#!/usr/bin/perl -T
$versions{'agora.cgi'} = "5.5.005 Gold Member Version"; # . $ENV{"AGORAWRAP"};
# Version history is available at...
# http://www.agoracart.com/
#
# AgoraCart Pro and all associated files, except where noted, are
# Copyright 2001 to Present by K-Factor Technologies, Inc.
# at AgoraCart.com / AgoraCartPro.com / K-Factor.net with additional
# Copyrights 1999-2001 by Steven P. Kneizys and
# Copyrights 2000 - 2007 by C. Edward Mayo
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
#
# Each copy of Agoracart Pro and it's related files are cost items and
# are not free software. Each copy, use, install, copy and/or module must be
# licensed by K-Factor Technologies, Inc. Licenses (aka pro version membership)
# may be purchased at AgoraCart.com or AgoraCartPro.com.
#
# This copyright notice may not be
# removed or altered in any way.
#
BEGIN { use lib "library/additions"; push(@INC,"library/additions"); }
$| = 1;
$ENV{"PATH"} = "/bin:/usr/bin";
$test=`whoami`;
$versions{'whoami'} = $test if $test;
$versions{'id'} = `id`;
if ((-f "./wrap_agc.o") && (!($ARGV[0] =~ /nowrap/i))) { # use wrapper
$ENV{"AGORAWRAP"}="*";
print `./wrap_agc.o`;
&call_exit;
}
$time = time;
$main_program_running = "yes";
$sc_global_bot_tracker = '';
&require_supporting_libraries (__FILE__, __LINE__,
"./admin_files/agora_user_lib.pl",
# md5
"./library/MD5.pl",
"./library/cgi-lib.pl",
"./library/agora_html_lib.pl"); # added by Mister Ed for mySQL testing. fixes other thingies too.
$sc_special_checkout_variable2 = "";# reserved, do not use if using PayPal
&read_and_parse_form_data;
&xss_killer;
&require_supporting_libraries (__FILE__, __LINE__,
"./library/agora.setup.db");
&codehook("after_loading_setup_db");
&require_supporting_libraries (__FILE__, __LINE__,
"./admin_files/$sc_gateway_name-user_lib.pl",
"$sc_html_setup_file_path",
"$sc_cookie_lib");
$sc_loading_primary_gateway = "yes";
&require_supporting_libraries(__FILE__,__LINE__,"$sc_process_order_lib_path");
$sc_loading_primary_gateway = "no";
# added by Mister Ed July 11, 2006
$sc_special_checkout_variable1 = ''; # reserved, do not use if using random key generation
$sc_special_checkout_variable3 = '';
$sc_special_misc_variable1 = '';
$sc_special_misc_variable2 = '';
$sc_special_misc_variable3 = '';
&codehook("before_loading_custom_libs");
opendir (USER_LIBS, "./add_ons") || &codehook("cannot-open-custom-dir");
@mylibs = sort(readdir(USER_LIBS));
closedir (USER_LIBS);
foreach $zlib (@mylibs) {
$lib = $zlib;
$lib =~ /([\w\-\=\+]+)(\.pl)/i;
$zfile = "$1$2";
$zlib =~ /([^\n|;]+)/;
$lib = $1;
if ((-f "./add_ons/$lib") && ($lib eq $zfile)) {
&require_supporting_libraries(__FILE__, __LINE__,"./add_ons/$lib");
}
}
&codehook("after_loading_custom_libs");
&agora_starter_section;
&codehook("open_for_business");
foreach $query_field (@sc_db_query_criteria)
{
@criteria = split(/\|/, $query_field);
if ($form_data{$criteria[0]} ne "")
{
$are_any_query_fields_filled_in = "yes";
}
}
if (($search_request ne "") && ($are_any_query_fields_filled_in eq "no")) {
$page = "searchpage.html";
$search_request = "";
if (!(-f "$sc_html_product_directory_path/$page")){
$page = "";
$form_data{'product'} = "."; # show everything
$are_any_query_fields_filled_in = "yes";
} else {
$form_data{'page'} = $page;
}
}
&codehook("special_navigation");
if (&form_check('display_cart'))
{
&load_order_lib;
&display_cart_contents;
&call_exit;
}
if (&form_check('add_to_cart_button'))
{
&load_order_lib;
&add_to_the_cart;
&call_exit;
}
elsif (&form_check('modify_cart_button'))
{
