← All changes | classes/paymentPayPalCP.class.php +33 -5 2.11.35 → 2.12.4 View file →

		@@ -1784,9 +1784,9 @@
1784	1784	createOrder: function() {
1785	1785	let params = new URLSearchParams();
1786	1786	params.append( "action", "create_order_card" );
1787	1787	params.append( "tracking_id", document.getElementById( "paypal_tracking_id" ).value );
1788		- return fetch( uscesL10n.ajaxurl+"?uscesid="+uscesL10n.uscesid, {
	1788	+ return fetch( uscesL10n.ajaxurl, {
1789	1789	method: "POST",
1790	1790	body: params
1791	1791	}).then( function( res ) {
1792	1792	return res.json();
		@@ -1862,9 +1862,9 @@
1862	1862	let params3ds = new URLSearchParams();
1863	1863	params3ds.append( "action", "show_order_details_card" );
1864	1864	params3ds.append( "tracking_id", document.getElementById( "paypal_tracking_id" ).value );
1865	1865	params3ds.append( "resource_id", payload.orderId );
1866		- return fetch( uscesL10n.ajaxurl + "?uscesid=" + uscesL10n.uscesid, {
	1866	+ return fetch( uscesL10n.ajaxurl, {
1867	1867	method: "POST",
1868	1868	body: params3ds
1869	1869	}).then( function( res ) {
1870	1870	return res.json();
		@@ -1974,9 +1974,9 @@
1974	1974	let params = new URLSearchParams();
1975	1975	params.append( "action", "create_billing_agreement" );
1976	1976	params.append( "tracking_id", document.getElementsByName( "tracking_id" )[0].value );
1977	1977	params.append( "billing", "<?php echo esc_html( $billing ); ?>" );
1978		- return fetch( uscesL10n.ajaxurl + "?uscesid=" + uscesL10n.uscesid, {
	1978	+ return fetch( uscesL10n.ajaxurl, {
1979	1979	method: "POST",
1980	1980	body: params
1981	1981	}).then( function( res ) {
1982	1982	return res.json();
		@@ -1997,9 +1997,9 @@
1997	1997	createOrder: function() {
1998	1998	let params = new URLSearchParams();
1999	1999	params.append( "action", "create_order" );
2000	2000	params.append( "tracking_id", document.getElementsByName( "tracking_id" )[0].value );
2001		- return fetch( uscesL10n.ajaxurl + "?uscesid=" + uscesL10n.uscesid, {
	2001	+ return fetch( uscesL10n.ajaxurl, {
2002	2002	method: "POST",
2003	2003	body: params
2004	2004	}).then( function( res ) {
2005	2005	return res.json();
		@@ -2066,9 +2066,9 @@
2066	2066	createOrder: function() {
2067	2067	let params = new URLSearchParams();
2068	2068	params.append( "action", "create_order_member" );
2069	2069	params.append( "tracking_id", document.getElementById( "paypal_tracking_id" ).value );
2070		- return fetch( uscesL10n.ajaxurl + "?uscesid=" + uscesL10n.uscesid, {
	2070	+ return fetch( uscesL10n.ajaxurl, {
2071	2071	method: "POST",
2072	2072	body: params
2073	2073	}).then( function( res ) {
2074	2074	return res.json();
		@@ -2264,11 +2264,36 @@
2264	2264
2265	2265	/**
2266	2266	* Create billing agreement.
2267	2267	*/
	2268	+ /**
	2269	+ * A5 (Layer 3 / uscesid removal): reopen the shopper's shop session from its own
	2270	+ * same-origin session cookie (USCES_KEY) instead of decoding a crafted `uscesid` GET
	2271	+ * param through uscesdc()/session_id(). These nopriv admin-ajax handlers run under
	2272	+ * admin-ajax.php, where usces_close_session() (admin_init) has closed the bootstrap
	2273	+ * session, so session_status() is PHP_SESSION_NONE here. get_entry()/get_cart()/
	2274	+ * get_member() read $_SESSION live, so reattaching before they run restores the
	2275	+ * shopper's cart/entry/member. Mirrors A2 (cart-monitor) / A6 (Zeus enrol).
	2276	+ * The uk session cookie is HttpOnly but is still sent on same-origin fetch()
	2277	+ * (default credentials: 'same-origin') and readable via $_COOKIE.
	2278	+ * See .docs/welcart2.x/security-remediation_uscesid-layer3-a3-a6-design.md A5.
	2279	+ */
	2280	+ private function reattach_shop_session() {
	2281	+ if ( PHP_SESSION_NONE === session_status() ) {
	2282	+ $usces_options = get_option( 'usces' );
	2283	+ $sess_name = defined( 'USCES_KEY' ) ? USCES_KEY : ( isset( $usces_options['usces_key'] ) ? $usces_options['usces_key'] : '' );
	2284	+ if ( '' !== $sess_name && ! empty( $_COOKIE[ $sess_name ] ) ) {
	2285	+ $sess_id = preg_replace( '/[^A-Za-z0-9,\-]/', '', wp_unslash( $_COOKIE[ $sess_name ] ) );
	2286	+ session_id( $sess_id );
	2287	+ @session_start(); // phpcs:ignore
	2288	+ }
	2289	+ }
	2290	+ }
	2291	+
2268	2292	public function create_billing_agreement() {
2269	2293	global $usces;
2270	2294
	2295	+ $this->reattach_shop_session();
2271	2296	$entry = $usces->cart->get_entry();
2272	2297	$cart = $usces->cart->get_cart();
2273	2298
2274	2299	$usces->error_message = $usces->zaiko_check();
		@@ -2341,8 +2366,9 @@
2341	2366	*/
2342	2367	public function create_order() {
2343	2368	global $usces;
2344	2369
	2370	+ $this->reattach_shop_session();
2345	2371	$entry = $usces->cart->get_entry();
2346	2372	$cart = $usces->cart->get_cart();
2347	2373
2348	2374	$usces->error_message = $usces->zaiko_check();
		@@ -2366,8 +2392,9 @@
2366	2392	*/
2367	2393	public function create_order_card() {
2368	2394	global $usces;
2369	2395
	2396	+ $this->reattach_shop_session();
2370	2397	$entry = $usces->cart->get_entry();
2371	2398	$cart = $usces->cart->get_cart();
2372	2399
2373	2400	$usces->error_message = $usces->zaiko_check();
		@@ -2393,8 +2420,9 @@
2393	2420	*/
2394	2421	public function create_order_member() {
2395	2422	global $usces;
2396	2423
	2424	+ $this->reattach_shop_session();
2397	2425	$acting_opts = $this->get_acting_settings();
2398	2426	$tracking_id = wp_unslash( $_POST['tracking_id'] );
2399	2427
2400	2428	/* Get Access Token */