setVars(array( 'authorizenet_receipt_email' => SNF_AUTHORIZENET_RECEIPT_EMAIL, 'authorizenet_receipt_email_from' => SNF_AUTHORIZENET_RECEIPT_EMAIL_FROM, 'authorizenet_error_email' => SNF_AUTHORIZENET_ERROR_EMAIL, 'authorizenet_merchant_login_id' => SNF_AUTHORIZENET_MERCHANT_LOGIN_ID, 'authorizenet_transaction_key' => SNF_AUTHORIZENET_TRANSACTION_KEY, 'ip' => $_SERVER['REMOTE_ADDR'])); if (!$cc_system->systemUp()) { AddContent('Cannot connect to our credit card processor.', 'PAGE_TITLE'); snf_event_log(SNF_EVENT_TYPE_CCTRANSFAILURE, 'cannot connect to processor', false, $_SESSION['order']['uid']); RaiseError('

We could not connect to our credit card processing system.

For help, please contact us at 877-610-3282 (Monday-Friday 8:30am to 5:00pm EST) or at support@snfdata.com.

'); DisplayErrors(); ep_page_halt(); } DisplayErrors(); require_once('snf_change_log.php'); switch ($_REQUEST['order_type']) { case 'new': AddContent('Annual Subscription', 'PAGE_TITLE'); break; case 'renew': AddContent('Annual Subscription Renewal', 'PAGE_TITLE'); break; case 'checkout': AddContent('Report Purchase Checkout', 'PAGE_TITLE'); break; case 'register': AddContent('New Account Registration', 'PAGE_TITLE'); break; default: AddContent('New Account', 'PAGE_TITLE'); } $showform = true; $tpl = new HTML_Template_IT(); $tpl->loadTemplatefile(EP_TEMPLATE_DIR . 'sslpages/order_form.tpl'); if ($_REQUEST['uid'] && $_REQUEST['submitted'] != 'Submit') { // allow AHD admin users to operate as another user if ($_SESSION['account_type_id'] == SNF_ACCOUNT_TYPE_ADMIN && $_REQUEST['uid']) { $_SESSION['order']['uid'] = $_REQUEST['uid']; $_SESSION['order']['admin_user_hijack'] = true; } else { // validate that this email matches the userid $checked_email = false; if (ValidateInput($_REQUEST['uid'], 'format', '0-9') && ValidateInput($_REQUEST['uid_email'], 'email')) { $uid_email = GetDbField(DbQuery('SELECT u.email FROM ' . EP_DB_COM_NAME . '.tbl_user u WHERE u.id = ' . intval($_REQUEST['uid'])), 'email'); $checked_email = true; } if ($checked_email == false || $uid_email != $_REQUEST['uid_email']) { RaiseError('An error occurred during renewal.'); RaiseError(SNF_SUPPORT_CONTACT); LogError('SECURITY WARNING: attempted to renew with uid [' . $_REQUEST['uid'] . '] and email [' . $_REQUEST['uid_email'] . ']'); ep_page_halt(); } else $_SESSION['order']['uid'] = $_REQUEST['uid']; } } elseif ($_SESSION['logged_in'] && $_SESSION['account_type_id'] != SNF_ACCOUNT_TYPE_ADMIN) { if (!$_REQUEST['order_type']) $_REQUEST['order_type'] = 'checkout'; $_SESSION['order']['uid'] = $_SESSION['EPORT_USER_ID']; } if ($_SESSION['order']['uid']) { $ud_row = GetDbRow(DbQuery(' SELECT u.username, u.email, uc.account_type, uc.contact, uc.acctname, uc.address, uc.city, uc.state, uc.state_other, uc.zip, uc.country, uc.phone FROM ' . EP_DB_COM_NAME . '.tbl_user u LEFT JOIN ' . EP_DB_COM_NAME . '.tbl_user_snf uc ON u.id = uc.userid WHERE u.id = ' . intval($_SESSION['order']['uid']))); $_REQUEST['username'] = (isset($_REQUEST['username'])) ? $_REQUEST['username'] : $ud_row['username']; $_REQUEST['name'] = (isset($_REQUEST['name'])) ? $_REQUEST['name'] : $ud_row['contact']; $_REQUEST['companyname'] = (isset($_REQUEST['companyname'])) ? $_REQUEST['companyname'] : $ud_row['acctname']; $_REQUEST['account_type'] = (isset($_REQUEST['account_type'])) ? $_REQUEST['account_type'] : $ud_row['account_type']; $_REQUEST['address'] = (isset($_REQUEST['address'])) ? $_REQUEST['address'] : $ud_row['address']; $_REQUEST['city'] = (isset($_REQUEST['city'])) ? $_REQUEST['city'] : $ud_row['city']; $_REQUEST['state'] = (isset($_REQUEST['state'])) ? $_REQUEST['state'] : $ud_row['state']; $_REQUEST['state_other'] = (isset($_REQUEST['state_other'])) ? $_REQUEST['state_other'] : $ud_row['state_other']; $_REQUEST['zip'] = (isset($_REQUEST['zip'])) ? $_REQUEST['zip'] : $ud_row['zip']; $_REQUEST['country'] = (isset($_REQUEST['country'])) ? $_REQUEST['country'] : $ud_row['country']; $_REQUEST['phone'] = (isset($_REQUEST['phone'])) ? $_REQUEST['phone'] : $ud_row['phone']; $_REQUEST['email'] = (isset($_REQUEST['email'])) ? $_REQUEST['email'] : $ud_row['email']; if (strtolower($_REQUEST['country']) == 'usa') $_REQUEST['country'] = 'US'; } if (!isset($_REQUEST['order_type'])) $_REQUEST['order_type'] = 'new'; if ($_REQUEST['order_type'] == 'checkout') { $tpl->setCurrentBlock('CHECKOUT_INSTRUCTIONS'); $tpl->setVariable('LOGIN', GetUserLogin()); // $tpl->parseCurrentBlock(); $tpl->setCurrentBlock('ORDER_FORM'); if (is_array($_SESSION['cart'])) { $_SESSION['cart'] = array_filter($_SESSION['cart']); $tpl->setVariable(array('NUMREPORTS' => count($_SESSION['cart']), 'AMOUNT' => number_format(SNF_REPORT_PRICE * count($_SESSION['cart']),2))); } } elseif ($_REQUEST['order_form'] != 'register') $tpl->touchBlock('INSTRUCTIONS'); if ($_REQUEST['submitted']) { if (in_array($_REQUEST['order_type'], array('register', 'new', 'checkout'))) { if (!ValidateInput($_REQUEST['username'])) RaiseError('Username is required'); elseif (GetDbNumRows(DbQuery('SELECT id FROM ' . EP_DB_COM_NAME . '.tbl_user WHERE username = \'' . DbEscapeQuotes($_REQUEST['username']) . '\'')) && !$_SESSION['logged_in']) RaiseError('Username ' . $_REQUEST['username'] . ' is already in use'); elseif (!(strpos($_REQUEST['username'], ' ') === false)) RaiseError('Your username cannot contain spaces'); if (!$_SESSION['logged_in']) { if (!ValidateInput($_REQUEST['new-password'])) RaiseError('Password is required'); elseif ($_REQUEST['new-password'] != $_REQUEST['new-password2']) RaiseError('Password and confirmation must match'); } if (!ValidateInput($_REQUEST['name'])) RaiseError('Your name is required'); if (!ValidateInput($_REQUEST['companyname'])) RaiseError('Company Name is required'); if (!ValidateInput($_REQUEST['address'])) RaiseError('Address is required'); if (!ValidateInput($_REQUEST['city'])) RaiseError('City is required'); elseif (!ValidateInput($_REQUEST['city'], 'regex', '/^[A-Za-z\. ]+$/')) RaiseError('City is not correctly formatted'); $us_or_canada = ($_REQUEST['country'] == 'US' || $_REQUEST['country'] == 'CA'); if (($us_or_canada && !ValidateInput($_REQUEST['state'])) || (!$us_or_canada && !ValidateInput($_REQUEST['state_other']))) RaiseError('State / Province is required'); elseif ($us_or_canada && !ValidateInput($_REQUEST['state'], 'regex', '/^[A-Z]{2}$/')) RaiseError('State is not correctly formatted'); // this is so dumb, but pci comliance is bitching about it // receive_email can only be undefined or equal "on" if (!