValueFactory
      */
     public function __construct(
-        \Magento\App\Config\ScopeConfigInterface $config,
+        \Magento\Framework\App\Config\ScopeConfigInterface $config,
         \Magento\Store\Model\StoreManagerInterface $storeManager,
         \Magento\UrlInterface $urlBuilder,
-        \Magento\App\Config\ValueFactory $configValueFactory
+        \Magento\Framework\App\Config\ValueFactory $configValueFactory
     ) {
         $this->_urlBuilder = $urlBuilder;
         $this->_config = $config;
@@ -84,7 +84,7 @@ protected function _getConfigUrl()
             $dataCollection = $this->_configValueFactory->create()->getCollection();
             $dataCollection->addValueFilter(\Magento\Store\Model\Store::BASE_URL_PLACEHOLDER);
 
-            /** @var $data \Magento\App\Config\ValueInterface */
+            /** @var $data \Magento\Framework\App\Config\ValueInterface */
             foreach ($dataCollection as $data) {
                 if ($data->getScope() == 'stores') {
                     $code = $this->_storeManager->getStore($data->getScopeId())->getCode();

app/code/Magento/AdminNotification/Model/System/Message/CacheOutdated.php

@@ -36,19 +36,19 @@ class CacheOutdated implements \Magento\AdminNotification\Model\System\MessageIn
     protected $_authorization;
 
     /**
-     * @var \Magento\App\Cache\TypeListInterface
+     * @var \Magento\Framework\App\Cache\TypeListInterface
      */
     protected $_cacheTypeList;
 
     /**
      * @param \Magento\AuthorizationInterface $authorization
      * @param \Magento\UrlInterface $urlBuilder
-     * @param \Magento\App\Cache\TypeListInterface $cacheTypeList
+     * @param \Magento\Framework\App\Cache\TypeListInterface $cacheTypeList
      */
     public function __construct(
         \Magento\AuthorizationInterface $authorization,
         \Magento\UrlInterface $urlBuilder,
-        \Magento\App\Cache\TypeListInterface $cacheTypeList
+        \Magento\Framework\App\Cache\TypeListInterface $cacheTypeList
     ) {
         $this->_authorization = $authorization;
         $this->_urlBuilder = $urlBuilder;

app/code/Magento/AdminNotification/Model/System/Message/Security.php

@@ -44,7 +44,7 @@ class Security implements \Magento\AdminNotification\Model\System\MessageInterfa
     private $_verificationTimeOut = 2;
 
     /**
-     * @var \Magento\App\CacheInterface
+     * @var \Magento\Framework\App\CacheInterface
      */
     protected $_cache;
 
@@ -54,7 +54,7 @@ class Security implements \Magento\AdminNotification\Model\System\MessageInterfa
     protected $_backendConfig;
 
     /**
-     * @var \Magento\App\Config\ScopeConfigInterface
+     * @var \Magento\Framework\App\Config\ScopeConfigInterface
      */
     protected $_config;
 
@@ -64,15 +64,15 @@ class Security implements \Magento\AdminNotification\Model\System\MessageInterfa
     protected $_curlFactory;
 
     /**
-     * @param \Magento\App\CacheInterface $cache
+     * @param \Magento\Framework\App\CacheInterface $cache
      * @param \Magento\Backend\App\ConfigInterface $backendConfig
-     * @param \Magento\App\Config\ScopeConfigInterface $config
+     * @param \Magento\Framework\App\Config\ScopeConfigInterface $config
      * @param \Magento\HTTP\Adapter\CurlFactory $curlFactory
      */
     public function __construct(
-        \Magento\App\CacheInterface $cache,
+        \Magento\Framework\App\CacheInterface $cache,
         \Magento\Backend\App\ConfigInterface $backendConfig,
-        \Magento\App\Config\ScopeConfigInterface $config,
+        \Magento\Framework\App\Config\ScopeConfigInterface $config,
         \Magento\HTTP\Adapter\CurlFactory $curlFactory
     ) {
         $this->_cache = $cache;

app/code/Magento/AdminNotification/etc/adminhtml/routes.xml

@@ -23,7 +23,7 @@
  * @license     http://opensource.org/licenses/afl-3.0.php  Academic Free License (AFL 3.0)
  */
 -->
-<config xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="../../../../../../lib/Magento/App/etc/routes.xsd">
+<config xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="../../../../../../lib/Magento/Framework/App/etc/routes.xsd">
     <router id="admin">
         <route id="adminhtml">
             <module name="Magento_AdminNotification" before="Magento_Adminhtml" />