From f651a03d025b86177829a3a13073eb3c369fdd44 Mon Sep 17 00:00:00 2001 From: danila Date: Wed, 19 Aug 2026 19:12:48 +0500 Subject: [PATCH 1/2] =?UTF-8?q?=D0=9F=D1=80=D0=BE=D0=B2=D0=B5=D1=80=D0=B5?= =?UTF-8?q?=D0=BD=D0=B0=20=D0=BF=D1=80=D0=B8=D0=BD=D0=B0=D0=B4=D0=BB=D0=B5?= =?UTF-8?q?=D0=B6=D0=BD=D0=BE=D1=81=D1=82=D1=8C=20=D1=83=D1=87=D0=B0=D1=81?= =?UTF-8?q?=D1=82=D0=B8=D1=8F=20=D0=BF=D1=80=D0=B8=20=D0=BF=D0=BE=D0=B2?= =?UTF-8?q?=D1=82=D0=BE=D1=80=D0=BD=D0=BE=D0=B9=20=D0=BE=D1=82=D0=BF=D1=80?= =?UTF-8?q?=D0=B0=D0=B2=D0=BA=D0=B5=20SMS?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- intaro.retailcrm/lib/controller/loyalty/register.php | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/intaro.retailcrm/lib/controller/loyalty/register.php b/intaro.retailcrm/lib/controller/loyalty/register.php index def3ed5c..fb5d1454 100644 --- a/intaro.retailcrm/lib/controller/loyalty/register.php +++ b/intaro.retailcrm/lib/controller/loyalty/register.php @@ -325,6 +325,14 @@ public function resendRegisterSmsAction(string $idInLoyalty): ?array return ['msg' => GetMessage('ARGUMENT_ERROR')]; } + global $USER; + + $currentLoyaltyAccountId = LoyaltyAccountService::getLoyaltyAccountId((int) $USER->GetID()); + + if ($currentLoyaltyAccountId === null || $currentLoyaltyAccountId !== (int) $idInLoyalty) { + return ['msg' => 'Forbidden']; + } + /** @var LoyaltyAccountService $service */ $service = ServiceLocator::get(LoyaltyAccountService::class); From 8079885da8bf420841130012624de5f301f6e764 Mon Sep 17 00:00:00 2001 From: danila Date: Thu, 20 Aug 2026 10:10:18 +0500 Subject: [PATCH 2/2] =?UTF-8?q?=D0=92=D1=8B=D0=BF=D1=83=D1=89=D0=B5=D0=BD?= =?UTF-8?q?=D0=B0=20=D0=B2=D0=B5=D1=80=D1=81=D0=B8=D1=8F=206.9.2=20=D1=81?= =?UTF-8?q?=20=D0=B8=D1=81=D0=BF=D1=80=D0=B0=D0=B2=D0=BB=D0=B5=D0=BD=D0=B8?= =?UTF-8?q?=D0=B5=D0=BC=20=D0=BF=D1=80=D0=BE=D0=B2=D0=B5=D1=80=D0=BA=D0=B8?= =?UTF-8?q?=20=D1=83=D1=87=D0=B0=D1=81=D1=82=D0=B8=D1=8F?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- CHANGELOG.md | 3 +++ intaro.retailcrm/description.ru | 2 +- intaro.retailcrm/install/version.php | 4 ++-- intaro.retailcrm/lib/component/constants.php | 2 +- 4 files changed, 7 insertions(+), 4 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index d81e1fa9..0ee0dddb 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,3 +1,6 @@ +## 2026-08-20 v6.9.2 +- Добавлена проверка принадлежности участия в программе лояльности при повторной отправке SMS. + ## 2026-08-19 v6.9.1 - Исправлены замечания по безопасности модуля. Уточнены защитные проверки в публичных сценариях после повторной проверки приложения на Маркетплейсе. - Добавлено подключение класса Utils в RetailCrmEvent.php. diff --git a/intaro.retailcrm/description.ru b/intaro.retailcrm/description.ru index 5b85324f..a2ae6a25 100644 --- a/intaro.retailcrm/description.ru +++ b/intaro.retailcrm/description.ru @@ -1 +1 @@ -- Исправлены защитные проверки в публичных сценариях. Добавлено подключение класса Utils в RetailCrmEvent.php. +- Добавлена проверка принадлежности участия в программе лояльности при повторной отправке SMS. diff --git a/intaro.retailcrm/install/version.php b/intaro.retailcrm/install/version.php index 13ea5b9b..5dcf6826 100644 --- a/intaro.retailcrm/install/version.php +++ b/intaro.retailcrm/install/version.php @@ -1,6 +1,6 @@ '6.9.1', - 'VERSION_DATE' => '2026-08-19 12:00:00' + 'VERSION' => '6.9.2', + 'VERSION_DATE' => '2026-08-20 12:00:00' ]; diff --git a/intaro.retailcrm/lib/component/constants.php b/intaro.retailcrm/lib/component/constants.php index 70b394e5..7debcfd4 100644 --- a/intaro.retailcrm/lib/component/constants.php +++ b/intaro.retailcrm/lib/component/constants.php @@ -18,7 +18,7 @@ */ class Constants { - public const MODULE_VERSION = '6.9.1'; + public const MODULE_VERSION = '6.9.2'; public const CRM_PURCHASE_PRICE_NULL = 'purchasePrice_null'; public const BITRIX_USER_ID_PREFIX = 'bitrixUserId-'; public const CRM_USERS_MAP = 'crm_users_map';