From c4e6961b2082bf03d46b600da237972826e92d75 Mon Sep 17 00:00:00 2001
From: ellynoize <na1ton.trik@gmail.com>
Date: Wed, 17 Jun 2026 14:24:13 +0300
Subject: [PATCH 01/10] issues 6

---
 .../classes/general/RCrmActions.php           |  5 +-
 .../general/collector/RetailCrmCollector.php  |  5 +-
 .../classes/general/ua/RetailCrmUa.php        |  5 +-
 intaro.retailcrm/install/index.php            | 18 +++---
 .../lib/component/configprovider.php          |  2 +-
 intaro.retailcrm/lib/icml/settingsservice.php | 30 +++++++--
 .../lib/service/loyaltyservice.php            |  2 +-
 intaro.retailcrm/options.php                  | 63 +++++++++++--------
 8 files changed, 83 insertions(+), 47 deletions(-)

diff --git a/intaro.retailcrm/classes/general/RCrmActions.php b/intaro.retailcrm/classes/general/RCrmActions.php
index 65516420..52199512 100644
--- a/intaro.retailcrm/classes/general/RCrmActions.php
+++ b/intaro.retailcrm/classes/general/RCrmActions.php
@@ -261,7 +261,10 @@ public static function eventLog($auditType, $itemId, $description)
     public static function uploadOrdersAgent()
     {
         RetailCrmOrder::uploadOrders();
-        $failedIds = unserialize(COption::GetOptionString(self::$MODULE_ID, self::$CRM_ORDER_FAILED_IDS, 0));
+        $failedIds = unserialize(
+            COption::GetOptionString(self::$MODULE_ID, self::$CRM_ORDER_FAILED_IDS, 0),
+            ['allowed_classes' => false]
+        );
 
         if (is_array($failedIds) && !empty($failedIds)) {
             RetailCrmOrder::uploadOrders(50, true);
diff --git a/intaro.retailcrm/classes/general/collector/RetailCrmCollector.php b/intaro.retailcrm/classes/general/collector/RetailCrmCollector.php
index 61b1aeed..719811b2 100644
--- a/intaro.retailcrm/classes/general/collector/RetailCrmCollector.php
+++ b/intaro.retailcrm/classes/general/collector/RetailCrmCollector.php
@@ -28,7 +28,10 @@ class RetailCrmCollector
      */
     public static function add()
     {
-        $keys = unserialize(COption::GetOptionString(self::$MODULE_ID, self::$CRM_COLL_KEY, 0));
+        $keys = unserialize(
+            COption::GetOptionString(self::$MODULE_ID, self::$CRM_COLL_KEY, 0),
+            ['allowed_classes' => false]
+        );
         $collector = COption::GetOptionString(self::$MODULE_ID, self::$CRM_COLL, 0);
         $request = \Bitrix\Main\Context::getCurrent()->getRequest();
 
diff --git a/intaro.retailcrm/classes/general/ua/RetailCrmUa.php b/intaro.retailcrm/classes/general/ua/RetailCrmUa.php
index bf7245d2..f61413c3 100644
--- a/intaro.retailcrm/classes/general/ua/RetailCrmUa.php
+++ b/intaro.retailcrm/classes/general/ua/RetailCrmUa.php
@@ -24,7 +24,10 @@ class RetailCrmUa
     public static function add()
     {
         $ua = COption::GetOptionString(self::$MODULE_ID, self::$CRM_UA, 0);
-        $uaKeys = unserialize(COption::GetOptionString(self::$MODULE_ID, self::$CRM_UA_KEYS, 0));
+        $uaKeys = unserialize(
+            COption::GetOptionString(self::$MODULE_ID, self::$CRM_UA_KEYS, 0),
+            ['allowed_classes' => false]
+        );
         $request = \Bitrix\Main\Context::getCurrent()->getRequest();
 
         if ($ua === 'Y' && !empty($uaKeys[SITE_ID]['ID']) && !empty($uaKeys[SITE_ID]['INDEX']) && $request->isAdminSection() !== true) {
diff --git a/intaro.retailcrm/install/index.php b/intaro.retailcrm/install/index.php
index a8fa23c2..40856849 100644
--- a/intaro.retailcrm/install/index.php
+++ b/intaro.retailcrm/install/index.php
@@ -245,7 +245,7 @@ function DoInstall()
             COption::SetOptionString($this->MODULE_ID, Constants::CRM_API_KEY_OPTION, $api_key);
 
             if ($sites_list = COption::GetOptionString($this->OLD_MODULE_ID, Constants::CRM_SITES_LIST, 0)) {
-                $arResult['SITES_LIST'] = unserialize($sites_list);
+                $arResult['SITES_LIST'] = unserialize($sites_list, ['allowed_classes' => false]);
             }
 
             $APPLICATION->IncludeAdminFile(
@@ -453,19 +453,19 @@ function DoInstall()
             $arResult['bitrixStatusesList'] = RCrmActions::StatusesList();
 
             if ($order_types = COption::GetOptionString($this->OLD_MODULE_ID, Constants::CRM_ORDER_TYPES_ARR, 0)) {
-                $arResult['ORDER_TYPES'] = array_flip(unserialize($order_types));
+                $arResult['ORDER_TYPES'] = array_flip(unserialize($order_types, ['allowed_classes' => false]));
             }
             if ($delivery_types = COption::GetOptionString($this->OLD_MODULE_ID, Constants::CRM_DELIVERY_TYPES_ARR, 0)) {
-                $arResult['DELIVERY_TYPES'] = array_flip(unserialize($delivery_types));
+                $arResult['DELIVERY_TYPES'] = array_flip(unserialize($delivery_types, ['allowed_classes' => false]));
             }
             if ($payment_types = COption::GetOptionString($this->OLD_MODULE_ID, Constants::CRM_PAYMENT_TYPES, 0)) {
-                $arResult['PAYMENT_TYPES'] = array_flip(unserialize($payment_types));
+                $arResult['PAYMENT_TYPES'] = array_flip(unserialize($payment_types, ['allowed_classes' => false]));
             }
             if ($payment_statuses = COption::GetOptionString($this->OLD_MODULE_ID, Constants::CRM_PAYMENT_STATUSES, 0)) {
-                $arResult['PAYMENT_STATUSES'] = array_flip(unserialize($payment_statuses));
+                $arResult['PAYMENT_STATUSES'] = array_flip(unserialize($payment_statuses, ['allowed_classes' => false]));
             }
             if ($payment = COption::GetOptionString($this->OLD_MODULE_ID, Constants::CRM_PAYMENT, 0)) {
-                $arResult['PAYMENT'] = array_flip(unserialize($payment));
+                $arResult['PAYMENT'] = array_flip(unserialize($payment, ['allowed_classes' => false]));
             }
 
             $APPLICATION->IncludeAdminFile(
@@ -668,13 +668,13 @@ function DoInstall()
             }
 
             if ($orderProps = COption::GetOptionString($this->OLD_MODULE_ID, Constants::CRM_ORDER_PROPS, 0)) {
-                $arResult['ORDER_PROPS'] = unserialize($orderProps);
+                $arResult['ORDER_PROPS'] = unserialize($orderProps, ['allowed_classes' => false]);
             }
             if ($legalDetails = COption::GetOptionString($this->OLD_MODULE_ID, Constants::CRM_LEGAL_DETAILS, 0)) {
-                $arResult['LEGAL_DETAILS'] = unserialize($legalDetails);
+                $arResult['LEGAL_DETAILS'] = unserialize($legalDetails, ['allowed_classes' => false]);
             }
             if ($contragentType = COption::GetOptionString($this->OLD_MODULE_ID, Constants::CRM_CONTRAGENT_TYPE, 0)) {
-                $arResult['CONTRAGENT_TYPES'] = unserialize($contragentType);
+                $arResult['CONTRAGENT_TYPES'] = unserialize($contragentType, ['allowed_classes' => false]);
             }
 
