← All changes | functions/settlement_func.php +47 -22 2.12.2 → 2.12.4 View file →

		@@ -576,8 +576,27 @@
576	576	return $res;
577	577	}
578	578
579	579	/**
	580	+ * Escape a settlement log field for HTML output.
	581	+ *
	582	+ * Log fields come from unauthenticated payment-gateway callbacks, so a field
	583	+ * may arrive as an array (e.g. `?rand[]=x`) or as an object. Flatten anything
	584	+ * non-scalar before escaping, because esc_html() cannot take an array.
	585	+ *
	586	+ * Use this for text nodes only. Attribute values need esc_attr().
	587	+ *
	588	+ * @param mixed $value Raw log field.
	589	+ * @return string Escaped, HTML-safe string.
	590	+ */
	591	+function wel_esc_settlement_log( $value ) {
	592	+ if ( null === $value || is_scalar( $value ) ) {
	593	+ return esc_html( (string) $value );
	594	+ }
	595	+ return esc_html( wp_json_encode( $value ) );
	596	+}
	597	+
	598	+/**
580	599	* 決済直前ログ一覧
581	600	*
582	601	* @param string $log_key Log key.
583	602	* @return void
		@@ -604,15 +623,15 @@
604	623	$payment_structure = ( isset( $usces->payment_structure[ $settlement ] ) ) ? '[' . $usces->payment_structure[ $settlement ] . ']' : '';
605	624	$class = ( ! empty( $log['revival'] ) ) ? ' class="revival"' : '';
606	625	$ip = ( ! empty( $log['remote_addr'] ) ) ? $log['remote_addr'] : '';
607	626	$html .= '<tr' . $class . '>
608		- <td class="check"><input type="checkbox" class="log-check" value="' . $data['log_key'] . '"></td>
609		- <td class="detail"><input type="button" class="log-detail button" id="' . $data['log_key'] . '" value="' . __( 'Detail', 'usces' ) . '"></td>
610		- <td class="datetime">' . $data['datetime'] . '</td>
611		- <td class="key">' . $data['log_key'] . '</td>
	627	+ <td class="check"><input type="checkbox" class="log-check" value="' . esc_attr( $data['log_key'] ) . '"></td>
	628	+ <td class="detail"><input type="button" class="log-detail button" id="' . esc_attr( $data['log_key'] ) . '" value="' . esc_attr__( 'Detail', 'usces' ) . '"></td>
	629	+ <td class="datetime">' . esc_html( $data['datetime'] ) . '</td>
	630	+ <td class="key">' . esc_html( $data['log_key'] ) . '</td>
612	631	<td class="name">' . $name . '</td>
613	632	<td class="payment">' . $payment_name . $payment_structure . '</td>
614		- <td class="ip">' . $ip . '</td>
	633	+ <td class="ip">' . esc_html( $ip ) . '</td>
615	634	</tr>';
616	635	}
617	636	$html .= '</table>';
618	637	} else {
		@@ -638,12 +657,12 @@
638	657	$order_data = usces_get_acting_data( $log_key );
639	658	$usces_entries = $order_data['usces_entry'];
640	659
641	660	$html = '<table class="detail-head">';
642		- $html .= '<tr><th>' . __( 'Register date', 'usces' ) . '</th><td>' . $order_data['datetime'] . '</td><td>
	661	+ $html .= '<tr><th>' . __( 'Register date', 'usces' ) . '</th><td>' . esc_html( $order_data['datetime'] ) . '</td><td>
643	662	<label for="register_date_1"><input type="radio" name="register_date" id="register_date_1" value="1" checked="checked" /><span>' . __( 'Set the Registered Date to the Order Date.', 'usces' ) . '</span></label><br />
644	663	<label for="register_date_0"><input type="radio" name="register_date" id="register_date_0" value="0" /><span>' . __( 'Set the current time to the Order Date.', 'usces' ) . '</span></label></td></tr>';
645		- $html .= '<tr><th>' . __( 'Link key', 'usces' ) . '</th><td colspan="2">' . $order_data['key'] . '</td></tr>';
	664	+ $html .= '<tr><th>' . __( 'Link key', 'usces' ) . '</th><td colspan="2">' . wel_esc_settlement_log( $order_data['key'] ) . '</td></tr>';
646	665	$html .= '</table>';
647	666
648	667	$html .= '<table class="detail-customer">';
649	668	$html .= '<tr class="title"><td colspan="2"><h3>' . __( 'Customer Information', 'usces' ) . '</h3></td></tr>';
		@@ -746,9 +765,9 @@
746	765	$html .= '<tr><th colspan="3">' . __( 'Used points', 'usces' ) . '</th><td class="usedpoint">' . number_format( $usces_entries['order']['usedpoint'] ) . '</td></tr>';
747	766	}
748	767	$html .= '<tr><th colspan="3">' . __( 'Payment amount', 'usces' ) . '</th><td class="total_full_price">' . usces_crform( $usces_entries['order']['total_full_price'], true, false, 'return' ) . '</td></tr>';
749	768	$html .= '</tfoot></table>';
750		- $html .= '<input type="hidden" id="log_key" value="' . $order_data['key'] . '" />';
	769	+ $html .= '<input type="hidden" id="log_key" value="' . esc_attr( $order_data['key'] ) . '" />';
751	770
752	771	$resdata = array();
753	772	$resdata['status'] = 'OK';
