M3 Security Fixes for pass 28
This commit is contained in:
Mark Gregory
@@ -4,280 +4,116 @@ namespace Modules\M3\Http\Controllers\API;
|
||||
|
||||
use Config;
|
||||
use DB;
|
||||
use Illuminate\Http\Client\Response as HttpResponse;
|
||||
use Illuminate\Http\Request;
|
||||
use Illuminate\Http\Response;
|
||||
use Log;
|
||||
use Illuminate\Support\Facades\Http;
|
||||
use Modules\M3\Helpers\Helper;
|
||||
use Modules\M3\Http\Controllers\Controller;
|
||||
use Str;
|
||||
|
||||
class TwoShipAPIs extends Controller
|
||||
{
|
||||
// TwoShipUpdateHold with URL Params
|
||||
private const SOURCE = 'TwoShipUpdateHold';
|
||||
private const RESPONSE_TYPE = 'AggStopRsp';
|
||||
|
||||
public function TwoShipUpdateHold(Request $request)
|
||||
{
|
||||
ini_set('max_execution_time', Config::get('arrays.PHPTimeOut'));
|
||||
ini_set('max_input_time', Config::get('arrays.PHPTimeOut'));
|
||||
ini_set('default_socket_timeout', Config::get('arrays.PHPTimeOut'));
|
||||
$this->configureTimeouts();
|
||||
$user = m3_user() !== '' ? Str::upper(m3_user()) : 'WebUser';
|
||||
$params = $request->all();
|
||||
$whs = (string) ($params['WHS'] ?? '');
|
||||
$co = (string) ($params['COMPANY'] ?? '');
|
||||
$macpkr = (string) ($params['MACPKR'] ?? '');
|
||||
|
||||
// dd($request->all());
|
||||
|
||||
// Log::info( $request->all() );
|
||||
// Get The Calling User
|
||||
$SHUSER = m3_user() !== '' ? Str::upper(m3_user()) : 'WebUser';
|
||||
|
||||
$SHSOURCE = 'TwoShipUpdateHold';
|
||||
$TwoShipErrors = '';
|
||||
|
||||
$urlParams = count($request->all()) > 0 ? $request->all() : '';
|
||||
$WHS = isset($urlParams['WHS']) ? $urlParams['WHS'] : '';
|
||||
$CO = isset($urlParams['COMPANY']) ? $urlParams['COMPANY'] : '';
|
||||
$MACPKR = isset($urlParams['MACPKR']) ? $urlParams['MACPKR'] : '';
|
||||
if ($params === []) {
|
||||
$this->log($macpkr ?: '000000', $co, $whs, $user, 'X', 'No URL Parameters Sent');
|
||||
return response()->json(['code' => '405', 'status' => 'Error', 'message' => 'No URL Parameters Sent']);
|
||||
}
|
||||
|
||||
try {
|
||||
if ($urlParams != '') {
|
||||
$IncomingParams = ['CO' => $CO, 'WHS' => $WHS, 'MACPKR' => $MACPKR];
|
||||
$IncomingParams = json_encode($IncomingParams);
|
||||
|
||||
// Write to Logs : Params In
|
||||
$data = ['SHMACPKR' => $MACPKR,
|
||||
'SHDT' => date('Y-m-d'),
|
||||
'SHTIME' => date('H:i:s'),
|
||||
'SHERROR' => '',
|
||||
'SHINTBOX' => '',
|
||||
'SHTYPE' => 'AggStopReq',
|
||||
'SHDATA' => $IncomingParams,
|
||||
'SHUSER' => $SHUSER,
|
||||
'SHSOURCE' => $SHSOURCE,
|
||||
'SHCO' => $CO,
|
||||
'SHWHS' => $WHS,
|
||||
];
|
||||