             $APPLICATION->IncludeAdminFile(
diff --git a/intaro.retailcrm/lib/component/configprovider.php b/intaro.retailcrm/lib/component/configprovider.php
index cda06eeb..3ef6b0d3 100644
--- a/intaro.retailcrm/lib/component/configprovider.php
+++ b/intaro.retailcrm/lib/component/configprovider.php
@@ -975,7 +975,7 @@ protected static function setOption($name, $value = "", $site = ""): void
      */
     protected static function getUnserializedOption($option, $def = 0)
     {
-        return unserialize(static::getOption($option, $def));
+        return unserialize(static::getOption($option, $def), ['allowed_classes' => false]);
     }
 
     /**
diff --git a/intaro.retailcrm/lib/icml/settingsservice.php b/intaro.retailcrm/lib/icml/settingsservice.php
index 130b20db..9181cb47 100644
--- a/intaro.retailcrm/lib/icml/settingsservice.php
+++ b/intaro.retailcrm/lib/icml/settingsservice.php
@@ -805,7 +805,10 @@ public function setCatalogCustomPropsOptionName(string $catalogId): self
 
     private function getCustomProps(): ?array
     {
-        $props = unserialize(COption::GetOptionString(self::MODULE_ID, $this->catalogCustomPropsOptionName));
+        $props = unserialize(
+            COption::GetOptionString(self::MODULE_ID, $this->catalogCustomPropsOptionName),
+            ['allowed_classes' => false]
+        );
 
         if (!$props) {
             return null;
@@ -857,7 +860,10 @@ public function saveCustomProps(array $newProps): void
 
     private function getProfileCatalogs(): ?array
     {
-        $catalogs = unserialize(COption::GetOptionString(self::MODULE_ID, $this->profileCatalogsOptionName));
+        $catalogs = unserialize(
+            COption::GetOptionString(self::MODULE_ID, $this->profileCatalogsOptionName),
+            ['allowed_classes' => false]
+        );
 
         if (!$catalogs) {
             return null;
@@ -912,11 +918,17 @@ private function deleteOptionEntry(string $name)
 
     private function linkNewProfile(): void
     {
-        $currentProfileCatalogs = unserialize(COption::GetOptionString(self::MODULE_ID, $this->profileCatalogsOptionName));
+        $currentProfileCatalogs = unserialize(
+            COption::GetOptionString(self::MODULE_ID, $this->profileCatalogsOptionName),
+            ['allowed_classes' => false]
+        );
 
         if (!$currentProfileCatalogs) {
             $tmpProfileName = 'exportProfileId_0_catalogs';
-            $currentProfileCatalogs = unserialize(COption::GetOptionString(self::MODULE_ID, $tmpProfileName));
+            $currentProfileCatalogs = unserialize(
+                COption::GetOptionString(self::MODULE_ID, $tmpProfileName),
+                ['allowed_classes' => false]
+            );
 
             if ($currentProfileCatalogs) {
                 $this->setOptionEntry($this->profileCatalogsOptionName, serialize($currentProfileCatalogs));
@@ -926,11 +938,17 @@ private function linkNewProfile(): void
 
         foreach ($currentProfileCatalogs as $catalogId) {
             $optionName = sprintf('exportCustomProps_ProfileId_%s_catalogId_%s', $this->exportProfileId, $catalogId);
-            $propsCatalog = unserialize(COption::GetOptionString(self::MODULE_ID, $optionName));
+            $propsCatalog = unserialize(
+                COption::GetOptionString(self::MODULE_ID, $optionName),
+                ['allowed_classes' => false]
+            );
 
             if (!$propsCatalog) {
                 $tmpOptionName = sprintf('exportCustomProps_ProfileId_%s_catalogId_%s', '0', $catalogId);
-                $propsCatalog = unserialize(COption::GetOptionString(self::MODULE_ID, $tmpOptionName));
+                $propsCatalog = unserialize(
+                    COption::GetOptionString(self::MODULE_ID, $tmpOptionName),
+                    ['allowed_classes' => false]
+                );
 
                 if ($propsCatalog) {
                     $this->setOptionEntry($optionName, serialize($propsCatalog));
diff --git a/intaro.retailcrm/lib/service/loyaltyservice.php b/intaro.retailcrm/lib/service/loyaltyservice.php
index b861b49a..ab68f0d5 100644
--- a/intaro.retailcrm/lib/service/loyaltyservice.php
+++ b/intaro.retailcrm/lib/service/loyaltyservice.php
@@ -143,7 +143,7 @@ public function getLoyaltyCalculate(array $basketItems, float $bonuses = 0): ?Lo
 
             $prices = ConfigProvider::getCrmPrices();
             $product->priceType = new PriceType();
-            $serializePrice = unserialize($prices);
+            $serializePrice = unserialize($prices, ['allowed_classes' => false]);
 
             if (isset($serializePrice[$item['PRICE_TYPE_ID']])) {
                 $product->priceType->code = $serializePrice[$item['PRICE_TYPE_ID']];
diff --git a/intaro.retailcrm/options.php b/intaro.retailcrm/options.php
index a697caee..f83e42fe 100644
--- a/intaro.retailcrm/options.php
+++ b/intaro.retailcrm/options.php
@@ -118,7 +118,10 @@
         die(json_encode(['success' => false, 'errMsg' => $e->getCode()]));
     }
 
-    $optionsDelivTypes    = unserialize(COption::GetOptionString($mid, Constants::CRM_DELIVERY_TYPES_ARR, 0));
+    $optionsDelivTypes    = unserialize(
+        COption::GetOptionString($mid, Constants::CRM_DELIVERY_TYPES_ARR, 0),
+        ['allowed_classes' => false]
+    );
     $arDeliveryServiceAll = Manager::getActiveList();
 
     foreach ($optionsDelivTypes as $key => $deliveryType) {
@@ -792,8 +795,14 @@ function maskCorp($var) {
 
         RCrmActions::sendConfiguration($api, false);
     } else {
-        $deactivateAgents = unserialize(COption::GetOptionString($mid, Constants::AGENTS_DEACTIVATE, ''));
-        $deactivateEvents = unserialize(COption::GetOptionString($mid, Constants::EVENTS_DEACTIVATE, ''));
+        $deactivateAgents = unserialize(
+            COption::GetOptionString($mid, Constants::AGENTS_DEACTIVATE, ''),
+            ['allowed_classes' => false]
+        );
+        $deactivateEvents = unserialize(
+            COption::GetOptionString($mid, Constants::EVENTS_DEACTIVATE, ''),
+            ['allowed_classes' => false]
+        );
 
         if (!empty($deactivateAgents)) {
             $dateAgent = new DateTime();
@@ -1320,39 +1329,39 @@ function ($payment) {
 
