From 853e067052ebb63e879249eb746f98451d9191dc Mon Sep 17 00:00:00 2001 From: ellynoize Date: Fri, 31 Jul 2026 13:15:30 +0300 Subject: [PATCH 1/2] sec_fix --- .../intaro/main.register/component.php | 7 ++++- .../intaro/sale.order.ajax/class.php | 31 ++++++++++++++++++- 2 files changed, 36 insertions(+), 2 deletions(-) diff --git a/intaro.retailcrm/install/export/local/components/intaro/main.register/component.php b/intaro.retailcrm/install/export/local/components/intaro/main.register/component.php index 05f4c87cd..e0c4303d4 100644 --- a/intaro.retailcrm/install/export/local/components/intaro/main.register/component.php +++ b/intaro.retailcrm/install/export/local/components/intaro/main.register/component.php @@ -268,7 +268,12 @@ } // verify phone code -if ($_SERVER["REQUEST_METHOD"] == "POST" && $_REQUEST["code_submit_button"] <> '' && !$USER->IsAuthorized()) +if ( + $_SERVER["REQUEST_METHOD"] == "POST" + && check_bitrix_sessid() + && $_REQUEST["code_submit_button"] <> '' + && !$USER->IsAuthorized() +) { if($_REQUEST["SIGNED_DATA"] <> '') { diff --git a/intaro.retailcrm/install/export/local/components/intaro/sale.order.ajax/class.php b/intaro.retailcrm/install/export/local/components/intaro/sale.order.ajax/class.php index 2a2969e36..ce9b9f7d9 100644 --- a/intaro.retailcrm/install/export/local/components/intaro/sale.order.ajax/class.php +++ b/intaro.retailcrm/install/export/local/components/intaro/sale.order.ajax/class.php @@ -1378,9 +1378,20 @@ protected function confirmSmsCodeAction() { global $USER; + if (!$this->request->isPost() || !$this->checkSession) + { + $this->showAjaxAnswer([ + 'error' => Loc::getMessage('SESSID_ERROR'), + ]); + + return; + } + if ($USER->IsAuthorized()) { $this->refreshOrderAjaxAction(); + + return; } $request = $this->request->get('order') ?: []; @@ -4620,6 +4631,15 @@ protected function saveOrderAjaxAction() */ protected function enterCouponAction() { + if (!$this->request->isPost() || !$this->checkSession) + { + $this->showAjaxAnswer([ + 'error' => Loc::getMessage('SESSID_ERROR'), + ]); + + return; + } + $coupon = trim($this->request->get('coupon')); if (!empty($coupon)) @@ -4640,6 +4660,15 @@ protected function enterCouponAction() */ protected function removeCouponAction() { + if (!$this->request->isPost() || !$this->checkSession) + { + $this->showAjaxAnswer([ + 'error' => Loc::getMessage('SESSID_ERROR'), + ]); + + return; + } + $coupon = htmlspecialchars_decode(trim($this->request->get('coupon'))); if (!empty($coupon)) @@ -6252,4 +6281,4 @@ public function executeComponent() die(); } } -} \ No newline at end of file +} From ff994d9823cec50154d5c3b84463e7e4c259d3d1 Mon Sep 17 00:00:00 2001 From: danila Date: Wed, 19 Aug 2026 09:24:59 +0500 Subject: [PATCH 2/2] =?UTF-8?q?=D0=9E=D0=B1=D1=8A=D0=B5=D0=B4=D0=B8=D0=BD?= =?UTF-8?q?=D0=B5=D0=BD=D1=8B=20=D0=B8=D1=81=D0=BF=D1=80=D0=B0=D0=B2=D0=BB?= =?UTF-8?q?=D0=B5=D0=BD=D0=B8=D1=8F=20PR=20#438=20=D0=B8=20#439?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- CHANGELOG.md | 4 ++++ intaro.retailcrm/classes/general/events/RetailCrmEvent.php | 1 + intaro.retailcrm/description.ru | 2 +- intaro.retailcrm/install/version.php | 4 ++-- intaro.retailcrm/lib/component/constants.php | 2 +- 5 files changed, 9 insertions(+), 4 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index e61f8a56c..d81e1fa96 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,3 +1,7 @@ +## 2026-08-19 v6.9.1 +- Исправлены замечания по безопасности модуля. Уточнены защитные проверки в публичных сценариях после повторной проверки приложения на Маркетплейсе. +- Добавлено подключение класса Utils в RetailCrmEvent.php. + ## 2026-07-27 v6.9.0 - Добавлена поддержка мультисайтовости для типа контрагента - Исправлена установка и обновление модуля diff --git a/intaro.retailcrm/classes/general/events/RetailCrmEvent.php b/intaro.retailcrm/classes/general/events/RetailCrmEvent.php index 0f7f2414d..beb04b3e2 100644 --- a/intaro.retailcrm/classes/general/events/RetailCrmEvent.php +++ b/intaro.retailcrm/classes/general/events/RetailCrmEvent.php @@ -25,6 +25,7 @@ use Intaro\RetailCrm\Component\ConfigProvider; use Intaro\RetailCrm\Model\Api\Response\OrdersCreateResponse; use Intaro\RetailCrm\Model\Api\Response\OrdersEditResponse; +use Intaro\RetailCrm\Service\Utils; /** * Class RetailCrmEvent diff --git a/intaro.retailcrm/description.ru b/intaro.retailcrm/description.ru index 09289a856..5b85324f0 100644 --- a/intaro.retailcrm/description.ru +++ b/intaro.retailcrm/description.ru @@ -1 +1 @@ -- Добавлена поддержка мультисайтовости для типа контрагента +- Исправлены защитные проверки в публичных сценариях. Добавлено подключение класса Utils в RetailCrmEvent.php. diff --git a/intaro.retailcrm/install/version.php b/intaro.retailcrm/install/version.php index 3b59382ef..13ea5b9b9 100644 --- a/intaro.retailcrm/install/version.php +++ b/intaro.retailcrm/install/version.php @@ -1,6 +1,6 @@ '6.9.0', - 'VERSION_DATE' => '2026-07-27 12:00:00' + 'VERSION' => '6.9.1', + 'VERSION_DATE' => '2026-08-19 12:00:00' ]; diff --git a/intaro.retailcrm/lib/component/constants.php b/intaro.retailcrm/lib/component/constants.php index 03b4d9712..70b394e59 100644 --- a/intaro.retailcrm/lib/component/constants.php +++ b/intaro.retailcrm/lib/component/constants.php @@ -18,7 +18,7 @@ */ class Constants { - public const MODULE_VERSION = '6.9.0'; + public const MODULE_VERSION = '6.9.1'; public const CRM_PURCHASE_PRICE_NULL = 'purchasePrice_null'; public const BITRIX_USER_ID_PREFIX = 'bitrixUserId-'; public const CRM_USERS_MAP = 'crm_users_map';