Helper::logToICM699M($data);
|
||||
|
||||
// First Step : Get MACPKRs list if available
|
||||
// select a4macpkr from icm688m1 where a4shpaggcd in (select a4shpaggcd from icm688m1 where a4macpkr=233709) and a4shpaggcd<>0 and a4concmplt<>'y' and a4co=410 and a4whs=111
|
||||
$A4MACPKRSel = DB::connection(config('m3.connection', 'pgsql'))->select(
|
||||
"select a4macpkr from icm688m1 where a4shpaggcd in (select a4shpaggcd from icm688m1 where a4macpkr={$MACPKR})
|
||||
and a4shpaggcd<>0 and a4concmplt<>'y' and a4co='{$CO}' and a4whs='{$WHS}' ",
|
||||
);
|
||||
// dd($A4MACPKRSel);
|
||||
|
||||
if (count($A4MACPKRSel) > 0) {
|
||||
foreach ($A4MACPKRSel as $key => $A4MACPKRR) {
|
||||
$A4MACPKRArr[] = $A4MACPKRR->A4MACPKR;
|
||||
}
|
||||
} else {
|
||||
$A4MACPKRArr[] = $MACPKR;
|
||||
}
|
||||
|
||||
// dump($A4MACPKRArr);
|
||||
|
||||
// Call 2ship API with Params
|
||||
$WS_key = Config::get('arrays.2Ship.TwoShip_Key');
|
||||
$end_point = Config::get('arrays.2Ship.end_point');
|
||||
$API = Config::get('arrays.2Ship.hold_update');
|
||||
|
||||
$ShipOnHoldOrder_url = $end_point . $API;
|
||||
|
||||
// Build Json Data
|
||||
$data = [
|
||||
'WS_Key' => $WS_key,
|
||||
'OrderNumbers' => [implode(',', $A4MACPKRArr)],
|
||||
// 'ShipmentId' => 3,
|
||||
'FindBy' => 'ByMultipleOrderNumbers',
|
||||
'DataToBeUpdated' => [
|
||||
'UpdateAggregationSettings' => true,
|
||||
'OrderAggregationSettingsInfo' => [
|
||||
'NotConsideredAggregation' => true,
|
||||
],
|
||||
],
|
||||
];
|
||||
|
||||
$json_string = json_encode($data);
|
||||
|
||||
// dump($json_string);
|
||||
|
||||
// ######
|
||||
// Initialise the cURL var
|
||||
$ch = curl_init();
|
||||
|
||||
// Get the response from cURL
|
||||
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
|
||||
curl_setopt($ch, CURLOPT_CUSTOMREQUEST, 'POST');
|
||||
|
||||
curl_setopt($ch, CURLOPT_URL, $ShipOnHoldOrder_url);
|
||||
curl_setopt($ch, CURLOPT_VERBOSE, false);
|
||||
|
||||
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, true);
|
||||
// When CURLOPT_SSL_VERIFYPEER is enabled (value=1), and the verification fails to prove that the certificate is authentic, the connection fails.
|
||||
// When the option is zero, the peer certificate verification succeeds regardless.
|
||||
|
||||
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 2);
|
||||
// When CURLOPT_SSL_VERIFYHOST is 2, that certificate must indicate that the server is the server to which you meant to connect,
|
||||
// or the connection fails. Simply put, it means it has to have the same name in the certificate as is in the URL you operate against.