     //saved params
     $useCrmOrderMethods = ConfigProvider::useCrmOrderMethods();
-    $crmOrderMethods = unserialize(COption::GetOptionString($mid, Constants::CRM_ORDER_METHODS, 0));
-    $moduleDeactivate = unserialize(COption::GetOptionString($mid, Constants::MODULE_DEACTIVATE, 'N'));
-    $optionsOrderTypes = unserialize(COption::GetOptionString($mid, Constants::CRM_ORDER_TYPES_ARR, 0));
-    $optionsDelivTypes = unserialize(COption::GetOptionString($mid, Constants::CRM_DELIVERY_TYPES_ARR, 0));
-    $optionsPayTypes = unserialize(COption::GetOptionString($mid, Constants::CRM_PAYMENT_TYPES, 0));
-    $optionsPayStatuses = unserialize(COption::GetOptionString($mid, Constants::CRM_PAYMENT_STATUSES, 0));
-    $optionsPayment = unserialize(COption::GetOptionString($mid, Constants::CRM_PAYMENT, 0));
-    $optionsSitesList = unserialize(COption::GetOptionString($mid, Constants::CRM_SITES_LIST, 0));
+    $crmOrderMethods = unserialize(COption::GetOptionString($mid, Constants::CRM_ORDER_METHODS, 0), ['allowed_classes' => false]);
+    $moduleDeactivate = unserialize(COption::GetOptionString($mid, Constants::MODULE_DEACTIVATE, 'N'), ['allowed_classes' => false]);
+    $optionsOrderTypes = unserialize(COption::GetOptionString($mid, Constants::CRM_ORDER_TYPES_ARR, 0), ['allowed_classes' => false]);
+    $optionsDelivTypes = unserialize(COption::GetOptionString($mid, Constants::CRM_DELIVERY_TYPES_ARR, 0), ['allowed_classes' => false]);
+    $optionsPayTypes = unserialize(COption::GetOptionString($mid, Constants::CRM_PAYMENT_TYPES, 0), ['allowed_classes' => false]);
+    $optionsPayStatuses = unserialize(COption::GetOptionString($mid, Constants::CRM_PAYMENT_STATUSES, 0), ['allowed_classes' => false]);
+    $optionsPayment = unserialize(COption::GetOptionString($mid, Constants::CRM_PAYMENT, 0), ['allowed_classes' => false]);
+    $optionsSitesList = unserialize(COption::GetOptionString($mid, Constants::CRM_SITES_LIST, 0), ['allowed_classes' => false]);
     $optionsDischarge = (int) COption::GetOptionString($mid, Constants::CRM_ORDER_DISCHARGE, 0);
-    $optionsOrderProps = unserialize(COption::GetOptionString($mid, Constants::CRM_ORDER_PROPS, 0));
-    $optionsContragentType = unserialize(COption::GetOptionString($mid, Constants::CRM_CONTRAGENT_TYPE, 0));
-    $optionsLegalDetails = unserialize(COption::GetOptionString($mid, Constants::CRM_LEGAL_DETAILS, 0));
-    $optionsCustomFields = unserialize(COption::GetOptionString($mid, Constants::CRM_CUSTOM_FIELDS, 0));
+    $optionsOrderProps = unserialize(COption::GetOptionString($mid, Constants::CRM_ORDER_PROPS, 0), ['allowed_classes' => false]);
+    $optionsContragentType = unserialize(COption::GetOptionString($mid, Constants::CRM_CONTRAGENT_TYPE, 0), ['allowed_classes' => false]);
+    $optionsLegalDetails = unserialize(COption::GetOptionString($mid, Constants::CRM_LEGAL_DETAILS, 0), ['allowed_classes' => false]);
+    $optionsCustomFields = unserialize(COption::GetOptionString($mid, Constants::CRM_CUSTOM_FIELDS, 0), ['allowed_classes' => false]);
     $optionsOrderNumbers = COption::GetOptionString($mid, Constants::CRM_ORDER_NUMBERS, 0);
     $optionsOrderVat = COption::GetOptionString($mid, Constants::CRM_ORDER_VAT, 0);
     $optionsOrderTrackNumber = ConfigProvider::getTrackNumberStatus();
     $optionsSyncIntegrationPayment = ConfigProvider::getSyncIntegrationPayment();
-    $canselOrderArr = unserialize(COption::GetOptionString($mid, Constants::CRM_CANCEL_ORDER, 0));
+    $canselOrderArr = unserialize(COption::GetOptionString($mid, Constants::CRM_CANCEL_ORDER, 0), ['allowed_classes' => false]);
     $sendPickupPointAddress = COption::GetOptionString($mid, Constants::CRM_SEND_PICKUP_POINT_ADDRESS, 'N');
 
     $optionInventotiesUpload = COption::GetOptionString($mid, Constants::CRM_INVENTORIES_UPLOAD, 0);
-    $optionStores = unserialize(COption::GetOptionString($mid, Constants::CRM_STORES, 0));
-    $optionShops = unserialize(COption::GetOptionString($mid, Constants::CRM_SHOPS, 0));
-    $optionIblocksInventories = unserialize(COption::GetOptionString($mid, Constants::CRM_IBLOCKS_INVENTORIES, 0));
-    $optionShopsCorporate = unserialize(COption::GetOptionString($mid, Constants::CRM_SHOPS, 0));
+    $optionStores = unserialize(COption::GetOptionString($mid, Constants::CRM_STORES, 0), ['allowed_classes' => false]);
+    $optionShops = unserialize(COption::GetOptionString($mid, Constants::CRM_SHOPS, 0), ['allowed_classes' => false]);
+    $optionIblocksInventories = unserialize(COption::GetOptionString($mid, Constants::CRM_IBLOCKS_INVENTORIES, 0), ['allowed_classes' => false]);
+    $optionShopsCorporate = unserialize(COption::GetOptionString($mid, Constants::CRM_SHOPS, 0), ['allowed_classes' => false]);
 
     $optionPricesUpload = COption::GetOptionString($mid, Constants::CRM_PRICES_UPLOAD, 0);
-    $optionPrices = unserialize(COption::GetOptionString($mid, Constants::CRM_PRICES, 0));
-    $optionPriceShops = unserialize(COption::GetOptionString($mid, Constants::CRM_PRICE_SHOPS, 0));
-    $optionIblocksPrices = unserialize(COption::GetOptionString($mid, Constants::CRM_IBLOCKS_PRICES, 0));
+    $optionPrices = unserialize(COption::GetOptionString($mid, Constants::CRM_PRICES, 0), ['allowed_classes' => false]);
+    $optionPriceShops = unserialize(COption::GetOptionString($mid, Constants::CRM_PRICE_SHOPS, 0), ['allowed_classes' => false]);
+    $optionIblocksPrices = unserialize(COption::GetOptionString($mid, Constants::CRM_IBLOCKS_PRICES, 0), ['allowed_classes' => false]);
 
     $optionCollector = COption::GetOptionString($mid, Constants::CRM_COLLECTOR, 0);
-    $optionCollectorKeys = unserialize(COption::GetOptionString($mid, Constants::CRM_COLL_KEY));
+    $optionCollectorKeys = unserialize(COption::GetOptionString($mid, Constants::CRM_COLL_KEY), ['allowed_classes' => false]);
 
     $optionOnlineConsultant = RetailcrmConfigProvider::isOnlineConsultantEnabled();
     $optionOnlineConsultantScript = RetailcrmConfigProvider::getOnlineConsultantScript();
@@ -1361,7 +1370,7 @@ function ($payment) {
     $optionEventTrackerOpenCart= RetailcrmConfigProvider::isEventTrackerOpenCartEnabled();
 
     $optionUa = COption::GetOptionString($mid, Constants::CRM_UA, 0);
-    $optionUaKeys = unserialize(COption::GetOptionString($mid, Constants::CRM_UA_KEYS));
+    $optionUaKeys = unserialize(COption::GetOptionString($mid, Constants::CRM_UA_KEYS), ['allowed_classes' => false]);
 
     $optionDiscRound = COption::GetOptionString($mid, Constants::CRM_DISCOUNT_ROUND, 0);
     $optionPricePrchaseNull = COption::GetOptionString($mid, Constants::CRM_PURCHASE_PRICE_NULL, 0);
@@ -1369,7 +1378,7 @@ function ($payment) {
 
