WordPress.org
Get WordPress

Plugin Directory

Changeset 3206473


Ignore:
Timestamp:
12/11/2024 03:56:54 PM (14 months ago)
Author:
planetstudio
Message:

*Fixed a CSRF vulnerability in the plugin settings.
*Added CSRF protection for all requests using security tokens (nonce).
*Improved data validation and sanitization to prevent XSS attacks.

Location:
arca-payment-gateway
Files:
24 edited

Legend:

Unmodified
Added
Removed

  • arca-payment-gateway/tags/1.3.1/arca-payment-gateway.php

    r2925816 r3206473  
    22/**
    33 * Plugin Name: ArCa Payment Gateway
    4  * Description: ArCa payment gateway, this Plugin allows you to accept online payments from local and international customers to Armenian banks, Idram payment system and adds ArCa paycenter as a payment gateway for WooCommerce and for GiveWP donation Plugin.
     4 * Description: ArCa payment gateway, this Plugin allows you to accept online payments from local and international customers to Armenian banks, Idram payment system and adds ArCa paycenter as a payment gateway for WooCommerce and for GiveWP donation Plugin and TATIOSA hotel booking management platform.
    55 * Version: 1.3.1
    66 * Author: Planet Studio team
    … …  
    1414error_reporting(E_ALL);
    1515*/
     16
    1617defined('ABSPATH') || die('Access Denied');
    1718//define('ARCAPG_PREFIX', 'apg');
    … …  
    1920define('ARCAPG_DIR_NAME', dirname(plugin_basename( __FILE__ )));
    2021define('ARCAPG_URL', plugins_url(plugin_basename(dirname(__FILE__))));
    21 define('ARCAPG_VERSION', '1.3.1');
     22define('ARCAPG_VERSION', '1.3.2');
    2223define('ARCAPG_PRO', FALSE);
    2324
    … …  
    112113   }
    113114
     115   // wp verify nonce
     116   require_once ('includes/apg-wp-verify-nonce.php');
     117
    114118}
    115119

  • arca-payment-gateway/tags/1.3.1/endpoints/apg-ameria-bank.php

    r2925816 r3206473  
    1616    $productId    = ( !empty($_REQUEST["productId"]) ) ? intval($_REQUEST["productId"]) : 0;
    1717    $amount       = ( !empty($_REQUEST["amount"]) ) ? doubleval($_REQUEST["amount"]) : 0;
    18     $description  = ( !empty($_REQUEST["description"]) ) ? sanitize_text_field($_REQUEST["description"]) : __( "Online payment", 'apg' );
     18    $description  = parse_url( get_site_url() )['host']; //( !empty($_REQUEST["description"]) ) ? sanitize_text_field($_REQUEST["description"]) : __( "Online payment", 'apg' );
    1919    $language     = ( !empty($_REQUEST["language"]) ) ? sanitize_text_field($_REQUEST["language"]) : $arca_config->default_language;
    2020    $currency     = ( !empty($_REQUEST["currency"]) ) ? sanitize_text_field($_REQUEST["currency"]) : $arca_config->default_currency;
    2121    $custom_amount  = ( !empty($_REQUEST["custom_amount"]) && intval($_REQUEST["custom_amount"]) == 1 ) ? 1 : 0;
     22   
     23    $tatiosa_booking_id   = ( !empty($_REQUEST["bookid"]) ) ? intval($_REQUEST["bookid"]) : null;
     24    $tatiosa_booking_Key    =   ( !empty($_REQUEST["key"]) ) ? sanitize_text_field($_REQUEST["key"]) : null;
    2225   
    2326    // get payment initiator, woocommerce, givewp or apg
    … …  
    4649       
    4750        if (!isset($currency)) array_push($errMgs, "Incorect currency:" . $currency);
     51       
     52    } else if (isset($tatiosa_booking_id)) {
     53
     54
     55        // validate currency
     56        $resultCount = $wpdb->get_var($wpdb->prepare("SELECT COUNT(*) from " . $wpdb->prefix . "arca_pg_currency where (abbr = '%s' or code = '%s') and active = 1", $currency, $currency));
     57        if ($resultCount == 0) array_push($errMgs, "Incorect currency:" . $currency);
     58
    4859       
    4960    } else {
    … …  
    130141                    'Amount'        => $amount,
    131142                    'Currency'      => $currency,
    132                     'BackURL'       => get_site_url() . "?arca_process=payment_completed&wc_orderId=$wc_orderId&gwp_donationId=$gwp_donationId&language=$language&currency=$currency",
     143                    'BackURL'       => get_site_url() . "?arca_process=payment_completed&wc_orderId=$wc_orderId&gwp_donationId=$gwp_donationId&language=$language&currency=$currency&tatiosa_booking_id=$tatiosa_booking_id",
    133144                    'Description'   => $description,
    134145                ),
    … …  
    192203    $wc_orderId     = ( !empty($_REQUEST["wc_orderId"]) ) ? intval($_REQUEST["wc_orderId"]) : null;
    193204    $gwp_donationId = ( !empty($_REQUEST["gwp_donationId"]) ) ? intval($_REQUEST["gwp_donationId"]) : null;
     205   
     206    $tatiosa_booking_id   = ( !empty($_REQUEST["tatiosa_booking_id"]) ) ? intval($_REQUEST["tatiosa_booking_id"]) : null;
     207   
    194208
    195209    if ( $resposneCode == "00" ) {
    … …  
    217231        // get previous stored requests
    218232        $OrderStatusExtended =  json_decode( $wpdb->get_var("select OrderStatusExtended from " . $wpdb->prefix . "arca_pg_orders where orderNumber = '$orderID'"), true );
    219 
     233       
    220234        // add new request
    221235        $OrderStatusExtended = array_merge($OrderStatusExtended, array( "Response 2" => json_decode($response, true) ) );
    … …  
    249263                $sql = "update " . $wpdb->prefix . "arca_pg_orders set mailSent = 1 where orderNumber = $orderID";
    250264                $wpdb->query($sql);
     265               
    251266
    252267                // get wc return url
    … …  
    270285                give_send_to_success_page();
    271286                exit;
    272 
    273             }
     287               
     288            // if tatiosa booking
     289            } else if(isset($tatiosa_booking_id)){
     290               
     291
     292                // get ws order status processing or failed
     293                $apg_booking_orderStatus = ( $paymentState == 'DEPOSITED' ) ? 1 : 0; //booking status, 0 (cancelled), 1 (confirmed), 2 (new), 3 (request)
     294                $code = 0;
     295               
     296                if( $apg_booking_orderStatus == 1){
     297                   
     298                    $tatiosa_booking_Key = parse_url( get_site_url() )['host'];
     299                    $description = 'Paid via Credit Card';
     300                    $payment_status = 'Successful';
     301                    $amount = $response->ApprovedAmount;
     302
     303                    // notify of payment status tatiosa.net
     304                    $booking_orderStatus_url =  "https://tatiosa.net/api/custompaymentgateway/notify.php";
     305                    $args = array(
     306                        'headers'     => array('Content-Type: text/html; charset=UTF-8'),
     307                        'body'        => array(
     308                            'key'           => $tatiosa_booking_Key,
     309                            'bookid'    => $tatiosa_booking_id,
     310                            'status'     => $apg_booking_orderStatus,
     311                            'amount'     => $amount,
     312                            'description' => $description,
     313                            'payment_status' => $payment_status,
     314                        ),
     315                        'method'      => 'POST',
     316                        'data_format' => 'body',
     317                    );
     318                    $response = wp_remote_post( $booking_orderStatus_url, $args );
     319
     320
     321                    // get booking system status
     322                    $code = wp_remote_retrieve_response_code( $response );
     323                    if($code != 200){
     324                        arca_pg_errorCatch("Booking system respons error: " . json_encode($response, JSON_UNESCAPED_UNICODE), $wc_orderId, $gwp_donationId);
     325                    }
     326                   
     327                }
     328               
     329                // get previous stored requests
     330                $OrderStatusExtended =  json_decode( $wpdb->get_var("select OrderStatusExtended from " . $wpdb->prefix . "arca_pg_orders where orderNumber = '$orderID'"), true );
     331
     332                // add new request
     333                $OrderStatusExtended = array_merge($OrderStatusExtended, array( "Booking System Response 1" => json_decode('{"Status": '.$code.'}', true) ) );
     334
     335                $OrderStatusExtended = json_encode( $OrderStatusExtended );
     336               
     337                // update order row from REST response
     338                $sql = "update " . $wpdb->prefix . "arca_pg_orders set OrderStatusExtended = '$OrderStatusExtended', paymentState = 'Successful' where orderNumber = $orderID";
     339                $wpdb->query($sql);             
     340                   
     341            }
    274342
    275343            // get language

