RT#29354: Password Security in Email [xmlhttp validation for selfservice]

[freeside.git] / fs_selfservice / FS-SelfService / cgi / signup.cgi

diff --git a/fs_selfservice/FS-SelfService/cgi/signup.cgi b/fs_selfservice/FS-SelfService/cgi/signup.cgi
index 23d814e..072ce96 100755 (executable)
--- a/fs_selfservice/FS-SelfService/cgi/signup.cgi
+++ b/fs_selfservice/FS-SelfService/cgi/signup.cgi
@@ -160,31 +160,31 @@ if ( $magic eq 'process' || $action eq 'process_signup' ) {
     my $payby = $cgi->param('payby');
     if ( $payby eq 'CHEK' || $payby eq 'DCHK' ) {
       #$payinfo = join('@', map { $cgi->param( $payby. "_payinfo$_" ) } (1,2) );
-      $cgi->param('payinfo' => $cgi->param($payby. '_payinfo1'). '@'. 
-                               $cgi->param($payby. '_payinfo2')
+      $cgi->param('payinfo' => scalar($cgi->param($payby. '_payinfo1')). '@'. 
+                               scalar($cgi->param($payby. '_payinfo2'))
                  );
     } else {
-      $cgi->param('payinfo' => $cgi->param( $payby. '_payinfo' ) );
+      $cgi->param('payinfo' => scalar($cgi->param( $payby. '_payinfo' ) ) );
     }
-    $cgi->param('paydate' => $cgi->param( $payby. '_month' ). '-'.
-                             $cgi->param( $payby. '_year' )
+    $cgi->param('paydate' => scalar($cgi->param( $payby. '_month' )). '-'.
+                             scalar($cgi->param( $payby. '_year' ))
                );
-    $cgi->param('payname' => $cgi->param( $payby. '_payname' ) );
+    $cgi->param('payname' => scalar($cgi->param( $payby. '_payname' ) ) );
     $cgi->param('paycvv' => defined $cgi->param( $payby. '_paycvv' )
-                              ? $cgi->param( $payby. '_paycvv' )
+                              ? scalar($cgi->param( $payby. '_paycvv' ))
                               : ''
                );
     $cgi->param('paytype' => defined $cgi->param( $payby. '_paytype' )
-                              ? $cgi->param( $payby. '_paytype' )
+                              ? scalar($cgi->param( $payby. '_paytype' ))
                               : ''
                );
     $cgi->param('paystate' => defined $cgi->param( $payby. '_paystate' )
-                              ? $cgi->param( $payby. '_paystate' )
+                              ? scalar($cgi->param( $payby. '_paystate' ))
                               : ''
                );
 
     if ( $cgi->param('invoicing_list') ) {
-      $cgi->param('invoicing_list' => $cgi->param('invoicing_list'). ', POST')
+      $cgi->param('invoicing_list' => scalar($cgi->param('invoicing_list')). ', POST')
         if $cgi->param('invoicing_list_POST');
     } else {
       $cgi->param('invoicing_list' => 'POST' );
@@ -208,6 +208,11 @@ if ( $magic eq 'process' || $action eq 'process_signup' ) {
         or $error ||= $init_data->{msgcat}{invalid_card}; #. $self->payinfo;
       cardtype($payinfo) eq $cgi->param('CARD_type')
         or $error ||= $init_data->{msgcat}{not_a}. $cgi->param('CARD_type');
+
+      $error ||= 'CVV2 is required'
+        if ! $cgi->param('paycvv')
+        && $init_data->{require_cvv};
+
     }
 
     if ($init_data->{emailinvoiceonly} && (length $cgi->param('invoicing_list') < 1)) {
@@ -231,11 +236,11 @@ if ( $magic eq 'process' || $action eq 'process_signup' ) {
                 invoicing_list referral_custnum promo_code reg_code
                 override_ban_warn
                 pkgpart refnum agentnum
-                username sec_phrase _password popnum
+                username sec_phrase _password popnum domsvc
                 mac_addr
                 countrycode phonenum sip_password pin prepaid_shortform
               ),
-            grep { /^snarf_/ } $cgi->param
+            grep { /^(snarf_|tax_)/ } $cgi->param
         ),
         'payip' => $cgi->remote_host(),
       } );
@@ -250,10 +255,9 @@ if ( $magic eq 'process' || $action eq 'process_signup' ) {
         qw( popup_url reference amount );
       print_collect($rv);
     } elsif ( $error ) {
-
-      #fudge the snarf info
+      #fudge the snarf and tax info
       no strict 'refs';
-      ${$_} = $cgi->param($_) foreach grep { /^snarf_/ } $cgi->param;
+      ${$_} = $cgi->param($_) foreach grep { /^(snarf_|tax_)/ } $cgi->param;
 
       if ( $error =~ /^_duplicate_(card|ach)/ ) {
         my $what = ($1 eq 'card') ? 'Credit card' : 'Electronic check';
@@ -500,5 +504,35 @@ END
 
 package FS::SelfService::_signupcgi;
 use HTML::Entities;
-use FS::SelfService qw(regionselector expselect popselector didselector);
+use FS::SelfService qw( regionselector expselect popselector domainselector
+                        didselector
+                      );
+
+sub add_password_validation {
+  my $fieldid = shift;
+  my $out = '';
+  if ((-e './send_xmlhttp.html') && (-e './add_password_validation.html')) {
+    my $template = new Text::Template( TYPE   => 'FILE',
+                                       SOURCE => "./send_xmlhttp.html",
+                                       DELIMITERS => [ '<%=', '%>' ],
+                                       UNTAINT => 1,                   
+                                     )
+      or die $Text::Template::ERROR;
+    $out .= $template->fill_in( PACKAGE => 'FS::SelfService::_signupcgi' );
+    $template = new Text::Template( TYPE   => 'FILE',
+                                       SOURCE => "./add_password_validation.html",
+                                       DELIMITERS => [ '<%=', '%>' ],
+                                       UNTAINT => 1,                   
+                                     )
+      or die $Text::Template::ERROR;
+    $out .= $template->fill_in( PACKAGE => 'FS::SelfService::_signupcgi' );
+    $out .= <<ENDOUT;
+<SCRIPT>
+add_password_validation('$fieldid');
+</SCRIPT>
+ENDOUT
+  }
+  return $out;
+}
+