Index: /controller/wpsg_ProduktController.class.php =================================================================== --- /controller/wpsg_ProduktController.class.php (revision 7497) +++ /controller/wpsg_ProduktController.class.php (revision 7498) @@ -823,6 +823,5 @@ { - if ($this->shop->get_option('wpsg_options_nl2br') == '1') - { + if ($this->shop->get_option('wpsg_options_nl2br') == '1') { $_REQUEST['beschreibung'] = nl2br($_REQUEST['beschreibung']); @@ -830,6 +829,5 @@ } - if (isset($_REQUEST['wpsg_lang'])) - { + if (isset($_REQUEST['wpsg_lang'])){ // Übersetzung speichern @@ -863,25 +861,25 @@ // RegulÀres Produkt speichern - $data = array( - 'name' => wpsg_q(wpsg_sinput("text_field", wpsg_getStr($_REQUEST['name']))), - 'disabled' => wpsg_q(wpsg_sinput("key", $_REQUEST['disabled'])), - 'detailname' => wpsg_q(wpsg_sinput("text_field", wpsg_getStr($_REQUEST['detailname']))), - 'shortdesc' => wpsg_q(wpsg_sinput("text_field", wpsg_getStr($_REQUEST['shortdesc']))), - 'beschreibung' => wpsg_q(wpsg_sinput("text_field", wpsg_getStr($_REQUEST['beschreibung']))), - 'longdescription' => wpsg_q(wpsg_getStr($_REQUEST['longdescription'])), - 'moreinfos' => wpsg_q(wpsg_getStr($_REQUEST['moreinfos'])), - 'moreinfos2' => wpsg_q(wpsg_getStr($_REQUEST['moreinfos2'])), - 'anr' => wpsg_q(wpsg_sinput("key", wpsg_getStr($_REQUEST['anr']))), - 'mwst_key' => wpsg_q(wpsg_sinput("text_field", wpsg_getStr($_REQUEST['mwst_key']))), - 'ptemplate_file' => wpsg_q(wpsg_sinput("text_field", wpsg_getStr($_REQUEST['ptemplate_file']))), - 'posturl' => wpsg_q(wpsg_sinput("text_field", wpsg_sinput("text_field", wpsg_getStr($_REQUEST['posturl'])))), - 'posturl_verkauf' => wpsg_q(wpsg_sinput("key", wpsg_getStr($_REQUEST['posturl_verkauf']))), - 'posturl_bezahlung' => wpsg_q(wpsg_sinput("key", wpsg_getStr($_REQUEST['posturl_bezahlung']))), - 'partikel' => wpsg_q(wpsg_sinput("key", wpsg_getStr($_REQUEST['partikel']))), - 'euleistungsortregel' => wpsg_q(wpsg_sinput("key", wpsg_getStr($_REQUEST['euleistungsortregel']))), - 'basket_multiple' => wpsg_q(wpsg_sinput("key", wpsg_getStr($_REQUEST['basket_multiple']))), - 'rating' => wpsg_q(wpsg_xss(wpsg_getStr($_REQUEST['rating']))) - ); - + $data = []; + + wpsg_checkRequest('name', [WPSG_SANITIZE_TEXTFIELD], __('Produktname', 'wpsg'), $data); + wpsg_checkRequest('disabled', [WPSG_SANITIZE_CHECKBOX], __('Produktstatus', 'wpsg'), $data); + wpsg_checkRequest('detailname', [WPSG_SANITIZE_TEXTFIELD], __('Produktname (Detail)', 'wpsg'), $data); + wpsg_checkRequest('shortdesc', [WPSG_SANITIZE_TEXTFIELD], __('Produktbeschreibung (Kurz)', 'wpsg'), $data); + wpsg_checkRequest('beschreibung', [WPSG_SANITIZE_HTML], __('Kurztext', 'wpsg'), $data); + wpsg_checkRequest('longdescription', [WPSG_SANITIZE_HTML], __('Langtext', 'wpsg'), $data); + wpsg_checkRequest('moreinfos', [WPSG_SANITIZE_HTML], __('ZusÀtzliche Informationen', 'wpsg'), $data); + wpsg_checkRequest('moreinfos2', [WPSG_SANITIZE_HTML], __('Lieferumfang', 'wpsg'), $data); + wpsg_checkRequest('anr', [WPSG_SANITIZE_TEXTFIELD], __('Artikelnummer', 