  • arca-payment-gateway/tags/1.3.1/endpoints/apg-arca.php

    r2925816 r3206473  
    1616    $productId      =   ( !empty($_REQUEST["productId"]) ) ? intval($_REQUEST["productId"]) : 0;
    1717    $amount         =   ( !empty($_REQUEST["amount"]) ) ? doubleval($_REQUEST["amount"]) : 0;
    18     $description    =   ( !empty($_REQUEST["description"]) ) ? sanitize_text_field($_REQUEST["description"]) : __( "Online payment", 'apg' );
     18    $description    =   parse_url( get_site_url() )['host']; //( !empty($_REQUEST["description"]) ) ? sanitize_text_field($_REQUEST["description"]) : __( "Online payment", 'apg' );
    1919    $language       =   ( !empty($_REQUEST["language"]) ) ? sanitize_text_field($_REQUEST["language"]) : $arca_config->default_language;
    2020    $currency       =   ( !empty($_REQUEST["currency"]) ) ? sanitize_text_field($_REQUEST["currency"]) : $arca_config->default_currency;
    21     $custom_amount  = ( !empty($_REQUEST["custom_amount"]) && intval($_REQUEST["custom_amount"]) == 1 ) ? 1 : 0;
     21    $custom_amount  =   ( !empty($_REQUEST["custom_amount"]) && intval($_REQUEST["custom_amount"]) == 1 ) ? 1 : 0;
     22   
     23    $tatiosa_booking_id   = ( !empty($_REQUEST["bookid"]) ) ? intval($_REQUEST["bookid"]) : null;
     24    $tatiosa_booking_Key    =   ( !empty($_REQUEST["key"]) ) ? sanitize_text_field($_REQUEST["key"]) : null;
     25
    2226   
    2327    // get payment initiator, woocommerce, givewp or apg
    … …  
    4751       
    4852        if (!isset($currency)) array_push($errMgs, "Incorect currency:" . $currency);
     53       
     54    } else if (isset($tatiosa_booking_id)) {
     55       
     56       
     57        // validate currency
     58        $resultCount = $wpdb->get_var($wpdb->prepare("SELECT COUNT(*) from " . $wpdb->prefix . "arca_pg_currency where (abbr = '%s' or code = '%s') and active = 1", $currency, $currency));
     59        if ($resultCount == 0) array_push($errMgs, "Incorect currency:" . $currency);
     60       
    4961       
    5062    } else {
    … …  
    129141                    'amount'      => $amount * 100,
    130142                    'currency'    => $currency,
    131                     'returnUrl'   => get_site_url() . "?arca_process=payment_completed&wc_orderId=$wc_orderId&gwp_donationId=$gwp_donationId&language=$language&currency=$currency",
     143                    'returnUrl'   => get_site_url() . "?arca_process=payment_completed&wc_orderId=$wc_orderId&gwp_donationId=$gwp_donationId&language=$language&currency=$currency&tatiosa_booking_id=$tatiosa_booking_id",
    132144                    'description' => $description,
    133145                    'language'    => $language,
    … …  
    190202    $orderId = sanitize_text_field($_REQUEST['orderId']);
    191203    $currency = sanitize_text_field($_REQUEST['currency']);
     204   
     205    $tatiosa_booking_id   = ( !empty($_REQUEST["tatiosa_booking_id"]) ) ? intval($_REQUEST["tatiosa_booking_id"]) : null;
    192206
    193207    // create order status request from REST / Extended
    … …  
    273287        exit;
    274288
    275     }
     289    // if tatiosa_booking
     290    } else if(isset($tatiosa_booking_id)){
     291       
     292        $response = json_decode($response);
     293        $response = $response->paymentAmountInfo;
     294
     295        // get ws order status processing or failed
     296        $apg_booking_orderStatus = ( $paymentState == 'DEPOSITED' ) ? 1 : 0; //booking status, 0 (cancelled), 1 (confirmed), 2 (new), 3 (request)
     297        $code = 0;     
     298       
     299        if( $apg_booking_orderStatus == 1){
     300
     301            $tatiosa_booking_Key = parse_url( get_site_url() )['host'];
     302            $description = 'Paid via Credit Card';
     303            $payment_status = 'Successful';
     304            $amount = $response->approvedAmount;
     305
     306            // notify of payment status tatiosa.net
     307            $booking_orderStatus_url =  "https://tatiosa.net/api/custompaymentgateway/notify.php";
     308            $args = array(
     309                'headers'     => array('Content-Type: text/html; charset=UTF-8'),
     310                'body'        => array(
     311                    'key'           => $tatiosa_booking_Key,
     312                    'bookid'    => $tatiosa_booking_id,
     313                    'status'     => $apg_booking_orderStatus,
     314                    'amount'     => $amount,
     315                    'description' => $description,
     316                    'payment_status' => $payment_status,
     317                ),
     318                'method'      => 'POST',
     319                'data_format' => 'body',
     320            );
     321            $response = wp_remote_post( $booking_orderStatus_url, $args );
     322
     323
     324            // get booking system status
     325            $code = wp_remote_retrieve_response_code( $response );
     326            if($code != 200){
     327                arca_pg_errorCatch("Booking system respons error: " . json_encode($response, JSON_UNESCAPED_UNICODE), $wc_orderId, $gwp_donationId);
     328            }
     329
     330        }
     331
     332
     333        // get previous stored requests
     334        $OrderStatusExtended =  json_decode( $wpdb->get_var("select OrderStatusExtended from " . $wpdb->prefix . "arca_pg_orders where orderId = '$orderId'"), true );
     335
     336        // add new request
     337        $OrderStatusExtended = array_merge($OrderStatusExtended, array( "Booking System Response 1" => json_decode('{"Status": '.$code.'}', true) ) );
     338
     339        $OrderStatusExtended = json_encode( $OrderStatusExtended );
     340
     341        // update order payment REST response data
     342        $sql = "update " . $wpdb->prefix . "arca_pg_orders set OrderStatusExtended = '$OrderStatusExtended', paymentState = '$paymentState' where orderId = '$orderId'";
     343        $wpdb->query($sql);
     344       
     345       
     346    }
    276347
    277348    // get language

