From 9c2932dad133a6f600767c76c0d11751d47963f6 Mon Sep 17 00:00:00 2001
From: Jacek Pyziak <jacek.pyziak@project-pro.pl>
Date: Thu, 19 Mar 2026 19:35:09 +0100
Subject: [PATCH] update

---
 admin/index.php                               |  26 ++++++------------
 admin/templates/components/form-edit.php      |   3 +-
 admin/templates/site/unlogged-layout.php      |   3 +-
 admin/templates/users/user-2fa.php            |   2 ++
 autoload/Domain/CronJob/CronJobRepository.php |  14 +++++++++-
 autoload/Domain/CronJob/CronJobType.php       |  14 ++++++++++
 autoload/Domain/Product/ProductRepository.php |   6 ++--
 .../_partials/product-custom-fields.php       |  22 +++++++++------
 templates_user/.DS_Store                      | Bin 0 -> 6148 bytes
 templates_user/components/.DS_Store           | Bin 0 -> 6148 bytes
 10 files changed, 60 insertions(+), 30 deletions(-)
 create mode 100644 templates_user/.DS_Store
 create mode 100644 templates_user/components/.DS_Store

diff --git a/admin/index.php b/admin/index.php
index 2a228cb..8affdba 100644
--- a/admin/index.php
+++ b/admin/index.php
@@ -31,19 +31,20 @@ function __autoload_my_classes( $classname )
 spl_autoload_register( '__autoload_my_classes' );
 require_once '../config.php';
 require_once '../libraries/medoo/medoo.php';
-require_once '../libraries/rb.php';
 require_once '../libraries/phpmailer/class.phpmailer.php';
 require_once '../libraries/phpmailer/class.smtp.php';
 
-define( 'REDBEAN_MODEL_PREFIX', '' );
-\R::setup( 'mysql:host=' . $database['host'] . ';dbname=' . $database['name'], $database['user'], $database['password'] );
-\R::ext( 'xdispense', function ( $type )
-{
-  return R::getRedBean() -> dispense( $type );
-} );
-
 date_default_timezone_set( 'Europe/Warsaw' );
 
+$mdb = new medoo( [
+    'database_type' => 'mysql',
+    'database_name' => $database['name'],
+    'server'        => $database['host'],
+    'username'      => $database['user'],
+    'password'      => $database['password'],
+    'charset'       => 'utf8'
+  ] );
+
 $settings = ( new \Domain\Settings\SettingsRepository( $mdb ) )->allSettings();
 
 if ( file_exists( 'config.php' ) )
@@ -79,15 +80,6 @@ if ( !$lang = \Shared\Helpers\Helpers::get_session( 'lang-' . $lang_id ) )
   \Shared\Helpers\Helpers::set_session( 'lang-' . $lang_id, $lang );
 }
 
-$mdb = new medoo( [
-    'database_type' => 'mysql',
-    'database_name' => $database['name'],
-    'server'        => $database['host'],
-    'username'      => $database['user'],
-    'password'      => $database['password'],
-    'charset'       => 'utf8'
-  ] );
-
 $user = \Shared\Helpers\Helpers::get_session( 'user', true );
 
 \admin\App::update();
diff --git a/admin/templates/components/form-edit.php b/admin/templates/components/form-edit.php
index 1ed2713..d9b04c0 100644
--- a/admin/templates/components/form-edit.php
+++ b/admin/templates/components/form-edit.php
@@ -78,7 +78,8 @@ $_SESSION['can_use_rfm'] = true;
                 action="<?= htmlspecialchars($form->action) ?>" enctype="multipart/form-data">
             