'wpsg'), $data); + wpsg_checkRequest('mwst_key', [WPSG_SANITIZE_TAXKEY], __('Steuergruppe', 'wpsg'), $data); + wpsg_checkRequest('ptemplate_file', [WPSG_SANITIZE_VALUES, $this->shop->loadProduktTemplates()], __('Produkttemplate', 'wpsg'), $data); + wpsg_checkRequest('posturl', [WPSG_SANITIZE_URL], __('URL Benachrichtigung / URL', 'wpsg'), $data); + wpsg_checkRequest('posturl_verkauf', [WPSG_SANITIZE_CHECKBOX], __('URL Benachrichtigung / Bei Kauf', 'wpsg'), $data); + wpsg_checkRequest('posturl_bezahlung', [WPSG_SANITIZE_CHECKBOX], __('URL Benachrichtigung / Bei Bezahlung', 'wpsg'), $data); + wpsg_checkRequest('partikel', [WPSG_SANITIZE_INT], __('Zugeordneter Wordpress Artikel', 'wpsg'), $data); + wpsg_checkRequest('euleistungsortregel', [WPSG_SANITIZE_CHECKBOX], __('Produkt unterliegt den EU-Leistungsortregeln', 'wpsg'), $data); + wpsg_checkRequest('basket_multiple', [WPSG_SANITIZE_VALUES, [wpsg_product::MULTIPLE_ONE_MULTI, wpsg_product::MULTIPLE_MULTI_MULTI, wpsg_product::MULTIPLE_MULTI_ONE, wpsg_product::MULTIPLE_ONE_ONE]], __('Produkt unterliegt den EU-Leistungsortregeln', 'wpsg'), $data); + wpsg_checkRequest('rating', [WPSG_SANITIZE_VALUES, ['0', '1', '2', '3', '4', '5']], __('Produkt unterliegt den EU-Leistungsortregeln', 'wpsg'), $data); + // Erlaubte Zahlungsarten speichern $data['allowedpayments'] = ''; @@ -906,9 +904,9 @@ } - $data['preis'] = wpsg_tf(wpsg_getStr($_REQUEST['preis'])); - $data['oldprice'] = wpsg_tf(wpsg_getStr($_REQUEST['oldprice'])); - + wpsg_checkRequest('preis', [WPSG_SANITIZE_FLOAT], __('Preis', 'wpsg'), $data); + wpsg_checkRequest('oldprice', [WPSG_SANITIZE_FLOAT], __('Alter Preis', 'wpsg'), $data); + $this->shop->callMods('produkt_save_before', array(&$data)); - + if (wpsg_getInt($_REQUEST['edit_id']) > 0) { Index: /controller/wpsg_ShopController.class.php =================================================================== --- /controller/wpsg_ShopController.class.php (revision 7497) +++ /controller/wpsg_ShopController.class.php (revision 7498) @@ -4718,4 +4718,13 @@ } // public function getFrontendTaxview() + + /** + * @return wpsg_ShopController + */ + public static function getShop() { + + return $GLOBALS['wpsg_sc']; + + } } // class ShopController extends SystemController Index: /lib/functions.inc.php =================================================================== --- /lib/functions.inc.php (revision 7497) +++ /lib/functions.inc.php (revision 7498) @@ -512,4 +512,6 @@ $bReturn = false; + if (!isset($val)) return false; + if (!is_numeric($type)) $type = -1; @@ -523,4 +525,13 @@ break; + case WPSG_SANITIZE_HTML: + + $filtered = \wp_kses_post($val); + + if ($filtered === $val) $bReturn = true; + else $bReturn = false; + + break; + case WPSG_SANITIZE_CHECKBOX: @@ -573,5 +584,5 @@ case WPSG_SANITIZE_FLOAT: - if (sanitize_text_field($val) == $val) { + if (\sanitize_text_field($val) == $val) { $bReturn = true; @@ -613,4 +624,45 @@ return $bReturn; + + } + + /** + * Nutzt die wpsg_checkInput um eine Variable im Request zu validieren + * + * @param $name + * @param $arCheckInputArguments + * @param null $strLabel + * @param $data + * @param null $value + * @return bool + * @throws \wpsg\Exception + */ + function wpsg_checkRequest($name, $arCheckInputArguments, $strLabel = null, &$data, $value = null) { + + $type = $arCheckInputArguments[0]; + $param = null; + + if (isset($arCheckInputArguments[1])) $param = $arCheckInputArguments[1]; + + if ($value === null) $value = $_REQUEST[$name]; + + if (!wpsg_checkInput($value, $type, $param)) { + + wpsg_ShopController::getShop()->addBackendError( + wpsg_translate( + __('ÜberprÃŒfen Sie die Eingaben im Feld "#1#"', 'wpsg'), + $strLabel + ) + ); + + return false; + + } else { + + $data[$name] = wpsg_q($value); + + return true; + + } } Index: /model/wpsg_order.class.php =================================================================== --- /model/wpsg_order.class.php (revision 7497) +++ /model/wpsg_order.class.php (revision 7498) @@ -251,13 +251,10 @@ public function getToPay($brutto_netto = WPSG_BRUTTO) { - - if ($brutto_netto == WPSG_BRUTTO) - { + + if ($brutto_netto == WPSG_BRUTTO) { return wpsg_tf($this->data['topay_brutto']); - } - else - { + } else { return wpsg_tf($this->data['topay_netto']); Index: /mods/wpsg_mod_abo.class.php =================================================================== --- /mods/wpsg_mod_abo.class.php (revision 7497) +++ /mods/wpsg_mod_abo.class.php (revision 7498) @@ -353,45 +353,37 @@ } // public function product_addedit_content(&$product_content, &$produkt_data) - public function produkt_save_before(&$product_data) - { + public function produkt_save_before(&$product_data) { if (isset($_REQUEST['wpsg_lang'])) return false; - if (isset($_REQUEST['wpsg_mod_abo_activ']) && $_REQUEST['wpsg_mod_abo_activ'] == '1') - { - + if (isset($_REQUEST['wpsg_mod_abo_activ']) && $_REQUEST['wpsg_mod_abo_activ'] == '1') { + $product_data['wpsg_mod_abo_activ'] = '1'; - $product_data['wpsg_mod_abo_price'] = wpsg_sinput("key", $_REQUEST['wpsg_mod_abo_price'], WPSG_SANITIZE_FLOAT); - $product_data['wpsg_mod_abo_durration'] = wpsg_sinput("key", $_REQUEST['wpsg_mod_abo_durration']); - $product_data['wpsg_mod_abo_url'] = wpsg_sinput("text_field", $_REQUEST['wpsg_mod_abo_url']); - - if ($_REQUEST['wpsg_mod_abo_resell'] == '1') - { - - if ($_REQUEST['wpsg_mod_abo_resell_count'] <= 0) - { + + wpsg_checkRequest('wpsg_mod_abo_price', [WPSG_SANITIZE_FLOAT], __('Abo Produkt / Abo Preis', 'wpsg'), $product_data); + wpsg_checkRequest('wpsg_mod_abo_durration', [WPSG_SANITIZE_INT], __('Abo Produkt / Abo Dauer', 'wpsg'), $product_data); + wpsg_checkRequest('wpsg_mod_abo_url', [WPSG_SANITIZE_URL], __('Abo Produkt / URL Benachrichtigung', 'wpsg'), $product_data); + + if ($_REQUEST['wpsg_mod_abo_resell'] == '1') { + + if ($_REQUEST['wpsg_mod_abo_resell_count'] <= 0) { $this->shop->addBackendError(__('UngÃŒltige Anzahl von zulÀssigen AbokÀufen. Wurde auf unendlich gesetzt.', 'wpsg')); + $product_data['wpsg_mod_abo_resell'] = '0'; + } else { + + $product_data['wpsg_mod_abo_resell'] = wpsg_q(wpsg_sinput("key", $_REQUEST['wpsg_mod_abo_resell_count'])); + } - else - { - - $product_data['wpsg_mod_abo_resell'] = wpsg_q(wpsg_sinput("key", $_REQUEST['wpsg_mod_abo_resell_count'])); - - } + + } else { + + $product_data['wpsg_mod_abo_resell'] = '0'; } - else - { - - $product_data['wpsg_mod_abo_resell'] = '0'; - - } - - } - else - { + + } else { $product_data['wpsg_mod_abo_activ'] = '0'; Index: /mods/wpsg_mod_amazon.class.php =================================================================== --- /mods/wpsg_mod_amazon.class.php (revision 7497) +++ /mods/wpsg_mod_amazon.class.php (revision 7498) @@ -167,5 +167,5 @@ $oOrder = wpsg_order::getInstance($order_id); - if ($oOrder->getAmount() <= 0 || $oOrder->getPaymentID() != $this->id) return; + if ($oOrder->getToPay() <= 0 || $oOrder->getPaymentID() != $this->id) return; if (wpsg_isSizedString($oOrder->getMeta('amazon_order_reference_id')) && !wpsg_isSizedString($oOrder->getMeta('amazon_order_done'))) @@ -576,5 +576,5 @@ $oResponse = $client->setOrderReferenceDetails(array( 'amazon_order_reference_id' => $oOrder->getMeta('amazon_order_reference_id'), - 'amount' => $oOrder->getAmount(), + 'amount' => $oOrder->getToPay(), 'seller_order_id' => $oOrder->id, 'mws_auth_token' => $oOrder->getMeta('amazon_last_authorization_reference_id'), @@ -599,5 +599,5 @@ $oResponse = $client->authorize(array( 'amazon_order_reference_id' => $oOrder->getMeta('amazon_order_reference_id'), - 'authorization_amount' => $oOrder->getAmount(), + 'authorization_amount' => $oOrder->getToPay(), 'authorization_reference_id' => $order_id, 'soft_descriptor' => $this->shop->replaceUniversalPlatzhalter(__($this->shop->get_option('wpsg_mod_amazon_subject'), 'wpsg'), $order_id), @@ -666,5 +666,5 @@ 'amazon_capture_id' => $oOrder->getMeta('amazon_capture_id'), 'refund_reference_id' => 'R'.$oOrder->id, - 'refund_amount' => $oOrder->getAmount(), + 'refund_amount' => $oOrder->getToPay(), 'currency_code' => 'EUR', 'seller_refund_note' => 'STORNO' Index: /mods/wpsg_mod_gutschein.class.php =================================================================== --- /mods/wpsg_mod_gutschein.class.php (revision 7497) +++ /mods/wpsg_mod_gutschein.class.php (revision 7498) @@ -860,5 +860,6 @@ 'autocreate_order_product' => wpsg_q($autocreate_order_product), 'productgroups' => wpsg_q(wpsg_implode(',', $productgroups)), - 'products' => wpsg_q(wpsg_implode(',', $products)) + 'products' => wpsg_q(wpsg_implode(',', $products)), + 'coupon' => (($isCoupon === true)?'1':'0') )); Index: /mods/wpsg_mod_minquantity.class.php =================================================================== --- /mods/wpsg_mod_minquantity.class.php (revision 7497) +++ /mods/wpsg_mod_minquantity.class.php (revision 7498) @@ -89,10 +89,9 @@ } // public function produkt_edit_allgemein(&$produkt_data) - public function produkt_save_before(&$produkt_data) - { - - $produkt_data['wpsg_mod_minquantity_value'] = wpsg_tf(wpsg_sinput("key", $_REQUEST['wpsg_mod_minquantity']['value'])); - $produkt_data['wpsg_mod_minquantity_valuemax'] = wpsg_tf(wpsg_sinput("key", $_REQUEST['wpsg_mod_minquantity']['valuemax'])); - + public function