&load_order_lib;
&display_cart_contents;
&call_exit;
}
elsif (&form_check('change_quantity_button'))
{
&load_order_lib;
&output_modify_quantity_form;
&call_exit;
}
elsif (&form_check('submit_change_quantity_button'))
{
&load_order_lib;
&modify_quantity_of_items_in_cart;
&call_exit;
}
elsif (&form_check('delete_item_button'))
{
&load_order_lib;
&output_delete_item_form;
&call_exit;
}
elsif (&form_check('submit_deletion_button'))
{
&load_order_lib;
&delete_from_cart;
&call_exit;
}
elsif (&form_check('order_form_button'))
{
&load_order_lib;
&display_order_form;
&call_exit;
}
elsif (&form_check('clear_order_form_button'))
{
&load_order_lib;
&clear_verify_file;
&codehook("display_cleared_order_form");
&display_order_form;
&call_exit;
}
elsif (&form_check('submit_order_form_button'))
{
&load_order_lib;
if ($sc_test_repeat) {
&display_order_form;
} else {
&process_order_form;
}
&call_exit;
}
elsif (($page ne "" || $search_request ne ""
|| &form_check('continue_shopping_button')
|| $are_any_query_fields_filled_in =~ /yes/i) &&
($form_data{'return_to_frontpage_button'} eq ""))
{
&display_products_for_sale;
&call_exit;
}
$sc_processing_order="yes"; # assume unless we fall through
&codehook("gateway_response");
$sc_processing_order="no";
# If we got here, then just output the front page
&output_frontpage;
&call_exit;
#########################################################################
# load the order library #
#########################################################################
sub load_order_lib{
&codehook("load_order_lib_before");
&require_supporting_libraries(__FILE__,__LINE__,"$sc_order_lib_path");
&codehook("load_order_lib_after");
}
#########################################################################
# check if a form_data button has been selected #
#########################################################################
sub form_check {
local ($name) = @_;
local ($name2) = $name . ".x";
if (($form_data{$name} ne "") || ($form_data{$name2} ne "")) {
return 1;
} else {
return "";
}
}
#######################################################################
# Require Supporting Libraries. #
#######################################################################
# require_supporting_libraries is used to read in some of
# the supporting files that this script will take
# advantage of.
#
# require_supporting_libraries takes a list of arguments
# beginning with the current filename, the current line
# number and continuing with the list of files which must
# be required using the following syntax:
#
# &require_supporting_libraries (__FILE__, __LINE__,
# "file1", "file2",
# "file3"...);
#
# Note: __FILE__ and __LINE__ are special Perl variables
# which contain the current filename and line number
# respectively. We'll continually use these two variables
# throughout the rest of this script in order to generate
# useful error messages.
sub require_supporting_libraries
{
# The libraries are required by us,so exit if loading error
local ($file, $line, @require_files) = @_;
local ($require_file);
&request_supporting_libraries("warn exit",$file, $line, @require_files);
}
sub request_supporting_libraries
{
# The incoming file and line arguments are split into
# the local variables $file and $line while the file list
# is assigned to the local list array @require_files.
#
# $require_file which will just be a temporary holder
# variable for our foreach processing is also defined as a
# local variable.
local ($what_to_do_on_error, $file, $line, @require_files) = @_;
local ($require_file);