|
||||
|
||||
// Set data content type
|
||||
curl_setopt(
|
||||
$ch,
|
||||
CURLOPT_HTTPHEADER,
|
||||
[
|
||||
'Content-Type: application/json',
|
||||
'Content-Length: ' . strlen($json_string),
|
||||
],
|
||||
);
|
||||
|
||||
// Post data
|
||||
curl_setopt($ch, CURLOPT_POSTFIELDS, $json_string);
|
||||
|
||||
// Set timeout
|
||||
curl_setopt($ch, CURLOPT_TIMEOUT, Config::get('arrays.PHPTimeOut'));
|
||||
curl_setopt($ch, CURLOPT_CONNECTTIMEOUT, Config::get('arrays.PHPTimeOut'));
|
||||
|
||||
// if set true, cURL will follow redirects
|
||||
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
|
||||
|
||||
// Execute the request
|
||||
$response = curl_exec($ch);
|
||||
|
||||
// Verifying error
|
||||
$info = curl_getinfo($ch);
|
||||
|
||||
// Get status
|
||||
$status = curl_getinfo($ch, CURLINFO_HTTP_CODE);
|
||||
|
||||
// Output the error code
|
||||
// $CurlError= curl_error($ch);
|
||||
$CurlError = str_replace("'", ' ', curl_error($ch));
|
||||
|
||||
// Close the session
|
||||
unset($ch);
|
||||
|
||||
// dump($response);
|
||||
// dump($status);
|
||||
// dump($CurlError);
|
||||
|
||||
if ($status == '200' && $CurlError == '') {
|
||||
$responseJSON = json_decode($response);
|
||||
// dump($responseJSON);
|
||||
if ($responseJSON->Success == false) {
|
||||
$TwoShipErrors = '2Ship Error: ' . $responseJSON->GlobalError;
|
||||
}
|
||||
} else {
|
||||
$TwoShipErrors = 'Error: No Response from 2Ship';
|
||||
$TwoShipErrors .= ' -Curl Error: ' . $CurlError;
|
||||
}
|
||||
|
||||
// Validate response From 2Ship
|
||||
// Error
|
||||
if ($TwoShipErrors != '') {
|
||||
// dump($TwoShipErrors);
|
||||
|
||||
// Write to Logs : Error
|
||||
$data = ['SHMACPKR' => $MACPKR,
|
||||
'SHDT' => date('Y-m-d'),
|
||||
'SHTIME' => date('H:i:s'),
|
||||
'SHERROR' => 'X',
|
||||
'SHINTBOX' => '',
|
||||
'SHTYPE' => 'AggStopRsp',
|
||||
'SHDATA' => $status . '-' . $TwoShipErrors,
|
||||
'SHUSER' => $SHUSER,
|
||||
'SHSOURCE' => $SHSOURCE,
|
||||
'SHCO' => $CO,
|
||||
'SHWHS' => $WHS,
|
||||
];
|
||||
Helper::logToICM699M($data);
|
||||
|
||||
// Send Response
|
||||
return response()->json([
|
||||
'code' => '405',
|
||||
'status' => 'error',
|
||||
'message' => 'Status: ' . $status . '-' . $TwoShipErrors,
|
||||
]);
|
||||
}
|
||||
// Success
|
||||
else {
|
||||
// Write to Logs : JSON
|
||||
$data = ['SHMACPKR' => $MACPKR,
|
||||
'SHDT' => date('Y-m-d'),
|
||||
'SHTIME' => date('H:i:s'),
|
||||
'SHERROR' => '',
|
||||
'SHINTBOX' => '',
|
||||
'SHTYPE' => 'AggStopRsp',
|
||||
'SHDATA' => $response,
|
||||
'SHUSER' => $SHUSER,
|
||||
'SHSOURCE' => $SHSOURCE,
|
||||
'SHCO' => $CO,
|
||||
'SHWHS' => $WHS,
|
||||
];
|
||||
Helper::logToICM699M($data);
|
||||
|
||||
// Update ICM688M1 set a4concmplt to 'y'
