← All changes | functions/settlement_func.php +54 -29 2.12.1 → 2.12.4 View file →

		@@ -518,9 +518,9 @@
518	518	$log_table_name = $wpdb->prefix . 'usces_log';
519	519	$query = $wpdb->prepare( "SELECT * FROM {$log_table_name} WHERE `log_type` = %s AND `log_key` = %s", 'acting_data', $key );
520	520	$data = $wpdb->get_row( $query, ARRAY_A );
521	521	if ( $data ) {
522		- $order_data = unserialize( $data['log'] );
	522	+ $order_data = wel_safe_unserialize( $data['log'] );
523	523	$order_data['key'] = $data['log_key'];
524	524	$order_data['datetime'] = $data['datetime'];
525	525	} else {
526	526	$order_data = array(
		@@ -576,8 +576,27 @@
576	576	return $res;
577	577	}
578	578
579	579	/**
	580	+ * Escape a settlement log field for HTML output.
	581	+ *
	582	+ * Log fields come from unauthenticated payment-gateway callbacks, so a field
	583	+ * may arrive as an array (e.g. `?rand[]=x`) or as an object. Flatten anything
	584	+ * non-scalar before escaping, because esc_html() cannot take an array.
	585	+ *
	586	+ * Use this for text nodes only. Attribute values need esc_attr().
	587	+ *
	588	+ * @param mixed $value Raw log field.
	589	+ * @return string Escaped, HTML-safe string.
	590	+ */
	591	+function wel_esc_settlement_log( $value ) {
	592	+ if ( null === $value || is_scalar( $value ) ) {
	593	+ return esc_html( (string) $value );
	594	+ }
	595	+ return esc_html( wp_json_encode( $value ) );
	596	+}
	597	+
	598	+/**
580	599	* 決済直前ログ一覧
581	600	*
582	601	* @param string $log_key Log key.
583	602	* @return void
		@@ -595,9 +614,9 @@
595	614	$log_data = $wpdb->get_results( $query, ARRAY_A );
596	615	if ( $log_data ) {
597	616	$html = '<table class="list"><tr><th></th><th></th><th>' . __( 'Register date', 'usces' ) . '</th><th>' . __( 'Link key', 'usces' ) . '</th><th>' . __( 'Name', 'usces' ) . '</th><th>' . __( 'Type of payment', 'usces' ) . '</th><th>IP</th></tr>';
598	617	foreach ( (array) $log_data as $data ) {
599		- $log = unserialize( $data['log'] );
	618	+ $log = wel_safe_unserialize( $data['log'] );
600	619	$name = esc_html( $log['usces_entry']['customer']['name1'] ) . esc_html( $log['usces_entry']['customer']['name2'] );
601	620	$payment_name = esc_html( $log['usces_entry']['order']['payment_name'] );
602	621	$payments = usces_get_payments_by_name( $payment_name );
603	622	$settlement = ( isset( $payments['settlement'] ) ) ? $payments['settlement'] : '';
		@@ -604,15 +623,15 @@
604	623	$payment_structure = ( isset( $usces->payment_structure[ $settlement ] ) ) ? '[' . $usces->payment_structure[ $settlement ] . ']' : '';
605	624	$class = ( ! empty( $log['revival'] ) ) ? ' class="revival"' : '';
606	625	$ip = ( ! empty( $log['remote_addr'] ) ) ? $log['remote_addr'] : '';
607	626	$html .= '<tr' . $class . '>
608		- <td class="check"><input type="checkbox" class="log-check" value="' . $data['log_key'] . '"></td>
