[freeside-commits] branch FREESIDE_3_BRANCH updated. 26210bd8dc75076209944cb45b891b4a51bf8a9e

[Ivan]

The branch, FREESIDE_3_BRANCH has been updated
       via  26210bd8dc75076209944cb45b891b4a51bf8a9e (commit)
      from  f4830f3d053be44857e1a5701b2dde2a3de0d584 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 26210bd8dc75076209944cb45b891b4a51bf8a9e
Author: Ivan Kohler <ivan at freeside.biz>
Date:   Sun Nov 17 17:10:48 2013 -0800

    don't redirect to a GET with sensitive data, RT#26099

diff --git a/httemplate/elements/handle_uri_query b/httemplate/elements/handle_uri_query
index eb7ea1a..2dea96a 100644
--- a/httemplate/elements/handle_uri_query
+++ b/httemplate/elements/handle_uri_query
@@ -1,8 +1,20 @@
 <%init>
+
+my %opt = @_;
+
 if ( $cgi->param('redirect') ) {
   my $session = $cgi->param('redirect');
+
   my $pref = $FS::CurrentUser::CurrentUser->option("redirect$session");
   die "unknown redirect session $session\n" unless length($pref);
   $cgi = new CGI($pref);
+
+  foreach my $param (grep /pay(info\d?|cvv)$/, $cgi->param) {
+    my $value = $cgi->param($param);
+    next unless length($value);
+    my $decrypted = FS::Record->decrypt( $value );
+    $cgi->param($param, $decrypted);
+  }
+
 }
 </%init>

-----------------------------------------------------------------------

Summary of changes:
 httemplate/elements/handle_uri_query |   12 ++++++++++++
 1 files changed, 12 insertions(+), 0 deletions(-)