  • arca-payment-gateway/tags/1.3.1/endpoints/apg-idram.php

    r2925816 r3206473  
    121121                $wpdb->query($sql);
    122122
    123                 // if give wp
     123            // if give wp
    124124            } else if(isset($gwp_donationId)){
    125125
    … …  
    134134                $wpdb->query($sql);
    135135
    136             }                   
     136            // if tatiosa_booking
     137            } else if(isset($tatiosa_booking_id)){
     138       
     139                $response = json_decode($response);
     140                $response = $response->paymentAmountInfo;
     141
     142                // get ws order status processing or failed
     143                $apg_booking_orderStatus = 1; //booking status, 0 (cancelled), 1 (confirmed), 2 (new), 3 (request)
     144                $code = 0;             
     145               
     146                if( $apg_booking_orderStatus == 1){
     147
     148                    $tatiosa_booking_Key = parse_url( get_site_url() )['host'];
     149                    $description = 'Paid via Credit Card';
     150                    $payment_status = 'Successful';
     151                    $amount = $response->approvedAmount;
     152
     153                    // notify of payment status tatiosa.net
     154                    $booking_orderStatus_url =  "https://tatiosa.net/api/custompaymentgateway/notify.php";
     155                    $args = array(
     156                        'headers'     => array('Content-Type: text/html; charset=UTF-8'),
     157                        'body'        => array(
     158                            'key'           => $tatiosa_booking_Key,
     159                            'bookid'    => $tatiosa_booking_id,
     160                            'status'     => $apg_booking_orderStatus,
     161                            'amount'     => $amount,
     162                            'description' => $description,
     163                            'payment_status' => $payment_status,
     164                        ),
     165                        'method'      => 'POST',
     166                        'data_format' => 'body',
     167                    );
     168                    $response = wp_remote_post( $booking_orderStatus_url, $args );
     169
     170
     171                    // get booking system status
     172                    $code = wp_remote_retrieve_response_code( $response );
     173                    if($code != 200){
     174                        arca_pg_errorCatch("Booking system respons error: " . json_encode($response, JSON_UNESCAPED_UNICODE), $wc_orderId, $gwp_donationId);
     175                    }
     176
     177                }
     178
     179
     180                // get previous stored requests
     181                $OrderStatusExtended =  json_decode( $wpdb->get_var("select OrderStatusExtended from " . $wpdb->prefix . "arca_pg_orders where orderId = '$orderId'"), true );
     182
     183                // add new request
     184                $OrderStatusExtended = array_merge($OrderStatusExtended, array( "Booking System Response 1" => json_decode('{"Status": '.$code.'}', true) ) );
     185
     186                $OrderStatusExtended = json_encode( $OrderStatusExtended );
     187
     188                // update order payment REST response data
     189                $sql = "update " . $wpdb->prefix . "arca_pg_orders set OrderStatusExtended = '$OrderStatusExtended', paymentState = '$paymentState' where orderId = '$orderId'";
     190                $wpdb->query($sql);
     191
     192            }
    137193
    138194            echo "OK";
    … …  
    172228        exit;
    173229
     230    } else if(isset($tatiosa_booking_id)){
     231       
     232
     233       
    174234    }
    175235

  • arca-payment-gateway/tags/1.3.1/endpoints/apg-inecobank.php

    r2925816 r3206473  
    1515    $productId      =   ( !empty($_REQUEST["productId"]) ) ? intval($_REQUEST["productId"]) : 0;
    1616    $amount         =   ( !empty($_REQUEST["amount"]) ) ? ( (APG_URL_IF_TEST_MODE != "test") ? doubleval($_REQUEST["amount"]) : 10 ) : 0;
    17     $description    =   ( !empty($_REQUEST["description"]) ) ? sanitize_text_field($_REQUEST["description"]) : __( "Online payment", 'apg' );
     17    $description    =   parse_url( get_site_url() )['host']; //( !empty($_REQUEST["description"]) ) ? sanitize_text_field($_REQUEST["description"]) : __( "Online payment", 'apg' );
    1818    $language       =   ( !empty($_REQUEST["language"]) ) ? sanitize_text_field($_REQUEST["language"]) : $arca_config->default_language;
    1919    $currency       =   ( !empty($_REQUEST["currency"]) ) ? sanitize_text_field($_REQUEST["currency"]) : $arca_config->default_currency;

  • arca-payment-gateway/tags/1.3.1/includes/apg-config.php

    r2925816 r3206473  
    374374        <br>
    375375
     376        <?php ps_wp_nonce_field(); ?>
    376377        <input type="hidden" name="rest_serverID" value="<?php echo $row["rest_serverID"]; ?>">
    377378        <input type="hidden" name="act" value="save">
    … …  
    387388        <input disabled readonly="" type="radio" name="rest_serverID" checked value="2"> Test server
    388389        <span class="actions">
     390            <?php ps_wp_nonce_field(); ?>
    389391            <input type="hidden" name="act" value="switch-server">
    390392            <input disabled readonly class="submitLink button-primary" type="button" value="<?php _e( "Switch", 'apg' ) ?>">

  • arca-payment-gateway/tags/1.3.1/includes/apg-error-logs.php

    r2925816 r3206473  
    3232
    3333    <p>
    34         <a style="margin-right:20px" class="linkDelate button" onclick="return confirmDelete();" href="<?php echo esc_url("?page=errorlogs&act=delete_all"); ?>"><?php _e( "Delete All", 'apg' )?></a>
     34        <a style="margin-right:20px" class="linkDelate button" onclick="return confirmDelete();" href="<?php echo esc_url("?page=errorlogs&act=delete_all"); ?>"><?php ps_wp_nonce_arg(); ?><?php _e( "Delete All", 'apg' )?></a>
    3535        <a class="button<?php echo (($rest_serverID == 1) ? '-primary' : '');?>" href="<?php echo esc_url("?page=errorlogs&rest_serverID=1"); ?>"><?php _e( "Real Orders", 'apg' )?></a>
    3636        <a class="button<?php echo (($rest_serverID == 2) ? '-primary' : '');?>" href="<?php echo esc_url("?page=errorlogs&rest_serverID=2"); ?>"><?php _e( "Test Orders", 'apg' )?></a>
    … …  
    5555            <td><?php echo esc_html($row->error); ?></td>
    5656            <td class="actions">
    57                 <a class="linkDelate button" onclick="return confirmDelete();" href="<?php echo esc_url("?page=errorlogs&act=delete&id=" . $row->id); ?>"><?php _e( "Delete", 'apg' )?></a>
     57                <a class="linkDelate button" onclick="return confirmDelete();" href="<?php echo esc_url("?page=errorlogs&act=delete&id=" . $row->id); ?>"><?php ps_wp_nonce_arg(); ?><?php _e( "Delete", 'apg' )?></a>
    5858            </td>
    5959        </tr>

