myron/tomtomgames
1
0
Fork 0
mirror of https://github.com/myronblair/tomtomgames synced 2026-07-27 17:02:27 -05:00
Code Issues Packages Projects Releases Wiki Activity

Fix stored XSS in admin gamer overview (unescaped username/alias/email) and undefined-variable logging bug in purchase.php

Browse Source
This commit is contained in:
Myron Blair
2026-07-06 07:52:39 +00:00
parent 674ec71682
commit abe49a77fa
2 changed files with 5 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
api/purchase.php
+2 -2
View File
@@ -66,7 +66,7 @@ if ($isManual) {
$playerName, $cardholderName, $billingEmail, $isCustom ? 1 : 0
]);
$pid = db()->lastInsertId();
logActivity('manual_payment_pending', $userId, null, 'purchase', 0, "Manual payment pending: {$paymentMethod} \${$amountDollars}");
logActivity('manual_payment_pending', $userId, null, 'purchase', 0, "Manual payment pending: {$method} \$" . number_format($priceCents / 100, 2));
echo json_encode(['success'=>true,'manual'=>true,'purchase_id'=>$pid,
'message'=>"Request #{$pid} submitted! Tokens credited after payment verification."]);
exit;
@@ -150,7 +150,7 @@ $bal = db()->prepare("SELECT tokens FROM users WHERE id=?");
$bal->execute([$userId]);
$newBal = (float)$bal->fetchColumn();
logActivity('token_purchase', $userId, null, 'purchase', (int)db()->lastInsertId(),
"Bought {$tokens} tokens via {$paymentMethod} for \${$amountDollars}");
"Bought {$tokens} tokens via {$method} for \$" . number_format($priceCents / 100, 2));
echo json_encode([
'success' => true,
'manual' => false,