← All changes | classes/paymentPayPalCP.class.php +40 -12 2.11.32 → 2.12.4 View file →

		@@ -1784,9 +1784,9 @@
1784	1784	createOrder: function() {
1785	1785	let params = new URLSearchParams();
1786	1786	params.append( "action", "create_order_card" );
1787	1787	params.append( "tracking_id", document.getElementById( "paypal_tracking_id" ).value );
1788		- return fetch( uscesL10n.ajaxurl+"?uscesid="+uscesL10n.uscesid, {
	1788	+ return fetch( uscesL10n.ajaxurl, {
1789	1789	method: "POST",
1790	1790	body: params
1791	1791	}).then( function( res ) {
1792	1792	return res.json();
		@@ -1862,9 +1862,9 @@
1862	1862	let params3ds = new URLSearchParams();
1863	1863	params3ds.append( "action", "show_order_details_card" );
1864	1864	params3ds.append( "tracking_id", document.getElementById( "paypal_tracking_id" ).value );
1865	1865	params3ds.append( "resource_id", payload.orderId );
1866		- return fetch( uscesL10n.ajaxurl + "?uscesid=" + uscesL10n.uscesid, {
	1866	+ return fetch( uscesL10n.ajaxurl, {
1867	1867	method: "POST",
1868	1868	body: params3ds
1869	1869	}).then( function( res ) {
1870	1870	return res.json();
		@@ -1974,9 +1974,9 @@
1974	1974	let params = new URLSearchParams();
1975	1975	params.append( "action", "create_billing_agreement" );
1976	1976	params.append( "tracking_id", document.getElementsByName( "tracking_id" )[0].value );
1977	1977	params.append( "billing", "<?php echo esc_html( $billing ); ?>" );
1978		- return fetch( uscesL10n.ajaxurl + "?uscesid=" + uscesL10n.uscesid, {
	1978	+ return fetch( uscesL10n.ajaxurl, {
1979	1979	method: "POST",
1980	1980	body: params
1981	1981	}).then( function( res ) {
1982	1982	return res.json();
		@@ -1997,9 +1997,9 @@
1997	1997	createOrder: function() {
1998	1998	let params = new URLSearchParams();
1999	1999	params.append( "action", "create_order" );
2000	2000	params.append( "tracking_id", document.getElementsByName( "tracking_id" )[0].value );
2001		- return fetch( uscesL10n.ajaxurl + "?uscesid=" + uscesL10n.uscesid, {
	2001	+ return fetch( uscesL10n.ajaxurl, {
2002	2002	method: "POST",
2003	2003	body: params
2004	2004	}).then( function( res ) {
2005	2005	return res.json();
		@@ -2066,9 +2066,9 @@
2066	2066	createOrder: function() {
2067	2067	let params = new URLSearchParams();
2068	2068	params.append( "action", "create_order_member" );
2069	2069	params.append( "tracking_id", document.getElementById( "paypal_tracking_id" ).value );
2070		- return fetch( uscesL10n.ajaxurl + "?uscesid=" + uscesL10n.uscesid, {
	2070	+ return fetch( uscesL10n.ajaxurl, {
2071	2071	method: "POST",
2072	2072	body: params
2073	2073	}).then( function( res ) {
2074	2074	return res.json();
		@@ -2264,11 +2264,36 @@
2264	2264
2265	2265	/**
2266	2266	* Create billing agreement.
2267	2267	*/
	2268	+ /**
	2269	+ * A5 (Layer 3 / uscesid removal): reopen the shopper's shop session from its own
	2270	+ * same-origin session cookie (USCES_KEY) instead of decoding a crafted `uscesid` GET
	2271	+ * param through uscesdc()/session_id(). These nopriv admin-ajax handlers run under
	2272	+ * admin-ajax.php, where usces_close_session() (admin_init) has closed the bootstrap
	2273	+ * session, so session_status() is PHP_SESSION_NONE here. get_entry()/get_cart()/
	2274	+ * get_member() read $_SESSION live, so reattaching before they run restores the
	2275	+ * shopper's cart/entry/member. Mirrors A2 (cart-monitor) / A6 (Zeus enrol).
	2276	+ * The uk session cookie is HttpOnly but is still sent on same-origin fetch()
	2277	+ * (default credentials: 'same-origin') and readable via $_COOKIE.
	2278	+ * See .docs/welcart2.x/security-remediation_uscesid-layer3-a3-a6-design.md A5.
