diff --git a/htdocs/public/eventorganization/attendee_new.php b/htdocs/public/eventorganization/attendee_new.php index b350ece39f4..55303bcb00e 100644 --- a/htdocs/public/eventorganization/attendee_new.php +++ b/htdocs/public/eventorganization/attendee_new.php @@ -19,16 +19,6 @@ * \file htdocs/public/eventorganization/attendee_new.php * \ingroup project * \brief Example of form to subscribe to an event - * - * Note that you can add following constant to change behaviour of page - * MEMBER_NEWFORM_AMOUNT Default amount for auto-subscribe form - * MEMBER_NEWFORM_EDITAMOUNT 0 or 1 = Amount can be edited - * MEMBER_NEWFORM_PAYONLINE Suggest payment with paypal, paybox or stripe - * MEMBER_NEWFORM_DOLIBARRTURNOVER Show field turnover (specific for dolibarr foundation) - * MEMBER_URL_REDIRECT_SUBSCRIPTION Url to redirect once subscribe submitted - * MEMBER_NEWFORM_FORCETYPE Force type of member - * MEMBER_NEWFORM_FORCEMORPHY Force nature of member (mor/phy) - * MEMBER_NEWFORM_FORCECOUNTRYCODE Force country */ if (!defined('NOLOGIN')) { diff --git a/htdocs/public/members/new.php b/htdocs/public/members/new.php index 6589f2a17d0..055ffec56f9 100644 --- a/htdocs/public/members/new.php +++ b/htdocs/public/members/new.php @@ -30,6 +30,7 @@ * Note that you can add following constant to change behaviour of page * MEMBER_NEWFORM_AMOUNT Default amount for auto-subscribe form * MEMBER_NEWFORM_EDITAMOUNT 0 or 1 = Amount can be edited + * MEMBER_MIN_AMOUNT Minimum amount * MEMBER_NEWFORM_PAYONLINE Suggest payment with paypal, paybox or stripe * MEMBER_NEWFORM_DOLIBARRTURNOVER Show field turnover (specific for dolibarr foundation) * MEMBER_URL_REDIRECT_SUBSCRIPTION Url to redirect once subscribe submitted diff --git a/htdocs/public/payment/newpayment.php b/htdocs/public/payment/newpayment.php index 5158e294fb2..d25e14288f8 100644 --- a/htdocs/public/payment/newpayment.php +++ b/htdocs/public/payment/newpayment.php @@ -481,7 +481,7 @@ if ($action == 'dopayment') { // Called when choosing Stripe mode. -// When using the Charge API architecture, this code is called after clicking the 'dopayment' with the Charge API architecture. +// When using the old Charge API architecture, this code is called after clicking the 'dopayment' with the Charge API architecture. // When using the PaymentIntent API architecture, the Stripe customer was already created when creating PaymentIntent when showing payment page, and the payment is already ok when action=charge. if ($action == 'charge' && !empty($conf->stripe->enabled)) { $amountstripe = $amount; @@ -728,7 +728,7 @@ if ($action == 'charge' && !empty($conf->stripe->enabled)) { } } - // When using the PaymentIntent API architecture + // When using the PaymentIntent API architecture (mode set on by default into conf.class.php) if (!empty($conf->global->STRIPE_USE_INTENT_WITH_AUTOMATIC_CONFIRMATION)) { $service = 'StripeTest'; $servicestatus = 0; @@ -793,8 +793,8 @@ if ($action == 'charge' && !empty($conf->stripe->enabled)) { $remoteip = getUserRemoteIP(); $_SESSION["onlinetoken"] = $stripeToken; - $_SESSION["FinalPaymentAmt"] = $amount; - $_SESSION["currencyCodeType"] = $currency; + $_SESSION["FinalPaymentAmt"] = $amount; // amount really paid (coming from Stripe). Will be used for check in paymentok.php. + $_SESSION["currencyCodeType"] = $currency; // currency really used for payment (coming from Stripe). Will be used for check in paymentok.php. $_SESSION["paymentType"] = ''; $_SESSION['ipaddress'] = ($remoteip ? $remoteip : 'unknown'); // Payer ip $_SESSION['payerID'] = is_object($customer) ? $customer->id : ''; diff --git