| Index: trunk/extensions/DonationInterface/globalcollect_gateway/globalcollect_resultswitcher.body.php |
| — | — | @@ -41,9 +41,11 @@ |
| 42 | 42 | //no longer letting people in without these things. If this is |
| 43 | 43 | //preventing you from doing something, you almost certainly want to be |
| 44 | 44 | //somewhere else. |
| | 45 | + $forbidden = false; |
| 45 | 46 | if ( !isset($_GET['order_id']) || !$this->adapter->hasDonorDataInSession( 'order_id', $_GET['order_id'] ) ){ |
| 46 | 47 | //TODO: i18n, apparently. |
| 47 | 48 | wfHttpError( 403, 'Forbidden', 'You do not have permission to access this page.' ); |
| | 49 | + $forbidden = true; |
| 48 | 50 | } |
| 49 | 51 | |
| 50 | 52 | $referrer = $wgRequest->getHeader( 'referer' ); |
| — | — | @@ -64,6 +66,23 @@ |
| 65 | 67 | $this->adapter->getGlobal( 'CSSVersion' ) ); |
| 66 | 68 | |
| 67 | 69 | $this->setHeaders(); |
| | 70 | + |
| | 71 | + if ( $forbidden ){ |
| | 72 | + $qs_oid = 'undefined'; |
| | 73 | + $message = ''; |
| | 74 | + if ( !isset($_GET['order_id']) ){ |
| | 75 | + $message = 'No order ID in the Querystring.'; |
| | 76 | + } else { |
| | 77 | + $qs_oid = $_GET['order_id']; |
| | 78 | + } |
| | 79 | + |
| | 80 | + if ( !$this->adapter->hasDonorDataInSession( 'order_id', $_GET['order_id'] ) ){ |
| | 81 | + $message = 'Requested order id not present in the session'; |
| | 82 | + } |
| | 83 | + |
| | 84 | + $this->adapter->log("Resultswitcher: Request forbidden. " . $message . " Quersytring Oirder ID: $qs_oid"); |
| | 85 | + return; |
| | 86 | + } |
| 68 | 87 | |
| 69 | 88 | |
| 70 | 89 | // dispatch forms/handling |
| — | — | @@ -99,16 +118,16 @@ |
| 100 | 119 | $wgOut->addHTML( "<br>Redirecting to page $go" ); |
| 101 | 120 | $wgOut->redirect( $go ); |
| 102 | 121 | } else { |
| 103 | | - $this->adapter->log("Resultswitcher: No redirect defined."); |
| | 122 | + $this->adapter->log("Resultswitcher: No redirect defined. Order ID: $oid"); |
| 104 | 123 | } |
| 105 | 124 | } else { |
| 106 | | - $this->adapter->log("Resultswitcher: No TransactionWMFStatus."); |
| | 125 | + $this->adapter->log("Resultswitcher: No TransactionWMFStatus. Order ID: $oid"); |
| 107 | 126 | } |
| 108 | 127 | } else { |
| 109 | | - $this->adapter->log("Resultswitcher: Payment method is not cc."); |
| | 128 | + $this->adapter->log("Resultswitcher: Payment method is not cc. Order ID: $oid"); |
| 110 | 129 | } |
| 111 | 130 | } else { |
| 112 | | - $this->adapter->log("Resultswitcher: Token Check Failed."); |
| | 131 | + $this->adapter->log("Resultswitcher: Token Check Failed. Order ID: $oid"); |
| 113 | 132 | } |
| 114 | 133 | } |
| 115 | 134 | |