Index: /controller/wpsg_BasketController.class.php =================================================================== --- /controller/wpsg_BasketController.class.php (revision 7665) +++ /controller/wpsg_BasketController.class.php (revision 7666) @@ -10,34 +10,25 @@ public function content_filter(&$content) { - if (wpsg_get_the_id() == $this->shop->getPagePID(wpsg_ShopController::PAGE_BASKET)) { + if (wpsg_get_the_id() === $this->shop->getPagePID(wpsg_ShopController::PAGE_BASKET)) { parent::dispatch(); - if (isset($_REQUEST['wpsg_checkout'])) - { + if (isset($_REQUEST['wpsg_checkout'])) { $this->checkoutAction($content); - } - else if (isset($_REQUEST['wpsg_checkout2'])) - { + } else if (isset($_REQUEST['wpsg_checkout2'])) { $this->checkout2Action($content); - } - else if (isset($_REQUEST['wpsg_overview'])) - { + } else if (isset($_REQUEST['wpsg_overview'])) { $this->overviewAction($content); - } - else if (isset($_REQUEST['wpsg_done'])) - { + } else if (isset($_REQUEST['wpsg_done'])) { $this->doneAction($content); - } - else - { + } else { $this->basketAction($content); @@ -52,11 +43,9 @@ * Gibt den Warenkorb aus, wird von content_filter aufgerufen */ - public function basketAction(&$content) - { - - if (isset($_REQUEST['wpsg_action']) && $_REQUEST['wpsg_action'] == 'showProdukt' && $_REQUEST['produkt_id'] > 0) - { - - $content = $this->shop->renderProdukt($_REQUEST['produkt_id']); return; + public function basketAction(&$content) { + + if (isset($_REQUEST['wpsg_action']) && $_REQUEST['wpsg_action'] === 'showProdukt' && isset($_REQUEST['produkt_id'])) { + + $content = $this->shop->renderProdukt(intval($_REQUEST['produkt_id'])); return; } @@ -69,5 +58,5 @@ $this->shop->view['error'] = array(); - if (wpsg_isSizedArray($_SESSION['wpsg']['errorFields'])) $this->shop->view['error'] = $_SESSION['wpsg']['errorFields']; + if (isset($_SESSION['wpsg']['errorFields']) && wpsg_checkInput($_SESSION['wpsg']['errorFields'], WPSG_SANITIZE_ARRAY_TEXTFIELD)) $this->shop->view['error'] = $_SESSION['wpsg']['errorFields']; $this->shop->checkShippingAvailable(); @@ -82,6 +71,5 @@ if (sizeof($this->shop->arPayment) == 1) $_SESSION['wpsg']['checkout']['payment'] = $array_keys_payment[0]; - if (sizeof($this->shop->arShipping) == 1 || sizeof($this->shop->arPayment) == 1) - { + if (sizeof($this->shop->arShipping) == 1 || sizeof($this->shop->arPayment) == 1) { $this->shop->basket->initFromSession(true); @@ -93,6 +81,5 @@ // Es kann vorkommen, das eine Zahlungsart voreingestellt ist die nicht mehr verfÃŒgbar ist // Ist nicht ganz schön, da aber checkShippingAvailable von toArray() abhÀngig ist - if (isset($_SESSION['wpsg']['checkout']['shipping']) && (is_array($this->shop->arShipping) && !array_key_exists($_SESSION['wpsg']['checkout']['shipping'], $this->shop->arShipping))) - { + if (isset($_SESSION['wpsg']['checkout']['shipping']) && (is_array($this->shop->arShipping) && !array_key_exists($_SESSION['wpsg']['checkout']['shipping'], $this->shop->arShipping))) { unset($_SESSION['wpsg']['checkout']['shipping']); @@ -109,6 +96,5 @@ if ($this->get_option('wpsg_showMwstAlways') == '1' || sizeof($this->shop->view['basket']['mwst']) > 1) $this->shop->view['colspan'] ++; - if ($this->shop->hasMod('wpsg_mod_onepagecheckout') && ($this->get_option('wpsg_mod_onepagecheckout_basket') == 1)) - { + if ($this->shop->hasMod('wpsg_mod_onepagecheckout') && ($this->get_option('wpsg_mod_onepagecheckout_basket') == 1)) { $this->shop->view['arShipping'] = $this->shop->arShipping; @@ -119,7 +105,5 @@ $content = $this->shop->render(WPSG_PATH_VIEW.'/mods/mod_onepagecheckout/onepage.phtml', false); - } - else - { + } else { $content = $this->shop->render(WPSG_PATH_VIEW.'/warenkorb/basket.phtml', false); @@ -129,32 +113,28 @@ } // public function basketAction() - public function setBasketData() - { + public function setBasketData() { // gewÀhlte Lieferanschrift im Warenkorb setzen - if (wpsg_isSizedInt($_REQUEST['set_land'])) - { - - if ($this->shop->hasMod('wpsg_mod_shippingadress') && wpsg_isSizedInt($_SESSION['wpsg']['checkout']['shipping_land'])) - { - - $_SESSION['wpsg']['checkout']['shipping_land'] = $_REQUEST['set_land']; - - } - else - { - - $_SESSION['wpsg']['checkout']['land'] = $_REQUEST['set_land']; + if (isset($_REQUEST['set_land'])) { + + $set_land = $_REQUEST['set_land']; + + if ($this->shop->hasMod('wpsg_mod_shippingadress') && wpsg_isSizedInt($_SESSION['wpsg']['checkout']['shipping_land'])) { + + $_SESSION['wpsg']['checkout']['shipping_land'] = $set_land; + + } else { + + $_SESSION['wpsg']['checkout']['land'] = $set_land; } // FÃŒr die Abfrage von EU Leistungsort Produkten eintragen - if (wpsg_isSizedInt($_SESSION['wpsg']['customerCountry'])) $_SESSION['wpsg']['customerCountry'] = $_REQUEST['set_land']; + if (wpsg_isSizedInt($_SESSION['wpsg']['customerCountry'])) $_SESSION['wpsg']['customerCountry'] = $set_land; } // gewÀhlte Versandart setzen - if (wpsg_isSizedString($_REQUEST['set_shipping'])) - { + if (isset($_REQUEST['set_shipping']) && wpsg_checkInput($_REQUEST['set_shipping'], WPSG_SANITIZE_SHIPPING_KEY)) { $_SESSION['wpsg']['checkout']['shipping'] = $_REQUEST['set_shipping']; @@ -163,6 +143,5 @@ // gewÀhlte Zahlungsart setzen - if (wpsg_isSizedString($_REQUEST['set_payment'])) - { + if (isset($_REQUEST['set_payment']) && wpsg_checkInput($_REQUEST['set_payment'], WPSG_SANITIZE_PAYMENT_KEY)) { $_SESSION['wpsg']['checkout']['payment'] = $_REQUEST['set_payment']; @@ -176,7 +155,8 @@ /** * Eingabe der Kundendaten (Checkout) + * @param $content + * @throws Exception */ - public function checkoutAction(&$content) - { + public function checkoutAction(&$content) { $this->setBasketData(); @@ -187,8 +167,8 @@ $this->shop->callMods('checkBasket', array(&$bError)); - if ($bError === false) - { + if ($bError === false) { $this->basketAction($content); + return; @@ -198,9 +178,9 @@ $arProductIDs = $this->shop->basket->getProductIDs(); - if (!wpsg_isSizedArray($arProductIDs)) - { + if (!wpsg_checkInput($arProductIDs, WPSG_SANITIZE_ARRAY_INT)) { $this->shop->addFrontendError(__('Es befinden sich keine Produkte im Warenkorb.', 'wpsg')); $this->basketAction($content); + return; @@ -210,14 +190,18 @@ $this->shop->checkCustomerPreset(); - if ($this->shop->hasMod('wpsg_mod_onepagecheckout')) - { - if ($this->shop->get_option('wpsg_mod_onepagecheckout_basket') == 1) - { + if ($this->shop->hasMod('wpsg_mod_onepagecheckout')) { + + if ($this->shop->get_option('wpsg_mod_onepagecheckout_basket') == 1) { + $this->basketAction($content); return; - } - else - { - $content = $this->shop->callMod('wpsg_mod_onepagecheckout', 'onepage'); return; - } + + } else { + + $content = $this->shop->callMod('wpsg_mod_onepagecheckout', 'onepage'); + + return; + + } + } @@ -225,5 +209,5 @@ $this->shop->view['error'] = array(); - if (wpsg_isSizedArray($_SESSION['wpsg']['errorFields'])) $this->shop->view['error'] = $_SESSION['wpsg']['errorFields']; + if (wpsg_checkInput($_SESSION['wpsg']['errorFields'], WPSG_SANITIZE_ARRAY_TEXTFIELD)) $this->shop->view['error'] = $_SESSION['wpsg']['errorFields']; $this->shop->view['basket'] = $this->shop->basket->toArray(); @@ -241,6 +225,5 @@ * Eingabe der Versand- und Zahlungsart */ - private function checkout2Action(&$content) - { + private function checkout2Action(&$content) { $this->shop->basket->initFromSession(); @@ -248,20 +231,19 @@ // Wenn keine Produkte drin sind, dann mit