Version 4.5.0

applications/nexus/modules/admin/customers/purchases.php

@@ -12,7 +12,7 @@
 namespace IPS\nexus\modules\admin\customers;
 
 /* To prevent PHP errors (extending class does not exist) revealing path */
-if ( !defined( '\IPS\SUITE_UNIQUE_KEY' ) )
+if ( !\defined( '\IPS\SUITE_UNIQUE_KEY' ) )
 {
 	header( ( isset( $_SERVER['SERVER_PROTOCOL'] ) ? $_SERVER['SERVER_PROTOCOL'] : 'HTTP/1.0' ) . ' 403 Forbidden' );
 	exit;
@@ -23,6 +23,11 @@ if ( !defined( '\IPS\SUITE_UNIQUE_KEY' ) )
  */
 class _purchases extends \IPS\Dispatcher\Controller
 {
+	/**
+	 * @brief	Has been CSRF-protected
+	 */
+	public static $csrfProtected = TRUE;
+	
 	/**
 	 * View
 	 *
@@ -152,9 +157,22 @@ class _purchases extends \IPS\Dispatcher\Controller
 				{
 					$groupedChildren[] = $child;
 					$childGroupedRenewals = $child->grouped_renewals;
+
+					/* Figure out tax */
+					$tax = NULL;
+
 					try
 					{
-						$childGroupedRenewalTerm = new \IPS\nexus\Purchase\RenewalTerm( new \IPS\nexus\Money( $childGroupedRenewals['price'], $this->purchase->renewals->cost->currency ), new \DateInterval( 'P' . $childGroupedRenewals['term'] . mb_strtoupper( $childGroupedRenewals['unit'] ) ) );
+						if( $this->purchase->tax )
+						{
+							$tax = \IPS\nexus\Tax::load( $this->purchase->tax );
+						}
+					}
+					catch( \OutOfRangeException $e ){}
+
+					try
+					{
+						$childGroupedRenewalTerm = new \IPS\nexus\Purchase\RenewalTerm( new \IPS\nexus\Money( $childGroupedRenewals['price'], $this->purchase->renewals->cost->currency ), new \DateInterval( 'P' . $childGroupedRenewals['term'] . mb_strtoupper( $childGroupedRenewals['unit'] ) ), $tax );
 						$renewals = new \IPS\nexus\Purchase\RenewalTerm( $renewals->subtract( $childGroupedRenewalTerm ), $renewals->interval );
 					}
 					catch ( \Exception $e ) { }
@@ -278,6 +296,7 @@ class _purchases extends \IPS\Dispatcher\Controller
 			$invoice = new \IPS\nexus\Invoice;
 			$invoice->currency = $this->purchase->renewal_currency;
 			$invoice->member = $this->purchase->member;
+			$invoice->billaddress = $this->purchase->member->primaryBillingAddress();
 			$invoice->addItem( \IPS\nexus\Invoice\Item\Renewal::create( $this->purchase, $values['renew_cycles'] ) );
 			$invoice->save();
 			$invoice->sendNotification();
@@ -393,6 +412,7 @@ class _purchases extends \IPS\Dispatcher\Controller
 	protected function reactivate()
 	{
 		\IPS\Dispatcher::i()->checkAcpPermission( 'purchases_cancel' );
+		\IPS\Session::i()->csrfCheck();
 		
 		$parent = $this->purchase->parent();
 		
@@ -486,6 +506,8 @@ class _purchases extends \IPS\Dispatcher\Controller
 	protected function group()
 	{
 		\IPS\Dispatcher::i()->checkAcpPermission( 'purchases_edit' );
+		\IPS\Session::i()->csrfCheck();
+		
 		if ( $this->purchase->billing_agreement and !$this->purchase->billing_agreement->canceled )
 		{
 			\IPS\Output::i()->error( 'not_with_billing_agreement', '2X195/E', 403, '' );
@@ -511,6 +533,8 @@ class _purchases extends \IPS\Dispatcher\Controller
 	protected function ungroup()
 	{
 		\IPS\Dispatcher::i()->checkAcpPermission( 'purchases_edit' );
+		\IPS\Session::i()->csrfCheck();
+		
 		if ( $this->purchase->billing_agreement and !$this->purchase->billing_agreement->canceled )
 		{
 			\IPS\Output::i()->error( 'not_with_billing_agreement', '2X195/F', 403, '' );