754	773	$resdata['result'] = $html;
		@@ -897,14 +916,14 @@
897	916	$log = wel_safe_unserialize( $data['log'] );
898	917	$result = ( ! empty( $log['result'] ) ) ? $log['result'] : '';
899	918	$acting = ( ! empty( $log['acting'] ) ) ? $log['acting'] : '';
900	919	$html .= '<tr>
901		- <td class="check"><input type="checkbox" class="error-log-check" value="' . $data['ID'] . '"></td>
902		- <td class="detail"><input type="button" class="error-log-detail button" id="' . $data['ID'] . '" value="' . __( 'Detail', 'usces' ) . '"></td>
903		- <td class="datetime">' . $data['datetime'] . '</td>
904		- <td class="key">' . $data['log_key'] . '</td>
905		- <td class="payment">' . $acting . '</td>
906		- <td class="status">' . $result . '</td>
	920	+ <td class="check"><input type="checkbox" class="error-log-check" value="' . esc_attr( $data['ID'] ) . '"></td>
	921	+ <td class="detail"><input type="button" class="error-log-detail button" id="' . esc_attr( $data['ID'] ) . '" value="' . esc_attr__( 'Detail', 'usces' ) . '"></td>
	922	+ <td class="datetime">' . esc_html( $data['datetime'] ) . '</td>
	923	+ <td class="key">' . esc_html( $data['log_key'] ) . '</td>
	924	+ <td class="payment">' . wel_esc_settlement_log( $acting ) . '</td>
	925	+ <td class="status">' . wel_esc_settlement_log( $result ) . '</td>
907	926	</tr>';
908	927	}
909	928	$html .= '</table>';
910	929	} else {
		@@ -945,11 +964,11 @@
945	964	$data = $wpdb->get_row( $query, ARRAY_A );
946	965	if ( $data ) {
947	966	$log = wel_safe_unserialize( $data['log'] );
948	967	$html = '<table class="detail">';
949		- $html .= '<tr><th>' . __( 'Register date', 'usces' ) . '</th><td>' . $data['datetime'] . '</td></tr>';
950		- $html .= '<tr><th>' . __( 'Link key', 'usces' ) . '</th><td>' . $log['key'] . '</td></tr>';
951		- $html .= '<tr><th>' . __( 'Result', 'usces' ) . '</th><td>' . $log['result'] . '</td></tr>';
	968	+ $html .= '<tr><th>' . __( 'Register date', 'usces' ) . '</th><td>' . esc_html( $data['datetime'] ) . '</td></tr>';
	969	+ $html .= '<tr><th>' . __( 'Link key', 'usces' ) . '</th><td>' . wel_esc_settlement_log( $log['key'] ) . '</td></tr>';
	970	+ $html .= '<tr><th>' . __( 'Result', 'usces' ) . '</th><td>' . wel_esc_settlement_log( $log['result'] ) . '</td></tr>';
952	971	foreach ( (array) $log['data'] as $key => $value ) {
953	972	if ( in_array( $key, $exemption ) ) {
954	973	continue;
955	974	}
		@@ -958,19 +977,19 @@
958	977	if ( in_array( $key2, $exemption ) ) {
959	978	continue;
960	979	}
961	980	if ( is_array( $value2 ) ) {
962		- $html .= '<tr><th>' . $key . ':' . $key2 . '</th><td>' . esc_html( serialize( $value2 ) ) . '</td></tr>';
	981	+ $html .= '<tr><th>' . esc_html( $key ) . ':' . esc_html( $key2 ) . '</th><td>' . esc_html( serialize( $value2 ) ) . '</td></tr>';
963	982	} else {
964		- $html .= '<tr><th>' . $key . ':' . $key2 . '</th><td>' . esc_html( $value2 ) . '</td></tr>';
	983	+ $html .= '<tr><th>' . esc_html( $key ) . ':' . esc_html( $key2 ) . '</th><td>' . esc_html( $value2 ) . '</td></tr>';
965	984	}
966	985	}
967	986	} else {
968		- $html .= '<tr><th>' . $key . '</th><td>' . esc_html( $value ) . '</td></tr>';
	987	+ $html .= '<tr><th>' . esc_html( $key ) . '</th><td>' . esc_html( $value ) . '</td></tr>';
969	988	}
970	989	}
971	990	$html .= '</table>';
972		- $html .= '<input type="hidden" id="log_id" value="' . $data['ID'] . '" />';
	991	+ $html .= '<input type="hidden" id="log_id" value="' . esc_attr( $data['ID'] ) . '" />';
973	992	}
974	993
975	994	$resdata = array();
976	995	$resdata['status'] = 'OK';
		@@ -1024,9 +1043,15 @@
1024	1043	if ( ! current_user_can( 'wel_manage_order' ) ) {
1025	1044	return false;
1026	1045	}
1027	1046	$datetime = get_option( 'usces_settlement_notice' );
1028		- echo '<div class="message error"><p>' . sprintf( __( "Settlement error has occurred. Please check <a href=\"admin.php?page=usces_orderlist&order_action=settlement_notice\">the settlement error log</a>. The date of occurrence:[ %s ]", 'usces' ), $datetime ) . '</p></div>';
	1047	+ echo '<div class="message error"><p>' . wp_kses_post(
	1048	+ sprintf(
	1049	+ /* translators: %s: date and time when the settlement error occurred */
	1050	+ __( 'Settlement error has occurred. Please check <a href="admin.php?page=usces_orderlist&order_action=settlement_notice">the settlement error log</a>. The date of occurrence:[ %s ]', 'usces' ),
	1051	+ $datetime
	1052	+ )
	1053	+ ) . '</p></div>';
1029	1054	}
1030	1055
1031	1056	/**
1032	1057	* 決済エラーログダウンロード