Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

信頼性向上のための処理を追加 #1201

Open
wants to merge 2 commits into
base: master
Choose a base branch
from
Open

信頼性向上のための処理を追加 #1201

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
a1c4255
信頼性向上のため画像の filepath にエスケープ処理を追加
nanasess Mar 12, 2025
be30e63
信頼性向上のため、order_id のバリデーションを追加
nanasess Mar 13, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 5 additions & 5 deletions data/Smarty/templates/admin/products/confirm.tpl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -208,7 +208,7 @@
<td>
<!--{assign var=key value="main_list_image"}-->
<!--{if $arrForm.arrFile[$key].filepath != ""}-->
<img src="<!--{$arrForm.arrFile[$key].filepath}-->" alt="<!--{$arrForm.name|h}-->" /><br />
<img src="<!--{$arrForm.arrFile[$key].filepath|h}-->" alt="<!--{$arrForm.name|h}-->" /><br />
<!--{/if}-->
</td>
</tr>
Expand All @@ -217,7 +217,7 @@
<td>
<!--{assign var=key value="main_image"}-->
<!--{if $arrForm.arrFile[$key].filepath != ""}-->
<img src="<!--{$arrForm.arrFile[$key].filepath}-->" alt="<!--{$arrForm.name|h}-->" /><br />
<img src="<!--{$arrForm.arrFile[$key].filepath|h}-->" alt="<!--{$arrForm.name|h}-->" /><br />
<!--{/if}-->
</td>
</tr>
Expand All @@ -226,7 +226,7 @@
<td>
<!--{assign var=key value="main_large_image"}-->
<!--{if $arrForm.arrFile[$key].filepath != ""}-->
<img src="<!--{$arrForm.arrFile[$key].filepath}-->" alt="<!--{$arrForm.name|h}-->" /><br />
<img src="<!--{$arrForm.arrFile[$key].filepath|h}-->" alt="<!--{$arrForm.name|h}-->" /><br />
<!--{/if}-->
</td>
</tr>
Expand All @@ -252,7 +252,7 @@
<td>
<!--{assign var=key value="sub_image`$smarty.section.cnt.iteration`"}-->
<!--{if $arrForm.arrFile[$key].filepath != ""}-->
<img src="<!--{$arrForm.arrFile[$key].filepath}-->" alt="<!--{$arrForm.name|h}-->" /><br />
<img src="<!--{$arrForm.arrFile[$key].filepath|h}-->" alt="<!--{$arrForm.name|h}-->" /><br />
<!--{/if}-->
</td>
</tr>
Expand All @@ -261,7 +261,7 @@
<td>
<!--{assign var=key value="sub_large_image`$smarty.section.cnt.iteration`"}-->
<!--{if $arrForm.arrFile[$key].filepath != ""}-->
<img src="<!--{$arrForm.arrFile[$key].filepath}-->" alt="<!--{$arrForm.name|h}-->" /><br />
<img src="<!--{$arrForm.arrFile[$key].filepath|h}-->" alt="<!--{$arrForm.name|h}-->" /><br />
<!--{/if}-->
</td>
</tr>
Expand Down
2 changes: 1 addition & 1 deletion data/Smarty/templates/default/products/detail.tpl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -293,7 +293,7 @@
<!--{if $arrProduct[$lkey]|strlen >= 1}-->
<a href="<!--{$smarty.const.IMAGE_SAVE_URLPATH}--><!--{$arrProduct[$lkey]|h}-->" class="expansion" target="_blank" >
<!--{/if}-->
<img src="<!--{$arrFile[$ikey].filepath}-->" alt="<!--{$arrProduct.name|h}-->" width="<!--{$arrFile[$ikey].width}-->" height="<!--{$arrFile[$ikey].height}-->" />
<img src="<!--{$arrFile[$ikey].filepath|h}-->" alt="<!--{$arrProduct.name|h}-->" width="<!--{$arrFile[$ikey].width}-->" height="<!--{$arrFile[$ikey].height}-->" />
<!--{if $arrProduct[$lkey]|strlen >= 1}-->
</a>
<span class="mini">
Expand Down
2 changes: 1 addition & 1 deletion data/Smarty/templates/mobile/products/detail.tpl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,7 +29,7 @@
<!--{else}-->
<!--{assign var=key value="main_image"}-->
<!--{/if}-->
<center><img src="<!--{$arrFile[$key].filepath}-->"></center>
<center><img src="<!--{$arrFile[$key].filepath|h}-->"></center>
<br>

<!--★商品サブ画像★-->
Expand Down
4 changes: 2 additions & 2 deletions data/Smarty/templates/sphone/products/detail.tpl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -347,10 +347,10 @@
<p class="subphotoimg">
<!--{if $arrProduct[$lkey]|strlen >= 1}-->
<a class="expansion" href="<!--{$smarty.const.IMAGE_SAVE_URLPATH}--><!--{$arrProduct[$lkey]|h}-->" target="_blank">
<img src="<!--{$arrFile[$key].filepath}-->" alt="<!--{$arrProduct.name|h}-->" width="<!--{$arrFile[$key].width/$sub_image_factor}-->" height="<!--{$arrFile[$key].height/$sub_image_factor}-->" />
<img src="<!--{$arrFile[$key].filepath|h}-->" alt="<!--{$arrProduct.name|h}-->" width="<!--{$arrFile[$key].width/$sub_image_factor}-->" height="<!--{$arrFile[$key].height/$sub_image_factor}-->" />
</a>
<!--{else}-->
<img src="<!--{$arrFile[$key].filepath}-->" alt="<!--{$arrProduct.name|h}-->" width="<!--{$arrFile[$key].width/$sub_image_factor}-->" height="<!--{$arrFile[$key].height/$sub_image_factor}-->" />
<img src="<!--{$arrFile[$key].filepath|h}-->" alt="<!--{$arrProduct.name|h}-->" width="<!--{$arrFile[$key].width/$sub_image_factor}-->" height="<!--{$arrFile[$key].height/$sub_image_factor}-->" />
<!--{/if}-->
</p>
<!--{/if}-->
Expand Down
4 changes: 4 additions & 0 deletions data/class/pages/admin/order/LC_Page_Admin_Order_Edit.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -161,6 +161,10 @@ public function action()
$objFormParam->setParam($_REQUEST);
$objFormParam->convParam();
$order_id = $objFormParam->getValue('order_id');
if (($order_id ?? '') !== '' && filter_var($order_id, FILTER_VALIDATE_INT) === false) {
trigger_error("不正な注文番号が指定されました。(注文番号: $order_id)", E_USER_ERROR);
}

$arrValuesBefore = [];

// DBから受注情報を読み込む
Expand Down
Loading