Changeset 23277 for branches/version-2_13_1/data

Timestamp:

2013/11/18 13:07:02 (9 years ago)

Author:

m_uehara

Message:

#2463 退会画面の入力チェックの見直し

Location:

branches/version-2_13_1/data

Files:

• Smarty/templates/default/mypage/refusal_confirm.tpl (modified) (1 diff)
• Smarty/templates/mobile/mypage/refusal.tpl (modified) (1 diff)
• Smarty/templates/sphone/mypage/refusal_confirm.tpl (modified) (1 diff)
• class/pages/mypage/LC_Page_Mypage_Refusal.php (modified) (3 diffs)

branches/version-2_13_1/data/Smarty/templates/default/mypage/refusal_confirm.tpl

@@ -28 +28 @@
     <form name="form1" id="form1" method="post" action="?">
         <input type="hidden" name="<!--{$smarty.const.TRANSACTION_ID_NAME}-->" value="<!--{$transactionid}-->" />
+        <input type="hidden" name="refusal_transactionid" value="<!--{$refusal_transactionid}-->" />
         <input type="hidden" name="mode" value="complete" />
 

branches/version-2_13_1/data/Smarty/templates/mobile/mypage/refusal.tpl

@@ -29 +29 @@
         <form action="?" method="post">
             <input type="hidden" name="mode" value="complete">
+            <input type="hidden" name="refusal_transactionid" value="<!--{$refusal_transactionid}-->" />
             <input type="hidden" name="<!--{$smarty.const.TRANSACTION_ID_NAME}-->" value="<!--{$transactionid}-->">
 

branches/version-2_13_1/data/Smarty/templates/sphone/mypage/refusal_confirm.tpl

@@ -28 +28 @@
     <form name="form1" id="form1" method="post" action="<!--{$smarty.const.HTTPS_URL}-->mypage/refusal.php">
         <input type="hidden" name="<!--{$smarty.const.TRANSACTION_ID_NAME}-->" value="<!--{$transactionid}-->" />
+        <input type="hidden" name="refusal_transactionid" value="<!--{$refusal_transactionid}-->" />
         <input type="hidden" name="mode" value="complete" />
 

branches/version-2_13_1/data/class/pages/mypage/LC_Page_Mypage_Refusal.php

@@ -64 +64 @@
         switch ($this->getMode()) {
             case 'confirm':
+                // トークンを設定
+                $this->refusal_transactionid = $this->getRefusalToken();
+
                 $this->tpl_mainpage     = 'mypage/refusal_confirm.tpl';
                 $this->tpl_subtitle     = '退会手続き(確認ページ)';
@@ -69 +72 @@
 
             case 'complete':
+                // トークン入力チェック
+                if(!$this->isValidRefusalToken()) {
+                    // エラー画面へ遷移する
+                    SC_Utils_Ex::sfDispSiteError(PAGE_ERROR, '', true);
+                    SC_Response_Ex::actionExit();
+                }
+
                 $objCustomer = new SC_Customer_Ex();
                 $this->lfDeleteCustomer($objCustomer->getValue('customer_id'));
@@ -76 +86 @@
 
             default:
+                if (SC_Display_Ex::detectDevice() == DEVICE_TYPE_MOBILE) {
+                    $this->refusal_transactionid = $this->getRefusalToken();
+                }
                 break;
         }
 
+    }
+
+    /**
+     * トランザクショントークンを取得する
+     *
+     * @return string
+     */
+    function getRefusalToken() {
+        if (empty($_SESSION['refusal_transactionid'])) {
+            $_SESSION['refusal_transactionid'] = SC_Helper_Session_Ex::createToken();
+        }
+        return $_SESSION['refusal_transactionid'];
+    }
+
+    /**
+     * トランザクショントークンのチェックを行う
+     */
+    function isValidRefusalToken() {
+        if(empty($_POST['refusal_transactionid'])) {
+            $ret = false;
+        } else {
+            $ret = $_POST['refusal_transactionid'] === $_SESSION['refusal_transactionid'];
+        }
+
+        return $ret;
+    }
+
+    /**
+     * トランザクショントークを破棄する
+     */
+    function destroyRefusalToken() {
+        unset($_SESSION['refusal_transactionid']);
     }