fix XSS

[freeside.git] / FS / FS / ClientAPI / MyAccount.pm

diff --git a/FS/FS/ClientAPI/MyAccount.pm b/FS/FS/ClientAPI/MyAccount.pm
index 151a2ed..3364b97 100644 (file)
--- a/FS/FS/ClientAPI/MyAccount.pm
+++ b/FS/FS/ClientAPI/MyAccount.pm
@@ -14,6 +14,7 @@ use Business::CreditCard;
 use HTML::Entities;
 use Text::CSV_XS;
 use Spreadsheet::WriteExcel;
+use OLE::Storage_Lite;
 use FS::UI::Web::small_custview qw(small_custview); #less doh
 use FS::UI::Web;
 use FS::UI::bytecount qw( display_bytecount );
@@ -196,8 +197,6 @@ sub login {
 
   } else {
 
-warn Dumper($p);
-
     my $svc_domain = qsearchs('svc_domain', { 'domain' => $p->{'domain'} } )
       or return { error => 'Domain '. $p->{'domain'}. ' not found' };
 
@@ -931,8 +930,13 @@ sub validate_payment {
   #changing the hidden form values
   my $conf = new FS::Conf;
   my $fee_display = $conf->config('selfservice_process-display') || 'add';
-  my $fee_pkgpart = $conf->config('selfservice_process-pkgpart');
-  if ( $fee_display eq 'add' && $fee_pkgpart ) {
+  my $fee_pkgpart = $conf->config('selfservice_process-pkgpart', $cust_main->agentnum);
+  my $fee_skip_first = $conf->exists('selfservice_process-skip_first');
+  if ( $fee_display eq 'add'
+         and $fee_pkgpart
+         and ! $fee_skip_first || scalar($cust_main->cust_pay)
+     )
+  {
     my $fee_pkg = qsearchs('part_pkg', { pkgpart=>$fee_pkgpart } );
     $amount = sprintf('%.2f', $amount + $fee_pkg->option('setup_fee') );
   }
@@ -1098,8 +1102,10 @@ sub do_process_payment {
 
   #no error, so order the fee package if applicable...
   my $conf = new FS::Conf;
-  my $fee_pkgpart = $conf->config('selfservice_process-pkgpart');
-  if ( $fee_pkgpart ) {
+  my $fee_pkgpart = $conf->config('selfservice_process-pkgpart', $cust_main->agentnum);
+  my $fee_skip_first = $conf->exists('selfservice_process-skip_first');
+  
+  if ( $fee_pkgpart and ! $fee_skip_first || scalar($cust_main->cust_pay) ) {
 
     my $cust_pkg = new FS::cust_pkg { 'pkgpart' => $fee_pkgpart };
 
@@ -2031,6 +2037,9 @@ sub _usage_details {
     $p->{ending}    = $end;
   }
 
+  die "illegal beginning" if $p->{beginning} !~ /^\d*$/;
+  die "illegal ending"    if $p->{ending}    !~ /^\d*$/;
+
   my (@usage) = &$callback($svc_x, $p->{beginning}, $p->{ending}, 
     %callback_opt
   );