Include new parameters in session and authorize to support MarketPay integration - #158
BushraAsif wants to merge 9 commits into
Conversation
| { | ||
| $db = Db::getInstance(); | ||
|
|
||
| $uniqueId = $db->getValue('SELECT unique_id FROM `' . _DB_PREFIX_ . 'altapay_transaction` WHERE id_cart = ' . $cartId); |
There was a problem hiding this comment.
Remember to cast, you can't guarantee that the layer using the method will do the casting for you
| @@ -17,23 +19,112 @@ public function postProcess() | |||
| { | |||
| $currentShopId = $this->context->shop->id; | |||
| $validationUrl = Tools::getValue('validationUrl'); | |||
There was a problem hiding this comment.
Shouldn't we validate this is a valid url ?
There was a problem hiding this comment.
Good catch — I’ve added a check for this now.
| ->setDomain($domain); | ||
|
|
||
| if (!$terminal->applepay_legacy_flow) { | ||
| $requestedAmount = (float) Tools::getValue('amount'); |
There was a problem hiding this comment.
Casting can return valid numeric values for bad input such as "", boolean, etc.
This can caause the requested amount to be an unexpected value
Ensure requested amount is numeric and validate URL.
| ->setDomain($domain); | ||
|
|
||
| if (!$terminal->applepay_legacy_flow) { | ||
| $requestedAmount = Tools::getValue('amount'); |
There was a problem hiding this comment.
Where is the value coming from? Is that coming from the front? If yes, then it looks to be exposed for an attacker to be tampered => a lower value retrieved by the merchant
|
|
||
| if (!empty($paymentId)) { | ||
| $sql = 'INSERT INTO `' . _DB_PREFIX_ . 'altapay_cartInfo` (id_cart, date_add, payment_id, shop_order_id) VALUES (' | ||
| . (int) $cart->id . ", '" . pSQL(time()) . "', '" . pSQL($paymentId) . "', '" . pSQL($shopOrderId) . "')" |
There was a problem hiding this comment.
$cart->id might be null if cardwalletsession is invoked by a user whose session has expired.
The code currently inserts a row into the altapay_cartInfo table using (int) $cart->id, which will result in inserting 0 as the id_cart.
Maybe you should validate the $cart->id
| data: { | ||
| validationUrl: event.validationURL, | ||
| termminalid: terminalId | ||
| termminalid: terminalId, |
4 participants
No description provided.