	2279	+ */
	2280	+ private function reattach_shop_session() {
	2281	+ if ( PHP_SESSION_NONE === session_status() ) {
	2282	+ $usces_options = get_option( 'usces' );
	2283	+ $sess_name = defined( 'USCES_KEY' ) ? USCES_KEY : ( isset( $usces_options['usces_key'] ) ? $usces_options['usces_key'] : '' );
	2284	+ if ( '' !== $sess_name && ! empty( $_COOKIE[ $sess_name ] ) ) {
	2285	+ $sess_id = preg_replace( '/[^A-Za-z0-9,\-]/', '', wp_unslash( $_COOKIE[ $sess_name ] ) );
	2286	+ session_id( $sess_id );
	2287	+ @session_start(); // phpcs:ignore
	2288	+ }
	2289	+ }
	2290	+ }
	2291	+
2268	2292	public function create_billing_agreement() {
2269	2293	global $usces;
2270	2294
	2295	+ $this->reattach_shop_session();
2271	2296	$entry = $usces->cart->get_entry();
2272	2297	$cart = $usces->cart->get_cart();
2273	2298
2274	2299	$usces->error_message = $usces->zaiko_check();
		@@ -2341,8 +2366,9 @@
2341	2366	*/
2342	2367	public function create_order() {
2343	2368	global $usces;
2344	2369
	2370	+ $this->reattach_shop_session();
2345	2371	$entry = $usces->cart->get_entry();
2346	2372	$cart = $usces->cart->get_cart();
2347	2373
2348	2374	$usces->error_message = $usces->zaiko_check();
		@@ -2366,8 +2392,9 @@
2366	2392	*/
2367	2393	public function create_order_card() {
2368	2394	global $usces;
2369	2395
	2396	+ $this->reattach_shop_session();
2370	2397	$entry = $usces->cart->get_entry();
2371	2398	$cart = $usces->cart->get_cart();
2372	2399
2373	2400	$usces->error_message = $usces->zaiko_check();
		@@ -2393,8 +2420,9 @@
2393	2420	*/
2394	2421	public function create_order_member() {
2395	2422	global $usces;
2396	2423
	2424	+ $this->reattach_shop_session();
2397	2425	$acting_opts = $this->get_acting_settings();
2398	2426	$tracking_id = wp_unslash( $_POST['tracking_id'] );
2399	2427
2400	2428	/* Get Access Token */
		@@ -2878,9 +2906,9 @@
2878	2906	$description = '';
2879	2907	foreach ( $options as $key => $value ) {
2880	2908	if ( ! empty( $key ) ) {
2881	2909	$key = urldecode( $key );
2882		- $value = maybe_unserialize( $value );
	2910	+ $value = wel_safe_maybe_unserialize( $value );
2883	2911	if ( is_array( $value ) ) {
2884	2912	$c = '';
2885	2913	$description .= $key . ' : ';
2886	2914	foreach ( $value as $v ) {
		@@ -3172,9 +3200,9 @@
3172	3200	$description = '';
3173	3201	foreach ( $options as $key => $value ) {
3174	3202	if ( ! empty( $key ) ) {
3175	3203	$key = urldecode( $key );
3176		- $value = maybe_unserialize( $value );
	3204	+ $value = wel_safe_maybe_unserialize( $value );
3177	3205	if ( is_array( $value ) ) {
3178	3206	$c = '';
3179	3207	$description .= $key . ' : ';
3180	3208	foreach ( $value as $v ) {
		@@ -4713,9 +4741,9 @@
4713	4741
4714	4742	$shipping = usces_have_shipped( $cart );
4715	4743	if ( $shipping ) {
4716	4744	$order_data = $usces->get_order_data( $order_id, 'direct' );
4717		- $delivery = unserialize( $order_data['order_delivery'] );
	4745	+ $delivery = wel_safe_unserialize( $order_data['order_delivery'] );
4718	4746	$entry['delivery']['name1'] = $delivery['name1'];
4719	4747	$entry['delivery']['name2'] = $delivery['name2'];
4720	4748	$entry['delivery']['country'] = $delivery['country'];
4721	4749	$entry['delivery']['zipcode'] = $delivery['zipcode'];
		@@ -5675,9 +5703,9 @@
5675	5703	$entry['order']['total_full_price'] = $continue_data['price'];
5676	5704	$cart = usces_get_ordercartdata( $order_id );
5677	5705	$shipping = usces_have_shipped( $cart );
5678	5706	if ( $shipping ) {
5679		- $delivery = unserialize( $order_data['order_delivery'] );
	5707	+ $delivery = wel_safe_unserialize( $order_data['order_delivery'] );
5680	5708	$entry['delivery']['name1'] = $delivery['name1'];
5681	5709	$entry['delivery']['name2'] = $delivery['name2'];
5682	5710	$entry['delivery']['country'] = $delivery['country'];
5683	5711	$entry['delivery']['zipcode'] = $delivery['zipcode'];
		@@ -5913,9 +5941,9 @@
5913	5941	$optstr = '';
5914	5942	foreach ( $options as $key => $value ) {
5915	5943	if ( ! empty( $key ) ) {
5916	5944	$key = urldecode( $key );
5917		- $value = maybe_unserialize( $value );
	5945	+ $value = wel_safe_maybe_unserialize( $value );
5918	5946	if ( is_array( $value ) ) {
5919	5947	$c = '';
5920	5948	$optstr .= '( ' . $key . ' : ';
5921	5949	foreach ( $value as $v ) {
		@@ -6021,9 +6049,9 @@
6021	6049	$optstr = '';
6022	6050	foreach ( $options as $key => $value ) {
6023	6051	if ( ! empty( $key ) ) {
6024	6052	$key = urldecode( $key );
6025		- $value = maybe_unserialize( $value );
	6053	+ $value = wel_safe_maybe_unserialize( $value );
6026	6054	if ( is_array( $value ) ) {
6027	6055	$c = '';
6028	6056	$optstr .= '( ' . $key . ' : ';
6029	6057	foreach ( $value as $v ) {
		@@ -6414,9 +6442,9 @@
6414	6442
6415	6443	$shipping = usces_have_shipped( $cart );
6416	6444	if ( $shipping ) {
6417	6445	$regular_data = $this->get_regular_data( $member_id, $reg_id );
6418		- $delivery = (array) unserialize( $regular_data['reg_delivery'] );
	6446	+ $delivery = (array) wel_safe_unserialize( $regular_data['reg_delivery'] );
6419	6447	$entry['delivery']['name1'] = $delivery['name1'];
6420	6448	$entry['delivery']['name2'] = $delivery['name2'];
6421	6449	$entry['delivery']['country'] = $delivery['country'];
6422	6450	$entry['delivery']['zipcode'] = $delivery['zipcode'];