609		- <td class="detail"><input type="button" class="log-detail button" id="' . $data['log_key'] . '" value="' . __( 'Detail', 'usces' ) . '"></td>
610		- <td class="datetime">' . $data['datetime'] . '</td>
611		- <td class="key">' . $data['log_key'] . '</td>
	627	+ <td class="check"><input type="checkbox" class="log-check" value="' . esc_attr( $data['log_key'] ) . '"></td>
	628	+ <td class="detail"><input type="button" class="log-detail button" id="' . esc_attr( $data['log_key'] ) . '" value="' . esc_attr__( 'Detail', 'usces' ) . '"></td>
	629	+ <td class="datetime">' . esc_html( $data['datetime'] ) . '</td>
	630	+ <td class="key">' . esc_html( $data['log_key'] ) . '</td>
612	631	<td class="name">' . $name . '</td>
613	632	<td class="payment">' . $payment_name . $payment_structure . '</td>
614		- <td class="ip">' . $ip . '</td>
	633	+ <td class="ip">' . esc_html( $ip ) . '</td>
615	634	</tr>';
616	635	}
617	636	$html .= '</table>';
618	637	} else {
		@@ -638,12 +657,12 @@
638	657	$order_data = usces_get_acting_data( $log_key );
639	658	$usces_entries = $order_data['usces_entry'];
640	659
641	660	$html = '<table class="detail-head">';
642		- $html .= '<tr><th>' . __( 'Register date', 'usces' ) . '</th><td>' . $order_data['datetime'] . '</td><td>
	661	+ $html .= '<tr><th>' . __( 'Register date', 'usces' ) . '</th><td>' . esc_html( $order_data['datetime'] ) . '</td><td>
643	662	<label for="register_date_1"><input type="radio" name="register_date" id="register_date_1" value="1" checked="checked" /><span>' . __( 'Set the Registered Date to the Order Date.', 'usces' ) . '</span></label><br />
644	663	<label for="register_date_0"><input type="radio" name="register_date" id="register_date_0" value="0" /><span>' . __( 'Set the current time to the Order Date.', 'usces' ) . '</span></label></td></tr>';
645		- $html .= '<tr><th>' . __( 'Link key', 'usces' ) . '</th><td colspan="2">' . $order_data['key'] . '</td></tr>';
	664	+ $html .= '<tr><th>' . __( 'Link key', 'usces' ) . '</th><td colspan="2">' . wel_esc_settlement_log( $order_data['key'] ) . '</td></tr>';
646	665	$html .= '</table>';
647	666
648	667	$html .= '<table class="detail-customer">';
649	668	$html .= '<tr class="title"><td colspan="2"><h3>' . __( 'Customer Information', 'usces' ) . '</h3></td></tr>';
		@@ -669,9 +688,9 @@
669	688	$html .= '<tr><th>No</th><th>' . __( 'Items', 'usces' ) . '</th><th>' . __( 'Quantity', 'usces' ) . '</th><th>' . __( 'Unit price', 'usces' ) . '</th></tr>';
670	689	$html .= '</thead><tbody>';
671	690	$num = 1;
672	691	foreach ( $order_data['usces_cart'] as $serial => $row ) {
673		- $array = @unserialize( $serial );
	692	+ $array = wel_safe_unserialize( $serial );
674	693	$ids = ( is_array( $array ) && ! empty( $array ) ) ? array_keys( $array ) : array();
675	694	if ( empty( $ids ) || ! is_array( $array[ $ids[0] ] ) || empty( $array[ $ids[0] ] ) ) {
676	695	/*
677	696	* The serial key is broken and the item cannot be identified.
