← All changes | functions/settlement_func.php +72 -30 2.11.31 → 2.12.4 View file →

		@@ -518,9 +518,9 @@
518	518	$log_table_name = $wpdb->prefix . 'usces_log';
519	519	$query = $wpdb->prepare( "SELECT * FROM {$log_table_name} WHERE `log_type` = %s AND `log_key` = %s", 'acting_data', $key );
520	520	$data = $wpdb->get_row( $query, ARRAY_A );
521	521	if ( $data ) {
522		- $order_data = unserialize( $data['log'] );
	522	+ $order_data = wel_safe_unserialize( $data['log'] );
523	523	$order_data['key'] = $data['log_key'];
524	524	$order_data['datetime'] = $data['datetime'];
525	525	} else {
526	526	$order_data = array(
		@@ -576,8 +576,27 @@
576	576	return $res;
577	577	}
578	578
579	579	/**
	580	+ * Escape a settlement log field for HTML output.
	581	+ *
	582	+ * Log fields come from unauthenticated payment-gateway callbacks, so a field
	583	+ * may arrive as an array (e.g. `?rand[]=x`) or as an object. Flatten anything
	584	+ * non-scalar before escaping, because esc_html() cannot take an array.
	585	+ *
	586	+ * Use this for text nodes only. Attribute values need esc_attr().
	587	+ *
	588	+ * @param mixed $value Raw log field.
	589	+ * @return string Escaped, HTML-safe string.
	590	+ */
	591	+function wel_esc_settlement_log( $value ) {
	592	+ if ( null === $value || is_scalar( $value ) ) {
	593	+ return esc_html( (string) $value );
	594	+ }
	595	+ return esc_html( wp_json_encode( $value ) );
	596	+}
	597	+
	598	+/**
580	599	* 決済直前ログ一覧
581	600	*
582	601	* @param string $log_key Log key.
583	602	* @return void
		@@ -595,9 +614,9 @@
595	614	$log_data = $wpdb->get_results( $query, ARRAY_A );
596	615	if ( $log_data ) {
597	616	$html = '<table class="list"><tr><th></th><th></th><th>' . __( 'Register date', 'usces' ) . '</th><th>' . __( 'Link key', 'usces' ) . '</th><th>' . __( 'Name', 'usces' ) . '</th><th>' . __( 'Type of payment', 'usces' ) . '</th><th>IP</th></tr>';
598	617	foreach ( (array) $log_data as $data ) {
599		- $log = unserialize( $data['log'] );
	618	+ $log = wel_safe_unserialize( $data['log'] );
600	619	$name = esc_html( $log['usces_entry']['customer']['name1'] ) . esc_html( $log['usces_entry']['customer']['name2'] );
601	620	$payment_name = esc_html( $log['usces_entry']['order']['payment_name'] );
602	621	$payments = usces_get_payments_by_name( $payment_name );
603	622	$settlement = ( isset( $payments['settlement'] ) ) ? $payments['settlement'] : '';
		@@ -604,15 +623,15 @@
604	623	$payment_structure = ( isset( $usces->payment_structure[ $settlement ] ) ) ? '[' . $usces->payment_structure[ $settlement ] . ']' : '';
605	624	$class = ( ! empty( $log['revival'] ) ) ? ' class="revival"' : '';
606	625	$ip = ( ! empty( $log['remote_addr'] ) ) ? $log['remote_addr'] : '';
607	626	$html .= '<tr' . $class . '>
608		- <td class="check"><input type="checkbox" class="log-check" value="' . $data['log_key'] . '"></td>
609		- <td class="detail"><input type="button" class="log-detail button" id="' . $data['log_key'] . '" value="' . __( 'Detail', 'usces' ) . '"></td>
610		- <td class="datetime">' . $data['datetime'] . '</td>
