EIT-3646: Allow custom alphanumeric data to

be sent to checkout. Also change `deviceId` to `device_id`.
afterpay · Jan 18, 2024 · c65d2f2 · c65d2f2
1 parent 898f5d0
commit c65d2f2
Showing 1 changed file with 15 additions and 2 deletions.
diff --git a/src/HTTP/Response/CreateCheckout.php b/src/HTTP/Response/CreateCheckout.php
@@ -55,10 +55,23 @@ public function afterReceive()
 
                     if ($decodedCookie) {
                         $cookieObj = json_decode($decodedCookie, false);
+                        $urlChanged = false;
 
-                        if (isset($cookieObj->deviceId)) {
-                            $bodyObj->redirectCheckoutUrl .= "&deviceId={$cookieObj->deviceId}";
+                        if (isset($cookieObj->deviceId) && preg_match('/^[0-9a-z-]*$/i', $cookieObj->deviceId)) {
+                            $bodyObj->redirectCheckoutUrl .= "&device_id={$cookieObj->deviceId}";
+                            $urlChanged = true;
+                        }
+
+                        if (isset($cookieObj->checkout) && is_object($cookieObj->checkout)) {
+                            foreach ($cookieObj->checkout as $prop => $val) {
+                                if (preg_match('/^[0-9a-z]+$/i', $prop) && preg_match('/^[0-9a-z-]*$/i', $val)) {
+                                    $bodyObj->redirectCheckoutUrl .= "&{$prop}={$val}";
+                                    $urlChanged = true;
+                                }
+                            }
+                        }
 
+                        if ($urlChanged) {
                             $this->setRawBody(json_encode($bodyObj, JSON_PRETTY_PRINT | JSON_UNESCAPED_SLASHES));
                         }
                     }