Fehlermeldung zum Warenkorb leiten $temp = $this->shop->basket->getProductIDs(); - if (!wpsg_isSizedArray($temp)) - { + + if (!wpsg_checkInput($temp, WPSG_SANITIZE_ARRAY_INT)) { $this->shop->addFrontendError(__('Es befinden sich keine Produkte im Warenkorb.', 'wpsg')); $this->basketAction($content); + return; } - $this->shop->view['error'] = $_SESSION['wpsg']['errorFields']; + $this->shop->view['error'] = array(); + if (wpsg_checkInput($_SESSION['wpsg']['errorFields'], WPSG_SANITIZE_ARRAY_TEXTFIELD)) $this->shop->view['error'] = $_SESSION['wpsg']['errorFields']; + $this->shop->view['basket'] = $this->shop->basket->toArray(); - - // Alte Werte löschen / Warum war das mal drin ? - //unset($_SESSION['wpsg']['checkout']['shipping']); - //unset($_SESSION['wpsg']['checkout']['payment']); - + $this->shop->checkShippingAvailable(); $this->shop->checkPaymentAvailable(); @@ -295,9 +277,10 @@ // Wenn keine Produkte drin sind, dann mit Fehlermeldung zum Warenkorb leiten $temp = $this->shop->basket->getProductIDs(); - if (!wpsg_isSizedArray($temp)) - { + + if (!wpsg_checkInput($temp, WPSG_SANITIZE_ARRAY_INT)) { $this->shop->addFrontendError(__('Es befinden sich keine Produkte im Warenkorb.', 'wpsg')); $this->basketAction($content); + return; @@ -305,22 +288,27 @@ // Wenn die Overview PrÃŒfung nicht bestanden wurde, dann zum Checkout leiten - if (!$this->shop->basket->checkCheckout(3)) - { - - if ($this->shop->hasMod('wpsg_mod_onepagecheckout') && ($this->shop->get_option('wpsg_mod_onepagecheckout_basket') == 1)) - { + if (!$this->shop->basket->checkCheckout(3)) { + + if ($this->shop->hasMod('wpsg_mod_onepagecheckout') && ($this->shop->get_option('wpsg_mod_onepagecheckout_basket') == 1)) { + $this->basketAction($content); + return; + + } else { + + $this->checkoutAction($content); + + return; + } - else - { - $this->checkoutAction($content); - return; - } - - } - - $this->shop->view['pflicht'] = $this->shop->loadPflichtFeldDaten(); - $this->shop->view['error'] = $_SESSION['wpsg']['errorFields']; + + } + + $this->shop->view['pflicht'] = $this->shop->loadPflichtFeldDaten(); + + $this->shop->view['error'] = array(); + if (wpsg_checkInput($_SESSION['wpsg']['errorFields'], WPSG_SANITIZE_ARRAY_TEXTFIELD)) $this->shop->view['error'] = $_SESSION['wpsg']['errorFields']; + $this->shop->view['basket'] = $this->shop->basket->toArray(); @@ -354,4 +342,5 @@ * @param $content * @throws \wpsg\Exception + * @throws Exception */ private function doneAction(&$content) { @@ -388,7 +377,6 @@ * Verarbeitet die Anfragen und leitet anschließend weiter */ - public function template_redirect() - { - + public function template_redirect() { + if (isset($_REQUEST['wpsg_cron'])) { @@ -400,9 +388,7 @@ exit; - } - - - if (isset($_REQUEST['wpsg_form_data'])) - { + } + + if (isset($_REQUEST['wpsg_form_data'])) { parse_str($_REQUEST['wpsg_form_data'], $request); @@ -411,29 +397,27 @@ } - if (isset($_REQUEST['wpsg']['action']) && $_REQUEST['wpsg']['action'] == 'customeranswer') - { + if (isset($_REQUEST['wpsg']['action']) && $_REQUEST['wpsg']['action'] === 'customeranswer') { // Der Preisdialog wurde beantwortet $_SESSION['wpsg']['priceDialog'] = true; - $_SESSION['wpsg']['customertype'] = $_REQUEST['wpsg']['customertype']; - $_SESSION['wpsg']['checkout']['land'] = $_REQUEST['wpsg']['customerCountry']; + $_SESSION['wpsg']['customertype'] = intval($_REQUEST['wpsg']['customertype']); + $_SESSION['wpsg']['checkout']['land'] = intval($_REQUEST['wpsg']['customerCountry']); + + if (!wpsg_checkInput($_REQUEST['wpsg']['redirect'], WPSG_SANITIZE_URL_LOCAL)) throw \wpsg\Exception::getSanitizeException(); $this->redirect($_REQUEST['wpsg']['redirect']); - } - else if (wpsg_isSizedString($_REQUEST['wpsg']['action'], 'updateCheckout')) - { + } else if (wpsg_isSizedString($_REQUEST['wpsg']['action'], 'updateCheckout')) { // Checkout Aktualisierung ÃŒber AJAX - if (isset($_REQUEST['wpsg']['checkout']['shipping'])) $_SESSION['wpsg']['checkout']['shipping'] = $_REQUEST['wpsg']['checkout']['shipping']; - if (isset($_REQUEST['wpsg']['checkout']['payment'])) $_SESSION['wpsg']['checkout']['payment'] = $_REQUEST['wpsg']['checkout']['payment']; + if (isset($_REQUEST['wpsg']['checkout']['shipping']) && wpsg_checkInput($_REQUEST['wpsg']['checkout']['shipping'], WPSG_SANITIZE_SHIPPING_KEY)) $_SESSION['wpsg']['checkout']['shipping'] = $_REQUEST['wpsg']['checkout']['shipping']; + if (isset($_REQUEST['wpsg']['checkout']['payment']) && wpsg_checkInput($_REQUEST['wpsg']['checkout']['payment'], WPSG_SANITIZE_PAYMENT_KEY)) $_SESSION['wpsg']['checkout']['payment'] = $_REQUEST['wpsg']['checkout']['payment']; die("1"); - } - else if (wpsg_isSizedString($_REQUEST['wpsg']['action'], 'widget')) - { + } else if (wpsg_isSizedString($_REQUEST['wpsg']['action'], 'widget')) { the_widget('wpsg_basket_widget'); + die(); @@ -441,10 +425,8 @@ // Der Warenkorb wurde abgeschickt - if (isset($_REQUEST['wpsg_basket_submit'])) - { + if (isset($_REQUEST['wpsg_basket_submit'])) { // Ein Modul hat einen Fehler im Warenkorb entdeckt, zurÃŒck zum Warenkorb leiten - if ($this->shop->callMods('basket_checkoutAction', array(&$this)) == false) - { + if ($this->shop->callMods('basket_checkoutAction', array(&$this)) == false) { $this->redirect($this->shop->getURL(wpsg_ShopController::URL_BASKET)); @@ -455,6 +437,5 @@ // Warenkorb wurde verarbeitet, soll ein Modul die Umleitung ÃŒbernehmen? - if (wpsg_isSizedString($_REQUEST['wpsg_mod_submit'])) - { + if (wpsg_isSizedString($_REQUEST['wpsg_mod_submit'])) { $this->shop->callMod($_REQUEST['wpsg_mod_submit'], 'basket_submitSuccess'); @@ -462,6 +443,5 @@ } - if (isset($_REQUEST['wpsg']['action']) && $_REQUEST['wpsg']['action'] == 'customerquestion') - { + if (isset($_REQUEST['wpsg']['action']) && $_REQUEST['wpsg']['action'] === 'customerquestion') { // Das Widget mit der Frage bzgl. der Preisberechnung EU Rotz soll angezeigt werden @@ -469,5 +449,7 @@ $this->shop->view['defaultCountry_id'] = $this->shop->getFrontendCountry(true); - $this->shop->view['url'] = $_REQUEST['wpsg']['url']; + + $this->shop->view['url'] = ''; + if (isset($_REQUEST['wpsg']['url']) && wpsg_checkInput($_REQUEST['wpsg']['url'], WPSG_SANITIZE_URL_LOCAL)) $this->shop->view['url'] = $_REQUEST['wpsg']['url']; $geo_code = wpsg_geo_code(); @@ -479,7 +461,5 @@ die($this->shop->render(WPSG_PATH_VIEW.'