a/htdocs/public/payment/paymentok.php b/htdocs/public/payment/paymentok.php index c822bfcdf96..ea86f28a894 100644 --- a/htdocs/public/payment/paymentok.php +++ b/htdocs/public/payment/paymentok.php @@ -417,7 +417,7 @@ if ($ispaymentok) { // Do action only if $FinalPaymentAmt is set (session variable is cleaned after this page to avoid duplicate actions when page is POST a second time) if (!empty($FinalPaymentAmt) && $paymentTypeId > 0) { // Security protection: - if (empty($conf->global->MEMBER_NEWFORM_EDITAMOUNT)) { // If we didn't allow members to choose their membership amount + if (empty($conf->global->MEMBER_NEWFORM_EDITAMOUNT)) { // If we didn't allow members to choose their membership amount (if free amount is allowed, no need to check) if ($object->status == $object::STATUS_DRAFT) { // If the member is not yet validated, we check that the amount is the same as expected. $typeid = $object->typeid; @@ -440,6 +440,17 @@ if ($ispaymentok) { } } + // Security protection: + if (!empty($conf->global->MEMBER_MIN_AMOUNT)) { + if ($FinalPaymentAmt < $conf->global->MEMBER_MIN_AMOUNT) { + $error++; + $errmsg = 'Value of FinalPayment ('.$FinalPaymentAmt.') is lower than the minimum allowed ('.$conf->global->MEMBER_MIN_AMOUNT.'). May be a hack to try to pay a different amount ?'; + $postactionmessages[] = $errmsg; + $ispostactionok = -1; + dol_syslog("Failed to validate member (amount lower than minimum): ".$errmsg, LOG_ERR, 0, '_payment'); + } + } + // Security protection: if ($currencyCodeType && $currencyCodeType != $conf->currency) { // Check that currency is the good one $error++; diff --git a/htdocs/public/project/suggestbooth.php b/htdocs/public/project/suggestbooth.php index c0bcdc751c6..39c2a57700e 100644 --- a/htdocs/public/project/suggestbooth.php +++ b/htdocs/public/project/suggestbooth.php @@ -19,16 +19,6 @@ * \file htdocs/public/project/suggestbooth.php * \ingroup member * \brief Example of form to suggest a booth - * - * Note that you can add following constant to change behaviour of page - * MEMBER_NEWFORM_AMOUNT Default amount for auto-subscribe form - * MEMBER_NEWFORM_EDITAMOUNT 0 or 1 = Amount can be edited - * MEMBER_NEWFORM_PAYONLINE Suggest payment with paypal, paybox or stripe - * MEMBER_NEWFORM_DOLIBARRTURNOVER Show field turnover (specific for dolibarr foundation) - * MEMBER_URL_REDIRECT_SUBSCRIPTION Url to redirect once subscribe submitted - * MEMBER_NEWFORM_FORCETYPE Force type of member - * MEMBER_NEWFORM_FORCEMORPHY Force nature of member (mor/phy) - * MEMBER_NEWFORM_FORCECOUNTRYCODE Force country */ if (!defined('NOLOGIN')) { diff --git a/htdocs/public/project/suggestconference.php b/htdocs/public/project/suggestconference.php index f2a919c0aa2..b97777c3a9a 100644 --- a/htdocs/public/project/suggestconference.php +++ b/htdocs/public/project/suggestconference.php @@ -19,16 +19,6 @@ * \file htdocs/public/project/suggestconference.php * \ingroup member * \brief Example of form to suggest a conference - * - * Note that you can add following constant to change behaviour of page - * MEMBER_NEWFORM_AMOUNT Default amount for auto-subscribe form - * MEMBER_NEWFORM_EDITAMOUNT 0 or 1 = Amount can be edited - * MEMBER_NEWFORM_PAYONLINE Suggest payment with paypal, paybox or stripe - * MEMBER_NEWFORM_DOLIBARRTURNOVER Show field turnover (specific for dolibarr foundation) - * MEMBER_URL_REDIRECT_SUBSCRIPTION Url to redirect once subscribe submitted - * MEMBER_NEWFORM_FORCETYPE Force type of member - * MEMBER_NEWFORM_FORCEMORPHY Force nature of member (mor/phy) - * MEMBER_NEWFORM_FORCECOUNTRYCODE Force country */ if (!defined('NOLOGIN')) {