← All changes | classes/paymentZeus.class.php +55 -7 2.11.31 → 2.12.4 View file →

		@@ -14,8 +14,15 @@
14	14	*/
15	15	class ZEUS_SETTLEMENT {
16	16
17	17	/**
	18	+ * 決済結果通知（zeus_conv / zeus_bank）の送信元IP許可リスト
	19	+ *
	20	+ * @var array
	21	+ */
	22	+ const ACTING_NOTICE_IPADDRS = array( '210.164.6.67', '202.221.139.50' );
	23	+
	24	+ /**
18	25	* Instance of this class.
19	26	*
20	27	* @var object
21	28	*/
		@@ -1454,9 +1461,9 @@
1454	1461	$usces->action_status = 'success';
1455	1462	$usces->action_message = __( 'Options are updated.', 'usces' );
1456	1463	if ( 'on' === $options['acting_settings']['zeus']['card_activate'] || 'on' === $options['acting_settings']['zeus']['bank_activate'] || 'on' === $options['acting_settings']['zeus']['conv_activate'] || 'on' === $options['acting_settings']['zeus']['bnpl_activate'] ) {
1457	1464	$options['acting_settings']['zeus']['activate'] = 'on';
1458		- $options['acting_settings']['zeus']['ipaddrs'] = array( '210.164.6.67', '202.221.139.50' );
	1465	+ $options['acting_settings']['zeus']['ipaddrs'] = self::ACTING_NOTICE_IPADDRS;
1459	1466	$toactive = array();
1460	1467	if ( 'on' === $options['acting_settings']['zeus']['card_activate'] ) {
1461	1468	$options['acting_settings']['zeus']['card_url'] = 'https://linkpt.cardservice.co.jp/cgi-bin/secure.cgi';
1462	1469	$options['acting_settings']['zeus']['card_secureurl'] = 'https://linkpt.cardservice.co.jp/cgi-bin/secure/api.cgi';
		@@ -1984,8 +1991,34 @@
1984	1991	}
1985	1992	}
1986	1993
1987	1994	/**
	1995	+ * 決済結果通知（zeus_conv / zeus_bank）の送信元IPを検証する
	1996	+ *
	1997	+ * 許可IP以外からのリクエストはエラーログを残して処理を終了する
	1998	+ * 入金状態を変更するサーバー間通知でのみ呼び出すこと
	1999	+ * ブラウザ戻りを伴う zeus_card では呼び出さない
	2000	+ *
	2001	+ * @return void
	2002	+ */
	2003	+ private function acting_notice_ip_guard() {
	2004	+ $remote_addr = ( isset( $_SERVER['REMOTE_ADDR'] ) ) ? wp_unslash( $_SERVER['REMOTE_ADDR'] ) : '';
	2005	+ if ( usces_acting_notice_ip_allowed( $remote_addr, self::ACTING_NOTICE_IPADDRS ) ) {
	2006	+ return;
	2007	+ }
	2008	+ $log = array(
	2009	+ 'acting' => ( isset( $_REQUEST['acting'] ) ) ? wp_unslash( $_REQUEST['acting'] ) : 'zeus',
	2010	+ 'key' => ( isset( $_REQUEST['sendpoint'] ) ) ? wp_unslash( $_REQUEST['sendpoint'] ) : '',
	2011	+ 'result' => 'IP ADDRESS NOT ALLOWED: ' . $remote_addr,
	2012	+ 'data' => wp_unslash( $_REQUEST ),
	2013	+ );
	2014	+ usces_save_order_acting_error( $log );
	2015	+ usces_log( 'zeus notice denied ip : ' . $remote_addr, 'acting_transaction.log' );
	2016	+ header( 'HTTP/1.0 200 OK' );
	2017	+ die( 'error0' );
	2018	+ }
	2019	+
	2020	+ /**
1988	2021	* 結果通知処理
1989	2022	* usces_after_cart_instant
1990	2023	*/
1991	2024	public function acting_transaction() {
		@@ -2084,8 +2117,9 @@
2084	2117	}
2085	2118
2086	2119	/* zeus_bank */
2087	2120	} elseif ( isset( $_REQUEST['acting'] ) && 'zeus_bank' === $_REQUEST['acting'] && isset( $_REQUEST['order_no'] ) && isset( $_REQUEST['tracking_no'] ) ) {
	2121	+ $this->acting_notice_ip_guard();
2088	2122	foreach ( $_REQUEST as $key => $value ) {
2089	2123	if ( 'uscesid' === $key ) {
2090	2124	continue;
2091	2125	}
		@@ -2166,8 +2200,9 @@
2166	2200	die( 'zeus' );
2167	2201
2168	2202	/* zeus_conv */
2169	2203	} elseif ( isset( $_REQUEST['acting'] ) && 'zeus_conv' === $_REQUEST['acting'] && isset( $_REQUEST['status'] ) && isset( $_REQUEST['sendpoint'] ) && isset( $_REQUEST['clientip'] ) ) {
	2204	+ $this->acting_notice_ip_guard();
2170	2205	foreach ( $_REQUEST as $key => $value ) {
2171	2206	if ( 'uscesid' === $key ) {
2172	2207	continue;
2173	2208	}
		@@ -5649,9 +5684,9 @@
5649	5684	params.append("card_name",document.getElementById("card_name").value);
5650	5685	params.append("sendid",document.getElementById("sendid").value);
5651	5686	params.append("sendpoint",document.getElementById("sendpoint").value);
