update

admin/index.php

@@ -31,19 +31,20 @@ function __autoload_my_classes( $classname )
 spl_autoload_register( '__autoload_my_classes' );
 require_once '../config.php';
 require_once '../libraries/medoo/medoo.php';
-require_once '../libraries/rb.php';
 require_once '../libraries/phpmailer/class.phpmailer.php';
 require_once '../libraries/phpmailer/class.smtp.php';
 
-define( 'REDBEAN_MODEL_PREFIX', '' );
-\R::setup( 'mysql:host=' . $database['host'] . ';dbname=' . $database['name'], $database['user'], $database['password'] );
-\R::ext( 'xdispense', function ( $type )
-{
-  return R::getRedBean() -> dispense( $type );
-} );
-
 date_default_timezone_set( 'Europe/Warsaw' );
 
+$mdb = new medoo( [
+    'database_type' => 'mysql',
+    'database_name' => $database['name'],
+    'server'        => $database['host'],
+    'username'      => $database['user'],
+    'password'      => $database['password'],
+    'charset'       => 'utf8'
+  ] );
+
 $settings = ( new \Domain\Settings\SettingsRepository( $mdb ) )->allSettings();
 
 if ( file_exists( 'config.php' ) )
@@ -79,15 +80,6 @@ if ( !$lang = \Shared\Helpers\Helpers::get_session( 'lang-' . $lang_id ) )
   \Shared\Helpers\Helpers::set_session( 'lang-' . $lang_id, $lang );
 }
 
-$mdb = new medoo( [
-    'database_type' => 'mysql',
-    'database_name' => $database['name'],
-    'server'        => $database['host'],
-    'username'      => $database['user'],
-    'password'      => $database['password'],
-    'charset'       => 'utf8'
-  ] );
-
 $user = \Shared\Helpers\Helpers::get_session( 'user', true );
 
 \admin\App::update();

admin/templates/components/form-edit.php

@@ -78,6 +78,7 @@ $_SESSION['can_use_rfm'] = true;
                 action="<?= htmlspecialchars($form->action) ?>" enctype="multipart/form-data">
             
             <input type="hidden" name="_form_id" value="<?= htmlspecialchars($form->formId) ?>">
+            <input type="hidden" name="_csrf_token" value="<?= htmlspecialchars(\Shared\Security\CsrfToken::getToken()) ?>">
 
             <?php foreach ($form->hiddenFields as $name => $value): ?>
               <input type="hidden" name="<?= htmlspecialchars($name) ?>" value="<?= htmlspecialchars($value ?? '') ?>">

admin/templates/site/unlogged-layout.php

@@ -37,12 +37,13 @@
                   ?>
                   <div class="alert alert-danger alert-dismissable">
                     <button type="button" class="close" data-dismiss="alert" aria-hidden="true">×</button>
-                    <i class="icon fa fa-ban "></i><?= $alert;?>
+                    <i class="icon fa fa-ban "></i><?= htmlspecialchars($alert) ?>
                   </div>
                 <? endif;
                 ?>
                 <form method="POST" action="/admin/" class="form-horizontal" rol="form">
                   <input type="hidden" name="s-action" value="user-logon" />
+                  <input type="hidden" name="_csrf_token" value="<?= htmlspecialchars(\Shared\Security\CsrfToken::getToken()) ?>">
                   <div class="form-group form-inline row">
                     <div class="col-12">
                       <div class="input-group input-login">

admin/templates/users/user-2fa.php

@@ -1,5 +1,6 @@
 <form method="POST" action="/admin/" class="form-horizontal" rol="form">
   <input type="hidden" name="s-action" value="user-2fa-verify">
+  <input type="hidden" name="_csrf_token" value="<?= htmlspecialchars(\Shared\Security\CsrfToken::getToken()) ?>">
   <div class="form-group row">
     <label class="col col-sm-4 control-label" for="login">Kod z e-maila:</label>
     <div class="col col-sm-8">
@@ -14,5 +15,6 @@
 </form>
 <form method="POST" action="/admin/" style="margin-top:10px">
   <input type="hidden" name="s-action" value="user-2fa-resend">
+  <input type="hidden" name="_csrf_token" value="<?= htmlspecialchars(\Shared\Security\CsrfToken::getToken()) ?>">
   <button class="btn btn-danger">Wyślij kod ponownie</button>
 </form>

autoload/Domain/CronJob/CronJobRepository.php

@@ -130,10 +130,22 @@ class CronJobRepository
      */
     public function markFailed($jobId, $error, $attempt = 1)
     {
-        $job = $this->db->get('pp_cron_jobs', ['max_attempts', 'attempts'], ['id' => $jobId]);
+        $job = $this->db->get('pp_cron_jobs', ['job_type', 'max_attempts', 'attempts'], ['id' => $jobId]);
 