     //corporate-cliente
     $optionCorpClient = COption::GetOptionString($mid, Constants::CRM_CC, 0);
-    $optionCorpShops = unserialize(COption::GetOptionString($mid, Constants::CRM_CORP_SHOPS, 0));
+    $optionCorpShops = unserialize(COption::GetOptionString($mid, Constants::CRM_CORP_SHOPS, 0), ['allowed_classes' => false]);
     $optionsCorpComName = COption::GetOptionString($mid, Constants::CRM_CORP_NAME, 0);
     $optionsCorpAdres = COption::GetOptionString($mid, Constants::CRM_CORP_ADDRESS, 0);
 
@@ -1446,7 +1455,7 @@ function ($payment) {
     } while($getCustomFields['pagination']['currentPage'] < $getCustomFields['pagination']['totalPageCount']);
 
     $optionsOrderDimensions = COption::GetOptionString($mid, Constants::CRM_DIMENSIONS, 'N');
-    $addressOptions = unserialize(COption::GetOptionString($mid, Constants::CRM_ADDRESS_OPTIONS, 0));
+    $addressOptions = unserialize(COption::GetOptionString($mid, Constants::CRM_ADDRESS_OPTIONS, 0), ['allowed_classes' => false]);
 
     $optionCart = COption::GetOptionString($mid, Constants::CART, 'N');
 

From ce5719eb52ae24f0d2f32ea78a7d5ed1a0a7fe1f Mon Sep 17 00:00:00 2001
From: ellynoize <na1ton.trik@gmail.com>
Date: Wed, 17 Jun 2026 14:26:49 +0300
Subject: [PATCH 02/10] issue 1

---
 intaro.retailcrm/lib/controller/loyalty/order.php    | 5 +++++
 intaro.retailcrm/lib/controller/loyalty/register.php | 7 +++++++
 2 files changed, 12 insertions(+)

diff --git a/intaro.retailcrm/lib/controller/loyalty/order.php b/intaro.retailcrm/lib/controller/loyalty/order.php
index 732551ea..2e17a080 100644
--- a/intaro.retailcrm/lib/controller/loyalty/order.php
+++ b/intaro.retailcrm/lib/controller/loyalty/order.php
@@ -195,6 +195,11 @@ private function isOrderCheckIdValid(int $orderId, string $checkId): bool
     public function configureActions(): array
     {
         return [
+            'loyaltyCalculate' => [
+                'prefilters' => [
+                    new HttpMethod([HttpMethod::METHOD_POST]),
+                ],
+            ],
             'sendVerificationCode' => [
                 'prefilters' => [
                     new Authentication(),
diff --git a/intaro.retailcrm/lib/controller/loyalty/register.php b/intaro.retailcrm/lib/controller/loyalty/register.php
index 5001961b..febf28c0 100644
--- a/intaro.retailcrm/lib/controller/loyalty/register.php
+++ b/intaro.retailcrm/lib/controller/loyalty/register.php
@@ -55,6 +55,13 @@ public function __construct(Request $request = null)
     public function configureActions(): array
     {
         return [
+            'accountCreate' => [
+                'prefilters' => [
+                    new Authentication(),
+                    new HttpMethod([HttpMethod::METHOD_POST]),
+                    new Csrf(),
+                ],
+            ],
             'saveUserLpFields' => [
                 'prefilters' => [
                     new Authentication(),

From e1759848eac978da52b624c2bfa250df37601b9a Mon Sep 17 00:00:00 2001
From: ellynoize <na1ton.trik@gmail.com>
Date: Wed, 17 Jun 2026 14:41:26 +0300
Subject: [PATCH 03/10] issue 4

---
 intaro.retailcrm/classes/general/Logger.php | 14 ++++++++++----
 1 file changed, 10 insertions(+), 4 deletions(-)

diff --git a/intaro.retailcrm/classes/general/Logger.php b/intaro.retailcrm/classes/general/Logger.php
index 75c5f687..18982377 100644
--- a/intaro.retailcrm/classes/general/Logger.php
+++ b/intaro.retailcrm/classes/general/Logger.php
@@ -62,12 +62,18 @@ public function write($dump, $file = 'info')
     {
         $rsSites = CSite::GetList($by, $sort, array('DEFAULT' => 'Y'));
         $ar = $rsSites->Fetch();
+        $logDir = $ar['ABS_DOC_ROOT'] . $this->logPath . '/';
 
-        if (!is_dir($ar['ABS_DOC_ROOT'] . $this->logPath . '/')) {
-            mkdir($ar['ABS_DOC_ROOT'] . $this->logPath . '/');
+        if (!is_dir($logDir)) {
+            mkdir($logDir, 0755, true);
         }
-        
-        $file = $ar['ABS_DOC_ROOT'] . $this->logPath . '/' . $file . '.log';
+
+        $htaccessPath = $logDir . '.htaccess';
+        if (!file_exists($htaccessPath)) {
+            file_put_contents($htaccessPath, "Deny from All\n");
+        }
+
+        $file = $logDir . $file . '.log';
 
         $data['TIME'] = date('Y-m-d H:i:s');
         $data['DATA'] = $dump;

From 897f9a459c0ec51a9946ed88643f6b977fb9557d Mon Sep 17 00:00:00 2001
From: ellynoize <na1ton.trik@gmail.com>
Date: Wed, 17 Jun 2026 14:45:08 +0300
Subject: [PATCH 04/10] issue 3

---
 .../lib/controller/loyalty/register.php       | 21 +++++++++++++++++++
 1 file changed, 21 insertions(+)

diff --git a/intaro.retailcrm/lib/controller/loyalty/register.php b/intaro.retailcrm/lib/controller/loyalty/register.php
index febf28c0..def3ed5c 100644
--- a/intaro.retailcrm/lib/controller/loyalty/register.php
+++ b/intaro.retailcrm/lib/controller/loyalty/register.php
@@ -62,6 +62,27 @@ public function configureActions(): array
                     new Csrf(),
                 ],
             ],
+            'resendRegisterSms' => [
+                'prefilters' => [
+                    new Authentication(),
+                    new HttpMethod([HttpMethod::METHOD_POST]),
+                    new Csrf(),
+                ],
+            ],
+            'activateLpBySms' => [
+                'prefilters' => [
+                    new Authentication(),
+                    new HttpMethod([HttpMethod::METHOD_POST]),
+                    new Csrf(),
+                ],
+            ],
+            'activateAccount' => [
+                'prefilters' => [
+                    new Authentication(),
+                    new HttpMethod([HttpMethod::METHOD_POST]),
+                    new Csrf(),
+                ],
+            ],
             'saveUserLpFields' => [
                 'prefilters' => [
                     new Authentication(),

From c4fcfa6595da06762c315b23200f672ecb821a44 Mon Sep 17 00:00:00 2001
From: ellynoize <na1ton.trik@gmail.com>
Date: Wed, 17 Jun 2026 14:49:22 +0300
Subject: [PATCH 05/10] issue 7

---
 .../consultant/RetailCrmOnlineConsultant.php  | 12 ++++-
 .../lib/component/configprovider.php          | 54 ++++++++++++++++++-
 intaro.retailcrm/options.php                  |  4 +-
 3 files changed, 65 insertions(+), 5 deletions(-)

diff --git a/intaro.retailcrm/classes/general/consultant/RetailCrmOnlineConsultant.php b/intaro.retailcrm/classes/general/consultant/RetailCrmOnlineConsultant.php
index ee123abc..fe195b52 100644
--- a/intaro.retailcrm/classes/general/consultant/RetailCrmOnlineConsultant.php
+++ b/intaro.retailcrm/classes/general/consultant/RetailCrmOnlineConsultant.php
@@ -25,10 +25,18 @@ class RetailCrmOnlineConsultant
     public static function add()
     {
         $request = \Bitrix\Main\Context::getCurrent()->getRequest();
+        $scriptUrl = RetailcrmConfigProvider::getOnlineConsultantScriptUrl();
 