# Next, the script checks to see if every file in the
# @require_files list array exists (-e) and is readable by
# it (-r). If so, the script goes ahead and requires it.
foreach $require_file (@require_files)
{
if (-e "$require_file" && -r "$require_file")
{ # file is there, now try to require it
$result = eval('require "$require_file"'); # require it in a not-fatal way
if ($@ ne "") {
if($what_to_do_on_error =~ /warn/i) {
if ($error_header_done ne "yes") {
$error_header_done = "yes";
print "Content-type: text/html\n\n";
}
print "
\n";
print "Error loading library $require_file:
\n $@\n";
print "
Please contact the site administrator to ",
"fix the error. \($ENV{'SERVER_ADMIN'}\) \n";
print " |
\n";
}
if($what_to_do_on_error =~ /exit/i) {
&call_exit;
}
}
}
# If not, the scripts sends back an error message that
# will help the admin isolate the problem with the script.
else
{
if($what_to_do_on_error =~ /warn/i) {
if ($error_header_done ne "yes") {
$error_header_done = "yes";
print "Content-type: text/html\n\n";
}
print "I am sorry but I was unable to require $require_file at line
$line in $file.
\nWould you please make sure that you have the
path correct and that the permissions are set so that I have
read access? Thank you. \($ENV{'SERVER_ADMIN'}\)
\n";
}
if($what_to_do_on_error =~ /exit/i) {
&call_exit;
}
}
} # End of foreach $require_file (@require_files)
} # End of sub require_supporting_libraries
#######################################################################
# Read and Parse Form Data. #
#######################################################################
# read_and_parse_form_data is a short subroutine
# responsible for calling the ReadParse subroutine in
# cgi-lib.pl to parse the incoming form data. The script
# also tells cgi-lib to prepare that information in the
# associative array named %form_data which we will be able
# to use for the rest of this script.
#
# read_and_parse_form_data takes no arguments and is
# called with the following syntax:
#
# &read_and_parse_form_data;
sub read_and_parse_form_data
{
local ($junk);
&ReadParse(*form_data);
# DELUXE feature ... check here if we are just serving images
if ($form_data{'picserve'} ne "") {
&serve_picture($form_data{'picserve'},$sc_path_of_images_directory);
&call_exit;
}
if ($form_data{'secpicserve'} ne "") {
&serve_picture($form_data{'secpicserve'},"./protected/images/");
&call_exit;
}
}
#########################################################################
#
# Writen by Steve K to serve images 04-FEB-2000
# HTML usage examples:
#
#
#
# Note: using the http:// format is less efficient
# converted to taint-mode sub 2/5/2000
sub serve_picture {
local ($qstr,$sc_path_of_images_directory) = @_;
local ($test, $test2, $my_path_to_image);
$qstr =~ /([\w\-\=\+\/\.\:]+)/;
$qstr = "$1";
$my_path_to_image = $sc_path_of_images_directory . $qstr ;
$test = substr($my_path_to_image,0,6);
$test2 = substr($my_path_to_image,(length($my_path_to_image)-3),3);
if ($test2=~ /jpg/i || $test2 =~ /gif/i || $test2 =~ /png/i) {
# file is ok to display
if ($test2=~ /jpg/i) {# .jpg is jpeg file
$test2 = "jpeg";
}
if ($test=~ /http:\//i || $test =~ /https:/i) {
# need to GET the info .. no implemented here in agora
# use LWP::Simple;
# print "Content-type: image/$test2\n\n";
# print get($my_path_to_image);
} else { # is a filename we can load up directly
print "Content-type: image/$test2\n\n";
if (!(-f $my_path_to_image)) {# try adding another slash!
$my_path_to_image = $sc_path_of_images_directory ."/" . $qstr ;
}
open (MYPIC,$my_path_to_image);
binmode(MYPIC);
$size = 250000;
while ($size > 0) {
$size = read(MYPIC,$the_picture,$size);
print $the_picture;
}
close(MYPIC);
}
}
}
#######################################################################
sub pre_header_navigation {
local($temp,$inx,@things_to_delete,@form_keys,$form_name,$count);
local(@temp,$request,$actual);
if ($cart_id eq $my_cookie_cart_id) {
&set_agora("BROWSER_COOKIES_ON","yes");
}
# Check if running under SSI ... may need to do something special
if ($sc_running_an_SSI_store =~ /yes/i) {
$test_for_forced_redirect = &get_agora("SSI_FORCE_REDIRECT");
&set_agora("SSI_FORCE_REDIRECT",'');
