Merge pull request #773 from afoucret/fix-tracker-injection

Fix tracker injection
Smile-SA · Feb 20, 2018 · c37461e · c37461e
2 parents bf22500 + 77d1e6a
commit c37461e
Show file tree

Hide file tree

Showing 3 changed files with 23 additions and 3 deletions.
diff --git a/src/module-elasticsuite-tracker/Controller/Tracker/Hit.php b/src/module-elasticsuite-tracker/Controller/Tracker/Hit.php
@@ -56,6 +56,26 @@ public function execute()
         $this->getResponse()->setHeader('Content-Type', 'image/png');
         $this->getResponse()->sendResponse();
 
-        $this->logEventQueue->addEvent($this->getRequest()->getParams());
+        $this->logEventQueue->addEvent($this->decodeParams($this->getRequest()->getParams()));
+    }
+
+    /**
+     * Decode URI params.
+     *
+     * @param mixed $params Params.
+     *
+     * @return mixed
+     */
+    private function decodeParams($params)
+    {
+        if (is_string($params)) {
+            $params = urldecode($params);
+        } elseif (is_array($params)) {
+            foreach ($params as &$currentParam) {
+                $currentParam = $this->decodeParams($currentParam);
+            }
+        }
+
+        return $params;
     }
 }
diff --git a/src/module-elasticsuite-tracker/etc/elasticsuite_indices.xml b/src/module-elasticsuite-tracker/etc/elasticsuite_indices.xml
@@ -94,7 +94,7 @@
                 <field name="page.order.items.label" type="string" nestedPath="page.order.items" />
                 <field name="page.order.items.price" type="double" nestedPath="page.order.items" />
                 <field name="page.order.items.row_total" type="double" nestedPath="page.order.items" />
-                <field name="page.order.items.qty" type="integer" nestedPath="page.order.items" />
+                <field name="page.order.items.qty" type="double" nestedPath="page.order.items" />
 
                 <!-- Page data (referrer) -->
                 <field name="page.referrer.domain" type="string" />

diff --git a/src/module-elasticsuite-tracker/view/frontend/web/js/tracking.js b/src/module-elasticsuite-tracker/view/frontend/web/js/tracking.js
@@ -160,7 +160,7 @@ var smileTracker = (function () {
 
     // Append a variable to the page
     function addVariable(varName, value) {
-        this.vars[varName] = encodeURI(value);
+        this.vars[varName] = encodeURIComponent(value);
         return this;
     }