CMS/OpenCart3
3
0
Fork 0
Code Releases 6 Activity

fix/security-audit

Browse Source
This commit is contained in:
ivan.sadovin
2026-10-26 17:44:54 +03:00
committed by Git Moneta
parent 1f29a07f63
commit d850c2ca31
8 changed files with 389 additions and 113 deletions
Download Patch File Download Diff File Expand all files Collapse all files
upload/admin/controller/extension/payment/payanyway.php
+29 -15
View File
@@ -8,8 +8,7 @@
*/
class ControllerExtensionPaymentPayanyway extends Controller {
const CMS_NAME = 'OpenCart';
const MODULE_NAME = 'payanyway';
const MODULE_VERSION = '1.0.5';
const MODULE_VERSION = '1.0.6';
const MODULE_DEFAULT_SORT_ORDER = 0;
/** Маркер вставки OCMOD из install.xml в роутере витрины (приём Check/Pay URL методом POST). */
@@ -30,7 +29,6 @@ class ControllerExtensionPaymentPayanyway extends Controller {
'vat122' => '1114'
);
/** Признак способа расчёта (kassaspecification.pdf, pm). */
private $paymentMethods = array(
'full_prepayment',
'prepayment',
@@ -41,7 +39,6 @@ class ControllerExtensionPaymentPayanyway extends Controller {
'credit_payment'
);
/** Признак предмета расчёта (kassaspecification.pdf, po). */
private $paymentObjects = array(
'commodity',
'excise',
@@ -108,7 +105,9 @@ class ControllerExtensionPaymentPayanyway extends Controller {
$data['payment_payanyway_status'] = $this->retrieveValue('payment_payanyway_status');
$data['payment_payanyway_account'] = $this->retrieveValue('payment_payanyway_account');
$data['payment_payanyway_integrity_code'] = $this->getIntegrityCode('payment_payanyway_integrity_code');
$data['integrity_code_placeholder'] = $this->hasIntegrityCode()
? $this->language->get('text_integrity_code_saved')
: $this->language->get('entry_integrity_code_description');
$data['payment_payanyway_server'] = $this->retrieveValue('payment_payanyway_server');
$data['payment_payanyway_test_mode'] = (string)$this->retrieveValue('payment_payanyway_test_mode');
$data['payment_payanyway_fiscalization'] = $this->isFiscalizationEnabled() ? '1' : '0';
@@ -182,7 +181,8 @@ class ControllerExtensionPaymentPayanyway extends Controller {
'payment_payanyway_integrity_code' => '',
'payment_payanyway_server' => 'prod',
'payment_payanyway_test_mode' => 0,
'payment_payanyway_fiscalization' => 1,
'payment_payanyway_fiscalization' => 0,
'payment_payanyway_vat_rate' => $this->availableVatRates['vat_none'],
'payment_payanyway_receipt_email' => '',
'payment_payanyway_payment_method' => self::DEFAULT_PAYMENT_METHOD,
'payment_payanyway_payment_object' => self::DEFAULT_PAYMENT_OBJECT,
@@ -246,9 +246,10 @@ class ControllerExtensionPaymentPayanyway extends Controller {
$this->error['account'] = $this->language->get('error_account');
}
// OpenCart экранирует весь POST (htmlspecialchars в system/library/request.php): код с & " < >
// сохранился бы экранированным, и подписи не сошлись бы с MONETA.RU.
$integrityCode = $this->decodePostedString($request, 'payment_payanyway_integrity_code');
if (('' === $integrityCode) && $this->hasIntegrityCode()) {
$integrityCode = (string)$this->config->get('payment_payanyway_integrity_code');
}
if ('' === $integrityCode) {
$this->error['integrity_code'] = $this->language->get('error_integrity_code');
}
@@ -278,7 +279,9 @@ class ControllerExtensionPaymentPayanyway extends Controller {
$canceled = isset($request->post['payment_payanyway_canceled_order_status_ids'])
? (array)$request->post['payment_payanyway_canceled_order_status_ids']
: array();
$request->post['payment_payanyway_canceled_order_status_ids'] = array_values(array_unique(array_map('intval', $canceled)));
$request->post['payment_payanyway_canceled_order_status_ids'] = array_values(array_unique(array_filter(array_map('intval', $canceled), function ($statusId) {
return $statusId > 0;
})));
if (empty($request->post['payment_payanyway_pending_order_status_id'])) {
$this->error['pending_order_status'] = $this->language->get('error_order_status');
@@ -290,6 +293,19 @@ class ControllerExtensionPaymentPayanyway extends Controller {
$this->error['error_order_status'] = $this->language->get('error_order_status');
}
// Статус ожидания или ошибки среди отменённых: Check и Pay URL ответили бы на настоящую оплату
// 500, и MONETA.RU прекратила бы уведомления — деньги списаны, заказ не оплачен.