-        if (RetailcrmConfigProvider::isOnlineConsultantEnabled() && $request->isAdminSection() !== true) {
+        if (
+            RetailcrmConfigProvider::isOnlineConsultantEnabled()
+            && $request->isAdminSection() !== true
+            && $scriptUrl !== ''
+        ) {
             \Bitrix\Main\Page\Asset::getInstance()->addString(
-                RetailcrmConfigProvider::getOnlineConsultantScript(), 
+                sprintf(
+                    '<script async src="%s"></script>',
+                    htmlspecialcharsbx($scriptUrl)
+                ),
                 true
             );
             
diff --git a/intaro.retailcrm/lib/component/configprovider.php b/intaro.retailcrm/lib/component/configprovider.php
index 3ef6b0d3..a10339e6 100644
--- a/intaro.retailcrm/lib/component/configprovider.php
+++ b/intaro.retailcrm/lib/component/configprovider.php
@@ -1000,6 +1000,11 @@ public static function getOnlineConsultantScript(): string
         return trim(static::getOption(Constants::CRM_ONLINE_CONSULTANT_SCRIPT, ""));
     }
 
+    public static function getOnlineConsultantScriptUrl(): string
+    {
+        return static::extractAllowedOnlineConsultantUrl(static::getOnlineConsultantScript());
+    }
+
     public static function isEventTrackerEnabled(): bool
     {
         return static::getOption(Constants::CRM_EVENT_TRACKER) === 'Y';
@@ -1023,7 +1028,10 @@ public static function setOnlineConsultant(string $value)
 
     public static function setOnlineConsultantScript(string $value)
     {
-        static::setOption(Constants::CRM_ONLINE_CONSULTANT_SCRIPT, $value);
+        static::setOption(
+            Constants::CRM_ONLINE_CONSULTANT_SCRIPT,
+            static::extractAllowedOnlineConsultantUrl($value)
+        );
     }
 
     public static function setEventTracker(string $value)
@@ -1031,6 +1039,50 @@ public static function setEventTracker(string $value)
         static::setOption(Constants::CRM_EVENT_TRACKER, $value);
     }
 
+    private static function extractAllowedOnlineConsultantUrl(string $value): string
+    {
+        $value = trim($value);
+
+        if ($value === '') {
+            return '';
+        }
+
+        $candidates = [];
+
+        if (filter_var($value, FILTER_VALIDATE_URL)) {
+            $candidates[] = $value;
+        }
+
+        if (preg_match_all('~https://[^\s\'"<>]+~i', $value, $matches)) {
+            $candidates = array_merge($candidates, $matches[0]);
+        }
+
+        $allowedDomains = [
+            'retailcrm.ru',
+            'retailcrm.pro',
+            'retailcrm.es',
+            'retailcrm.tech',
+        ];
+
+        foreach (array_unique($candidates) as $candidate) {
+            $parsedUrl = parse_url($candidate);
+            $host = strtolower((string) ($parsedUrl['host'] ?? ''));
+            $scheme = strtolower((string) ($parsedUrl['scheme'] ?? ''));
+
+            if ($host === '' || $scheme !== 'https') {
+                continue;
+            }
+
+            foreach ($allowedDomains as $domain) {
+                if ($host === $domain || substr($host, -strlen('.' . $domain)) === '.' . $domain) {
+                    return $candidate;
+                }
+            }
+        }
+
+        return '';
+    }
+
     public static function setEventTrackerCart(string $value)
     {
         static::setOption(Constants::CRM_EVENT_TRACKER_CART, $value);
diff --git a/intaro.retailcrm/options.php b/intaro.retailcrm/options.php
index f83e42fe..9ec847bf 100644
--- a/intaro.retailcrm/options.php
+++ b/intaro.retailcrm/options.php
@@ -610,7 +610,7 @@ function maskPrice($var) {
     //online_consultant
     if (htmlspecialchars(trim($_POST['online_consultant'] === 'Y'))) {
         $onlineConsultant = 'Y';
-        $onlineConsultantScript = trim($_POST['online_consultant_script']);
+        $onlineConsultantScript = trim((string) ($_POST['online_consultant_script'] ?? ''));
         RegisterModuleDependences("main", "OnBeforeProlog", $mid, "RetailCrmOnlineConsultant", "add");
     } else {
         $onlineConsultant = 'N';
@@ -3538,7 +3538,7 @@ function customerFixDate() {
                     <?php echo GetMessage('ONLINE_CONSULTANT_AND_EVENT_TRACKER_LABEL')?>
                 </td>
                 <td class="adm-detail-content-cell-r" width="55%">
-                    <textarea name="online_consultant_script" style="width: 300px; height: 200px;"><?php echo $optionOnlineConsultantScript; ?></textarea>
+                    <textarea name="online_consultant_script" style="width: 300px; height: 200px;"><?php echo htmlspecialcharsbx((string) $optionOnlineConsultantScript); ?></textarea>
 
                     <div id="event_tracker_container" style="margin-top: 10px; display: none;">
                         <label style="display: block; margin-top: 8px;">

From 53843c43c2071703b76d7644ba851bf360998972 Mon Sep 17 00:00:00 2001
From: ellynoize <na1ton.trik@gmail.com>
Date: Wed, 17 Jun 2026 15:01:13 +0300
Subject: [PATCH 06/10] issue 7.1

---
 .../consultant/RetailCrmOnlineConsultant.php  |  9 ++--
 .../lib/component/configprovider.php          | 53 +++++++++++++++++--
 intaro.retailcrm/options.php                  | 19 ++++++-
 3 files changed, 70 insertions(+), 11 deletions(-)

diff --git a/intaro.retailcrm/classes/general/consultant/RetailCrmOnlineConsultant.php b/intaro.retailcrm/classes/general/consultant/RetailCrmOnlineConsultant.php
index fe195b52..658245c8 100644
--- a/intaro.retailcrm/classes/general/consultant/RetailCrmOnlineConsultant.php
+++ b/intaro.retailcrm/classes/general/consultant/RetailCrmOnlineConsultant.php
@@ -25,18 +25,15 @@ class RetailCrmOnlineConsultant
     public static function add()
     {
         $request = \Bitrix\Main\Context::getCurrent()->getRequest();
-        $scriptUrl = RetailcrmConfigProvider::getOnlineConsultantScriptUrl();
+        $script = RetailcrmConfigProvider::getOnlineConsultantScript();
 
         if (
             RetailcrmConfigProvider::isOnlineConsultantEnabled()
             && $request->isAdminSection() !== true
-            && $scriptUrl !== ''
+            && $script !== ''
         ) {
             \Bitrix\Main\Page\Asset::getInstance()->addString(
-                sprintf(
-                    '<script async src="%s"></script>',
-                    htmlspecialcharsbx($scriptUrl)
-                ),
+                $script,
                 true
             );
             
diff --git a/intaro.retailcrm/lib/component/configprovider.php b/intaro.retailcrm/lib/component/configprovider.php
index a10339e6..30697e04 100644
--- a/intaro.retailcrm/lib/component/configprovider.php
+++ b/intaro.retailcrm/lib/component/configprovider.php
@@ -997,12 +997,16 @@ public static function isOnlineConsultantEnabled(): bool
 
     public static function getOnlineConsultantScript(): string
     {
-        return trim(static::getOption(Constants::CRM_ONLINE_CONSULTANT_SCRIPT, ""));
+        return static::buildAllowedOnlineConsultantScript(
+            trim(static::getOption(Constants::CRM_ONLINE_CONSULTANT_SCRIPT, ""))
+        );
     }
 
     public static function getOnlineConsultantScriptUrl(): string
     {
-        return static::extractAllowedOnlineConsultantUrl(static::getOnlineConsultantScript());
+        return static::extractAllowedOnlineConsultantUrl(
+            trim(static::getOption(Constants::CRM_ONLINE_CONSULTANT_SCRIPT, ""))
+        );
     }
 
     public static function isEventTrackerEnabled(): bool
@@ -1030,7 +1034,7 @@ public static function setOnlineConsultantScript(string $value)
     {
         static::setOption(
             Constants::CRM_ONLINE_CONSULTANT_SCRIPT,
-            static::extractAllowedOnlineConsultantUrl($value)
+            static::buildAllowedOnlineConsultantScript($value)
         );
     }
 
