FishEye: diff osCommerce/oscommerce2/trunk/update-20051113.html

1

-

<html>

2

-

3

-

<head>

4

-

5

-

6

-

<title>osCommerce 2.2 Milestone 2 Update 051113</title>

7

-

<style>

8

-

<!--

9

-

/* Style Definitions */

10

-

p.MsoNormal, li.MsoNormal, div.MsoNormal

11

-

{margin:0cm;

12

-

margin-bottom:.0001pt;

13

-

font-size:12.0pt;

14

-

font-family:"Times New Roman";}

15

-

h1

16

-

{margin-top:12.0pt;

17

-

margin-right:0cm;

18

-

margin-bottom:3.0pt;

19

-

margin-left:0cm;

20

-

page-break-after:avoid;

21

-

font-size:16.0pt;

22

-

font-family:Arial;}

23

-

h2

24

-

{margin-top:12.0pt;

25

-

margin-right:0cm;

26

-

margin-bottom:3.0pt;

27

-

margin-left:0cm;

28

-

page-break-after:avoid;

29

-

font-size:14.0pt;

30

-

font-family:Arial;

31

-

font-style:italic;}

32

-

h3

33

-

{margin-top:12.0pt;

34

-

margin-right:0cm;

35

-

margin-bottom:3.0pt;

36

-

margin-left:0cm;

37

-

page-break-after:avoid;

38

-

font-size:13.0pt;

39

-

font-family:Arial;}

40

-

p.MsoToc1, li.MsoToc1, div.MsoToc1

41

-

{margin:0cm;

42

-

margin-bottom:.0001pt;

43

-

font-size:12.0pt;

44

-

font-family:"Times New Roman";}

45

-

p.MsoToc3, li.MsoToc3, div.MsoToc3

46

-

{margin-top:0cm;

47

-

margin-right:0cm;

48

-

margin-bottom:0cm;

49

-

margin-left:24.0pt;

50

-

margin-bottom:.0001pt;

51

-

font-size:12.0pt;

52

-

font-family:"Times New Roman";}

53

-

p.MsoHeader, li.MsoHeader, div.MsoHeader

54

-

{margin:0cm;

55

-

margin-bottom:.0001pt;

56

-

font-size:12.0pt;

57

-

font-family:"Times New Roman";}

58

-

p.MsoFooter, li.MsoFooter, div.MsoFooter

59

-

{margin:0cm;

60

-

margin-bottom:.0001pt;

61

-

font-size:12.0pt;

62

-

font-family:"Times New Roman";}

63

-

a:link, span.MsoHyperlink

64

-

{color:blue;

65

-

text-decoration:underline;}

66

-

a:visited, span.MsoHyperlinkFollowed

67

-

{color:purple;

68

-

text-decoration:underline;}

69

-

pre

70

-

{margin:0cm;

71

-

margin-bottom:.0001pt;

72

-

font-size:10.0pt;

73

-

font-family:"Courier New";}

74

-

span.Heading1Char

75

-

{font-family:Arial;

76

-

font-weight:bold;}

77

-

p.NormalCourierNew, li.NormalCourierNew, div.NormalCourierNew

78

-

{margin:0cm;

79

-

margin-bottom:.0001pt;

80

-

font-size:12.0pt;

81

-

font-family:"Times New Roman";}

82

-

span.Heading3Char

83

-

{font-family:Arial;

84

-

font-weight:bold;}

85

-

/* Page Definitions */

86

-

@page Section1

87

-

{size:612.0pt 792.0pt;

88

-

margin:72.0pt 90.0pt 72.0pt 90.0pt;}

89

-

div.Section1

90

-

{page:Section1;}

91

-

-->

92

-

</style>

93

-

94

-

</head>

95

-

96

-

97

-

98

-

99

-

100

-

<h1 align=center style='text-align:center'><a name="_Toc119693700"></a><a

101

-

name="_Toc119693027"></a><a name="_Toc119692912"></a><a name="_Toc119692858"></a><a

102

-

name="_Toc119473688"></a><a name="_Toc119399320"></a><a name="_Toc116415078"></a><a

103

-

name="_Toc116413327"></a><a name="_Toc115810646"></a><a name="_Toc114779446"></a><a

104

-

name="_Toc114755867"></a><a name="_Toc114755833"></a><a name="_Toc114753969"></a><a

105

-

name="_Toc114748813">osCommerce 2.2 Milestone 2</a> Update 051113</h1>

106

-

107

-

Update Package 13th

108

-

November 2005

109

-

110

-

111

-

112

-

113

-

114

-

115

-

116

-

117

-

118

-

Table of Contents

119

-

120

-

121

-

122

-

Update 051113

123

-

124

-

125

-

126

-

<a href="#_Toc119693028"><span

127

-

lang=EN>customer_country_id in addressbook<span style='color:windowtext;

128

-

display:none;text-decoration:none'>. <span

129

-

style='color:windowtext;display:none;text-decoration:none'>2</a>

130

-

131

-

132

-

133

-

Update 051112

134

-

135

-

136

-

137

-

<a href="#_Toc119693703">Cannot

138

-

re-assign $this. <span

139

-

style='color:windowtext;display:none;text-decoration:none'>3</a>

140

-

141

-

<a href="#_Toc119693704"><span

142

-

lang=EN>limit -20, 20<span style='color:windowtext;display:none;

143

-

text-decoration:none'>. <span

144

-

style='color:windowtext;display:none;text-decoration:none'>4</a>

145

-

146

-

<a href="#_Toc119693705">Database

147

-

Input Enhancement<span style='color:windowtext;display:none;text-decoration:

148

-

none'> <span

149

-

style='color:windowtext;display:none;text-decoration:none'>5</a>

150

-

151

-

<a href="#_Toc119693706">Adding

152

-

Non-Existing Products To Cart<span style='color:windowtext;display:none;

153

-

text-decoration:none'> <span

154

-

style='color:windowtext;display:none;text-decoration:none'>7</a>

155

-

156

-

<a href="#_Toc119693707">Session ID

157

-

XSS Issue. <span

158

-

style='color:windowtext;display:none;text-decoration:none'>12</a>

159

-

160

-

<a href="#_Toc119693708">Validate

161

-

Session ID.. <span

162

-

style='color:windowtext;display:none;text-decoration:none'>13</a>

163

-

164

-

<a href="#_Toc119693709">File Manager

165

-

Problem.. <span

166

-

style='color:windowtext;display:none;text-decoration:none'>15</a>

167

-

168

-

<a href="#_Toc119693710">HTTP Header

169

-

Injection. <span

170

-

style='color:windowtext;display:none;text-decoration:none'>16</a>

171

-

172

-

<a href="#_Toc119693711">E-Mail

173

-

Header Injection<span style='color:windowtext;display:none;text-decoration:

174

-

none'>. <span

175

-

style='color:windowtext;display:none;text-decoration:none'>18</a>

176

-

177

-

<a href="#_Toc119693712">Contact Us

178

-

Form XSS Issue. <span

179

-

style='color:windowtext;display:none;text-decoration:none'>21</a>

180

-

181

-

<a href="#_Toc119693713">Open

182

-

Redirector <span

183

-

style='color:windowtext;display:none;text-decoration:none'>22</a>

184

-

185

-

<a href="#_Toc119693714">Extra

186

-

Slashes In New Products<span style='color:windowtext;display:none;text-decoration:

187

-

none'>. <span

188

-

style='color:windowtext;display:none;text-decoration:none'>23</a>

189

-

190

-

<a href="#_Toc119693715">Order Status

191

-

Filtering. <span

192

-

style='color:windowtext;display:none;text-decoration:none'>25</a>

193

-

194

-

<a href="#_Toc119693716">MySQL 5.0

195

-

Compatibility. <span

196

-

style='color:windowtext;display:none;text-decoration:none'>26</a>

197

-

198

-

<h1>

199

-

<a name="_Toc119693702"></a><a name="_Toc119693701"></a><a name="_Toc119693028">customer_country_id

200

-

in addressbook</a></h1>

201

-

202

-

<a href="http://www.oscommerce.com/community/bugs,1662">http://www.oscommerce.com/community/bugs,1662</a>

203

-

204

-

205

-

206

-

<h3>Problem:</h3>

207

-

208

-

209

-

210

-

When the customer updates their address in the

211

-

My Account page, their country value is being stored in an incorrect variable

212

-

that can cause an incorrect tax rate value being used in product prices.

