Index: branches/5.3.x/units/gateways/gw_classes/ideal_nl.php =================================================================== diff -u -r15671 -r15899 --- branches/5.3.x/units/gateways/gw_classes/ideal_nl.php (.../ideal_nl.php) (revision 15671) +++ branches/5.3.x/units/gateways/gw_classes/ideal_nl.php (.../ideal_nl.php) (revision 15899) @@ -1,6 +1,6 @@ FindChildValue('message'); $this->parsed_responce['XML'] = $transaction_xml; $this->Application->SetVar('failure_template', $this->Application->RecallVar('gw_cancel_template')); - $this->parsed_responce['MESSAGE'] = $error_msg ? $error_msg : 'Unknown gateway error ('.htmlspecialchars($transaction_xml, null, CHARSET).')'; + $this->parsed_responce['MESSAGE'] = $error_msg ? $error_msg : 'Unknown gateway error ('.kUtil::escape($transaction_xml, kUtil::ESCAPE_HTML).')'; return false; } Index: branches/5.3.x/install/upgrades.sql =================================================================== diff -u -r15671 -r15899 --- branches/5.3.x/install/upgrades.sql (.../upgrades.sql) (revision 15671) +++ branches/5.3.x/install/upgrades.sql (.../upgrades.sql) (revision 15899) @@ -286,3 +286,10 @@ # ===== v 5.2.1-B1 ===== ALTER TABLE Affiliates CHANGE PortalUserId PortalUserId INT(10) NULL DEFAULT NULL; UPDATE Affiliates SET PortalUserId = NULL WHERE PortalUserId = 0; + +# ===== v 5.2.1-B2 ===== +UPDATE Modules +SET ClassNamespace = 'Intechnic\\InPortal\\Modules\\InCommerce' +WHERE `Name` = 'In-Commerce'; + +# ===== v 5.2.1-RC1 ===== Index: branches/5.3.x/units/destinations/dst_event_handler.php =================================================================== diff -u -r15671 -r15899 --- branches/5.3.x/units/destinations/dst_event_handler.php (.../dst_event_handler.php) (revision 15671) +++ branches/5.3.x/units/destinations/dst_event_handler.php (.../dst_event_handler.php) (revision 15899) @@ -1,6 +1,6 @@ SetFieldsFromHash($field_values, $this->getRequestProtectedFields($field_values)); + $event->setEventParam('form_data', $field_values); $this->customProcessing($event, 'before'); if ( $object->Create() ) { Index: branches/5.3.x/units/product_option_combinations/product_option_combinations_event_handler.php =================================================================== diff -u -r15695 -r15899 --- branches/5.3.x/units/product_option_combinations/product_option_combinations_event_handler.php (.../product_option_combinations_event_handler.php) (revision 15695) +++ branches/5.3.x/units/product_option_combinations/product_option_combinations_event_handler.php (.../product_option_combinations_event_handler.php) (revision 15899) @@ -1,6 +1,6 @@ SetFieldsFromHash($field_values, $this->getRequestProtectedFields($field_values)); + $event->setEventParam('form_data', $field_values); if ( !$object->Validate() ) { $event->status = kEvent::erFAIL; @@ -208,6 +209,7 @@ { $object->Load($id); $object->SetFieldsFromHash($field_values, $this->getRequestProtectedFields($field_values)); + $event->setEventParam('form_data', $field_values); if (!$object->Validate()) { $event->status = kEvent::erFAIL; Index: branches/5.3.x/units/shipping_quote_engines/usps.php =================================================================== diff -u -r15695 -r15899 --- branches/5.3.x/units/shipping_quote_engines/usps.php (.../usps.php) (revision 15695) +++ branches/5.3.x/units/shipping_quote_engines/usps.php (.../usps.php) (revision 15899) @@ -1,6 +1,6 @@ '; $api_query = 'IntlRate'; } - $request = 'API='.$api_query.'&XML=' . urlencode($request); + $request = 'API='.$api_query.'&XML=' . kUtil::escape($request, kUtil::ESCAPE_URL); $body = $this->PostQuery($request); $body = str_replace(chr(146), '', $body); // for bad ` @@ -937,7 +937,7 @@ // die($request); - $request = 'API='.$api_query.'&XML='.urlencode($request); + $request = 'API='.