Changeset 23279 for branches/version-2_13-dev/data/class/pages/mypage

Timestamp:

2013/11/18 15:20:47 (13 years ago)

Author:

m_uehara

Message:

#2465 r23269 - r23272, r23274 - r23275, r23277 - r23278 をマージ

Location:

branches/version-2_13-dev/data/class/pages/mypage

Files:

• LC_Page_Mypage_DeliveryAddr.php (modified) (2 diffs)
• LC_Page_Mypage_Refusal.php (modified) (3 diffs)

branches/version-2_13-dev/data/class/pages/mypage/LC_Page_Mypage_DeliveryAddr.php

@@ -81 +81 @@
             $ParentPage = htmlspecialchars($_POST['ParentPage'], ENT_QUOTES);
         }
+
+        // 正しい遷移かをチェック
+        $arrParentPageList = array(DELIV_URLPATH, MYPAGE_DELIVADDR_URLPATH, MULTIPLE_URLPATH);
+        if(!SC_Utils_Ex::isBlank($ParentPage) && !in_array($ParentPage, $arrParentPageList)) {
+            // 遷移が正しくない場合、デフォルトであるマイページの配送先追加の画面を設定する
+            $ParentPage  = MYPAGE_DELIVADDR_URLPATH;
+        }
+
         $this->ParentPage = $ParentPage;
 
@@ -90 +98 @@
          */
         if (!$objCustomer->isLoginSuccess(true) && $ParentPage != MULTIPLE_URLPATH) {
-            $this->tpl_onload = "eccube.changeParentUrl('". $this->getLocation($_POST['ParentPage']) ."'); window.close();";
+            $this->tpl_onload = "eccube.changeParentUrl('". $ParentPage ."'); window.close();";
         }
 

branches/version-2_13-dev/data/class/pages/mypage/LC_Page_Mypage_Refusal.php

@@ -64 +64 @@
         switch ($this->getMode()) {
             case 'confirm':
+                // トークンを設定
+                $this->refusal_transactionid = $this->getRefusalToken();
+
                 $this->tpl_mainpage     = 'mypage/refusal_confirm.tpl';
                 $this->tpl_subtitle     = '退会手続き(確認ページ)';
@@ -69 +72 @@
 
             case 'complete':
+                // トークン入力チェック
+                if(!$this->isValidRefusalToken()) {
+                    // エラー画面へ遷移する
+                    SC_Utils_Ex::sfDispSiteError(PAGE_ERROR, '', true);
+                    SC_Response_Ex::actionExit();
+                }
+
                 $objCustomer = new SC_Customer_Ex();
                 $this->lfDeleteCustomer($objCustomer->getValue('customer_id'));
@@ -76 +86 @@
 
             default:
+                if (SC_Display_Ex::detectDevice() == DEVICE_TYPE_MOBILE) {
+                    $this->refusal_transactionid = $this->getRefusalToken();
+                }
                 break;
         }
 
+    }
+
+    /**
+     * トランザクショントークンを取得する
+     *
+     * @return string
+     */
+    function getRefusalToken() {
+        if (empty($_SESSION['refusal_transactionid'])) {
+            $_SESSION['refusal_transactionid'] = SC_Helper_Session_Ex::createToken();
+        }
+        return $_SESSION['refusal_transactionid'];
+    }
+
+    /**
+     * トランザクショントークンのチェックを行う
+     */
+    function isValidRefusalToken() {
+        if(empty($_POST['refusal_transactionid'])) {
+            $ret = false;
+        } else {
+            $ret = $_POST['refusal_transactionid'] === $_SESSION['refusal_transactionid'];
+        }
+
+        return $ret;
+    }
+
+    /**
+     * トランザクショントークを破棄する
+     */
+    function destroyRefusalToken() {
+        unset($_SESSION['refusal_transactionid']);
     }