FoxyCart / FoxyCart-Cart-Validation--PHP

Automatically sign (with HMAC SHA-256) all links and forms in a block of HTML
http://wiki.foxycart.com/static/redirect/price_validation
13 stars 9 forks source link

Fix to ignore elements that should be excluded #4

Closed agoel96 closed 13 years ago

agoel96 commented 13 years ago

There's an issue in the fc_hash_html() function to not honor the cart_excludes. For example, "cart" value should not be hashed along with a number of other values defined in the array $cart_excludes. However, this function does check the name/value pairs against the array.

If you add the following code at LINE 221, this will fix the problem.

// Skip the cart excludes if (in_array($prefix.$name[2], self::$cart_excludes) || in_array($prefix.$name[2], self::$cart_excludes_prefixes)) { self::$log[] = 'Skipping the reserved parameter or prefix "'.$prefix.$name[2].'" = '.$value[2]; continue; }