CVS log for interchange/lib/Vend/Payment/Protx2.pm

Up to [Local Repository] / interchange / lib / Vend / Payment

Request diff between arbitrary revisions

Keyword substitution: kv
Default branch: MAIN

Code cleanup after audit of Protx2 payment module.

The logdir option was insecure, as it could be specified by
an end-user, and could cause a new file to be touched.

This is now only allowed if the developer wants it by setting this in catalog.cfg:

    Route protx logdir_from_user_allowed 1

It was also insecure in that it allowed absolute paths, disregarding NoAbsolute.
That is now checked.

Reworked external touch call with Perl open call to remove shell exploit possibility.
This was probably the most dangerous part of accepting end-user logdir form input.

Fix variable name typo that broke Diners Club detection.

Made code work under strict pragma.

Fixed errors and cleaned up POD documentation.

Reformatted code with standard indenting, brace positioning, etc.

Only tested against the Protx test environment; still needs live account testing
by someone with an account.

Add Protx2 payment module, compatible with Protx API 2.22, by Lyn St George (RT #9).

Downloaded from:

http://www.interchange.rtfm.info/mirror/payments/Protx2.pm

First, committing verbatim.