From d4d0dc58aed19022a27072f5ee6b3224d5360dab Mon Sep 17 00:00:00 2001
From: ellynoize <na1ton.trik@gmail.com>
Date: Fri, 31 Jul 2026 13:15:30 +0300
Subject: [PATCH 1/2] sec_fix

---
 .../intaro/main.register/component.php        |  7 ++++-
 .../intaro/sale.order.ajax/class.php          | 31 ++++++++++++++++++-
 2 files changed, 36 insertions(+), 2 deletions(-)

diff --git a/intaro.retailcrm/install/export/local/components/intaro/main.register/component.php b/intaro.retailcrm/install/export/local/components/intaro/main.register/component.php
index 05f4c87cd..e0c4303d4 100644
--- a/intaro.retailcrm/install/export/local/components/intaro/main.register/component.php
+++ b/intaro.retailcrm/install/export/local/components/intaro/main.register/component.php
@@ -268,7 +268,12 @@
 }
 
 // verify phone code
-if ($_SERVER["REQUEST_METHOD"] == "POST" && $_REQUEST["code_submit_button"] <> '' && !$USER->IsAuthorized())
+if (
+    $_SERVER["REQUEST_METHOD"] == "POST"
+    && check_bitrix_sessid()
+    && $_REQUEST["code_submit_button"] <> ''
+    && !$USER->IsAuthorized()
+)
 {
 	if($_REQUEST["SIGNED_DATA"] <> '')
 	{
diff --git a/intaro.retailcrm/install/export/local/components/intaro/sale.order.ajax/class.php b/intaro.retailcrm/install/export/local/components/intaro/sale.order.ajax/class.php
index 2a2969e36..ce9b9f7d9 100644
--- a/intaro.retailcrm/install/export/local/components/intaro/sale.order.ajax/class.php
+++ b/intaro.retailcrm/install/export/local/components/intaro/sale.order.ajax/class.php
@@ -1378,9 +1378,20 @@ protected function confirmSmsCodeAction()
 	{
 		global $USER;
 
+		if (!$this->request->isPost() || !$this->checkSession)
+		{
+			$this->showAjaxAnswer([
+				'error' => Loc::getMessage('SESSID_ERROR'),
+			]);
+
+			return;
+		}
+
 		if ($USER->IsAuthorized())
 		{
 			$this->refreshOrderAjaxAction();
+
+			return;
 		}
 
 		$request = $this->request->get('order') ?: [];
@@ -4620,6 +4631,15 @@ protected function saveOrderAjaxAction()
 	 */
 	protected function enterCouponAction()
 	{
+		if (!$this->request->isPost() || !$this->checkSession)
+		{
+			$this->showAjaxAnswer([
+				'error' => Loc::getMessage('SESSID_ERROR'),
+			]);
+
+			return;
+		}
+
 		$coupon = trim($this->request->get('coupon'));
 
 		if (!empty($coupon))
@@ -4640,6 +4660,15 @@ protected function enterCouponAction()
 	 */
 	protected function removeCouponAction()
 	{
+		if (!$this->request->isPost() || !$this->checkSession)
+		{
+			$this->showAjaxAnswer([
+				'error' => Loc::getMessage('SESSID_ERROR'),
+			]);
+
+			return;
+		}
+
 		$coupon = htmlspecialchars_decode(trim($this->request->get('coupon')));
 
 		if (!empty($coupon))
@@ -6252,4 +6281,4 @@ public function executeComponent()
 			die();
 		}
 	}
-}
\ No newline at end of file
+}

From e2ce5833c240487ea58b3a20625d4285ba7c79a8 Mon Sep 17 00:00:00 2001
From: ellynoize <na1ton.trik@gmail.com>
Date: Fri, 31 Jul 2026 13:27:37 +0300
Subject: [PATCH 2/2] bump

---
 CHANGELOG.md                                 | 3 +++
 intaro.retailcrm/description.ru              | 2 +-
 intaro.retailcrm/install/version.php         | 4 ++--
 intaro.retailcrm/lib/component/constants.php | 2 +-
 4 files changed, 7 insertions(+), 4 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index e61f8a56c..09803a2a4 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,3 +1,6 @@
+## 2026-07-31 v6.9.1
+- Исправлены замечания по безопасности модуля. Уточнены защитные проверки в публичных сценариях после повторной проверки приложения на Маркетплейсе.
+
 ## 2026-07-27 v6.9.0
 - Добавлена поддержка мультисайтовости для типа контрагента
 - Исправлена установка и обновление модуля
diff --git a/intaro.retailcrm/description.ru b/intaro.retailcrm/description.ru
index 09289a856..49f60096f 100644
--- a/intaro.retailcrm/description.ru
+++ b/intaro.retailcrm/description.ru
@@ -1 +1 @@
-- Добавлена поддержка мультисайтовости для типа контрагента
+- Исправлены замечания по безопасности модуля. Уточнены защитные проверки в публичных сценариях после повторной проверки приложения на Маркетплейсе.
diff --git a/intaro.retailcrm/install/version.php b/intaro.retailcrm/install/version.php
index 3b59382ef..2f68a9a32 100644
--- a/intaro.retailcrm/install/version.php
+++ b/intaro.retailcrm/install/version.php
@@ -1,6 +1,6 @@
 <?php
 
 $arModuleVersion = [
-    'VERSION'      => '6.9.0',
-    'VERSION_DATE' => '2026-07-27 12:00:00'
+    'VERSION'      => '6.9.1',
+    'VERSION_DATE' => '2026-07-31 12:00:00'
 ];
diff --git a/intaro.retailcrm/lib/component/constants.php b/intaro.retailcrm/lib/component/constants.php
index 03b4d9712..70b394e59 100644
--- a/intaro.retailcrm/lib/component/constants.php
+++ b/intaro.retailcrm/lib/component/constants.php
@@ -18,7 +18,7 @@
  */
 class Constants
 {
-    public const MODULE_VERSION = '6.9.0';
+    public const MODULE_VERSION = '6.9.1';
     public const CRM_PURCHASE_PRICE_NULL = 'purchasePrice_null';
     public const BITRIX_USER_ID_PREFIX = 'bitrixUserId-';
     public const CRM_USERS_MAP = 'crm_users_map';