| @@ -183,16 +183,19 @@ | ||
| 183 | 183 | |
| 184 | 184 | # Called in admin-post and will finalize a Vipps Checkout order + send the customer to the payment page. |
| 185 | 185 | public function choose_other_gw () { |
| 186 | 186 | $orderid = intval($_GET['o']); |
| 187 | + | |
| 188 | + | |
| 187 | 189 | $gw = trim(sanitize_title($_GET['gw'])); |
| 188 | 190 | if ($gw == 'any') $gw = ""; |
| 189 | 191 | $nonce = $_GET['cb']; |
| 190 | - $ok = wp_verify_nonce($nonce, 'vipps_gw'); | |
| 192 | + $ok = wp_verify_nonce($nonce, 'vipps_gw_' . $orderid); | |
| 191 | 193 | if (!$ok) { |
| 192 | 194 | $this->abandonVippsCheckoutOrder(false); |
| 193 | 195 | $this->log(sprintf(__("Orderid %1\$s: Wrong nonce when trying to switch payment methods.", 'woo-vipps'), $orderid), 'error'); |
| 194 | 196 | wp_redirect(home_url()); |
| 197 | + exit(); | |
| 195 | 198 | } |
| 196 | 199 | $order = wc_get_order($orderid); |
| 197 | 200 | if (!$order || $order->get_status() != 'pending') { |
| 198 | 201 | $this->abandonVippsCheckoutOrder(false); |
| @@ -197,8 +200,9 @@ | ||
| 197 | 200 | if (!$order || $order->get_status() != 'pending') { |
| 198 | 201 | $this->abandonVippsCheckoutOrder(false); |
| 199 | 202 | $this->log(sprintf(__("Orderid %1\$s is not pending when choosing another payment method from Vipps Checkout", 'woo-vipps'), $orderid), 'error'); |
| 200 | 203 | wp_redirect(home_url()); |
| 204 | + exit(); | |
| 201 | 205 | } |
| 202 | 206 | |
| 203 | 207 | try { |
| 204 | 208 | // Load session from cookies - it will not get loaded on admin-post. |
| @@ -207,8 +211,19 @@ | ||
| 207 | 211 | if (WC()->session) { |
| 208 | 212 | if (! WC()->session->has_session()) { |
| 209 | 213 | WC()->session->set_customer_session_cookie( true ); |
| 210 | 214 | } |
| 215 | + | |
| 216 | + // Check to see if we actually are paying for an order in session IOK 2026-09-24 | |
| 217 | + $current_pending = WC()->session->get('vipps_checkout_current_pending'); | |
| 218 | + | |
| 219 | + if ($orderid != $current_pending) { | |
| 220 | + $this->abandonVippsCheckoutOrder(false); | |
| 221 | + $this->log(sprintf(__("Orderid %1\$s: Wrong current pending order when trying to switch payment methods.", 'woo-vipps'), $orderid), 'error'); | |
| 222 | + wp_redirect(home_url()); | |
| 223 | + exit(); | |
| 224 | + } | |
| 225 | + | |
| 211 | 226 | // There is actually a bug here for KCO which will redirect to the normal checkout page with an error message. |
| 212 | 227 | // Try to stop that.. IOK 2024-05-15 |
| 213 | 228 | if ($gw != 'kco') { |
| 214 | 229 | WC()->session->set('chosen_payment_method', $gw); |
