From 5c58ed8ca78bc1aafdee3f817afcf14e03c83650 Mon Sep 17 00:00:00 2001 From: Laurent Destailleur Date: Fri, 2 Jun 2017 09:13:04 +0200 Subject: [PATCH] Add a better error message when payment link is not valid. --- htdocs/core/lib/functions.lib.php | 8 +- htdocs/langs/en_US/errors.lang | 1 + htdocs/langs/en_US/projects.lang | 2 +- htdocs/public/paybox/newpayment.php | 77 +++++++++-------- htdocs/public/payment/newpayment.php | 123 ++++++++++++++------------- htdocs/public/paypal/newpayment.php | 83 ++++++++++-------- htdocs/public/stripe/newpayment.php | 96 +++++++++++---------- 7 files changed, 217 insertions(+), 173 deletions(-) diff --git a/htdocs/core/lib/functions.lib.php b/htdocs/core/lib/functions.lib.php index dd4f720b378..ef03b0c00cc 100644 --- a/htdocs/core/lib/functions.lib.php +++ b/htdocs/core/lib/functions.lib.php @@ -3235,15 +3235,19 @@ function dol_print_error($db='',$error='',$errors=null) * Show a public email and error code to contact if technical error * * @param string $prefixcode Prefix of public error code + * @param string $errormessage Complete error message * @return void */ -function dol_print_error_email($prefixcode) +function dol_print_error_email($prefixcode, $errormessage='') { global $langs,$conf; $langs->load("errors"); $now=dol_now(); - print '
'.$langs->trans("ErrorContactEMail", $conf->global->MAIN_INFO_SOCIETE_MAIL, $prefixcode.dol_print_date($now,'%Y%m%d')).'
'; + print '
'; + print $langs->trans("ErrorContactEMail", $conf->global->MAIN_INFO_SOCIETE_MAIL, $prefixcode.dol_print_date($now,'%Y%m%d')); + if ($errormessage) print '

'.$errormessage; + print '
'; } /** diff --git a/htdocs/langs/en_US/errors.lang b/htdocs/langs/en_US/errors.lang index 740397a5044..0f49bd832d6 100644 --- a/htdocs/langs/en_US/errors.lang +++ b/htdocs/langs/en_US/errors.lang @@ -190,6 +190,7 @@ ErrorModuleFileSeemsToHaveAWrongFormat=The module package seems to have a wrong ErrorFilenameDosNotMatchDolibarrPackageRules=The name of the module package (%s) does not match expected name syntax: %s ErrorDuplicateTrigger=Error, duplicate trigger name %s. Already loaded from %s. ErrorNoWarehouseDefined=Error, no warehouses defined. +ErrorBadLinkSourceSetButBadValueForRef=The link you use is not valid. A 'source' for payment is defined, but value for 'ref' is not valid. # Warnings WarningPasswordSetWithNoAccount=A password was set for this member. However, no user account was created. So this password is stored but can't be used to login to Dolibarr. It may be used by an external module/interface but if you don't need to define any login nor password for a member, you can disable option "Manage a login for each member" from Member module setup. If you need to manage a login but don't need any password, you can keep this field empty to avoid this warning. Note: Email can also be used as a login if the member is linked to a user. diff --git a/htdocs/langs/en_US/projects.lang b/htdocs/langs/en_US/projects.lang index c98c2120e21..27db2976b2a 100644 --- a/htdocs/langs/en_US/projects.lang +++ b/htdocs/langs/en_US/projects.lang @@ -185,7 +185,7 @@ ProjectsStatistics=Statistics on projects/leads TaskAssignedToEnterTime=Task assigned. Entering time on this task should be possible. IdTaskTime=Id task time YouCanCompleteRef=If you want to complete the ref with some information (to use it as search filters), it is recommanded to add a - character to separate it, so the automatic numbering will still work correctly for next projects. For example %s-ABC. You may also prefer to add search keys into label. But best practice may be to add a dedicated field, also called complementary attributes. -OpenedProjectsByThirdparties=Open projects by thirdparties +OpenedProjectsByThirdparties=Open projects by third parties OnlyOpportunitiesShort=Only opportunities OpenedOpportunitiesShort=Open opportunities NotAnOpportunityShort=Not an opportunity diff --git a/htdocs/public/paybox/newpayment.php b/htdocs/public/paybox/newpayment.php index c3aff6341cc..97a4c5452ff 100644 --- a/htdocs/public/paybox/newpayment.php +++ b/htdocs/public/paybox/newpayment.php @@ -135,7 +135,7 @@ if (GETPOST('action','aZ09') == 'dopayment') $email=GETPOST("email"); $origfulltag=GETPOST("fulltag",'alpha'); - + $mesg=''; if (empty($PRICE) || ! is_numeric($PRICE)) $mesg=$langs->trans("ErrorFieldRequired",$langs->transnoentitiesnoconv("Amount")); elseif (empty($email)) $mesg=$langs->trans("ErrorFieldRequired",$langs->transnoentitiesnoconv("YourEMail")); @@ -143,7 +143,7 @@ if (GETPOST('action','aZ09') == 'dopayment') elseif (! $origfulltag) $mesg=$langs->trans("ErrorFieldRequired",$langs->transnoentitiesnoconv("PaymentCode")); elseif (dol_strlen($urlok) > 150) $mesg='Error urlok too long '.