Protect saved card deletion with a CSRF token, fix PHP 8.4 nullable deprecations

Config/module.xml

@@ -17,7 +17,7 @@
         <language>en_US</language>
         <language>fr_FR</language>
     </languages>
-    <version>3.2.0</version>
+    <version>3.2.1</version>
     <authors>
         <author>
             <name>Vincent Lopes-Vicente</name>

Config/routing.xml

@@ -18,7 +18,7 @@
         <default key="_controller">PayPlugModule\Controller\NotificationController::entryPoint</default>
     </route>
 
-    <route id="payplugmodule_delete_card" path="/payplug/card/delete">
+    <route id="payplugmodule_delete_card" path="/payplug/card/delete" methods="POST">
         <default key="_controller">PayPlugModule\Controller\CardController::deleteCurrentCustomerCard</default>
     </route>
 

Controller/CardController.php

@@ -3,13 +3,22 @@
 namespace PayPlugModule\Controller;
 
 use PayPlugModule\Model\PayPlugCardQuery;
+use Symfony\Component\HttpKernel\Exception\AccessDeniedHttpException;
+use Symfony\Component\Security\Csrf\CsrfToken;
+use Symfony\Component\Security\Csrf\CsrfTokenManagerInterface;
 use Thelia\Controller\Front\BaseFrontController;
 use Thelia\Core\HttpFoundation\Request;
 
 class CardController extends BaseFrontController
 {
-    public function deleteCurrentCustomerCard(Request $request)
+    public const DELETE_TOKEN_ID = 'payplug_card_delete';
+
+    public function deleteCurrentCustomerCard(Request $request, CsrfTokenManagerInterface $csrfTokenManager)
     {
+        if (!$csrfTokenManager->isTokenValid(new CsrfToken(self::DELETE_TOKEN_ID, (string) $request->request->get('_token')))) {
+            throw new AccessDeniedHttpException('Invalid CSRF token.');
+        }
+
         if (!$request->hasSession()) {
             return $this->generateRedirect('/');
         }

Event/PayPlugPaymentEvent.php

@@ -789,7 +789,7 @@ public function getPaymentId()
      * @param string $paymentId
      * @return PayPlugPaymentEvent
      */
-    public function setPaymentId(string $paymentId = null): PayPlugPaymentEvent
+    public function setPaymentId(?string $paymentId = null): PayPlugPaymentEvent
     {
         $this->paymentId = $paymentId;
         return $this;
@@ -953,7 +953,7 @@ public function getPaymentMethod()
      * @param string $paymentMethod
      * @return PayPlugPaymentEvent
      */
-    public function setPaymentMethod(string $paymentMethod = null): PayPlugPaymentEvent
+    public function setPaymentMethod(?string $paymentMethod = null): PayPlugPaymentEvent
     {
         $this->paymentMethod = $paymentMethod;
         return $this;
@@ -1583,7 +1583,7 @@ public function getHostedPaymentReturnUrl()
      * @param string $hostedPaymentReturnUrl
      * @return PayPlugPaymentEvent
      */
-    public function setHostedPaymentReturnUrl(string $hostedPaymentReturnUrl = null): PayPlugPaymentEvent
+    public function setHostedPaymentReturnUrl(?string $hostedPaymentReturnUrl = null): PayPlugPaymentEvent
     {
         $this->hostedPaymentReturnUrl = $hostedPaymentReturnUrl;
         return $this;
@@ -1601,7 +1601,7 @@ public function getHostedPaymentCancelUrl()
      * @param string $hostedPaymentCancelUrl
      * @return PayPlugPaymentEvent
      */
-    public function setHostedPaymentCancelUrl(string $hostedPaymentCancelUrl = null): PayPlugPaymentEvent
+    public function setHostedPaymentCancelUrl(?string $hostedPaymentCancelUrl = null): PayPlugPaymentEvent
     {
         $this->hostedPaymentCancelUrl = $hostedPaymentCancelUrl;
         return $this;

Event/PayPlugProduct.php

@@ -38,7 +38,7 @@ class PayPlugProduct
     /** @var integer */
     protected $totalAmount;
 
-    public function buildFromOrderProduct(OrderProduct $orderProduct, PayPlugModuleDeliveryType $payPlugModuleDeliveryType = null)
+    public function buildFromOrderProduct(OrderProduct $orderProduct, ?PayPlugModuleDeliveryType $payPlugModuleDeliveryType = null)
     {
         $storeName = ConfigQuery::read(
             'store_name',

PayPlugModule.php

@@ -33,15 +33,15 @@ class PayPlugModule extends AbstractPaymentModule
     const DOMAIN_NAME = 'payplugmodule';
 
 
-    public function postActivation(ConnectionInterface $con = null): void
+    public function postActivation(?ConnectionInterface $con = null): void
     {
         if (!$this->getConfigValue('is_initialized', false)) {
             $database = new Database($con);
             $database->insertSql(null, [__DIR__ . "/Config/TheliaMain.sql"]);
         }
     }
 
-    public function update($currentVersion, $newVersion, ConnectionInterface $con = null): void
+    public function update($currentVersion, $newVersion, ?ConnectionInterface $con = null): void
     {
         $finder = Finder::create()
             ->name('*.sql')

Service/PaymentService.php

@@ -130,7 +130,7 @@ public function doOrderCapture(Order $order)
         $this->dispatcher->dispatch($paymentEvent, PayPlugPaymentEvent::ORDER_CAPTURE_EVENT);
     }
 
-    public function doOrderRefund(Order $order, int $amountRefund = null)
+    public function doOrderRefund(Order $order, ?int $amountRefund = null)
     {
         $paymentEvent = (new PayPlugPaymentEvent())
             ->buildFromOrder($order);

templates/frontOffice/default/PayPlugModule/payment-extra.html.twig

@@ -7,7 +7,10 @@
         <p class="mt-4"><strong>{{ savedCard.title }}</strong></p>
         <p class="paragraph-4 mt-1">
             {{ savedCard.notice }}
-            <a class="underline" href="{{ savedCard.deleteUrl }}">{{ savedCard.deleteLabel }}</a>
+            <button type="submit" class="underline" form="payplug-delete-card">{{ savedCard.deleteLabel }}</button>
         </p>
+        <form id="payplug-delete-card" method="post" action="{{ savedCard.deleteUrl }}">
+            <input type="hidden" name="_token" value="{{ csrf_token('payplug_card_delete') }}">
+        </form>
     {% endif %}
 </div>