# What name would we use for the form data?
@form_keys = grep(/SSI_FORM_DATA/,&get_agora_names);
if ($sc_unique_cart_modifier eq '') {
$sc_unique_cart_modifier = &make_random_chars;
}
@form_keys = grep(/$sc_unique_cart_modifier/,@form_keys);
$form_name = $form_keys[0];
# Check for existance of SSI_FORM_DATA
$temp = &get_agora("$form_name");
if ($temp ne '') {
%form_data = split(/\x01/,$temp);
&alias_and_override;
&error_check_form_data;
} else {
# For safety and such, only keep max 90 POSTs cached
# automatically delete old ones even if not a POST!
$count = &get_agora("SSI_FORM_COUNT");
$count = $count+1;
if ($count < 10 || $count > 99) {$count = "10";}
&set_agora("SSI_FORM_COUNT",$count);
@things_to_delete = grep(/SSI_FORM_DATA_${count}_/,&get_agora_names);
foreach $inx (@things_to_delete) {&set_agora($inx,'');}
# see if we need to force a redirect
($request,$junk) = split(/\?/,$ENV{'REQUEST_URI'},2);
@temp = split(/\//,$request);
$request = pop(@temp);
($request,$junk) = split(/\?/,$request,2);
@temp = split(/\//,$sc_store_url);
$actual = pop(@temp);
if ($request ne $actual && (!($sc_allow_forced_SSI_redirect =~ /no/))) {
if ($test_for_forced_redirect eq '') {
$form_data{'SSI'} = 1;
&set_agora("SSI_FORCE_REDIRECT",'1');
}
}
if (defined($form_data{'SSI'})) { # setup the redirect
$temp = '';
delete($form_data{'SSI'}); # Don't re-direct a redirect!
$sc_unique_cart_modifier = &make_random_chars; # Need new id!!
foreach $inx (keys %form_data) {
$temp .= "$inx\x01$form_data{$inx}\x01";
}
&set_agora("SSI_FORM_DATA_${count}_$sc_unique_cart_modifier",$temp);
$href = "$sc_store_url?cart_id=$cart_id";
$href .= "&crtmod=$sc_unique_cart_modifier";
$temp = $ENV{'SCRIPT_NAME'};
if ($temp =~ /nph-agora.cgi$/i) {
$SSI_redirect_message = "HTTP/1.0 302 Found\n";
$SSI_redirect_message .= "$sc_cookie_information";
$SSI_redirect_message .= "Location: $href\n";
} else {
$SSI_redirect_message = qq~$sc_doctype
~;
}
&set_agora("SSI_REDIRECT_OK",'yes');
&add_codehook("cleanup_before_exit","print_SSI_redirect");
&call_exit;
}
}
}
&codehook("pre_header_navigation");
}
#######################################################################
sub print_SSI_redirect {
print $SSI_redirect_message,"\n";
}
#######################################################################
# Alias and Override
#
# This routine allows the use of aliases for switches, such as
# using xm= instead of exact_match=
#
# Also, override certain setup variables under certain conditions
#
#######################################################################
sub alias_and_override {
local($item,$xx);
local ($junk,$raw_text)="";
local (@mylibs,$lib);
local ($testval,$testval2,$found_response);
&codehook("alias_and_override_top");
&special_security_f3_01172004;
if ((
((($form_data{'NiftyPay'} eq '')&&($sc_gateway_name eq "NiftyPay"))||(($form_data{'AgoraPay'} eq '')&&($sc_gateway_name eq "AgoraPay"))
||(($form_data{'iTransact'} eq '')&&($sc_gateway_name eq "iTransact")))
||(($sc_gateway_name ne "iTransact")&&($sc_gateway_name ne "AgoraPay")&&($sc_gateway_name ne "NiftyPay"))
)) {
# Debug Thingies
# print "Content-type: text/html\n\n";
# print "we did security
";
&special_security_f1_01242002;}
if (defined($form_data{'versions'})) {