|
||||
DB::connection(config('m3.connection', 'pgsql'))->table('icm688m1')
|
||||
->whereIn('A4MACPKR', $A4MACPKRArr)
|
||||
->where('A4CO', $CO)
|
||||
->where('A4WHS', $WHS)
|
||||
->update(['A4CONCMPLT' => 'Y']);
|
||||
|
||||
}
|
||||
|
||||
// Send Response
|
||||
return response()->json([
|
||||
'code' => '200',
|
||||
'status' => 'Success',
|
||||
]);
|
||||
$this->logRequest($macpkr, $co, $whs, $user);
|
||||
$orders = $this->aggregationOrders($macpkr, $co, $whs);
|
||||
$response = $this->callTwoShip($orders);
|
||||
$error = $this->responseError($response);
|
||||
if ($error !== '') {
|
||||
$this->log($macpkr, $co, $whs, $user, 'X', $response->status() . '-' . $error);
|
||||
return response()->json(['code' => '405', 'status' => 'error', 'message' => 'Status: ' . $response->status() . '-' . $error]);
|
||||
}
|
||||
// Error : No URL params
|
||||
else {
|
||||
// Write to Logs Out : Error
|
||||
$MACPKR = isset($MACPKR) ? $MACPKR : '000000';
|
||||
$data = ['SHMACPKR' => $MACPKR,
|
||||
'SHDT' => date('Y-m-d'),
|
||||
'SHTIME' => date('H:i:s'),
|
||||
'SHERROR' => 'X',
|
||||
'SHINTBOX' => '',
|
||||
'SHTYPE' => 'AggStopRsp',
|
||||
'SHDATA' => 'No URL Parameters Sent',
|
||||
'SHUSER' => $SHUSER,
|
||||
'SHSOURCE' => $SHSOURCE,
|
||||
'SHCO' => $CO,
|
||||
'SHWHS' => $WHS,
|
||||
];
|
||||
Helper::logToICM699M($data);
|
||||
|
||||
// Return Error
|
||||
return response()->json([
|
||||
'code' => '405',
|
||||
'status' => 'Error',
|
||||
'message' => 'No URL Parameters Sent',
|
||||
]);
|
||||
}
|
||||
$this->log($macpkr, $co, $whs, $user, '', $response->body());
|
||||
$this->markAggregationComplete($orders, $co, $whs);
|
||||
return response()->json(['code' => '200', 'status' => 'Success']);
|
||||
} catch (\Throwable $th) {
|
||||
// Write to Logs Out : Error
|
||||
$getCurlErrors = str_contains($th->getMessage(), 'cURL error');
|
||||
if ($getCurlErrors) {
|
||||
// dd($getCurlErrors);
|
||||
// Write to Logs Out : Failed
|
||||
$data = ['SHMACPKR' => $MACPKR,
|
||||
'SHDT' => date('Y-m-d'),
|
||||
'SHTIME' => date('H:i:s'),
|
||||
'SHERROR' => 'X',
|
||||
'SHINTBOX' => '',
|
||||
'SHTYPE' => 'AggStopRsp',
|
||||
'SHDATA' => 'Curl Error: Communication with 2Ship Timed Out' . ' 2Ship-JSN-out' . $IncomingParams,
|
||||
'SHUSER' => $SHUSER,
|
||||
'SHSOURCE' => $SHSOURCE,
|
||||
'SHCO' => $CO,
|
||||
'SHWHS' => $WHS,
|
||||
];
|
||||
Helper::logToICM699M($data);
|
||||
|
||||
return response()->json([
|
||||
'code' => '405',
|
||||
'status' => 'error',
|
||||
'message' => 'Curl Error: Communication with 2Ship Timed Out.',
|
||||
]);
|
||||
}
|
||||
$message = str_contains($th->getMessage(), 'cURL error')
|
||||
? 'Curl Error: Communication with 2Ship Timed Out.'
