SecureSubmit/magento-extension — pull request #20 by colinmollenhour (2014-01-28 00:49:28+00:00)
Title: Various improvements and fixes

Ran into some issues when testing in production environment and these are all of the changes I made in the process of tracking down various issues.

The PEAR Soap client caused fatal errors in some cases and I didn't spend much time trying to debug and just switched to using the compiled extension which always works well, is well maintained and I think already a requirement for Magento.

Using the include path to load the various files is a security risk since another module (e.g. one downloaded from Magento connect) could inject files with the same path/name earlier in the include path (e.g. app/code/local) and thereby inject malicious code into the execution and steal secret keys, etc.. Using dirname(__FILE__) ensures that at least the file from the expected path is loaded.