print "Content-type: text/html\n\n";
print "\nVERSIONS\n\n";
print "
Info and Versions of loaded libraries:
\n";
print "\n";
foreach $junk (sort(keys(%versions)))
{
print "| $junk | $versions{$junk} |
\n";
}
print "
\n";
$junk .= `$sc_grep -h "versions{'" ./add_ons/* |$sc_grep "}="`;
$junk .= `$sc_grep -h "versions{'" ./add_ons/* |$sc_grep "} ="`;
$junk .= `$sc_grep -h "versions{'" ./protected/* |$sc_grep "}="`;
$junk .= `$sc_grep -h "versions{'" ./protected/* |$sc_grep "} ="`;
$junk .= `$sc_grep -h "versions{'" ./protected/custom/* |$sc_grep "}="`;
$junk .= `$sc_grep -h "versions{'" ./protected/custom/* |$sc_grep "} ="`;
$junk .= `$sc_grep -h "versions{'" ./library/* |$sc_grep "}="`;
$junk .= `$sc_grep -h "versions{'" ./library/* |$sc_grep "} ="`;
$junk =~s/\n/ /g;
$junk =~ /([\w\-\=\+\/\;\{\}\'\ \.\"\$]+)/;
$junk = $1;
while ($junk ne "") {
$result = $lib;
($junk1,$key,$junk) = split(/\'/,$junk,3);
($junk1,$val,$junk) = split(/\"/,$junk,3);
if ($versions{$key} eq "") {
$versions{$key} = $val;
}
($junk1,$junk) = split(/versions/,$junk,2);
}
# if ($@ eq "") {
print "
info and Versions of loaded and unloaded libraries:
\n";
print "\n";
foreach $junk (sort(keys(%versions)))
{
print "| $junk | $versions{$junk} |
\n";
}
print "
\n";
# }
print "\n\n";
&call_exit;
}
# Get rid of extraneous stuff, if present, on the cart id
# need to test for a repeated loading of critical pages ...
if (defined($form_data{'cart_id'})) {
($form_data{'cart_id'},$junk) = split(/\*/,$form_data{'cart_id'},2);
$sc_unique_cart_modifier_orig = $junk;
$sc_unique_cart_modifier = substr($sc_unique_cart_modifier_orig,0,6);
}
# Check for proper URL in use, helps with cookies but not required
$found_response = "";
foreach $testval (keys %sc_order_response_vars) {
$testval2 = $sc_order_response_vars{$testval};
if ($form_data{$testval2} ne "") {
$found_response .= "*";
}
}
if (("$sc_domain_name_for_cookie" ne $ENV{'HTTP_HOST'}) &&
($sc_allow_location_redirect =~ /yes/i ) &&
($form_data{'process_order.x'} eq "" ) &&
($form_data{'process_order'} eq "" ) &&
($form_data{'relay'} eq "" ) &&
($found_response eq "" ) &&
($form_data{'submit_order_form_button.x'} eq "" ) &&
($form_data{'submit_order_form_button'} eq "" ) &&
($form_data{'order_form_button.x'} eq "" ) &&
($form_data{'order_form_button'} eq "" )){ #redrect them to standard URL
if ($cookie{'cart_id'} ne "") {
$cart_id = $cookie{'cart_id'};
}
if ($form_data{'cart_id'} ne "") {
$cart_id = $form_data{'cart_id'};
($cart_id,$junk) = split(/\*/,$cart_id,2);
}
$sc_cart_path = "$sc_user_carts_directory_path/${cart_id}_cart";
if (!(-f $sc_cart_path)){ #no cart, forget the number
$cart_id = "";
}
$href = "$sc_store_url";
if ($cart_id ne "") {
$href .= "?cart_id=$cart_id";
}
print "Location: $href\n\n";
&call_exit;
}
$search_request = ($form_data{'search_request_button'} ||
$form_data{'search_request_button.x'});
if (($form_data{'maxp'} > 0) && ($form_data{'maxp'} < 301)) {
$sc_db_max_rows_returned = $form_data{'maxp'};
}
if (defined($form_data{'srb'})) { #is an override/shortcut
$search_request = $form_data{'srb'};
}
if (defined($form_data{'xc'})) {
$form_data{'exact_case'} = $form_data{'xc'};
}
if (defined($form_data{'xm'})) {
