Changeset 19947 for branches/version-2_5-dev/data/class

Timestamp:

2011/01/17 18:32:35 (16 years ago)

Author:

spiritofof

Message:

#790(カートの「戻る」ボタンが機能していない)対応。prev_urlが利用できないため専用セッション変数を用いる。

• REFERER妥当性チェック追加。

Location:

branches/version-2_5-dev/data/class

Files:

• pages/cart/LC_Page_Cart.php (modified) (2 diffs)
• pages/products/LC_Page_Products_Detail.php (modified) (1 diff)
• pages/products/LC_Page_Products_List.php (modified) (1 diff)
• util/SC_Utils.php (modified) (1 diff)

branches/version-2_5-dev/data/class/pages/cart/LC_Page_Cart.php

@@ -196 +196 @@
             } else {
                 if (preg_match("/entry/", $_SERVER['HTTP_REFERER'])) {
-                    $_SESSION['cart_prev_url'] = URL_PATH . 'entry/kiyaku.php';
+                    $_SESSION['cart_prev_url'] = HTTPS_URL . 'entry/kiyaku.php';
                 } else {
                     $_SESSION['cart_prev_url'] = $_SERVER['HTTP_REFERER'];
@@ -202 +202 @@
             }
         }
-        $this->tpl_prev_url = $_SESSION['cart_prev_url'];
+        // 妥当性チェック
+        if (!SC_Utils_Ex::sfIsInternalDomain($_SESSION['cart_prev_url'])) {
+            $_SESSION['cart_prev_url'] = '';
+        }
+
+        $this->tpl_prev_url = (isset($_SESSION['cart_prev_url'])) ? $_SESSION['cart_prev_url'] : '';
     }
 

branches/version-2_5-dev/data/class/pages/products/LC_Page_Products_Detail.php

@@ -198 +198 @@
 
                     // カート「戻るボタン」用に保持
-                    $_SESSION['cart_referer_url'] = $_SERVER['HTTP_REFERER'];
+                    if (SC_Utils_Ex::sfIsInternalDomain($_SERVER['HTTP_REFERER'])) {
+                        $_SESSION['cart_referer_url'] = $_SERVER['HTTP_REFERER'];
+                    }
 
                     if (!empty($_POST['gmo_oneclick'])) {

branches/version-2_5-dev/data/class/pages/products/LC_Page_Products_List.php

@@ -168 +168 @@
 
                 // カート「戻るボタン」用に保持
-                $_SESSION['cart_referer_url'] = $_SERVER['HTTP_REFERER'];
+                if (SC_Utils_Ex::sfIsInternalDomain($_SERVER['HTTP_REFERER'])) {
+                    $_SESSION['cart_referer_url'] = $_SERVER['HTTP_REFERER'];
+                }
 
                 SC_Response_Ex::sendRedirect(CART_URLPATH);

branches/version-2_5-dev/data/class/util/SC_Utils.php

@@ -2230 +2230 @@
         return true;
     }
+
+    /**
+     * 指定されたURLのドメインが一致するかを返す
+     *
+     * 戻り値：一致(true) 不一致(false)
+     *
+     * @param string $url
+     * @return boolean
+     */
+    function sfIsInternalDomain($url) {
+        $netURL = new Net_URL(HTTP_URL);
+        $host = $netURL->host;
+        if (!$host) return false;
+        $host = preg_quote($host, "#");
+        if (!preg_match("#^(http|https)://{$host}#i", $url)) return false;
+        return true;
+    }
 }
 ?>