$urlok; elseif (dol_strlen($urlko) > 150) $mesg='Error urlko too long '.$urlko; - + if (empty($mesg)) { dol_syslog("newpayment.php call paybox api and do redirect", LOG_DEBUG); @@ -169,13 +169,22 @@ $conf->dol_hide_leftmenu=1; llxHeader($head, $langs->trans("PaymentForm"), '', '', 0, 0, '', '', '', 'onlinepaymentbody'); - // Common variables $creditor=$mysoc->name; $paramcreditor='PAYBOX_CREDITOR_'.$suffix; if (! empty($conf->global->$paramcreditor)) $creditor=$conf->global->$paramcreditor; else if (! empty($conf->global->PAYBOX_CREDITOR)) $creditor=$conf->global->PAYBOX_CREDITOR; +// Check link validity +if (! empty($SOURCE) && in_array($ref, array('member_ref', 'contractline_ref', 'invoice_ref', 'order_ref', ''))) +{ + $langs->load("errors"); + dol_print_error_email('BADREFINPAYMENTFORM', $langs->trans("ErrorBadLinkSourceSetButBadValueForRef", $SOURCE, $ref)); + llxFooter(); + $db->close(); + exit; +} + print ''."\n"; print '
'; print '
'; @@ -258,14 +267,14 @@ if (! GETPOST("source") && $valid) $fulltag=$tag; // Creditor - + print ''.$langs->trans("Creditor"); print ''.$creditor.''; print ''; print ''."\n"; // Amount - + print ''.$langs->trans("Amount"); if (empty($amount)) print ' ('.$langs->trans("ToComplete").')'; print ''; @@ -286,7 +295,7 @@ if (! GETPOST("source") && $valid) print ''."\n"; // Tag - + print ''.$langs->trans("PaymentCode"); print ''.$fulltag.''; print ''; @@ -294,7 +303,7 @@ if (! GETPOST("source") && $valid) print ''."\n"; // EMail - + print ''.$langs->trans("YourEMail"); print ' ('.$langs->trans("ToComplete").')'; print ''."\n"; @@ -331,19 +340,19 @@ if (GETPOST("source") == 'order' && $valid) $fulltag=dol_string_unaccent($fulltag); // Creditor - + print ''.$langs->trans("Creditor"); print ''.$creditor.''; print ''; print ''."\n"; // Debitor - + print ''.$langs->trans("ThirdParty"); print ''.$order->thirdparty->name.''; // Object - + $text=''.$langs->trans("PaymentOrderRef",$order->ref).''; print ''.$langs->trans("Designation"); print ''.$text; @@ -352,7 +361,7 @@ if (GETPOST("source") == 'order' && $valid) print ''."\n"; // Amount - + print ''.$langs->trans("Amount"); if (empty($amount)) print ' ('.$langs->trans("ToComplete").')'; print ''; @@ -372,7 +381,7 @@ if (GETPOST("source") == 'order' && $valid) print ''."\n"; // Tag - + print ''.$langs->trans("PaymentCode"); print ''.$fulltag.''; print ''; @@ -380,7 +389,7 @@ if (GETPOST("source") == 'order' && $valid) print ''."\n"; // EMail - + print ''.$langs->trans("YourEMail"); print ' ('.$langs->trans("ToComplete").')'; $email=$order->thirdparty->email; @@ -419,19 +428,19 @@ if (GETPOST("source") == 'invoice' && $valid) $fulltag=dol_string_unaccent($fulltag); // Creditor - + print ''.$langs->trans("Creditor"); print ''.$creditor.''; print ''; print ''."\n"; // Debitor - + print ''.$langs->trans("ThirdParty"); print ''.$invoice->thirdparty->name.''; // Object - + $text=''.$langs->trans("PaymentInvoiceRef",$invoice->ref).''; print ''.$langs->trans("Designation"); print ''.$text; @@ -440,7 +449,7 @@ if (GETPOST("source") == 'invoice' && $valid) print ''."\n"; // Amount - + print ''.$langs->trans("Amount"); if (empty($amount)) print ' ('.$langs->trans("ToComplete").')'; print ''; @@ -460,7 +469,7 @@ if (GETPOST("source") == 'invoice' && $valid) print ''."\n"; // Tag - + print ''.$langs->trans("PaymentCode"); print ''.$fulltag.''; print ''; @@ -468,7 +477,7 @@ if (GETPOST("source") == 'invoice' && $valid) print ''."\n"; // EMail - + print ''.$langs->trans("YourEMail"); print ' ('.$langs->trans("ToComplete").')'; $email=$invoice->thirdparty->email; @@ -553,19 +562,19 @@ if (GETPOST("source") == 'contractline' && $valid) if (GETPOST('qty')) $qty=GETPOST('qty'); // Creditor - + print ''.$langs->trans("Creditor"); print ''.$creditor.''; print ''; print ''."\n"; // Debitor - + print ''.$langs->trans("ThirdParty"); print ''.$contract->thirdparty->name.''; // Object - + $text=''.