// Merge -> revision 8720

git-svn-id: http://dev.prestashop.com/svn/v1/branches/1.5.x@8722 b9a71923-0436-4b27-9f14-aed3839534dd

modules/mondialrelay/ajax.php

@@ -33,10 +33,6 @@
  */
  
 require_once(realpath(dirname(__FILE__).'/../../config/config.inc.php'));
-
-if (Tools::getValue('mrtoken') != sha1('mr'._COOKIE_KEY_.'mrAgain'))
-	die();
-
 require_once(realpath(dirname(__FILE__).'/../../init.php'));
 require(dirname(__FILE__).'/mondialrelay.php');
 require(dirname(__FILE__).'/classes/MRCreateTickets.php');
@@ -44,10 +40,30 @@ require(dirname(__FILE__).'/classes/MRGetTickets.php');
 require(dirname(__FILE__).'/classes/MRGetRelayPoint.php');
 require(dirname(__FILE__).'/classes/MRManagement.php');
 
+MondialRelay::initModuleAccess();
+
+// Access page List liable to the generated token
+$accessPageList = array(
+	MondialRelay::getToken('front') => array(
+		'MRGetRelayPoint',
+		'addSelectedCarrierToDB'),
+	MondialRelay::getToken('back') => array(
+		'MRGetTickets',
+		'MRCreateTickets',
+		'MRDeleteHistory',
+		'uninstallDetail',
+		'DeleteHistory'));
+
 $method = Tools::getValue('method');
+$token = Tools::getValue('mrtoken');
 $params = array();
 $result = array();
 
+// If the method name assoacited to the token received doesn't match with
+// the list, then we kill the request
+if (!isset($accessPageList[$token]) || !in_array($method, $accessPageList[$token]))
+	exit();
+
 // Method name allow to instanciate his object to properly call the 
 // implemented interface method and do his job
 switch($method)
@@ -112,4 +128,4 @@ catch(Exception $e)
 }
 echo MondialRelay::jsonEncode($result);
 exit(0);
-?>
+?>

modules/mondialrelay/fr.php

@@ -48,6 +48,7 @@ $_MODULE['<{mondialrelay}prestashop>mondialrelay_cb5e100e5a9a3e7f6d1fd9751221528
 $_MODULE['<{mondialrelay}prestashop>mondialrelay_350c1cc4343826a89f08a33bb49c6d98'] = 'Configuration du Module Mondial Relay';
 $_MODULE['<{mondialrelay}prestashop>mondialrelay_d21a9f93917604d5490ad529a7cf1ff9'] = 'Pour créer un transporteur Mondial Relay';
 $_MODULE['<{mondialrelay}prestashop>mondialrelay_c6a2e6af5fff47adb3afd780b97d9b4b'] = 'Remplissez et sauvegarder vos paramètres Mondial Relay';
+$_MODULE['<{mondialrelay}prestashop>mondialrelay_94fbe32464fcfa902feed9f256439833'] = 'Créer un transporteur utilisant le formulaire \"ajouter un transporteur\" ci-dessous';
 $_MODULE['<{mondialrelay}prestashop>mondialrelay_b962d8fb95f5a439f50502152f3bad71'] = 'Definissez un prix pour votre transporteur sur';
 $_MODULE['<{mondialrelay}prestashop>mondialrelay_faf1247ae6846a9955a466d4f301bbe4'] = 'La page Transporteurs';
 $_MODULE['<{mondialrelay}prestashop>mondialrelay_10d78806b84b97ebc774e9f6277af6ac'] = 'Pour générer vos étiquettes, vous devez avoir enregistré une adresse valide de votre boutique sur votre';

