| @@ -16,8 +16,15 @@ | ||
| 16 | 16 | * ペイメントフォー |
| 17 | 17 | */ |
| 18 | 18 | class DIGITALCHECK_SETTLEMENT { |
| 19 | 19 | /** |
| 20 | + * 決済結果通知の送信元IP許可リスト | |
| 21 | + * | |
| 22 | + * @var array | |
| 23 | + */ | |
| 24 | + const ACTING_NOTICE_IPADDRS = array( '27.110.52.0/27' ); | |
| 25 | + | |
| 26 | + /** | |
| 20 | 27 | * Instance of this class. |
| 21 | 28 | * |
| 22 | 29 | * @var object |
| 23 | 30 | */ |
| @@ -693,9 +700,9 @@ | ||
| 693 | 700 | if ( 'acting_digitalcheck_conv' != $payment['settlement'] ) { |
| 694 | 701 | return $msg_payment; |
| 695 | 702 | } |
| 696 | 703 | |
| 697 | - $args = maybe_unserialize( $usces->get_order_meta_value( $payment['settlement'], $order_id ) ); | |
| 704 | + $args = wel_safe_maybe_unserialize( $usces->get_order_meta_value( $payment['settlement'], $order_id ) ); | |
| 698 | 705 | if ( isset( $args['CVS'] ) ) { |
| 699 | 706 | $msg_payment .= '支払先 : ' . $this->get_conv_name( $args['CVS'] ) . "\r\n"; |
| 700 | 707 | } |
| 701 | 708 | if ( isset( $args['SHNO'] ) ) { |
| @@ -725,9 +732,9 @@ | ||
| 725 | 732 | return $msg_payment; |
| 726 | 733 | } |
| 727 | 734 | |
| 728 | 735 | if ( 'orderConfirmMail' == $_POST['mode'] ) { |
| 729 | - $args = maybe_unserialize( $usces->get_order_meta_value( $payment['settlement'], $order_id ) ); | |
| 736 | + $args = wel_safe_maybe_unserialize( $usces->get_order_meta_value( $payment['settlement'], $order_id ) ); | |
| 730 | 737 | if ( isset( $args['CVS'] ) ) { |
| 731 | 738 | $msg_payment .= '支払先 : ' . $this->get_conv_name( $args['CVS'] ) . "\r\n"; |
| 732 | 739 | } |
| 733 | 740 | if ( isset( $args['SHNO'] ) ) { |
| @@ -763,8 +770,35 @@ | ||
| 763 | 770 | default: |
| 764 | 771 | $name = $code; |
| 765 | 772 | } |
| 766 | 773 | return $name; |
| 774 | + } | |
| 775 | + | |
| 776 | + /** | |
| 777 | + * 決済結果通知の送信元IPを検証する | |
| 778 | + * | |
| 779 | + * 許可IP以外からのリクエストはエラーログを残して処理を終了する | |
| 780 | + * 入金状態を変更するサーバー間通知でのみ呼び出すこと | |
| 781 | + * ブラウザ戻りを伴う結果戻りでは呼び出さない | |
| 782 | + * | |
| 783 | + * @param array $data Notification data. | |
| 784 | + * @return void | |
| 785 | + */ | |
| 786 | + public function acting_notice_ip_guard( $data ) { | |
| 787 | + $remote_addr = ( isset( $_SERVER['REMOTE_ADDR'] ) ) ? wp_unslash( $_SERVER['REMOTE_ADDR'] ) : ''; | |
| 788 | + if ( usces_acting_notice_ip_allowed( $remote_addr, self::ACTING_NOTICE_IPADDRS ) ) { | |
| 789 | + return; | |
| 790 | + } | |
| 791 | + $log = array( | |
| 792 | + 'acting' => 'digitalcheck_conv', | |
| 793 | + 'key' => ( isset( $data['SID'] ) ) ? $data['SID'] : '', | |
| 794 | + 'result' => 'IP ADDRESS NOT ALLOWED: ' . $remote_addr, | |
| 795 | + 'data' => $data, | |
| 796 | + ); | |
| 797 | + usces_save_order_acting_error( $log ); | |
| 798 | + usces_log( 'digitalcheck notice denied ip : ' . $remote_addr, 'acting_transaction.log' ); | |
| 799 | + header( 'Content-Type: text/plain; charset=Shift_JIS' ); | |
| 800 | + die( "9\r\n" ); | |
| 767 | 801 | } |
| 768 | 802 | |
| 769 | 803 | /** |
| 770 | 804 | * 決済オプション取得 |