$langs->trans("PaymentRenewContractId",$contract->ref,$contractline->ref).''; if ($contractline->fk_product) { @@ -588,7 +597,7 @@ if (GETPOST("source") == 'contractline' && $valid) print ''."\n"; // Quantity - + $label=$langs->trans("Quantity"); $qty=1; $duration=''; @@ -616,7 +625,7 @@ if (GETPOST("source") == 'contractline' && $valid) print ''."\n"; // Amount - + print ''.$langs->trans("Amount"); if (empty($amount)) print ' ('.$langs->trans("ToComplete").')'; print ''; @@ -636,7 +645,7 @@ if (GETPOST("source") == 'contractline' && $valid) print ''."\n"; // Tag - + print ''.$langs->trans("PaymentCode"); print ''.$fulltag.''; print ''; @@ -644,7 +653,7 @@ if (GETPOST("source") == 'contractline' && $valid) print ''."\n"; // EMail - + print ''.$langs->trans("YourEMail"); print ' ('.$langs->trans("ToComplete").')'; $email=$contract->thirdparty->email; @@ -684,14 +693,14 @@ if (GETPOST("source") == 'membersubscription' && $valid) $fulltag=dol_string_unaccent($fulltag); // Creditor - + print ''.$langs->trans("Creditor"); print ''.$creditor.''; print ''; print ''."\n"; // Debitor - + print ''.$langs->trans("Member"); print ''; if ($member->morphy == 'mor' && ! empty($member->societe)) print $member->societe; @@ -699,7 +708,7 @@ if (GETPOST("source") == 'membersubscription' && $valid) print ''; // Object - + $text=''.$langs->trans("PaymentSubscription").''; print ''.$langs->trans("Designation"); print ''.$text; @@ -710,13 +719,13 @@ if (GETPOST("source") == 'membersubscription' && $valid) if ($member->last_subscription_date || $member->last_subscription_amount) { // Last subscription date - + print ''.$langs->trans("LastSubscriptionDate"); print ''.dol_print_date($member->last_subscription_date,'day'); print ''."\n"; // Last subscription amount - + print ''.$langs->trans("LastSubscriptionAmount"); print ''.price($member->last_subscription_amount); print ''."\n"; @@ -725,7 +734,7 @@ if (GETPOST("source") == 'membersubscription' && $valid) } // Amount - + print ''.$langs->trans("Amount"); if (empty($amount)) print ' ('.$langs->trans("ToComplete").')'; print ''; @@ -749,7 +758,7 @@ if (GETPOST("source") == 'membersubscription' && $valid) print ''."\n"; // Tag - + print ''.$langs->trans("PaymentCode"); print ''.$fulltag.''; print ''; @@ -757,7 +766,7 @@ if (GETPOST("source") == 'membersubscription' && $valid) print ''."\n"; // EMail - + print ''.$langs->trans("YourEMail"); $email=$member->email; $email=(GETPOST("email")?GETPOST("email"):(isValidEmail($email)?$email:'')); diff --git a/htdocs/public/payment/newpayment.php b/htdocs/public/payment/newpayment.php index 788321b6212..cdfaaa2afc6 100644 --- a/htdocs/public/payment/newpayment.php +++ b/htdocs/public/payment/newpayment.php @@ -156,10 +156,10 @@ $urlko=preg_replace('/&$/','',$urlko); // Remove last & if (! empty($conf->paypal->enabled)) { $langs->load("paypal"); - + require_once DOL_DOCUMENT_ROOT.'/paypal/lib/paypal.lib.php'; require_once DOL_DOCUMENT_ROOT.'/paypal/lib/paypalfunctions.lib.php'; - + $PAYPAL_API_OK=""; if ($urlok) $PAYPAL_API_OK=$urlok; $PAYPAL_API_KO=""; @@ -194,7 +194,7 @@ if (! empty($conf->paypal->enabled)) $token = $conf->global->PAYPAL_SECURITY_TOKEN; } if ($SECUREKEY != $token) $valid=false; - + if (! $valid) { print '
Bad value for key.
'; @@ -202,16 +202,16 @@ if (! empty($conf->paypal->enabled)) exit; } } - + $validpaymentmethod['paypal']='valid'; } if (! empty($conf->paybox->enabled)) { $langs->load("paybox"); - + // TODO - + $validpaymentmethod['paybox']='valid'; } @@ -256,10 +256,10 @@ if (empty($validpaymentmethod)) accessforbidden('', 0, 0, 1); if ($action == 'dopayment') { if ($paymentmethod == 'paypal') - { + { $PAYPAL_API_PRICE=price2num(GETPOST("newamount"),'MT'); $PAYPAL_PAYMENT_TYPE='Sale'; - + $origfulltag=GETPOST("fulltag",'alpha'); $shipToName=GETPOST("shipToName"); $shipToStreet=GETPOST("shipToStreet"); @@ -271,24 +271,24 @@ if ($action == 'dopayment') $phoneNum=GETPOST("phoneNum"); $email=GETPOST("email"); $desc=GETPOST("desc"); - + $mesg=''; if (empty($PAYPAL_API_PRICE) || ! is_numeric($PAYPAL_API_PRICE)) $mesg=$langs->trans("ErrorFieldRequired",$langs->transnoentitiesnoconv("Amount")); //elseif (empty($EMAIL)) $mesg=$langs->trans("ErrorFieldRequired",$langs->transnoentitiesnoconv("YourEMail")); //elseif (! isValidEMail($EMAIL)) $mesg=$langs->trans("ErrorBadEMail",$EMAIL); elseif (! $origfulltag) $mesg=$langs->trans("ErrorFieldRequired",$langs->transnoentitiesnoconv("PaymentCode")); - + //var_dump($_POST); if (empty($mesg)) { dol_syslog("newpayment.php call paypal api and do redirect", LOG_DEBUG); - + // Other $PAYPAL_API_DEVISE="USD"; //if ($currency == 'EUR') $PAYPAL_API_DEVISE="EUR"; //if ($currency == 'USD') $PAYPAL_API_DEVISE="USD"; if (! empty($currency)) $PAYPAL_API_DEVISE=$currency; - + dol_syslog("Submit Paypal form", LOG_DEBUG); dol_syslog("PAYPAL_API_USER: $PAYPAL_API_USER", LOG_DEBUG); //dol_syslog("PAYPAL_API_PASSWORD: $PAYPAL_API_PASSWORD", LOG_DEBUG); // No password into log files @@ -308,15 +308,15 @@ if ($action == 'dopayment') dol_syslog("phoneNum: $phoneNum", LOG_DEBUG); dol_syslog("email: $email", LOG_DEBUG); dol_syslog("desc: $desc", LOG_DEBUG); - + dol_syslog("SCRIPT_URI: ".(empty($_SERVER["SCRIPT_URI"])?'':$_SERVER["SCRIPT_URI"]), LOG_DEBUG); // If defined script uri must match domain of PAYPAL_API_OK and PAYPAL_API_KO //$_SESSION["PaymentType"]=$PAYPAL_PAYMENT_TYPE; //$_SESSION["currencyCodeType"]=$PAYPAL_API_DEVISE; //$_SESSION["Payment_Amount"]=$PAYPAL_API_PRICE; - + // A redirect is added if API call successfull print_paypal_redirect($PAYPAL_API_PRICE,$PAYPAL_API_DEVISE,$PAYPAL_PAYMENT_TYPE,$PAYPAL_API_OK,$PAYPAL_API_KO, $FULLTAG); - + exit; } } @@ -335,19 +335,28 @@ $conf->dol_hide_leftmenu=1; llxHeader($head, $langs->trans("PaymentForm"), '', '', 0, 0, '', '', '', 'onlinepaymentbody'); +// Check link validity +if (! empty($SOURCE) && in_array($ref, array('member_ref', 'contractline_ref', 'invoice_ref', 'order_ref', ''))) +{ + $langs->load("errors"); + dol_print_error_email('BADREFINPAYMENTFORM', $langs->trans("ErrorBadLinkSourceSetButBadValueForRef", $SOURCE, $ref)); + llxFooter(); + $db->close(); + exit; +} if (! empty($conf->paypal->enabled)) { - if (! empty($PAYPAL_API_SANDBOX)) - { - dol_htmloutput_mesg($langs->trans('YouAreCurrentlyInSandboxMode'),'','warning'); - } - // Common variables $creditor=$mysoc->name; $paramcreditor='PAYPAL_CREDITOR_'.$suffix; if (! empty($conf->global->$paramcreditor)) $creditor=$conf->global->$paramcreditor; else if (! empty($conf->global->PAYPAL_CREDITOR)) $creditor=$conf->global->PAYPAL_CREDITOR; + + if (! empty($PAYPAL_API_SANDBOX)) + { + dol_htmloutput_mesg($langs->trans('YouAreCurrentlyInSandboxMode'),'','warning'); + } } print ''."\n"; @@ -442,14 +451,14 @@ if (! GETPOST("source")) $fulltag=$tag; // Creditor - + print ''.$langs->trans("Creditor"); print ''.$creditor.''; print ''; print ''."\n"; // Amount - + print ''.$langs->trans("Amount"); if (empty($amount)) print ' ('.$langs->trans("ToComplete").')'; print ''; @@ -469,7 +478,7 @@ if (! GETPOST("source")) print ''."\n"; // Tag - + print ''.$langs->trans("PaymentCode"); print ''.$fulltag.''; print ''; @@ -507,26 +516,26 @@ if (GETPOST("source") == 'order') if (GETPOST("amount",'int')) $amount=GETPOST("amount",'int'); $amount=price2num($amount); } - + $fulltag='ORD='.$order->ref.'.CUS='.$order->thirdparty->id; //$fulltag.='.NAM='.strtr($order->thirdparty->name,"-"," "); if (! empty($TAG)) { $tag=$TAG; $fulltag.='.TAG='.$TAG; } $fulltag=dol_string_unaccent($fulltag); // Creditor - + print ''.$langs->trans("Creditor"); print ''.$creditor.''; print ''; print ''."\n"; // Debitor - + print ''.$langs->trans("ThirdParty"); print ''.$order->thirdparty->name.''; // Object - + $text=''.$langs->trans("PaymentOrderRef",$order->ref).''; print ''.$langs->trans("Designation"); print ''.$text; @@ -535,7 +544,7 @@ if (GETPOST("source") == 'order') print ''."\n"; // Amount - + print ''.$langs->trans("Amount"); if (empty($amount)) print ' ('.$langs->trans("ToComplete").')'; print ''; @@ -555,7 +564,7 @@ if (GETPOST("source") == 'order') print ''."\n"; // Tag - + print ''.$langs->trans("PaymentCode"); print ''.$fulltag.''; print ''; @@ -617,26 +626,26 @@ if (GETPOST("source") == 'invoice') if (GETPOST("amount",'int')) $amount=GETPOST("amount",'int'); $amount=price2num($amount); } - + $fulltag='INV='.$invoice->ref.'.CUS='.$invoice->thirdparty->id; //$fulltag.='.NAM='.strtr($invoice->thirdparty->name,"-"," "); if (! empty($TAG)) { $tag=$TAG; $fulltag.='.TAG='.$TAG; } $fulltag=dol_string_unaccent($fulltag); // Creditor - + print ''.$langs->trans("Creditor"); print ''.$creditor.''; print ''; print ''."\n"; // Debitor - + print ''.$langs->trans("ThirdParty"); print ''.$invoice->thirdparty->name.''; // Object - + $text=''.