| @@ -14,8 +14,15 @@ | ||
| 14 | 14 | * ロボットペイメント |
| 15 | 15 | */ |
| 16 | 16 | class JPAYMENT_SETTLEMENT { |
| 17 | 17 | /** |
| 18 | + * 決済結果通知（キックバック）の送信元IP許可リスト | |
| 19 | + * | |
| 20 | + * @var array | |
| 21 | + */ | |
| 22 | + const ACTING_NOTICE_IPADDRS = array( '54.95.223.30', '54.168.57.171' ); | |
| 23 | + | |
| 24 | + /** | |
| 18 | 25 | * Instance of this class. |
| 19 | 26 | * |
| 20 | 27 | * @var object |
| 21 | 28 | */ |
| @@ -571,9 +578,9 @@ | ||
| 571 | 578 | public function order_confirm_mail_payment( $msg_payment, $order_id, $payment, $cart, $data ) { |
| 572 | 579 | global $usces; |
| 573 | 580 | |
| 574 | 581 | if ( 'acting_jpayment_conv' == $payment['settlement'] ) { |
| 575 | - $args = maybe_unserialize( $usces->get_order_meta_value( $payment['settlement'], $order_id ) ); | |
| 582 | + $args = wel_safe_maybe_unserialize( $usces->get_order_meta_value( $payment['settlement'], $order_id ) ); | |
| 576 | 583 | $msg_payment .= '決済番号 : ' . $args['gid'] . "\r\n"; |
| 577 | 584 | $msg_payment .= '決済金額 : ' . number_format( $args['ta'] ) . __( 'dollars', 'usces' ) . "\r\n"; |
| 578 | 585 | $msg_payment .= 'お支払先 : ' . usces_get_conv_name( $args['cv'] ) . "\r\n"; |
| 579 | 586 | $msg_payment .= 'コンビニ受付番号 : ' . $args['no'] . "\r\n"; |
| @@ -582,9 +589,9 @@ | ||
| 582 | 589 | } |
| 583 | 590 | $msg_payment .= "\r\n" . usces_mail_line( 2, $data['order_email'] ) . "\r\n"; |
| 584 | 591 | |
| 585 | 592 | } elseif ( 'acting_jpayment_bank' == $payment['settlement'] ) { |
| 586 | - $args = maybe_unserialize( $usces->get_order_meta_value( $payment['settlement'], $order_id ) ); | |
| 593 | + $args = wel_safe_maybe_unserialize( $usces->get_order_meta_value( $payment['settlement'], $order_id ) ); | |
| 587 | 594 | $msg_payment .= '決済番号 : ' . $args['gid'] . "\r\n"; |
| 588 | 595 | $msg_payment .= '決済金額 : ' . number_format( $args['ta'] ) . __( 'dollars', 'usces' ) . "\r\n"; |
| 589 | 596 | $bank = explode( '.', $args['bank'] ); |
| 590 | 597 | $msg_payment .= '銀行コード : ' . $bank[0] . "\r\n"; |
| @@ -615,9 +622,9 @@ | ||
| 615 | 622 | public function send_order_mail_payment( $msg_payment, $order_id, $payment, $cart, $entry, $data ) { |
| 616 | 623 | global $usces; |
| 617 | 624 | |
| 618 | 625 | if ( 'acting_jpayment_conv' == $payment['settlement'] ) { |
| 619 | - $args = maybe_unserialize( $usces->get_order_meta_value( $payment['settlement'], $order_id ) ); | |
| 626 | + $args = wel_safe_maybe_unserialize( $usces->get_order_meta_value( $payment['settlement'], $order_id ) ); | |
| 620 | 627 | $msg_payment .= '決済番号 : ' . $args['gid'] . "\r\n"; |
| 621 | 628 | $msg_payment .= '決済金額 : ' . number_format( $args['ta'] ) . __( 'dollars', 'usces' ) . "\r\n"; |
| 622 | 629 | $msg_payment .= 'お支払先 : ' . usces_get_conv_name( $args['cv'] ) . "\r\n"; |
| 623 | 630 | $msg_payment .= 'コンビニ受付番号 : ' . $args['no'] . "\r\n"; |
| @@ -626,9 +633,9 @@ | ||
| 626 | 633 | } |
| 627 | 634 | $msg_payment .= "\r\n" . usces_mail_line( 2, $entry['customer']['mailaddress1'] ) . "\r\n"; |
| 628 | 635 | |
| 629 | 636 | } elseif ( 'acting_jpayment_bank' == $payment['settlement'] ) { |
| 630 | - $args = maybe_unserialize( $usces->get_order_meta_value( $payment['settlement'], $order_id ) ); | |
| 637 | + $args = wel_safe_maybe_unserialize( $usces->get_order_meta_value( $payment['settlement'], $order_id ) ); | |
| 631 | 638 | $msg_payment .= '決済番号 : ' . $args['gid'] . "\r\n"; |
| 632 | 639 | $msg_payment .= '決済金額 : ' . number_format( $args['ta'] ) . __( 'dollars', 'usces' ) . "\r\n"; |
| 633 | 640 | $bank = explode( '.', $args['bank'] ); |
| 634 | 641 | $msg_payment .= '銀行コード : ' . $bank[0] . "\r\n"; |
| @@ -689,8 +696,33 @@ | ||
| 689 | 696 | $form .= '<p>「お支払いのご案内」は、' . esc_html( $entry['customer']['mailaddress1'] ) . ' 宛にメールさせていただいております。</p>'; |
| 690 | 697 | $form .= '</div>'; |
| 691 | 698 | } |
| 692 | 699 | return $form; |
| 700 | + } | |
| 701 | + | |
| 702 | + /** | |
| 703 | + * 決済結果通知（キックバック）の送信元IPを検証する | |
| 704 | + * | |
| 705 | + * 許可IP以外からのリクエストはエラーログを残して処理を終了する | |
| 706 | + * 入金状態を変更する通知（CPL / CVS_CAN / BAN_SAL）でのみ呼び出すこと | |
| 707 | + * ブラウザ戻り（CPL_PRE / BANK）では呼び出さない | |
| 708 | + * | |
| 709 | + * @return void | |
| 710 | + */ | |
| 711 | + public function acting_notice_ip_guard() { | |
| 712 | + $remote_addr = ( isset( $_SERVER['REMOTE_ADDR'] ) ) ? wp_unslash( $_SERVER['REMOTE_ADDR'] ) : ''; | |
| 713 | + if ( usces_acting_notice_ip_allowed( $remote_addr, self::ACTING_NOTICE_IPADDRS ) ) { | |
| 714 | + return; | |
| 715 | + } | |
| 716 | + $log = array( | |
| 717 | + 'acting' => ( isset( $_REQUEST['acting'] ) ) ? wp_unslash( $_REQUEST['acting'] ) : 'jpayment', | |
| 718 | + 'key' => ( isset( $_GET['cod'] ) ) ? wp_unslash( $_GET['cod'] ) : '', | |
| 719 | + 'result' => 'IP ADDRESS NOT ALLOWED: ' . $remote_addr, | |
| 720 | + 'data' => wp_unslash( $_REQUEST ), | |
| 721 | + ); | |
| 722 | + usces_save_order_acting_error( $log ); | |
| 723 | + usces_log( 'jpayment notice denied ip : ' . $remote_addr, 'acting_transaction.log' ); | |
| 724 | + die( 'error0' ); | |
| 693 | 725 | } |
| 694 | 726 | |
| 695 | 727 | /** |
| 696 | 728 | * 決済オプション取得 |
