Skip to content

Commit 7854f89

Browse files
rharot-visarharot-visa
committed
Checkmarx fixes. Also recommitted correct version of hybris/bin/b2b/isvb2bpaymentaddon/acceleratoraddon/web/webroot/WEB-INF/views/responsive/pages/checkout/multi/checkoutSummaryPage.jsp
1 parent dc337d1 commit 7854f89

File tree

4 files changed

+69
-144
lines changed

4 files changed

+69
-144
lines changed

‎hybris/bin/b2b/isvb2bpaymentaddon/acceleratoraddon/web/webroot/WEB-INF/views/responsive/pages/checkout/multi/checkoutSummaryPage.jsp

+62-135
Original file line numberDiff line numberDiff line change
@@ -1,167 +1,94 @@
11
<%@ page trimDirectiveWhitespaces="true"%>
2-
<%@ taglib prefix="c" uri="http://java.sun.com/jsp/jstl/core"%>
32
<%@ taglib prefix="template" tagdir="/WEB-INF/tags/responsive/template"%>
43
<%@ taglib prefix="cms" uri="http://hybris.com/tld/cmstags"%>
54
<%@ taglib prefix="multi-checkout" tagdir="/WEB-INF/tags/responsive/checkout/multi"%>
5+
<%@ taglib prefix="b2b-multi-checkout" tagdir="/WEB-INF/tags/addons/b2bacceleratoraddon/responsive/checkout/multi" %>
66
<%@ taglib prefix="spring" uri="http://www.springframework.org/tags"%>
77
<%@ taglib prefix="form" uri="http://www.springframework.org/tags/form" %>
8+
<%@ taglib prefix="c" uri="http://java.sun.com/jsp/jstl/core"%>
89

910
<spring:url value="/checkout/multi/summary/placeOrder" var="placeOrderUrl"/>
1011
<spring:url value="/checkout/multi/termsAndConditions" var="getTermsAndConditionsUrl"/>
11-
1212
<%@ taglib prefix="ycommerce" uri="http://hybris.com/tld/ycommercetags" %>
13-
<%@ taglib prefix="isv" uri="/WEB-INF/tld/addons/isvpaymentaddon/isv.tld"%>
1413

1514
<%@ taglib prefix="fraud" tagdir="/WEB-INF/tags/addons/isvpaymentaddon/responsive/fraud" %>
16-
<%@ taglib prefix="visacheckout" tagdir="/WEB-INF/tags/addons/isvpaymentaddon/responsive/payment/visacheckout" %>
17-
<%@ taglib prefix="klarna" tagdir="/WEB-INF/tags/addons/isvpaymentaddon/responsive/payment/klarna" %>
18-
<%@ taglib prefix="wechat" tagdir="/WEB-INF/tags/addons/isvpaymentaddon/responsive/payment/wechat" %>
19-
<%@ taglib prefix="multi-checkout-isv" tagdir="/WEB-INF/tags/addons/isvpaymentaddon/responsive/checkout/multi"%>
20-
<%@ taglib prefix="shared" tagdir="/WEB-INF/tags/addons/isvpaymentaddon/responsive/shared" %>
21-
<%@ taglib prefix="isv3ds" tagdir="/WEB-INF/tags/addons/isvpaymentaddon/responsive/payment/3ds" %>
2215

2316
<template:page pageTitle="${pageTitle}" hideHeaderLinks="true">
2417

25-
<c:if test="${visaCheckoutEnabled}">
26-
<visacheckout:vcInit
27-
apiKey="${visaCheckoutAPIKey}"
28-
currency="${cartData.totalPriceWithTax.currencyIso}"
29-
total="${cartData.totalPriceWithTax.value}"/>
30-
</c:if>
31-
32-
<div class="row">
33-
<div class="col-sm-6">
34-
<div class="checkout-headline">
35-
<span class="glyphicon glyphicon-lock"></span>
36-
<spring:theme code="checkout.multi.secure.checkout" />
37-
</div>
38-
<multi-checkout:checkoutSteps checkoutSteps="${checkoutSteps}" progressBarId="${progressBarId}">
39-
<ycommerce:testId code="checkoutStepFour">
40-
41-
<jsp:include page="payment/checkoutPaymentModes.jsp"/>
42-
43-
<c:if test="${klarnaEnabled}">
44-
<klarna:klarnaInit klarnaSDKURL="${klarnaSDKUrl}"/>
45-
</c:if>
4618