             <input type="hidden" name="_form_id" value="<?= htmlspecialchars($form->formId) ?>">
-            
+            <input type="hidden" name="_csrf_token" value="<?= htmlspecialchars(\Shared\Security\CsrfToken::getToken()) ?>">
+
             <?php foreach ($form->hiddenFields as $name => $value): ?>
               <input type="hidden" name="<?= htmlspecialchars($name) ?>" value="<?= htmlspecialchars($value ?? '') ?>">
             <?php endforeach; ?>
diff --git a/admin/templates/site/unlogged-layout.php b/admin/templates/site/unlogged-layout.php
index fbd1eb6..f1cebd2 100644
--- a/admin/templates/site/unlogged-layout.php
+++ b/admin/templates/site/unlogged-layout.php
@@ -37,12 +37,13 @@
                   ?>
                   <div class="alert alert-danger alert-dismissable">
                     <button type="button" class="close" data-dismiss="alert" aria-hidden="true">×</button>
-                    <i class="icon fa fa-ban "></i><?= $alert;?>
+                    <i class="icon fa fa-ban "></i><?= htmlspecialchars($alert) ?>
                   </div>
                 <? endif;
                 ?>
                 <form method="POST" action="/admin/" class="form-horizontal" rol="form">
                   <input type="hidden" name="s-action" value="user-logon" />
+                  <input type="hidden" name="_csrf_token" value="<?= htmlspecialchars(\Shared\Security\CsrfToken::getToken()) ?>">
                   <div class="form-group form-inline row">
                     <div class="col-12">
                       <div class="input-group input-login">
diff --git a/admin/templates/users/user-2fa.php b/admin/templates/users/user-2fa.php
index b6bd65e..16e706e 100644
--- a/admin/templates/users/user-2fa.php
+++ b/admin/templates/users/user-2fa.php
@@ -1,5 +1,6 @@
 <form method="POST" action="/admin/" class="form-horizontal" rol="form">
   <input type="hidden" name="s-action" value="user-2fa-verify">
+  <input type="hidden" name="_csrf_token" value="<?= htmlspecialchars(\Shared\Security\CsrfToken::getToken()) ?>">
   <div class="form-group row">
     <label class="col col-sm-4 control-label" for="login">Kod z e-maila:</label>
     <div class="col col-sm-8">
@@ -14,5 +15,6 @@
 </form>
 <form method="POST" action="/admin/" style="margin-top:10px">
   <input type="hidden" name="s-action" value="user-2fa-resend">
+  <input type="hidden" name="_csrf_token" value="<?= htmlspecialchars(\Shared\Security\CsrfToken::getToken()) ?>">
   <button class="btn btn-danger">Wyślij kod ponownie</button>
 </form>
\ No newline at end of file
diff --git a/autoload/Domain/CronJob/CronJobRepository.php b/autoload/Domain/CronJob/CronJobRepository.php
index 3a872c0..27b667b 100644
--- a/autoload/Domain/CronJob/CronJobRepository.php
+++ b/autoload/Domain/CronJob/CronJobRepository.php
@@ -130,10 +130,22 @@ class CronJobRepository
      */
     public function markFailed($jobId, $error, $attempt = 1)
     {
-        $job = $this->db->get('pp_cron_jobs', ['max_attempts', 'attempts'], ['id' => $jobId]);
+        $job = $this->db->get('pp_cron_jobs', ['job_type', 'max_attempts', 'attempts'], ['id' => $jobId]);
 
         $attempts = $job ? (int) $job['attempts'] : $attempt;
         $maxAttempts = $job ? (int) $job['max_attempts'] : 10;
+        $jobType = $job ? $job['job_type'] : '';
+
+        // Order-related Apilo joby — infinite retry co 30 min
+        if (CronJobType::isOrderRelatedApiloJob($jobType)) {
+            $nextRun = date('Y-m-d H:i:s', time() + CronJobType::APILO_ORDER_BACKOFF_SECONDS);
+            $this->db->update('pp_cron_jobs', [
+                'status' => CronJobType::STATUS_PENDING,
+                'last_error' => mb_substr($error, 0, 500),
+                'scheduled_at' => $nextRun,
+            ], ['id' => $jobId]);
+            return;
+        }
 
         if ($attempts >= $maxAttempts) {
             // Przekroczono limit prób — trwale failed
diff --git a/autoload/Domain/CronJob/CronJobType.php b/autoload/Domain/CronJob/CronJobType.php
index 8bee136..8fe89c0 100644
--- a/autoload/Domain/CronJob/CronJobType.php
+++ b/autoload/Domain/CronJob/CronJobType.php
@@ -34,6 +34,7 @@ class CronJobType
     // Backoff
     const BASE_BACKOFF_SECONDS = 60;
     const MAX_BACKOFF_SECONDS = 3600;
+    const APILO_ORDER_BACKOFF_SECONDS = 1800; // 30 min — stały interwał dla order jobów
 
     /**
      * @return string[]
@@ -69,6 +70,19 @@ class CronJobType
         ];
     }
 