  • arca-payment-gateway/tags/1.3.1/includes/apg-idram-config.php

    r2925816 r3206473  
    204204            </select>
    205205        <?php } ?>
    206        
     206
     207        <?php ps_wp_nonce_field(); ?>
    207208        <input type="hidden" name="act" value="save">
    208209        <input class="submitLink button-primary" type="submit" value="<?php _e( "Save", 'apg' )?>">

  • arca-payment-gateway/tags/1.3.1/includes/apg-orders.php

    r2925816 r3206473  
    5353
    5454    <p>
    55         <a style="margin-right:20px" class="linkDelate button" onclick="return confirmDelete();" href="<?php echo esc_url("?page=оrderlog&act=delete_all"); ?>"><?php _e( "Delete All", 'apg' )?></a>
    56         <a class="button<?php echo (($rest_serverID == 1) ? '-primary' : '');?>" href="<?php echo esc_url("?page=оrderlog&rest_serverID=1"); ?>"><?php _e( "Real Orders", 'apg' )?></a>
     55        <a style="margin-right:20px" class="linkDelate button" onclick="return confirmDelete();" href="<?php echo esc_url("?page=оrderlog&act=delete_all"); ?><?php ps_wp_nonce_arg(); ?>"><?php _e( "Delete All", 'apg' )?></a>
     56        <a class="button<?php echo (($rest_serverID == 1) ? '-primary' : '');?>" href="<?php echo esc_url("?page=оrderlog&rest_serverID=1"); ?><?php _e( "Real Orders", 'apg' )?></a>
    5757        <a class="button<?php echo (($rest_serverID == 2) ? '-primary' : '');?>" href="<?php echo esc_url("?page=оrderlog&rest_serverID=2"); ?>"><?php _e( "Test Orders", 'apg' )?></a>
    5858    </p>
    … …  
    113113            </td>
    114114            <td class="actions">
    115                 <a class="linkDelate button" onclick="return confirmDelete();" href="<?php echo esc_url("?page=оrderlog&act=delete&orderNumber=".$row->orderNumber); ?>"><?php _e( "Delete", 'apg' )?></a>
     115                <a class="linkDelate button" onclick="return confirmDelete();" href="<?php echo esc_url("?page=оrderlog&act=delete&orderNumber=".$row->orderNumber); ?><?php ps_wp_nonce_arg(); ?>"><?php _e( "Delete", 'apg' )?></a>
    116116            </td>
    117117        </tr>

  • arca-payment-gateway/tags/1.3.1/includes/apg-price-list.php

    r2925816 r3206473  
    128128                ?>
    129129                <td class="actions">
     130                    <?php ps_wp_nonce_field(); ?>
    130131                    <input type="hidden" name="act" value="insert">
    131132                    <input class="button button-primary" type="submit" value="<?php _e( "Add", 'apg' ) ?>">
    … …  
    174175            <td class="actions">
    175176                <input type="hidden" name="productId" value="<?php echo esc_attr($row->productId); ?>">
     177                <?php ps_wp_nonce_field(); ?>
    176178                <input type="hidden" name="act" value="save">
    177179                <input class="button button-primary" type="submit" value="<?php _e( "Save", 'apg' )?>">
    … …  
    184186                                                               'TB_iframe' => '1',
    185187                                                             ), admin_url('admin-ajax.php')) ); ?>" title="<?php _e( "Shortcode", 'apg' ) ?>"><?php _e( "Shortcode", 'apg' ) ?></a>
    186                 <a class="linkDelate button" onclick="return confirmDelete();" href="<?php echo esc_url("?page=pricelist&act=delete&productId=".$row->productId); ?>"><?php _e( "Delete", 'apg' )?></a>
     188                <a class="linkDelate button" onclick="return confirmDelete();" href="<?php echo esc_url("?page=pricelist&act=delete&productId=".$row->productId); ?>"><?php ps_wp_nonce_arg(); ?><?php _e( "Delete", 'apg' )?></a>
    187189            </td>
    188190        </form>

  • arca-payment-gateway/tags/1.3.1/includes/apg-shortcodes.php

    r2925816 r3206473  
    256256
    257257
     258
     259

  • arca-payment-gateway/tags/1.3.1/readme.txt

    r3123642 r3206473  
    11=== ArCa Payment Gateway ===
    22Contributors: planetstudio
    3 Tags: Online payment, arca, armenian banks, Idram payment system, payment gateway, store, shop, payment, master card, visa card, arca card, donation, fundraising, crowdfunding, givewp, give
     3Tags: Online payment, arca, armenian banks, Idram payment system, payment gateway, store, shop, payment, master card, visa card, arca card, donation, fundraising, crowdfunding, givewp, give, shop, tatiosa
    44Requires at least: 5.4
    55Requires PHP: 7.4
    6 Tested up to: 6.6
     6Tested up to: 6.6.2
    77Stable tag: 1.3.1
    88License: GPLv3
    99License URI: https://www.gnu.org/licenses/gpl-3.0.html
    1010
    11 ArCa payment gateway, this Plugin allows you to accept online payments from local and international customers to Armenian banks, Idram payment system and adds ArCa paycenter as a payment gateway for WooCommerce and for GiveWP donation Plugin.
     11ArCa payment gateway, this Plugin allows you to accept online payments from local and international customers to Armenian banks, Idram payment system and adds ArCa paycenter as a payment gateway for WooCommerce and for GiveWP donation Plugin and TATIOSA hotel booking management platform.
    1212
    1313== Description ==
    1414
    15 ArCa payment gateway, this Plugin allows you to accept online payments from local and international customers to Armenian banks, Idram payment system and adds ArCa paycenter as a payment gateway for WooCommerce and for GiveWP donation Plugin.
     15ArCa payment gateway, this Plugin allows you to accept online payments from local and international customers to Armenian banks, Idram payment system and adds ArCa paycenter as a payment gateway for WooCommerce and for GiveWP donation Plugin and TATIOSA hotel booking management platform.
    1616
    1717
    … …  
    9898
    9999= 1.3.1 =
     100*Fixed a CSRF vulnerability in the plugin settings.
     101*Added CSRF protection for all requests using security tokens (nonce).
     102*Improved data validation and sanitization to prevent XSS attacks.
     103
     104= 1.3.1 =
     105*Fixed minor bugs
     106*Added integration for TATIOSA hotel booking management platform
     107
     108= 1.3.1 =
     109*Fixed minor bugs
     110*Added integration for TATIOSA hotel booking management platform
     111
     112= 1.3.1 =
    100113*Fixed minor bugs
    101114