213

-

214

-

215

-

216

-

<h3>Solution:</h3>

217

-

218

-

219

-

220

-

The following lines must be replaced in

221

-

catalog/address_book_process.php:

222

-

223

-

224

-

225

-

Line 150, from:

226

-

227

-

228

-

229

-

<span lang=EN style='font-size:9.0pt;font-family:"Courier New";

230

-

color:blue'>$customer_country_id = $country_id;

231

-

232

-

233

-

234

-

to:

235

-

236

-

237

-

238

-

<span lang=EN style='font-size:9.0pt;font-family:"Courier New";

239

-

color:blue'>$customer_country_id = $country;

240

-

241

-

242

-

243

-

Line 171, from:

244

-

245

-

246

-

247

-

<span lang=EN style='font-size:9.0pt;font-family:"Courier New";

248

-

color:blue'>$customer_country_id = $country_id;

249

-

250

-

251

-

252

-

to:

253

-

254

-

255

-

256

-

<span lang=EN style='font-size:9.0pt;font-family:"Courier New";

257

-

color:blue'>$customer_country_id = $country;

258

-

259

-

<br

260

-

clear=all style='page-break-before:always'>

261

-

262

-

263

-

<a name="_Toc119693703"></a><a name="_Toc119693029"><span

264

-

class=Heading1Char>Cannot re-assign $this</a>

265

-

266

-

<a href="http://www.oscommerce.com/community/bugs,1650">http://www.oscommerce.com/community/bugs,1650</a>

267

-

268

-

269

-

270

-

<h3>Problem:</h3>

271

-

272

-

273

-

274

-

Fatal error: Cannot re-assign $this in /path/to/catalog/admin/includes/classes/upload.php

275

-

on line 31

276

-

277

-

278

-

279

-

<h3>Solution:</h3>

280

-

281

-

282

-

283

-

Lines 27-34 in catalog/admin/includes/classes/upload.php

284

-

must be changed from:

285

-

286

-

287

-

288

-

<span style='font-size:9.0pt;font-family:"Courier New";

289

-

color:blue'>if ( ($this->parse() == true) && ($this->save() ==

290

-

true) ) {

291

-

292

-

<span style='font-size:9.0pt;font-family:"Courier New";

293

-

color:blue'>� return true;

294

-

295

-

<span style='font-size:9.0pt;font-family:"Courier New";

296

-

color:blue'>} else {

297

-

298

-

<span style='font-size:9.0pt;font-family:"Courier New";

299

-

color:blue;background:yellow'>// self destruct

300

-

301

-

<span style='font-size:9.0pt;font-family:"Courier New";

302

-

color:blue;background:yellow'>� $this = null;

303

-

304

-

<span style='font-size:9.0pt;font-family:"Courier New";

305

-

color:blue'>

306

-

307

-

<span style='font-size:9.0pt;font-family:"Courier New";

308

-

color:blue'>� return false;

309

-

310

-

<span style='font-size:9.0pt;font-family:"Courier New";

311

-

color:blue'>}

312

-

313

-

314

-

315

-

to:

316

-

317

-

318

-

319

-

<span style='font-size:9.0pt;font-family:"Courier New";

320

-

color:blue'>if ( ($this->parse() == true) && ($this->save() ==

321

-

true) ) {

322

-

323

-

<span style='font-size:9.0pt;font-family:"Courier New";

324

-

color:blue'>� return true;

325

-

326

-

<span style='font-size:9.0pt;font-family:"Courier New";

327

-

color:blue'>} else {

328

-

329

-

<span style='font-size:9.0pt;font-family:"Courier New";

330

-

color:blue'>� return false;

331

-

332

-

<span style='font-size:9.0pt;font-family:"Courier New";

333

-

color:blue'>}

334

-

335

-

<br

336

-

clear=all style='page-break-before:always'>

337

-

338

-

339

-

<h1><a name="_Toc119693704"></a><a name="_Toc119693030">limit

340

-

-20, 20</a></h1>

341

-

342

-

<a

343

-

href="http://www.oscommerce.com/community/bugs,1605">http://www.oscommerce.com/community/bugs,1605</a>

344

-

345

-

346

-

347

-

348

-

349

-

<h3>Problem:</h3>

350

-

351

-

352

-

353

-

1064 - You have an error in your SQL syntax;

354

-

check the manual that corresponds to your MySQL server version for the right

355

-

syntax to use near '-20, 20' at line 1

356

-

357

-

358

-

359

-

<h3>Solution:</h3>

360

-

361

-

362

-

363

-

Line 67 in catalog/includes/classes/split_page_results.php

364

-

must be changed from:

365

-

366

-

367

-

368

-

<span lang=EN style='font-size:9.0pt;font-family:"Courier New";

369

-

color:blue'>$this->sql_query .= " limit " . <span

370

-

style='background:yellow'>$offset . ", " . $this->number_of_rows_per_page;

371

-

372

-

373

-

374

-

to:

375

-

376

-

377

-

378

-

<span lang=EN style='font-size:9.0pt;font-family:"Courier New";

379

-

color:blue'>$this->sql_query .= " limit " . <span

380

-

style='background:yellow'>max($offset, 0) . ", " . $this->number_of_rows_per_page;

381

-

382

-

383

-

384

-

Line 38 in

385

-

catalog/admin/includes/classes/split_page_results.php must be changed from:

386

-

387

-

388

-

389

-

<span lang=EN style='font-size:9.0pt;font-family:"Courier New";

390

-

color:blue'>$sql_query .= " limit " . $offset

391

-

. ", " . $max_rows_per_page;

392

-

393

-

394

-

395

-

to:

396

-

397

-

398

-

399

-

<span lang=EN style='font-size:9.0pt;font-family:"Courier New";

400

-

color:blue'>$sql_query .= " limit " . max($offset,

401

-

0) . ", " . $max_rows_per_page;

402

-

403

-

<br clear=all

404

-

style='page-break-before:always'>

405

-

406

-

407

-

<h1><a name="_Toc119693705"></a><a name="_Toc119693031">Database Input

408

-

Enhancement</a></h1>

409

-

410

-

411

-

412

-

<h3>Problem:</h3>

413

-

414

-

415

-

416

-

Native MySQL functions should be used in preference to the

417

-

addslashes() function, to properly protect the SQL queries being executed on

418

-

the database server.

419

-

420

-

421

-

422

-

<h3>Solution:</h3>

423

-

424

-

425

-

426

-

The following function must be replaced in

427

-

catalog/includes/functions/database.php.

428

-

429

-

430

-

431

-

Lines 126-128, from:

432

-

433

-

434

-

435

-

<span style='font-size:9.0pt;font-family:"Courier New";

436

-

color:blue'>function tep_db_input($string) {

437

-

438

-

<span style='font-size:9.0pt;font-family:"Courier New";

439

-

color:blue'>� return addslashes($string);

440

-

441

-

<span style='font-size:9.0pt;font-family:"Courier New";

442

-

color:blue'>}

443

-

444

-

445

-

446

-

to:

447

-

448

-

449

-

450

-

<pre>function tep_db_input($string, $link = 'db_link') {</pre><pre><span

451

-

style='font-size:9.0pt;color:blue'>� global $$link;</pre><pre><span

452

-

style='font-size:9.0pt;color:blue'> </pre><pre><span

453

-

style='font-size:9.0pt;color:blue'>� if (function_exists('mysql_real_escape_string')) {</pre><pre><span

454

-

style='font-size:9.0pt;color:blue'>�� return mysql_real_escape_string($string, $$link);</pre><pre><span

455

-

style='font-size:9.0pt;color:blue'>� } elseif (function_exists('mysql_escape_string')) {</pre><pre><span

456

-

style='font-size:9.0pt;color:blue'>�� return mysql_escape_string($string);</pre><pre><span

457

-

style='font-size:9.0pt;color:blue'>� }</pre><pre><span style='font-size:

458

-

9.0pt;color:blue'> </pre><pre><span style='font-size:9.0pt;

459

-

color:blue'>� return addslashes($string);</pre><pre><span

460

-

style='font-size:9.0pt;color:blue'>}</pre>

461

-

462

-

463

-

464

-

The following function must be replaced in

465

-

catalog/admin/includes/functions/database.php.

466

-

467

-

468

-

469

-

Lines 130-132, from:

470

-

471

-

472

-

473

-

<span style='font-size:9.0pt;font-family:"Courier New";

474

-

color:blue'>function tep_db_input($string) {

475

-

476

-

<span style='font-size:9.0pt;font-family:"Courier New";

477

-

color:blue'>� return addslashes($string);

478

-

479

-

<span style='font-size:9.0pt;font-family:"Courier New";

480

-

color:blue'>}

481

-

482

-

483

-

484

-

<br clear=all

485

-

style='page-break-before:always'>

486

-

487

-

488

-

to:

489

-

490

-

491

-

492

-

<pre>function tep_db_input($string, $link = 'db_link') {</pre><pre><span

493

-

style='font-size:9.0pt;color:blue'>� global $$link;</pre><pre><span

494

-

style='font-size:9.0pt;color:blue'> </pre><pre><span

495

-

style='font-size:9.0pt;color:blue'>� if (function_exists('mysql_real_escape_string')) {</pre><pre><span

496

-

style='font-size:9.0pt;color:blue'>�� return mysql_real_escape_string($string, $$link);</pre><pre><span

497

-

style='font-size:9.0pt;color:blue'>� } elseif (function_exists('mysql_escape_string')) {</pre><pre><span

498

-

style='font-size:9.0pt;color:blue'>�� return mysql_escape_string($string);</pre><pre><span

499

-

style='font-size:9.0pt;color:blue'>� }</pre><pre><span style='font-size:

500

-

9.0pt;color:blue'> </pre><pre><span style='font-size:9.0pt;

501

-

color:blue'>� return addslashes($string);</pre><pre><span

502

-

style='font-size:9.0pt;color:blue'>}</pre><span style='font-size:

503

-

16.0pt;font-family:Arial'>

504

-

505

-

506

-

<h1><a name="_Toc119693706"></a><a name="_Toc119693032">Adding Non-Existing

507

-

Products To Cart</a></h1>

508

-

509

-

<a href="http://www.oscommerce.com/community/bugs,1617">http://www.oscommerce.com/community/bugs,1617</a>

510

-

511

-

512

-

513

-

<h3>Problem:</h3>

514

-

515

-

516

-

517

-

It is possible to add non-existing products into the

518

-

shopping cart which may prevent customers from removing the products from their

519

-

cart.