611		- <td class="key">' . $data['log_key'] . '</td>
	627	+ <td class="check"><input type="checkbox" class="log-check" value="' . esc_attr( $data['log_key'] ) . '"></td>
	628	+ <td class="detail"><input type="button" class="log-detail button" id="' . esc_attr( $data['log_key'] ) . '" value="' . esc_attr__( 'Detail', 'usces' ) . '"></td>
	629	+ <td class="datetime">' . esc_html( $data['datetime'] ) . '</td>
	630	+ <td class="key">' . esc_html( $data['log_key'] ) . '</td>
612	631	<td class="name">' . $name . '</td>
613	632	<td class="payment">' . $payment_name . $payment_structure . '</td>
614		- <td class="ip">' . $ip . '</td>
	633	+ <td class="ip">' . esc_html( $ip ) . '</td>
615	634	</tr>';
616	635	}
617	636	$html .= '</table>';
618	637	} else {
		@@ -638,12 +657,12 @@
638	657	$order_data = usces_get_acting_data( $log_key );
639	658	$usces_entries = $order_data['usces_entry'];
640	659
641	660	$html = '<table class="detail-head">';
642		- $html .= '<tr><th>' . __( 'Register date', 'usces' ) . '</th><td>' . $order_data['datetime'] . '</td><td>
	661	+ $html .= '<tr><th>' . __( 'Register date', 'usces' ) . '</th><td>' . esc_html( $order_data['datetime'] ) . '</td><td>
643	662	<label for="register_date_1"><input type="radio" name="register_date" id="register_date_1" value="1" checked="checked" /><span>' . __( 'Set the Registered Date to the Order Date.', 'usces' ) . '</span></label><br />
644	663	<label for="register_date_0"><input type="radio" name="register_date" id="register_date_0" value="0" /><span>' . __( 'Set the current time to the Order Date.', 'usces' ) . '</span></label></td></tr>';
645		- $html .= '<tr><th>' . __( 'Link key', 'usces' ) . '</th><td colspan="2">' . $order_data['key'] . '</td></tr>';
	664	+ $html .= '<tr><th>' . __( 'Link key', 'usces' ) . '</th><td colspan="2">' . wel_esc_settlement_log( $order_data['key'] ) . '</td></tr>';
646	665	$html .= '</table>';
647	666
648	667	$html .= '<table class="detail-customer">';
649	668	$html .= '<tr class="title"><td colspan="2"><h3>' . __( 'Customer Information', 'usces' ) . '</h3></td></tr>';
		@@ -669,10 +688,27 @@
669	688	$html .= '<tr><th>No</th><th>' . __( 'Items', 'usces' ) . '</th><th>' . __( 'Quantity', 'usces' ) . '</th><th>' . __( 'Unit price', 'usces' ) . '</th></tr>';
670	689	$html .= '</thead><tbody>';
671	690	$num = 1;
672	691	foreach ( $order_data['usces_cart'] as $serial => $row ) {
673		- $array = unserialize( $serial );
674		- $ids = array_keys( $array );
	692	+ $array = wel_safe_unserialize( $serial );
	693	+ $ids = ( is_array( $array ) && ! empty( $array ) ) ? array_keys( $array ) : array();
	694	+ if ( empty( $ids ) || ! is_array( $array[ $ids[0] ] ) || empty( $array[ $ids[0] ] ) ) {
	695	+ /*
	696	+ * The serial key is broken and the item cannot be identified.
	697	+ * When the cart in the session was empty, every posted row was
	698	+ * written to the same empty key and overwrote the previous one,
	699	+ * so the stored quantity and price cannot be attributed to a
	700	+ * particular item. Show the row without those figures.
