This repository has been archived on 2026-03-21. You can view files and clone it, but cannot push or open issues or pull requests.
payfrit-biz/api/tasks/getDetails.cfm
John Mizerek 3f15b0c8b6 Fix SQL injection, wrong PK, and hardcoded production URLs
Security:
- orders/submit.cfm: parameterize IN clause (was string-interpolated)
- auth/completeProfile.cfm: fix UserID → ID on Users table PK

Environment-aware URLs:
- Add application.baseUrl to config/environment.cfm
- Replace all hardcoded https://biz.payfrit.com with application.baseUrl in:
  orders/getDetail, tasks/getDetails, auth/completeProfile, auth/avatar,
  stripe/onboard, users/search, workers/onboardingLink, workers/earlyUnlock

Also fix submit.cfm qMeta.ItemID → qMeta.ID (column not in SELECT)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-01-31 21:14:19 -08:00

191 lines
6.3 KiB
Text

<cfsetting showdebugoutput="false">
<cfsetting enablecfoutputonly="true">
<cffunction name="apiAbort" access="public" returntype="void" output="true">
<cfargument name="payload" type="struct" required="true">
<cfcontent type="application/json; charset=utf-8">
<cfoutput>#serializeJSON(arguments.payload)#</cfoutput>
<cfabort>
</cffunction>
<cffunction name="readJsonBody" access="public" returntype="struct" output="false">
<cfset var raw = getHttpRequestData().content>
<cfif isNull(raw) OR len(trim(raw)) EQ 0>
<cfreturn {}>
</cfif>
<cftry>
<cfset var data = deserializeJSON(raw)>
<cfif isStruct(data)>
<cfreturn data>
<cfelse>
<cfreturn {}>
</cfif>
<cfcatch>
<cfreturn {}>
</cfcatch>
</cftry>
</cffunction>
<cfset data = readJsonBody()>
<cfset TaskID = val( structKeyExists(data,"TaskID") ? data.TaskID : 0 )>
<cfif TaskID LTE 0>
<cfset apiAbort({ "OK": false, "ERROR": "missing_params", "MESSAGE": "TaskID is required." })>
</cfif>
<cftry>
<!--- Get the task and linked order details --->
<cfset qTask = queryExecute("
SELECT
t.ID AS TaskID,
t.BusinessID,
t.CategoryID,
t.OrderID,
t.TaskTypeID,
t.CreatedOn,
t.ClaimedByUserID,
tc.Name AS CategoryName,
tc.Color AS CategoryColor,
o.ID AS OID,
o.UUID AS OrderUUID,
o.UserID,
o.OrderTypeID,
o.StatusID AS OrderStatusID,
o.ServicePointID,
o.Remarks,
o.SubmittedOn,
sp.Name AS ServicePointName,
sp.TypeID AS ServicePointTypeID,
u.ID AS CustomerUserID,
u.FirstName,
u.LastName,
u.ContactNumber
FROM Tasks t
LEFT JOIN TaskCategories tc ON tc.ID = t.CategoryID
LEFT JOIN Orders o ON o.ID = t.OrderID
LEFT JOIN ServicePoints sp ON sp.ID = o.ServicePointID
LEFT JOIN Users u ON u.ID = o.UserID
WHERE t.ID = ?
", [ { value = TaskID, cfsqltype = "cf_sql_integer" } ], { datasource = "payfrit" })>
<cfif qTask.recordCount EQ 0>
<cfset apiAbort({ "OK": false, "ERROR": "not_found", "MESSAGE": "Task not found." })>
</cfif>
<!--- Build basic task info --->
<cfset taskTitle = "Task ##" & qTask.TaskID>
<cfif qTask.OrderID GT 0>
<cfset taskTitle = "Order ##" & qTask.OrderID>
</cfif>
<!--- Check if user photo file exists (try both .jpg and .png) --->
<cfset customerPhotoUrl = "">
<cfif qTask.CustomerUserID GT 0>
<cfset uploadDir = expandPath("/uploads/users/")>
<cfset jpgPath = uploadDir & qTask.CustomerUserID & ".jpg">
<cfset pngPath = uploadDir & qTask.CustomerUserID & ".png">
<cfset pngPathUpper = uploadDir & qTask.CustomerUserID & ".PNG">