47-
<isv:pciStrategyType type="FLEX">
48-
<jsp:include page="payment/flexCardPaymentDetails.jsp"/>
49-
</isv:pciStrategyType>
50-
51-
<isv:pciStrategyType type="HOP">
52-
<c:url var="hopFormAction" value="/checkout/payment/sa/hop"/>
53-
<form:form id="hopRequestForm" name="hopRequestForm" action="${hopFormAction}"/>
54-
</isv:pciStrategyType>
55-
56-
<isv:pciStrategyType type="SOP">
57-
<jsp:include page="payment/checkoutCardPaymentDetails.jsp"/>
58-
<c:url var="sopFormAction" value="/checkout/payment/sa/sop"/>
59-
<div id="sopIframeCbox">
60-
<iframe id="sopRequestIframe" src="${sopFormAction}"></iframe>
61-
</div>
62-
</isv:pciStrategyType>
63-
64-
<jsp:include page="payment/vcCardPaymentDetails.jsp"/>
19+
<div class="row">
20+
<div class="col-sm-6">
21+
<div class="checkout-headline">
22+
<span class="glyphicon glyphicon-lock"></span>
23+
<spring:theme code="checkout.multi.secure.checkout"></spring:theme>
24+
</div>
25+
26+
<multi-checkout:checkoutSteps checkoutSteps="${checkoutSteps}" progressBarId="${progressBarId}">
27+
<ycommerce:testId code="checkoutStepFour">
28+
29+
<c:if test="${cartData.paymentType.code == 'CARD'}">
30+
<c:choose>
31+
<c:when test="${paymentPciType == 'HOP'}">
32+
<c:url var="hopFormAction" value="/checkout/payment/sa/hop"/>
33+
<form:form id="hopRequestForm" name="hopRequestForm" action="${hopFormAction}"/>
34+
</c:when>
35+
<c:otherwise>
36+
<jsp:include page="/WEB-INF/views/addons/isvpaymentaddon/responsive/pages/checkout/multi/payment/checkoutCardPaymentDetails.jsp"/>
37+
<c:url var="sopFormAction" value="/checkout/payment/sa/sop"/>
38+
<div id="sopIframeCbox">
39+
<iframe id="sopRequestIframe" src="${sopFormAction}"></iframe>
40+
</div>
41+
</c:otherwise>
42+
</c:choose>
43+
</c:if>
6544

66-
<div class="checkout-review hidden-xs">
67-
<div class="checkout-order-summary">
68-
<multi-checkout:orderTotals cartData="${cartData}" showTaxEstimate="${showTaxEstimate}" showTax="${showTax}" subtotalsCssClasses="dark"/>
45+
<div class="checkout-review hidden-xs">
46+
<div class="checkout-order-summary">
47+
<multi-checkout:orderTotals cartData="${cartData}" showTaxEstimate="${showTaxEstimate}" showTax="${showTax}" subtotalsCssClasses="dark"/>
48+
</div>
6949
</div>
70-
</div>
71-
72-
<div class="display-none">
73-
<div class="checkout-weChatPaymentDetails m-2">
74-
<div class="row m-2">
75-
<div class="col-xs-12 w-100 border-0">
76-
<iframe id="weChatPaymentQRIframe" src="" style="height: 304px;"></iframe>
77-
</div>
78-
</div>
79-
<div class="row m-2">
80-
<label class="weChatModalInstructions">
81-
<spring:theme code="checkout.summary.paymentMethod.weChat.modal.instructions"/>
82-
</label>
83-
</div>
84-
<div class="row m-2">
85-
<button type="submit" class="btn btn-primary btn-block btn-wechat-complete-payment">
86-
<spring:theme code="checkout.summary.paymentMethod.weChat.modal.submit" />
87-
</button>
88-
</div>
89-
<div class="row mb-2">
90-
<div class="confirm-wechat-payment-spinner" hidden="hidden">
91-
<img src="${contextPath}/_ui/responsive/common/images/spinner.gif"/>
92-
</div>
93-
</div>
94-
<div class="display-none">
95-
<label id="weChatModalTitle">
96-
<spring:theme code="checkout.summary.paymentMethod.weChat.modal.title"/>
50+
<div class="place-order-form hidden-xs">
51+
<form:form action="${placeOrderUrl}" id="placeOrderForm1" modelAttribute="placeOrderForm">
52+
<div class="checkbox">
53+
<label> <form:checkbox id="Terms1" path="termsCheck" />
54+
<spring:theme code="checkout.summary.placeOrder.readTermsAndConditions" arguments="${getTermsAndConditionsUrl}"/>
9755
</label>
9856
</div>
99-
</div>
100-
</div>
101-
102-
<div class="place-order-form hidden-xs">
103-
<form:form action="${placeOrderUrl}" id="placeOrderForm1" modelAttribute="placeOrderForm">
104-
<div class="checkbox">
105-
<label> <form:checkbox id="Terms1" path="termsCheck" />
106-
<spring:theme code="checkout.summary.placeOrder.readTermsAndConditions" arguments="${getTermsAndConditionsUrl}" text="Terms and Conditions"/>
107-
</label>
108-
</div>
10957

