CSRF 対策のバグの対策

• 2.13.4
  • 脆弱性
  • [TRANSACTION_ID が NULL === NULL で正常となる] (https://github.com/EC-CUBE/eccube-2_13/issues/67)

    public function isValidToken($is_unset = false)
    {
        // token の妥当性チェック
-        $ret = $_REQUEST[TRANSACTION_ID_NAME] === $_SESSION[TRANSACTION_ID_NAME];
+        $ret = $_REQUEST[TRANSACTION_ID_NAME] === $_SESSION[TRANSACTION_ID_NAME] 
+               && isset($_REQUEST[TRANSACTION_ID_NAME]);

        if ($is_unset || $ret === false) {
            SC_Helper_Session_Ex::destroyToken();
        }

        return $ret;
    }