520

-

521

-

522

-

523

-

<h3>Solution:</h3>

524

-

525

-

526

-

527

-

The following functions must be replaced in

528

-

catalog/includes/functions/general.php.

529

-

530

-

531

-

532

-

Lines 912-921, from:

533

-

534

-

535

-

536

-

<span style='font-size:9.0pt;font-family:"Courier New";

537

-

color:blue'>function tep_get_uprid($prid, $params) {

538

-

539

-

<span style='font-size:9.0pt;font-family:"Courier New";

540

-

color:blue'>� $uprid = $prid;

541

-

542

-

<span style='font-size:9.0pt;font-family:"Courier New";

543

-

color:blue'>� if ( (is_array($params)) && (!strstr($prid, '{')) ) {

544

-

545

-

<span style='font-size:9.0pt;font-family:"Courier New";

546

-

color:blue'>�� while (list($option, $value) = each($params)) {

547

-

548

-

<span style='font-size:9.0pt;font-family:"Courier New";

549

-

color:blue'>�� $uprid = $uprid . '{' . $option . '}' . $value;

550

-

551

-

<span style='font-size:9.0pt;font-family:"Courier New";

552

-

color:blue'>� ��}

553

-

554

-

<span style='font-size:9.0pt;font-family:"Courier New";

555

-

color:blue'>� }

556

-

557

-

<span style='font-size:9.0pt;font-family:"Courier New";

558

-

color:blue'>

559

-

560

-

<span style='font-size:9.0pt;font-family:"Courier New";

561

-

color:blue'>� return $uprid;

562

-

563

-

<span style='font-size:9.0pt;font-family:"Courier New";

564

-

color:blue'>}

565

-

566

-

<span style='font-size:10.0pt;font-family:"Courier New";

567

-

color:blue'>

568

-

569

-

to:

570

-

571

-

572

-

573

-

<pre>function tep_get_uprid($prid, $params) {</pre><pre><span

574

-

style='font-size:9.0pt;color:blue'>� if (is_numeric($prid)) {</pre><pre><span

575

-

style='font-size:9.0pt;color:blue'>�� $uprid = $prid;</pre><pre><span

576

-

style='font-size:9.0pt;color:blue'> </pre><pre><span

577

-

style='font-size:9.0pt;color:blue'>�� if (is_array($params) && (sizeof($params) > 0)) {</pre><pre><span

578

-

style='font-size:9.0pt;color:blue'>�� $attributes_check = true;</pre><pre><span

579

-

style='font-size:9.0pt;color:blue'>�� $attributes_ids = '';</pre><pre><span

580

-

style='font-size:9.0pt;color:blue'> </pre><pre><span

581

-

style='font-size:9.0pt;color:blue'>�� reset($params);</pre><pre><span

582

-

style='font-size:9.0pt;color:blue'>�� while (list($option, $value) = each($params)) {</pre><pre><span

583

-

style='font-size:9.0pt;color:blue'>�� if (is_numeric($option) && is_numeric($value)) {</pre><pre><span

584

-

style='font-size:9.0pt;color:blue'>�� $attributes_ids .= '{' . (int)$option . '}' . (int)$value;</pre><pre><span

585

-

style='font-size:9.0pt;color:blue'>�� } else {</pre><pre><span

586

-

style='font-size:9.0pt;color:blue'>�� $attributes_check = false;</pre><pre><span

587

-

style='font-size:9.0pt;color:blue'>�� break;</pre><pre><span

588

-

style='font-size:9.0pt;color:blue'> ��}</pre><pre><span

589

-

style='font-size:9.0pt;color:blue'>�� }</pre><pre><span

590

-

style='font-size:9.0pt;color:blue'> </pre><pre><span

591

-

style='font-size:9.0pt;color:blue'>�� if ($attributes_check == true) {</pre><pre><span

592

-

style='font-size:9.0pt;color:blue'>�� $uprid .= $attributes_ids;</pre><pre><span

593

-

style='font-size:9.0pt;color:blue'>�� }</pre><pre><span

594

-

style='font-size:9.0pt;color:blue'>�� }</pre><pre><span

595

-

style='font-size:9.0pt;color:blue'>� } else {</pre><pre><span

596

-

style='font-size:9.0pt;color:blue'>�� $uprid = tep_get_prid($prid);</pre><pre><span

597

-

style='font-size:9.0pt;color:blue'> </pre><pre><span

598

-

style='font-size:9.0pt;color:blue'>�� if (is_numeric($uprid)) {</pre><pre><span

599

-

style='font-size:9.0pt;color:blue'>�� if (strpos($prid, '{') !== false) {</pre><pre><span

600

-

style='font-size:9.0pt;color:blue'>�� $attributes_check = true;</pre><pre><span

601

-

style='font-size:9.0pt;color:blue'>�� $attributes_ids = '';</pre><pre><span

602

-

style='font-size:9.0pt;color:blue'> </pre><pre><span

603

-

style='font-size:9.0pt;color:blue'>// strpos()+1 to remove up to and including the first { which would create an empty array element in explode()</pre><pre><span

604

-

style='font-size:9.0pt;color:blue'>�� $attributes = explode('{', substr($prid, strpos($prid, '{')+1));</pre><pre><span

605

-

style='font-size:9.0pt;color:blue'> </pre><pre><span

606

-

style='font-size:9.0pt;color:blue'>�� for ($i=0, $n=sizeof($attributes); $i<$n; $i++) {</pre><pre><span

607

-

style='font-size:9.0pt;color:blue'>�� $pair = explode('}', $attributes[$i]);</pre><pre><span

608

-

style='font-size:9.0pt;color:blue'> </pre><pre><span

609

-

style='font-size:9.0pt;color:blue'>�� if (is_numeric($pair[0]) && is_numeric($pair[1])) {</pre><pre><span

610

-

style='font-size:9.0pt;color:blue'>�� $attributes_ids .= '{' . (int)$pair[0] . '}' . (int)$pair[1];</pre><pre><span

611

-

style='font-size:9.0pt;color:blue'>�� } else {</pre><pre><span

612

-

style='font-size:9.0pt;color:blue'>�� $attributes_check = false;</pre><pre><span

613

-

style='font-size:9.0pt;color:blue'>�� break;</pre><pre><span

614

-

style='font-size:9.0pt;color:blue'>�� }</pre><pre><span

615

-

style='font-size:9.0pt;color:blue'>�� }</pre><pre><span

616

-

style='font-size:9.0pt;color:blue'> </pre><pre><span

617

-

style='font-size:9.0pt;color:blue'>�� if ($attributes_check == true) {</pre><pre><span

618

-

style='font-size:9.0pt;color:blue'>�� $uprid .= $attributes_ids;</pre><pre><span

619

-

style='font-size:9.0pt;color:blue'>�� }</pre><pre><span

620

-

style='font-size:9.0pt;color:blue'>�� }</pre><pre><span

621

-

style='font-size:9.0pt;color:blue'>�� } else {</pre><pre><span

622

-

style='font-size:9.0pt;color:blue'>�� return false;</pre><pre><span

623

-

style='font-size:9.0pt;color:blue'>�� }</pre><pre><span

624

-

style='font-size:9.0pt;color:blue'>� }</pre><pre><span style='font-size:

625

-

9.0pt;color:blue'> </pre><pre><span style='font-size:9.0pt;

626

-

color:blue'>� return $uprid;</pre><pre><span style='font-size:9.0pt;

627

-

color:blue'>}</pre><pre> </pre>

628

-

629

-

Lines 925-929, from:

630

-

631

-

632

-

633

-

<span style='font-size:9.0pt;font-family:"Courier New";

634

-

color:blue'>function tep_get_prid($uprid) {

635

-

636

-

<span style='font-size:9.0pt;font-family:"Courier New";

637

-

color:blue'>� $pieces = explode('{', $uprid);

638

-

639

-

<span style='font-size:9.0pt;font-family:"Courier New";

640

-

color:blue'>

641

-

642

-

<span style='font-size:9.0pt;font-family:"Courier New";

643

-

color:blue'>� return $pieces[0];

644

-

645

-

<span style='font-size:9.0pt;font-family:"Courier New";

646

-

color:blue'>}

647

-

648

-

649

-

650

-

to:

651

-

652

-

<pre> </pre><pre>function tep_get_prid($uprid) {</pre><pre><span

653

-

style='font-size:9.0pt;color:blue'>� $pieces = explode('{', $uprid);</pre><pre><span

654

-

style='font-size:9.0pt;color:blue'> </pre><pre><span

655

-

style='font-size:9.0pt;color:blue'>� if (is_numeric($pieces[0])) {</pre><pre><span

656

-

style='font-size:9.0pt;color:blue'>�� return $pieces[0];</pre><pre><span

657

-

style='font-size:9.0pt;color:blue'>� } else {</pre><pre><span

658

-

style='font-size:9.0pt;color:blue'>�� return false;</pre><pre><span

659

-

style='font-size:9.0pt;color:blue'>� }</pre><pre><span style='font-size:

660

-

9.0pt;color:blue'>}</pre><pre> </pre><span

661

-

style='font-size:12.0pt;font-family:"Times New Roman"'><br clear=all

662

-

style='page-break-before:always'>

663

-

664

-

665

-

The following functions must be replaced in

666

-

catalog/includes/classes/shopping_cart.php.