produkt_save_before(&$produkt_data) { + + wpsg_checkRequest('wpsg_mod_minquantity_value', [WPSG_SANITIZE_INT], __('Mindestbestellmenge', 'wpsg'), $produkt_data, $_REQUEST['wpsg_mod_minquantity']['value']); + wpsg_checkRequest('wpsg_mod_minquantity_valuemax', [WPSG_SANITIZE_INT], __('Maximalbestellmenge', 'wpsg'), $produkt_data, $_REQUEST['wpsg_mod_minquantity']['valuemax']); + } // public function produkt_save_before(&$produkt_data) Index: /mods/wpsg_mod_minrequest.class.php =================================================================== --- /mods/wpsg_mod_minrequest.class.php (revision 7497) +++ /mods/wpsg_mod_minrequest.class.php (revision 7498) @@ -98,6 +98,9 @@ } // public function produkt_edit_allgemein(&$produkt_data) - public function produkt_save_before(&$produkt_data) - { + public function produkt_save_before(&$produkt_data) { + + wpsg_checkRequest('wpsg_mod_minrequest_product_activ', [WPSG_SANITIZE_CHECKBOX], __('Minimalbestand Aktiv'), $produkt_data, $_REQUEST['wpsg_mod_minrequest']['product_activ']); + wpsg_checkRequest('wpsg_mod_minrequest_value', [WPSG_SANITIZE_CHECKBOX], __('Minimalbestand Aktiv'), $produkt_data, $_REQUEST['wpsg_mod_minrequest']['value']); + wpsg_checkRequest('wpsg_mod_minrequest_valuemax', [WPSG_SANITIZE_CHECKBOX], __('Minimalbestand Aktiv'), $produkt_data, $_REQUEST['wpsg_mod_minrequest']['valuemax']); $produkt_data['wpsg_mod_minrequest_product_activ'] = wpsg_tf(wpsg_sinput("key", $_REQUEST['wpsg_mod_minrequest']['product_activ'])); Index: /mods/wpsg_mod_si.class.php =================================================================== --- /mods/wpsg_mod_si.class.php (revision 7497) +++ /mods/wpsg_mod_si.class.php (revision 7498) @@ -86,9 +86,8 @@ } // public function produkt_edit_sidebar(&$produkt_data) - public function produkt_save_before(&$produkt_data) - { - - $produkt_data['wpsg_mod_si_check'] = wpsg_sinput("key", wpsg_getStr($_REQUEST['wpsg_mod_si']['check'])); - $produkt_data['wpsg_mod_si_minage'] = wpsg_sinput("key", wpsg_getStr($_REQUEST['wpsg_mod_si']['minAge'])); + public function produkt_save_before(&$produkt_data) { + + if (wpsg_checkInput($_REQUEST['wpsg_mod_si']['check'], WPSG_SANITIZE_CHECKBOX)) $produkt_data['wpsg_mod_si_check'] = wpsg_sinput("key", wpsg_getStr($_REQUEST['wpsg_mod_si']['check'])); + if (wpsg_checkInput($_REQUEST['wpsg_mod_si']['check'], WPSG_SANITIZE_INT))$produkt_data['wpsg_mod_si_minage'] = wpsg_sinput("key", wpsg_getStr($_REQUEST['wpsg_mod_si']['minAge'])); } // public function produkt_save_before(&$produkt_data) Index: /mods/wpsg_mod_voucherproduct.class.php =================================================================== --- /mods/wpsg_mod_voucherproduct.class.php (revision 7497) +++ /mods/wpsg_mod_voucherproduct.class.php (revision 7498) @@ -202,9 +202,25 @@ $price = $p['price_brutto']; - + + //public function genGS( + // $value, + // $calc_typ, + // $tStart, + // $tEnd, + // $multi, + // $laenge, + // $comment, + // $autocreate_order = 0, + // $autocreate_product = 0, + // $autocreate_order_product, + // $productgroups = array(), + // $products = array(), + // $minValue = false, + // $code = false, + // $isCoupon = false) $code = $this->shop->callMod('wpsg_mod_gutschein', 'genGS', array( $price, 'w', - wpsg_time(), + mktime(0, 0, 0,intval(date(n)), intval(date('j')), intval(date('Y'))), wpsg_time() + (86400 * $p['wpsg_mod_voucherproduct_available']), 0, @@ -215,8 +231,7 @@ $p['order_product_id'], [], // $arProductGroups - [], // $productgroups [], // $products false, // $minValue - false. // $code + false, // $code wpsg_isSizedInt($p['wpsg_mod_voucherproduct_coupon']) )); Index: /mods/wpsg_mod_weight.class.php =================================================================== --- /mods/wpsg_mod_weight.class.php (revision 7497) +++ /mods/wpsg_mod_weight.class.php (revision 7498) @@ -168,9 +168,8 @@ } // public function produkt_edit_allgemein(&$produkt_data) - public function produkt_save_before(&$produkt_data) - { - - $produkt_data['weight'] = wpsg_tf(wpsg_sinput("key", $_REQUEST['wpsg_mod_weight']['weight'])); - + public function produkt_save_before(&$produkt_data) { + + wpsg_checkRequest('weight', [WPSG_SANITIZE_FLOAT], __('Produktgewicht', 'wpsg'), $produkt_data, $_REQUEST['wpsg_mod_weight']['weight']); + } // public function produkt_save_before(&$produkt_data) Index: /views/mods/mod_minquantity/produkt_addedit_allgemein.phtml =================================================================== --- /views/mods/mod_minquantity/produkt_addedit_allgemein.phtml (revision 7497) +++ /views/mods/mod_minquantity/produkt_addedit_allgemein.phtml (revision 7498) @@ -8,14 +8,23 @@
+
+

+
+
+ view['wpsg_mod_minquantity']['value']); ?> view['wpsg_mod_minquantity']['valuemax']); ?> + +

+ + +
-

- +
Index: /views/mods/mod_minquantity/produkt_edit_allgemein.phtml =================================================================== --- /views/mods/mod_minquantity/produkt_edit_allgemein.phtml (revision 7497) +++ /views/mods/mod_minquantity/produkt_edit_allgemein.phtml (revision 7498) @@ -6,4 +6,5 @@ ?> + view['wpsg_mod_minquantity']['value']); ?> view['wpsg_mod_minquantity']['valuemax']); ?> Index: /views/mods/mod_minrequest/produkt_addedit_allgemein.phtml =================================================================== --- /views/mods/mod_minrequest/produkt_addedit_allgemein.phtml (revision 7497) +++ /views/mods/mod_minrequest/produkt_addedit_allgemein.phtml (revision 7498) @@ -1,5 +1,5 @@ view['wpsg_mod_minrequest']['data'][0]); ?> - hasMod('wpsg_mod_minrequest') && $this->get_option('wpsg_mod_minrequest_productamount') == '1') { ?> +
+ view['wpsg_mod_minrequest']['value']); ?> - - - hasMod('wpsg_mod_minrequest') && $this->get_option('wpsg_mod_minrequest_productamount_max') == '1') { ?> view['wpsg_mod_minrequest']['valuemax']); ?> - + +
+ +

Index: /wpshopgermany.php =================================================================== --- /wpshopgermany.php (revision 7497) +++ /wpshopgermany.php (revision 7498) @@ -87,4 +87,5 @@ define('WPSG_SANITIZE_DATETIME', 13); define('WPSG_SANITIZE_ARRAY_INT', 14); + define('WPSG_SANITIZE_HTML', 15); // Ist in Multiblog manchma nicht definiert :? Sonst ist hier das Verzeichnis drin