=== modified file 'payment/uc_recurring/uc_recurring.module' --- payment/uc_recurring/uc_recurring.module 2008-06-18 15:48:05 +0000 +++ payment/uc_recurring/uc_recurring.module 2008-06-22 15:14:11 +0000 @@ -632,7 +632,7 @@ $form['submit'] = array( '#type' => 'submit', '#value' => t('Charge'), - '#suffix' => l(t('Cancel'), referer_uri()), + '#suffix' => l(t('Cancel'), uc_referer_uri()), ); return $form; } @@ -710,7 +710,7 @@ $form['submit'] = array( '#type' => 'submit', '#value' => t('Submit'), - '#suffix' => l(t('Cancel'), referer_uri()), + '#suffix' => l(t('Cancel'), uc_referer_uri()), ); return $form; @@ -738,7 +738,7 @@ $form['submit'] = array( '#type' => 'submit', '#value' => t('Delete'), - '#suffix' => l(t('Cancel'), referer_uri()), + '#suffix' => l(t('Cancel'), uc_referer_uri()), ); return $form; } === modified file 'uc_cart/uc_cart.module' --- uc_cart/uc_cart.module 2008-05-30 16:19:28 +0000 +++ uc_cart/uc_cart.module 2008-06-22 15:58:08 +0000 @@ -468,14 +468,11 @@ return; } - // Grab the referer if possible. - $referer = referer_uri(); - - // Compare it for checkout page URLs. - if (substr($referer, -13, 13) == 'cart/checkout') { + // Compare the referer to checkout page URLs. + if (uc_referer_check('cart/checkout')) { $form['#action'] = url($_GET['q'], "destination=cart/checkout"); } - elseif (substr($referer, -22, 22) == 'cart/checkout/complete') { + elseif (uc_referer_check('cart/checkout/complete')) { $form['#action'] = url($_GET['q'], "destination=user"); } } @@ -1359,8 +1366,7 @@ $order = uc_order_load($_SESSION['cart_order']); // Check the referer URI to clear order details and prevent identity theft. - $referer = referer_uri(); - if (substr($referer, -20, 20) == 'cart/checkout/review' || substr($referer, -13, 13) == 'cart/checkout') { + if (uc_referer_check('cart/checkout', 'cart/checkout/review')) { if ($order == FALSE || uc_order_status_data($order->order_status, 'state') != 'in_checkout') { unset($_SESSION['cart_order']); $order = NULL; @@ -1531,7 +1537,7 @@ function uc_cart_checkout_review() { $form = drupal_get_form('uc_cart_checkout_review_form'); - if ($_SESSION['do_review'] !== TRUE && substr(referer_uri(), -13) != 'cart/checkout') { + if ($_SESSION['do_review'] !== TRUE && !uc_referer_check('cart/checkout')) { drupal_goto('cart/checkout'); } unset($_SESSION['do_review']); @@ -1640,6 +1646,15 @@ } function uc_cart_checkout_review_form_submit($form_id, $form_values) { + + $order = uc_order_load($_SESSION['cart_order']); + + if ($order === FALSE || uc_order_status_data($order->order_status, 'state') != 'in_checkout' || !uc_referer_check('cart/checkout/review')) { + unset($_SESSION['cart_order']); + return 'cart/checkout/'; + } + + switch ($form_values['op']) { case t('Back'): cache_clear_all(); @@ -1649,7 +1664,6 @@ case variable_get('uc_checkout_submit_button', t('Submit order')): // Invoke hook_order($op = 'submit') to test to make sure the order can // be completed... used for auto payment in uc_credit.module. - $order = uc_order_load($_SESSION['cart_order']); $pass = module_invoke_all('order', 'submit', $order, NULL); foreach ($pass as $result) { @@ -1910,11 +1924,11 @@ } $redirect = variable_get('uc_add_item_redirect', 'cart'); if ($redirect != '') { - $_SESSION['last_url'] = referer_uri(); + $_SESSION['last_url'] = uc_referer_uri(); return $redirect; } else { - return referer_uri(); + return uc_referer_uri(); } } } @@ -1953,11 +1967,11 @@ $redirect = variable_get('uc_add_item_redirect', 'cart'); if ($redirect != '') { - $_SESSION['last_url'] = referer_uri(); + $_SESSION['last_url'] = uc_referer_uri(); return $redirect; } else { - return referer_uri(); + return uc_referer_uri(); } } } === modified file 'uc_product_kit/uc_product_kit.module' --- uc_product_kit/uc_product_kit.module 2008-06-16 21:24:11 +0000 +++ uc_product_kit/uc_product_kit.module 2008-06-22 15:23:45 +0000 @@ -614,11 +614,11 @@ $redirect = variable_get('uc_add_item_redirect', 'cart'); if ($redirect != '') { - $_SESSION['last_url'] = referer_uri(); + $_SESSION['last_url'] = uc_referer_uri(); return $redirect; } else { - return referer_uri(); + return uc_referer_uri(); } } return array(array('success' => false, 'silent' => true, $message => '')); === modified file 'uc_store/uc_store.module' --- uc_store/uc_store.module 2008-06-13 22:02:52 +0000 +++ uc_store/uc_store.module 2008-06-22 16:03:41 +0000 @@ -498,8 +498,16 @@ * Implementation of hook_exit(). */ function uc_store_exit() { + // Save the current request for tracking paths on subsequent page requests. - // $_SESSION['uc_referer_uri'] = $_GET['q']; + // When HTTP_REFERER is set, the session version is not; and vice versa. + if (referer_uri()=='') { + $_SESSION['uc_referer_uri'] = 'http://'.$_SERVER['SERVER_NAME'].'/'.$_GET['q']; + } else { + if (isset($_SESSION['uc_referer_uri'])) { + unset($_SESSION['uc_referer_uri']); + } + } // Save the timestamp of the last access. // $_SESSION['uc_last_access'] = time(); @@ -2887,3 +2895,42 @@ watchdog('uc_store', t('Reported the following version info to Ubercart.org:') .'
'. print_r($data, TRUE) .'
'); } +// Checks referers to see if they are in the allowed list. +function uc_referer_check($urls) { + $http_referer = uc_referer_uri(); + + // Always return true if we have no referer. + if (empty($http_referer)) { + return TRUE; + } + + // Check the user didn't shamelessly two-time us with another site. + if (substr($http_referer, 7, strlen($_SERVER['SERVER_NAME'])) != $_SERVER['SERVER_NAME']) { + return FALSE; + } + + // Accept mixed input. + if (!is_array($urls)) { + $urls = array($urls); + } + + // The check itself. + foreach ($urls as $url) { + + if (substr($http_referer, -strlen($url)) == $url) { + return TRUE; + } + } + + return FALSE; +} + +// Provides a more reliable referrer for Übercart. +function uc_referer_uri() { + $http_referer = referer_uri(); + if (!empty($http_referer)) { + return $http_referer; + } else { + return $_SESSION['uc_referer_uri']; + } +} \ No newline at end of file