{"action":"closed","issue":{"url":"https://api.github.com/repos/opencart/opencart/issues/3048","labels_url":"https://api.github.com/repos/opencart/opencart/issues/3048/labels{/name}","comments_url":"https://api.github.com/repos/opencart/opencart/issues/3048/comments","events_url":"https://api.github.com/repos/opencart/opencart/issues/3048/events","html_url":"https://github.com/opencart/opencart/issues/3048","id":80168613,"number":3048,"title":"OC 2.0.2.0-2.0.3.0 Insecure Cancel-links in various admin payment controllers","user":{"login":"mhcwebdesign","id":2989557,"avatar_url":"https://avatars.githubusercontent.com/u/2989557?v=3","gravatar_id":"","url":"https://api.github.com/users/mhcwebdesign","html_url":"https://github.com/mhcwebdesign","followers_url":"https://api.github.com/users/mhcwebdesign/followers","following_url":"https://api.github.com/users/mhcwebdesign/following{/other_user}","gists_url":"https://api.github.com/users/mhcwebdesign/gists{/gist_id}","starred_url":"https://api.github.com/users/mhcwebdesign/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mhcwebdesign/subscriptions","organizations_url":"https://api.github.com/users/mhcwebdesign/orgs","repos_url":"https://api.github.com/users/mhcwebdesign/repos","events_url":"https://api.github.com/users/mhcwebdesign/events{/privacy}","received_events_url":"https://api.github.com/users/mhcwebdesign/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2015-05-24T13:53:30Z","updated_at":"2015-05-27T09:10:08Z","closed_at":"2015-05-27T09:10:08Z","body":"For the following files the insecure Cancel-links\r\n```\r\n$data['cancel'] = $this->url->link('extension/payment', 'token=' . $this->session->data['token']);\r\n```\r\nshould be replaced with\r\n```\r\n$data['cancel'] = $this->url->link('extension/payment', 'token=' . $this->session->data['token'], 'SSL');\r\n```\r\nadmin/controller/payment/amazon_checkout.php\r\nadmin/controller/payment/amazon_login_pay.php\r\nadmin/controller/payment/securetrading_pp.php\r\nadmin/controller/payment/securetrading_ws.php\r\n\r\nAlso, while not wrong, in file admin/controller/payment/web_payment_software.php, the following 2 lines \r\n```\r\n\t\t$data['action'] = HTTPS_SERVER . 'index.php?route=payment/web_payment_software&token=' . $this->session->data['token'];\r\n\r\n\t\t$data['cancel'] = HTTPS_SERVER . 'index.php?route=extension/payment&token=' . $this->session->data['token'];\r\n```\r\nshould still be replaced with\r\n```\r\n\t\t$data['action'] = $this->url->link('payment/web_payment_software', 'token=' . $this->session->data['token'], 'SSL');\r\n\r\n\t\t$data['cancel'] = this->url->link('extension/payment', 'token=' . $this->session->data['token'], 'SSL');\r\n```\r\n"}}