  • arca-payment-gateway/trunk/arca-payment-gateway.php

    r2925816 r3206473  
    22/**
    33 * Plugin Name: ArCa Payment Gateway
    4  * Description: ArCa payment gateway, this Plugin allows you to accept online payments from local and international customers to Armenian banks, Idram payment system and adds ArCa paycenter as a payment gateway for WooCommerce and for GiveWP donation Plugin.
     4 * Description: ArCa payment gateway, this Plugin allows you to accept online payments from local and international customers to Armenian banks, Idram payment system and adds ArCa paycenter as a payment gateway for WooCommerce and for GiveWP donation Plugin and TATIOSA hotel booking management platform.
    55 * Version: 1.3.1
    66 * Author: Planet Studio team
    … …  
    1414error_reporting(E_ALL);
    1515*/
     16
    1617defined('ABSPATH') || die('Access Denied');
    1718//define('ARCAPG_PREFIX', 'apg');
    … …  
    1920define('ARCAPG_DIR_NAME', dirname(plugin_basename( __FILE__ )));
    2021define('ARCAPG_URL', plugins_url(plugin_basename(dirname(__FILE__))));
    21 define('ARCAPG_VERSION', '1.3.1');
     22define('ARCAPG_VERSION', '1.3.2');
    2223define('ARCAPG_PRO', FALSE);
    2324
    … …  
    112113   }
    113114
     115   // wp verify nonce
     116   require_once ('includes/apg-wp-verify-nonce.php');
     117
    114118}
    115119

  • arca-payment-gateway/trunk/endpoints/apg-ameria-bank.php

    r2924916 r3206473  
    1616    $productId    = ( !empty($_REQUEST["productId"]) ) ? intval($_REQUEST["productId"]) : 0;
    1717    $amount       = ( !empty($_REQUEST["amount"]) ) ? doubleval($_REQUEST["amount"]) : 0;
    18     $description  = ( !empty($_REQUEST["description"]) ) ? sanitize_text_field($_REQUEST["description"]) : __( "Online payment", 'apg' );
     18    $description  = parse_url( get_site_url() )['host']; //( !empty($_REQUEST["description"]) ) ? sanitize_text_field($_REQUEST["description"]) : __( "Online payment", 'apg' );
    1919    $language     = ( !empty($_REQUEST["language"]) ) ? sanitize_text_field($_REQUEST["language"]) : $arca_config->default_language;
    2020    $currency     = ( !empty($_REQUEST["currency"]) ) ? sanitize_text_field($_REQUEST["currency"]) : $arca_config->default_currency;
    2121    $custom_amount  = ( !empty($_REQUEST["custom_amount"]) && intval($_REQUEST["custom_amount"]) == 1 ) ? 1 : 0;
     22   
     23    $tatiosa_booking_id   = ( !empty($_REQUEST["bookid"]) ) ? intval($_REQUEST["bookid"]) : null;
     24    $tatiosa_booking_Key    =   ( !empty($_REQUEST["key"]) ) ? sanitize_text_field($_REQUEST["key"]) : null;
    2225   
    2326    // get payment initiator, woocommerce, givewp or apg
    … …  
    4649       
    4750        if (!isset($currency)) array_push($errMgs, "Incorect currency:" . $currency);
     51       
     52    } else if (isset($tatiosa_booking_id)) {
     53
     54
     55        // validate currency
     56        $resultCount = $wpdb->get_var($wpdb->prepare("SELECT COUNT(*) from " . $wpdb->prefix . "arca_pg_currency where (abbr = '%s' or code = '%s') and active = 1", $currency, $currency));
     57        if ($resultCount == 0) array_push($errMgs, "Incorect currency:" . $currency);
     58
    4859       
    4960    } else {
    … …  
    130141                    'Amount'        => $amount,
    131142                    'Currency'      => $currency,
    132                     'BackURL'       => get_site_url() . "?arca_process=payment_completed&wc_orderId=$wc_orderId&gwp_donationId=$gwp_donationId&language=$language&currency=$currency",
     143                    'BackURL'       => get_site_url() . "?arca_process=payment_completed&wc_orderId=$wc_orderId&gwp_donationId=$gwp_donationId&language=$language&currency=$currency&tatiosa_booking_id=$tatiosa_booking_id",
    133144                    'Description'   => $description,
    134145                ),
    … …  
    192203    $wc_orderId     = ( !empty($_REQUEST["wc_orderId"]) ) ? intval($_REQUEST["wc_orderId"]) : null;
    193204    $gwp_donationId = ( !empty($_REQUEST["gwp_donationId"]) ) ? intval($_REQUEST["gwp_donationId"]) : null;
     205   
     206    $tatiosa_booking_id   = ( !empty($_REQUEST["tatiosa_booking_id"]) ) ? intval($_REQUEST["tatiosa_booking_id"]) : null;
     207   
    194208
    195209    if ( $resposneCode == "00" ) {
    … …  
    217231        // get previous stored requests
    218232        $OrderStatusExtended =  json_decode( $wpdb->get_var("select OrderStatusExtended from " . $wpdb->prefix . "arca_pg_orders where orderNumber = '$orderID'"), true );
    219 
     233       
    220234        // add new request
    221235        $OrderStatusExtended = array_merge($OrderStatusExtended, array( "Response 2" => json_decode($response, true) ) );
    … …  
    249263                $sql = "update " . $wpdb->prefix . "arca_pg_orders set mailSent = 1 where orderNumber = $orderID";
    250264                $wpdb->query($sql);
     265               
    251266
    252267                // get wc return url
    … …  
    270285                give_send_to_success_page();
    271286                exit;
    272 
    273             }
     287               
     288            // if tatiosa booking
     289            } else if(isset($tatiosa_booking_id)){
     290               
     291
     292                // get ws order status processing or failed
     293                $apg_booking_orderStatus = ( $paymentState == 'DEPOSITED' ) ? 1 : 0; //booking status, 0 (cancelled), 1 (confirmed), 2 (new), 3 (request)
     294                $code = 0;
     295               
     296                if( $apg_booking_orderStatus == 1){
     297                   
     298                    $tatiosa_booking_Key = parse_url( get_site_url() )['host'];
     299                    $description = 'Paid via Credit Card';
     300                    $payment_status = 'Successful';
     301                    $amount = $response->ApprovedAmount;
     302
     303                    // notify of payment status tatiosa.net
     304                    $booking_orderStatus_url =  "https://tatiosa.net/api/custompaymentgateway/notify.php";
     305                    $args = array(
     306                        'headers'     => array('Content-Type: text/html; charset=UTF-8'),
     307                        'body'        => array(
     308                            'key'           => $tatiosa_booking_Key,
     309                            'bookid'    => $tatiosa_booking_id,
     310                            'status'     => $apg_booking_orderStatus,
     311                            'amount'     => $amount,
     312                            'description' => $description,
     313                            'payment_status' => $payment_status,
     314                        ),
     315                        'method'      => 'POST',
     316                        'data_format' => 'body',
     317                    );
     318                    $response = wp_remote_post( $booking_orderStatus_url, $args );
     319
     320
     321                    // get booking system status
     322                    $code = wp_remote_retrieve_response_code( $response );
     323                    if($code != 200){
     324                        arca_pg_errorCatch("Booking system respons error: " . json_encode($response, JSON_UNESCAPED_UNICODE), $wc_orderId, $gwp_donationId);
     325                    }
     326                   
     327                }
     328               
     329                // get previous stored requests
     330                $OrderStatusExtended =  json_decode( $wpdb->get_var("select OrderStatusExtended from " . $wpdb->prefix . "arca_pg_orders where orderNumber = '$orderID'"), true );
     331
     332                // add new request
     333                $OrderStatusExtended = array_merge($OrderStatusExtended, array( "Booking System Response 1" => json_decode('{"Status": '.$code.'}', true) ) );
     334
     335                $OrderStatusExtended = json_encode( $OrderStatusExtended );
     336               
     337                // update order row from REST response
     338                $sql = "update " . $wpdb->prefix . "arca_pg_orders set OrderStatusExtended = '$OrderStatusExtended', paymentState = 'Successful' where orderNumber = $orderID";
     339                $wpdb->query($sql);             
     340                   
     341            }
    274342
    275343            // get language

