[IMPORTANT] Paypal Bug in OJS 2.2.x

[michael]

The PKP team has identified a bug in PayPal payment management whereby an unauthorized user can view a listing of past payments and the details of specific payments. This bug only affects OJS 2.2.x.

It is recommended that all users of OJS 2.2.x apply the patch provided here:
http://pkp.sfu.ca/bugzilla/show_bug.cgi?id=5132

If you have access to command-line tools, the patch can be applied by following the directions here:
viewtopic.php?f=8&t=3779

If you don't have access to command-line tools, you can copy-and-paste the following two lines (marked with a '+') into pages/manager/ManagerPaymentHandler.inc.php (do not include the '+'; it's simply a marker to denote the addition of the line):

Code: Select all

     function viewPayments($args) {
+      parent::validate();
       $rangeInfo = &Handler::getRangeInfo('CompletedPayments');
       $paymentDao = &DAORegistry::getDAO('OJSCompletedPaymentDAO');
       $journal =& Request::getJournal();


Code: Select all

     function viewPayment($args) {
+      parent::validate();
       $paymentDao = &DAORegistry::getDAO('OJSCompletedPaymentDAO');
       $completedPaymentId = $args[0];
       $payment = &$paymentDao->getCompletedPayment($completedPaymentId);