Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Sanitize, Escape, and Validate POST Calls, PFW-151 #1148

Merged
merged 1 commit into from
Jun 20, 2018
Merged

Sanitize, Escape, and Validate POST Calls, PFW-151 #1148

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 6 additions & 6 deletions angelleye-includes/angelleye-utility.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -393,7 +393,7 @@ public function pfw_do_capture($order, $transaction_id = null, $capture_total =
$this->ec_add_log('DoCapture API call');
$order_id = version_compare(WC_VERSION, '3.0', '<') ? $order->id : $order->get_id();
if( !empty($_POST['_regular_price'])) {
$AMT = self::number_format($_POST['_regular_price']);
$AMT = self::number_format(wc_clean( wp_unslash( $_POST['_regular_price'] ) ) );
} elseif ($capture_total == null) {
$AMT = $this->get_amount_by_transaction_id($transaction_id);
} else {
Expand Down Expand Up @@ -494,7 +494,7 @@ public function call_do_void($order) {
$this->ec_add_log('DoVoid API call');
$order_id = version_compare(WC_VERSION, '3.0', '<') ? $order->id : $order->get_id();
if (isset($_POST['angelleye_paypal_dovoid_transaction_dropdown']) && !empty($_POST['angelleye_paypal_dovoid_transaction_dropdown'])) {
$transaction_id = $_POST['angelleye_paypal_dovoid_transaction_dropdown'];
$transaction_id = wc_clean($_POST['angelleye_paypal_dovoid_transaction_dropdown']);
} else {
$old_wc = version_compare(WC_VERSION, '3.0', '<');
$transaction_id = $old_wc ? get_post_meta($order_id, '_first_transaction_id', true) : get_post_meta($order->get_id(), '_first_transaction_id', true);
Expand Down Expand Up @@ -561,7 +561,7 @@ public function call_do_reauthorization($order) {
$this->ec_add_log('DoReauthorization API call');
$order_id = version_compare(WC_VERSION, '3.0', '<') ? $order->id : $order->get_id();
if (isset($_POST['angelleye_paypal_doreauthorization_transaction_dropdown']) && !empty($_POST['angelleye_paypal_doreauthorization_transaction_dropdown'])) {
$transaction_id = $_POST['angelleye_paypal_doreauthorization_transaction_dropdown'];
$transaction_id = wc_clean($_POST['angelleye_paypal_doreauthorization_transaction_dropdown']);
} else {
$old_wc = version_compare(WC_VERSION, '3.0', '<');
$transaction_id = $old_wc ? get_post_meta($order_id, '_first_transaction_id', true) : get_post_meta($order->get_id(), '_first_transaction_id', true);
Expand Down Expand Up @@ -654,7 +654,7 @@ public function call_do_authorization($order) {
if (isset($transaction_id) && !empty($transaction_id)) {
$DRFields = array(
'TRANSACTIONID' => $transaction_id, // Required. The value of a previously authorized transaction ID returned by PayPal.
'AMT' => self::number_format($_POST['_regular_price']), // Required. Must have two decimal places. Decimal separator must be a period (.) and optional thousands separator must be a comma (,)
'AMT' => self::number_format(wc_clean( wp_unslash( $_POST['_regular_price']))), // Required. Must have two decimal places. Decimal separator must be a period (.) and optional thousands separator must be a comma (,)
'CURRENCYCODE' => version_compare(WC_VERSION, '3.0', '<') ? $order->get_order_currency() : $order->get_currency()
);
$PayPalRequestData = array('DAFields' => $DRFields);
Expand Down Expand Up @@ -1705,7 +1705,7 @@ public function call_paypal_pro_payflow_docapture($order, $transaction_id, $capt
$order_id = version_compare(WC_VERSION, '3.0', '<') ? $order->id : $order->get_id();

