Daniel/hotel
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fixed: Prevented refund requests for service order lines belonging to other customers

Browse Source 
Co-authored-by: Name <azharbhat.qlo098@webkul.in>
This commit is contained in:
amit sharma
2026-10-09 16:31:46 +05:30
parent df93538090
commit 38d780ab1a
6 changed files with 85 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
admin-dev/themes/default/template/controllers/customer_threads/page_header_toolbar.tpl
View File

@@ -28,7 +28,7 @@
{if is_array($title)}
{$title|end|strip_tags}
{else}
<span title="{$title}">
<span title="{$title|strip_tags|escape:'html':'UTF-8'}">
{$title|strip_tags|truncate:40}
</span>
{/if}

2
classes/Validate.php
View File

@@ -404,7 +404,7 @@ class ValidateCore
$events .= '|onbounce|oncellchange|oncontextmenu|oncontrolselect|oncopy|oncut|ondataavailable|ondatasetchanged|ondatasetcomplete|ondeactivate|ondrag|ondragend|ondragenter|onmousewheel';
$events .= '|ondragleave|ondragover|ondragstart|ondrop|onerrorupdate|onfilterchange|onfinish|onfocusin|onfocusout|onhashchange|onhelp|oninput|onlosecapture|onmessage|onmouseup|onmovestart';
$events .= '|onoffline|ononline|onpaste|onpropertychange|onreadystatechange|onresizeend|onresizestart|onrowenter|onrowexit|onrowsdelete|onrowsinserted|onscroll|onsearch|onselectionchange';
$events .= '|onselectstart|onstart|onstop';
$events .= '|onselectstart|onstart|onstop|onpointerover';
if (preg_match('/<[\s]*script/ims', $html) || preg_match('/('.$events.')[\s]*=/ims', $html) || preg_match('/.*script\:/ims', $html)) {
return false;

55
classes/controller/AdminController.php
View File

@@ -1187,6 +1187,11 @@ class AdminControllerCore extends Controller
*/
public function processDeleteImage()
{
if ($this->tabAccess['delete'] !== 1) {
$this->errors[] = Tools::displayError('You do not have permission to delete this.');
return false;
}
if (Validate::isLoadedObject($object = $this->loadObject())) {
if (($object->deleteImage())) {
$redirect = self::$currentIndex.'&update'.$this->table.'&'.$this->identifier.'='.Tools::getValue($this->identifier).'&conf=7&token='.$this->token;
@@ -1289,6 +1294,11 @@ class AdminControllerCore extends Controller
*/
public function processDelete()
{
if ($this->tabAccess['delete'] !== 1) {
$this->errors[] = Tools::displayError('You do not have permission to delete this.');
return false;
}
if (Validate::isLoadedObject($object = $this->loadObject())) {
$res = true;
// check if request at least one object with noZeroObject
@@ -1351,6 +1361,11 @@ class AdminControllerCore extends Controller
*/
public function processAdd()
{
if ($this->tabAccess['add'] !== 1) {
$this->errors[] = Tools::displayError('You do not have permission to add this.');
return false;
}
if (!isset($this->className) || empty($this->className)) {
return false;
}
@@ -1402,6 +1417,11 @@ class AdminControllerCore extends Controller
*/
public function processUpdate()
{
if ($this->tabAccess['edit'] !== 1) {
$this->errors[] = Tools::displayError('You do not have permission to edit this.');
return false;
}
/* Checking fields validity */
$this->validateRules();
if (empty($this->errors)) {
@@ -1495,6 +1515,11 @@ class AdminControllerCore extends Controller
*/
public function processUpdateFields()
{
if ($this->tabAccess['edit'] !== 1) {
$this->errors[] = Tools::displayError('You do not have permission to edit this.');
return false;
}
if (!is_array($fields = Tools::getValue('fieldsBox'))) {
$fields = array();
}
@@ -1519,6 +1544,11 @@ class AdminControllerCore extends Controller
*/
public function processStatus()
{
if ($this->tabAccess['edit'] !== 1) {
$this->errors[] = Tools::displayError('You do not have permission to edit this.');
return false;
}
if (Validate::isLoadedObject($object = $this->loadObject())) {
if ($object->toggleStatus()) {
PrestaShopLogger::addLog(
@@ -1562,6 +1592,11 @@ class AdminControllerCore extends Controller
*/
public function processPosition()
{
if ($this->tabAccess['edit'] !== 1) {
$this->errors[] = Tools::displayError('You do not have permission to edit this.');
return false;
}
if (!Validate::isLoadedObject($object = $this->loadObject())) {
$this->errors[] = Tools::displayError('An error occurred while updating the status for an object.').
' <b>'.$this->table.'</b> '.Tools::displayError('(cannot load object)');
@@ -1619,6 +1654,11 @@ class AdminControllerCore extends Controller
*/
protected function processUpdateOptions()
{
if ($this->tabAccess['edit'] !== 1) {
$this->errors[] = Tools::displayError('You do not have permission to edit this.');
return false;
}
$this->beforeUpdateOptions();
$languages = Language::getLanguages(false);
@@ -4065,6 +4105,11 @@ class AdminControllerCore extends Controller
*/
protected function processBulkDelete()
{
if ($this->tabAccess['delete'] !== 1) {
$this->errors[] = Tools::displayError('You do not have permission to delete this.');
return false;
}
if (is_array($this->boxes) && !empty($this->boxes)) {
$object = new $this->className();
@@ -4266,6 +4311,11 @@ class AdminControllerCore extends Controller
*/
protected function processBulkStatusSelection($status)
{
if ($this->tabAccess['edit'] !== 1) {
$this->errors[] = Tools::displayError('You do not have permission to edit this.');
return false;
}
$result = true;
if (is_array($this->boxes) && !empty($this->boxes)) {
foreach ($this->boxes as $id) {
@@ -4298,6 +4348,11 @@ class AdminControllerCore extends Controller
*/
protected function processBulkAffectZone()
{
if ($this->tabAccess['edit'] !== 1) {
$this->errors[] = Tools::displayError('You do not have permission to edit this.');
return false;
}
$result = false;
if (is_array($this->boxes) && !empty($this->boxes)) {
/** @var Country|State $object */