($_REQUEST['receive_email'] == 'on' || !isset($_REQUEST['receive_email']))) RaiseError('Receive email is not correctly formatted'); $_REQUEST['zip'] = trim($_REQUEST['zip']); if (!ValidateInput($_REQUEST['zip'])) RaiseError('ZIP is required'); else { if ($_REQUEST['country'] == 'US') { // US zipcodes should be five numbers $zip_filtered = preg_replace('/[^0-9]/', '', $_REQUEST['zip'], -1, $match_count); if ($match_count) RaiseError('ZIP must be numbers only'); elseif (!ValidateInput($zip_filtered, 'length', '=', 5)) RaiseError('ZIP must be 5 digits'); } elseif ($_REQUEST['country'] == 'CA') { // CA zipcodes are six alphanumeric characters (sometimes with spaces) $zip_filtered = preg_replace('/[^0-9a-zA-Z ]/', '', $_REQUEST['zip'], -1, $match_count); $zip_nospaces = preg_replace('/[^0-9a-zA-Z]/', '', $_REQUEST['zip']); if ($match_count) RaiseError('Canadian postal codes may only contain numbers, letters, or spaces'); elseif (!ValidateInput($zip_nospaces, 'length', '=', 6)) RaiseError('Canadian postal codes must be 6 characters'); } } if (!ValidateInput($_REQUEST['country'])) RaiseError('Country is required'); if (!ValidateInput($_REQUEST['phone'])) RaiseError('Phone is required'); if (!ValidateInput($_REQUEST['email'])) RaiseError('Email is required'); elseif (!ValidateInput($_REQUEST['email'], 'email')) RaiseError('Email is not in proper format'); elseif (GetDbNumRows(DbQuery('SELECT email FROM ' . EP_DB_COM_NAME . '.tbl_user WHERE email = \'' . DbEscapeQuotes($_REQUEST['email']) . '\'')) && !$_SESSION['logged_in']) RaiseError('That email address is already registered with an account.
If you have forgotten your password, it can be reset and emailed to you.'); } PushBuffer(); if (!DisplayErrors()) { unset($_REQUEST['PHPSESSID']); unset($_REQUEST['submitted']); unset($_REQUEST['LES']); unset($_REQUEST['LOGIN_UNAME']); unset($_REQUEST['LOGIN_PWD']); foreach ($_REQUEST as $key => $value) $_SESSION['order'][$key] = str_replace("\n", " ", str_replace("\r", "", $value)); if ($_SESSION['order']['uid'] == '') $_SESSION['order']['uid'] = $_SESSION['EPORT_USER_ID']; header('Location: /order/place_order.html'); ep_page_halt(true); } else $tpl->setVariable('ERRORS', PullBuffer()); } if (!$_REQUEST['receive_email'] && !$_REQUEST['submitted']) $_REQUEST['receive_email'] = 1; if (!$_REQUEST['account_type'] && !$_REQUEST['submitted']) $_REQUEST['account_type'] = SNF_ACCT_LEVEL1; if ((!$_REQUEST['country'] && !$_REQUEST['submitted']) || strtolower($_REQUEST['country']) == 'usa') $_REQUEST['country'] = 'US'; $hiddenvars = GetHidden('order_type', $_REQUEST['order_type']); if ($_REQUEST['uid']) $hiddenvars .= GetHidden('uid', $_REQUEST['uid']); if ($showform) { if ($_REQUEST['order_type'] != 'checkout') { PushBuffer(); include('subscription_table.php'); $tpl->setVariable('SUBSCRIPTION_TABLE', PullBuffer()); } if (true) $account_type = ep_getdbselect('account_type', DbQuery('SELECT CONCAT(at.name, \' - $\', at.price) AS label, at.id AS value FROM ' . EP_DB_COM_NAME . '.tbl_account_type at WHERE at.online = 1 ORDER BY at.price')); else $account_type = ''; // just display for renewals // $tpl->setCurrentBlock('ORDER_FORM'); // verify that state is two characters and alpha only if ($_REQUEST['state'] && strlen($_REQUEST['state']) == 2 && ctype_alpha($_REQUEST['state'])) $state_init_vars = 'state=' . $_REQUEST['state']; AddContent('snf_state_other_init("' . $state_init_vars . '");', 'ONLOAD'); if ($_SESSION['order']['admin_user_hijack']) { AddContent('', 'CSS_JAVASCRIPT'); AddContent('snf_order_type_switch();', 'ONLOAD'); echo '