	701	+ */
	702	+ $html .= '<tr>';
	703	+ $html .= '<td class="num">' . $num . '</td>';
	704	+ $html .= '<td class="item_name">' . esc_html( __( 'The cart data is broken and the item details cannot be restored. The original number of items is also unknown. This line is not included when the order data is recreated.', 'usces' ) ) . '</td>';
	705	+ $html .= '<td class="quantity">-</td>';
	706	+ $html .= '<td class="price">-</td>';
	707	+ $html .= '</tr>';
	708	+ $num++;
	709	+ continue;
	710	+ }
675	711	$skus = array_keys( $array[ $ids[0] ] );
676	712	$post_id = $ids[0];
677	713	$sku = $skus[0];
678	714	$options = $array[ $ids[0] ][ $skus[0] ];
		@@ -682,9 +718,9 @@
682	718	$name = urlencode( $field['name'] );
683	719	$options[ $name ] = ( isset( $options[ $name ] ) ) ? $options[ $name ] : '';
684	720	if ( ! empty( $name ) ) {
685	721	$key = urldecode( $name );
686		- $value = maybe_unserialize( $options[ $name ] );
	722	+ $value = wel_safe_maybe_unserialize( $options[ $name ] );
687	723	if ( is_array( $value ) ) {
688	724	$c = '';
689	725	$optstr .= esc_html( $key ) . ' : ';
690	726	foreach ( $value as $v ) {
		@@ -729,9 +765,9 @@
729	765	$html .= '<tr><th colspan="3">' . __( 'Used points', 'usces' ) . '</th><td class="usedpoint">' . number_format( $usces_entries['order']['usedpoint'] ) . '</td></tr>';
730	766	}
731	767	$html .= '<tr><th colspan="3">' . __( 'Payment amount', 'usces' ) . '</th><td class="total_full_price">' . usces_crform( $usces_entries['order']['total_full_price'], true, false, 'return' ) . '</td></tr>';
732	768	$html .= '</tfoot></table>';
733		- $html .= '<input type="hidden" id="log_key" value="' . $order_data['key'] . '" />';
	769	+ $html .= '<input type="hidden" id="log_key" value="' . esc_attr( $order_data['key'] ) . '" />';
734	770
735	771	$resdata = array();
736	772	$resdata['status'] = 'OK';
737	773	$resdata['result'] = $html;
		@@ -876,18 +912,18 @@
876	912	$log_data = $wpdb->get_results( $query, ARRAY_A );
877	913	if ( $log_data ) {
878	914	$html = '<table class="list"><tr><th></th><th></th><th>' . __( 'Register date', 'usces' ) . '</th><th>' . __( 'Link key', 'usces' ) . '</th><th>' . __( 'Type of payment', 'usces' ) . '</th><th>' . __( 'Status', 'usces' ) . '</th></tr>';
879	915	foreach ( (array) $log_data as $data ) {
880		- $log = unserialize( $data['log'] );
	916	+ $log = wel_safe_unserialize( $data['log'] );
881	917	$result = ( ! empty( $log['result'] ) ) ? $log['result'] : '';
882	918	$acting = ( ! empty( $log['acting'] ) ) ? $log['acting'] : '';
883	919	$html .= '<tr>
884		- <td class="check"><input type="checkbox" class="error-log-check" value="' . $data['ID'] . '"></td>
885		- <td class="detail"><input type="button" class="error-log-detail button" id="' . $data['ID'] . '" value="' . __( 'Detail', 'usces' ) . '"></td>
886		- <td class="datetime">' . $data['datetime'] . '</td>
887		- <td class="key">' . $data['log_key'] . '</td>
888		- <td class="payment">' . $acting . '</td>
889		- <td class="status">' . $result . '</td>
	920	+ <td class="check"><input type="checkbox" class="error-log-check" value="' . esc_attr( $data['ID'] ) . '"></td>
	921	+ <td class="detail"><input type="button" class="error-log-detail button" id="' . esc_attr( $data['ID'] ) . '" value="' . esc_attr__( 'Detail', 'usces' ) . '"></td>
	922	+ <td class="datetime">' . esc_html( $data['datetime'] ) . '</td>
	923	+ <td class="key">' . esc_html( $data['log_key'] ) . '</td>
	924	+ <td class="payment">' . wel_esc_settlement_log( $acting ) . '</td>
	925	+ <td class="status">' . wel_esc_settlement_log( $result ) . '</td>
890	926	</tr>';
891	927	}
892	928	$html .= '</table>';
893	929	} else {
		@@ -926,13 +962,13 @@
926	962	$html = '';
927	963	$query = $wpdb->prepare( "SELECT * FROM {$log_table_name} WHERE `log_type` = %s AND `ID` = %s", 'acting_error', $log_id );