17
controllers/admin/AdminTabsController.php
View File

@@ -336,6 +336,23 @@ class AdminTabsControllerCore extends AdminController
}
}
/**
* Prevent creating a tab whose class name is already used.
*
* @return ObjectModel|false
*/
public function processSave()
{
$className = trim((string) Tools::getValue('class_name'));
$idExisting = Tab::getIdFromClassName($className);
if ($idExisting && $idExisting != (int) $this->id_object) {
$this->errors[] = Tools::displayError('A tab with this class name already exists.');
return false;
}
return parent::processSave();
}
protected function afterImageUpload()
{
/** @var Tab $obj */

2
controllers/front/ContactController.php
View File

@@ -62,7 +62,7 @@ class ContactControllerCore extends FrontController
} elseif (!$id_customer_thread && !$subject) {
$this->errors[] = Tools::displayError('The title cannot be blank.');
} elseif (!$id_customer_thread && !Validate::isCleanHtml($subject)) {
$this->errors[] = Tools::displayError('Invalid subject$subject');
$this->errors[] = Tools::displayError('Invalid subject.');
} else if (!$id_customer_thread && $nameRequired && !trim($userName)) {
$this->errors[] = Tools::displayError('Name is required.');
} else if (!$id_customer_thread && trim($nameRequired) && !Validate::isGenericName($userName)) {

10
controllers/front/OrderDetailController.php
View File

@@ -599,6 +599,16 @@ class OrderDetailControllerCore extends FrontController
}
if ($idServiceProductOrderDetails) {
foreach ($idServiceProductOrderDetails as $idServiceProductOrderDetail) {
$objServiceProductOrderDetail = new ServiceProductOrderDetail((int) $idServiceProductOrderDetail);
// the service line must exist and belong to the customer's own order
if (!Validate::isLoadedObject($objServiceProductOrderDetail)
|| $objServiceProductOrderDetail->id_order != $objOrder->id
) {
$this->errors[] = Tools::displayError('Something went wrong. Please try later.');
break;
}
if (OrderReturn::getOrdersReturnDetail($objOrder->id, 0, 0, $idServiceProductOrderDetail)) {
$this->errors[] = Tools::displayError('Some selected rooms have already been requested for cancellation.');
break;