if( !empty($_POST['_regular_price'])) {
$AMT = self::number_format($_POST['_regular_price']);
$AMT = self::number_format(wc_clean( wp_unslash( $_POST['_regular_price'])));
} elseif ($capture_total == null) {
$AMT = $this->get_amount_by_transaction_id($transaction_id);
} else {
Expand Down Expand Up @@ -1757,7 +1757,7 @@ public function call_paypal_pro_payflow_do_void($order) {
$this->ec_add_log('DoVoid API call');
$order_id = version_compare(WC_VERSION, '3.0', '<') ? $order->id : $order->get_id();
if (isset($_POST['angelleye_paypal_dovoid_transaction_dropdown']) && !empty($_POST['angelleye_paypal_dovoid_transaction_dropdown'])) {
$transaction_id = $_POST['angelleye_paypal_dovoid_transaction_dropdown'];
$transaction_id = wc_clean($_POST['angelleye_paypal_dovoid_transaction_dropdown']);
} else {
$old_wc = version_compare(WC_VERSION, '3.0', '<');
$transaction_id = $old_wc ? get_post_meta($order_id, '_first_transaction_id', true) : get_post_meta($order->get_id(), '_first_transaction_id', true);
Expand Down
16 changes: 8 additions & 8 deletions angelleye-includes/express-checkout/class-wc-gateway-paypal-express-helper-angelleye.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -230,7 +230,7 @@ public function angelleye_paypal_express_checkout_redirect_to_paypal($data, $err
}
if (empty($_POST['woocommerce_checkout_update_totals']) && 0 === $notice_count) {
try {
WC()->session->set('post_data', $_POST);
WC()->session->set('post_data', wp_slash($_POST));
if (isset($_POST['payment_method']) && 'paypal_express' === $_POST['payment_method'] && $this->function_helper->ec_notice_count('error') == 0) {
$this->function_helper->ec_redirect_after_checkout();
}
Expand Down Expand Up @@ -308,7 +308,7 @@ public function ec_set_checkout_post_data() {
}
}
$post_data = WC()->session->get('post_data');
$_POST['order_comments'] = isset($post_data['order_comments']) ? $post_data['order_comments'] : '';
$_POST['order_comments'] = isset($post_data['order_comments']) ? wc_clean($post_data['order_comments']) : '';
if (!empty($post_data)) {
foreach ($post_data as $key => $value) {
if (!empty($value)) {
Expand All @@ -319,11 +319,11 @@ public function ec_set_checkout_post_data() {
if ($this->angelleye_is_need_to_set_billing_address() == false) {
$shipping_details = $this->ec_get_session_data('shipping_details');
if (!empty($shipping_details)) {
$_POST['billing_first_name'] = $shipping_details['first_name'];
$_POST['billing_last_name'] = $shipping_details['last_name'];
$_POST['billing_first_name'] = !empty($shipping_details['first_name']) ? wc_clean($shipping_details['first_name']) : '';
$_POST['billing_last_name'] = !empty($shipping_details['last_name']) ? wc_clean($shipping_details['last_name']) : '';
$_POST['billing_company'] = !empty($shipping_details['company']) ? wc_clean(stripslashes($shipping_details['company'])) : '';
$_POST['billing_email'] = $shipping_details['email'];
$_POST['billing_phone'] = $shipping_details['phone'];
$_POST['billing_email'] = !empty($shipping_details['email']) ? wc_clean($shipping_details['email']) : '';
$_POST['billing_phone'] = !empty($shipping_details['phone']) ? wc_clean($shipping_details['phone']) : '';
}
}
}
Expand Down Expand Up @@ -836,7 +836,7 @@ public function angelleye_ajax_generate_cart() {
wp_die(__('Cheatin&#8217; huh?', 'paypal-for-woocommerce'));
}
WC()->shipping->reset_shipping();
$product_id = $_POST['product_id'];
$product_id = absint( wp_unslash( $_POST['product_id']));
$url = esc_url_raw(add_query_arg('pp_action', 'set_express_checkout', add_query_arg('wc-api', 'WC_Gateway_PayPal_Express_AngellEYE', home_url('/'))));
if (!empty($_POST['wc-paypal_express-new-payment-method']) && $_POST['wc-paypal_express-new-payment-method'] == 'true') {
$url = add_query_arg('ec_save_to_account', 'true', $url);
Expand All @@ -854,7 +854,7 @@ public function angelleye_ajax_generate_cart() {
if ($product->is_type('variable')) {
$attributes = array_map('wc_clean', json_decode(stripslashes($_POST['attributes']), true));
if(!empty($_POST['variation_id'])) {
$variation_id = $_POST['variation_id'];
$variation_id = absint( wp_unslash( $_POST['variation_id'] ) );
} else {
if (version_compare(WC_VERSION, '3.0', '<')) {
$variation_id = $product->get_matching_variation($attributes);
Expand Down
20 changes: 10 additions & 10 deletions angelleye-includes/express-checkout/class-wc-gateway-paypal-express-request-angelleye.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -152,7 +152,7 @@ public function angelleye_redirect_action($url) {
$query_str = parse_url($url, PHP_URL_QUERY);
parse_str($query_str, $query_params);
wp_send_json(array(
'token' => $query_params['token']
'token' => wc_clean($query_params['token'])
));
exit();
}
Expand Down Expand Up @@ -241,7 +241,7 @@ public function angelleye_get_express_checkout_details() {
if ($this->angelleye_ec_force_to_display_checkout_page()) {
if ($this->angelleye_ec_force_to_display_checkout_page()) {
if (!empty($_GET['pay_for_order']) && $_GET['pay_for_order'] == true && !empty($_GET['key'])) {
WC()->session->set('order_awaiting_payment', $_GET['order_id']);
WC()->session->set('order_awaiting_payment', absint( wp_unslash( $_GET['order_id'] ) ) ) ;
} else {
$this->angelleye_wp_safe_redirect(wc_get_checkout_url(), 'get_express_checkout_details');
}
Expand Down Expand Up @@ -592,7 +592,7 @@ public function angelleye_set_express_checkout_request() {
'utm_nooverride' => 1
), WC()->api_request_url('WC_Gateway_PayPal_Express_AngellEYE')));
}
WC()->session->set('order_awaiting_payment', $order_id);
WC()->session->set('order_awaiting_payment', absint( wp_unslash( $order_id) ) );
} else {
$this->cart_param = $this->gateway_calculation->cart_calculation();
$order_total = WC()->cart->total;
Expand Down Expand Up @@ -703,13 +703,13 @@ public function angelleye_set_express_checkout_request() {
$Payment['shiptoname'] = wc_clean(stripslashes($shiptoname));
}

