From: Ivan Kohler <ivan@freeside.biz>
Date: Mon, 18 Nov 2013 01:10:49 +0000 (-0800)
Subject: don't redirect to a GET with sensitive data, RT#26099
X-Git-Url: http://git.freeside.biz/gitweb/?p=freeside.git;a=commitdiff_plain;h=78468b9e9cb1ccf39e6092b8e3d87bab393ea5dd

don't redirect to a GET with sensitive data, RT#26099
---

diff --git a/httemplate/elements/handle_uri_query b/httemplate/elements/handle_uri_query
index eb7ea1ae1..2dea96a6d 100644
--- a/httemplate/elements/handle_uri_query
+++ b/httemplate/elements/handle_uri_query
@@ -1,8 +1,20 @@
 <%init>
+
+my %opt = @_;
+
 if ( $cgi->param('redirect') ) {
   my $session = $cgi->param('redirect');
+
   my $pref = $FS::CurrentUser::CurrentUser->option("redirect$session");
   die "unknown redirect session $session\n" unless length($pref);
   $cgi = new CGI($pref);
+
+  foreach my $param (grep /pay(info\d?|cvv)$/, $cgi->param) {
+    my $value = $cgi->param($param);
+    next unless length($value);
+    my $decrypted = FS::Record->decrypt( $value );
+    $cgi->param($param, $decrypted);
+  }
+
 }
 </%init>