+    /**
+     * @param string $jobType
+     * @return bool
+     */
+    public static function isOrderRelatedApiloJob($jobType)
+    {
+        return in_array($jobType, [
+            self::APILO_SEND_ORDER,
+            self::APILO_SYNC_PAYMENT,
+            self::APILO_SYNC_STATUS,
+        ], true);
+    }
+
     /**
      * @param int $attempt
      * @return int
diff --git a/autoload/Domain/Product/ProductRepository.php b/autoload/Domain/Product/ProductRepository.php
index ddef888..562db10 100644
--- a/autoload/Domain/Product/ProductRepository.php
+++ b/autoload/Domain/Product/ProductRepository.php
@@ -1751,8 +1751,10 @@ class ProductRepository
         if ( \Shared\Helpers\Helpers::is_array_fix( $customFields ) ) {
             foreach ( $customFields as $row ) {
                 $this->db->insert( 'pp_shop_products_custom_fields', [
-                    'id_product' => $newProductId,
-                    'name'       => $row['name'],
+                    'id_product'  => $newProductId,
+                    'name'        => $row['name'],
+                    'type'        => $row['type'] ?? 'text',
+                    'is_required' => $row['is_required'] ?? 0,
                 ] );
             }
         }
diff --git a/templates/shop-basket/_partials/product-custom-fields.php b/templates/shop-basket/_partials/product-custom-fields.php
index a9134c7..d0b651f 100644
--- a/templates/shop-basket/_partials/product-custom-fields.php
+++ b/templates/shop-basket/_partials/product-custom-fields.php
@@ -1,20 +1,26 @@
 <? if ( $this -> custom_fields ) : ?>
   <? foreach ( $this -> custom_fields as $key => $val ) : ?>
     <? $custom_field = ( new \Domain\Product\ProductRepository( $GLOBALS['mdb'] ) )->findCustomFieldCached( $key ); ?>
-    
-    <? if ( $custom_field['type'] == 'text' ) : ?>
+    <? $field_type = !empty( $custom_field['type'] ) ? $custom_field['type'] : 'text'; ?>
+
+    <? if ( $field_type == 'text' ) : ?>
       <div class="custom-field">
         <div class="_name">
-          <?
-            echo $custom_field['name'] . ':';
-          ?>
+          <?= htmlspecialchars( $custom_field['name'] ) . ':'; ?>
         </div>
         <div class="_text">
-          <?= $val;?>
+          <?= nl2br( htmlspecialchars( $val ) );?>
+        </div>
+      </div>
+    <? elseif ( $field_type == 'image' && !empty( $val ) ) : ?>
+      <div class="custom-field">
+        <div class="_name">
+          <?= htmlspecialchars( $custom_field['name'] ) . ':'; ?>
+        </div>
+        <div class="_image">
+          <img src="<?= htmlspecialchars( $val );?>" alt="<?= htmlspecialchars( $custom_field['name'] );?>">
         </div>
       </div>
-    <? elseif ( $custom_field['type'] == 'image' ) : ?>
-
     <? endif; ?>
   <? endforeach; ?>
 <? endif;?>
\ No newline at end of file
diff --git a/templates_user/.DS_Store b/templates_user/.DS_Store
new file mode 100644
index 0000000000000000000000000000000000000000..dbd07c1a1c1d289c1b490405a326e8a55ae29325
GIT binary patch
literal 6148
zcmeHKJ8r^25S>XVP-t9I?iIMf%5qNN3m_#C4KXMr)UI+aj>emhq98+&f+l(+&Ai>&
zd29I<9*>A<`}MjKX+&fWH<WJ+Q?qmPi9KXSfpFZhlR@6#pK_Q~Ur!kKNnXHwm;G=4
zvHuvhyI~V|Unet51*iZOpaN8Y3jA3C>%Fk~B9M^^Pys6Nqkw%M3f!<Jj)DH^K=2U&
zI78YEYo8^6#S*}pI0hmE)1U%_sySk4(2*}$R};s;po`}4q4{LZ2}S+sxW9P0Xbohf
z0#x8qfydZ3*8iX3H|GCK5_eR93j8Ytbk_A<i&x6tI(a$kwFSP0Tg?e>hP6`=yd49*
i9b;qdc<Dt^S8R>*nm7hJ9eJk%`7>a;(5S$@6*vQa;1$mR

literal 0
HcmV?d00001

diff --git a/templates_user/components/.DS_Store b/templates_user/components/.DS_Store
new file mode 100644
index 0000000000000000000000000000000000000000..5008ddfcf53c02e82d7eee2e57c38e5672ef89f6
GIT binary patch
literal 6148
zcmeH~Jr2S!425mzP>H1@V-^m;4Wg<&0T*E43hX&L&p$$qDprKhvt+--jT7}7np#A3
zem<@ulZcFPQ@L2!n>{z**<q8>++&mCkOWA81W14cNZ<zv;LbK1Poaz?KmsK2CSc!(
z0ynLxE!0092;Krf2c+FF_Fe*7ECH>lEfg7;MkzE(HCqgga^y>{tEnwC%0;vJ&^%eQ
zLs35+`xjp>T0<F0fCPF1$Cyrb|F7^5{eNG?83~ZUUlGt@xh*qZDeu<Z%US-OSsOPv
j)R!Z4KLME7ReXlK;d!wEw5GODWMKRea10D2@KpjYNUI8I

literal 0
HcmV?d00001