[freeside-commits] branch master updated. a56ef0afb5d1ba6f5b25116ca289d732371616d5

[Ivan]

The branch, master has been updated
       via  a56ef0afb5d1ba6f5b25116ca289d732371616d5 (commit)
      from  d4cdc4db87f1b6a373398b7ab33e791bd0527dda (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit a56ef0afb5d1ba6f5b25116ca289d732371616d5
Author: Ivan Kohler <ivan at freeside.biz>
Date:   Sun Nov 17 17:10:45 2013 -0800

    don't redirect to a GET with sensitive data, RT#26099

diff --git a/httemplate/elements/handle_uri_query b/httemplate/elements/handle_uri_query
index eb7ea1a..2dea96a 100644
--- a/httemplate/elements/handle_uri_query
+++ b/httemplate/elements/handle_uri_query
@@ -1,8 +1,20 @@
 <%init>
+
+my %opt = @_;
+
 if ( $cgi->param('redirect') ) {
   my $session = $cgi->param('redirect');
+
   my $pref = $FS::CurrentUser::CurrentUser->option("redirect$session");
   die "unknown redirect session $session\n" unless length($pref);
   $cgi = new CGI($pref);
+
+  foreach my $param (grep /pay(info\d?|cvv)$/, $cgi->param) {
+    my $value = $cgi->param($param);
+    next unless length($value);
+    my $decrypted = FS::Record->decrypt( $value );
+    $cgi->param($param, $decrypted);
+  }
+
 }
 </%init>

-----------------------------------------------------------------------

Summary of changes:
 httemplate/elements/handle_uri_query |   12 ++++++++++++
 1 files changed, 12 insertions(+), 0 deletions(-)