928	964	$data = $wpdb->get_row( $query, ARRAY_A );
929	965	if ( $data ) {
930		- $log = unserialize( $data['log'] );
	966	+ $log = wel_safe_unserialize( $data['log'] );
931	967	$html = '<table class="detail">';
932		- $html .= '<tr><th>' . __( 'Register date', 'usces' ) . '</th><td>' . $data['datetime'] . '</td></tr>';
933		- $html .= '<tr><th>' . __( 'Link key', 'usces' ) . '</th><td>' . $log['key'] . '</td></tr>';
934		- $html .= '<tr><th>' . __( 'Result', 'usces' ) . '</th><td>' . $log['result'] . '</td></tr>';
	968	+ $html .= '<tr><th>' . __( 'Register date', 'usces' ) . '</th><td>' . esc_html( $data['datetime'] ) . '</td></tr>';
	969	+ $html .= '<tr><th>' . __( 'Link key', 'usces' ) . '</th><td>' . wel_esc_settlement_log( $log['key'] ) . '</td></tr>';
	970	+ $html .= '<tr><th>' . __( 'Result', 'usces' ) . '</th><td>' . wel_esc_settlement_log( $log['result'] ) . '</td></tr>';
935	971	foreach ( (array) $log['data'] as $key => $value ) {
936	972	if ( in_array( $key, $exemption ) ) {
937	973	continue;
938	974	}
		@@ -941,19 +977,19 @@
941	977	if ( in_array( $key2, $exemption ) ) {
942	978	continue;
943	979	}
944	980	if ( is_array( $value2 ) ) {
945		- $html .= '<tr><th>' . $key . ':' . $key2 . '</th><td>' . esc_html( serialize( $value2 ) ) . '</td></tr>';
	981	+ $html .= '<tr><th>' . esc_html( $key ) . ':' . esc_html( $key2 ) . '</th><td>' . esc_html( serialize( $value2 ) ) . '</td></tr>';
946	982	} else {
947		- $html .= '<tr><th>' . $key . ':' . $key2 . '</th><td>' . esc_html( $value2 ) . '</td></tr>';
	983	+ $html .= '<tr><th>' . esc_html( $key ) . ':' . esc_html( $key2 ) . '</th><td>' . esc_html( $value2 ) . '</td></tr>';
948	984	}
949	985	}
950	986	} else {
951		- $html .= '<tr><th>' . $key . '</th><td>' . esc_html( $value ) . '</td></tr>';
	987	+ $html .= '<tr><th>' . esc_html( $key ) . '</th><td>' . esc_html( $value ) . '</td></tr>';
952	988	}
953	989	}
954	990	$html .= '</table>';
955		- $html .= '<input type="hidden" id="log_id" value="' . $data['ID'] . '" />';
	991	+ $html .= '<input type="hidden" id="log_id" value="' . esc_attr( $data['ID'] ) . '" />';
956	992	}
957	993
958	994	$resdata = array();
959	995	$resdata['status'] = 'OK';
		@@ -1007,9 +1043,15 @@
1007	1043	if ( ! current_user_can( 'wel_manage_order' ) ) {
1008	1044	return false;
1009	1045	}
1010	1046	$datetime = get_option( 'usces_settlement_notice' );
1011		- echo '<div class="message error"><p>' . sprintf( __( "Settlement error has occurred. Please check <a href=\"admin.php?page=usces_orderlist&order_action=settlement_notice\">the settlement error log</a>. The date of occurrence:[ %s ]", 'usces' ), $datetime ) . '</p></div>';
	1047	+ echo '<div class="message error"><p>' . wp_kses_post(
	1048	+ sprintf(
	1049	+ /* translators: %s: date and time when the settlement error occurred */
	1050	+ __( 'Settlement error has occurred. Please check <a href="admin.php?page=usces_orderlist&order_action=settlement_notice">the settlement error log</a>. The date of occurrence:[ %s ]', 'usces' ),
	1051	+ $datetime
	1052	+ )
	1053	+ ) . '</p></div>';
1012	1054	}
1013	1055
1014	1056	/**
1015	1057	* 決済エラーログダウンロード
		@@ -1028,9 +1070,9 @@
1028	1070	$query = "SELECT * FROM {$log_table_name} WHERE `log_type` = 'acting_error' ORDER BY datetime DESC";
1029	1071	}
1030	1072	$log_data = $wpdb->get_results( $query, ARRAY_A );
1031	1073	foreach ( (array) $log_data as $data ) {
1032		- $log = unserialize( $data['log'] );
	1074	+ $log = wel_safe_unserialize( $data['log'] );
1033	1075	$line .= __( 'Register date', 'usces' ) . ' = ' . $data['datetime'] . "\r\n";
1034	1076	$line .= __( 'Link key', 'usces' ) . ' = ' . $log['key'] . "\r\n";
1035	1077	$line .= __( 'Result', 'usces' ) . ' = ' . $log['result'] . "\r\n";
1036	1078	foreach ( (array) $log['data'] as $key => $value ) {