@@ -1039,6 +1043,38 @@ public static function setEventTracker(string $value)
         static::setOption(Constants::CRM_EVENT_TRACKER, $value);
     }
 
+    private static function buildAllowedOnlineConsultantScript(string $value): string
+    {
+        $url = static::extractAllowedOnlineConsultantUrl($value);
+        $rcct = static::extractOnlineConsultantToken($value);
+
+        if ($url === '') {
+            return '';
+        }
+
+        $scriptParts = [];
+
+        if ($rcct !== '') {
+            $scriptParts[] = sprintf(
+                '<script>var _rcct = "%s";</script>',
+                htmlspecialcharsbx($rcct)
+            );
+        }
+
+        $scriptParts[] = sprintf('<script async src="%s"></script>', htmlspecialcharsbx($url));
+
+        return implode('', $scriptParts);
+    }
+
+    private static function extractOnlineConsultantToken(string $value): string
+    {
+        if (!preg_match('/_rcct\s*=\s*[\'"]([A-Za-z0-9_-]+)[\'"]/i', $value, $matches)) {
+            return '';
+        }
+
+        return (string) ($matches[1] ?? '');
+    }
+
     private static function extractAllowedOnlineConsultantUrl(string $value): string
     {
         $value = trim($value);
@@ -1053,7 +1089,7 @@ private static function extractAllowedOnlineConsultantUrl(string $value): string
             $candidates[] = $value;
         }
 
-        if (preg_match_all('~https://[^\s\'"<>]+~i', $value, $matches)) {
+        if (preg_match_all('~(?:https:)?//[^\s\'"<>]+~i', $value, $matches)) {
             $candidates = array_merge($candidates, $matches[0]);
         }
 
@@ -1065,14 +1101,23 @@ private static function extractAllowedOnlineConsultantUrl(string $value): string
         ];
 
         foreach (array_unique($candidates) as $candidate) {
+            if (strpos($candidate, '//') === 0) {
+                $candidate = 'https:' . $candidate;
+            }
+
             $parsedUrl = parse_url($candidate);
             $host = strtolower((string) ($parsedUrl['host'] ?? ''));
             $scheme = strtolower((string) ($parsedUrl['scheme'] ?? ''));
+            $path = (string) ($parsedUrl['path'] ?? '');
 
             if ($host === '' || $scheme !== 'https') {
                 continue;
             }
 
+            if (strpos($path, '/widget/loader.js') === false) {
+                continue;
+            }
+
             foreach ($allowedDomains as $domain) {
                 if ($host === $domain || substr($host, -strlen('.' . $domain)) === '.' . $domain) {
                     return $candidate;
diff --git a/intaro.retailcrm/options.php b/intaro.retailcrm/options.php
index 9ec847bf..c44fb065 100644
--- a/intaro.retailcrm/options.php
+++ b/intaro.retailcrm/options.php
@@ -3495,11 +3495,28 @@ function customerFixDate() {
                     warning.style = 'color:red; margin-top:5px; display:none;';
                     warning.textContent = '<?php echo GetMessage('ONLINE_CONSULTANT_AND_EVENT_TRACKER_CODE_WARNING')?>';
                     textarea.insertAdjacentElement('afterend', warning);
+                    const allowedDomains = ['retailcrm.ru', 'retailcrm.pro', 'retailcrm.es', 'retailcrm.tech'];
 
                     const renderEventCheckboxes = () => {
                         const textareaValue = textarea.value.trim();
                         const hasCode = textareaValue !== '';
-                        const hasWidget = textareaValue.includes('c.retailcrm.tech/widget/loader.js');
+                        const urlMatches = textareaValue.match(/(?:https:)?\/\/[^\s'"<>]+/g) || [];
+                        const hasWidget = urlMatches.some((url) => {
+                            try {
+                                const normalizedUrl = url.startsWith('//') ? 'https:' + url : url;
+                                const parsedUrl = new URL(normalizedUrl);
+                                const host = parsedUrl.hostname.toLowerCase();
+                                const hasAllowedDomain = allowedDomains.some((domain) =>
+                                    host === domain || host.endsWith('.' + domain)
+                                );
+
+                                return parsedUrl.protocol === 'https:'
+                                    && hasAllowedDomain
+                                    && parsedUrl.pathname.includes('/widget/loader.js');
+                            } catch (e) {
+                                return false;
+                            }
+                        });
                         const canRenderElements = eventTrackerCheckbox.checked && hasCode && hasWidget;
 
                         warning.style.display = (!hasWidget && hasCode) ? 'block' : 'none';

From c8d2530106c8d20553db575bc44da76258927b19 Mon Sep 17 00:00:00 2001
From: ellynoize <na1ton.trik@gmail.com>
Date: Wed, 17 Jun 2026 15:06:14 +0300
Subject: [PATCH 07/10] issue 2

---
 .../lib/controller/loyalty/basket.php            | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/intaro.retailcrm/lib/controller/loyalty/basket.php b/intaro.retailcrm/lib/controller/loyalty/basket.php
index 8784954b..d966550a 100644
--- a/intaro.retailcrm/lib/controller/loyalty/basket.php
+++ b/intaro.retailcrm/lib/controller/loyalty/basket.php
@@ -11,6 +11,9 @@
 
 namespace Intaro\RetailCrm\Controller\Loyalty;
 
+use Bitrix\Main\Engine\ActionFilter\Authentication;
+use Bitrix\Main\Engine\ActionFilter\Csrf;
+use Bitrix\Main\Engine\ActionFilter\HttpMethod;
 use Bitrix\Main\Engine\Controller;
 use Bitrix\Main\Request;
 use Exception;
@@ -38,6 +41,19 @@ public function __construct(Request $request = null)
         parent::__construct($request);
     }
 
+    public function configureActions(): array
+    {
+        return [
+            'addLoyaltyToBasket' => [
+                'prefilters' => [
+                    new Authentication(),
+                    new HttpMethod([HttpMethod::METHOD_POST]),
+                    new Csrf(),
+                ],
+            ],
+        ];
+    }
+
     /**
      * Добавляет данные, полученные при расчете привилегии, в массив корзины
      *

From eb968e4e7d44d02403d48d552dbead5b71caf058 Mon Sep 17 00:00:00 2001
From: ellynoize <na1ton.trik@gmail.com>
Date: Wed, 17 Jun 2026 15:10:20 +0300
Subject: [PATCH 08/10] after review