$langs->trans("PaymentInvoiceRef",$invoice->ref).''; print ''.$langs->trans("Designation"); print ''.$text; @@ -645,7 +654,7 @@ if (GETPOST("source") == 'invoice') print ''."\n"; // Amount - + print ''.$langs->trans("Amount"); if (empty($amount)) print ' ('.$langs->trans("ToComplete").')'; print ''; @@ -665,7 +674,7 @@ if (GETPOST("source") == 'invoice') print ''."\n"; // Tag - + print ''.$langs->trans("PaymentCode"); print ''.$fulltag.''; print ''; @@ -745,7 +754,7 @@ if (GETPOST("source") == 'contractline') { $product=new Product($db); $result=$product->fetch($contractline->fk_product); - + // We define price for product (TODO Put this in a method in product class) if (! empty($conf->global->PRODUIT_MULTIPRICES)) { @@ -759,7 +768,7 @@ if (GETPOST("source") == 'contractline') $pu_ttc = $product->price_ttc; $price_base_type = $product->price_base_type; } - + $amount=$pu_ttc; if (empty($amount)) { @@ -780,19 +789,19 @@ if (GETPOST("source") == 'contractline') if (GETPOST('qty')) $qty=GETPOST('qty'); // Creditor - + print ''.$langs->trans("Creditor"); print ''.$creditor.''; print ''; print ''."\n"; // Debitor - + print ''.$langs->trans("ThirdParty"); print ''.$contract->thirdparty->name.''; // Object - + $text=''.$langs->trans("PaymentRenewContractId",$contract->ref,$contractline->ref).''; if ($contractline->fk_product) { @@ -815,7 +824,7 @@ if (GETPOST("source") == 'contractline') print ''."\n"; // Quantity - + $label=$langs->trans("Quantity"); $qty=1; $duration=''; @@ -843,7 +852,7 @@ if (GETPOST("source") == 'contractline') print ''."\n"; // Amount - + print ''.$langs->trans("Amount"); if (empty($amount)) print ' ('.$langs->trans("ToComplete").')'; print ''; @@ -863,7 +872,7 @@ if (GETPOST("source") == 'contractline') print ''."\n"; // Tag - + print ''.$langs->trans("PaymentCode"); print ''.$fulltag.''; print ''; @@ -925,20 +934,20 @@ if (GETPOST("source") == 'membersubscription') if (GETPOST("amount",'int')) $amount=GETPOST("amount",'int'); $amount=price2num($amount); } - + $fulltag='MEM='.$member->id.'.DAT='.dol_print_date(dol_now(),'%Y%m%d%H%M'); if (! empty($TAG)) { $tag=$TAG; $fulltag.='.TAG='.$TAG; } $fulltag=dol_string_unaccent($fulltag); // Creditor - + print ''.$langs->trans("Creditor"); print ''.$creditor.''; print ''; print ''."\n"; // Debitor - + print ''.$langs->trans("Member"); print ''; if ($member->morphy == 'mor' && ! empty($member->societe)) print $member->societe; @@ -946,7 +955,7 @@ if (GETPOST("source") == 'membersubscription') print ''; // Object - + $text=''.$langs->trans("PaymentSubscription").''; print ''.$langs->trans("Designation"); print ''.$text; @@ -957,13 +966,13 @@ if (GETPOST("source") == 'membersubscription') if ($member->last_subscription_date || $member->last_subscription_amount) { // Last subscription date - + print ''.$langs->trans("LastSubscriptionDate"); print ''.dol_print_date($member->last_subscription_date,'day'); print ''."\n"; // Last subscription amount - + print ''.$langs->trans("LastSubscriptionAmount"); print ''.price($member->last_subscription_amount); print ''."\n"; @@ -972,7 +981,7 @@ if (GETPOST("source") == 'membersubscription') } // Amount - + print ''.$langs->trans("Amount"); if (empty($amount)) { @@ -1001,7 +1010,7 @@ if (GETPOST("source") == 'membersubscription') print ''."\n"; // Tag - + print ''.$langs->trans("PaymentCode"); print ''.$fulltag.''; print ''; @@ -1051,11 +1060,11 @@ if ($action != 'dopayment') if ($found && ! $error) // We are in a management option and no error { // Buttons for all payments registration methods - + if (! empty($conf->paypal->enabled)) { if (empty($conf->global->PAYPAL_API_INTEGRAL_OR_PAYPALONLY)) $conf->global->PAYPAL_API_INTEGRAL_OR_PAYPALONLY='integral'; - + if ($conf->global->PAYPAL_API_INTEGRAL_OR_PAYPALONLY == 'integral') { print '
'; @@ -1065,13 +1074,13 @@ if ($action != 'dopayment') print '