667

-

668

-

669

-

670

-

Lines 78-108, from:

671

-

672

-

673

-

674

-

<span style='font-size:9.0pt;font-family:"Courier New";

675

-

color:blue'>function add_cart($products_id, $qty = '1', $attributes = '',

676

-

$notify = true) {

677

-

678

-

<span style='font-size:9.0pt;font-family:"Courier New";

679

-

color:blue'>� global $new_products_id_in_cart, $customer_id;

680

-

681

-

<span style='font-size:9.0pt;font-family:"Courier New";

682

-

color:blue'>

683

-

684

-

<span style='font-size:9.0pt;font-family:"Courier New";

685

-

color:blue'>� $products_id = tep_get_uprid($products_id, $attributes);

686

-

687

-

<span style='font-size:9.0pt;font-family:"Courier New";

688

-

color:blue'>� if ($notify == true) {

689

-

690

-

<span style='font-size:9.0pt;font-family:"Courier New";

691

-

color:blue'>�� $new_products_id_in_cart = $products_id;

692

-

693

-

<span style='font-size:9.0pt;font-family:"Courier New";

694

-

color:blue'>�� tep_session_register('new_products_id_in_cart');

695

-

696

-

<span style='font-size:9.0pt;font-family:"Courier New";

697

-

color:blue'>� }

698

-

699

-

<span style='font-size:9.0pt;font-family:"Courier New";

700

-

color:blue'>

701

-

702

-

<span style='font-size:9.0pt;font-family:"Courier New";

703

-

color:blue'>� if ($this->in_cart($products_id)) {

704

-

705

-

<span style='font-size:9.0pt;font-family:"Courier New";

706

-

color:blue'>�� $this->update_quantity($products_id, $qty, $attributes);

707

-

708

-

<span style='font-size:9.0pt;font-family:"Courier New";

709

-

color:blue'>� } else {

710

-

711

-

<span style='font-size:9.0pt;font-family:"Courier New";

712

-

color:blue'>�� $this->contents[] = array($products_id);

713

-

714

-

<span style='font-size:9.0pt;font-family:"Courier New";

715

-

color:blue'>�� $this->contents[$products_id] = array('qty' => $qty);

716

-

717

-

<span style='font-size:9.0pt;font-family:"Courier New";

718

-

color:blue'>// insert into database

719

-

720

-

<span style='font-size:9.0pt;font-family:"Courier New";

721

-

color:blue'>�� if (tep_session_is_registered('customer_id'))

722

-

tep_db_query("insert into " . TABLE_CUSTOMERS_BASKET . "

723

-

(customers_id, products_id, customers_basket_quantity,

724

-

customers_basket_date_added) values ('" . (int)$customer_id . "',

725

-

'" . tep_db_input($products_id) . "', '" . $qty . "',

726

-

'" . date('Ymd') . "')");

727

-

728

-

<span style='font-size:9.0pt;font-family:"Courier New";

729

-

color:blue'>

730

-

731

-

<span style='font-size:9.0pt;font-family:"Courier New";

732

-

color:blue'>�� if (is_array($attributes)) {

733

-

734

-

<span style='font-size:9.0pt;font-family:"Courier New";

735

-

color:blue'>�� reset($attributes);

736

-

737

-

<span style='font-size:9.0pt;font-family:"Courier New";

738

-

color:blue'>�� while (list($option, $value) = each($attributes)) {

739

-

740

-

<span style='font-size:9.0pt;font-family:"Courier New";

741

-

color:blue'>�� $this->contents[$products_id]['attributes'][$option] =

742

-

$value;

743

-

744

-

<span style='font-size:9.0pt;font-family:"Courier New";

745

-

color:blue'>// insert into database

746

-

747

-

<span style='font-size:9.0pt;font-family:"Courier New";

748

-

color:blue'>�� if (tep_session_is_registered('customer_id'))

749

-

tep_db_query("insert into " . TABLE_CUSTOMERS_BASKET_ATTRIBUTES . "

750

-

(customers_id, products_id, products_options_id, products_options_value_id)

751

-

values ('" . (int)$customer_id . "', '" .

752

-

tep_db_input($products_id) . "', '" . (int)$option . "', '"

753

-

. (int)$value . "')");

754

-

755

-

<span style='font-size:9.0pt;font-family:"Courier New";

756

-

color:blue'>�� }

757

-

758

-

<span style='font-size:9.0pt;font-family:"Courier New";

759

-

color:blue'>�� }

760

-

761

-

<span style='font-size:9.0pt;font-family:"Courier New";

762

-

color:blue'>� }

763

-

764

-

<span style='font-size:9.0pt;font-family:"Courier New";

765

-

color:blue'>� $this->cleanup();

766

-

767

-

<span style='font-size:9.0pt;font-family:"Courier New";

768

-

color:blue'>

769

-

770

-

<span style='font-size:9.0pt;font-family:"Courier New";

771

-

color:blue'>// assign a temporary unique ID to the order contents to prevent

772

-

hack attempts during the checkout procedure

773

-

774

-

<span style='font-size:9.0pt;font-family:"Courier New";

775

-

color:blue'>� $this->cartID = $this->generate_cart_id();

776

-

777

-

<span style='font-size:9.0pt;font-family:"Courier New";

778

-

color:blue'>}

779

-

780

-

<br clear=all

781

-

style='page-break-before:always'>

782

-

783

-

784

-

to:

785

-

786

-

787

-

788

-

<pre>function add_cart($products_id, $qty = '1', $attributes = '', $notify = true) {</pre><pre><span

789

-

style='font-size:9.0pt;color:blue'>� global $new_products_id_in_cart, $customer_id;</pre><pre><span

790

-

style='font-size:9.0pt;color:blue'> </pre><pre><span

791

-

style='font-size:9.0pt;color:blue'>� $products_id_string = tep_get_uprid($products_id, $attributes);</pre><pre><span

792

-

style='font-size:9.0pt;color:blue'>� $products_id = tep_get_prid($products_id_string);</pre><pre><span

793

-

style='font-size:9.0pt;color:blue'> </pre><pre><span

794

-

style='font-size:9.0pt;color:blue'>� if (is_numeric($products_id) && is_numeric($qty)) {</pre><pre><span

795

-

style='font-size:9.0pt;color:blue'>�� $check_product_query = tep_db_query("select products_status from " . TABLE_PRODUCTS . " where products_id = '" . (int)$products_id . "'");</pre><pre><span

796

-

style='font-size:9.0pt;color:blue'>�� $check_product = tep_db_fetch_array($check_product_query);</pre><pre><span

797

-

style='font-size:9.0pt;color:blue'> </pre><pre><span

798

-

style='font-size:9.0pt;color:blue'>�� if (($check_product !== false) && ($check_product['products_status'] == '1')) {</pre><pre><span

799

-

style='font-size:9.0pt;color:blue'>�� if ($notify == true) {</pre><pre><span

800

-

style='font-size:9.0pt;color:blue'>�� $new_products_id_in_cart = $products_id;</pre><pre><span

801

-

style='font-size:9.0pt;color:blue'>�� tep_session_register('new_products_id_in_cart');</pre><pre><span

802

-

style='font-size:9.0pt;color:blue'>�� }</pre><pre><span

803

-

style='font-size:9.0pt;color:blue'> </pre><pre><span

804

-

style='font-size:9.0pt;color:blue'>�� if ($this->in_cart($products_id_string)) {</pre><pre><span

805

-

style='font-size:9.0pt;color:blue'>�� $this->update_quantity($products_id_string, $qty, $attributes);</pre><pre><span

806

-

style='font-size:9.0pt;color:blue'>�� } else {</pre><pre><span

807

-

style='font-size:9.0pt;color:blue'>� ��$this->contents[$products_id_string] = array('qty' => $qty);</pre><pre><span

