lainwir3d/dolibarr
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix usage of PAYMENT_SECURITY_TOKEN

Browse Source
This commit is contained in:
Laurent Destailleur 2018-01-17 18:00:05 +01:00
parent 81999be027
commit 4034122169
4 changed files with 39 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

24
htdocs/public/paybox/newpayment.php
View File

@ -123,6 +123,30 @@ $urlko=preg_replace('/&$/','',$urlko); // Remove last &
// Check security token
$valid=true;
if (! empty($conf->global->PAYMENT_SECURITY_TOKEN))
{
if (! empty($conf->global->PAYMENT_SECURITY_TOKEN_UNIQUE))
{
if ($SOURCE && $REF) $token = dol_hash($conf->global->PAYMENT_SECURITY_TOKEN . $SOURCE . $REF, 2); // Use the source in the hash to avoid duplicates if the references are identical
else $token = dol_hash($conf->global->PAYMENT_SECURITY_TOKEN, 2);
}
else
{
$token = $conf->global->PAYMENT_SECURITY_TOKEN;
}
if ($SECUREKEY != $token)
{
if (empty($conf->global->PAYMENT_SECURITY_ACCEPT_ANY_TOKEN)) $valid=false; // PAYMENT_SECURITY_ACCEPT_ANY_TOKEN is for backward compatibility
else dol_syslog("Warning: PAYMENT_SECURITY_ACCEPT_ANY_TOKEN is on", LOG_WARNING);
}
if (! $valid)
{
print '<div class="error">Bad value for key.</div>';
//print 'SECUREKEY='.$SECUREKEY.' token='.$token.' valid='.$valid;
exit;
}
}
/*

6
htdocs/public/payment/newpayment.php
View File

@ -230,7 +230,11 @@ if (! empty($conf->global->PAYMENT_SECURITY_TOKEN))
{
$token = $conf->global->PAYMENT_SECURITY_TOKEN;
}
if ($SECUREKEY != $token) $valid=false;
if ($SECUREKEY != $token)
{
if (empty($conf->global->PAYMENT_SECURITY_ACCEPT_ANY_TOKEN)) $valid=false; // PAYMENT_SECURITY_ACCEPT_ANY_TOKEN is for backward compatibility
else dol_syslog("Warning: PAYMENT_SECURITY_ACCEPT_ANY_TOKEN is on", LOG_WARNING);
}
if (! $valid)
{

6
htdocs/public/paypal/newpayment.php
View File

@ -170,7 +170,11 @@ if (! empty($conf->global->PAYPAL_SECURITY_TOKEN))
{
$token = $conf->global->PAYPAL_SECURITY_TOKEN;
}
if ($SECUREKEY != $token) $valid=false;
if ($SECUREKEY != $token)
{
if (empty($conf->global->PAYMENT_SECURITY_ACCEPT_ANY_TOKEN)) $valid=false; // PAYMENT_SECURITY_ACCEPT_ANY_TOKEN is for backward compatibility
else dol_syslog("Warning: PAYMENT_SECURITY_ACCEPT_ANY_TOKEN is on", LOG_WARNING);
}
if (! $valid)
{

6
htdocs/public/stripe/newpayment.php
View File

@ -174,7 +174,11 @@ if (! empty($conf->global->STRIPE_SECURITY_TOKEN))
{
$token = $conf->global->STRIPE_SECURITY_TOKEN;
}
if ($SECUREKEY != $token) $valid=false;
if ($SECUREKEY != $token)
{
if (empty($conf->global->PAYMENT_SECURITY_ACCEPT_ANY_TOKEN)) $valid=false; // PAYMENT_SECURITY_ACCEPT_ANY_TOKEN is for backward compatibility
else dol_syslog("Warning: PAYMENT_SECURITY_ACCEPT_ANY_TOKEN is on", LOG_WARNING);
}
if (! $valid)
{