/warenkorb/customerquestion.phtml')); - } - else if (isset($_REQUEST['wpsg']['submit']) && intval($_REQUEST['wpsg']['menge']) > 0 && intval($_REQUEST['wpsg']['produkt_id']) > 0) - { + } else if (isset($_REQUEST['wpsg']['submit']) && intval($_REQUEST['wpsg']['menge']) > 0 && intval($_REQUEST['wpsg']['produkt_id']) > 0) { // Ein Produktformular wurde abgeschickt @@ -491,14 +471,14 @@ $this->shop->callMods('basket_preInsert'); - $product_key = $_REQUEST['wpsg']['produkt_id']; + $product_key = intval($_REQUEST['wpsg']['produkt_id']); $this->shop->callMods('getProductKeyFromRequest', array(&$product_key, $_REQUEST['wpsg']['produkt_id'], $_REQUEST)); // Produkt hinzufÃŒgen - $bOK = $this->shop->basket->addProduktToSession($product_key, $_REQUEST['wpsg']['menge']); + $amount = intval($_REQUEST['wpsg']['menge']); + $bOK = $this->shop->basket->addProduktToSession($product_key, $amount); if ($this->shop->get_option('wpsg_afterinsert') == '2') die(); - if ($this->shop->get_option('wpsg_afterinsert') == '3') - { + if ($this->shop->get_option('wpsg_afterinsert') == '3') { $this->shop->basket->initFromSession(true); @@ -506,15 +486,15 @@ $this->shop->view['product_data'] = $this->shop->loadProduktArray($this->shop->getProduktId($product_key)); $this->shop->view['oProduct'] = wpsg_product::getInstance($this->shop->getProduktID($product_key)); - $this->shop->view['product_key'] = $_REQUEST['wpsg']['produkt_id']; - $this->shop->view['amount_add'] = $_REQUEST['wpsg']['menge']; - $this->shop->view['amount_basket'] = $this->shop->basket->getBasketAmount($_REQUEST['wpsg']['produkt_id']); + $this->shop->view['product_key'] = $product_key; + $this->shop->view['amount_add'] = $amount; + $this->shop->view['amount_basket'] = $this->shop->basket->getBasketAmount($product_key); $this->shop->view['product_index'] = $GLOBALS['wpsg_lastInsertIndex']; } - if ($this->shop->get_option('wpsg_afterinsert') == '4') - { - - $this->redirect($_REQUEST['myReferer']); + if ($this->shop->get_option('wpsg_afterinsert') == '4') { + + if (wpsg_checkInput($_REQUEST['myReferer'], WPSG_SANITIZE_URL_LOCAL)) $this->redirect($_REQUEST['myReferer']); + else throw \wpsg\Exception::getSanitizeException(); } @@ -522,62 +502,56 @@ // Erfolgsmeldung hinzufÃŒgen if ($bOK === true) $this->shop->addFrontendMessage(__('Produkt erfolgreich in den Warenkorb gelegt.', 'wpsg')); - else if ($bOK === -1) - { + else if ($bOK === -1) { // Hier Warenkorb ohne Meldung anzeigen / FÃŒr den Fall, dass das Produkt nur einmal im Warenkorb auftauchen darf - } - else - { - - if ($this->shop->get_option('wpsg_afterinsert') == '3') - { - - die($this->shop->render(WPSG_PATH_VIEW.'warenkorb/messageDialog.phtml')); + } else { + + if ($this->shop->get_option('wpsg_afterinsert') == '3') { + + echo $this->shop->render(WPSG_PATH_VIEW.'warenkorb/messageDialog.phtml'); + + exit; } // Fehler beim hinzufÃŒgen, hier einfach auf der Seite bleiben - $this->redirect($_REQUEST['myReferer']); - - } - - if (wpsg_isSizedInt($_REQUEST['wpsg']['ajax'], 1)) - { - - if ($this->shop->get_option('wpsg_afterinsert') == '3') - { - - $this->shop->view['product_data']['preis'] = $this->shop->view['oProduct']->getPrice($product_key, $this->shop->getFrontendTaxview()); - + + if (wpsg_checkInput($_REQUEST['myReferer'], WPSG_SANITIZE_URL_LOCAL)) $this->redirect($_REQUEST['myReferer']); + else \wpsg\Exception::getSanitizeException(); + + } + + if (wpsg_isSizedInt($_REQUEST['wpsg']['ajax'], 1)) { + + if ($this->shop->get_option('wpsg_afterinsert') == '3') { + + $this->shop->view['product_data']['preis'] = $this->shop->view['oProduct']->getPrice($product_key, $this->shop->getFrontendTaxview()); $this->shop->view['content'] = $this->shop->render(WPSG_PATH_VIEW.'warenkorb/ajaxDialog.phtml', false); - die($this->shop->render(WPSG_PATH_VIEW.'warenkorb/messageDialog.phtml')); + echo $this->shop->render(WPSG_PATH_VIEW.'warenkorb/messageDialog.phtml'); + + exit; + + } else { + + echo "1"; + + exit; } - else - { - - die("1"); - - } - - } - else if (wpsg_isSizedInt($this->get_option('wpsg_afterinsert'), 1)) - { + + } else if (wpsg_isSizedInt($this->get_option('wpsg_afterinsert'), 1)) { $this->redirect($this->shop->getURL(wpsg_ShopController::URL_BASKET)); - } - else - { - - $this->redirect($_REQUEST['myReferer']); - - } - - } - else if (isset($_REQUEST['wpsg_basket_ajax'])) - { + } else { + + if (wpsg_checkInput($_REQUEST['myReferer'], WPSG_SANITIZE_URL_LOCAL)) $this->redirect($_REQUEST['myReferer']); + else throw \wpsg\Exception::getSanitizeException(); + + } + + } else if (isset($_REQUEST['wpsg_basket_ajax'])) { $content = ''; @@ -585,8 +559,9 @@ $this->basketAction($content); - die($content); - } - else if (isset($_REQUEST['wpsg_redirect_basket'])) - { + echo $content; + + exit; + + } else if (isset($_REQUEST['wpsg_redirect_basket'])) { // Button "ZurÃŒck zum Warenkorb wurde gedrÃŒckt" @@ -595,7 +570,5 @@ $this->redirect($this->shop->getURL(wpsg_ShopController::URL_BASKET)); - } - else if (isset($_REQUEST['wpsg_redirect_checkout'])) - { + } else if (isset($_REQUEST['wpsg_redirect_checkout'])) { // Weiterleitung zum Checkout ohne speichern @@ -604,24 +577,22 @@ $this->redirect($this->shop->getURL(wpsg_ShopController::URL_CHECKOUT)); - } - else if (isset($_REQUEST['wpsg_gutschein_add'])) - { + } else if (isset($_REQUEST['wpsg_gutschein_add'])) { + + if (!isset($_SESSION['wpsg']['errorFields'])) $_SESSION['wpsg']['errorFields'] = []; // Gutscheincode soll hinzugefÃŒgt werden - $code = $_REQUEST['wpsg']['gutschein']; - - $gs_db = $this->db->fetchRow("SELECT * FROM `".WPSG_TBL_GUTSCHEIN."` WHERE `code` = '".wpsg_q($code)."'"); - - if (!isset($gs_db['id']) || $gs_db['id'] <= 0) - { + $code = sanitize_text_field($_REQUEST['wpsg']['gutschein']); + + $gs_db = $this->db->fetchRow("SELECT * FROM `".WPSG_TBL_GUTSCHEIN."` WHERE `code` = '".wpsg_q($code)."' "); + + if (!isset($gs_db['id']) || $gs_db['id'] <= 0) { $this->addFrontendError(__('Ein Gutschein mit diesem Code existiert nicht!', 'wpsg')); + $_SESSION['wpsg']['errorFields'][] = 'gutschein'; $this->redirect($this->shop->getURL(wpsg_ShopController::URL_BASKET)); - } - else - { + } else { // GÃŒltigkeit des Gutscheins prÃŒfen @@ -631,6 +602,5 @@ $arBasket = $this->shop->cache->getShopBasketArray(); - if (!(wpsg_time() >= $tStart && wpsg_time() <= $tEnd)) - { + if (!(wpsg_time() >= $tStart && wpsg_time() <= $tEnd)) { // Zeit ist abgelaufen @@ -640,7 +610,5 @@ $this->redirect($this->shop->getURL(wpsg_ShopController::URL_BASKET)); - } - else - { + } else { if ($gs_db['o_id'] > 0 && $gs_db['multi'] !== '1') { @@ -650,7 +618,5 @@ $_SESSION['wpsg']['errorFields'][] = 'gutschein'; - } - else - { + } else { $bCheckDiscount = true; @@ -664,4 +630,5 @@ $this->addFrontendError(__('Dieser Gutscheincode kann nicht eingelöst werden, da bereits Rabatte angerechnet sind.', 'wpsg')); + $_SESSION['wpsg']['errorFields'][] = 'gutschein'; @@ -674,5 +641,5 @@ if ($bCheckDiscount) { - $oVoucher = wpsg_voucher::getInstance($gs_db['id']); + $oVoucher = wpsg_voucher::getInstance(intval($gs_db['id'])); if (!$oVoucher->isUsabel()) { @@ -683,13 +650,11 @@ // Gutschein ist von der größe des Warenkorbes begrenzt. - if (wpsg_tf($gs_db['minvalue']) > 0 && wpsg_tf($gs_db['minvalue']) > $arBasket['sum']['preis']) - { + if (wpsg_tf($gs_db['minvalue']) > 0 && wpsg_tf($gs_db['minvalue']) > $arBasket['sum']['preis']) { $this->addFrontendError(wpsg_translate(__('Dieser Gutscheincode kann nicht eingelöst werden, da der Mindestbestellwert von #1# noch nicht erreicht ist.', 'wpsg'), wpsg_ff(wpsg_tf($gs_db['minvalue']), $this->shop->get_option('wpsg_currency')))); + $_SESSION['wpsg']['errorFields'][] = 'gutschein'; - } - else - { + } else { $this->shop->basket->initFromSession(); @@ -700,9 +665,7 @@ // ProduktgÃŒltigkeit prÃŒfen $tarr = wpsg_explode(',', $gs_db['products']); - if (wpsg_isSizedArray($tarr)) - { + if (wpsg_isSizedArray($tarr)) { - if (sizeof(array_diff($arProductIDsBasket, wpsg_explode(',', $gs_db['products']))) > 0) - { + if (sizeof(array_diff($arProductIDsBasket, wpsg_explode(',', $gs_db['products']))) > 0) { $wrongProducts = array_diff($arProductIDsBasket, wpsg_explode(',', $gs_db['products'])); @@ -714,6 +677,5 @@ // ProduktgruppengÃŒltigkeit prÃŒfen $tarr = wpsg_explode(',', $gs_db['productgroups']); - if (wpsg_isSizedArray($tarr)) - { + if (wpsg_isSizedArray($tarr)) { $ProductGroupIDs = wpsg_explode(',', $gs_db['productgroups']); @@ -723,6 +685,5 @@ "); - if (sizeof(array_diff($arProductIDsBasket, $arProductIDs)) > 0) - { + if (sizeof(array_diff($arProductIDsBasket, $arProductIDs)) > 0) { $wrongProducts = array_merge($wrongProducts, array_diff($arProductIDsBasket, $arProductIDs)); @@ -732,20 +693,16 @@ } - if (wpsg_isSizedArray($wrongProducts)) - { + if (wpsg_isSizedArray($wrongProducts)) { - if (sizeof($wrongProducts) === 1) - { + if (sizeof($wrongProducts) === 1) { $product = $this->shop->loadProduktArray(array_values($wrongProducts)[0]); $this->addFrontendError(wpsg_translate(__('Gutschein konnte nicht hinzugefÃŒgt werden, da er fÃŒr das Produkt #1# nicht zulÀssig ist.', 'wpsg'), $product['name'])); - } - else - { + } else { $arProductNames = array(); - foreach ($wrongProducts as $product_id) - { + + foreach ($wrongProducts as $product_id) { $product_data = $this->shop->loadProduktArray($product_id); @@ -758,7 +715,5 @@ } - } - else - { + } else { $this->addFrontendMessage(__('Gutschein wurde der Bestellung erfolgreich hinzugefÃŒgt.', 'wpsg')); @@ -781,7 +736,5 @@ } - } - else if (isset($_REQUEST['wpsg_order'])) - { + } else if (isset($_REQUEST['wpsg_order'])) { parent::dispatch(); @@ -792,17 +745,13 @@ $bOK = $this->shop->basket->checkCheckout(); - if ($bOK) - { + if ($bOK) { $bModulError = false; $this->shop->callMods('checkFinaly', array(&$bModulError)); - if ($bModulError === true) - { + if ($bModulError === true) { $this->redirect($this->shop->getURL(wpsg_ShopController::URL_OVERVIEW)); - } - else if (!$this->shop->hasMod('wpsg_mod_ordercondition') && wpsg_getStr($_REQUEST['wpsg']['agb']) != '1' ) - { + } else if (!$this->shop->hasMod('wpsg_mod_ordercondition') && wpsg_getStr($_REQUEST['wpsg']['agb']) != '1' ) { $this->addFrontendError( @@ -816,45 +765,36 @@ $this->redirect($this->shop->getURL(wpsg_ShopController::URL_OVERVIEW)); + } else { + + $order_id = $this->shop->basket->save(); + + $this->redirect($this->shop->getDoneURL($order_id)); + } - else - { - - $order_id = $this->shop->basket->save(); - - $this->redirect($this->shop->getDoneURL($order_id)); + + } else { + + $this->redirect($this->shop->getURL(wpsg_ShopController::URL_BASKET)); + + } + + } else if (wpsg_isSizedString($_REQUEST['wpsg_action'], 'remove') && isset($_REQUEST['wpsg_produkt'])) { + + parent::dispatch(); + + if (preg_match('/^voucher_(\d+)?/', $_REQUEST['wpsg_produkt'], $m)) { + + foreach ($_SESSION['wpsg']['gs'] as $gs_k => $gs) { + + if (intval($gs['id']) === intval($m[1])) unset($_SESSION['wpsg']['gs'][$gs_k]); } - } - else - { - - $this->redirect($this->shop->getURL(wpsg_ShopController::URL_BASKET)); - - } - - } - else if (wpsg_isSizedString($_REQUEST['wpsg_action'], 'remove') && isset($_REQUEST['wpsg_produkt'])) - { - - parent::dispatch(); - - if (preg_match('/^voucher_(\d+)?/', $_REQUEST['wpsg_produkt'], $m)) { - - foreach ($_SESSION['wpsg']['gs'] as $gs_k => $gs) { - - if (intval($gs['id']) === intval($m[1])) unset($_SESSION['wpsg']['gs'][$gs_k]); - - } - $this->shop->addFrontendMessage(__('Gutschein erfolgreich entfernt.', 'wpsg')); - } - else - { + } else { // Produkt entfernen - if ($this->shop->basket->removeProduktFromSession($_REQUEST['wpsg_produkt'])) - { + if ($this->shop->basket->removeProduktFromSession(intval($_REQUEST['wpsg_produkt']))) { // Erfolgsmeldung hinzufÃŒgen @@ -869,7 +809,5 @@ $this->redirect($this->shop->getURL(wpsg_ShopController::URL_BASKET)); - } - else if (isset($_REQUEST['wpsg_basket_refresh'])) - { + } else if (isset($_REQUEST['wpsg_basket_refresh'])) { parent::dispatch(); @@ -878,21 +816,21 @@ $bError = false; - //die(wpsg_debug($_REQUEST['wpsg']['menge'])); + // Warenkorb aktualisieren - foreach ($_REQUEST['wpsg']['menge'] as $product_index => $produkt_menge) - { + foreach ($_REQUEST['wpsg']['menge'] as $product_index => $produkt_menge) { $product_key = $_SESSION['wpsg']['basket'][$product_index]['id']; + + if (!wpsg_checkInput($product_key, WPSG_SANITIZE_PRODUCTKEY)) \wpsg\Exception::getSanitizeException(); + $product_data = $this->shop->cache->loadProduct($this->shop->getProduktId($product_key)); - if ($product_data['basket_multiple'] == 1) - { + if ($product_data['basket_multiple'] == 1) { // Mehrfach mit beliebiger Menge if (!$this->shop->basket->updateProduktFromSession($product_index, $produkt_menge)) $bError = true; - } - else if ($product_data['basket_multiple'] == 2) { + } else if ($product_data['basket_multiple'] == 2) { // Mehrfach mit Menge 1 @@ -905,6 +843,5 @@ $this->shop->callMods('basket_preMultiple', array($product_index)); - $bOK = true; - for ($i = 1; $i < $produkt_menge; $i ++) { + $bOK = true; for ($i = 1; $i < $produkt_menge; $i ++) { $bOK = $bOK && $this->shop->basket->addProduktToSession($product_key, 1); @@ -916,7 +853,5 @@ if (!$bOK) $bError = true; - } - else - { + } else { // Menge ist 1 gebliegen, hier normal aktualisieren @@ -925,10 +860,7 @@ } - } - else if ($product_data['basket_multiple'] == 4) - { - - if ($produkt_menge != "1") - { + } else if ($product_data['basket_multiple'] == 4) { + + if (intval($produkt_menge) !== 1) { $this->shop->addFrontendError(__('Produkt darf nur einmal im Warenkorb auftauchen.', 'wpsg')); @@ -936,7 +868,5 @@ } - } - else - { + } else { // Nur einmal mit beliebiger Menge @@ -952,6 +882,5 @@ $this->shop->callMods('basket_afterUpdate', array(&$bError)); - if (!$bError) - { + if (!$bError) { // Fehler ist aufgetreten @@ -962,16 +891,14 @@ $this->redirect($this->shop->getURL(wpsg_ShopController::URL_BASKET)); - } - // Der Ausschluß von wpsg_mod ist nötig, da PayPal PLUS die Versandart Àndert - else if (isset($_REQUEST['wpsg']['checkout']) && !isset($_REQUEST['wpsg_mod'])) - { + } else if (isset($_REQUEST['wpsg']['checkout']) && !isset($_REQUEST['wpsg_mod'])) { + + // Der Ausschluß von wpsg_mod ist nötig, da PayPal PLUS die Versandart Àndert // Checkout wurde abgeschickt parent::dispatch(); - if (wpsg_isSizedInt($_SESSION['wpsg']['customerCountry']) && $_SESSION['wpsg']['customerCountry'] != $_SESSION['wpsg']['land']) $_SESSION['wpsg']['customerCountry'] = $_SESSION['wpsg']['land']; - - $this->shop->callMods('doCheckout'); - + if (wpsg_isSizedInt($_SESSION['wpsg']['customerCountry']) && $_SESSION['wpsg']['customerCountry'] != $_SESSION['wpsg']['land']) $_SESSION['wpsg']['customerCountry'] = intval($_SESSION['wpsg']['land']); + + $this->shop->callMods('doCheckout'); $this->shop->basket->initFromSession(true); @@ -979,15 +906,14 @@ $bOK = $this->shop->basket->checkCheckout(1); - if (isset($_REQUEST['wpsg_checkout'])) - { + if (isset($_REQUEST['wpsg_checkout'])) { // Änderungen bei der Lieferadresse nach dem "overview" beachten - if (isset($_REQUEST['wpsg']['checkout']['act_checkout_shippingadress'])) - { + if (isset($_REQUEST['wpsg']['checkout']['act_checkout_shippingadress'])) { + if ($_REQUEST['wpsg']['checkout']['act_checkout_shippingadress'] !