808

-

style='font-size:9.0pt;color:blue'>// insert into database</pre><pre><span

809

-

style='font-size:9.0pt;color:blue'>�� if (tep_session_is_registered('customer_id')) tep_db_query("insert into " . TABLE_CUSTOMERS_BASKET . " (customers_id, products_id, customers_basket_quantity, customers_basket_date_added) values ('" . (int)$customer_id . "', '" . tep_db_input($products_id_string) . "', '" . (int)$qty . "', '" . date('Ymd') . "')");</pre><pre><span

810

-

style='font-size:9.0pt;color:blue'> </pre><pre><span

811

-

style='font-size:9.0pt;color:blue'>�� if (is_array($attributes)) {</pre><pre><span

812

-

style='font-size:9.0pt;color:blue'>�� reset($attributes);</pre><pre><span

813

-

style='font-size:9.0pt;color:blue'>�� while (list($option, $value) = each($attributes)) {</pre><pre><span

814

-

style='font-size:9.0pt;color:blue'>�� $this->contents[$products_id_string]['attributes'][$option] = $value;</pre><pre><span

815

-

style='font-size:9.0pt;color:blue'>// insert into database</pre><pre><span

816

-

style='font-size:9.0pt;color:blue'>�� if (tep_session_is_registered('customer_id')) tep_db_query("insert into " . TABLE_CUSTOMERS_BASKET_ATTRIBUTES . " (customers_id, products_id, products_options_id, products_options_value_id) values ('" . (int)$customer_id . "', '" . tep_db_input($products_id_string) . "', '" . (int)$option . "', '" . (int)$value . "')");</pre><pre><span

817

-

style='font-size:9.0pt;color:blue'>�� }</pre><pre><span

818

-

style='font-size:9.0pt;color:blue'>�� }</pre><pre><span

819

-

style='font-size:9.0pt;color:blue'>�� }</pre><pre><span

820

-

style='font-size:9.0pt;color:blue'> </pre><pre><span

821

-

style='font-size:9.0pt;color:blue'>�� $this->cleanup();</pre><pre><span

822

-

style='font-size:9.0pt;color:blue'> </pre><pre><span

823

-

style='font-size:9.0pt;color:blue'>// assign a temporary unique ID to the order contents to prevent hack attempts during the checkout procedure</pre><pre><span

824

-

style='font-size:9.0pt;color:blue'>�� $this->cartID = $this->generate_cart_id();</pre><pre><span

825

-

style='font-size:9.0pt;color:blue'>�� }</pre><pre><span

826

-

style='font-size:9.0pt;color:blue'>� }</pre><pre><span style='font-size:

827

-

9.0pt;color:blue'>}</pre><br

828

-

clear=all style='page-break-before:always'>

829

-

830

-

831

-

Lines 110-127, from:

832

-

833

-

834

-

835

-

<span style='font-size:9.0pt;font-family:"Courier New";

836

-

color:blue'>function update_quantity($products_id, $quantity = '', $attributes

837

-

= '') {

838

-

839

-

<span style='font-size:9.0pt;font-family:"Courier New";

840

-

color:blue'>� global $customer_id;

841

-

842

-

<span style='font-size:9.0pt;font-family:"Courier New";

843

-

color:blue'>

844

-

845

-

<span style='font-size:9.0pt;font-family:"Courier New";

846

-

color:blue'>� if (empty($quantity)) return true; // nothing needs to be updated

847

-

if theres no quantity, so we return true..

848

-

849

-

<span style='font-size:9.0pt;font-family:"Courier New";

850

-

color:blue'>

851

-

852

-

<span style='font-size:9.0pt;font-family:"Courier New";

853

-

color:blue'>� $this->contents[$products_id] = array('qty' => $quantity);

854

-

855

-

<span style='font-size:9.0pt;font-family:"Courier New";

856

-

color:blue'>// update database

857

-

858

-

<span style='font-size:9.0pt;font-family:"Courier New";

859

-

color:blue'>� if (tep_session_is_registered('customer_id'))

860

-

tep_db_query("update " . TABLE_CUSTOMERS_BASKET . " set

861

-

customers_basket_quantity = '" . $quantity . "' where customers_id =

862

-

'" . (int)$customer_id . "' and products_id = '" . tep_db_input($products_id)

863

-

. "'");

864

-

865

-

<span style='font-size:9.0pt;font-family:"Courier New";

866

-

color:blue'>

867

-

868

-

<span style='font-size:9.0pt;font-family:"Courier New";

869

-

color:blue'>� if (is_array($attributes)) {

870

-

871

-

<span style='font-size:9.0pt;font-family:"Courier New";

872

-

color:blue'>�� reset($attributes);

873

-

874

-

<span style='font-size:9.0pt;font-family:"Courier New";

875

-

color:blue'>�� while (list($option, $value) = each($attributes)) {

876

-

877

-

<span style='font-size:9.0pt;font-family:"Courier New";

878

-

color:blue'>�� $this->contents[$products_id]['attributes'][$option] =

879

-

$value;

880

-

881

-

<span style='font-size:9.0pt;font-family:"Courier New";

882

-

color:blue'>// update database

883

-

884

-

<span style='font-size:9.0pt;font-family:"Courier New";

885

-

color:blue'>�� if (tep_session_is_registered('customer_id')) tep_db_query("update

886

-

" . TABLE_CUSTOMERS_BASKET_ATTRIBUTES . " set

887

-

products_options_value_id = '" . (int)$value . "' where customers_id

888

-

= '" . (int)$customer_id . "' and products_id = '" .

889

-

tep_db_input($products_id) . "' and products_options_id = '" .

890

-

(int)$option . "'");

891

-

892

-

<span style='font-size:9.0pt;font-family:"Courier New";

893

-

color:blue'>�� }

894

-

895

-

<span style='font-size:9.0pt;font-family:"Courier New";

896

-

color:blue'>� }

897

-

898

-

<span style='font-size:9.0pt;font-family:"Courier New";

899

-

color:blue'>}

900

-

901

-

902

-

903

-

to:

904

-

905

-

906

-

907

-

<pre>function update_quantity($products_id, $quantity = '', $attributes = '') {</pre><pre><span

908

-

style='font-size:9.0pt;color:blue'>� global $customer_id;</pre><pre><span

909

-

style='font-size:9.0pt;color:blue'> </pre><pre><span

910

-

style='font-size:9.0pt;color:blue'>� $products_id_string = tep_get_uprid($products_id, $attributes);</pre><pre><span

911

-

style='font-size:9.0pt;color:blue'>� $products_id = tep_get_prid($products_id_string);</pre><pre><span

912

-

style='font-size:9.0pt;color:blue'> </pre><pre><span

913

-

style='font-size:9.0pt;color:blue'>� if (is_numeric($products_id) && isset($this->contents[$products_id_string]) && is_numeric($quantity)) {</pre><pre><span

914

-

style='font-size:9.0pt;color:blue'>�� $this->contents[$products_id_string] = array('qty' => $quantity);</pre><pre><span

915

-

style='font-size:9.0pt;color:blue'>// update database</pre><pre><span

916

-

style='font-size:9.0pt;color:blue'>�� if (tep_session_is_registered('customer_id')) tep_db_query("update " . TABLE_CUSTOMERS_BASKET . " set customers_basket_quantity = '" . (int)$quantity . "' where customers_id = '" . (int)$customer_id . "' and products_id = '" . tep_db_input($products_id_string) . "'");</pre><pre><span

917

-

style='font-size:9.0pt;color:blue'> </pre><pre><span

918

-

style='font-size:9.0pt;color:blue'>�� if (is_array($attributes)) {</pre><pre><span

919

-

style='font-size:9.0pt;color:blue'>�� reset($attributes);</pre><pre><span

920

-

style='font-size:9.0pt;color:blue'>�� while (list($option, $value) = each($attributes)) {</pre><pre><span

921

-

style='font-size:9.0pt;color:blue'>�� $this->contents[$products_id_string]['attributes'][$option] = $value;</pre><pre><span

922

-

style='font-size:9.0pt;color:blue'>// update database</pre><pre><span

923

-

style='font-size:9.0pt;color:blue'>�� if (tep_session_is_registered('customer_id')) tep_db_query("update " . TABLE_CUSTOMERS_BASKET_ATTRIBUTES . " set products_options_value_id = '" . (int)$value . "' where customers_id = '" . (int)$customer_id . "' and products_id = '" . tep_db_input($products_id_string) . "' and products_options_id = '" . (int)$option . "'");</pre><pre><span

924

-

style='font-size:9.0pt;color:blue'>�� }</pre><pre><span

925

-

style='font-size:9.0pt;color:blue'>�� }</pre><pre><span

926

-

style='font-size:9.0pt;color:blue'>� }</pre><pre><span style='font-size:

927

-

9.0pt;color:blue'>}</pre><span style='font-size:16.0pt;font-family:

928

-

Arial'>

929

-

930

-

931

-

<h1><a name="_Toc119693707"></a><a name="_Toc119693033">Session ID XSS Issue</a></h1>

932

-

933

-

<a href="http://www.oscommerce.com/community/bugs,1546">http://www.oscommerce.com/community/bugs,1546</a>

934

-

935

-

936

-

937

-

<h3>Problem:</h3>

938

-

939

-

940

-

941

-

A cross site scripting issue exists with

942

-

malformed session IDs being used in the tep_href_link() function.

