prestashopcorp / easymarketing Goto Github PK

Code execution via serialize

Unserialize() ca lean to code execution on user controlled input.
Replace all serialize/unserialize call with json_encode/json_decode in the following files :
/controllers/front/categories.php
/easymarketing.php

SQLi:

/easymarketing.php
:1854 escape $id_categories with implode(',', array_map('intval', $id_categories))
:1943 escape $id_categories with implode(',', array_map('intval', $id_categories))

File Access:

/easymarketing.php:514
check $path belong to PS_ROOT using realpath() function (to avoid directory traversal attack) and also check $path extension ends with .html (or something not executable).

On the settings page, the video needs a plugin to be played.

This is the only module where it does not work natively.
You can find an example of youtube object which works without plugin: https://github.com/PrestaShop/gadwords/blob/master/views/templates/admin/gadwords.tpl#L33

Your module seems to be compatible only with PrestaShop 1.6.

When you do this kind in the function hookFooter, I guess you are wrong:

if (strpos($_SERVER['REQUEST_URI'], __PS_BASE_URI__.'order.php'))

From PrestaShop 1.5, the URL are not in this format anymore, you will get instead /index.php?controller=order. You may need Tools::getValue('controller') == 'order') here
And they are different when the mode URL rewrite is enabled ! So are you sure to find the properly value $_SERVER['REQUEST_URI'] ?

The following functions have been found in your module and seem to be just copy pasted from the core:

• getPackageShippingCost
• getOrderTotal
• getProducts
• getBestSales
• getProductInfo

Because I do not see why they were duplicated, they should be removed from the module.

• /controllers/front/categories.php
  • l.75 to 79: Your conditions can be merged in the same if because they execute the same statement. You could get a test like this:

if (is_array($selected_cat_ids) && (count($selected_cat_ids) > 0 && in_array($child['id_category'], $selected_cat_ids) || count($selected_cat_ids) == 0))
    $response['children'][] = $child['id_category'];

• /easymarketing.php
  • l.41: ps_version_compliancy should be changed for the interval [1.6 ; PS_VERSION]
  • l.256: return Configuration::updateValue(.....
  • l.436 to 462:
    • HTML code should be moved in a tpl file
    • You should not use iFrames
    • You should not use inline style
  • The function recurseCategoryForInclude should not generate HTML code, but only the data used by the tpl file which will be displayed after.
• General
  You use mostly the same code to log a debug message. You should merge all of them in one function which will be called later. It will be easier for to update it when needed.