== 'act') unset($_SESSION['wpsg']['checkout']['act_checkout_shippingadress']); + } - if ($this->shop->hasMod('wpsg_mod_onepagecheckout')) - { + if ($this->shop->hasMod('wpsg_mod_onepagecheckout')) { $bOK = $bOK && $this->shop->basket->checkCheckout(2); @@ -996,28 +922,21 @@ $target = $this->shop->getURL(wpsg_ShopController::URL_OVERVIEW); + } else { + + $target_error = $this->shop->getURL(wpsg_ShopController::URL_CHECKOUT); + + if (array_key_exists($this->shop->basket->arCheckout['shipping'], $this->shop->arShipping) && array_key_exists($this->shop->basket->arCheckout['payment'], $this->shop->arPayment) && $this->shop->get_option('wpsg_skip_checkout2') === '1' && $this->shop->basket->arCheckout['payment'] != 20) { + + $target = $this->shop->getURL(wpsg_ShopController::URL_OVERVIEW); + + } else { + + $target = $this->shop->getURL(wpsg_ShopController::URL_CHECKOUT2); + + } + } - else - { - - $target_error = $this->shop->getURL(wpsg_ShopController::URL_CHECKOUT); - - if (array_key_exists($this->shop->basket->arCheckout['shipping'], $this->shop->arShipping) && array_key_exists($this->shop->basket->arCheckout['payment'], $this->shop->arPayment) && $this->shop->get_option('wpsg_skip_checkout2') === '1' && $this->shop->basket->arCheckout['payment'] != 20) - { - - $target = $this->shop->getURL(wpsg_ShopController::URL_OVERVIEW); - - } - else - { - - $target = $this->shop->getURL(wpsg_ShopController::URL_CHECKOUT2); - - } - - } - - } - else if (isset($_REQUEST['wpsg_checkout2'])) - { + + } else if (isset($_REQUEST['wpsg_checkout2'])) { $bOK = $this->shop->basket->checkCheckout(2); @@ -1026,7 +945,5 @@ $target = $this->shop->getURL(wpsg_ShopController::URL_OVERVIEW); - } - else - { + } else { die(__('Unerwarteter Fehler!', 'wpsg')); @@ -1035,23 +952,19 @@ // Speziell fÃŒr PayPal PLUS, da an den IFrame gesendet wird - if (wpsg_getStr($_REQUEST['wpsg_checkout']) === 'ppp') - { + if (wpsg_getStr($_REQUEST['wpsg_checkout']) === 'ppp') { unset($_SESSION['wpsg']['checkout']['payment']); - if (!$bOK) die(''); - else die(''); - - } - - if (!$bOK) - { + if (!$bOK) die(''); + else die(''); + + } + + if (!$bOK) { // Es sind Fehler aufgetreten, wieder zum Checkout leiten $this->redirect($target_error); - } - else - { + } else { $this->redirect($target); Index: /controller/wpsg_OrderController.class.php =================================================================== --- /controller/wpsg_OrderController.class.php (revision 7665) +++ /controller/wpsg_OrderController.class.php (revision 7666) @@ -39,9 +39,5 @@ { $this->paymentDataAction(); - } - if (wpsg_isSizedString($_REQUEST['subaction'], 'voucherData')) - { - $this->voucherDataAction(); - } + } if (wpsg_isSizedString($_REQUEST['subaction'], 'itemOrderData')) { @@ -617,114 +613,5 @@ } // public function shippingDataAction() - - /** - * Wird aufgerufen, wenn die Gutscheine verwaltet werden sollen - */ - public function voucherDataAction() - { - $t1 = 0; - $oid = 0; - $option = $this->shop->get_option('wpsg_preisangaben'); - if (isset($_REQUEST['edit_id'])) $oid = wpsg_q($_REQUEST['edit_id']); - - if (isset($_REQUEST['do']) && $_REQUEST['do'] == 'add') - { - if (isset($_REQUEST['edit_id'])) $oid = wpsg_q($_REQUEST['edit_id']); - //wp-admin/admin.php?page=wpsg-Admin&subaction=voucherData&do=add&oid=34&noheader=1 - $dt = new DateTime(); - $dt1 = $dt->format('Y-m-d H:i:s'); - $dt = date_modify($dt, '+1 year'); - $dt2 = $dt->format('Y-m-d H:i:s'); - $gs = array('value' => '10.00', 'calc_typ' => 'w', 'code' => 'Gutschein', 'o_id' => $oid, - 'cdate' => $dt1, 'start_date' => $dt1, 'end_date' => $dt2); - $gs_id = $this->db->ImportQuery(WPSG_TBL_GUTSCHEIN, $gs); - $sval = 10.0; - if ($option == WPSG_NETTO) - { - $data = array('price_gs' => $sval, 'price_gs_netto' => $sval); - } - else - { - $data = array('price_gs' => $sval, 'price_gs_brutto' => $sval); - } - - $this->db->UpdateQuery(WPSG_TBL_ORDER, $data, "`id` = '".$oid."'"); - $_REQUEST['gs_id'] = $gs_id; - - } - else if (isset($_REQUEST['do']) && $_REQUEST['do'] == 'remove') - { - // Gutschein löschen - $this->db->Query("DELETE FROM `".WPSG_TBL_GUTSCHEIN."` WHERE `id` = '".wpsg_q($_REQUEST['gs_id'])."'"); - $ogs = array('gs_id' => 0, 'price_gs' => 0, 'price_gs_netto' => 0, 'price_gs_brutto' => 0); - $this->db->UpdateQuery(WPSG_TBL_ORDER, $ogs, "`id` = '".$oid."'"); - $_REQUEST['gs_id'] = 0; - - } - else if (isset($_REQUEST['do']) && $_REQUEST['do'] == 'editname') - { - //wp-admin/admin.php?page=wpsg-Admin&subaction=voucherData&do=editname&oid=34&noheader=1 - //submitdata: { field: 'code', gs_id: 92 } - $data = array(wpsg_q($_REQUEST['field']) => wpsg_q($_REQUEST['value'])); - - $this->db->UpdateQuery(WPSG_TBL_GUTSCHEIN, $data, "`id` = '".wpsg_q($_REQUEST['gs_id'])."'"); - } - else if (isset($_REQUEST['do']) && $_REQUEST['do'] == 'editvalue') - { - //wp-admin/admin.php?page=wpsg-Admin&subaction=voucherData&do=editname&oid=34&noheader=1 - //submitdata: { field: 'code', gs_id: 92 } - $sval = abs(wpsg_tf($_REQUEST['value'])); - /* - $arTaxKey = explode('_', wpsg_q($_REQUEST['mwst'])); - $country_id = $arTaxKey[1]; - $country = wpsg_country::getInstance($country_id); - $tax_key = 'c'; - $noMwSt = false; - if (wpsg_q($_REQUEST['noMwSt']) == 1) $noMwSt = true; - if ($noMwSt === true) $tax_value = 0; else $tax_value = $country->getTax($tax_key); - //if (wpsg_q($_REQUEST['price_frontend']) == WPSG_NETTO) - */ - if ($option == WPSG_NETTO) - { - $data = array('price_gs' => $sval, 'price_gs_netto' => $sval); - } - else - { - $data = array('price_gs' => $sval, 'price_gs_brutto' => $sval); - } - - $this->db->UpdateQuery(WPSG_TBL_ORDER, $data, "`id` = '".wpsg_q($_REQUEST['edit_id'])."'"); - - } - - // Order-Daten sammeln und Tabelle neu generieren - $basket = new wpsg_basket(); - $basket->initFromDB($oid, true); - $this->shop->view['basket'] = $basket->toArray(true); - - //if (isset($_REQUEST['do']) && $_REQUEST['do'] == 'editvalue') - { - if ($option == WPSG_NETTO) - { - $data = array('price_gs_brutto' => $this->shop->view['basket']['sum']['gs_brutto']); - } - else - { - $data = array('price_gs_netto' => $this->shop->view['basket']['sum']['gs_netto']); - } - $this->db->UpdateQuery(WPSG_TBL_ORDER, $data, "`id` = '".wpsg_q($_REQUEST['edit_id'])."'"); - } - - $this->correctPrice($oid); - - $this->shop->view['colspan'] = 3; - if ($this->shop->get_option('wpsg_showMwstAlways') == '1' || sizeof($this->shop->view['basket']['mwst']) > 1) $this->shop->view['colspan'] ++; - - $this->shop->render(WPSG_PATH_VIEW.'/order/view_orderdata.phtml'); - - exit; - - } // public function voucherDataAction() - + /* * Wird aufgerufen, wenn Elemente der Bestellansicht in der Bestellverwaltung im alternativen Design verschoben werden Index: /controller/wpsg_ShopController.class.php =================================================================== --- /controller/wpsg_ShopController.class.php (revision 7665) +++ /controller/wpsg_ShopController.class.php (revision 7666) @@ -1233,30 +1233,16 @@ $hash = md5($this->get_option('wpsg_salt').