         $attempts = $job ? (int) $job['attempts'] : $attempt;
         $maxAttempts = $job ? (int) $job['max_attempts'] : 10;
+        $jobType = $job ? $job['job_type'] : '';
+
+        // Order-related Apilo joby — infinite retry co 30 min
+        if (CronJobType::isOrderRelatedApiloJob($jobType)) {
+            $nextRun = date('Y-m-d H:i:s', time() + CronJobType::APILO_ORDER_BACKOFF_SECONDS);
+            $this->db->update('pp_cron_jobs', [
+                'status' => CronJobType::STATUS_PENDING,
+                'last_error' => mb_substr($error, 0, 500),
+                'scheduled_at' => $nextRun,
+            ], ['id' => $jobId]);
+            return;
+        }
 
         if ($attempts >= $maxAttempts) {
             // Przekroczono limit prób — trwale failed

autoload/Domain/CronJob/CronJobType.php

@@ -34,6 +34,7 @@ class CronJobType
     // Backoff
     const BASE_BACKOFF_SECONDS = 60;
     const MAX_BACKOFF_SECONDS = 3600;
+    const APILO_ORDER_BACKOFF_SECONDS = 1800; // 30 min — stały interwał dla order jobów
 
     /**
      * @return string[]
@@ -69,6 +70,19 @@ class CronJobType
         ];
     }
 
+    /**
+     * @param string $jobType
+     * @return bool
+     */
+    public static function isOrderRelatedApiloJob($jobType)
+    {
+        return in_array($jobType, [
+            self::APILO_SEND_ORDER,
+            self::APILO_SYNC_PAYMENT,
+            self::APILO_SYNC_STATUS,
+        ], true);
+    }
+
     /**
      * @param int $attempt
      * @return int

autoload/Domain/Product/ProductRepository.php

@@ -1751,8 +1751,10 @@ class ProductRepository
         if ( \Shared\Helpers\Helpers::is_array_fix( $customFields ) ) {
             foreach ( $customFields as $row ) {
                 $this->db->insert( 'pp_shop_products_custom_fields', [
-                    'id_product' => $newProductId,
-                    'name'       => $row['name'],
+                    'id_product'  => $newProductId,
+                    'name'        => $row['name'],
+                    'type'        => $row['type'] ?? 'text',
+                    'is_required' => $row['is_required'] ?? 0,
                 ] );
             }
         }

templates/shop-basket/_partials/product-custom-fields.php

@@ -1,20 +1,26 @@
 <? if ( $this -> custom_fields ) : ?>
   <? foreach ( $this -> custom_fields as $key => $val ) : ?>
     <? $custom_field = ( new \Domain\Product\ProductRepository( $GLOBALS['mdb'] ) )->findCustomFieldCached( $key ); ?>
+    <? $field_type = !empty( $custom_field['type'] ) ? $custom_field['type'] : 'text'; ?>
 
-    <? if ( $custom_field['type'] == 'text' ) : ?>
+    <? if ( $field_type == 'text' ) : ?>
       <div class="custom-field">
         <div class="_name">
-          <?
-            echo $custom_field['name'] . ':';
-          ?>
+          <?= htmlspecialchars( $custom_field['name'] ) . ':'; ?>
         </div>
         <div class="_text">
-          <?= $val;?>
+          <?= nl2br( htmlspecialchars( $val ) );?>
+        </div>
+      </div>
+    <? elseif ( $field_type == 'image' && !empty( $val ) ) : ?>
+      <div class="custom-field">
+        <div class="_name">
+          <?= htmlspecialchars( $custom_field['name'] ) . ':'; ?>
+        </div>
+        <div class="_image">
+          <img src="<?= htmlspecialchars( $val );?>" alt="<?= htmlspecialchars( $custom_field['name'] );?>">
         </div>
       </div>
-    <? elseif ( $custom_field['type'] == 'image' ) : ?>
-
     <? endif; ?>
   <? endforeach; ?>
 <? endif;?>