5652	5687	params.append("_nonce","<?php echo esc_attr( wp_create_nonce( 'acting_zeus_card' ) ); ?>");
5653		- return fetch( uscesL10n.ajaxurl+"?uscesid="+uscesL10n.uscesid, {
	5688	+ return fetch( uscesL10n.ajaxurl, {
5654	5689	method:'POST',
5655	5690	cache:'no-cache',
5656	5691	body:params
5657	5692	}).then( function(res) {
		@@ -6781,9 +6816,9 @@
6781	6816	$optstr = '';
6782	6817	foreach ( $options as $key => $value ) {
6783	6818	if ( ! empty( $key ) ) {
6784	6819	$key = urldecode( $key );
6785		- $value = maybe_unserialize( $value );
	6820	+ $value = wel_safe_maybe_unserialize( $value );
6786	6821	if ( is_array( $value ) ) {
6787	6822	$c = '';
6788	6823	$optstr .= '( ' . $key . ' : ';
6789	6824	foreach ( $value as $v ) {
		@@ -6863,9 +6898,9 @@
6863	6898	$optstr = '';
6864	6899	foreach ( $options as $key => $value ) {
6865	6900	if ( ! empty( $key ) ) {
6866	6901	$key = urldecode( $key );
6867		- $value = maybe_unserialize( $value );
	6902	+ $value = wel_safe_maybe_unserialize( $value );
6868	6903	if ( is_array( $value ) ) {
6869	6904	$c = '';
6870	6905	$optstr .= '( ' . $key . ' : ';
6871	6906	foreach ( $value as $v ) {
		@@ -7072,8 +7107,22 @@
7072	7107	global $usces;
7073	7108
7074	7109	check_ajax_referer( 'acting_zeus_card', '_nonce' );
7075	7110
	7111	+ // A6 (Layer 3 / uscesid removal): この nopriv admin-ajax は usces_close_session()（admin_init）
	7112	+ // の後に走るため session_status() は PHP_SESSION_NONE。旧実装は JS が付けた `?uscesid=` を
	7113	+ // usces_session_start() が復号して買い物客セッションへ切替えていたが、uscesid を廃し、
	7114	+ // 同一オリジンの USCES_KEY cookie から買い物客セッションを再開する（A2 と同一方式）.
	7115	+ if ( PHP_SESSION_NONE === session_status() ) {
	7116	+ $usces_options = get_option( 'usces' );
	7117	+ $sess_name = defined( 'USCES_KEY' ) ? USCES_KEY : ( isset( $usces_options['usces_key'] ) ? $usces_options['usces_key'] : '' );
	7118	+ if ( '' !== $sess_name && ! empty( $_COOKIE[ $sess_name ] ) ) {
	7119	+ $sess_id = preg_replace( '/[^A-Za-z0-9,\-]/', '', wp_unslash( $_COOKIE[ $sess_name ] ) );
	7120	+ session_id( $sess_id );
	7121	+ @session_start(); // phpcs:ignore
	7122	+ }
	7123	+ }
	7124	+
7076	7125	$entry = $usces->cart->get_entry();
7077	7126	if ( empty( $entry ) ) {
7078	7127	$result_data = array(
7079	7128	'action' => 'session',
		@@ -7096,9 +7145,10 @@
7096	7145	if ( $this->is_activate_card( 'api' ) && 1 === (int) $acting_opts['3dsecur'] ) {
7097	7146	$sendid = ( 'on' === $acting_opts['quickcharge'] && isset( $_POST['sendid'] ) ) ? filter_input( INPUT_POST, 'sendid' ) : '';
7098	7147	$sendpoint = filter_input( INPUT_POST, 'sendpoint', FILTER_DEFAULT, array( 'options' => array( 'default' => '' ) ) );
7099	7148	$_nonce = filter_input( INPUT_POST, '_nonce', FILTER_DEFAULT, array( 'options' => array( 'default' => wp_create_nonce( 'acting_zeus_card' ) ) ) );
7100		- $uscesid = filter_input( INPUT_GET, 'uscesid', FILTER_DEFAULT, array( 'options' => array( 'default' => $usces->get_uscesid( false ) ) ) );
	7149	+ // A6: uscesid ブリッジ廃止。3DS 戻り（TermUrl）のセッションは sendpoint（取引キー）で
	7150	+ // acting_processing() が usces_restore_order_acting_data() 復元するため uscesid は不要.
7101	7151
7102	7152	$data = array();
7103	7153	$data['authentication']['clientip'] = $acting_opts['clientip'];
7104	7154	$data['authentication']['key'] = $acting_opts['authkey'];
		@@ -7158,9 +7208,8 @@
7158	7208	$term_data = array(
7159	7209	'purchase' => '1',
7160	7210	'sendpoint' => $sendpoint,
7161	7211	'_nonce' => $_nonce,
7162		- 'uscesid' => $uscesid,
7163	7212	);
7164	7213	$term_url = add_query_arg( $term_data, USCES_CART_URL );
7165	7214	$result_data = array(
7166	7215	'action' => 'EnrolReq',
		@@ -7327,9 +7376,8 @@
7327	7376	'acting' => 'zeus_card',
7328	7377	'acting_return' => 1,
7329	7378	'result' => 1,
7330	7379	'_nonce' => $_nonce,
7331		- 'uscesid' => $usces->get_uscesid( false ),
7332	7380	),
7333	7381	USCES_CART_URL
7334	7382	)
7335	7383	);