Changeset 23279 for branches/version-2_13-dev/data/class/pages

Timestamp:

2013/11/18 15:20:47 (10 years ago)

Author:

m_uehara

Message:

#2465 r23269 - r23272, r23274 - r23275, r23277 - r23278 をマージ

Location:

branches/version-2_13-dev/data/class/pages

Files:

• admin/contents/LC_Page_Admin_Contents_FileManager.php (modified) (2 diffs)
• admin/contents/LC_Page_Admin_Contents_FileView.php (modified) (1 diff)
• admin/products/LC_Page_Admin_Products_Product.php (modified) (3 diffs)
• mypage/LC_Page_Mypage_DeliveryAddr.php (modified) (2 diffs)
• mypage/LC_Page_Mypage_Refusal.php (modified) (3 diffs)

branches/version-2_13-dev/data/class/pages/admin/contents/LC_Page_Admin_Contents_FileManager.php

@@ -127 +127 @@
                         $this->setDispError('select_file', $disp_error);
                     } else {
-                        // ファイルダウンロード
-                        $objFileManager->sfDownloadFile($objFormParam->getValue('select_file'));
-                        SC_Response_Ex::actionExit();
-                    }
+                       $path_exists = SC_Utils::checkFileExistsWithInBasePath($objFormParam->getValue('select_file'),USER_REALDIR);
+                       if ($path_exists) {
+                         // ファイルダウンロード
+                         $objFileManager->sfDownloadFile($objFormParam->getValue('select_file'));
+                         SC_Response_Ex::actionExit();
+                      }
+                  }
                 }
                 break;
@@ -139 +142 @@
                 $objFormParam->setParam($this->createSetParam($_POST));
                 $objFormParam->convParam();
-
                 $this->arrErr = $objFormParam->checkError();
-                if (SC_Utils_Ex::isBlank($this->arrErr)) {
+                $path_exists = SC_Utils::checkFileExistsWithInBasePath($objFormParam->getValue('select_file'),USER_REALDIR);
+                if (SC_Utils_Ex::isBlank($this->arrErr) && ($path_exists)) {
                     $objFileManager->deleteFile($objFormParam->getValue('select_file'));
                 }

branches/version-2_13-dev/data/class/pages/admin/contents/LC_Page_Admin_Contents_FileView.php

@@ -102 +102 @@
     {
         $file_check_flg = false;
-
         // FIXME パスのチェック関数が必要
         $file = $objFormParam->getValue('file');
-
-        if (!preg_match('|\./|', $file)) {
+        $path_exists = SC_Utils::checkFileExistsWithInBasePath($file,USER_REALDIR);
+        if ($path_exists){
             $file_check_flg = true;
         }
-
         return $file_check_flg;
     }

branches/version-2_13-dev/data/class/pages/admin/products/LC_Page_Admin_Products_Product.php

@@ -565 +565 @@
     {
         $arrForm = $objFormParam->getHashArray();
-        $arrForm['category_id'] = unserialize($arrForm['category_id']);
+        $arrForm['category_id'] = SC_Utils_Ex::jsonDecode($arrForm['category_id']);
         $objFormParam->setValue('category_id', $arrForm['category_id']);
 
@@ -587 +587 @@
 
         if (isset($arrForm['category_id']) && !is_array($arrForm['category_id'])) {
-            $arrForm['category_id'] = unserialize($arrForm['category_id']);
+            $arrForm['category_id'] = SC_Utils_Ex::jsonDecode($arrForm['category_id']);
         }
         $this->tpl_json_category_id = !empty($arrForm['category_id']) ? SC_Utils_Ex::jsonEncode($arrForm['category_id']) : SC_Utils_Ex::jsonEncode(array());
@@ -638 +638 @@
         $arrForm['arrCategoryId'] = $arrForm['category_id'];
         // hidden に渡す値は serialize する
-        $arrForm['category_id'] = serialize($arrForm['category_id']);
+        $arrForm['category_id'] = SC_Utils_Ex::jsonEncode($arrForm['category_id']);
         // 画像ファイル用データ取得
         $arrForm['arrFile'] = $objUpFile->getFormFileList(IMAGE_TEMP_URLPATH, IMAGE_SAVE_URLPATH);

branches/version-2_13-dev/data/class/pages/mypage/LC_Page_Mypage_DeliveryAddr.php

@@ -81 +81 @@
             $ParentPage = htmlspecialchars($_POST['ParentPage'], ENT_QUOTES);
         }
+
+        // 正しい遷移かをチェック
+        $arrParentPageList = array(DELIV_URLPATH, MYPAGE_DELIVADDR_URLPATH, MULTIPLE_URLPATH);
+        if(!SC_Utils_Ex::isBlank($ParentPage) && !in_array($ParentPage, $arrParentPageList)) {
+            // 遷移が正しくない場合、デフォルトであるマイページの配送先追加の画面を設定する
+            $ParentPage  = MYPAGE_DELIVADDR_URLPATH;
+        }
+
         $this->ParentPage = $ParentPage;
 
@@ -90 +98 @@
          */
         if (!$objCustomer->isLoginSuccess(true) && $ParentPage != MULTIPLE_URLPATH) {
-            $this->tpl_onload = "eccube.changeParentUrl('". $this->getLocation($_POST['ParentPage']) ."'); window.close();";
+            $this->tpl_onload = "eccube.changeParentUrl('". $ParentPage ."'); window.close();";
         }
 

branches/version-2_13-dev/data/class/pages/mypage/LC_Page_Mypage_Refusal.php

@@ -64 +64 @@
         switch ($this->getMode()) {
             case 'confirm':
+                // トークンを設定
+                $this->refusal_transactionid = $this->getRefusalToken();
+
                 $this->tpl_mainpage     = 'mypage/refusal_confirm.tpl';
                 $this->tpl_subtitle     = '退会手続き(確認ページ)';
@@ -69 +72 @@
 
             case 'complete':
+                // トークン入力チェック
+                if(!$this->isValidRefusalToken()) {
+                    // エラー画面へ遷移する
+                    SC_Utils_Ex::sfDispSiteError(PAGE_ERROR, '', true);
+                    SC_Response_Ex::actionExit();
+                }
+
                 $objCustomer = new SC_Customer_Ex();
                 $this->lfDeleteCustomer($objCustomer->getValue('customer_id'));
@@ -76 +86 @@
 
             default:
+                if (SC_Display_Ex::detectDevice() == DEVICE_TYPE_MOBILE) {
+                    $this->refusal_transactionid = $this->getRefusalToken();
+                }
                 break;
         }
 
+    }
+
+    /**
+     * トランザクショントークンを取得する
+     *
+     * @return string
+     */
+    function getRefusalToken() {
+        if (empty($_SESSION['refusal_transactionid'])) {
+            $_SESSION['refusal_transactionid'] = SC_Helper_Session_Ex::createToken();
+        }
+        return $_SESSION['refusal_transactionid'];
+    }
+
+    /**
+     * トランザクショントークンのチェックを行う
+     */
+    function isValidRefusalToken() {
+        if(empty($_POST['refusal_transactionid'])) {
+            $ret = false;
+        } else {
+            $ret = $_POST['refusal_transactionid'] === $_SESSION['refusal_transactionid'];
+        }
+
+        return $ret;
+    }
+
+    /**
+     * トランザクショントークを破棄する
+     */
+    function destroyRefusalToken() {
+        unset($_SESSION['refusal_transactionid']);
     }