'; } } - + if (! empty($conf->paybox->enabled)) { - - + + } - + // TODO Other methods } else diff --git a/htdocs/public/paypal/newpayment.php b/htdocs/public/paypal/newpayment.php index 6de2cb8a441..65fbfbd38a7 100644 --- a/htdocs/public/paypal/newpayment.php +++ b/htdocs/public/paypal/newpayment.php @@ -265,17 +265,27 @@ $conf->dol_hide_leftmenu=1; llxHeader($head, $langs->trans("PaymentForm"), '', '', 0, 0, '', '', '', 'onlinepaymentbody'); -if (! empty($conf->global->PAYPAL_API_SANDBOX)) -{ - dol_htmloutput_mesg($langs->trans('YouAreCurrentlyInSandboxMode'),'','warning'); -} - // Common variables $creditor=$mysoc->name; $paramcreditor='PAYPAL_CREDITOR_'.$suffix; if (! empty($conf->global->$paramcreditor)) $creditor=$conf->global->$paramcreditor; else if (! empty($conf->global->PAYPAL_CREDITOR)) $creditor=$conf->global->PAYPAL_CREDITOR; +// Check link validity +if (! empty($SOURCE) && in_array($ref, array('member_ref', 'contractline_ref', 'invoice_ref', 'order_ref', ''))) +{ + $langs->load("errors"); + dol_print_error_email('BADREFINPAYMENTFORM', $langs->trans("ErrorBadLinkSourceSetButBadValueForRef", $SOURCE, $ref)); + llxFooter(); + $db->close(); + exit; +} + +if (! empty($conf->global->PAYPAL_API_SANDBOX)) +{ + dol_htmloutput_mesg($langs->trans('YouAreCurrentlyInSandboxMode'),'','warning'); +} + print ''."\n"; print '
'."\n"; print ''."\n"; @@ -359,14 +369,14 @@ if (! GETPOST("source")) $fulltag=$tag; // Creditor - + print ''.$langs->trans("Creditor"); print ''.$creditor.''; print ''; print ''."\n"; // Amount - + print ''.$langs->trans("Amount"); if (empty($amount)) print ' ('.$langs->trans("ToComplete").')'; print ''; @@ -386,7 +396,7 @@ if (! GETPOST("source")) print ''."\n"; // Tag - + print ''.$langs->trans("PaymentCode"); print ''.$fulltag.''; print ''; @@ -424,26 +434,26 @@ if (GETPOST("source") == 'order') if (GETPOST("amount",'int')) $amount=GETPOST("amount",'int'); $amount=price2num($amount); } - + $fulltag='ORD='.$order->ref.'.CUS='.$order->thirdparty->id; //$fulltag.='.NAM='.strtr($order->thirdparty->name,"-"," "); if (! empty($TAG)) { $tag=$TAG; $fulltag.='.TAG='.$TAG; } $fulltag=dol_string_unaccent($fulltag); // Creditor - + print ''.$langs->trans("Creditor"); print ''.$creditor.''; print ''; print ''."\n"; // Debitor - + print ''.$langs->trans("ThirdParty"); print ''.$order->thirdparty->name.''; // Object - + $text=''.$langs->trans("PaymentOrderRef",$order->ref).''; print ''.$langs->trans("Designation"); print ''.$text; @@ -452,7 +462,7 @@ if (GETPOST("source") == 'order') print ''."\n"; // Amount - + print ''.$langs->trans("Amount"); if (empty($amount)) print ' ('.$langs->trans("ToComplete").')'; print ''; @@ -472,7 +482,7 @@ if (GETPOST("source") == 'order') print ''."\n"; // Tag - + print ''.$langs->trans("PaymentCode"); print ''.$fulltag.''; print ''; @@ -534,26 +544,26 @@ if (GETPOST("source") == 'invoice') if (GETPOST("amount",'int')) $amount=GETPOST("amount",'int'); $amount=price2num($amount); } - + $fulltag='INV='.$invoice->ref.'.CUS='.$invoice->thirdparty->id; //$fulltag.='.NAM='.strtr($invoice->thirdparty->name,"-"," "); if (! empty($TAG)) { $tag=$TAG; $fulltag.='.TAG='.$TAG; } $fulltag=dol_string_unaccent($fulltag); // Creditor - + print ''.$langs->trans("Creditor"); print ''.$creditor.''; print ''; print ''."\n"; // Debitor - + print ''.$langs->trans("ThirdParty"); print ''.$invoice->thirdparty->name.''; // Object - + $text=''.$langs->trans("PaymentInvoiceRef",$invoice->ref).''; print ''.$langs->trans("Designation"); print ''.$text; @@ -562,7 +572,7 @@ if (GETPOST("source") == 'invoice') print ''."\n"; // Amount - + print ''.$langs->trans("Amount"); if (empty($amount)) print ' ('.$langs->trans("ToComplete").')'; print ''; @@ -582,7 +592,7 @@ if (GETPOST("source") == 'invoice') print ''."\n"; // Tag - + print ''.$langs->trans("PaymentCode"); print ''.$fulltag.''; print ''; @@ -662,7 +672,7 @@ if (GETPOST("source") == 'contractline') { $product=new Product($db); $result=$product->fetch($contractline->fk_product); - + // We define price for product (TODO Put this in a method in product class) if (! empty($conf->global->PRODUIT_MULTIPRICES)) { @@ -676,7 +686,7 @@ if (GETPOST("source") == 'contractline') $pu_ttc = $product->price_ttc; $price_base_type = $product->price_base_type; } - + $amount=$pu_ttc; if (empty($amount)) { @@ -697,19 +707,19 @@ if (GETPOST("source") == 'contractline') if (GETPOST('qty')) $qty=GETPOST('qty'); // Creditor - + print ''.$langs->trans("Creditor"); print ''.$creditor.''; print ''; print ''."\n"; // Debitor - + print ''.$langs->trans("ThirdParty"); print ''.$contract->thirdparty->name.''; // Object - + $text=''.$langs->trans("PaymentRenewContractId",$contract->ref,$contractline->ref).''; if ($contractline->fk_product) { @@ -732,7 +742,7 @@ if (GETPOST("source") == 'contractline') print ''."