110-
<div class="alert alert-danger tc-unchecked-alert" hidden="hidden">
111-
<spring:theme code="checkout.terms.and.conditions.unchecked.error"/>
112-
</div>
113-
114-
<div class="place-order-3ds-notification">
115-
<spring:theme code="checkout.summary.placeOrder.3ds.popup.notification"/>
116-
</div>
117-
118-
<div class="placeOrderBtnDiv">
119-
<div class="spinner-wrapper">
120-
<div class="spinner"></div>
121-
</div>
122-
<button id="placeOrder" type="button" class="btn btn-primary cs_btn-place-order btn-block">
123-
<spring:theme code="checkout.summary.placeOrder" text="Place Order"/>
58+
<button id="placeOrder" type="submit" class="btn btn-primary btn-block btn-place-order btn-block btn-lg checkoutSummaryButton" disabled="disabled">
59+
<spring:theme code="checkout.summary.placeOrder"/>
12460
</button>
125-
</div>
126-
127-
<div class="applePayBtnDiv" hidden="hidden">
128-
<a class="applePayBtn" role="link"></a>
129-
</div>
13061

131-
<div class="googlePayBtnDiv" hidden="hidden"></div>
132-
</form:form>
62+
<c:if test="${cartData.quoteData eq null}">
63+
<button id="scheduleReplenishment" type="button" class="btn btn-default btn-block scheduleReplenishmentButton checkoutSummaryButton" disabled="disabled">
64+
<spring:theme code="checkout.summary.scheduleReplenishment"/>
65+
</button>
13366

134-
<c:if test="${visaCheckoutEnabled}">
135-
<visacheckout:vcButton imageUrl="${visaCheckoutImageUrl}" locale="${locale}"/>
136-
</c:if>
137-
</div>
67+
<b2b-multi-checkout:replenishmentScheduleForm/>
68+
</c:if>
69+
</form:form>
70+
</div>
13871

139-
</ycommerce:testId>
140-
</multi-checkout:checkoutSteps>
141-
</div>
72+
<script type="application/javascript">
73+
var isvB2BPaymentMethod = '${cartData.paymentType.code}';
74+
</script>
14275

143-
<div class="col-sm-6">
144-
<multi-checkout-isv:checkoutOrderSummary cartData="${cartData}" showDeliveryAddress="true" showPaymentInfo="true" showTaxEstimate="true" showTax="true" />
145-
</div>
76+
</ycommerce:testId>
77+
</multi-checkout:checkoutSteps>
78+
</div>
14679

147-
<c:if test="${visaCheckoutEnabled}">
148-
<visacheckout:vcLoadSDK sdkUrl="${visaCheckoutSDKUrl}"/>
149-
</c:if>
80+
<div class="col-sm-6">
81+
<b2b-multi-checkout:checkoutOrderSummary cartData="${cartData}" showDeliveryAddress="true" showPaymentInfo="true" showTaxEstimate="true" showTax="true" />
82+
</div>
15083

