| @@ -134,9 +134,9 @@ | ||
| 134 | 134 | if ( empty( $datas ) || empty( $datas['order_data'] ) ) { |
| 135 | 135 | return; |
| 136 | 136 | } |
| 137 | 137 | |
| 138 | - $order_data = maybe_unserialize( $datas['order_data'] ); | |
| 138 | + $order_data = wel_safe_maybe_unserialize( $datas['order_data'] ); | |
| 139 | 139 | if ( ! is_array( $order_data ) ) { |
| 140 | 140 | return; |
| 141 | 141 | } |
| 142 | 142 | |
| @@ -577,9 +577,9 @@ | ||
| 577 | 577 | usces_log( 'PayPal IPN transaction : ' . wp_unslash( $_REQUEST['txn_id'] ), 'acting_transaction.log' ); |
| 578 | 578 | } |
| 579 | 579 | die( 'PayPal' ); |
| 580 | 580 | |
| 581 | - /* telecom edy */ | |
| 581 | + /* telecom edy 提供対象外のため無効化. CVE-2026-19887(PHP Object Injection)対応. | |
| 582 | 582 | } elseif ( isset( $_REQUEST['clientip'] ) && isset( $_REQUEST['sendid'] ) && ( isset( $_REQUEST['acting'] ) && 'telecom_edy' == $_REQUEST['acting'] ) ) { |
| 583 | 583 | $data = array(); |
| 584 | 584 | foreach ( $_REQUEST as $key => $value ) { |
| 585 | 585 | $data[ $key ] = $value; |
| @@ -594,9 +594,9 @@ | ||
| 594 | 594 | if ( 'yes' === wp_unslash( $_REQUEST['rel'] ) && isset( $_REQUEST['option'] ) ) { |
| 595 | 595 | $table_meta_name = $wpdb->prefix . 'usces_order_meta'; |
| 596 | 596 | $mquery = $wpdb->prepare( "SELECT order_id, meta_value FROM $table_meta_name WHERE meta_key = %s", wp_unslash( $_REQUEST['option'] ) ); |
| 597 | 597 | $mvalue = $wpdb->get_row( $mquery, ARRAY_A ); |
| 598 | - $value = unserialize( $mvalue['meta_value'] ); | |
| 598 | + $value = wel_safe_maybe_unserialize( $mvalue['meta_value'] ); | |
| 599 | 599 | $_SESSION['usces_cart'] = $value['usces_cart']; |
| 600 | 600 | $_SESSION['usces_entry'] = $value['usces_entry']; |
| 601 | 601 | $_SESSION['usces_member'] = $value['usces_member']; |
| 602 | 602 | $res = $usces->order_processing(); |
| @@ -624,11 +624,17 @@ | ||
| 624 | 624 | usces_save_order_acting_error( $log ); |
| 625 | 625 | usces_log( 'telecom edy - Error 2 : ' . print_r( $data, true ), 'acting_transaction.log' ); |
| 626 | 626 | } |
| 627 | 627 | die( 'SuccessOK' ); |
| 628 | + */ | |
| 628 | 629 | |
| 629 | 630 | /* telecom credit */ |
| 630 | 631 | } elseif ( isset( $_REQUEST['clientip'] ) && isset( $_REQUEST['sendid'] ) && isset( $_REQUEST['rel'] ) ) { |
| 632 | + $acting_clientip = ( isset( $usces->options['acting_settings']['telecom']['clientip'] ) ) ? (string) $usces->options['acting_settings']['telecom']['clientip'] : ''; | |
| 633 | + if ( '' === $acting_clientip || (string) wp_unslash( $_REQUEST['clientip'] ) !== $acting_clientip ) { | |
| 634 | + /* 設定済みクライアントIPと一致しない通知は正規のものではないため記録せず終了 */ | |
| 635 | + die( 'SuccessOK' ); | |
| 636 | + } | |
| 631 | 637 | $data = array(); |
| 632 | 638 | foreach ( $_REQUEST as $key => $value ) { |
| 633 | 639 | $data[ $key ] = $value; |
| 634 | 640 | } |