$arSend['time']); $arSend['hash'] = $hash; - - // CURL Aufruf - $curl = curl_init($url); - curl_setopt($curl, CURLOPT_POST, 1); - curl_setopt($curl, CURLOPT_USERAGENT,'Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.13) Gecko/20080311 Firefox/2.0.0.13'); - curl_setopt($curl, CURLOPT_REFERER, $this->getURL(self::URL_BASKET)); - curl_setopt($curl, CURLOPT_POSTFIELDS, http_build_query($arSend, '', '&')); - - if (!ini_get('safe_mode') && !ini_get('open_basedir')) - { - - /* - * TRUE um jedem "Location: "-Header zu folgen, den der Server als Teil der HTTP-Header zurÃŒckgibt. Die Verarbeitung erfolgt rekursiv, PHP wird jedem "Location: "-Header folgen, sofern nicht CURLOPT_MAXREDIRS gesetzt ist. - * Kann im Safemode nicht geÀndert werden - */ - curl_setopt($curl, CURLOPT_FOLLOWLOCATION, 1); - - } - - curl_setopt($curl, CURLOPT_HEADER, 0); - curl_setopt($curl, CURLOPT_RETURNTRANSFER, 1); - - $Rec_Data = curl_exec($curl); - - return $Rec_Data; + if (!wpsg_checkInput($url, WPSG_SANITIZE_URL)) throw \wpsg\Exception::getSanitizeException(); + + $result = \wp_remote_post($url, [ + 'body' => http_build_query($arSend, '', '&'), + 'headers' => [ + 'User-Agent' => 'Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.13) Gecko/20080311 Firefox/2.0.0.13', + 'Referer' => $this->getURL(self::URL_BASKET) + ] + ]); + + return $result['body']; } // public function notifyURL($url, $produkt_key, $order_id, $typ) @@ -2855,8 +2841,12 @@ } // public function loadModule($all = false) - + /** * Gibt die ID einer Seite aus den Einstellungen zurÃŒck, * beachtet dabei die aktuelle Sprache + * + * @param $page_const + * @return int + * @throws \wpsg\Exception */ public function getPagePID($page_const) @@ -2874,17 +2864,20 @@ } - + /** * Wie get_the_id() gibt aber bei WPML und ÃŒbersetzten Seiten die ID der Originalseite zurÃŒck - */ - public function getPageId($page_id) - { - - if (function_exists('icl_object_id')) //is_plugin_active('sitepress-multilingual-cms/sitepress.php')) - { - - return apply_filters('wpml_object_id', $page_id, 'post', false, $this->getDefaultLanguageCode()); - - } else return $page_id; + * + * @param $page_id + * @return int + */ + public function getPageId($page_id) { + + if (function_exists('icl_object_id')) { + + $page_id = apply_filters('wpml_object_id', $page_id, 'post', false, $this->getDefaultLanguageCode()); + + } + + return intval($page_id); } // public function get_the_id() Index: /controller/wpsg_SystemController.class.php =================================================================== --- /controller/wpsg_SystemController.class.php (revision 7665) +++ /controller/wpsg_SystemController.class.php (revision 7666) @@ -137,48 +137,21 @@ /** - * FÃŒhrt eine Anfrage an $url mittels curl durch und liefert das Ergebniss als String zurÃŒck - * POST Daten können dabei mittels $post_data angehÀngt werden - * @param string $url URL die angefragt werden soll - * @param array $post_data Daten, die mittels POST mitgesendet werden sollen - */ - public function get_url_post_content($url, $post_data = array(), $addition_curl_options = array()) - { - - $ch = curl_init(); - - curl_setopt($ch, CURLOPT_HEADER, 0); - - if (wpsg_isSizedArray($addition_curl_options)) - { - - foreach ($addition_curl_options as $option_key => $option_value) - { - - curl_setopt($ch, $option_key, $option_value); - - } - - } - - curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true); - curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1); - curl_setopt($ch, CURLOPT_URL, $url); - curl_setopt($ch, CURLOPT_POST, count($post_data)); - curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($post_data, null, '&')); - - $data = curl_exec($ch); - - if ($data === false) - { - - $this->last_curl_error = curl_error($ch); - - wpsg_debug(curl_error($ch)); - - } - - curl_close($ch); - - return $data; + * FÃŒhrt eine Anfrage an $url mittels curl durch und liefert das Ergebniss als String zurÃŒck + * POST Daten können dabei mittels $post_data angehÀngt werden + * @param string $url URL die angefragt werden soll + * @param array $post_data Daten, die mittels POST mitgesendet werden sollen + * @return mixed + * @throws Exception + */ + public function get_url_post_content($url, $post_data = []) { + + if (!wpsg_checkInput($url, WPSG_SANITIZE_URL)) throw \wpsg\Exception::getSanitizeException(); + + $result = \wp_remote_post($url, [ + 'body' => http_build_query($post_data, null, '&'), + + ]); + + return $result['body']; } // public function get_url_post_content($url, $post_data = array()) @@ -187,32 +160,8 @@ * Gibt die Antwort einer URL zurÃŒck */ - public function get_url_content($url) - { - - $Return = @file_get_contents($url); - - if (!$Return) - { - - $ch = curl_init(); - - curl_setopt($ch, CURLOPT_HEADER, 0); - curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true); - curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1); - curl_setopt($ch, CURLOPT_URL, $url); - - $data = curl_exec($ch); - curl_close($ch); - - return $data; - - } - else - { - - return $Return; - - } - + public function get_url_content($url) { + + return \wp_remote_get($url, [])['body']; + } // public function get_url_content($url) Index: /lib/functions.inc.php =================================================================== --- /lib/functions.inc.php (revision 7665) +++ /lib/functions.inc.php (revision 7666) @@ -530,5 +530,5 @@ break; - + case WPSG_SANITIZE_USTIDNR: @@ -598,8 +598,20 @@ break; + case WPSG_SANITIZE_URL_LOCAL: + + if (isset($_SERVER['HTTPS']) && $_SERVER['HTTPS'] == 'on') $url_local = 'https://'; + else $url_local = 'http://'; + + $url_local .= $_SERVER['HTTP_HOST']; + + if (substr($val, 0, strlen($url_local)) === $url_local) $bReturn = true; + + break; + case WPSG_SANITIZE_PATH: case WPSG_SANITIZE_URL: case WPSG_SANITIZE_DOMAIN: case WPSG_SANITIZE_ARRAY_LANG: + case WPSG_SANITIZE_PRODUCTKEY: case WPSG_SANITIZE_TEXTFIELD: @@ -661,9 +673,41 @@ break; + case WPSG_SANITIZE_PAYMENT_KEY: + case WPSG_SANITIZE_SHIPPING_KEY: + + if (is_numeric($val) || preg_match('/\d+_\d+/', $val)) $bReturn = true; + + break; + + case WPSG_SANITIZE_ARRAY_FILENAME: + + if (\sanitize_file_name($val) == $val) $bReturn = true; + + break; + case WPSG_SANITIZE_APIKEY: - case WPSG_SANITIZE_NONE: $bReturn = true; - - break; - + case WPSG_SANITIZE_NONE: + + $bReturn = true; + + break; + + case WPSG_SANITIZE_ARRAY_TEXTFIELD: + + if (!is_array($val)) $bReturn = false; + else { + + $bReturn = true; + + foreach ($val as $k => $v) { + + if (!wpsg_checkInput($v, WPSG_SANITIZE_TEXTFIELD)) $bReturn = false; + + } + + } + + break; + case WPSG_SANITIZE_ARRAY_INT: @@ -1501,8 +1545,9 @@ /** * Wie die Wordpress Funktion, bachtet aber die WPML Seitenzuordnung + * @return int */ function wpsg_get_the_id() { - return $GLOBALS['wpsg_sc']->getPageId(get_the_id()); + return intval($GLOBALS['wpsg_sc']->getPageId(\get_the_id())); } // function wpsg_get_the_id() @@ -1849,8 +1894,11 @@ } - + /** * PrÃŒft ob eine Varible ein String ist und die LÀnge > 0 ist * Gibt auch bei (int)"1" true zurÃŒck (!!!!!) + * @param $strValue + * @param bool $value + * @return bool */ function wpsg_isSizedString(&$strValue, $value = false) Index: /mods/mod_statistics/wpsg_customerMap.class.php =================================================================== --- /mods/mod_statistics/wpsg_customerMap.class.php (revision 7665) +++ /mods/mod_statistics/wpsg_customerMap.class.php (revision 7666) @@ -7,28 +7,17 @@ * @author daniel */ - class wpsg_customerMap extends wpsg_statisticabstract - { + class wpsg_customerMap extends wpsg_statisticabstract { /** * Ermittelt aus einer Adresse die LÀngne und Breitengrade und gibt diese zurÃŒck */ - function geocode($string) - { + function geocode($string) { $string = str_replace (" ", "+", urlencode($string)); $details_url = "http://maps.googleapis.com/maps/api/geocode/json?address=".$string."