$Payment['shiptostreet'] = !empty($post_data['billing_address_1']) ? $post_data['billing_address_1'] : '';
$Payment['shiptostreet2'] = !empty($post_data['billing_address_2']) ? $post_data['billing_address_2'] : '';
$Payment['shiptostreet'] = !empty($post_data['billing_address_1']) ? wc_clean($post_data['billing_address_1']) : '';
$Payment['shiptostreet2'] = !empty($post_data['billing_address_2']) ? wc_clean($post_data['billing_address_2']) : '';
$Payment['shiptocity'] = !empty($post_data['billing_city']) ? wc_clean(stripslashes($post_data['billing_city'])) : '';
$Payment['shiptostate'] = !empty($post_data['billing_state']) ? $post_data['billing_state'] : '';
$Payment['shiptozip'] = !empty($post_data['billing_postcode']) ? $post_data['billing_postcode'] : '';
$Payment['shiptocountrycode'] = !empty($post_data['billing_country']) ? $post_data['billing_country'] : '';
$Payment['shiptophonenum'] = !empty($post_data['billing_phone']) ? $post_data['billing_phone'] : '';
$Payment['shiptostate'] = !empty($post_data['billing_state']) ? wc_clean($post_data['billing_state']) : '';
$Payment['shiptozip'] = !empty($post_data['billing_postcode']) ? wc_clean($post_data['billing_postcode']) : '';
$Payment['shiptocountrycode'] = !empty($post_data['billing_country']) ? wc_clean($post_data['billing_country']) : '';
$Payment['shiptophonenum'] = !empty($post_data['billing_phone']) ? wc_clean($post_data['billing_phone']) : '';
}
} elseif (is_user_logged_in()) {
if (version_compare(WC_VERSION, '3.0', '<')) {
Expand Down Expand Up @@ -1272,7 +1272,7 @@ public function DoReferenceTransaction($order_id) {
$PayPalRequestData = array();
$referenceid = get_post_meta($order_id, '_payment_tokens_id', true);
if (!empty($_POST['wc-paypal_express-payment-token'])) {
$token_id = $_POST['wc-paypal_express-payment-token'];
$token_id = wc_clean($_POST['wc-paypal_express-payment-token']);
$token = WC_Payment_Tokens::get($token_id);
$referenceid = $token->get_token();
}
Expand Down
125 changes: 0 additions & 125 deletions classes/lib/angelleye/paypal-php-library/includes/paypal.nvp.callback.php
View file
Open in desktop

This file was deleted.

2 changes: 1 addition & 1 deletion classes/wc-gateway-braintree-angelleye.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1244,7 +1244,7 @@ public function payment_scripts() {
}

public static function get_posted_variable($variable, $default = '') {
return ( isset($_POST[$variable]) ? $_POST[$variable] : $default );
return ( isset($_POST[$variable]) ? wc_clean($_POST[$variable]) : $default );
}

function get_transaction_url($order) {
Expand Down
10 changes: 0 additions & 10 deletions classes/wc-gateway-calculations-angelleye.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -436,14 +436,4 @@ public function angelleye_disable_line_item() {
}

}










endif;
Loading