		@@ -699,9 +718,9 @@
699	718	$name = urlencode( $field['name'] );
700	719	$options[ $name ] = ( isset( $options[ $name ] ) ) ? $options[ $name ] : '';
701	720	if ( ! empty( $name ) ) {
702	721	$key = urldecode( $name );
703		- $value = maybe_unserialize( $options[ $name ] );
	722	+ $value = wel_safe_maybe_unserialize( $options[ $name ] );
704	723	if ( is_array( $value ) ) {
705	724	$c = '';
706	725	$optstr .= esc_html( $key ) . ' : ';
707	726	foreach ( $value as $v ) {
		@@ -746,9 +765,9 @@
746	765	$html .= '<tr><th colspan="3">' . __( 'Used points', 'usces' ) . '</th><td class="usedpoint">' . number_format( $usces_entries['order']['usedpoint'] ) . '</td></tr>';
747	766	}
748	767	$html .= '<tr><th colspan="3">' . __( 'Payment amount', 'usces' ) . '</th><td class="total_full_price">' . usces_crform( $usces_entries['order']['total_full_price'], true, false, 'return' ) . '</td></tr>';
749	768	$html .= '</tfoot></table>';
750		- $html .= '<input type="hidden" id="log_key" value="' . $order_data['key'] . '" />';
	769	+ $html .= '<input type="hidden" id="log_key" value="' . esc_attr( $order_data['key'] ) . '" />';
751	770
752	771	$resdata = array();
753	772	$resdata['status'] = 'OK';
754	773	$resdata['result'] = $html;
		@@ -893,18 +912,18 @@
893	912	$log_data = $wpdb->get_results( $query, ARRAY_A );
894	913	if ( $log_data ) {
895	914	$html = '<table class="list"><tr><th></th><th></th><th>' . __( 'Register date', 'usces' ) . '</th><th>' . __( 'Link key', 'usces' ) . '</th><th>' . __( 'Type of payment', 'usces' ) . '</th><th>' . __( 'Status', 'usces' ) . '</th></tr>';
896	915	foreach ( (array) $log_data as $data ) {
897		- $log = unserialize( $data['log'] );
	916	+ $log = wel_safe_unserialize( $data['log'] );
898	917	$result = ( ! empty( $log['result'] ) ) ? $log['result'] : '';
899	918	$acting = ( ! empty( $log['acting'] ) ) ? $log['acting'] : '';
900	919	$html .= '<tr>
901		- <td class="check"><input type="checkbox" class="error-log-check" value="' . $data['ID'] . '"></td>
902		- <td class="detail"><input type="button" class="error-log-detail button" id="' . $data['ID'] . '" value="' . __( 'Detail', 'usces' ) . '"></td>
903		- <td class="datetime">' . $data['datetime'] . '</td>
904		- <td class="key">' . $data['log_key'] . '</td>
905		- <td class="payment">' . $acting . '</td>
906		- <td class="status">' . $result . '</td>
	920	+ <td class="check"><input type="checkbox" class="error-log-check" value="' . esc_attr( $data['ID'] ) . '"></td>
	921	+ <td class="detail"><input type="button" class="error-log-detail button" id="' . esc_attr( $data['ID'] ) . '" value="' . esc_attr__( 'Detail', 'usces' ) . '"></td>
	922	+ <td class="datetime">' . esc_html( $data['datetime'] ) . '</td>
	923	+ <td class="key">' . esc_html( $data['log_key'] ) . '</td>
	924	+ <td class="payment">' . wel_esc_settlement_log( $acting ) . '</td>
	925	+ <td class="status">' . wel_esc_settlement_log( $result ) . '</td>
907	926	</tr>';
908	927	}
909	928	$html .= '</table>';
910	929	} else {
		@@ -943,13 +962,13 @@
943	962	$html = '';
944	963	$query = $wpdb->prepare( "SELECT * FROM {$log_table_name} WHERE `log_type` = %s AND `ID` = %s", 'acting_error', $log_id );
945	964	$data = $wpdb->get_row( $query, ARRAY_A );
946	965	if ( $data ) {
947		- $log = unserialize( $data['log'] );
	966	+ $log = wel_safe_unserialize( $data['log'] );
948	967	$html = '<table class="detail">';
949		- $html .= '<tr><th>' . __( 'Register date', 'usces' ) . '</th><td>' . $data['datetime'] . '</td></tr>';
