From c69ae02301331b1a6c09fd605b07d20bf096c8d7 Mon Sep 17 00:00:00 2001
From: Jonas Braathen <jonas@ponas.no>
Date: Wed, 18 Feb 2015 01:28:24 +0100
Subject: [PATCH 1/2] Ask tekstmelding for purchase date. Fallback to legacy
 din_sms_sent

---
 snapporder/config-sample.php |  1 +
 snapporder/lib/functions.php | 26 ++++++++++++++++++++++++++
 2 files changed, 27 insertions(+)

diff --git a/snapporder/config-sample.php b/snapporder/config-sample.php
index 3ec7507..3e5a3f8 100644
--- a/snapporder/config-sample.php
+++ b/snapporder/config-sample.php
@@ -5,4 +5,5 @@
     define("REGISTRATION_URL_TIMEOUT_DAYS", 3);
     define("MAILCHIMP_API_KEY", "");
     define("MAILCHIMP_LIST_ID", "004f53d7c6");
+    define("TEKSTMELDING_API_KEY", 'qwertyuiop');
 ?>
diff --git a/snapporder/lib/functions.php b/snapporder/lib/functions.php
index c3af290..a1c385d 100644
--- a/snapporder/lib/functions.php
+++ b/snapporder/lib/functions.php
@@ -588,7 +588,33 @@ function save_activation_form($data) {
 
     return true;
 }
+
 function get_purchase_date($phone, $activation_code) {
+    $url = "https://tekstmelding.neuf.no/inside-code-purchase-date";
+
+    $params = array(
+        'api_key' => TEKSTMELDING_API_KEY,
+        'number' => str_replace('+', '', $phone),
+        'activation_code' => $activation_code,
+    );
+    $url .= '?' . http_build_query($params);
+
+    $ch = curl_init();
+    curl_setopt($ch, CURLOPT_URL, $url);
+    curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
+    $result = curl_exec($ch);
+    curl_close($ch);
+
+    $timestamp = clean_timestamp($result);
+
+    if ($timestamp === false) {
+        return get_purchase_date_legacy($phone, $activation_code);
+    }
+
+    return $timestamp;
+}
+
+function get_purchase_date_legacy($phone, $activation_code) {
     global $conn;
     $gsm = substr($phone, 3); // strip off country code
 

From a7ba9b2d59e593f096d9ef6ea8fb9f3d2897d888 Mon Sep 17 00:00:00 2001
From: Paal Braathen <paalbra@gmail.com>
Date: Thu, 5 Mar 2015 19:49:53 +0100
Subject: [PATCH 2/2] Remove SQL injection

---
 inside/file.php | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/inside/file.php b/inside/file.php
index b08affa..ad1c192 100644
--- a/inside/file.php
+++ b/inside/file.php
@@ -7,6 +7,9 @@ $conn =& DB_connect();
 
 $id = $_GET['id'];
 
+if (!preg_match('/^\d+$/', $id))
+	die("That's not an id");
+
 $nodelist = array(); 
 
 // Pull file meta-data   
@@ -56,4 +59,4 @@ for ($i = 0 ; $i < count($nodelist) ; $i++) {
   }
 } 
 
-?>
\ No newline at end of file
+?>