\n"; // Quantity - + $label=$langs->trans("Quantity"); $qty=1; $duration=''; @@ -760,7 +770,7 @@ if (GETPOST("source") == 'contractline') print ''."\n"; // Amount - + print ''.$langs->trans("Amount"); if (empty($amount)) print ' ('.$langs->trans("ToComplete").')'; print ''; @@ -780,7 +790,7 @@ if (GETPOST("source") == 'contractline') print ''."\n"; // Tag - + print ''.$langs->trans("PaymentCode"); print ''.$fulltag.''; print ''; @@ -824,6 +834,7 @@ if (GETPOST("source") == 'membersubscription') require_once DOL_DOCUMENT_ROOT.'/adherents/class/adherent.class.php'; require_once DOL_DOCUMENT_ROOT.'/adherents/class/subscription.class.php'; + $member=new Adherent($db); $result=$member->fetch('',$ref); if ($result < 0) @@ -842,20 +853,20 @@ if (GETPOST("source") == 'membersubscription') if (GETPOST("amount",'int')) $amount=GETPOST("amount",'int'); $amount=price2num($amount); } - + $fulltag='MEM='.$member->id.'.DAT='.dol_print_date(dol_now(),'%Y%m%d%H%M'); if (! empty($TAG)) { $tag=$TAG; $fulltag.='.TAG='.$TAG; } $fulltag=dol_string_unaccent($fulltag); // Creditor - + print ''.$langs->trans("Creditor"); print ''.$creditor.''; print ''; print ''."\n"; // Debitor - + print ''.$langs->trans("Member"); print ''; if ($member->morphy == 'mor' && ! empty($member->societe)) print $member->societe; @@ -863,7 +874,7 @@ if (GETPOST("source") == 'membersubscription') print ''; // Object - + $text=''.$langs->trans("PaymentSubscription").''; print ''.$langs->trans("Designation"); print ''.$text; @@ -874,13 +885,13 @@ if (GETPOST("source") == 'membersubscription') if ($member->last_subscription_date || $member->last_subscription_amount) { // Last subscription date - + print ''.$langs->trans("LastSubscriptionDate"); print ''.dol_print_date($member->last_subscription_date,'day'); print ''."\n"; // Last subscription amount - + print ''.$langs->trans("LastSubscriptionAmount"); print ''.price($member->last_subscription_amount); print ''."\n"; @@ -889,7 +900,7 @@ if (GETPOST("source") == 'membersubscription') } // Amount - + print ''.$langs->trans("Amount"); if (empty($amount)) { @@ -918,7 +929,7 @@ if (GETPOST("source") == 'membersubscription') print ''."\n"; // Tag - + print ''.$langs->trans("PaymentCode"); print ''.$fulltag.''; print ''; diff --git a/htdocs/public/stripe/newpayment.php b/htdocs/public/stripe/newpayment.php index 01ae19c7032..af0c880d3c8 100644 --- a/htdocs/public/stripe/newpayment.php +++ b/htdocs/public/stripe/newpayment.php @@ -196,7 +196,7 @@ else if (! empty($conf->global->STRIPE_CREDITOR)) $creditor=$conf->global->STRIP if ($action == 'dopayment') // We click on button Create payment { if (GETPOST('newamount')) $amount = GETPOST('newamount'); - else + else { setEventMessages($langs->trans("ErrorFieldRequired", $langs->transnoentitiesnoconv("Amount")), null, 'errors'); $action = ''; @@ -209,18 +209,18 @@ if ($action == 'charge') // See https://support.stripe.com/questions/which-zero-decimal-currencies-does-stripe-support $arrayzerounitcurrency=array('BIF', 'CLP', 'DJF', 'GNF', 'JPY', 'KMF', 'KRW', 'MGA', 'PYG', 'RWF', 'VND', 'VUV', 'XAF', 'XOF', 'XPF'); if (! in_array($currency, $arrayzerounitcurrency)) $amount=$amount * 100; - + dol_syslog("POST keys : ".join(',', array_keys($_POST)), LOG_DEBUG, 0, '_stripe'); dol_syslog("POST values: ".join(',', $_POST), LOG_DEBUG, 0, '_stripe'); - + $stripeToken = GETPOST("stripeToken",'alpha'); $email = GETPOST("stripeEmail",'alpha'); dol_syslog("stripeToken = ".$stripeToken, LOG_DEBUG, 0, '_stripe'); dol_syslog("stripeEmail = ".$stripeEmail, LOG_DEBUG, 0, '_stripe'); - + $error = 0; - + try { dol_syslog("Create customer", LOG_DEBUG, 0, '_stripe'); $customer = \Stripe\Customer::create(array( @@ -230,7 +230,7 @@ if ($action == 'charge') 'source' => $stripeToken // source can be a token OR array('object'=>'card', 'exp_month'=>xx, 'exp_year'=>xxxx, 'number'=>xxxxxxx, 'cvc'=>xxx, 'name'=>'Cardholder's full name', zip ?) )); // TODO Add 'business_vat_id' ? - + dol_syslog("Create charge", LOG_DEBUG, 0, '_stripe'); $charge = \Stripe\Charge::create(array( 'customer' => $customer->id, @@ -244,14 +244,14 @@ if ($action == 'charge') // Since it's a decline, \Stripe\Error\Card will be caught $body = $e->getJsonBody(); $err = $body['error']; - + print('Status is:' . $e->getHttpStatus() . "\n"); print('Type is:' . $err['type'] . "\n"); print('Code