950		- $html .= '<tr><th>' . __( 'Link key', 'usces' ) . '</th><td>' . $log['key'] . '</td></tr>';
951		- $html .= '<tr><th>' . __( 'Result', 'usces' ) . '</th><td>' . $log['result'] . '</td></tr>';
	968	+ $html .= '<tr><th>' . __( 'Register date', 'usces' ) . '</th><td>' . esc_html( $data['datetime'] ) . '</td></tr>';
	969	+ $html .= '<tr><th>' . __( 'Link key', 'usces' ) . '</th><td>' . wel_esc_settlement_log( $log['key'] ) . '</td></tr>';
	970	+ $html .= '<tr><th>' . __( 'Result', 'usces' ) . '</th><td>' . wel_esc_settlement_log( $log['result'] ) . '</td></tr>';
952	971	foreach ( (array) $log['data'] as $key => $value ) {
953	972	if ( in_array( $key, $exemption ) ) {
954	973	continue;
955	974	}
		@@ -958,19 +977,19 @@
958	977	if ( in_array( $key2, $exemption ) ) {
959	978	continue;
960	979	}
961	980	if ( is_array( $value2 ) ) {
962		- $html .= '<tr><th>' . $key . ':' . $key2 . '</th><td>' . esc_html( serialize( $value2 ) ) . '</td></tr>';
	981	+ $html .= '<tr><th>' . esc_html( $key ) . ':' . esc_html( $key2 ) . '</th><td>' . esc_html( serialize( $value2 ) ) . '</td></tr>';
963	982	} else {
964		- $html .= '<tr><th>' . $key . ':' . $key2 . '</th><td>' . esc_html( $value2 ) . '</td></tr>';
	983	+ $html .= '<tr><th>' . esc_html( $key ) . ':' . esc_html( $key2 ) . '</th><td>' . esc_html( $value2 ) . '</td></tr>';
965	984	}
966	985	}
967	986	} else {
968		- $html .= '<tr><th>' . $key . '</th><td>' . esc_html( $value ) . '</td></tr>';
	987	+ $html .= '<tr><th>' . esc_html( $key ) . '</th><td>' . esc_html( $value ) . '</td></tr>';
969	988	}
970	989	}
971	990	$html .= '</table>';
972		- $html .= '<input type="hidden" id="log_id" value="' . $data['ID'] . '" />';
	991	+ $html .= '<input type="hidden" id="log_id" value="' . esc_attr( $data['ID'] ) . '" />';
973	992	}
974	993
975	994	$resdata = array();
976	995	$resdata['status'] = 'OK';
		@@ -1024,9 +1043,15 @@
1024	1043	if ( ! current_user_can( 'wel_manage_order' ) ) {
1025	1044	return false;
1026	1045	}
1027	1046	$datetime = get_option( 'usces_settlement_notice' );
1028		- echo '<div class="message error"><p>' . sprintf( __( "Settlement error has occurred. Please check <a href=\"admin.php?page=usces_orderlist&order_action=settlement_notice\">the settlement error log</a>. The date of occurrence:[ %s ]", 'usces' ), $datetime ) . '</p></div>';
	1047	+ echo '<div class="message error"><p>' . wp_kses_post(
	1048	+ sprintf(
	1049	+ /* translators: %s: date and time when the settlement error occurred */
	1050	+ __( 'Settlement error has occurred. Please check <a href="admin.php?page=usces_orderlist&order_action=settlement_notice">the settlement error log</a>. The date of occurrence:[ %s ]', 'usces' ),
	1051	+ $datetime
	1052	+ )
	1053	+ ) . '</p></div>';
1029	1054	}
1030	1055
1031	1056	/**
1032	1057	* 決済エラーログダウンロード
		@@ -1045,9 +1070,9 @@
1045	1070	$query = "SELECT * FROM {$log_table_name} WHERE `log_type` = 'acting_error' ORDER BY datetime DESC";
1046	1071	}
1047	1072	$log_data = $wpdb->get_results( $query, ARRAY_A );
1048	1073	foreach ( (array) $log_data as $data ) {
1049		- $log = unserialize( $data['log'] );
	1074	+ $log = wel_safe_unserialize( $data['log'] );
1050	1075	$line .= __( 'Register date', 'usces' ) . ' = ' . $data['datetime'] . "\r\n";
1051	1076	$line .= __( 'Link key', 'usces' ) . ' = ' . $log['key'] . "\r\n";
1052	1077	$line .= __( 'Result', 'usces' ) . ' = ' . $log['result'] . "\r\n";
1053	1078	foreach ( (array) $log['data'] as $key => $value ) {