&sensor=false"; - $ch = curl_init(); - curl_setopt($ch, CURLOPT_URL, $details_url); - curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1); - $response = json_decode(curl_exec($ch), true); - - if ($response['status'] != 'OK') - { - - return null; - - } - + $result = $this->shop->get_url_post_content($details_url, []); + $response = json_decode($result); + $lat = $response['results'][0]['geometry']['location']['lat']; $long = $response['results'][0]['geometry']['location']['lng']; Index: /mods/wpsg_mod_crefopay.class.php =================================================================== --- /mods/wpsg_mod_crefopay.class.php (revision 7665) +++ /mods/wpsg_mod_crefopay.class.php (revision 7666) @@ -1154,77 +1154,33 @@ } // private function getURL() - private function crefopay_call($order_id, $data, $call, $noLog = false) - { + private function crefopay_call($order_id, $data, $call, $noLog = false) { $oOrder = wpsg_order::getInstance($order_id); - $ch = curl_init(); - - $strError = ""; - - if (strlen(curl_error($ch))) { - - $strError = curl_errro($ch); - - } - else - { - - curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1); - curl_setopt($ch, CURLOPT_URL, $this->getURL().$call.'/'); - curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1); - curl_setopt($ch, CURLOPT_CONNECTTIMEOUT, 5); - curl_setopt($ch, CURLOPT_TIMEOUT, 60); - curl_setopt($ch, CURLOPT_POST, 1); - curl_setopt($ch, CURLOPT_HEADER, 0); - curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($data, '', '&')); - - $responseBody = @curl_exec($ch); - $responseInfo = curl_getinfo($ch); - - if (strlen(curl_error($ch))) - { - - $strError = wpsg_translate(__('CURL Error: #1#', 'wpsg'), curl_error($ch)); - - } - else - { - - $json_response = @json_decode($responseBody, true); - - if (wpsg_isSizedArray($json_response)) - { - - if (isset($json_response['errorCode']) && $json_response['errorCode'] != 'OK') - { - - $strError = $json_response['message'].' ('.$json_response['errorCode'].')'; - - } - else - { - - // Alles gut -> MAC verifizieren - return $json_response; - - } - - } - else - { - - $strError = "JSON Error: ".json_last_error(); - - } - - } - - } - - if (wpsg_isSizedString($strError) && !$noLog) - { + $result = $this->shop->get_url_post_content($this->getURL().$call.'/', $data); + $json_response = @json_decode($result, true); + + if (wpsg_isSizedArray($json_response)) { + + if (isset($json_response['errorCode']) && $json_response['errorCode'] != 'OK') { + + $strError = $json_response['message'].' ('.$json_response['errorCode'].')'; + + } else { + + // Alles gut -> MAC verifizieren + return $json_response; + + } + + } else { + + $strError = "JSON Error: ".json_last_error(); + + } + + if (wpsg_isSizedString($strError) && !$noLog) { - $oOrder->log(wpsg_translate(__('CrefoPay Fehler: #1#', 'wpsg'), $strError), "Request Data:\r\n".print_r($data, 1)."\r\nResponse Body:\r\n".$responseBody."\r\n\r\nResponse Info:\r\n".print_r($responseInfo, 1)); + $oOrder->log(wpsg_translate(__('CrefoPay Fehler: #1#', 'wpsg'), $strError), "Request Data:\r\n".print_r($data, 1)."\r\nResponse Body:\r\n".$result); } Index: /mods/wpsg_mod_downloadplus.class.php =================================================================== --- /mods/wpsg_mod_downloadplus.class.php (revision 7665) +++ /mods/wpsg_mod_downloadplus.class.php (revision 7666) @@ -249,42 +249,37 @@ } // public function settings_edit() - public function produkt_ajax() - { - - if(isset($_REQUEST['file'])) - $_REQUEST['file'] = wpsg_sinput("text_field", $_REQUEST['file']); - - $_REQUEST['edit_id'] = wpsg_sinput("key", $_REQUEST['edit_id']); - - if ($_REQUEST['cmd'] == 'upload_file') - { - - $this->fileUpload(wpsg_q($_REQUEST['edit_id'])); - - } - else if ($_REQUEST['cmd'] == 'pdffiles_list') - { - - die($this->renderFilesList($_REQUEST['edit_id'])); - - } - else if ($_REQUEST['cmd'] == 'delete_file') - { - - unlink($this->getPDFPath($_REQUEST['edit_id']).'/'.rawurldecode($_REQUEST['file'])); - die("1"); - - } - else if ($_REQUEST['cmd'] == 'download_file') - { - + public function produkt_ajax() { + + $product_id = intval($_REQUEST['edit_id']); + + $file = ''; if (isset($_REQUEST['file'])) $file = \sanitize_file_name(rawurldecode($_REQUEST['file'])); + + if ($_REQUEST['cmd'] === 'upload_file') { + + $this->fileUpload($product_id); + + } else if ($_REQUEST['cmd'] === 'pdffiles_list') { + + echo $this->renderFilesList($product_id); + + echo "1"; exit; + + } else if ($_REQUEST['cmd'] === 'delete_file') { + + unlink($this->getPDFPath($product_id).'/'.$file); + + echo "1"; exit; + + } else if ($_REQUEST['cmd'] === 'download_file') { + wpsg_ob_end_clean(); header('Content-Type: application/pdf'); - header('Content-Disposition: inline; filename="'.rawurldecode(basename($_REQUEST['file'])).'"'); + header('Content-Disposition: inline; filename="'.$file.'"'); header('Cache-Control: private, max-age=0, must-revalidate'); header('Pragma: public'); - die(file_get_contents($this->getPDFPath($_REQUEST['edit_id']).'/'.rawurldecode($_REQUEST['file']))); + echo file_get_contents($this->getPDFPath($product_id).'/'.$file); + exit; } Index: /mods/wpsg_mod_flexipay.class.php =================================================================== --- /mods/wpsg_mod_flexipay.class.php (revision 7665) +++ /mods/wpsg_mod_flexipay.class.php (revision 7666) @@ -13,12 +13,5 @@ var $version = "9.9.9"; var $free = true; - - var $curl_options = array( - CURLINFO_HEADER_OUT => true, - CURLOPT_HTTPHEADER => array('Content-Type: application/x-www-form-urlencoded;charset=UTF-8'), - CURLOPT_FOLLOWLOCATION => 0, - CURLOPT_SSL_VERIFYPEER => false - ); - + var $api_url = array( 'generateToken' => array( @@ -235,5 +228,5 @@ $url .= $_REQUEST['token']; - $result = $this->shop->get_url_post_content($url, $arParam, $this->curl_options); + $result = $this->shop->get_url_post_content($url, $arParam); $resultJson = json_decode($result, true); @@ -366,5 +359,5 @@ if (in_array($this->shop->get_option('wpsg_mod_flexipay_integratormode'), array('INTEGRATOR_TEST', 'CONNECTOR_TEST'))) $url = $this->api_url['generateToken']['test']; - $result = $this->shop->get_url_post_content($url, $arParam, $this->curl_options); + $result = $this->shop->get_url_post_content($url, $arParam); $ident = json_decode($result); Index: /mods/wpsg_mod_gutschein.class.php =================================================================== --- /mods/wpsg_mod_gutschein.class.php (revision 7665) +++ /mods/wpsg_mod_gutschein.class.php (revision 7666) @@ -611,5 +611,5 @@ $data = array( - 'code' => wpsg_q($arData[$i][$arCol['code']]), + 'code' => wpsg_q(sanitize_text_field($arData[$i][$arCol['code']])), 'value' => wpsg_q(wpsg_tf($arData[$i][$arCol['value']])), 'start_date' => wpsg_q($arData[$i][$arCol['start_date']]), @@ -841,5 +841,5 @@ $this->db->ImportQuery(WPSG_TBL_GUTSCHEIN, array( - 'code' => wpsg_q($strCode), + 'code' => wpsg_q(sanitize_text_field($strCode)), 'value' => wpsg_q($value), 'minvalue' => wpsg_q(wpsg_tf($minValue)), Index: /mods/wpsg_mod_icp.class.php =================================================================== --- /mods/wpsg_mod_icp.class.php (revision 7665) +++ /mods/wpsg_mod_icp.class.php (revision 7666) @@ -14,12 +14,5 @@ var $version = "9.9.9"; var $free = true; - - var $curl_options = array( - CURLINFO_HEADER_OUT => true, - CURLOPT_HTTPHEADER => array('Content-Type: application/x-www-form-urlencoded;charset=UTF-8'), - CURLOPT_FOLLOWLOCATION => 0, - /*CURLOPT_SSL_VERIFYPEER => false*/ - ); - + var $api_url = array( 'generateToken' => array( @@ -235,5 +228,5 @@ $url .