CVE-2022-0689 (published 2022-02-19T16:15Z)

Use multiple time the one-time coupon in Packagist microweber/microweber prior to 1.2.11.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:N/I:P/A:N)
CVSS v3 base score: 5.3, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)

Weakness information:
cwe_id: NVD-CWE-Other
cwe_name: Other
description: NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/microweber/microweber
commit_details: repo_url: https://github.com/microweber/microweber
author: Peter Ivanov
author_date: 2022-02-19 17:43:46+02:00
msg: update
repository: repo_url: https://github.com/microweber/microweber
repo_name: microweber/microweber
description: Drag and Drop Website Builder and CMS with E-commerce
repo_language: HTML
owner: microweber
file_changes: filename: CartManager.php
change_type: ModificationType.MODIFY
diff: @@ -30,8 +30,7 @@ class CartManager extends Crud
             $this->app = mw();
         }
 
-        $coupon_code = $this->app->user_manager->session_get('coupon_code');
-        $this->coupon_data = coupon_get_by_code($coupon_code);
+
     }
 
     /**
@@ -41,7 +40,7 @@ class CartManager extends Crud
      */
     public function sum($return_amount = true)
     {
-        if($return_amount ){
+        if ($return_amount) {
             return $this->app->cart_repository->getCartAmount();
         } else {
             return $this->app->cart_repository->getCartItemsCount();
@@ -182,26 +181,45 @@ class CartManager extends Crud
 
     public function get_discount_type()
     {
-        if (empty($this->coupon_data)) {
+        $data = $this->couponCodeGetDataFromSession();
+        if (empty($data)) {
             return false;
         }
+        if (isset($data['discount_type'])) {
+            return $data['discount_type'];
+        }
+        return false;
+    }
 
-        return  $this->coupon_data['discount_type'];
+    public function set_coupon_data($data)
+    {
+        $this->coupon_data = $data;
     }
 
     public function get_discount_value()
     {
-        if (empty($this->coupon_data)) {
+        $data = $this->couponCodeGetDataFromSession();
+
+
+        if (empty($data)) {
+            return false;
+        }
+
+        if (!isset($data['discount_value'])) {
+            return false;
+        }
+
+        if (!isset($data['total_amount'])) {
             return false;
         }
 
         $apply_code = false;
-        if ($this->sum() >= $this->coupon_data['total_amount']) {
+        if ($this->sum() >= $data['total_amount']) {
             $apply_code = true;
         }
 
         if ($apply_code) {
-            return floatval($this->coupon_data['discount_value']);
+            return floatval($data['discount_value']);
         }
 
         return false;
@@ -353,9 +371,9 @@ class CartManager extends Crud
         $cart = array();
         $cart['id'] = intval($data['id']);
 
-       // if ($this->app->user_manager->is_admin() == false) {
+        // if ($this->app->user_manager->is_admin() == false) {
         $cart['session_id'] = mw()->user_manager->session_id();
-       // }
+        // }
 
         $cart['order_completed'] = 0;
         $cart['one'] = 1;
@@ -574,9 +592,9 @@ class CartManager extends Crud
         $skip_keys = array();
 
         $content_custom_fields = $this->app->fields_manager->get([
-            'rel_type'=>$for,
-            'rel_id'=>$for_id,
-            'return_full'=>true,
+            'rel_type' => $for,
+            'rel_id' => $for_id,
+            'return_full' => true,
         ]);
 
         $product_prices = array();
@@ -738,7 +756,7 @@ class CartManager extends Crud
                         $cart['qty'] = $update_qty_new;
                     } else {
                         $cart['qty'] = $check_cart['qty'] + 1;
-                     }
+                    }
                 }
             } else {
                 if ($update_qty > 0) {
@@ -911,16 +929,54 @@ class CartManager extends Crud
         $item = content_data($content_id);
         $isInStock = true;
         if ($item) {
-                if (isset($item['qty']) and $item['qty'] != 'nolimit' ) {
-                    $quantity =intval( $item['qty']);
-                    if ($quantity < 1) {
-                        $isInStock = false;
-                    }
+            if (isset($item['qty']) and $item['qty'] != 'nolimit') {
+                $quantity = intval($item['qty']);
+                if ($quantity < 1) {
+                    $isInStock = false;
                 }
+            }
 