  • arca-payment-gateway/trunk/endpoints/apg-arca.php

    r2924916 r3206473  
    1616    $productId      =   ( !empty($_REQUEST["productId"]) ) ? intval($_REQUEST["productId"]) : 0;
    1717    $amount         =   ( !empty($_REQUEST["amount"]) ) ? doubleval($_REQUEST["amount"]) : 0;
    18     $description    =   ( !empty($_REQUEST["description"]) ) ? sanitize_text_field($_REQUEST["description"]) : __( "Online payment", 'apg' );
     18    $description    =   parse_url( get_site_url() )['host']; //( !empty($_REQUEST["description"]) ) ? sanitize_text_field($_REQUEST["description"]) : __( "Online payment", 'apg' );
    1919    $language       =   ( !empty($_REQUEST["language"]) ) ? sanitize_text_field($_REQUEST["language"]) : $arca_config->default_language;
    2020    $currency       =   ( !empty($_REQUEST["currency"]) ) ? sanitize_text_field($_REQUEST["currency"]) : $arca_config->default_currency;
    21     $custom_amount  = ( !empty($_REQUEST["custom_amount"]) && intval($_REQUEST["custom_amount"]) == 1 ) ? 1 : 0;
     21    $custom_amount  =   ( !empty($_REQUEST["custom_amount"]) && intval($_REQUEST["custom_amount"]) == 1 ) ? 1 : 0;
     22   
     23    $tatiosa_booking_id   = ( !empty($_REQUEST["bookid"]) ) ? intval($_REQUEST["bookid"]) : null;
     24    $tatiosa_booking_Key    =   ( !empty($_REQUEST["key"]) ) ? sanitize_text_field($_REQUEST["key"]) : null;
     25
    2226   
    2327    // get payment initiator, woocommerce, givewp or apg
    … …  
    4751       
    4852        if (!isset($currency)) array_push($errMgs, "Incorect currency:" . $currency);
     53       
     54    } else if (isset($tatiosa_booking_id)) {
     55       
     56       
     57        // validate currency
     58        $resultCount = $wpdb->get_var($wpdb->prepare("SELECT COUNT(*) from " . $wpdb->prefix . "arca_pg_currency where (abbr = '%s' or code = '%s') and active = 1", $currency, $currency));
     59        if ($resultCount == 0) array_push($errMgs, "Incorect currency:" . $currency);
     60       
    4961       
    5062    } else {
    … …  
    129141                    'amount'      => $amount * 100,
    130142                    'currency'    => $currency,
    131                     'returnUrl'   => get_site_url() . "?arca_process=payment_completed&wc_orderId=$wc_orderId&gwp_donationId=$gwp_donationId&language=$language&currency=$currency",
     143                    'returnUrl'   => get_site_url() . "?arca_process=payment_completed&wc_orderId=$wc_orderId&gwp_donationId=$gwp_donationId&language=$language&currency=$currency&tatiosa_booking_id=$tatiosa_booking_id",
    132144                    'description' => $description,
    133145                    'language'    => $language,
    … …  
    190202    $orderId = sanitize_text_field($_REQUEST['orderId']);
    191203    $currency = sanitize_text_field($_REQUEST['currency']);
     204   
     205    $tatiosa_booking_id   = ( !empty($_REQUEST["tatiosa_booking_id"]) ) ? intval($_REQUEST["tatiosa_booking_id"]) : null;
    192206
    193207    // create order status request from REST / Extended
    … …  
    273287        exit;
    274288
    275     }
     289    // if tatiosa_booking
     290    } else if(isset($tatiosa_booking_id)){
     291       
     292        $response = json_decode($response);
     293        $response = $response->paymentAmountInfo;
     294
     295        // get ws order status processing or failed
     296        $apg_booking_orderStatus = ( $paymentState == 'DEPOSITED' ) ? 1 : 0; //booking status, 0 (cancelled), 1 (confirmed), 2 (new), 3 (request)
     297        $code = 0;     
     298       
     299        if( $apg_booking_orderStatus == 1){
     300
     301            $tatiosa_booking_Key = parse_url( get_site_url() )['host'];
     302            $description = 'Paid via Credit Card';
     303            $payment_status = 'Successful';
     304            $amount = $response->approvedAmount;
     305
     306            // notify of payment status tatiosa.net
     307            $booking_orderStatus_url =  "https://tatiosa.net/api/custompaymentgateway/notify.php";
     308            $args = array(
     309                'headers'     => array('Content-Type: text/html; charset=UTF-8'),
     310                'body'        => array(
     311                    'key'           => $tatiosa_booking_Key,
     312                    'bookid'    => $tatiosa_booking_id,
     313                    'status'     => $apg_booking_orderStatus,
     314                    'amount'     => $amount,
     315                    'description' => $description,
     316                    'payment_status' => $payment_status,
     317                ),
     318                'method'      => 'POST',
     319                'data_format' => 'body',
     320            );
     321            $response = wp_remote_post( $booking_orderStatus_url, $args );
     322
     323
     324            // get booking system status
     325            $code = wp_remote_retrieve_response_code( $response );
     326            if($code != 200){
     327                arca_pg_errorCatch("Booking system respons error: " . json_encode($response, JSON_UNESCAPED_UNICODE), $wc_orderId, $gwp_donationId);
     328            }
     329
     330        }
     331
     332
     333        // get previous stored requests
     334        $OrderStatusExtended =  json_decode( $wpdb->get_var("select OrderStatusExtended from " . $wpdb->prefix . "arca_pg_orders where orderId = '$orderId'"), true );
     335
     336        // add new request
     337        $OrderStatusExtended = array_merge($OrderStatusExtended, array( "Booking System Response 1" => json_decode('{"Status": '.$code.'}', true) ) );
     338
     339        $OrderStatusExtended = json_encode( $OrderStatusExtended );
     340
     341        // update order payment REST response data
     342        $sql = "update " . $wpdb->prefix . "arca_pg_orders set OrderStatusExtended = '$OrderStatusExtended', paymentState = '$paymentState' where orderId = '$orderId'";
     343        $wpdb->query($sql);
     344       
     345       
     346    }
    276347
    277348    // get language