---
 CHANGELOG.md                                      | 3 +++
 intaro.retailcrm/lib/component/configprovider.php | 7 -------
 2 files changed, 3 insertions(+), 7 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index b4af81b3..847b9f20 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,3 +1,6 @@
+## 2026-06-17 v6.8.1
+- Исправлены замечания по безопасности модуля. Устанены уязвимости после проверки приложения на Маркетплейсе.
+
 ## 2026-06-16 v6.8.0
 - Исправлены замечания по безопасности модуля. Устранены уязвимости Authentication Bypass, IDOR и SSRF. Снижены риски CSRF, XSS и Information Disclosure. Усилены проверки доступа и обработки пользовательских данных.
 
diff --git a/intaro.retailcrm/lib/component/configprovider.php b/intaro.retailcrm/lib/component/configprovider.php
index 30697e04..88c4d135 100644
--- a/intaro.retailcrm/lib/component/configprovider.php
+++ b/intaro.retailcrm/lib/component/configprovider.php
@@ -1002,13 +1002,6 @@ public static function getOnlineConsultantScript(): string
         );
     }
 
-    public static function getOnlineConsultantScriptUrl(): string
-    {
-        return static::extractAllowedOnlineConsultantUrl(
-            trim(static::getOption(Constants::CRM_ONLINE_CONSULTANT_SCRIPT, ""))
-        );
-    }
-
     public static function isEventTrackerEnabled(): bool
     {
         return static::getOption(Constants::CRM_EVENT_TRACKER) === 'Y';

From caae686563897d379e6b2ca909e133dc7b1725e1 Mon Sep 17 00:00:00 2001
From: ellynoize <na1ton.trik@gmail.com>
Date: Wed, 17 Jun 2026 15:12:48 +0300
Subject: [PATCH 09/10] bump

---
 CHANGELOG.md                                 | 2 +-
 intaro.retailcrm/description.ru              | 2 +-
 intaro.retailcrm/install/version.php         | 4 ++--
 intaro.retailcrm/lib/component/constants.php | 2 +-
 4 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 847b9f20..412f5394 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,5 @@
 ## 2026-06-17 v6.8.1
-- Исправлены замечания по безопасности модуля. Устанены уязвимости после проверки приложения на Маркетплейсе.
+- Исправлены замечания по безопасности модуля. Устранены уязвимости после проверки приложения на Маркетплейсе.
 
 ## 2026-06-16 v6.8.0
 - Исправлены замечания по безопасности модуля. Устранены уязвимости Authentication Bypass, IDOR и SSRF. Снижены риски CSRF, XSS и Information Disclosure. Усилены проверки доступа и обработки пользовательских данных.
diff --git a/intaro.retailcrm/description.ru b/intaro.retailcrm/description.ru
index 3761b2f5..ebb585df 100644
--- a/intaro.retailcrm/description.ru
+++ b/intaro.retailcrm/description.ru
@@ -1 +1 @@
-- Исправлены замечания по безопасности модуля. Устранены уязвимости Authentication Bypass, IDOR и SSRF. Снижены риски CSRF, XSS и Information Disclosure. Усилены проверки доступа и обработки пользовательских данных.
+- Исправлены замечания по безопасности модуля. Устранены уязвимости после проверки приложения на Маркетплейсе.
diff --git a/intaro.retailcrm/install/version.php b/intaro.retailcrm/install/version.php
index 2ff06158..20416a20 100644
--- a/intaro.retailcrm/install/version.php
+++ b/intaro.retailcrm/install/version.php
@@ -1,6 +1,6 @@
 <?php
 
 $arModuleVersion = [
-    'VERSION'      => '6.8.0',
-    'VERSION_DATE' => '2026-06-16 12:00:00'
+    'VERSION'      => '6.8.1',
+    'VERSION_DATE' => '2026-06-17 12:00:00'
 ];
diff --git a/intaro.retailcrm/lib/component/constants.php b/intaro.retailcrm/lib/component/constants.php
index 855cc6a4..f3b3851b 100644
--- a/intaro.retailcrm/lib/component/constants.php
+++ b/intaro.retailcrm/lib/component/constants.php
@@ -18,7 +18,7 @@
  */
 class Constants
 {
-    public const MODULE_VERSION = '6.8.0';
+    public const MODULE_VERSION = '6.8.1';
     public const CRM_PURCHASE_PRICE_NULL = 'purchasePrice_null';
     public const BITRIX_USER_ID_PREFIX = 'bitrixUserId-';
     public const CRM_USERS_MAP = 'crm_users_map';

From b7768c0772b44d4c655006cbb370ad723c14bd26 Mon Sep 17 00:00:00 2001
From: Uryvskiy Dima <uryvskiydima@gmail.com>
Date: Thu, 18 Jun 2026 11:55:41 +0300
Subject: [PATCH 10/10] Fix remaining security review issues

---
 intaro.retailcrm/classes/general/Logger.php   | 24 +++--
 .../classes/general/RCrmActions.php           |  2 +-
 .../templates/.default/template.php           | 12 ++-
 .../lib/component/configprovider.php          | 88 ++++++-------------
 intaro.retailcrm/options.php                  |  2 +-
 5 files changed, 58 insertions(+), 70 deletions(-)

diff --git a/intaro.retailcrm/classes/general/Logger.php b/intaro.retailcrm/classes/general/Logger.php
index 18982377..b837fe86 100644
--- a/intaro.retailcrm/classes/general/Logger.php
+++ b/intaro.retailcrm/classes/general/Logger.php
@@ -68,18 +68,13 @@ public function write($dump, $file = 'info')
             mkdir($logDir, 0755, true);
         }
 
-        $htaccessPath = $logDir . '.htaccess';
-        if (!file_exists($htaccessPath)) {
-            file_put_contents($htaccessPath, "Deny from All\n");
-        }
-
         $file = $logDir . $file . '.log';
 
         $data['TIME'] = date('Y-m-d H:i:s');
         $data['DATA'] = $dump;
 
         $f = fopen($file, "a+");
-        fwrite($f, print_r($data, true));
+        fwrite($f, $this->maskSensitiveData(print_r($data, true)));
         fclose($f);
 
         // if filesize more than 5 Mb rotate it
@@ -125,4 +120,21 @@ private function clean($file)
     {
         file_put_contents($file, '');
     }
+
+    private function maskSensitiveData($data)
+    {
+        $sensitiveKeys = 'api[_-]?key|token|access[_-]?token|password|passwd|secret|authorization';
+
+        $data = preg_replace(
+            '/(\[(?:' . $sensitiveKeys . ')\]\s*=>\s*)[^\r\n]*/i',
+            '$1[masked]',
+            $data
+        );
+
+        return preg_replace(
+            '/([?&](?:' . $sensitiveKeys . ')=)[^&\s"\']+/i',
+            '$1[masked]',
+            $data
+        );
+    }
 }
diff --git a/intaro.retailcrm/classes/general/RCrmActions.php b/intaro.retailcrm/classes/general/RCrmActions.php
index 52199512..1e431834 100644
--- a/intaro.retailcrm/classes/general/RCrmActions.php
+++ b/intaro.retailcrm/classes/general/RCrmActions.php
@@ -429,7 +429,7 @@ public static function unserializeArrayRecursive($string)
         }
 
         if (is_string($string)) {
-            $string = unserialize($string);
+            $string = unserialize($string, ['allowed_classes' => false]);
         }
 
         if (!is_array($string)) {
diff --git a/intaro.retailcrm/install/export/local/components/intaro/main.register/templates/.default/template.php b/intaro.retailcrm/install/export/local/components/intaro/main.register/templates/.default/template.php
index 6657ce09..03d45b27 100644
--- a/intaro.retailcrm/install/export/local/components/intaro/main.register/templates/.default/template.php
+++ b/intaro.retailcrm/install/export/local/components/intaro/main.register/templates/.default/template.php
@@ -20,6 +20,12 @@
     die();
 }
 