943

-

944

-

945

-

946

-

<h3>Solution:</h3>

947

-

948

-

949

-

950

-

Line 66 in

951

-

catalog/includes/functions/html_output.php must be changed from:

952

-

953

-

954

-

955

-

<span lang=EN style='font-size:9.0pt;font-family:"Courier New";

956

-

color:blue'>$link .= $separator . $_sid;

957

-

958

-

959

-

960

-

to:

961

-

962

-

963

-

964

-

<span lang=EN style='font-size:9.0pt;font-family:"Courier New";

965

-

color:blue'>$link .= $separator . tep_output_string($_sid);

966

-

967

-

968

-

969

-

<br clear=all

970

-

style='page-break-before:always'>

971

-

972

-

973

-

<h1><a name="_Toc119693708"></a><a name="_Toc119693034">Validate Session ID</a></h1>

974

-

975

-

976

-

977

-

<h3>Problem:</h3>

978

-

979

-

980

-

981

-

Validate the session ID and redirect to the front page when an

982

-

invalid session ID is requested.

983

-

984

-

985

-

986

-

<h3>Solution:</h3>

987

-

988

-

989

-

990

-

The following function must be replaced in

991

-

catalog/includes/functions/sessions.php.

992

-

993

-

994

-

995

-

Lines 66-68, from:

996

-

997

-

998

-

999

-

<span lang=EN style='font-size:9.0pt;font-family:"Courier New";

1000

-

color:blue'>function tep_session_start() {

1001

-

1002

-

<span lang=EN style='font-size:9.0pt;font-family:"Courier New";

1003

-

color:blue'>� return session_start();

1004

-

1005

-

<span lang=EN style='font-size:9.0pt;font-family:"Courier New";

1006

-

color:blue'>}

1007

-

1008

-

1009

-

1010

-

to:

1011

-

1012

-

1013

-

1014

-

<span lang=EN style='font-size:9.0pt;font-family:"Courier New";

1015

-

color:blue'>function tep_session_start() {

1016

-

1017

-

<span lang=EN style='font-size:9.0pt;font-family:"Courier New";

1018

-

color:blue'>� global $HTTP_GET_VARS, $HTTP_POST_VARS, $HTTP_COOKIE_VARS;

1019

-

1020

-

<span lang=EN style='font-size:9.0pt;font-family:"Courier New";

1021

-

color:blue'>

1022

-

1023

-

<span lang=EN style='font-size:9.0pt;font-family:"Courier New";

1024

-

color:blue'>� $sane_session_id = true;

1025

-

1026

-

<span lang=EN style='font-size:9.0pt;font-family:"Courier New";

1027

-

color:blue'>

1028

-

1029

-

<span lang=EN style='font-size:9.0pt;font-family:"Courier New";

1030

-

color:blue'>� if (isset($HTTP_GET_VARS[tep_session_name()])) {

1031

-

1032

-

<span lang=EN style='font-size:9.0pt;font-family:"Courier New";

1033

-

color:blue'>�� if (preg_match('/^[a-zA-Z0-9]+$/',

1034

-

$HTTP_GET_VARS[tep_session_name()]) == false) {

1035

-

1036

-

<span lang=EN style='font-size:9.0pt;font-family:"Courier New";

1037

-

color:blue'>�� unset($HTTP_GET_VARS[tep_session_name()]);

1038

-

1039

-

<span lang=EN style='font-size:9.0pt;font-family:"Courier New";

1040

-

color:blue'>

1041

-

1042

-

<span lang=EN style='font-size:9.0pt;font-family:"Courier New";

1043

-

color:blue'>�� $sane_session_id = false;

1044

-

1045

-

<span lang=EN style='font-size:9.0pt;font-family:"Courier New";

1046

-

color:blue'>�� }

1047

-

1048

-

<span lang=EN style='font-size:9.0pt;font-family:"Courier New";

1049

-

color:blue'>� } elseif (isset($HTTP_POST_VARS[tep_session_name()])) {

1050

-

1051

-

<span lang=EN style='font-size:9.0pt;font-family:"Courier New";

1052

-

color:blue'>�� if (preg_match('/^[a-zA-Z0-9]+$/',

1053

-

$HTTP_POST_VARS[tep_session_name()]) == false) {

1054

-

1055

-

<span lang=EN style='font-size:9.0pt;font-family:"Courier New";

1056

-

color:blue'>�� unset($HTTP_POST_VARS[tep_session_name()]);

1057

-

1058

-

<span lang=EN style='font-size:9.0pt;font-family:"Courier New";

1059

-

color:blue'>

1060

-

1061

-

<span lang=EN style='font-size:9.0pt;font-family:"Courier New";

1062

-

color:blue'>�� $sane_session_id = false;

1063

-

1064

-

<span lang=EN style='font-size:9.0pt;font-family:"Courier New";

1065

-

color:blue'>�� }

1066

-

1067

-

<span lang=EN style='font-size:9.0pt;font-family:"Courier New";

1068

-

color:blue'>� } elseif (isset($HTTP_COOKIE_VARS[tep_session_name()])) {

1069

-

1070

-

<span lang=EN style='font-size:9.0pt;font-family:"Courier New";

1071

-

color:blue'>�� if (preg_match('/^[a-zA-Z0-9]+$/',

1072

-

$HTTP_COOKIE_VARS[tep_session_name()]) == false) {

1073

-

1074

-

<span lang=EN style='font-size:9.0pt;font-family:"Courier New";

1075

-

color:blue'>�� $session_data = session_get_cookie_params();

1076

-

1077

-

<span lang=EN style='font-size:9.0pt;font-family:"Courier New";

1078

-

color:blue'>

1079

-

1080

-

<span lang=EN style='font-size:9.0pt;font-family:"Courier New";

1081

-

color:blue'>�� setcookie(tep_session_name(), '', time()-42000,

1082

-

$session_data['path'], $session_data['domain']);

1083

-

1084

-

<span lang=EN style='font-size:9.0pt;font-family:"Courier New";

1085

-

color:blue'>

1086

-

1087

-

<span lang=EN style='font-size:9.0pt;font-family:"Courier New";

1088

-

color:blue'>�� $sane_session_id = false;

1089

-

1090

-

<span lang=EN style='font-size:9.0pt;font-family:"Courier New";

1091

-

color:blue'>�� }

1092

-

1093

-

<span lang=EN style='font-size:9.0pt;font-family:"Courier New";

1094

-

color:blue'>� }

1095

-

1096

-

<span lang=EN style='font-size:9.0pt;font-family:"Courier New";

1097

-

color:blue'>

1098

-

1099

-

<span lang=EN style='font-size:9.0pt;font-family:"Courier New";

1100

-

color:blue'>� if ($sane_session_id == false) {

1101

-

1102

-

<span lang=EN style='font-size:9.0pt;font-family:"Courier New";

1103

-

color:blue'>�� tep_redirect(tep_href_link(FILENAME_DEFAULT, '', 'NONSSL',

1104

-

false));

1105

-

1106

-

<span lang=EN style='font-size:9.0pt;font-family:"Courier New";

1107

-

color:blue'>� }

1108

-

1109

-

<span lang=EN style='font-size:9.0pt;font-family:"Courier New";

1110

-

color:blue'>

1111

-

1112

-

<span lang=EN style='font-size:9.0pt;font-family:"Courier New";

1113

-

color:blue'>� return session_start();

1114

-

1115

-

<span lang=EN style='font-size:9.0pt;font-family:"Courier New";

1116

-

color:blue'>}

1117

-

1118

-

<br

1119

-

clear=all style='page-break-before:always'>

1120

-

1121

-

1122

-

<h1><a name="_Toc119693709"></a><a name="_Toc119693035">File Manager Problem</a></h1>

1123

-

1124

-

<a href="http://www.oscommerce.com/community/bugs,1391">http://www.oscommerce.com/community/bugs,1391</a>

1125

-

1126

-

1127

-

1128

-

<h3>Problem:</h3>

1129

-

1130

-

1131

-

1132

-

Parsing errors occur when saving edited files through the

1133

-

File Manager.