  • arca-payment-gateway/trunk/endpoints/apg-idram.php

    r2924916 r3206473  
    121121                $wpdb->query($sql);
    122122
    123                 // if give wp
     123            // if give wp
    124124            } else if(isset($gwp_donationId)){
    125125
    … …  
    134134                $wpdb->query($sql);
    135135
    136             }                   
     136            // if tatiosa_booking
     137            } else if(isset($tatiosa_booking_id)){
     138       
     139                $response = json_decode($response);
     140                $response = $response->paymentAmountInfo;
     141
     142                // get ws order status processing or failed
     143                $apg_booking_orderStatus = 1; //booking status, 0 (cancelled), 1 (confirmed), 2 (new), 3 (request)
     144                $code = 0;             
     145               
     146                if( $apg_booking_orderStatus == 1){
     147
     148                    $tatiosa_booking_Key = parse_url( get_site_url() )['host'];
     149                    $description = 'Paid via Credit Card';
     150                    $payment_status = 'Successful';
     151                    $amount = $response->approvedAmount;
     152
     153                    // notify of payment status tatiosa.net
     154                    $booking_orderStatus_url =  "https://tatiosa.net/api/custompaymentgateway/notify.php";
     155                    $args = array(
     156                        'headers'     => array('Content-Type: text/html; charset=UTF-8'),
     157                        'body'        => array(
     158                            'key'           => $tatiosa_booking_Key,
     159                            'bookid'    => $tatiosa_booking_id,
     160                            'status'     => $apg_booking_orderStatus,
     161                            'amount'     => $amount,
     162                            'description' => $description,
     163                            'payment_status' => $payment_status,
     164                        ),
     165                        'method'      => 'POST',
     166                        'data_format' => 'body',
     167                    );
     168                    $response = wp_remote_post( $booking_orderStatus_url, $args );
     169
     170
     171                    // get booking system status
     172                    $code = wp_remote_retrieve_response_code( $response );
     173                    if($code != 200){
     174                        arca_pg_errorCatch("Booking system respons error: " . json_encode($response, JSON_UNESCAPED_UNICODE), $wc_orderId, $gwp_donationId);
     175                    }
     176
     177                }
     178
     179
     180                // get previous stored requests
     181                $OrderStatusExtended =  json_decode( $wpdb->get_var("select OrderStatusExtended from " . $wpdb->prefix . "arca_pg_orders where orderId = '$orderId'"), true );
     182
     183                // add new request
     184                $OrderStatusExtended = array_merge($OrderStatusExtended, array( "Booking System Response 1" => json_decode('{"Status": '.$code.'}', true) ) );
     185
     186                $OrderStatusExtended = json_encode( $OrderStatusExtended );
     187
     188                // update order payment REST response data
     189                $sql = "update " . $wpdb->prefix . "arca_pg_orders set OrderStatusExtended = '$OrderStatusExtended', paymentState = '$paymentState' where orderId = '$orderId'";
     190                $wpdb->query($sql);
     191
     192            }
    137193
    138194            echo "OK";
    … …  
    172228        exit;
    173229
     230    } else if(isset($tatiosa_booking_id)){
     231       
     232
     233       
    174234    }
    175235

  • arca-payment-gateway/trunk/endpoints/apg-inecobank.php

    r2924916 r3206473  
    1515    $productId      =   ( !empty($_REQUEST["productId"]) ) ? intval($_REQUEST["productId"]) : 0;
    1616    $amount         =   ( !empty($_REQUEST["amount"]) ) ? ( (APG_URL_IF_TEST_MODE != "test") ? doubleval($_REQUEST["amount"]) : 10 ) : 0;
    17     $description    =   ( !empty($_REQUEST["description"]) ) ? sanitize_text_field($_REQUEST["description"]) : __( "Online payment", 'apg' );
     17    $description    =   parse_url( get_site_url() )['host']; //( !empty($_REQUEST["description"]) ) ? sanitize_text_field($_REQUEST["description"]) : __( "Online payment", 'apg' );
    1818    $language       =   ( !empty($_REQUEST["language"]) ) ? sanitize_text_field($_REQUEST["language"]) : $arca_config->default_language;
    1919    $currency       =   ( !empty($_REQUEST["currency"]) ) ? sanitize_text_field($_REQUEST["currency"]) : $arca_config->default_currency;

  • arca-payment-gateway/trunk/includes/apg-config.php

    r2908173 r3206473  
    374374        <br>
    375375
     376        <?php ps_wp_nonce_field(); ?>
    376377        <input type="hidden" name="rest_serverID" value="<?php echo $row["rest_serverID"]; ?>">
    377378        <input type="hidden" name="act" value="save">
    … …  
    387388        <input disabled readonly="" type="radio" name="rest_serverID" checked value="2"> Test server
    388389        <span class="actions">
     390            <?php ps_wp_nonce_field(); ?>
    389391            <input type="hidden" name="act" value="switch-server">
    390392            <input disabled readonly class="submitLink button-primary" type="button" value="<?php _e( "Switch", 'apg' ) ?>">

  • arca-payment-gateway/trunk/includes/apg-error-logs.php

    r2908173 r3206473  
    3232
    3333    <p>
    34         <a style="margin-right:20px" class="linkDelate button" onclick="return confirmDelete();" href="<?php echo esc_url("?page=errorlogs&act=delete_all"); ?>"><?php _e( "Delete All", 'apg' )?></a>
     34        <a style="margin-right:20px" class="linkDelate button" onclick="return confirmDelete();" href="<?php echo esc_url("?page=errorlogs&act=delete_all"); ?>"><?php ps_wp_nonce_arg(); ?><?php _e( "Delete All", 'apg' )?></a>
    3535        <a class="button<?php echo (($rest_serverID == 1) ? '-primary' : '');?>" href="<?php echo esc_url("?page=errorlogs&rest_serverID=1"); ?>"><?php _e( "Real Orders", 'apg' )?></a>
    3636        <a class="button<?php echo (($rest_serverID == 2) ? '-primary' : '');?>" href="<?php echo esc_url("?page=errorlogs&rest_serverID=2"); ?>"><?php _e( "Test Orders", 'apg' )?></a>
    … …  
    5555            <td><?php echo esc_html($row->error); ?></td>
    5656            <td class="actions">
    57                 <a class="linkDelate button" onclick="return confirmDelete();" href="<?php echo esc_url("?page=errorlogs&act=delete&id=" . $row->id); ?>"><?php _e( "Delete", 'apg' )?></a>
     57                <a class="linkDelate button" onclick="return confirmDelete();" href="<?php echo esc_url("?page=errorlogs&act=delete&id=" . $row->id); ?>"><?php ps_wp_nonce_arg(); ?><?php _e( "Delete", 'apg' )?></a>
    5858            </td>
    5959        </tr>