You are operating under the user ' . $_REQUEST['username'] . ' (' . $_SESSION['order']['uid'] . ')

'; $order_form['ORDER_TYPE'] = ep_getradios('order_type', array( 'Renewal' => 'renew', 'Other Transaction' => 'other' ), array('attributes' => array('onClick' => 'snf_order_type_switch()'))); $order_form['TRANSACTION_AMOUNT'] = ep_gettext('transaction_amount', array('cols' => 10, 'inputmode' => 'numeric', 'pattern' => '[0-9\.]*', 'title' => 'Numbers and optional decimal point')); $order_form['TRANSACTION_DESC'] = ep_gettext('transaction_description', array('maxlength' => 255)); } else $order_form['HIDDENVARS'] = $hiddenvars; if (!$_SESSION['logged_in'] && $_REQUEST['order_type'] != 'renew') { $order_form['USERNAME'] = ep_gettext('username', array('required' => true, 'maxlength' => 50)); $order_form['PASSWORD'] = ep_gettext('new-password', array('type' => 'password', 'required' => true, 'autocomplete' => 'new-password')); $order_form['PASSWORD2'] = ep_gettext('new-password2', array('type' => 'password', 'required' => true)); } else $order_form['USERNAME'] = $_REQUEST['username']; $order_form['NAME'] = ep_gettext('name', array('required' => true, 'autocomplete' => 'billing name', 'maxlength' => 80)); $order_form['COMPANYNAME'] = ep_gettext('companyname', array('required' => true, 'autocomplete' => 'billing organization', 'maxlength' => 80)); $order_form['ADDRESS'] = ep_gettext('address', array('required' => true, 'autocomplete' => 'billing street-address', 'maxlength' => 64)); $order_form['CITY'] = ep_gettext('city', array('required' => true, 'autocomplete' => 'billing address-level2', 'maxlength' => 64)); $order_form['STATE'] = ep_getselect('state', array(), array('autocomplete' => 'billing address-level1')) . ep_gettext('state_other', array('cols' => 16, 'autocomplete' => 'billing address-level1', 'maxlength' => 100)); $order_form['ZIP'] = ep_gettext('zip', array('cols' => 7, 'maxlength' => 12, 'required' => true, 'inputmode' => 'numeric', 'autocomplete' => 'billing postal-code')); $order_form['COUNTRY'] = ep_getdbselect('country', DbQuery('SELECT name AS label, code AS value FROM ' . EP_DB_COM_NAME . '.tbl_fd_countries ORDER BY seq, name'), array('required' => true, 'autocomplete' => 'billing country')); $order_form['PHONE'] = ep_gettext('phone', array('type' => 'tel', 'required' => true, 'autocomplete' => 'tel', 'maxlength' => 24)); $order_form['EMAIL'] = ep_gettext('email', array('type' => 'email', 'required' => true, 'autocomplete' => 'email', 'maxlength' => 200)); $order_form['RECEIVE_EMAIL'] = ep_getcheck('receive_email', 'Would you like to receive email notifications?', array('selected' => true)); $order_form['SUBMIT'] = GetButton('submitted', 'submit', 'Submit'); if ($_REQUEST['order_type'] != 'checkout') $order_form['ACCOUNTTYPE'] = $account_type; $tpl->setVariable($order_form); $tpl->parseCurrentBlock(); $tpl->show(); } } // breadcrumbs $bc_links = array( '

Order Form

', '

Payment Information

', '

Order Complete

'); AddContent(implode('', $bc_links), 'BREADCRUMBS');