$api_query.'&XML='.kUtil::escape($request, kUtil::ESCAPE_URL); $body = $this->PostQuery($request, 1); @@ -1079,7 +1079,7 @@ $request = ''; $api_query = 'TrackV2'; - $request = 'API='.$api_query.'&XML='.urlencode($request); + $request = 'API='.$api_query.'&XML='.kUtil::escape($request, kUtil::ESCAPE_URL); $body = $this->PostQuery($request); // check for errors Index: branches/5.3.x/units/gateways/gw_classes/google_checkout.php =================================================================== diff -u -r15671 -r15899 --- branches/5.3.x/units/gateways/gw_classes/google_checkout.php (.../google_checkout.php) (revision 15671) +++ branches/5.3.x/units/gateways/gw_classes/google_checkout.php (.../google_checkout.php) (revision 15899) @@ -1,6 +1,6 @@ - '.htmlspecialchars($order_item['ProductName'], null, CHARSET).' - '.htmlspecialchars($order_item[$ml_formatter->LangFieldName('DescriptionExcerpt')], null, CHARSET).''. + '.kUtil::escape($order_item['ProductName'], kUtil::ESCAPE_HTML).' + '.kUtil::escape($order_item[$ml_formatter->LangFieldName('DescriptionExcerpt')], kUtil::ESCAPE_HTML).''. $this->getPriceXML('unit-price', $order_item['Price']).' '.$order_item['Quantity'].' '; @@ -102,7 +102,7 @@ $shipping_xml = ''; foreach ($shipping_types as $shipping_name) { - $shipping_xml .= ' + $shipping_xml .= ' 0.00 '; } @@ -390,7 +390,7 @@ $shipping_name = $shipping_type['ShippingName']; $processable_shipping_index = array_search($shipping_name, $process_shippings); if ($processable_shipping_index !== false) { - $shipping_types_xml .= ' + $shipping_types_xml .= ' '.sprintf('%01.2f', $shipping_type['TotalCost']).' true '; @@ -402,7 +402,7 @@ // add unavailable shipping types foreach ($process_shippings as $shipping_name) { - $shipping_types_xml .= ' + $shipping_types_xml .= ' 0.00 false '; Index: branches/5.3.x/admin_templates/affiliate_plans/affiliate_plans_edit.tpl =================================================================== diff -u -r15671 -r15899 --- branches/5.3.x/admin_templates/affiliate_plans/affiliate_plans_edit.tpl (.../affiliate_plans_edit.tpl) (revision 15671) +++ branches/5.3.x/admin_templates/affiliate_plans/affiliate_plans_edit.tpl (.../affiliate_plans_edit.tpl) (revision 15899) @@ -68,7 +68,7 @@ - + () Index: branches/5.3.x/units/order_items/order_items_event_handler.php =================================================================== diff -u -r15695 -r15899 --- branches/5.3.x/units/order_items/order_items_event_handler.php (.../order_items_event_handler.php) (revision 15695) +++ branches/5.3.x/units/order_items/order_items_event_handler.php (.../order_items_event_handler.php) (revision 15899) @@ -1,6 +1,6 @@ Load($id); $object->SetFieldsFromHash($field_values, $this->getRequestProtectedFields($field_values)); + $event->setEventParam('form_data', $field_values); $this->customProcessing($event, 'before'); if ( $object->Update($id) ) { Index: branches/5.3.x/units/shipping_costs/shipping_costs_event_handler.php =================================================================== diff -u -r15492 -r15899 --- branches/5.3.x/units/shipping_costs/shipping_costs_event_handler.php (.../shipping_costs_event_handler.php) (revision 15492) +++ branches/5.3.x/units/shipping_costs/shipping_costs_event_handler.php (.../shipping_costs_event_handler.php) (revision 15899) @@ -1,6 +1,6 @@ SetFieldsFromHash($field_values, $this->getRequestProtectedFields($field_values)); + $event->setEventParam('form_data', $field_values); $this->customProcessing($event, 'before'); if ( $object->Create() ) { Index: branches/5.3.x/units/orders/orders_event_handler.php =================================================================== diff -u -r15807 -r15899 --- branches/5.3.x/units/orders/orders_event_handler.php (.../orders_event_handler.php) (revision 15807) +++ branches/5.3.x/units/orders/orders_event_handler.php (.../orders_event_handler.php) (revision 15899) @@ -1,6 +1,6 @@ LockTables($event); - if ( !