= $_REQUEST['token']; - $result = $this->shop->get_url_post_content($url, $arParam, $this->curl_options); + $result = $this->shop->get_url_post_content($url, $arParam); $resultJson = json_decode($result, true); @@ -354,5 +347,5 @@ if ($this->shop->get_option('wpsg_mod_icp_sandbox') === '1') $url = $this->api_url['generateToken']['test']; - $result = $this->shop->get_url_post_content($url, $arParam, $this->curl_options); + $result = $this->shop->get_url_post_content($url, $arParam); $ident = json_decode($result); Index: /mods/wpsg_mod_kundenkontakt.class.php =================================================================== --- /mods/wpsg_mod_kundenkontakt.class.php (revision 7665) +++ /mods/wpsg_mod_kundenkontakt.class.php (revision 7666) @@ -283,18 +283,7 @@ ]; - $ch = curl_init(); - - //curl_setopt($ch,CURLOPT_CUSTOMREQUEST, "GET"); - curl_setopt($ch,CURLOPT_URL,self::$sms_endpoint); - curl_setopt($ch,CURLOPT_POST, 1); - curl_setopt($ch,CURLOPT_POSTFIELDS, $arFields); - curl_setopt($ch,CURLOPT_RETURNTRANSFER, true); - - $result = curl_exec($ch); - - curl_close($ch); - - $send_sms_return = substr($result, 0, 3); - + $result = $this->shop->get_url_post_content(self::$sms_endpoint, $arFields); + $send_sms_return = substr($result, 0, 3); + return array($send_sms_return, wpsg_getStr(self::$arSMSStatus[$send_sms_return], __('Unbekannte API Antwort', 'wpsg')), $result); Index: /mods/wpsg_mod_kundenverwaltung.class.php =================================================================== --- /mods/wpsg_mod_kundenverwaltung.class.php (revision 7665) +++ /mods/wpsg_mod_kundenverwaltung.class.php (revision 7666) @@ -25,5 +25,5 @@ $this->group = __('Sonstiges', 'wpsg'); $this->desc = __('Ermöglicht eine Kundenverwaltung mit Profil, Kundengruppen, Registrierung und Login Mechanismen.', 'wpsg'); - + } // public function __construct() @@ -192,10 +192,5 @@ $this->shop->update_option('wpsg_mod_kundenverwaltung_wpuser', $_REQUEST['wpsg_mod_kundenverwaltung_wpuser'], false, false, WPSG_SANITIZE_CHECKBOX); $this->shop->update_option('wpsg_mod_kundenverwaltung_wpuser_role', wpsg_xss($_REQUEST['wpsg_mod_kundenverwaltung_wpuser_role'])); - - $this->shop->update_option('wpsg_mod_kundenverwaltung_aweber', $_REQUEST['wpsg_mod_kundenverwaltung_aweber'], false, false, WPSG_SANITIZE_CHECKBOX); - $this->shop->update_option('wpsg_mod_kundenverwaltung_aweber_formid', $_REQUEST['wpsg_mod_kundenverwaltung_aweber_formid'], false, false, WPSG_SANITIZE_TEXTFIELD); - $this->shop->update_option('wpsg_mod_kundenverwaltung_aweber_listname', $_REQUEST['wpsg_mod_kundenverwaltung_aweber_listname'], false, false, WPSG_SANITIZE_TEXTFIELD); - $this->shop->update_option('wpsg_mod_kundenverwaltung_aweber_metaAdtracking', $_REQUEST['wpsg_mod_kundenverwaltung_aweber_metaAdtracking'], false, false, WPSG_SANITIZE_TEXTFIELD); - + $this->shop->update_option('wpsg_mod_kundenverwaltung_recaptcha_register', $_REQUEST['wpsg_mod_kundenverwaltung_recaptcha_register'], false, false, WPSG_SANITIZE_CHECKBOX); $this->shop->update_option('wpsg_mod_kundenveraltung_recaptcha_key', $_REQUEST['wpsg_mod_kundenveraltung_recaptcha_key'], false, false, WPSG_SANITIZE_TEXTFIELD); @@ -574,25 +569,20 @@ if (isset($_REQUEST['wpsg_mod_kundenverwaltung_register']) && $this->shop->get_option('wpsg_mod_kundenverwaltung_recaptcha_register') === '1') { - - $url = 'https://www.google.com/recaptcha/api/siteverify'; - $data = array( - 'secret' => $this->shop->get_option('wpsg_mod_kundenveraltung_recaptcha_secretkey'), - 'response' => $_REQUEST["g-recaptcha-response"] - ); - $options = array( - 'http' => array ( - 'method' => 'POST', - 'content' => http_build_query($data) - ) - ); - $context = stream_context_create($options); - $verify = file_get_contents($url, false, $context); - $captcha_success = json_decode($verify); - - if ($captcha_success->success === false) { + + $verify_wp = \wp_remote_post('https://www.google.com/recaptcha/api/siteverify', [ + 'body' => http_build_query([ + 'secret' => $this->shop->get_option('wpsg_mod_kundenveraltung_recaptcha_secretkey'), + 'response' => $_REQUEST["g-recaptcha-response"] + ]) + ]); + + $captcha_success = @json_decode($verify_wp['body']); + + if (!is_object($captcha_success) || $captcha_success->success !== true) { $this->shop->addFrontendError(__('Bitte bestÀtigen Sie, dass Sie kein Bot sind.', 'wpsg')); $_SESSION['wpsg']['errorFields'][] = 'mod_kundenverwaltung_recaptcha'; - + $error = true; + } @@ -622,47 +612,9 @@ } - public function basket_save_kunde(&$data, &$checkout) - { + public function basket_save_kunde(&$data, &$checkout) { // Passwort nur Àndern wenn etwas drin steht. Validierung erfolgt an anderer Stelle, aber auch leeres Passwort ist unter umstÀnden valid if (wpsg_isSizedString($checkout['password'])) $data['passwort_saltmd5'] = wpsg_q($this->hashString($checkout['password'])); - - if ($this->shop->get_option("wpsg_mod_kundenverwaltung_aweber") == "1") { - - // Anfrage an aWeber starten - $fields = array( - "meta_web_form_id" => $this->shop->get_option("wpsg_mod_kundenverwaltung_aweber_formid"), - "meta_split_id" => "", - "listname" => $this->shop->get_option("wpsg_mod_kundenverwaltung_aweber_listname"), - "redirect" => "", - "meta_adtracking" => $this->shop->get_option("wpsg_mod_kundenverwaltung_aweber_metaAdtracking"), - "meta_message" => "1", - "meta_required" => "name,email", - "meta_tooltip" => "", - "name" => @$data['vname'].' '.@$data['name'], - "email" => @$data['email'] - ); - - $fields_string = ''; - - foreach($fields as $key=>$value) { $fields_string .= $key.'='.$value.'&'; } - rtrim($fields_string,'&'); - - $url = 'http://www.aweber.com/scripts/addlead.pl'; - - $ch = curl_init($url); - curl_setopt($ch, CURLOPT_URL, $url); - curl_setopt($ch, CURLOPT_POST, sizeof($fields)); - curl_setopt($ch, CURLOPT_POSTFIELDS, $fields_string); - curl_setopt($ch, CURLOPT_TIMEOUT, 2); - curl_setopt($ch, CURLOPT_CONNECTTIMEOUT, 2); - - ob_start(); - $result = curl_exec($ch); - curl_close ($ch); - ob_end_clean(); - - } - + } // public function basket_save_kunde(&$data) Index: /mods/wpsg_mod_securepay.class.php =================================================================== --- /mods/wpsg_mod_securepay.class.php (revision 7665) +++ /mods/wpsg_mod_securepay.class.php (revision 7666) @@ -14,12 +14,5 @@ var $version = "9.9.9"; var $free = true; - - var $curl_options = array( - CURLINFO_HEADER_OUT => true, - CURLOPT_HTTPHEADER => array('Content-Type: application/x-www-form-urlencoded;charset=UTF-8'), - CURLOPT_FOLLOWLOCATION => 0, - /*CURLOPT_SSL_VERIFYPEER => false*/ - ); - + var $api_url = array( 'generateToken' => array( @@ -236,5 +229,5 @@ $url .= wpsg_sinput("text_field", $_REQUEST['token']); - $result = $this->shop->get_url_post_content($url, $arParam, $this->curl_options); + $result = $this->shop->get_url_post_content($url, $arParam); $resultJson = json_decode($result, true); @@ -355,5 +348,5 @@ if ($this->shop->get_option('wpsg_mod_securepay_sandbox') === '1') $url = $this->api_url['generateToken']['test']; - $result = $this->shop->get_url_post_content($url, $arParam, $this->curl_options); + $result = $this->shop->get_url_post_content($url, $arParam); $ident = json_decode($result); Index: /views/mods/mod_kundenverwaltung/register.phtml =================================================================== --- /views/mods/mod_kundenverwaltung/register.phtml (revision 7665) +++ /views/mods/mod_kundenverwaltung/register.phtml (revision 7666) @@ -200,5 +200,5 @@ view['pflicht']['email'] != '2') { ?>
-
-get_option('wpsg_mod_kundenverwaltung_aweber'), array('help' => 'wpsg_mod_kundenverwaltung_aweber')); ?> - - get_option('wpsg_mod_kundenverwaltung_recaptcha_register')); ?>