$form_data{'exact_match'} = $form_data{'xm'};
}
if (defined($form_data{'dc'})) {
$form_data{'display_cart'} = $form_data{'dc'};
}
if (defined($form_data{'pid'})) {
$form_data{'p_id'} = $form_data{'pid'};
}
if (defined($form_data{'ofn'})) {
$form_data{'order_form'} = $form_data{'ofn'};
}
if (defined($form_data{'p'})) {
if ($form_data{'product'} ne "") {
$form_data{'product'} .= " " . $form_data{'p'};
} else {
$form_data{'product'} = $form_data{'p'};
}
}
if (defined($form_data{'ppovr'})) {
$form_data{'ppinc'} = $form_data{'ppovr'};
}
if (defined($form_data{'k'})) {
if ($form_data{'keywords'} ne "") {
$form_data{'keywords'} .= " " . $form_data{'k'};
} else {
$form_data{'keywords'} = $form_data{'k'};
}
}
if (defined($form_data{'kovr'})) {
$form_data{'keywords'} = $form_data{'kovr'};
}
if (($form_data{'add_to_cart_button'} eq "") &&
($form_data{'add_to_cart_button.x'} ne "")) {
$form_data{'add_to_cart_button'} = "1";
}
if ($form_data{'viewOrder'} eq "yes") {
$sc_should_i_display_cart_after_purchase = "yes";
} else {
$sc_should_i_display_cart_after_purchase = "no";
}
if (($sc_debug_mode =~ /yes/i) && ($sc_debug_track_cartid =~ /yes/i)) {
if (($cookie{'cart_id'} ne "") && ($form_data{'cart_id'} ne "")) {
$cart_id = $form_data{'cart_id'};
($cart_id,$junk) = split(/\*/,$cart_id,2);
if ($cart_id ne $cookie{'cart_id'}) {
local($mytext) = "Cart ID changed: cookie=$cookie{'cart_id'} ";
$mytext .= "form=$form_data{'cart_id'}|";
$mytext .= "form values:|";
local($inx);
foreach $inx (sort(keys %form_data)) {
$mytext .= " \$form_data{'$inx'} = $form_data{$inx}|";
}
&update_error_log($mytext, __FILE__, __LINE__);
}
}
}
&special_security_f2_01242002;
&codehook("alias_and_override_end");
}
#######################################################################
# Error Check Form Data. #
#######################################################################
# error_check_form_data is responsible for checking to
# make sure that only authorized pages are viewable using
# this application. It takes no arguments and is called
# with the following syntax:
#
# &error_check_form_data;
#
# The routine simply checks to make sure that if
# the page variable extension is not one that is defined
# in the setup file as an appropriate extension like .html
# or .htm, or there is no page being requestd (ie: the
# store front is being displayed) it will send a warning
# to the user, append the error log, and exit.
#
# @acceptable_file_extensions_to_display is an array of
# acceptable file extensions defined in the setup file.
# To be more or less restrictive, just modify this list.
#
# Specifically, for each extension defined in the setup
# file, if the value of the page variable coming in from
# the form ($page) is like the extension (/$file_extension/)
# or there is no value for page (eq ""), we will set
# $valid_extension equal to yes.
sub error_check_form_data
{
#
# error check this, paranoia I know ... just in case regular expr. get
# broken somehow, this is our safety net
if ($form_data{'page'} =~ /\.\.\/|http:|https:|ftp:/) {
print "Content-type: text/html\n\n";
print "
ERROR:
You may not use the store to navigate";
print " to outside pages/sites, that is Forbidden. Sorry!\n ";
$form_data{'page'} ='';
&call_exit;