$this->CheckQuantites($event) ) { + $reoccurring_order = substr($event->Special, 0, 9) == 'recurring'; + + if ( !$reoccurring_order && !$this->CheckQuantites($event) ) { + // don't check quantities (that causes recalculate) for reoccurring orders return; } @@ -2916,7 +2919,8 @@ $sql = 'SELECT '.$backorder_select.' AS BackOrderFlagCalc, oi.* FROM '.TABLE_PREFIX.'OrderItems oi LEFT JOIN '.TABLE_PREFIX.'Products p ON p.ProductId = oi.ProductId - WHERE (OrderId = %s) AND (BackOrderFlagCalc = 0) AND (p.Type = '.PRODUCT_TYPE_TANGIBLE.')'; + WHERE (OrderId = %s) AND (p.Type = '.PRODUCT_TYPE_TANGIBLE.') + HAVING BackOrderFlagCalc = 0'; $products = $this->Conn->Query( sprintf($sql, $ord_id) ); foreach ($products as $product) { Index: branches/5.3.x/units/shipping_quote_engines/intershipper.php =================================================================== diff -u -r15695 -r15899 --- branches/5.3.x/units/shipping_quote_engines/intershipper.php (.../intershipper.php) (revision 15695) +++ branches/5.3.x/units/shipping_quote_engines/intershipper.php (.../intershipper.php) (revision 15899) @@ -1,6 +1,6 @@ Array ('Core' => '5.2.0-RC1'), '5.2.0' => Array ('Core' => '5.2.0'), '5.2.1-B1' => Array ('Core' => '5.2.1-B1'), + '5.2.1-B2' => Array ('Core' => '5.2.1-B2'), + '5.2.1-RC1' => Array ('Core' => '5.2.1-RC1'), ); } Index: branches/5.3.x/install.php =================================================================== diff -u -r15492 -r15899 --- branches/5.3.x/install.php (.../install.php) (revision 15492) +++ branches/5.3.x/install.php (.../install.php) (revision 15899) @@ -1,6 +1,6 @@ toolkit; - /* @var $toolkit kInstallToolkit */ - } - $application =& kApplication::Instance(); - $application->Init(); + $toolkit = new kInstallToolkit(); +} +else { + // install, using installation wizard + $toolkit =& $this->toolkit; + /* @var $toolkit kInstallToolkit */ +} - if ($application->RecallVar('user_id') != USER_ROOT) { - die('restricted access!'); - } +$application =& kApplication::Instance(); +$application->Init(); - $category =& $toolkit->createModuleCategory('Products', 'Product Catalog', '#in-commerce/section_design#', 'in-commerce/img/menu_products.gif'); +if ( $application->RecallVar('user_id') != USER_ROOT ) { + die('restricted access!'); +} - $toolkit->RunSQL('/' . $module_folder . '/install/install_schema.sql'); - $toolkit->RunSQL('/' . $module_folder . '/install/install_data.sql', '{ProductCatId}', $category->GetID()); - $toolkit->ImportLanguage('/' . $module_folder . '/install/english'); +$category =& $toolkit->createModuleCategory('Products', 'Product Catalog', '#in-commerce/section_design#', 'in-commerce/img/menu_products.gif'); - $toolkit->SetModuleRootCategory(basename($module_folder), $category->GetID()); +$toolkit->RunSQL('/' . $module_folder . '/install/install_schema.sql'); +$toolkit->RunSQL('/' . $module_folder . '/install/install_data.sql', '{ProductCatId}', $category->GetID()); +$toolkit->ImportLanguage('/' . $module_folder . '/install/english'); - $toolkit->linkCustomFields(basename($module_folder), 'p', 11); // to create Custom Fields for Products - $toolkit->linkCustomFields('KERNEL', 'u', 6); // to create shipping related Custom Fields for Users - $toolkit->linkCustomFields('KERNEL', 'c', 1); // to create ItemTemplate custom field - $toolkit->setModuleItemTemplate($category, 'p', '#in-commerce/item_design#'); +$toolkit->SetModuleRootCategory(basename($module_folder), $category->GetID()); - $toolkit->finalizeModuleInstall($module_folder, true); \ No newline at end of file +$toolkit->linkCustomFields(basename($module_folder), 'p', 11); // to create Custom Fields for Products +$toolkit->linkCustomFields('KERNEL', 'u', 6); // to create shipping related Custom Fields for Users +$toolkit->linkCustomFields('KERNEL', 'c', 1); // to create ItemTemplate custom field +$toolkit->setModuleItemTemplate($category, 'p', '#in-commerce/item_design#'); + +$toolkit->finalizeModuleInstall($module_folder, true); Index: branches/5.3.x/units/product_options/product_options_tag_processor.php =================================================================== diff -u -r15671 -r15899 --- branches/5.3.x/units/product_options/product_options_tag_processor.php (.../product_options_tag_processor.php) (revision 15671) +++ branches/5.3.x/units/product_options/product_options_tag_processor.php (.../product_options_tag_processor.php) (revision 15899) @@ -1,6 +1,6 @@ GetID(), $options) ? $options[$object->GetID()] : ''; if ( $object->GetDBField('OptionType') == OptionType::CHECKBOX ) { - $selected = is_array($option_value) && in_array(htmlspecialchars($val, null, CHARSET), $option_value); + $selected = is_array($option_value) && in_array(kUtil::escape($val), $option_value); } else { // radio buttons ? $selected = htmlspecialchars_decode($option_value) == $val; Index: branches/5.3.x/units/order_items/order_items_tag_processor.php =================================================================== diff -u -r15695 -r15899 --- branches/5.3.x/units/order_items/order_items_tag_processor.php (.../order_items_tag_processor.php) (revision 15695) +++ branches/5.3.x/units/order_items/order_items_tag_processor.php (.../order_items_tag_processor.php) (revision 15899) @@ -1,6 +1,6 @@ = 0 ? '+' : '-'; } - $block_params['value'] = htmlspecialchars($val, null, CHARSET); + + // TODO: consider escaping in template instead + $block_params['value'] = kUtil::escape($val); $block_params['type'] = $key_data['OptionType']; } $o .= $this->Application->ParseBlock($block_params, 1); @@ -176,7 +178,10 @@ foreach ($values as $val) { $i++; $val = htmlspecialchars_decode($val); - $block_params['value'] = htmlspecialchars($val, null, CHARSET); + + // TODO: consider escaping in template instead + $block_params['value'] = kUtil::escape($val); + if ($price_types[$val] == '$') { $iso = $this->GetISO($params['currency']); $value = $this->AddCurrencySymbol(sprintf("%.2f", $this->ConvertCurrency($prices[$val], $iso)), $iso, true); // true to force sign Index: branches/5.3.x/units/products/products_tag_processor.php =================================================================== diff -u -r15695 -r15899 --- branches/5.3.x/units/products/products_tag_processor.php (.../products_tag_processor.php) (revision 15695) +++ branches/5.3.x/units/products/products_tag_processor.php (.../products_tag_processor.php) (revision 15899) @@ -1,6 +1,6 @@ Application->HREF('__default__', '', Array ('pass_category' => 1))); + $params['continue'] = kUtil::escape($this->Application->HREF('__default__', '', Array ('pass_category' => 1)), kUtil::ESCAPE_URL); return $this->Application->ProcessParsedTag('m', 'Link', $params); } Index: branches/5.3.x/units/gateways/gw_tag_processor.php =================================================================== diff -u -r15695 -r15899 --- branches/5.3.x/units/gateways/gw_tag_processor.php (.../gw_tag_processor.php) (revision 15695) +++ branches/5.3.x/units/gateways/gw_tag_processor.php (.../gw_tag_processor.php) (revision 15899) @@ -1,6 +1,6 @@ ConfigValues[$id]) ? $this->ConfigValues[$id] : ''; if ( !array_key_exists('no_special', $params) || !