+$sanitizer = new CBXSanitizer();
+$sanitizer->SetLevel(CBXSanitizer::SECURE_LEVEL_MIDDLE);
+
+$agreementLoyaltyProgram = $sanitizer->SanitizeHtml((string) ($arResult['AGREEMENT_LOYALTY_PROGRAM'] ?? ''));
+$agreementPersonalData = $sanitizer->SanitizeHtml((string) ($arResult['AGREEMENT_PERSONAL_DATA'] ?? ''));
+
 if ($arResult["SHOW_SMS_FIELD"] == true) {
     CJSCore::Init('phone_auth');
 }
@@ -34,10 +40,10 @@
 ?>
 <?php CUtil::InitJSCore(['ajax', 'jquery', 'popup']); ?>
 <div id="uf_agree_pl_intaro_popup" style="display:none;">
-    <?=$arResult['AGREEMENT_LOYALTY_PROGRAM']?>
+    <?=$agreementLoyaltyProgram?>
 </div>
 <div id="uf_pd_proc_pl_intaro_popup" style="display:none;">
-    <?=$arResult['AGREEMENT_PERSONAL_DATA']?>
+    <?=$agreementPersonalData?>
 </div>
 <script>
     BX.ready(function() {
@@ -96,7 +102,7 @@
         <?php $this->addExternalJs(SITE_TEMPLATE_PATH . '/script.js'); ?>
         <div id="regBody">
             <?php if (isset($arResult['LP_REGISTER']['msg'])) { ?>
-                <div id="lpRegMsg" class="lpRegMsg"><?=$arResult['LP_REGISTER']['msg']?></div>
+                <div id="lpRegMsg" class="lpRegMsg"><?=htmlspecialcharsbx((string) $arResult['LP_REGISTER']['msg'])?></div>
             <?php } ?>
 
             <?php
diff --git a/intaro.retailcrm/lib/component/configprovider.php b/intaro.retailcrm/lib/component/configprovider.php
index 88c4d135..b480a7d2 100644
--- a/intaro.retailcrm/lib/component/configprovider.php
+++ b/intaro.retailcrm/lib/component/configprovider.php
@@ -997,7 +997,7 @@ public static function isOnlineConsultantEnabled(): bool
 
     public static function getOnlineConsultantScript(): string
     {
-        return static::buildAllowedOnlineConsultantScript(
+        return static::sanitizeOnlineConsultantScript(
             trim(static::getOption(Constants::CRM_ONLINE_CONSULTANT_SCRIPT, ""))
         );
     }
@@ -1027,7 +1027,7 @@ public static function setOnlineConsultantScript(string $value)
     {
         static::setOption(
             Constants::CRM_ONLINE_CONSULTANT_SCRIPT,
-            static::buildAllowedOnlineConsultantScript($value)
+            static::sanitizeOnlineConsultantScript($value)
         );
     }
 
@@ -1036,55 +1036,32 @@ public static function setEventTracker(string $value)
         static::setOption(Constants::CRM_EVENT_TRACKER, $value);
     }
 
-    private static function buildAllowedOnlineConsultantScript(string $value): string
+    private static function sanitizeOnlineConsultantScript(string $value): string
     {
-        $url = static::extractAllowedOnlineConsultantUrl($value);
-        $rcct = static::extractOnlineConsultantToken($value);
+        $value = trim($value);
 
-        if ($url === '') {
+        if ($value === '') {
             return '';
         }
 
-        $scriptParts = [];
-
-        if ($rcct !== '') {
-            $scriptParts[] = sprintf(
-                '<script>var _rcct = "%s";</script>',
-                htmlspecialcharsbx($rcct)
-            );
-        }
-
-        $scriptParts[] = sprintf('<script async src="%s"></script>', htmlspecialcharsbx($url));
-
-        return implode('', $scriptParts);
-    }
-
-    private static function extractOnlineConsultantToken(string $value): string
-    {
-        if (!preg_match('/_rcct\s*=\s*[\'"]([A-Za-z0-9_-]+)[\'"]/i', $value, $matches)) {
-            return '';
+        $rcct = '';
+        if (preg_match('/_rcct\s*=\s*[\'"]([A-Za-z0-9_-]+)[\'"]/i', $value, $matches)) {
+            $rcct = (string) ($matches[1] ?? '');
         }
 
-        return (string) ($matches[1] ?? '');
-    }
-
-    private static function extractAllowedOnlineConsultantUrl(string $value): string
-    {
-        $value = trim($value);
-
-        if ($value === '') {
+        if (!preg_match('~(?:https:)?//[^\s\'"<>]+~i', $value, $matches)) {
             return '';
         }
 
-        $candidates = [];
-
-        if (filter_var($value, FILTER_VALIDATE_URL)) {
-            $candidates[] = $value;
+        $url = (string) $matches[0];
+        if (strpos($url, '//') === 0) {
+            $url = 'https:' . $url;
         }
 
-        if (preg_match_all('~(?:https:)?//[^\s\'"<>]+~i', $value, $matches)) {
-            $candidates = array_merge($candidates, $matches[0]);
-        }
+        $parsedUrl = parse_url($url);
+        $host = strtolower((string) ($parsedUrl['host'] ?? ''));
+        $scheme = strtolower((string) ($parsedUrl['scheme'] ?? ''));
+        $path = (string) ($parsedUrl['path'] ?? '');
 
         $allowedDomains = [
             'retailcrm.ru',
@@ -1093,32 +1070,25 @@ private static function extractAllowedOnlineConsultantUrl(string $value): string
             'retailcrm.tech',
         ];
 
-        foreach (array_unique($candidates) as $candidate) {
-            if (strpos($candidate, '//') === 0) {
-                $candidate = 'https:' . $candidate;
+        $isAllowedDomain = false;
+        foreach ($allowedDomains as $domain) {
+            if ($host === $domain || substr($host, -strlen('.' . $domain)) === '.' . $domain) {
+                $isAllowedDomain = true;
+                break;
             }
+        }
 
-            $parsedUrl = parse_url($candidate);
-            $host = strtolower((string) ($parsedUrl['host'] ?? ''));
-            $scheme = strtolower((string) ($parsedUrl['scheme'] ?? ''));
-            $path = (string) ($parsedUrl['path'] ?? '');
-
-            if ($host === '' || $scheme !== 'https') {
-                continue;
-            }
+        if ($scheme !== 'https' || !$isAllowedDomain || $path !== '/widget/loader.js') {
+            return '';
+        }
 
-            if (strpos($path, '/widget/loader.js') === false) {
-                continue;
-            }
+        $script = '';
 
-            foreach ($allowedDomains as $domain) {
-                if ($host === $domain || substr($host, -strlen('.' . $domain)) === '.' . $domain) {
-                    return $candidate;
-                }
-            }
+        if ($rcct !== '') {
+            $script .= sprintf('<script>var _rcct = "%s";</script>', htmlspecialcharsbx($rcct));
         }
 
-        return '';
+        return $script . sprintf('<script async src="%s"></script>', htmlspecialcharsbx($url));
     }
 
     public static function setEventTrackerCart(string $value)
diff --git a/intaro.retailcrm/options.php b/intaro.retailcrm/options.php
index c44fb065..09c1b306 100644
--- a/intaro.retailcrm/options.php
+++ b/intaro.retailcrm/options.php
@@ -3512,7 +3512,7 @@ function customerFixDate() {
 
                                 return parsedUrl.protocol === 'https:'
                                     && hasAllowedDomain
-                                    && parsedUrl.pathname.includes('/widget/loader.js');
+                                    && parsedUrl.pathname === '/widget/loader.js';
                             } catch (e) {
                                 return false;
                             }