151-
<div class="col-sm-12 col-lg-12">
152-
<br class="hidden-lg">
153-
<cms:pageSlot position="SideContent" var="feature" element="div" class="checkout-help">
154-
<cms:component component="${feature}"/>
155-
</cms:pageSlot>
84+
<div class="col-sm-12 col-lg-12">
85+
<br class="hidden-lg">
86+
<cms:pageSlot position="SideContent" var="feature" element="div" class="checkout-help">
87+
<cms:component component="${feature}"/>
88+
</cms:pageSlot>
89+
</div>
15690
</div>
157-
</div>
15891

159-
<fraud:deviceFingerPrint deviceFingerPrint="${deviceFingerPrint}"/>
92+
<fraud:deviceFingerPrint deviceFingerPrint="${deviceFingerPrint}"/>
16093

16194
</template:page>
162-
163-
<%--Tags below will render with 'ACC.config' JS namespace available--%>
164-
165-
<shared:jsInit/>
166-
167-
<isv3ds:cardinalCommerce/>

‎hybris/bin/b2b/isvpaymentaddon/acceleratoraddon/web/webroot/WEB-INF/views/responsive/pages/checkout/multi/checkoutSummaryPage.jsp

+2-2
Original file line numberDiff line numberDiff line change
@@ -57,7 +57,7 @@
5757
<jsp:include page="payment/checkoutCardPaymentDetails.jsp"/>
5858
<c:url var="sopFormAction" value="/checkout/payment/sa/sop"/>
5959
<div id="sopIframeCbox">
60-
<iframe id="sopRequestIframe" src="${sopFormAction}" sandbox ></iframe>
60+
<iframe id="sopRequestIframe" src="${sopFormAction}"></iframe>
6161
</div>
6262
</isv:pciStrategyType>
6363

@@ -73,7 +73,7 @@
7373
<div class="checkout-weChatPaymentDetails m-2">
7474
<div class="row m-2">
7575
<div class="col-xs-12 w-100 border-0">
76-
<iframe id="weChatPaymentQRIframe" src="" style="height: 304px;" sandbox ></iframe>
76+
<iframe id="weChatPaymentQRIframe" src="" style="height: 304px;"></iframe>
7777
</div>
7878
</div>
7979
<div class="row m-2">

‎hybris/bin/b2c/isvb2cpaymentaddon/acceleratoraddon/web/src/isv/sap/payment/addon/b2c/controllers/pages/checkout/payment/flex/FlexMicroformController.java

+5-7
Original file line numberDiff line numberDiff line change
@@ -78,15 +78,13 @@ public AjaxResponse newJwk(final HttpSession session, final UriComponentsBuilder
7878
final Map<String, String> captureContext = flexService.createKey(targetOrigin);
7979

8080
session.setAttribute(FLEX_CAPTURE_CONTEXT_ATTRIBUTE, captureContext.get("captureContext"));
81-
82-
// session.setAttribute("clientLiberary", captureContext.get("clientLiberary"));
83-
// session.setAttribute("clientLibraryIntegrity",captureContext.get("clientLibraryIntegrity"));
81+
82+
//RCH: To be extra safe, we can sanitize inputs to AjaxResponse.
8483
return AjaxResponse.success()
85-
.put("captureContext", captureContext.get("captureContext"))
86-
.put("clientLibrary", captureContext.get("clientLibrary"))
87-
.put("clientLibraryIntegrity", captureContext.get("clientLibraryIntegrity"));
84+
.put("captureContext", StringEscapeUtils.escapeHtml4(captureContext.get("captureContext")))
85+
.put("clientLibrary", StringEscapeUtils.escapeHtml4(captureContext.get("clientLibrary")))
86+
.put("clientLibraryIntegrity", StringEscapeUtils.escapeHtml4(captureContext.get("clientLibraryIntegrity")));
8887

89-
// return captureContext.get("captureContext");
9088
}
9189

9290
@PostMapping(value = "/verifyToken", consumes = MediaType.APPLICATION_JSON_VALUE)

‎hybris/bin/b2c/isvpayment/lib/isv-payment-api-3.0.4.jar

1.11 KB
Binary file not shown.

0 commit comments

Comments
 (0)