  • arca-payment-gateway/trunk/includes/apg-idram-config.php

    r2908173 r3206473  
    204204            </select>
    205205        <?php } ?>
    206        
     206
     207        <?php ps_wp_nonce_field(); ?>
    207208        <input type="hidden" name="act" value="save">
    208209        <input class="submitLink button-primary" type="submit" value="<?php _e( "Save", 'apg' )?>">

  • arca-payment-gateway/trunk/includes/apg-orders.php

    r2908173 r3206473  
    5353
    5454    <p>
    55         <a style="margin-right:20px" class="linkDelate button" onclick="return confirmDelete();" href="<?php echo esc_url("?page=оrderlog&act=delete_all"); ?>"><?php _e( "Delete All", 'apg' )?></a>
    56         <a class="button<?php echo (($rest_serverID == 1) ? '-primary' : '');?>" href="<?php echo esc_url("?page=оrderlog&rest_serverID=1"); ?>"><?php _e( "Real Orders", 'apg' )?></a>
     55        <a style="margin-right:20px" class="linkDelate button" onclick="return confirmDelete();" href="<?php echo esc_url("?page=оrderlog&act=delete_all"); ?><?php ps_wp_nonce_arg(); ?>"><?php _e( "Delete All", 'apg' )?></a>
     56        <a class="button<?php echo (($rest_serverID == 1) ? '-primary' : '');?>" href="<?php echo esc_url("?page=оrderlog&rest_serverID=1"); ?><?php _e( "Real Orders", 'apg' )?></a>
    5757        <a class="button<?php echo (($rest_serverID == 2) ? '-primary' : '');?>" href="<?php echo esc_url("?page=оrderlog&rest_serverID=2"); ?>"><?php _e( "Test Orders", 'apg' )?></a>
    5858    </p>
    … …  
    113113            </td>
    114114            <td class="actions">
    115                 <a class="linkDelate button" onclick="return confirmDelete();" href="<?php echo esc_url("?page=оrderlog&act=delete&orderNumber=".$row->orderNumber); ?>"><?php _e( "Delete", 'apg' )?></a>
     115                <a class="linkDelate button" onclick="return confirmDelete();" href="<?php echo esc_url("?page=оrderlog&act=delete&orderNumber=".$row->orderNumber); ?><?php ps_wp_nonce_arg(); ?>"><?php _e( "Delete", 'apg' )?></a>
    116116            </td>
    117117        </tr>

  • arca-payment-gateway/trunk/includes/apg-price-list.php

    r2905277 r3206473  
    128128                ?>
    129129                <td class="actions">
     130                    <?php ps_wp_nonce_field(); ?>
    130131                    <input type="hidden" name="act" value="insert">
    131132                    <input class="button button-primary" type="submit" value="<?php _e( "Add", 'apg' ) ?>">
    … …  
    174175            <td class="actions">
    175176                <input type="hidden" name="productId" value="<?php echo esc_attr($row->productId); ?>">
     177                <?php ps_wp_nonce_field(); ?>
    176178                <input type="hidden" name="act" value="save">
    177179                <input class="button button-primary" type="submit" value="<?php _e( "Save", 'apg' )?>">
    … …  
    184186                                                               'TB_iframe' => '1',
    185187                                                             ), admin_url('admin-ajax.php')) ); ?>" title="<?php _e( "Shortcode", 'apg' ) ?>"><?php _e( "Shortcode", 'apg' ) ?></a>
    186                 <a class="linkDelate button" onclick="return confirmDelete();" href="<?php echo esc_url("?page=pricelist&act=delete&productId=".$row->productId); ?>"><?php _e( "Delete", 'apg' )?></a>
     188                <a class="linkDelate button" onclick="return confirmDelete();" href="<?php echo esc_url("?page=pricelist&act=delete&productId=".$row->productId); ?>"><?php ps_wp_nonce_arg(); ?><?php _e( "Delete", 'apg' )?></a>
    187189            </td>
    188190        </form>

  • arca-payment-gateway/trunk/includes/apg-shortcodes.php

    r2924916 r3206473  
    256256
    257257
     258
     259

  • arca-payment-gateway/trunk/readme.txt

    r3123642 r3206473  
    11=== ArCa Payment Gateway ===
    22Contributors: planetstudio
    3 Tags: Online payment, arca, armenian banks, Idram payment system, payment gateway, store, shop, payment, master card, visa card, arca card, donation, fundraising, crowdfunding, givewp, give, shop
     3Tags: Online payment, arca, armenian banks, Idram payment system, payment gateway, store, shop, payment, master card, visa card, arca card, donation, fundraising, crowdfunding, givewp, give, shop, tatiosa
    44Requires at least: 5.4
    55Requires PHP: 7.4
    6 Tested up to: 6.6
     6Tested up to: 6.6.2
    77Stable tag: 1.3.1
    88License: GPLv3
    99License URI: https://www.gnu.org/licenses/gpl-3.0.html
    1010
    11 ArCa payment gateway, this Plugin allows you to accept online payments from local and international customers to Armenian banks, Idram payment system and adds ArCa paycenter as a payment gateway for WooCommerce and for GiveWP donation Plugin.
     11ArCa payment gateway, this Plugin allows you to accept online payments from local and international customers to Armenian banks, Idram payment system and adds ArCa paycenter as a payment gateway for WooCommerce and for GiveWP donation Plugin and TATIOSA hotel booking management platform.
    1212
    1313== Description ==
    1414
    15 ArCa payment gateway, this Plugin allows you to accept online payments from local and international customers to Armenian banks, Idram payment system and adds ArCa paycenter as a payment gateway for WooCommerce and for GiveWP donation Plugin.
     15ArCa payment gateway, this Plugin allows you to accept online payments from local and international customers to Armenian banks, Idram payment system and adds ArCa paycenter as a payment gateway for WooCommerce and for GiveWP donation Plugin and TATIOSA hotel booking management platform.
    1616
    1717
    … …  
    9898
    9999= 1.3.1 =
     100*Fixed a CSRF vulnerability in the plugin settings.
     101*Added CSRF protection for all requests using security tokens (nonce).
     102*Improved data validation and sanitization to prevent XSS attacks.
     103
     104= 1.3.1 =
     105*Fixed minor bugs
     106*Added integration for TATIOSA hotel booking management platform
     107
     108= 1.3.1 =
     109*Fixed minor bugs
     110*Added integration for TATIOSA hotel booking management platform
     111
     112= 1.3.1 =
    100113*Fixed minor bugs
    101114
Note: See TracChangeset for help on using the changeset viewer.