| @@ -12,9 +12,40 @@ | ||
| 12 | 12 | /** |
| 13 | 13 | * e-SCOTT Smart Main Class. |
| 14 | 14 | */ |
| 15 | 15 | class ESCOTT_MAIN { |
| 16 | + | |
| 16 | 17 | /** |
| 18 | + * 入金通知の送信元IP許可リスト（本番環境） | |
| 19 | + * | |
| 20 | + * @var array | |
| 21 | + */ | |
| 22 | + const ACTING_NOTICE_IPADDRS_PUBLIC = array( | |
| 23 | + '54.238.10.224', | |
| 24 | + '3.114.145.91', | |
| 25 | + '54.248.234.19', | |
| 26 | + /* DR */ | |
| 27 | + '13.208.56.91', | |
| 28 | + '13.208.108.172', | |
| 29 | + '15.152.0.135', | |
| 30 | + ); | |
| 31 | + | |
| 32 | + /** | |
| 33 | + * 入金通知の送信元IP許可リスト（試験環境） | |
| 34 | + * | |
| 35 | + * @var array | |
| 36 | + */ | |
| 37 | + const ACTING_NOTICE_IPADDRS_TEST = array( | |
| 38 | + '35.72.54.3', | |
| 39 | + '54.248.208.159', | |
| 40 | + '35.72.47.156', | |
| 41 | + /* DR */ | |
| 42 | + '13.208.56.91', | |
| 43 | + '13.208.108.172', | |
| 44 | + '15.152.0.135', | |
| 45 | + ); | |
| 46 | + | |
| 47 | + /** | |
| 17 | 48 | * 決済代行会社ID |
| 18 | 49 | * ex) 'escott' |
| 19 | 50 | * |
| 20 | 51 | * @var string |
| @@ -2829,8 +2860,37 @@ | ||
| 2829 | 2860 | $mes .= sprintf( __( 'It exceeds the maximum amount of "%1$s" (total amount %2$s).', 'usces' ), $usces_entries['order']['payment_name'], usces_crform( $fee_limit_amount, true, false, 'return', true ) ); |
| 2830 | 2861 | } |
| 2831 | 2862 | |
| 2832 | 2863 | return $mes; |
| 2864 | + } | |
| 2865 | + | |
| 2866 | + /** | |
| 2867 | + * 入金通知の送信元IPを検証する | |
| 2868 | + * | |
| 2869 | + * 許可IP以外からのリクエストはエラーログを残して処理を終了する | |
| 2870 | + * 入金状態を変更するサーバー間通知でのみ呼び出すこと | |
| 2871 | + * ブラウザ戻りを伴う結果戻り（acting_return）では呼び出さない | |
| 2872 | + * | |
| 2873 | + * @param array $data Notification data. | |
| 2874 | + * @return void | |
| 2875 | + */ | |
| 2876 | + protected function acting_notice_ip_guard( $data ) { | |
| 2877 | + $acting_opts = $this->get_acting_settings(); | |
| 2878 | + $allowed_ips = ( isset( $acting_opts['ope'] ) && 'public' === $acting_opts['ope'] ) ? self::ACTING_NOTICE_IPADDRS_PUBLIC : self::ACTING_NOTICE_IPADDRS_TEST; | |
| 2879 | + $remote_addr = ( isset( $_SERVER['REMOTE_ADDR'] ) ) ? wp_unslash( $_SERVER['REMOTE_ADDR'] ) : ''; | |
| 2880 | + if ( usces_acting_notice_ip_allowed( $remote_addr, $allowed_ips ) ) { | |
| 2881 | + return; | |
| 2882 | + } | |
| 2883 | + $log = array( | |
| 2884 | + 'acting' => $this->acting_conv, | |
| 2885 | + 'key' => ( isset( $data['MerchantFree1'] ) ) ? $data['MerchantFree1'] : '', | |
| 2886 | + 'result' => 'IP ADDRESS NOT ALLOWED: ' . $remote_addr, | |
| 2887 | + 'data' => $data, | |
| 2888 | + ); | |
| 2889 | + usces_save_order_acting_error( $log ); | |
| 2890 | + usces_log( '[' . $this->acting_name . '] conv notice denied ip : ' . $remote_addr, 'acting_transaction.log' ); | |
| 2891 | + header( 'HTTP/1.0 200 OK' ); | |
| 2892 | + die(); | |
| 2833 | 2893 | } |
| 2834 | 2894 | |
| 2835 | 2895 | /** |
| 2836 | 2896 | * 決済オプション取得 |
