diff --git a/uc_cart/uc_cart.module b/uc_cart/uc_cart.module index 66e6e72..5fedb84 100644 --- a/uc_cart/uc_cart.module +++ b/uc_cart/uc_cart.module @@ -13,6 +13,12 @@ require_once('uc_cart_checkout_pane.inc'); require_once('uc_cart.ca.inc'); +/** + * Time in seconds after which a cart order is deemed abandoned. + */ +define('UC_CART_ORDER_TIMEOUT', 600); + + /******************************************************************************* * Hook Functions (Drupal) ******************************************************************************/ @@ -1515,20 +1521,20 @@ function uc_cart_add_item($nid, $qty = 1, $data = NULL, $cid = NULL, $msg = TRUE if (isset($_GET['destination'])) { drupal_goto(); } - $_SESSION['uc_cart_last_url'] = uc_referer_uri(); + $_SESSION['uc_cart_last_url'] = $_GET['q']; $redirect = variable_get('uc_add_item_redirect', 'cart'); if ($redirect != '') { return $redirect; } else { - return uc_referer_uri(); + return $_GET['q']; } } } else { drupal_set_message($message, 'error'); } - return uc_referer_uri(); + return $_GET['q']; } } } @@ -1561,13 +1567,13 @@ function uc_cart_add_item($nid, $qty = 1, $data = NULL, $cid = NULL, $msg = TRUE drupal_goto(); } - $_SESSION['uc_cart_last_url'] = uc_referer_uri(); + $_SESSION['uc_cart_last_url'] = $_GET['q']; $redirect = variable_get('uc_add_item_redirect', 'cart'); if ($redirect != '') { return $redirect; } else { - return uc_referer_uri(); + return $_GET['q']; } } } diff --git a/uc_cart/uc_cart.pages.inc b/uc_cart/uc_cart.pages.inc index 14df1e8..3acc159 100644 --- a/uc_cart/uc_cart.pages.inc +++ b/uc_cart/uc_cart.pages.inc @@ -136,18 +136,12 @@ function uc_cart_checkout_form() { $order = new UcOrder(); } - // Check the referer URI to clear order details and prevent identity theft. - if (uc_referer_check(array('cart/checkout', 'cart/checkout/review'))) { - if ($order == FALSE || uc_order_status_data($order->order_status, 'state') != 'in_checkout') { + // If there hasn't been activity on the checkout page for 20 minutes, clear + // order details and prevent identity theft. + if (!$order || uc_order_status_data($order->order_status, 'state') != 'in_checkout' || $order->modified < time() - UC_CART_ORDER_TIMEOUT || ($user->uid > 0 && $user->uid != $order->uid)) { + if (isset($_SESSION['cart_order'])) { unset($_SESSION['cart_order']); - $order = new UcOrder(); } - elseif (uc_order_status_data($order->order_status, 'state') != 'in_checkout' || ($user->uid > 0 && $user->uid != $order->uid)) { - $order = new UcOrder(); - } - } - else { - unset($_SESSION['cart_order']); $order = new UcOrder(); } @@ -363,7 +357,7 @@ function uc_cart_checkout_review() { drupal_add_js(drupal_get_path('module', 'uc_cart') .'/uc_cart.js'); $form = drupal_get_form('uc_cart_checkout_review_form'); - if ($_SESSION['do_review'] !== TRUE && !uc_referer_check(array('cart/checkout'))) { + if (empty($_SESSION['cart_order']) || $_SESSION['do_review'] !== TRUE) { drupal_goto('cart/checkout'); } unset($_SESSION['do_review']); diff --git a/uc_cart_links/uc_cart_links.pages.inc b/uc_cart_links/uc_cart_links.pages.inc index d11b7cc..2ec468e 100644 --- a/uc_cart_links/uc_cart_links.pages.inc +++ b/uc_cart_links/uc_cart_links.pages.inc @@ -145,7 +145,7 @@ function uc_cart_links_process($arg1) { $rebuild_cart = TRUE; } else { - watchdog('uc_cart_link', 'Cart link on %url tried to add an unpublished product to the cart.', array('%url' => uc_referer_uri()), WATCHDOG_ERROR); + watchdog('uc_cart_link', 'Cart link on %url tried to add an unpublished product to the cart.', array('%url' => referer_uri()), WATCHDOG_ERROR); } } break; @@ -194,7 +194,7 @@ function uc_cart_links_process($arg1) { } } - $_SESSION['uc_cart_last_url'] = uc_referer_uri(); + $_SESSION['uc_cart_last_url'] = referer_uri(); drupal_goto(); } diff --git a/uc_store/uc_store.module b/uc_store/uc_store.module index de47d9f..fcbe8bb 100644 --- a/uc_store/uc_store.module +++ b/uc_store/uc_store.module @@ -578,32 +578,6 @@ function uc_store_footer() { } /** - * Implements hook_exit(). - */ -function uc_store_exit() { - // Don't save anything to the session if this is the first request of a session - if (empty($_COOKIE[session_name()])) { - return; - } - - // Save the current request for tracking paths on subsequent page requests. - // When HTTP_REFERER is set, the session version is not; and vice versa. - if (referer_uri() == '') { - $protocol = (!empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] != 'off') ? 'https' : 'http'; - $q = isset($_GET['q']) ? $_GET['q'] : ''; - $_SESSION['uc_referer_uri'] = $protocol .'://'. $_SERVER['SERVER_NAME'] . $GLOBALS['base_path'] . $q; - } - else { - if (isset($_SESSION['uc_referer_uri'])) { - unset($_SESSION['uc_referer_uri']); - } - } - - // Save the timestamp of the last access. - // $_SESSION['uc_last_access'] = time(); -} - -/** * Implements hook_form_alter(). */ function uc_store_form_alter(&$form, $form_state, $form_id) { @@ -2133,48 +2107,10 @@ function uc_add_js($data = NULL, $type = 'module', $scope = 'header', $defer = F } /** - * Checks referers to see if they are in the allowed list. - */ -function uc_referer_check($urls) { - global $base_path; - - $http_referer = uc_referer_uri(); - - // Always return true if we have no referer; covers the case of page refreshes - // and switching from HTTP to HTTPS. This bypasses the two-time check below... - // is it safe? - if (empty($http_referer)) { - return TRUE; - } - - // Check the user didn't shamelessly two-time us with another site. - $referer = parse_url($http_referer); - if ($referer['host'] != $_SERVER['SERVER_NAME']) { - return FALSE; - } - - // Check the base path. - if (strncmp($referer['path'], $base_path, strlen($base_path))) { - return FALSE; - } - - // Convert any path aliases. - $path = drupal_get_normal_path(substr($referer['path'], strlen($base_path))); - - // The check itself. - return in_array($path, $urls); -} - -/** - * Provides a more reliable referer for Ubercart. + * Provides a referer where available. */ function uc_referer_uri() { - if (referer_uri() == '') { - return isset($_SESSION['uc_referer_uri']) ? $_SESSION['uc_referer_uri'] : ''; - } - else { - return referer_uri(); - } + return referer_uri(); } /**