$moduleStatuses = array();
foreach (array('pending', 'success', 'error') as $status) {
$key = 'payment_payanyway_' . $status . '_order_status_id';
if (!empty($request->post[$key])) {
$moduleStatuses[] = (int)$request->post[$key];
}
}
if (array_intersect($request->post['payment_payanyway_canceled_order_status_ids'], $moduleStatuses)) {
$this->error['canceled_order_status'] = $this->language->get('error_canceled_order_status');
}
$sortOrder = isset($request->post['payment_payanyway_sort_order'])
? (int)$request->post['payment_payanyway_sort_order']
: self::MODULE_DEFAULT_SORT_ORDER;
@@ -311,6 +327,7 @@ class ControllerExtensionPaymentPayanyway extends Controller {
$data['error_pending_order_status'] = isset($this->error['pending_order_status']) ? $this->error['pending_order_status'] : '';
$data['error_success_order_status'] = isset($this->error['success_order_status']) ? $this->error['success_order_status'] : '';
$data['error_error_order_status'] = isset($this->error['error_order_status']) ? $this->error['error_order_status'] : '';
$data['error_canceled_order_status'] = isset($this->error['canceled_order_status']) ? $this->error['canceled_order_status'] : '';
}
/** @return array<int, array{text: string, href: string}> */
@@ -331,12 +348,9 @@ class ControllerExtensionPaymentPayanyway extends Controller {
);
}
/**
* @param string $key
* @return string
*/
private function getIntegrityCode($key) {
return htmlspecialchars((string)$this->retrieveRawValue($key), ENT_QUOTES, 'UTF-8');
/** @return bool код проверки целостности уже сохранён */
private function hasIntegrityCode() {
return '' !== (string)$this->config->get('payment_payanyway_integrity_code');
}
/**
upload/admin/language/en-gb/extension/payment/payanyway.php
+5 -3
View File
@@ -1,6 +1,6 @@
<?php
// Heading
$_['heading_title'] = 'PayAnyWay';
$_['heading_title'] = 'PayAnyWay (MONETA)';
// Text
$_['text_extension'] = 'Extensions';
@@ -15,6 +15,7 @@ $_['entry_account_label'] = 'Account number';
$_['entry_account_description'] = 'Your extended account number in the MONETA.RU system';
$_['entry_integrity_code_label'] = 'Integrity Code';
$_['entry_integrity_code_description'] = 'Data integrity verification code specified in the extended account settings in the MONETA.RU system';
$_['text_integrity_code_saved'] = 'The code is saved. Leave the field empty to keep it';
$_['entry_server_label'] = 'Payment server';
$_['entry_server_prod_label'] = 'Production';
$_['entry_server_demo_label'] = 'Demo';
@@ -89,8 +90,8 @@ $_['help_sort_order'] = 'Determines the display order of the payment m
$_['help_test_mode'] = 'Simulates payments without charging. Must match the account setting in MONETA.RU';
$_['help_fiscalization'] = 'Enable only if the kassa.payanyway.ru cash register service is connected to the account';
$_['help_receipt_email'] = 'Required with fiscalization. Used in the receipt only when the customer has neither e-mail nor phone: the cash register does not accept a receipt without a contact, so it is sent to this address (the customer name stays in the receipt)';
$_['help_canceled_order_status'] = 'Orders in these statuses are not paid: the module rejects the check request';
$_['help_callback_url'] = 'Set this address as Check URL and Pay URL in the MONETA.RU account settings. It must be reachable from the internet';
$_['help_canceled_order_status'] = 'Orders in these statuses are not paid: the module rejects the check request and the payment notification';
$_['help_callback_url'] = 'Set this address as Check URL and Pay URL in the extended account settings';
// Button
$_['button_integrity_code_toggle'] = 'Show or hide';
@@ -106,4 +107,5 @@ $_['error_permission'] = 'Warning: You do not have permission to modify paym