modules/mondialrelay/mondialrelay.js

@@ -59,7 +59,6 @@ function getTickets(detailedExpeditionList)
 		},
 		error: function(xhr, ajaxOptions, thrownError)
 		{
-            //console.log(thrownError);
             displayBackGenerateSubmitButton();
 		}
 	});
@@ -311,7 +310,6 @@ function PS_MRGetUninstallDetail()
 		},
 		error: function(xhr, ajaxOptions, thrownError) 
 		{
-			//console.log(thrownError);
 			// Put debug to see error detail
 		}
 	});
@@ -363,7 +361,6 @@ function PS_MRBackupDatabase()
 		},
 		error: function(xhr, ajaxOptions, thrownError) 
 		{
-			//console.log(thrownError);
 			// Put debug to see error detail
 		}
 	});
@@ -387,13 +384,9 @@ function PS_MRAddSelectedRelayPointInDB(relayPointNumber, id_carrier)
     	'mrtoken' : mrtoken},
     success: function(json)
     {
-    // 	console.log(json);
     },
     error: function(xhr, ajaxOptions, thrownError)
     {
-     	//console.log(xhr);
-     	//console.log(thrownError);
-     	//console.log(ajaxOptions);
     }
 	});
 }
@@ -415,13 +408,9 @@ function PS_MRAddSelectedCarrierInDB(id_carrier)
     	'mrtoken' : mrtoken},
     success: function(json)
     {
-     	//console.log(json);
     },
     error: function(xhr, ajaxOptions, thrownError)
     {
-     	//console.log(xhr);
-     	//console.log(thrownError);
-     	//console.log(ajaxOptions);
     }
 	});
 }
@@ -521,7 +510,6 @@ function PS_MRDisplayErrorRelayPoint(errorList, blockContent)
 	
 	blockContent.fadeOut('fast', function()
 	{
-		console.log($(this));
 		$(this).children('td').html('');
 		for (numError in errorList)
 		{
@@ -564,7 +552,6 @@ function PS_MRFetchRelayPoint(carrierSelected)
 		},
 		error: function(xhr, ajaxOptions, thrownError) 
 		{
-			//console.log(thrownError);
 			// Put debug to see error detail
 		}
 	});
@@ -607,6 +594,10 @@ function PS_MRGetRelayPoint(carrierSelected)
 */
 function PS_MRCreateGmap(id_carrier)
 {
+	// This has been write this way because it needed to have a known block
+	// present everytime in the page. Body is the only one sure.
+	// It's an hidden block it's replaced in the good block when user select his
+	// own carrier
 	$('body').prepend('\
 		<tr id="PS_MRGmapDefaultPosition_' + id_carrier + '" class="PS_MRGmapDefaultPosition">\
 			<td colspan="4"> \

modules/mondialrelay/mondialrelay.php

@@ -39,7 +39,8 @@ class MondialRelay extends Module
 	
 	public static $modulePath = '';
 	public static $moduleURL = '';
-	static public $MRToken = '';
+	static public $MRFrontToken = '';
+	static public $MRBackToken = '';
 
 	// Added for 1.3 compatibility
 	const ONLY_PRODUCTS = 1;
@@ -171,6 +172,15 @@ class MondialRelay extends Module
 		return true;
 	}
 	
+	/*
+	** Return the token depend of the type 
+	*/
+	static public function getToken($type = 'front')
+	{
+		return ($type == 'front') ? self::$MRFrontToken : (($type == 'back') ? 
+			self::$MRBackToken : NULL);
+	}
+
 	/*
 	** Register hook depending of the Prestashop version used
 	*/
@@ -366,7 +376,8 @@ class MondialRelay extends Module
 	public static function initModuleAccess()
 	{
 		self::$modulePath =	_PS_MODULE_DIR_. 'mondialrelay/';
-		self::$MRToken = sha1('mr'._COOKIE_KEY_.'mrAgain');
+		self::$MRFrontToken = sha1('mr'._COOKIE_KEY_.'Front');
+		self::$MRBackToken = sha1('mr'._COOKIE_KEY_.'Back');
 	
 		$protocol = (Configuration::get('PS_SSL_ENABLED') || (!empty($_SERVER['HTTPS']) 
 			&& strtolower($_SERVER['HTTPS']) != 'off')) ? 'https://' : 'http://';
@@ -409,7 +420,7 @@ class MondialRelay extends Module
 			<link type="text/css" rel="stylesheet" href="'.$cssFilePath.'" />
 			<script type="text/javascript">
 				var _PS_MR_MODULE_DIR_ = "'.self::$moduleURL.'";
-				var mrtoken = "'.self::$MRToken.'";
+				var mrtoken = "'.self::$MRBackToken.'";
 			</script>
 			<script type="text/javascript" src="'.$jsFilePath.'"></script>';
 	}
@@ -613,7 +624,7 @@ class MondialRelay extends Module
 			$this->context->smarty->assign( array(
 							'one_page_checkout' => (Configuration::get('PS_ORDER_PROCESS_TYPE') ? Configuration::get('PS_ORDER_PROCESS_TYPE') : 0),
 							'new_base_dir' => self::$moduleURL,
-			'MRToken' => self::$MRToken,
+			'MRToken' => self::$MRFrontToken,
 			'carriersextra' => $carriersList));
 			
 			return $this->display(__FILE__, 'mondialrelay.tpl');