$params['no_special'] ) { - $value = htmlspecialchars($value, null, CHARSET); + $value = kUtil::escape($value); } if ( getArrayValue($params, 'checked') ) { Index: branches/5.3.x/units/order_items/order_items_config.php =================================================================== diff -u -r15656 -r15899 --- branches/5.3.x/units/order_items/order_items_config.php (.../order_items_config.php) (revision 15656) +++ branches/5.3.x/units/order_items/order_items_config.php (.../order_items_config.php) (revision 15899) @@ -1,6 +1,6 @@ Array ('type' => 'double', 'default' => NULL), 'ShippingTypeId' => Array ('type' => 'string', 'default' => NULL), 'ItemData' => Array ('type' => 'string', 'default' => null), - 'OptionsSalt' => Array ('type' => 'int', 'default' => 0), + 'OptionsSalt' => Array ('type' => 'string', 'default' => 0), 'SplitShippingGroup' => Array ('type' => 'int', 'not_null' => 1, 'default' => 0,), 'PackageNum' => Array ('type' => 'int', 'not_null' => 1, 'default' => 0,), 'ReturnType' => Array ( Index: branches/5.3.x/units/products/products_config.php =================================================================== diff -u -r15675 -r15899 --- branches/5.3.x/units/products/products_config.php (.../products_config.php) (revision 15675) +++ branches/5.3.x/units/products/products_config.php (.../products_config.php) (revision 15899) @@ -1,6 +1,6 @@ 'CategoryItemRewrite:RewriteListener', 'Hooks' => Array ( - // for subscription products: access group is saved before changing pricings Array ( 'Mode' => hAFTER, - 'Conditional' => true, - 'HookToPrefix' => 'pr', - 'HookToSpecial' => '*', - 'HookToEvent' => Array ('OnNew', 'OnAfterItemLoad'), - 'DoPrefix' => '', - 'DoSpecial' => '*', - 'DoEvent' => 'OnPreSave', - ), - - Array ( - 'Mode' => hAFTER, 'Conditional' => false, 'HookToPrefix' => 'lst', 'HookToSpecial' => '', @@ -417,21 +405,21 @@ FROM %1$s LEFT JOIN '.TABLE_PREFIX.'UserGroups ON '.TABLE_PREFIX.'UserGroups.GroupId = %1$s.AccessGroupId LEFT JOIN '.TABLE_PREFIX.'%3$sCategoryItems ON '.TABLE_PREFIX.'%3$sCategoryItems.ItemResourceId = %1$s.ResourceId + {PERM_JOIN} LEFT JOIN '.TABLE_PREFIX.'Categories ON '.TABLE_PREFIX.'Categories.CategoryId = '.TABLE_PREFIX.'%3$sCategoryItems.CategoryId LEFT JOIN '.TABLE_PREFIX.'%3$sCatalogImages img ON img.ResourceId = %1$s.ResourceId AND img.DefaultImg = 1 LEFT JOIN '.TABLE_PREFIX.'%3$sProductFiles files ON files.ProductId = %1$s.ProductId AND files.IsPrimary = 1 LEFT JOIN '.TABLE_PREFIX.'%3$sProductsPricing pricing ON pricing.ProductId = %1$s.ProductId AND pricing.IsPrimary = 1 LEFT JOIN '.TABLE_PREFIX.'Manufacturers ON '.TABLE_PREFIX.'Manufacturers.ManufacturerId = %1$s.ManufacturerId - LEFT JOIN '.TABLE_PREFIX.'CategoryPermissionsCache perm ON perm.CategoryId = '.TABLE_PREFIX.'%3$sCategoryItems.CategoryId LEFT JOIN '.TABLE_PREFIX.'%3$sProductsCustomData cust ON %1$s.ResourceId = cust.ResourceId', 'showall' => 'SELECT %1$s.* %2$s FROM %1$s LEFT JOIN '.TABLE_PREFIX.'%3$sProductsPricing pricing ON pricing.ProductId = %1$s.ProductId AND pricing.IsPrimary = 1 LEFT JOIN '.TABLE_PREFIX.'%3$sProductFiles files ON files.ProductId = %1$s.ProductId AND files.IsPrimary = 1 LEFT JOIN '.TABLE_PREFIX.'Manufacturers ON '.TABLE_PREFIX.'Manufacturers.ManufacturerId = %1$s.ManufacturerId LEFT JOIN '.TABLE_PREFIX.'%3$sCategoryItems ON '.TABLE_PREFIX.'%3$sCategoryItems.ItemResourceId = %1$s.ResourceId + {PERM_JOIN} LEFT JOIN '.TABLE_PREFIX.'Categories ON '.TABLE_PREFIX.'Categories.CategoryId = '.TABLE_PREFIX.'%3$sCategoryItems.CategoryId - LEFT JOIN '.TABLE_PREFIX.'CategoryPermissionsCache perm ON perm.CategoryId = '.TABLE_PREFIX.'%3$sCategoryItems.CategoryId LEFT JOIN '.TABLE_PREFIX.'%3$sProductsCustomData cust ON %1$s.ResourceId = cust.ResourceId', ), Index: branches/5.3.x/admin_templates/products/products_access.tpl =================================================================== diff -u -r15492 -r15899 --- branches/5.3.x/admin_templates/products/products_access.tpl (.../products_access.tpl) (revision 15492) +++ branches/5.3.x/admin_templates/products/products_access.tpl (.../products_access.tpl) (revision 15899) @@ -10,6 +10,7 @@