1134

-

1135

-

1136

-

1137

-

<h3>Solution:</h3>

1138

-

1139

-

1140

-

1141

-

Line 148 in catalog/admin/file_manager.php must be changed

1142

-

from:

1143

-

1144

-

1145

-

1146

-

<span style='font-size:9.0pt;font-family:"Courier New";

1147

-

color:blue'>$file_contents = htmlspecialchars(implode('',

1148

-

$file_array));

1149

-

1150

-

1151

-

1152

-

to:

1153

-

1154

-

1155

-

1156

-

<span style='font-size:9.0pt;font-family:"Courier New";

1157

-

color:blue'>$file_contents = addslashes(implode('',

1158

-

$file_array));

1159

-

1160

-

<span style='font-size:9.0pt;font-family:"Courier New";

1161

-

color:blue'>

1162

-

1163

-

Note: This update also requires the Contact Us Form XSS

1164

-

Issue update in order to function correctly.<span style='font-size:9.0pt;

1165

-

color:blue'>

1166

-

<a name="_Toc119693710"></a><a name="_Toc119693036"><span

1167

-

class=Heading1Char>HTTP Header Injection</a>

1168

-

1169

-

1170

-

1171

-

<h3>Problem:</h3>

1172

-

1173

-

1174

-

1175

-

By using malicious data it is possible to

1176

-

inject headers into HTTP requests.

1177

-

1178

-

<h3>Solution:</h3>

1179

-

1180

-

1181

-

1182

-

The following function must be replaced in

1183

-

catalog/includes/functions/general.php.

1184

-

1185

-

1186

-

1187

-

Lines 22-32, from:

1188

-

1189

-

1190

-

1191

-

<span style='font-size:9.0pt;font-family:"Courier New";

1192

-

color:blue'>function tep_redirect($url) {

1193

-

1194

-

<span style='font-size:9.0pt;font-family:"Courier New";

1195

-

color:blue'>� if ( (ENABLE_SSL == true) && (getenv('HTTPS') == 'on') )

1196

-

{ // We are loading an SSL page

1197

-

1198

-

<span style='font-size:9.0pt;font-family:"Courier New";

1199

-

color:blue'>�� if (substr($url, 0, strlen(HTTP_SERVER)) == HTTP_SERVER) { //

1200

-

NONSSL url

1201

-

1202

-

<span style='font-size:9.0pt;font-family:"Courier New";

1203

-

color:blue'>�� $url = HTTPS_SERVER . substr($url, strlen(HTTP_SERVER)); //

1204

-

Change it to SSL

1205

-

1206

-

<span style='font-size:9.0pt;font-family:"Courier New";

1207

-

color:blue'>�� }

1208

-

1209

-

<span style='font-size:9.0pt;font-family:"Courier New";

1210

-

color:blue'>� }

1211

-

1212

-

<span style='font-size:9.0pt;font-family:"Courier New";

1213

-

color:blue'>

1214

-

1215

-

<span style='font-size:9.0pt;font-family:"Courier New";

1216

-

color:blue'>� header('Location: ' . $url);

1217

-

1218

-

<span style='font-size:9.0pt;font-family:"Courier New";

1219

-

color:blue'>

1220

-

1221

-

<span style='font-size:9.0pt;font-family:"Courier New";

1222

-

color:blue'>� tep_exit();

1223

-

1224

-

<span style='font-size:9.0pt;font-family:"Courier New";

1225

-

color:blue'>}

1226

-

1227

-

1228

-

1229

-

to:

1230

-

1231

-

1232

-

1233

-

<span style='font-size:9.0pt;font-family:"Courier New";

1234

-

color:blue'>function tep_redirect($url) {

1235

-

1236

-

<span style='font-size:9.0pt;font-family:"Courier New";

1237

-

color:blue'>� if ( (strstr($url, "\n") != false) || (strstr($url,

1238

-

"\r") != false) ) {

1239

-

1240

-

<span style='font-size:9.0pt;font-family:"Courier New";

1241

-

color:blue'>�� tep_redirect(tep_href_link(FILENAME_DEFAULT, '', 'NONSSL',

1242

-

false));

1243

-

1244

-

<span style='font-size:9.0pt;font-family:"Courier New";

1245

-

color:blue'>� }

1246

-

1247

-

<span style='font-size:9.0pt;font-family:"Courier New";

1248

-

color:blue'>

1249

-

1250

-

<span style='font-size:9.0pt;font-family:"Courier New";

1251

-

color:blue'>� if ( (ENABLE_SSL == true) && (getenv('HTTPS') == 'on') )

1252

-

{ // We are loading an SSL page

1253

-

1254

-

<span style='font-size:9.0pt;font-family:"Courier New";

1255

-

color:blue'>�� if (substr($url, 0, strlen(HTTP_SERVER)) == HTTP_SERVER) { //

1256

-

NONSSL url

1257

-

1258

-

<span style='font-size:9.0pt;font-family:"Courier New";

1259

-

color:blue'>�� $url = HTTPS_SERVER . substr($url, strlen(HTTP_SERVER)); //

1260

-

Change it to SSL

1261

-

1262

-

<span style='font-size:9.0pt;font-family:"Courier New";

1263

-

color:blue'>�� }

1264

-

1265

-

<span style='font-size:9.0pt;font-family:"Courier New";

1266

-

color:blue'>��}

1267

-

1268

-

<span style='font-size:9.0pt;font-family:"Courier New";

1269

-

color:blue'>

1270

-

1271

-

<span style='font-size:9.0pt;font-family:"Courier New";

1272

-

color:blue'>� header('Location: ' . $url);

1273

-

1274

-

<span style='font-size:9.0pt;font-family:"Courier New";

1275

-

color:blue'>

1276

-

1277

-

<span style='font-size:9.0pt;font-family:"Courier New";

1278

-

color:blue'>� tep_exit();

1279

-

1280

-

<span style='font-size:9.0pt;font-family:"Courier New";

1281

-

color:blue'>}

1282

-

1283

-

<br

1284

-

clear=all style='page-break-before:always'>

1285

-

1286

-

1287

-

The following function must be replaced in

1288

-

catalog/admin/includes/functions/general.php.

1289

-

1290

-

1291

-

1292

-

Lines 15-26, from:

1293

-

1294

-

1295

-

1296

-

<span style='font-size:9.0pt;font-family:"Courier New";

1297

-

color:blue'>function tep_redirect($url) {

1298

-

1299

-

<span style='font-size:9.0pt;font-family:"Courier New";

1300

-

color:blue'>� global $logger;

1301

-

1302

-

<span style='font-size:9.0pt;font-family:"Courier New";

1303

-

color:blue'>

1304

-

1305

-

<span style='font-size:9.0pt;font-family:"Courier New";

1306

-

color:blue'>� header('Location: ' . $url);

1307

-

1308

-

<span style='font-size:9.0pt;font-family:"Courier New";

1309

-

color:blue'>

1310

-

1311

-

<span style='font-size:9.0pt;font-family:"Courier New";

1312

-

color:blue'>� if (STORE_PAGE_PARSE_TIME == 'true') {

1313

-

1314

-

<span style='font-size:9.0pt;font-family:"Courier New";

1315

-

color:blue'>�� if (!is_object($logger)) $logger = new logger;

1316

-

1317

-

<span style='font-size:9.0pt;font-family:"Courier New";

1318

-

color:blue'>�� $logger->timer_stop();

1319

-

1320

-

<span style='font-size:9.0pt;font-family:"Courier New";

1321

-

color:blue'>� }

1322

-

1323

-

<span style='font-size:9.0pt;font-family:"Courier New";

1324

-

color:blue'>

1325

-

1326

-

<span style='font-size:9.0pt;font-family:"Courier New";

1327

-

color:blue'>� exit;

1328

-

1329

-

<span style='font-size:9.0pt;font-family:"Courier New";

1330

-

color:blue'>}

1331

-

1332

-

1333

-

1334

-

to:

1335

-

1336

-

1337

-

1338

-

<span style='font-size:9.0pt;font-family:"Courier New";

1339

-

color:blue'>function tep_redirect($url) {

1340

-

1341

-

<span style='font-size:9.0pt;font-family:"Courier New";

1342

-

color:blue'>� global $logger;

1343

-

1344

-

<span style='font-size:9.0pt;font-family:"Courier New";

1345

-

color:blue'>

1346

-

1347

-

<span style='font-size:9.0pt;font-family:"Courier New";

1348

-

color:blue'>� if ( (strstr($url, "\n") != false) || (strstr($url,

1349

-

"\r") != false) ) {

1350

-

1351

-

<span style='font-size:9.0pt;font-family:"Courier New";

1352

-

color:blue'>�� tep_redirect(tep_href_link(FILENAME_DEFAULT, '', 'NONSSL',

1353

-

false));

1354

-

1355

-

<span style='font-size:9.0pt;font-family:"Courier New";

1356

-

color:blue'>� }

1357

-

1358

-

<span style='font-size:9.0pt;font-family:"Courier New";

1359

-

color:blue'>

1360

-

1361

-

<span style='font-size:9.0pt;font-family:"Courier New";

1362

-

color:blue'>� header('Location: ' . $url);

1363

-

1364

-

<span style='font-size:9.0pt;font-family:"Courier New";

1365

-

color:blue'>

1366

-

1367

-

<span style='font-size:9.0pt;font-family:"Courier New";