$_['error_account'] = 'Account number is required and must contain digits only';
$_['error_integrity_code'] = 'Account Integrity Code Required';
$_['error_order_status'] = 'Select order status';
$_['error_canceled_order_status'] = 'Pending, Success and Error order statuses cannot be among Canceled';
$_['error_receipt_email'] = 'Enter a valid e-mail no longer than 64 characters';
upload/admin/language/ru-ru/extension/payment/payanyway.php
+5 -3
View File
@@ -1,6 +1,6 @@
<?php
// Heading
$_['heading_title'] = 'PayAnyWay';
$_['heading_title'] = 'PayAnyWay (МОНЕТА)';
// Text
$_['text_extension'] = 'Расширения';
@@ -15,6 +15,7 @@ $_['entry_account_label'] = 'Номер счёта';
$_['entry_account_description'] = 'Ваш номер расширенного счёта в системе MONETA.RU';
$_['entry_integrity_code_label'] = 'Код проверки целостности данных';
$_['entry_integrity_code_description'] = 'Код проверки целостности данных, указанный в настройках расширенного счёта в системе MONETA.RU';
$_['text_integrity_code_saved'] = 'Код сохранён. Оставьте поле пустым, чтобы не менять его';
$_['entry_server_label'] = 'Сервер платежей';
$_['entry_server_prod_label'] = 'Боевой';
$_['entry_server_demo_label'] = 'Демо';
@@ -89,8 +90,8 @@ $_['help_sort_order'] = 'Определяет порядок отоб
$_['help_test_mode'] = 'Имитация оплаты без реального списания средств. Режим должен совпадать с настройкой счёта в MONETA.RU';
$_['help_fiscalization'] = 'Включайте, только если к счёту подключён кассовый сервис kassa.payanyway.ru';
$_['help_receipt_email'] = 'Обязателен при фискализации. Подставляется в чек, только если у покупателя нет ни e-mail, ни телефона: без контакта касса чек не примет, поэтому он уйдёт на этот адрес (ФИО покупателя в чеке остаётся)';
$_['help_canceled_order_status'] = 'Заказ в этих статусах не оплачивается: на проверочный запрос модуль отвечает отказом';
$_['help_callback_url'] = 'Укажите этот адрес в настройках счёта MONETA.RU как Check URL и Pay URL. Он должен быть доступен из интернета';
$_['help_canceled_order_status'] = 'Заказ в этих статусах не оплачивается: на проверочный запрос и уведомление об оплате модуль отвечает отказом';
$_['help_callback_url'] = 'Укажите этот адрес в настройках расширенного счёта как Check URL и Pay URL';
// Button
$_['button_integrity_code_toggle'] = 'Показать или скрыть';
@@ -106,4 +107,5 @@ $_['error_permission'] = 'Недостаточно прав для изме
$_['error_account'] = 'Номер счёта обязателен и состоит только из цифр';
$_['error_integrity_code'] = 'Код проверки целостности данных обязателен';
$_['error_order_status'] = 'Выберите статус заказа';
$_['error_canceled_order_status'] = 'Статусы Обрабатываемого, Успешного и Неуспешного заказа не могут быть среди Отменённых';
$_['error_receipt_email'] = 'Укажите корректный e-mail не длиннее 64 символов';
upload/admin/view/template/extension/payment/payanyway.twig
+5 -2
View File
@@ -71,8 +71,8 @@
<label class="col-sm-2 control-label" for="input-integrity-code">{{ entry_integrity_code_label }}</label>
<div class="col-sm-10">
<div class="input-group">
<input type="password" name="payment_payanyway_integrity_code" value="{{ payment_payanyway_integrity_code }}"
placeholder="{{ entry_integrity_code_description }}" id="input-integrity-code"
<input type="password" name="payment_payanyway_integrity_code" value=""
placeholder="{{ integrity_code_placeholder }}" id="input-integrity-code"
class="form-control" autocomplete="off"/>
<span class="input-group-btn">
<button type="button" class="btn btn-default" id="button-integrity-code-toggle"
@@ -293,6 +293,9 @@
</div>
{% endfor %}
</div>
{% if error_canceled_order_status %}
<div class="text-danger">{{ error_canceled_order_status }}</div>
{% endif %}
</div>
</div>
</div>