';
diff --git a/htdocs/langs/en_US/eventorganization.lang b/htdocs/langs/en_US/eventorganization.lang
index 6ef39e81ff6..55117ebb5e4 100644
--- a/htdocs/langs/en_US/eventorganization.lang
+++ b/htdocs/langs/en_US/eventorganization.lang
@@ -105,8 +105,8 @@ ViewAndVote = View and vote for suggested events
PublicAttendeeSubscriptionPage = Public link of registration to a conference
MissingOrBadSecureKey = The security key is invalid or missing
EvntOrgWelcomeMessage = This form allows you to register as a new participant to the conference
-EvntOrgDuration = This conference starts on %s and ends on %s
-ConferenceAttendeeFee = Conference attendee fee for the event : '%s' occurring from %s to %s
+EvntOrgDuration = This conference starts on %s and ends on %s.
+ConferenceAttendeeFee = Conference attendee fee for the event : '%s' occurring from %s to %s.
#
# SubscriptionOk page
#
diff --git a/htdocs/public/eventorganization/attendee_subscription.php b/htdocs/public/eventorganization/attendee_subscription.php
index 5f0025b23aa..0f583f7cfc0 100644
--- a/htdocs/public/eventorganization/attendee_subscription.php
+++ b/htdocs/public/eventorganization/attendee_subscription.php
@@ -101,16 +101,13 @@ if ($resultproject < 0) {
$errmsg .= $project->error;
}
-// Getting 'securekey'.'id' from Post and decoding it
-$encodedsecurekeyandid = GETPOST('securekey', 'alpha');
-$securekeyandid = dol_decode($encodedsecurekeyandid, $dolibarr_main_instance_unique_id);
-// Securekey decomposition into pure securekey and id added at the end
-$securekey = substr($securekeyandid, 0, strlen($securekeyandid)-strlen($encodedid));
-$idgotfromsecurekey = dol_decode(substr($securekeyandid, -strlen($encodedid), strlen($encodedid)), $dolibarr_main_instance_unique_id);
+// Getting 'securekey'.'id' from Post and decoding it
+$securekeyreceived = GETPOST('securekey', 'alpha');
+$securekeytocompare = dol_hash($conf->global->EVENTORGANIZATION_SECUREKEY.'conferenceorbooth'.$id, 2);
// We check if the securekey collected is OK and if the id collected is the same than the id in the securekey
-if ($securekey != $conf->global->EVENTORGANIZATION_SECUREKEY || $idgotfromsecurekey != $id) {
+if ($securekeytocompare != $securekeyreceived) {
print $langs->trans('MissingOrBadSecureKey');
exit;
}
@@ -251,7 +248,9 @@ if (empty($reshook) && $action == 'add') {
// If the attendee has already paid
if ($confattendee->status == 1) {
- $redirection = $dolibarr_main_url_root.'/public/eventorganization/subscriptionok.php?securekey='.dol_encode($conf->global->EVENTORGANIZATION_SECUREKEY, $dolibarr_main_instance_unique_id);
+ $encodedid = dol_encode($id, $dolibarr_main_instance_unique_id);
+ $securekeyurl = dol_hash($conf->global->EVENTORGANIZATION_SECUREKEY.'conferenceorbooth'.$id, 2);
+ $redirection = $dolibarr_main_url_root.'/public/eventorganization/subscriptionok.php?id='.$encodedid.'&securekey='.$securekeyurl;
Header("Location: ".$redirection);
exit;
}
@@ -435,7 +434,9 @@ if (empty($reshook) && $action == 'add') {
dol_syslog("Failed to send EMail to ".$sendto, LOG_ERR, 0, '_payment');
}
- $redirection = $dolibarr_main_url_root.'/public/eventorganization/subscriptionok.php?securekey='.dol_encode($conf->global->EVENTORGANIZATION_SECUREKEY, $dolibarr_main_instance_unique_id);
+ $encodedid = dol_encode($id, $dolibarr_main_instance_unique_id);
+ $securekeyurl = dol_hash($conf->global->EVENTORGANIZATION_SECUREKEY.'conferenceorbooth'.$id, 2);
+ $redirection = $dolibarr_main_url_root.'/public/eventorganization/subscriptionok.php?id='.$encodedid.'&securekey='.$securekeyurl;
Header("Location: ".$redirection);
exit;
}
@@ -478,7 +479,7 @@ print '';
print '';
print '';
print '';
-print '';
+print '';
print ' ';
diff --git a/htdocs/public/eventorganization/subscriptionok.php b/htdocs/public/eventorganization/subscriptionok.php
index 81db5ac1c02..31c3281a526 100644
--- a/htdocs/public/eventorganization/subscriptionok.php
+++ b/htdocs/public/eventorganization/subscriptionok.php
@@ -65,8 +65,12 @@ $object = new stdClass(); // For triggers
$error = 0;
// Security check
-$securekey = dol_decode(GETPOST('securekey'), $dolibarr_main_instance_unique_id);
-if ($securekey != $conf->global->EVENTORGANIZATION_SECUREKEY) {
+$encodedid = GETPOST("id");
+$id = dol_decode($encodedid, $dolibarr_main_instance_unique_id);
+$securekeyreceived = GETPOST("securekey");
+$securekeytocompare = dol_hash($conf->global->EVENTORGANIZATION_SECUREKEY.'conferenceorbooth'.$id, 2);
+
+if ($securekeyreceived != $securekeytocompare) {
print $langs->trans('MissingOrBadSecureKey');
exit;
}