mirror of
https://git.wownero.com/wownero/wownerowp.git
synced 2024-08-15 01:03:16 +00:00
Sanatize $payment_id cookie
This commit is contained in:
parent
c29d63f52a
commit
79dca7f9b7
1 changed files with 11 additions and 10 deletions
|
@ -2,8 +2,7 @@
|
||||||
|
|
||||||
/*
|
/*
|
||||||
* Main Gateway of Monero using a daemon online
|
* Main Gateway of Monero using a daemon online
|
||||||
* This code isn't for Dark Net Markets, please report them to Authority!
|
* Authors: Serhack and cryptochangements
|
||||||
* Authors: Serhack and cryptochangements34
|
|
||||||
*/
|
*/
|
||||||
|
|
||||||
|
|
||||||
|
@ -315,16 +314,18 @@ class Monero_Gateway extends WC_Payment_Gateway
|
||||||
if (!isset($_COOKIE['payment_id'])) {
|
if (!isset($_COOKIE['payment_id'])) {
|
||||||
$payment_id = bin2hex(openssl_random_pseudo_bytes(8));
|
$payment_id = bin2hex(openssl_random_pseudo_bytes(8));
|
||||||
setcookie('payment_id', $payment_id, time() + 2700);
|
setcookie('payment_id', $payment_id, time() + 2700);
|
||||||
} else{
|
}
|
||||||
// Please fix this SQLI injection! TODO: Fix me!
|
else{
|
||||||
$payment_id = $this->protect_payment(sanitize_text_field($_COOKIE['payment_id']));
|
$payment_id = $this->sanatize_id($_COOKIE['payment_id']);
|
||||||
}
|
}
|
||||||
return $payment_id;
|
return $payment_id;
|
||||||
}
|
}
|
||||||
|
|
||||||
public function protect_payment($payment_id){
|
public function sanatize_id($payment_id)
|
||||||
$payment_id = str_replace("'", "\n", $payment_id);
|
{
|
||||||
return $payment_id;
|
// Limit payment id to alphanumeric characters
|
||||||
|
$sanatized_id = preg_replace("/[^a-zA-Z0-9]+/", "", $payment_id);
|
||||||
|
return $sanatized_id;
|
||||||
}
|
}
|
||||||
|
|
||||||
public function changeto($amount, $currency, $payment_id)
|
public function changeto($amount, $currency, $payment_id)
|
||||||
|
|
Loading…
Reference in a new issue