| @@ -1885,9 +1885,12 @@ | ||
| 1885 | 1885 | $vbo_tn = VikBooking::getTranslator(); |
| 1886 | 1886 | |
| 1887 | 1887 | if ($row['status'] == 'confirmed' && !(VikBooking::multiplePayments() && $row['paymcount'] > 0)) { |
| 1888 | 1888 | // booking can be paid only if not confirmed or if multiple payments are enabled and payment counter for booking greater than zero |
| 1889 | - VBOHttpDocument::getInstance()->close(409, 'Conflicting and unexpected payment validation for this reservation'); | |
| 1889 | + if (empty($row['idorderota']) || !empty($row['totpaid'])) { | |
| 1890 | + // accept only the first payment for an OTA reservation | |
| 1891 | + VBOHttpDocument::getInstance()->close(409, 'Conflicting and unexpected payment validation for this reservation'); | |
| 1892 | + } | |
| 1890 | 1893 | } |
| 1891 | 1894 | |
| 1892 | 1895 | /** |
| 1893 | 1896 | * Check split stay reservation data. |
| @@ -3268,13 +3271,18 @@ | ||
| 3268 | 3271 | |
| 3269 | 3272 | foreach ($pguests as $ind => $adults) { |
| 3270 | 3273 | foreach ($adults as $aduind => $details) { |
| 3271 | 3274 | foreach ($details as $detkey => $detval) { |
| 3275 | + // accept no raw HTML tags as keys | |
| 3276 | + $detkey = htmlspecialchars(strip_tags($detkey)); | |
| 3277 | + if (!$detkey) { | |
| 3278 | + continue; | |
| 3279 | + } | |
| 3272 | 3280 | if (!in_array($detkey, $front_keys)) { |
| 3273 | 3281 | // push the key of the guest details for later comparison |
| 3274 | 3282 | array_push($front_keys, $detkey); |
| 3275 | 3283 | } |
| 3276 | - if (strlen($detval)) { | |
| 3284 | + if (is_scalar($detval) && strlen($detval)) { | |
| 3277 | 3285 | // push value only if not empty |
| 3278 | 3286 | if (!isset($guests_details[$ind])) { |
| 3279 | 3287 | $guests_details[$ind] = array(); |
| 3280 | 3288 | } |
| @@ -3303,8 +3311,13 @@ | ||
| 3303 | 3311 | // current pax data include a guest not present, set it to not lose it |
| 3304 | 3312 | $guests_details[$ind][$aduind] = $details; |
| 3305 | 3313 | } |
| 3306 | 3314 | foreach ($details as $detkey => $detval) { |
| 3315 | + // accept no raw HTML tags as keys | |
| 3316 | + $detkey = htmlspecialchars(strip_tags($detkey)); | |
| 3317 | + if (!$detkey) { | |
| 3318 | + continue; | |
| 3319 | + } | |
| 3307 | 3320 | if (!in_array($detkey, $front_keys)) { |
| 3308 | 3321 | // merge this key probably reserved to the back-end |
| 3309 | 3322 | $guests_details[$ind][$aduind][$detkey] = $detval; |
| 3310 | 3323 | } |