|
||||
: '2Ship communication failed.';
|
||||
$this->log($macpkr, $co, $whs, $user, 'X', $message);
|
||||
return response()->json(['code' => '405', 'status' => 'error', 'message' => $message]);
|
||||
}
|
||||
}
|
||||
// End TwoShipUpdateHold
|
||||
|
||||
private function configureTimeouts(): void
|
||||
{
|
||||
$timeout = Config::get('arrays.PHPTimeOut');
|
||||
ini_set('max_execution_time', $timeout);
|
||||
ini_set('max_input_time', $timeout);
|
||||
ini_set('default_socket_timeout', $timeout);
|
||||
}
|
||||
|
||||
private function logRequest(string $macpkr, string $co, string $whs, string $user): void
|
||||
{
|
||||
$data = json_encode(['CO' => $co, 'WHS' => $whs, 'MACPKR' => $macpkr]);
|
||||
Helper::logToICM699M($this->logData($macpkr, $co, $whs, $user, '', (string) $data, 'AggStopReq'));
|
||||
}
|
||||
|
||||
private function aggregationOrders(string $macpkr, string $co, string $whs): array
|
||||
{
|
||||
$aggregation = DB::connection(config('m3.connection', 'pgsql'))->table('icm688m1')
|
||||
->where('A4MACPKR', $macpkr)->value('A4SHPAGGCD');
|
||||
if (empty($aggregation) || (string) $aggregation === '0') {
|
||||
return [$macpkr];
|
||||
}
|
||||
$orders = DB::connection(config('m3.connection', 'pgsql'))->table('icm688m1')
|
||||
->where('A4SHPAGGCD', $aggregation)->where('A4SHPAGGCD', '<>', 0)->where('A4CONCMPLT', '<>', 'y')
|
||||
->where('A4CO', $co)->where('A4WHS', $whs)->pluck('A4MACPKR')->all();
|
||||
return $orders !== [] ? $orders : [$macpkr];
|
||||
}
|
||||
|
||||
private function callTwoShip(array $orders): HttpResponse
|
||||
{
|
||||
$payload = [
|
||||
'WS_Key' => Config::get('arrays.2Ship.TwoShip_Key'),
|
||||
'OrderNumbers' => [implode(',', $orders)],
|
||||
'FindBy' => 'ByMultipleOrderNumbers',
|
||||
'DataToBeUpdated' => ['UpdateAggregationSettings' => true, 'OrderAggregationSettingsInfo' => ['NotConsideredAggregation' => true]],
|
||||
];
|
||||
return Http::acceptJson()->asJson()->timeout((int) Config::get('arrays.PHPTimeOut'))
|
||||
->post(Config::get('arrays.2Ship.end_point') . Config::get('arrays.2Ship.hold_update'), $payload);
|
||||
}
|
||||
|
||||
private function responseError(HttpResponse $response): string
|
||||
{
|
||||
if (! $response->successful()) {
|
||||
return 'Error: No Response from 2Ship';
|
||||
}
|
||||
$body = $response->json();
|
||||
return ($body['Success'] ?? true) === false ? '2Ship Error: ' . ($body['GlobalError'] ?? 'Unknown error') : '';
|
||||
}
|
||||
|
||||
private function markAggregationComplete(array $orders, string $co, string $whs): void
|
||||
{
|
||||
DB::connection(config('m3.connection', 'pgsql'))->table('icm688m1')
|
||||
->whereIn('A4MACPKR', $orders)->where('A4CO', $co)->where('A4WHS', $whs)->update(['A4CONCMPLT' => 'Y']);
|
||||
}
|
||||
|
||||
private function log(string $macpkr, string $co, string $whs, string $user, string $error, string $message): void
|
||||
{
|
||||
Helper::logToICM699M($this->logData($macpkr, $co, $whs, $user, $error, $message, self::RESPONSE_TYPE));
|
||||
}
|
||||
|
||||
private function logData(string $macpkr, string $co, string $whs, string $user, string $error, string $message, string $type): array
|
||||
{
|
||||
return ['SHMACPKR' => $macpkr, 'SHDT' => date('Y-m-d'), 'SHTIME' => date('H:i:s'), 'SHERROR' => $error,
|
||||
'SHINTBOX' => '', 'SHTYPE' => $type, 'SHDATA' => $message, 'SHUSER' => $user, 'SHSOURCE' => self::SOURCE, 'SHCO' => $co, 'SHWHS' => $whs];
|
||||
}
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user