| @@ -12,8 +12,22 @@ | ||
| 12 | 12 | */ |
| 13 | 13 | class EPSILON_SETTLEMENT { |
| 14 | 14 | |
| 15 | 15 | /** |
| 16 | + * 決済結果通知の送信元IP許可リスト（本番環境） | |
| 17 | + * | |
| 18 | + * @var array | |
| 19 | + */ | |
| 20 | + const ACTING_NOTICE_IPADDRS_PUBLIC = array( '210.254.37.215' ); | |
| 21 | + | |
| 22 | + /** | |
| 23 | + * 決済結果通知の送信元IP許可リスト（テスト環境） | |
| 24 | + * | |
| 25 | + * @var array | |
| 26 | + */ | |
| 27 | + const ACTING_NOTICE_IPADDRS_TEST = array( '210.254.37.214' ); | |
| 28 | + | |
| 29 | + /** | |
| 16 | 30 | * Instance of this class. |
| 17 | 31 | * |
| 18 | 32 | * @var object |
| 19 | 33 | */ |
| @@ -583,8 +597,36 @@ | ||
| 583 | 597 | endif; |
| 584 | 598 | } |
| 585 | 599 | |
| 586 | 600 | /** |
| 601 | + * 決済結果通知の送信元IPを検証する | |
| 602 | + * | |
| 603 | + * 許可IP以外からのリクエストはエラーログを残して処理を終了する | |
| 604 | + * 入金状態を変更するサーバー間通知でのみ呼び出すこと | |
| 605 | + * ブラウザ戻りを伴う結果戻りでは呼び出さない | |
| 606 | + * | |
| 607 | + * @param array $data Notification data. | |
| 608 | + * @return void | |
| 609 | + */ | |
| 610 | + private function acting_notice_ip_guard( $data ) { | |
| 611 | + $acting_opts = $this->get_acting_settings(); | |
| 612 | + $allowed_ips = ( isset( $acting_opts['ope'] ) && 'public' === $acting_opts['ope'] ) ? self::ACTING_NOTICE_IPADDRS_PUBLIC : self::ACTING_NOTICE_IPADDRS_TEST; | |
| 613 | + $remote_addr = ( isset( $_SERVER['REMOTE_ADDR'] ) ) ? wp_unslash( $_SERVER['REMOTE_ADDR'] ) : ''; | |
| 614 | + if ( usces_acting_notice_ip_allowed( $remote_addr, $allowed_ips ) ) { | |
| 615 | + return; | |
| 616 | + } | |
| 617 | + $log = array( | |
| 618 | + 'acting' => 'epsilon_conv', | |
| 619 | + 'key' => ( isset( $data['order_number'] ) ) ? $data['order_number'] : '', | |
| 620 | + 'result' => 'IP ADDRESS NOT ALLOWED: ' . $remote_addr, | |
| 621 | + 'data' => $data, | |
| 622 | + ); | |
| 623 | + usces_save_order_acting_error( $log ); | |
| 624 | + usces_log( 'epsilon notice denied ip : ' . $remote_addr, 'acting_transaction.log' ); | |
| 625 | + exit( '0 999 ERROR0' ); | |
| 626 | + } | |
| 627 | + | |
| 628 | + /** | |
| 587 | 629 | * 結果通知処理 |
| 588 | 630 | * usces_after_cart_instant |
| 589 | 631 | */ |
| 590 | 632 | public function acting_transaction() { |
| @@ -610,8 +652,9 @@ | ||
| 610 | 652 | $post_data = array(); |
| 611 | 653 | foreach ( $_POST as $key => $value ) { |
| 612 | 654 | $post_data[ $key ] = mb_convert_encoding( wp_unslash( $value ), 'UTF-8', 'SJIS' ); |
| 613 | 655 | } |
| 656 | + $this->acting_notice_ip_guard( $post_data ); | |
| 614 | 657 | |
| 615 | 658 | if ( '1' === $post_data['paid'] ) { |
| 616 | 659 | $order_id = $this->get_order_id( $post_data['order_number'] ); |
| 617 | 660 | if ( ! $order_id ) { |