         }
 
         return $isInStock;
     }
 
+    public function couponCodeGetDataFromSession()
+    {
+        $coupon_code = $this->app->user_manager->session_get('coupon_code');
+        if ($coupon_code and !$this->couponCodeCheckIfValid($coupon_code)) {
+            //check if coupon is valid
+            if (function_exists('coupons_delete_session')) {
+                coupons_delete_session();
+            }
+
+            $this->coupon_data = false;
+        } else {
+            if (function_exists('coupon_get_by_code')) {
+                $this->coupon_data = coupon_get_by_code($coupon_code);
+            } else {
+                $this->coupon_data = false;
+            }
+        }
+        return $this->coupon_data;
+    }
+
+    public function couponCodeCheckIfValid($coupon_code)
+    {
+        if (function_exists('coupon_apply')) {
+            //check if coupon is valid
+            $coupon_valid = coupon_apply([
+                'coupon_code' => $coupon_code,
+                'coupon_check_if_valid' => true
+            ]);
+            if (!$coupon_valid) {
+                return false;
+            }
+            return true;
+        }
+        return false;
+
+    }
+
+
 }

programming_language: PHP
filename: CheckoutManager.php
change_type: ModificationType.MODIFY
diff: @@ -434,6 +434,32 @@ class CheckoutManager
                 }
             }
 
+
+            // Discount details save
+            if ($coupon_code) {
+                $place_order['promo_code'] = $coupon_code;
+                $place_order['coupon_id'] = $coupon_id;
+                $place_order['discount_type'] = $discount_type;
+                $place_order['discount_value'] = $discount_value;
+
+
+                if (!$this->app->cart_manager->couponCodeCheckIfValid($coupon_code)) {
+                    //check if coupon is valid
+                    if(function_exists('coupons_delete_session')){
+                        coupons_delete_session();
+                    }
+
+                    $place_order['promo_code'] = '';
+                    $place_order['coupon_id'] ='';
+                    $place_order['discount_type'] = '';
+                    $place_order['discount_value'] ='';
+                }
+            }
+
+
+
+
+
             $amount = $this->app->shop_manager->cart_total();
             $tax = $this->app->cart_manager->get_tax();
 
@@ -498,11 +524,6 @@ class CheckoutManager
             }
 
 
-            // Discount details save
-            $place_order['promo_code'] = $coupon_code;
-            $place_order['coupon_id'] = $coupon_id;
-            $place_order['discount_type'] = $discount_type;
-            $place_order['discount_value'] = $discount_value;
 
 
             // convert currency to payment provider currency
@@ -1426,4 +1447,6 @@ class CheckoutManager
             (isset($e['query']) ? '?' . (is_array($e['query']) ? http_build_query($e['query'], '', '&') : $e['query']) : '') .
             (isset($e['fragment']) ? "#$e[fragment]" : '');
     }
+
+
 }

programming_language: PHP
filename: functions.php
change_type: ModificationType.MODIFY
diff: @@ -27,14 +27,20 @@ function coupon_apply($params = array())
 
     $customer_ip = user_ip();
 
-    $checkout = new MicroweberPackages\Checkout\CheckoutManager();
-    $getCart = $checkout->app->shop_manager->get_cart(array(
-        'session_id' => $checkout->app->user_manager->session_id()
-
-    ));
+//    $checkout = new MicroweberPackages\Checkout\CheckoutManager();
+//    $getCart = $checkout->app->shop_manager->get_cart(array(
+//        'session_id' => $checkout->app->user_manager->session_id()
+//
+//    ));
 
+    $getCart = false;
     $coupon['total_amount'] = floatval($coupon['total_amount']);
-    $cartTotal = floatval(cart_total());
+    $cartTotal = floatval( \DB::table('cart')->where('session_id', app()->user_manager->session_id())->sum('price'));
+    $getCartItems =   \DB::table('cart')->where('session_id', app()->user_manager->session_id())->get();
+
+    if($getCartItems){
+        $getCart = $getCartItems->toArray();
+    }
 
     // Check rules
      if ($coupon and isset($coupon['uses_per_customer']) and $coupon['uses_per_customer'] > 0) {
@@ -65,6 +71,11 @@ function coupon_apply($params = array())
         $ok = true;
     }
 
+    if(isset( $params['coupon_check_if_valid'])){
+       return $ok;
+    }
+
+
     if ($ok) {
 
         mw()->user_manager->session_set('coupon_code', $coupon['coupon_code']);
@@ -294,6 +305,7 @@ function coupons_delete_session()
     mw()->user_manager->session_del('coupon_id');
     mw()->user_manager->session_del('discount_value');
     mw()->user_manager->session_del('discount_type');
+    mw()->user_manager->session_del('applied_coupon_data');
 }
 
 

programming_language: PHP