}
# These expressions will strip of any path information so
# files are only loaded from the appropriate directory.
# We will also only load pages of the proper extension,
# which is checked in sub error_check_form_data.
$page = $form_data{'page'};
$page =~ /([\w\-\=\+\/]+)\.(\w+)/;
$page = "$1.$2";
$page_extension = ".$2";
$page = "" if ($page eq ".");
$page =~ s/^\/+//; # Get rid of any residual / prefix
$form_data{'page'} = $page; # set it back, in case somebody uses it
foreach $file_extension (@acceptable_file_extensions_to_display)
{
if ($page_extension eq $file_extension || $page eq "")
{
$valid_extension = "yes";
}
}
# Next, the script checks to see if $valid_extension has
# been set to "yes".
#
# If the value for page satisfied any of the extensions
# in @acceptable_file_extensions_to_display, the script
# will set $valid_extension equal to yes. If the value
# is set to yes, the subroutine will go on with it's work.
# Otherwise it will exit with a warning and write to the
# eror log if appropriate
#
# Notice that we pass three parameters to the
# update_error_log subroutine which will be discussed
# later. The subroutine gets a warning, the
# name of the file, and the line number of the error.
#
# $sc_page_load_security_warning is a variable set in
# agora.setup.db If you want to give a more or less
# informative error message, you are welcome to change the
# text there.
if ($valid_extension ne "yes") {
print "Content-type: text/html\n\n$sc_page_load_security_warning\n";
&update_error_log("PAGE LOAD WARNING", __FILE__, __LINE__);
&call_exit;
}
$form_data{'page'} = $page; # set it to the untainted & filtered one
#
# This is section added by Mister Ed 09/2002 and operates
# exactly like the routines above for the pages parsed by
# agoracart, but for the cartlinks instead.
#
if ($form_data{'cartlink'} ne "") {
#
# error check this, paranoia I know ... just in case regular expr. get
# broken somehow, this is our safety net
if ($form_data{'cartlink'} =~ /\.\.\/|http:|https:|ftp:/) {
print "Content-type: text/html\n\n";
print "
ERROR:
You may not use the store to navigate";
print " to outside pages/sites, that is Forbidden. Sorry!\n ";
$form_data{'cartlink'} = '';
&call_exit;
}
$cartlink = $form_data{'cartlink'};
$cartlink =~ /([\w\-\=\+\/]+)\.(\w+)/;
$cartlink = "$1.$2";
$page_extension = ".$2";
$cartlink = "" if ($cartlink eq ".");
$cartlink =~ s/^\/+//;
$form_data{'cartlink'} = $cartlink;
foreach $file_extension (@acceptable_file_extensions_to_display)
{
if ($page_extension eq $file_extension || $cartlink eq "")
{
$valid_extension = "yes";
}
}
if ($valid_extension ne "yes") {
print "Content-type: text/html\n\n$sc_page_load_security_warning\n";
&update_error_log("PAGE LOAD WARNING", __FILE__, __LINE__);
&call_exit;
}
$form_data{'cartlink'} = $cartlink; # set it to the untainted & filtered one
}
# now un-taint the value of $form_data{'cart_id'}
# also pattern match it, in case the form has 2+ cart_id fields
if ($form_data{'cart_id'} ne "") {
if ($form_data{'cart_id'} =~ /^([\w\-\=\+\/]+)\.(\w+)/) {
$temp = "$1.$2";
