1

common/services/GuestDeclarationOrderService.php

@@ -161,15 +161,20 @@ class GuestDeclarationOrderService
 
         $form = new ApproachDeclarationForm();
         $form->scenario = 'userDec';
+        $explicitlyAllowedAttributes = [
+            'bottomUserName', 'payType', 'countryId', 'packageId', 'goodsId', 'goodsNum',
+            'email', 'languageId',
+        ];
+        $allowedNames = array_unique(array_merge($form->safeAttributes(), $explicitlyAllowedAttributes));
+        $allowedInput = array_flip($allowedNames);
+        unset($allowedInput['allData']);
+        $input = array_intersect_key($input, $allowedInput);
         foreach ($input as $name => $value) {
-            if (in_array($name, $form->safeAttributes(), true) && $name !== 'allData') {
+            if (in_array($name, $allowedNames, true)) {
                 $form->$name = $value;
             }
         }
         $form->bottomUserName = $sponsorName;
-        $allowedInput = array_flip(array_merge($form->safeAttributes(), ['bottomUserName', 'payType', 'countryId']));
-        unset($allowedInput['allData']);
-        $input = array_intersect_key($input, $allowedInput);
         $form->allData = [$input];
         if (!$form->validate()) {
             throw new BadRequestHttpException(Form::formatErrorsForApi($form->getErrors()));
@@ -303,7 +308,7 @@ class GuestDeclarationOrderService
             $ids = $input['goodsId'] ?? [];
             $quantities = $input['goodsNum'] ?? [];
             if (!is_array($ids) || !is_array($quantities) || count($ids) !== count($quantities) || !$ids) {
-                throw new BadRequestHttpException('Select at least one valid product.1'.json_encode($input));
+                throw new BadRequestHttpException('Select at least one valid product.');
             }
             foreach ($ids as $index => $id) {
                 $quantity = filter_var($quantities[$index], FILTER_VALIDATE_INT, ['options' => ['min_range' => 0, 'max_range' => 99]]);