<cfif fileExists(jpgPath)>
<cfset customerPhotoUrl = application.baseUrl & "/uploads/users/" & qTask.CustomerUserID & ".jpg">
<cfelseif fileExists(pngPath)>
<cfset customerPhotoUrl = application.baseUrl & "/uploads/users/" & qTask.CustomerUserID & ".png">
<cfelseif fileExists(pngPathUpper)>
<cfset customerPhotoUrl = application.baseUrl & "/uploads/users/" & qTask.CustomerUserID & ".PNG">
</cfif>
</cfif>
<cfset result = {
"TaskID": qTask.TaskID,
"TaskBusinessID": qTask.BusinessID,
"TaskCategoryID": qTask.CategoryID,
"TaskTypeID": qTask.TaskTypeID ?: 1,
"TaskTitle": taskTitle,
"TaskCreatedOn": dateFormat(qTask.CreatedOn, "yyyy-mm-dd") & "T" & timeFormat(qTask.CreatedOn, "HH:mm:ss"),
"TaskStatusID": qTask.ClaimedByUserID GT 0 ? 1 : 0,
"TaskCategoryName": len(trim(qTask.CategoryName)) ? qTask.CategoryName : "General",
"TaskCategoryColor": len(trim(qTask.CategoryColor)) ? qTask.CategoryColor : "##888888",
"OrderID": qTask.OrderID ?: 0,
"OrderRemarks": qTask.Remarks ?: "",
"OrderSubmittedOn": isDate(qTask.SubmittedOn) ? (dateFormat(qTask.SubmittedOn, "yyyy-mm-dd") & "T" & timeFormat(qTask.SubmittedOn, "HH:mm:ss")) : "",
"ServicePointID": qTask.ServicePointID ?: 0,
"ServicePointName": qTask.ServicePointName ?: "",
"ServicePointTypeID": qTask.ServicePointTypeID ?: 0,
"DeliveryAddress": "",
"DeliveryLat": 0,
"DeliveryLng": 0,
"CustomerUserID": qTask.CustomerUserID ?: 0,
"CustomerFirstName": qTask.FirstName ?: "",
"CustomerLastName": qTask.LastName ?: "",
"CustomerPhone": qTask.ContactNumber ?: "",
"CustomerPhotoUrl": customerPhotoUrl,
"BeaconUUID": "",
"LineItems": [],
"TableMembers": []
}>
<!--- Get beacon UUID for the service point (for auto-completion on Works app) --->
<cfif val(qTask.ServicePointID) GT 0>
<cfset qBeacon = queryExecute("
SELECT b.UUID
FROM ServicePoints sp_link
INNER JOIN Beacons b ON b.ID = sp_link.BeaconID
WHERE sp_link.ID = ?
AND b.IsActive = 1
LIMIT 1
", [ { value = qTask.ServicePointID, cfsqltype = "cf_sql_integer" } ], { datasource = "payfrit" })>
<cfif qBeacon.recordCount GT 0>
<cfset result.BeaconUUID = qBeacon.UUID>
</cfif>
</cfif>
<!--- Get order line items if there's an order --->
<cfif qTask.OrderID GT 0>
<cfset qLineItems = queryExecute("
SELECT
oli.ID AS OrderLineItemID,
oli.ParentOrderLineItemID,
oli.ItemID,
oli.Price AS LineItemPrice,
oli.Quantity,
oli.Remark,
i.ID AS IID,
i.Name AS ItemName,
i.ParentItemID,
i.Price AS ItemPrice,
i.IsCheckedByDefault
FROM OrderLineItems oli
INNER JOIN Items i ON i.ID = oli.ItemID
WHERE oli.OrderID = ?
AND oli.IsDeleted = b'0'
ORDER BY oli.ID
", [ { value = qTask.OrderID, cfsqltype = "cf_sql_integer" } ], { datasource = "payfrit" })>
<cfloop query="qLineItems">
<cfset arrayAppend(result.LineItems, {
"LineItemID": qLineItems.OrderLineItemID,
"ParentLineItemID": qLineItems.ParentOrderLineItemID,
"ItemID": qLineItems.ItemID,
"ItemName": qLineItems.ItemName,
"ItemPrice": qLineItems.LineItemPrice,
"Quantity": qLineItems.Quantity,
"Remark": qLineItems.Remark,
"IsModifier": qLineItems.ParentOrderLineItemID GT 0
})>
</cfloop>
</cfif>
<cfset apiAbort({
"OK": true,
"ERROR": "",
"TASK": result
})>
<cfcatch>
<cfset apiAbort({
"OK": false,
"ERROR": "server_error",
"MESSAGE": "Error loading task details",
"DETAIL": cfcatch.message
})>
</cfcatch>
</cftry>