if ($form_data{'cart_id'} ne $temp) { $temp = '';}
$form_data{'cart_id'} = $temp;
if ($form_data{'cart_id'} eq ".") {
$form_data{'cart_id'} = "";
}
} else {
$form_data{'cart_id'} = "";
}
}
if ($cookie{'cart_id'} ne "") {
if ($cookie{'cart_id'} =~ /(^[\w\-\=\+\/]+)\.(\w+)/) {
$cookie{'cart_id'} = "$1.$2";
if ($cookie{'cart_id'} eq ".") {
$cookie{'cart_id'} = "";
}
} else {
$cookie{'cart_id'} = "";
}
}
}
#######################################################################
sub special_security_f1_01242002 {
# international latin enabled by Mister Ed June 27, 2006
# ÀÁÂÃÄÅÆÇŒÈÉÊËÌÍÎÏÐÑÒÓÔÕÖØŠÙÚÛÜÝŸßàáâãäåæçèëìíîïðñòóôœõöøšùúûüýþÿž
# À Á Â Ã Ä Å Æ Ç Œ È É Ê Ë Ì Í Î Ï Ð Ñ Ò Ó Ô Õ Ö Ø Š Ù Ú Û Ü Ý Ÿ ß à á â ã ä å æ ç è ë ì í î ï ð ñ ò ó ô œ õ ö ø š ù ú û ü ý þ ÿ ž
# defaults for English: USA, Canada, Australia, Canada
my $patternString = '[^ \$\w\-=\+\.\/,@#!_\\[\]\^\{\}\:&;|~\*\x00\(\)]+';
my $patternString2 = '[ \$\w\-=\+\.\/,@#!_\\[\]\^\{\}\:&;|~\*\x00\(\)]+';
if ($sc_use_international_latin_characters =~ /yes/i) {
$patternString = '[^ \$\w\-=\+\.\/,ÀÁÂÃÄÅÆÇŒÈÉÊËÌÍÎÏÐÑÒÓÔÕÖØŠÙÚÛÜÝŸßàáâãäåæçèëìíîïðñòóôœõöøšùúûüýþÿž@#!_\\[\]\^\{\}\:&;|~\*\x00\(\)]+';
$patternString2 = '[ \$\w\-=\+\.\/,ÀÁÂÃÄÅÆÇŒÈÉÊËÌÍÎÏÐÑÒÓÔÕÖØŠÙÚÛÜÝŸßàáâãäåæçèëìíîïðñòóôœõöøšùúûüýþÿž@#!_\\[\]\^\{\}\:&;|~\*\x00\(\)]+';
# corrected December 22, 2006
# $patternString = '[^ \$\w\-=\+\.\/,ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖØÙÚÛÜÝŸàáâãäåæçèëìíîïðñòóôœõöøùúûüýþÿ@#!_\\[\]\^\{\}\:&;|~\*\x00\(\)]+';
# $patternString2 = '[ \$\w\-=\+\.\/,ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖØÙÚÛÜÝŸàáâãäåæçèëìíîïðñòóôœõöøùúûüýþÿ@#!_\\[\]\^\{\}\:&;|~\*\x00\(\)]+';
}
# prefilter everything for meta characters
if (!($sc_debug_mode =~ /yes/i)) { delete($form_data{'versions'});}
$form_data{'cart_id'} =~ s/</g;
$form_data{'cart_id'} =~ s/>/>/g;
for $xx (keys %form_data) {
$form_data{$xx}=~s/($patternString)//g;
if ($form_data{$xx}=~/($patternString2)/){
$form_data{$xx} = $1;
} else {
$form_data{$xx} = '';
}
}
}
sub special_security_f2_01242002 {
if (!($form_data{'cart_id'} =~ /^([\w\-\=\+\/]+)\.(\w+)/)) {
$form_data{'cart_id'} = '';
$sc_unique_cart_modifier_orig = '';
$sc_unique_cart_modifier = '';
}
}
# disallows submitting items in browser address bar
sub special_security_f3_01172004 {
if ($form_data{'option'} ne '') {
$form_data{'add_to_cart_button'} = '';
$form_data{'add_to_cart_button.x'} = '';
$sc_unique_cart_modifier_orig = '';
$sc_unique_cart_modifier = '';
}
}
#######################################################################
sub option_prep {
local ($field,$option_location,$product_id)= @_;
local ($very_first_part,$junk);
local ($arg,$arg1,$arg2);
$field = &agorascript($field,"optpre","$option_location",__FILE__,__LINE__);
$field =~ s/%%PRODUCT_ID%%/$product_id/ig;
$field =~ s/%%PRODUCTID%%/$product_id/ig;
$field =~ s/%%prodID%%/$product_id/ig;
$field = &agorascript($field,"optpost","$option_location",__FILE__,__LINE__);
# DELUXE feature ... take only the part between --cut here--
# tokens
# if ($chop =~ /yes/i) {
($very_first_part,$field,$junk) =
split(/