From b74cce9dcef87eafee8c1a633387fca31a9739fd Mon Sep 17 00:00:00 2001 From: Frederik Rommel Date: Thu, 2 Feb 2023 18:03:47 +0100 Subject: [PATCH] RATESWSX-270: debit/credit: add input validation --- .../Controller/ProductPanel.php | 37 ++++++++++++++----- .../ratepay-order-management/index.js | 2 +- .../ratepay-order-management.html.twig | 6 +-- .../public/administration/js/rpay-payments.js | 2 +- 4 files changed, 32 insertions(+), 15 deletions(-) diff --git a/src/Components/OrderManagement/Controller/ProductPanel.php b/src/Components/OrderManagement/Controller/ProductPanel.php index 64123f1e..242c9557 100644 --- a/src/Components/OrderManagement/Controller/ProductPanel.php +++ b/src/Components/OrderManagement/Controller/ProductPanel.php @@ -30,10 +30,16 @@ use Shopware\Core\Framework\DataAbstractionLayer\EntityRepository; use Shopware\Core\Framework\DataAbstractionLayer\Search\Criteria; use Shopware\Core\Framework\Routing\Exception\InvalidRequestParameterException; +use Shopware\Core\Framework\Validation\DataValidationDefinition; +use Shopware\Core\Framework\Validation\DataValidator; use Symfony\Bundle\FrameworkBundle\Controller\AbstractController; use Symfony\Component\HttpFoundation\JsonResponse; use Symfony\Component\HttpFoundation\Request; use Symfony\Component\Routing\Annotation\Route; +use Symfony\Component\Validator\Constraints\AtLeastOneOf; +use Symfony\Component\Validator\Constraints\GreaterThan; +use Symfony\Component\Validator\Constraints\LessThan; +use Symfony\Component\Validator\Constraints\NotBlank; /** * @Route("/api/ratepay/order-management", defaults={"_routeScope"={"administration"}}) @@ -51,13 +57,16 @@ class ProductPanel extends AbstractController private LineItemFactory $lineItemFactory; + private DataValidator $dataValidator; + public function __construct( EntityRepository $orderRepository, PaymentDeliverService $paymentDeliverService, PaymentReturnService $paymentReturnService, PaymentCancelService $paymentCancelService, PaymentCreditService $creditService, - LineItemFactory $lineItemFactory + LineItemFactory $lineItemFactory, + DataValidator $dataValidator ) { $this->orderRepository = $orderRepository; $this->creditService = $creditService; @@ -68,6 +77,7 @@ public function __construct( OrderOperationData::OPERATION_RETURN => $paymentReturnService, ]; $this->lineItemFactory = $lineItemFactory; + $this->dataValidator = $dataValidator; } /** @@ -152,20 +162,27 @@ public function return(string $orderId, Request $request, Context $context): Jso */ public function addItem(string $orderId, Request $request, Context $context): JsonResponse { - $name = (string) $request->request->get('name'); - $grossAmount = (float) (string) $request->request->get('grossAmount'); - $taxRuleId = (string) $request->request->get('taxId'); - $order = $this->fetchOrder($context, $orderId); if (!$order instanceof OrderEntity) { - return $this->json([ - 'success' => false, - 'message' => 'Order was not found', - ], 200); + throw $this->createNotFoundException('Order was not found'); } - $lineItem = $this->lineItemFactory->createLineItem($order, $name, $grossAmount, $taxRuleId, $context); + // validate provided data + $definition = new DataValidationDefinition(); + $definition->add('name', new NotBlank()); + $definition->add('grossAmount', new NotBlank(), new AtLeastOneOf([new GreaterThan(0), new LessThan(0)])); + $definition->add('taxId', new NotBlank()); + + $this->dataValidator->validate($request->request->all(), $definition); + + $lineItem = $this->lineItemFactory->createLineItem( + $order, + $request->request->get('name'), + $request->request->get('grossAmount'), + $request->request->get('taxId'), + $context + ); $response = $this->creditService->doRequest(new AddCreditData($context, $order, [$lineItem])); if ($response->getResponse()->isSuccessful()) { return $this->json([ diff --git a/src/Resources/app/administration/src/module/sw-order/component/ratepay-order-management/index.js b/src/Resources/app/administration/src/module/sw-order/component/ratepay-order-management/index.js index da83890f..645412de 100644 --- a/src/Resources/app/administration/src/module/sw-order/component/ratepay-order-management/index.js +++ b/src/Resources/app/administration/src/module/sw-order/component/ratepay-order-management/index.js @@ -338,7 +338,7 @@ Component.register('ratepay-order-management', { message = this.$tc('ratepay.errors.' + error.code) } this.createNotificationError({ - title: this.$tc('ratepay.orderManagement.messages.failedTitle'), + title: error.title ?? this.$tc('ratepay.orderManagement.messages.failedTitle'), message: message }); }); diff --git a/src/Resources/app/administration/src/module/sw-order/component/ratepay-order-management/ratepay-order-management.html.twig b/src/Resources/app/administration/src/module/sw-order/component/ratepay-order-management/ratepay-order-management.html.twig index 966c3dbb..9099a018 100644 --- a/src/Resources/app/administration/src/module/sw-order/component/ratepay-order-management/ratepay-order-management.html.twig +++ b/src/Resources/app/administration/src/module/sw-order/component/ratepay-order-management/ratepay-order-management.html.twig @@ -137,7 +137,7 @@ - +