is:' . $err['code'] . "\n"); // param is '' in this case print('Param is:' . $err['param'] . "\n"); print('Message is:' . $err['message'] . "\n"); - + $error++; setEventMessages($e->getMessage(), null, 'errors'); dol_syslog($e->getMessage(), LOG_WARNING, 0, '_stripe'); @@ -295,7 +295,7 @@ if ($action == 'charge') setEventMessages($e->getMessage(), null, 'errors'); $action=''; } - + $_SESSION["onlinetoken"] = $stripeToken; $_SESSION["FinalPaymentAmt"] = $amount; $_SESSION["currencyCodeType"] = $currency; @@ -303,12 +303,12 @@ if ($action == 'charge') $_SESSION['ipaddress'] = $_SERVER['REMOTE_ADDR']; // Payer ip $_SESSION['payerID'] = is_object($customer)?$customer->id:''; $_SESSION['TRANSACTIONID'] = is_object($charge)?$charge->id:''; - + dol_syslog("Action charge stripe result=".$error." ip=".$_SESSION['ipaddress'], LOG_DEBUG, 0, '_stripe'); dol_syslog("onlinetoken=".$_SESSION["onlinetoken"]." FinalPaymentAmt=".$_SESSION["FinalPaymentAmt"]." currencyCodeType=".$_SESSION["currencyCodeType"]." payerID=".$_SESSION['payerID']." TRANSACTIONID=".$_SESSION['TRANSACTIONID'], LOG_DEBUG, 0, '_stripe'); dol_syslog("FULLTAG=".$FULLTAG, LOG_DEBUG, 0, '_stripe'); dol_syslog("Now call the redirect to paymentok or paymentko", LOG_DEBUG, 0, '_stripe'); - + if ($error) { header("Location: ".$urlko); @@ -319,7 +319,7 @@ if ($action == 'charge') header("Location: ".$urlok); exit; } - + } @@ -335,6 +335,16 @@ $conf->dol_hide_leftmenu=1; llxHeader($head, $langs->trans("PaymentForm"), '', '', 0, 0, '', '', '', 'onlinepaymentbody'); +// Check link validity +if (! empty($SOURCE) && in_array($ref, array('member_ref', 'contractline_ref', 'invoice_ref', 'order_ref', ''))) +{ + $langs->load("errors"); + dol_print_error_email('BADREFINPAYMENTFORM', $langs->trans("ErrorBadLinkSourceSetButBadValueForRef", $SOURCE, $ref)); + llxFooter(); + $db->close(); + exit; +} + if (empty($conf->global->STRIPE_LIVE)) { dol_htmloutput_mesg($langs->trans('YouAreCurrentlyInSandboxMode'),'','warning'); @@ -420,7 +430,7 @@ if (! GETPOST("source")) $found=true; $tag=GETPOST("tag"); $fulltag=$tag; - + // Creditor print ''.$langs->trans("Creditor"); print ''.$creditor.''; @@ -485,7 +495,7 @@ if (GETPOST("source") == 'order') if (GETPOST("amount",'int')) $amount=GETPOST("amount",'int'); $amount=price2num($amount); } - + $fulltag='ORD='.$order->ref.'.CUS='.$order->thirdparty->id; //$fulltag.='.NAM='.strtr($order->thirdparty->name,"-"," "); if (! empty($TAG)) { $tag=$TAG; $fulltag.='.TAG='.$TAG; } @@ -600,7 +610,7 @@ if (GETPOST("source") == 'invoice') //$fulltag.='.NAM='.strtr($invoice->thirdparty->name,"-"," "); if (! empty($TAG)) { $tag=$TAG; $fulltag.='.TAG='.$TAG; } $fulltag=dol_string_unaccent($fulltag); - + // Creditor print ''.$langs->trans("Creditor"); @@ -723,7 +733,7 @@ if (GETPOST("source") == 'contractline') { $product=new Product($db); $result=$product->fetch($contractline->fk_product); - + // We define price for product (TODO Put this in a method in product class) if (! empty($conf->global->PRODUIT_MULTIPRICES)) { @@ -737,7 +747,7 @@ if (GETPOST("source") == 'contractline') $pu_ttc = $product->price_ttc; $price_base_type = $product->price_base_type; } - + $amount=$pu_ttc; if (empty($amount)) { @@ -749,7 +759,7 @@ if (GETPOST("source") == 'contractline') if (GETPOST("amount",'int')) $amount=GETPOST("amount",'int'); $amount=price2num($amount); } - + $fulltag='COL='.$contractline->ref.'.CON='.$contract->ref.'.CUS='.$contract->thirdparty->id.'.DAT='.dol_print_date(dol_now(),'%Y%m%d%H%M'); //$fulltag.='.NAM='.strtr($contract->thirdparty->name,"-"," "); if (! empty($TAG)) { $tag=$TAG; $fulltag.='.TAG='.$TAG; } @@ -904,7 +914,7 @@ if (GETPOST("source") == 'membersubscription') if (GETPOST("amount",'int')) $amount=GETPOST("amount",'int'); $amount=price2num($amount); } - + $fulltag='MEM='.$member->id.'.DAT='.dol_print_date(dol_now(),'%Y%m%d%H%M'); if (! empty($TAG)) { $tag=$TAG; $fulltag.='.TAG='.$TAG; } $fulltag=dol_string_unaccent($fulltag); @@ -1059,7 +1069,7 @@ if (preg_match('/^dopayment/',$action)) data-description="'.$ref.'"> '; */ - + // Personalized checkout print ''; - + print ' - +
'; @@ -1106,11 +1116,11 @@ if (preg_match('/^dopayment/',$action)) print ''; print ''."\n"; print ''."\n"; - + print '
- +
@@ -1126,22 +1136,22 @@ if (preg_match('/^dopayment/',$action))
- + - + - + '; + print ''; }