diff options
Diffstat (limited to 'httemplate/elements')
| -rw-r--r-- | httemplate/elements/create_uri_query | 21 | ||||
| -rw-r--r-- | httemplate/elements/searchbar-cust_main.html | 2 |
2 files changed, 20 insertions, 3 deletions
diff --git a/httemplate/elements/create_uri_query b/httemplate/elements/create_uri_query index 32d8e2f87..ce6249e0e 100644 --- a/httemplate/elements/create_uri_query +++ b/httemplate/elements/create_uri_query @@ -1,17 +1,34 @@ <% $query %>\ <%init> +my %opt = @_; + +if ( $opt{secure} ) { + + foreach my $param (grep /pay(info\d?|cvv)$/, $cgi->param) { + my $value = $cgi->param($param); + next unless length($value); + my $encrypted = FS::Record->encrypt( $value ); + $cgi->param($param, $encrypted); + } + +} + my $query = $cgi->query_string; -if ( length($query) > 1920 ) { #stupid IE 2083 URL limit +if ( length($query) > 1920 || $opt{secure} ) { #stupid IE 2083 URL limit my $session = int(rand(4294967296)); #XXX my $pref = new FS::access_user_pref({ 'usernum' => $FS::CurrentUser::CurrentUser->usernum, 'prefname' => "redirect$session", 'prefvalue' => $query, - 'expiration' => time + 3600, #1h? 1m? + 'expiration' => time + ( $opt{secure} ? 120 #2m? + : 3600 #1h? + ), }); + local($FS::Record::no_history) = 1; + my $pref_error = $pref->insert; if ( $pref_error ) { die "FATAL: couldn't even set redirect cookie: $pref_error". diff --git a/httemplate/elements/searchbar-cust_main.html b/httemplate/elements/searchbar-cust_main.html index 9a98417c8..5bfef484a 100644 --- a/httemplate/elements/searchbar-cust_main.html +++ b/httemplate/elements/searchbar-cust_main.html @@ -1,6 +1,6 @@ % if ( $curuser->access_right('List customers') ) { - <FORM ACTION="<%$fsurl%>search/cust_main.cgi" METHOD="GET" STYLE="margin:0"> + <FORM ACTION="<%$fsurl%>search/cust_main.cgi" METHOD="POST" STYLE="margin:0"> <INPUT NAME="search_cust" TYPE="text" VALUE="<% $cust_label |n %>" STYLE="width:<%$width%>" onFocus="clearhint_search_cust(this);" onClick="clearhint_search_cust(this);" CLASS="fstext"><BR> <A HREF="<%$fsurl%>search/report_cust_main.html" CLASS="fslink" STYLE="font-size: 11px"><% mt('Advanced') |h %></A> <INPUT TYPE="submit" VALUE="<% mt('Search customers') |h %>" CLASS="fsblackbutton" onMouseOver="this.className='fsblackbuttonselected'; return true;" onMouseOut="this.className='fsblackbutton'; return true;" STYLE="font-size:11px"> |