diff --git a/htdocs/eventorganization/conferenceorbooth_card.php b/htdocs/eventorganization/conferenceorbooth_card.php index 87418402f2b..0f0027b663d 100644 --- a/htdocs/eventorganization/conferenceorbooth_card.php +++ b/htdocs/eventorganization/conferenceorbooth_card.php @@ -494,10 +494,15 @@ if ($object->id > 0 && (empty($action) || ($action != 'edit' && $action != 'crea //unset($object->fields['fk_project']); // Hide field already shown in banner //unset($object->fields['fk_soc']); // Hide field already shown in banner global $dolibarr_main_url_root; - $link_subscription = $dolibarr_main_url_root.'/public/eventorganization/attendee_subscription.php?id='; - $key = 'DV3PH'; - $link_subscription .= dol_encode($id, $key); - $link_subscription .= '&securekey='.urlencode($conf->global->EVENTORGANIZATION_SECUREKEY); + + $keyforid = 'DV3PH'; + $encodedid = dol_encode($id, $keyforid); + $link_subscription = $dolibarr_main_url_root.'/public/eventorganization/attendee_subscription.php?id='.$encodedid; + + $keyforsecurekey = 'CGLOO'; + $encodedsecurekey = dol_encode($conf->global->EVENTORGANIZATION_SECUREKEY.$id, $keyforsecurekey); + $link_subscription .= '&securekey='.urlencode($encodedsecurekey); + $object->fields['pubregister'] = array('type'=>'url', 'label'=>$langs->trans("PublicAttendeeSubscriptionPage"), 'enabled'=>'1', 'position'=>72, 'notnull'=>0, 'visible'=>1); $object->pubregister = $link_subscription; $keyforbreak='pubregister'; diff --git a/htdocs/public/eventorganization/attendee_subscription.php b/htdocs/public/eventorganization/attendee_subscription.php index bd655362a3d..fec49e6648d 100644 --- a/htdocs/public/eventorganization/attendee_subscription.php +++ b/htdocs/public/eventorganization/attendee_subscription.php @@ -75,13 +75,24 @@ $error = 0; $backtopage = GETPOST('backtopage', 'alpha'); $action = GETPOST('action', 'aZ09'); -$key = 'DV3PH'; -$id = dol_decode(GETPOST('id'), $key); $email = GETPOST("email"); -// Securekey check -$securekey = GETPOST('securekey', 'alpha'); -if ($securekey != $conf->global->EVENTORGANIZATION_SECUREKEY) { +// Getting id from Post and decoding it +$encodedid = GETPOST('id'); +$keyforid = 'DV3PH'; +$id = dol_decode($encodedid, $keyforid); + +// Getting 'securekey'.'id' from Post and decoding it +$encodedsecurekeyandid = GETPOST('securekey', 'alpha'); +$keyforsecurekey = 'CGLOO'; +$securekeyandid = dol_decode($encodedsecurekeyandid, $keyforsecurekey); + +// Securekey decomposition into pure securekey and id added at the end +$securekey = substr($securekeyandid, 0, strlen($securekeyandid)-strlen($id)); +$idgotfromsecurekey = substr($securekeyandid, -strlen($id), strlen($id)); + +// We check if the securekey collected is OK and if the id collected is the same than the id in the securekey +if ($securekey != $conf->global->EVENTORGANIZATION_SECUREKEY || $idgotfromsecurekey != $id) { print $langs->trans('MissingOrBadSecureKey'); exit; }