Changeset 17700 for branches/comu-ver2/data/class/pages/mypage/LC_Page_Mypage_DeliveryAddr.php

Timestamp:

2008/11/08 08:29:40 (15 years ago)

Author:

takegami

Message:

EC-CUBE2.3.1,2.3.2の脆弱性を修正
r17698,r17678,r17679,r17680,r17682,r17684,r17685

File:

• branches/comu-ver2/data/class/pages/mypage/LC_Page_Mypage_DeliveryAddr.php (modified) (2 diffs)

branches/comu-ver2/data/class/pages/mypage/LC_Page_Mypage_DeliveryAddr.php

@@ -65 +65 @@
         // GETでページを指定されている場合には指定ページに戻す
         if (isset($_GET['page'])) {
-            $ParentPage = $_GET['page'];
+            $ParentPage = htmlspecialchars($_GET['page'],ENT_QUOTES);
         }
         $this->ParentPage = $ParentPage;
@@ -124 +124 @@
                     $deliv_count = $objQuery->count("dtb_other_deliv", "customer_id=?", array($objCustomer->getValue('customer_id')));
                     if ($deliv_count < DELIV_ADDR_MAX or isset($_POST['other_deliv_id'])){
-                        $this->lfRegistData($_POST,$arrRegistColumn, $objCustomer);
+                        if(strlen($_POST['other_deliv_id'] != 0)){
+                            $deliv_count = $objQuery->count("dtb_other_deliv","customer_id=? and other_deliv_id = ?" ,array($objCustomer->getValue('customer_id'), $_POST['other_deliv_id']));
+                            if ($deliv_count == 0) {
+                                SC_Utils_Ex::sfDispSiteError(CUSTOMER_ERROR);
+                            }else{
+                                $this->lfRegistData($_POST,$arrRegistColumn, $objCustomer);                                
+                            }
+                        }else{
+                            $this->lfRegistData($_POST,$arrRegistColumn, $objCustomer);                            
+                        }
                     }
-                    $this->tpl_onload = "fnUpdateParent('". $this->getLocation($_POST['ParentPage']) ."'); window.close();";
+                        if( $_POST['ParentPage'] == MYPAGE_DELIVADDR_URL || $_POST['ParentPage'] == URL_DELIV_TOP ){
+                            $this->tpl_onload = "fnUpdateParent('". $this->getLocation($_POST['ParentPage']) ."'); window.close();";
+                        }else{
+                            SC_Utils_Ex::sfDispSiteError(CUSTOMER_ERROR);
+                        }
                 }
                 break;