1368

-

color:blue'>� if (STORE_PAGE_PARSE_TIME == 'true') {

1369

-

1370

-

<span style='font-size:9.0pt;font-family:"Courier New";

1371

-

color:blue'>�� if (!is_object($logger)) $logger = new logger;

1372

-

1373

-

<span style='font-size:9.0pt;font-family:"Courier New";

1374

-

color:blue'>�� $logger->timer_stop();

1375

-

1376

-

<span style='font-size:9.0pt;font-family:"Courier New";

1377

-

color:blue'>� }

1378

-

1379

-

<span style='font-size:9.0pt;font-family:"Courier New";

1380

-

color:blue'>

1381

-

1382

-

<span style='font-size:9.0pt;font-family:"Courier New";

1383

-

color:blue'>� exit;

1384

-

1385

-

<span style='font-size:9.0pt;font-family:"Courier New";

1386

-

color:blue'>}<br clear=all

1387

-

style='page-break-before:always'>

1388

-

<a name="_Toc119693711"></a><a name="_Toc119693037"><span

1389

-

class=Heading1Char>E-Mail Header Injection</a>

1390

-

1391

-

<a href="http://www.oscommerce.com/community/bugs,2488">http://www.oscommerce.com/community/bugs,2488</a>

1392

-

1393

-

1394

-

1395

-

<h3>Problem:</h3>

1396

-

1397

-

1398

-

1399

-

By using malicious data it is possible to

1400

-

inject headers into emails the online store sends.

1401

-

1402

-

1403

-

1404

-

<h3>Solution:</h3>

1405

-

1406

-

1407

-

1408

-

The following function must be replaced in catalog/includes/classes/email.php

1409

-

and catalog/admin/includes/classes/email.php.

1410

-

1411

-

1412

-

1413

-

Lines 473-504, from:

1414

-

1415

-

1416

-

1417

-

<span style='font-size:9.0pt;font-family:"Courier New";

1418

-

color:blue'>function send($to_name, $to_addr, $from_name, $from_addr, $subject

1419

-

= '', $headers = '') {

1420

-

1421

-

<span style='font-size:9.0pt;font-family:"Courier New";

1422

-

color:blue'>� $to = (($to_name != '') ? '"' . $to_name . '" <' .

1423

-

$to_addr . '>' : $to_addr);

1424

-

1425

-

<span style='font-size:9.0pt;font-family:"Courier New";

1426

-

color:blue'>� $from = (($from_name != '') ? '"' . $from_name . '"

1427

-

<' . $from_addr . '>' : $from_addr);

1428

-

1429

-

<span style='font-size:9.0pt;font-family:"Courier New";

1430

-

color:blue'>

1431

-

1432

-

<span style='font-size:9.0pt;font-family:"Courier New";

1433

-

color:blue'>� if (is_string($headers)) {

1434

-

1435

-

<span style='font-size:9.0pt;font-family:"Courier New";

1436

-

color:blue'>�� $headers = explode($this->lf, trim($headers));

1437

-

1438

-

<span style='font-size:9.0pt;font-family:"Courier New";

1439

-

color:blue'>� }

1440

-

1441

-

<span style='font-size:9.0pt;font-family:"Courier New";

1442

-

color:blue'>

1443

-

1444

-

<span style='font-size:9.0pt;font-family:"Courier New";

1445

-

color:blue'>� for ($i=0; $i<count($headers); $i++) {

1446

-

1447

-

<span style='font-size:9.0pt;font-family:"Courier New";

1448

-

color:blue'>�� if (is_array($headers[$i])) {

1449

-

1450

-

<span style='font-size:9.0pt;font-family:"Courier New";

1451

-

color:blue'>�� for ($j=0; $j<count($headers[$i]); $j++) {

1452

-

1453

-

<span style='font-size:9.0pt;font-family:"Courier New";

1454

-

color:blue'>�� if ($headers[$i][$j] != '') {

1455

-

1456

-

<span style='font-size:9.0pt;font-family:"Courier New";

1457

-

color:blue'>�� $xtra_headers[] = $headers[$i][$j];

1458

-

1459

-

<span style='font-size:9.0pt;font-family:"Courier New";

1460

-

color:blue'>�� }

1461

-

1462

-

<span style='font-size:9.0pt;font-family:"Courier New";

1463

-

color:blue'>�� }

1464

-

1465

-

<span style='font-size:9.0pt;font-family:"Courier New";

1466

-

color:blue'>�� }

1467

-

1468

-

<span style='font-size:9.0pt;font-family:"Courier New";

1469

-

color:blue'>

1470

-

1471

-

<span style='font-size:9.0pt;font-family:"Courier New";

1472

-

color:blue'>�� if ($headers[$i] != '') {

1473

-

1474

-

<span style='font-size:9.0pt;font-family:"Courier New";

1475

-

color:blue'>�� $xtra_headers[] = $headers[$i];

1476

-

1477

-

<span style='font-size:9.0pt;font-family:"Courier New";

1478

-

color:blue'>�� }

1479

-

1480

-

<span style='font-size:9.0pt;font-family:"Courier New";

1481

-

color:blue'>� }

1482

-

1483

-

<span style='font-size:9.0pt;font-family:"Courier New";

1484

-

color:blue'>

1485

-

1486

-

<span style='font-size:9.0pt;font-family:"Courier New";

1487

-

color:blue'>� if (!isset($xtra_headers)) {

1488

-

1489

-

<span style='font-size:9.0pt;font-family:"Courier New";

1490

-

color:blue'>�� $xtra_headers = array();

1491

-

1492

-

<span style='font-size:9.0pt;font-family:"Courier New";

1493

-

color:blue'>� }

1494

-

1495

-

<span style='font-size:9.0pt;font-family:"Courier New";

1496

-

color:blue'>

1497

-

1498

-

<span style='font-size:9.0pt;font-family:"Courier New";

1499

-

color:blue'>� if (EMAIL_TRANSPORT == 'smtp') {

1500

-

1501

-

<span style='font-size:9.0pt;font-family:"Courier New";

1502

-

color:blue'>�� return mail($to_addr, $subject, $this->output, 'From: ' .

1503

-

$from . $this->lf . 'To: ' . $to . $this->lf . implode($this->lf,

1504

-

$this->headers) . $this->lf . implode($this->lf, $xtra_headers));

1505

-

1506

-

<span style='font-size:9.0pt;font-family:"Courier New";

1507

-

color:blue'>� } else {

1508

-

1509

-

<span style='font-size:9.0pt;font-family:"Courier New";

1510

-

color:blue'>�� return mail($to, $subject, $this->output, 'From:

1511

-

'.$from.$this->lf.implode($this->lf,

1512

-

$this->headers).$this->lf.implode($this->lf, $xtra_headers));

1513

-

1514

-

<span style='font-size:9.0pt;font-family:"Courier New";

1515

-

color:blue'>� }

1516

-

1517

-

<span style='font-size:9.0pt;font-family:"Courier New";

1518

-

color:blue'>}

1519

-

1520

-

<span style='font-size:9.0pt;font-family:"Courier New";

1521

-

color:blue'>

1522

-

1523

-

to:

1524

-

1525

-

1526

-

1527

-

<span style='font-size:9.0pt;font-family:"Courier New";

1528

-

color:blue'>function send($to_name, $to_addr, $from_name, $from_addr, $subject

1529

-

= '', $headers = '') {

1530

-

� if ((strstr($to_name, "\n") !=

1531

-

false) || (strstr($to_name, "\r") != false)) {

1532

-

1533

-

<span style='font-size:9.0pt;font-family:"Courier New";

1534

-

color:blue;background:yellow'>�� return false;

1535

-

� }

1536

-

1537

-

� if ((strstr($to_addr, "\n") != false) || (strstr($to_addr,

1538

-

"\r") != false)) {

1539

-

�� return false;

1540

-

� }

1541

-

1542

-

� if ((strstr($subject, "\n") != false) || (strstr($subject,

1543

-

"\r") != false)) {

1544

-

�� return false;

1545

-

� }

1546

-

1547

-

� if ((strstr($from_name, "\n") != false) || (strstr($from_name,

1548

-

"\r") != false)) {

1549

-

�� return false;

1550

-

� }

1551

-

1552

-

� if ((strstr($from_addr, "\n") != false) || (strstr($from_addr,

1553

-

"\r") != false)) {

1554

-

�� return false;

1555

-

� }

1556

-

1557

-

� $to = (($to_name != '') ? '"' . $to_name . '" <' . $to_addr .

1558

-

'>' : $to_addr);

1559

-

� $from = (($from_name != '') ? '"' . $from_name . '" <' . $from_addr

1560

-

. '>' : $from_addr);

1561

-

1562

-

� if (is_string($headers)) {

1563

-

�� $headers = explode($this->lf, trim($headers));

1564

-

� }

1565

-

1566

-

� for ($i=0; $i<count($headers); $i++) {

1567

-

�� if (is_array($headers[$i])) {

1568

-

�� for ($j=0; $j<count($headers[$i]); $j++) {

1569

-

�� if ($headers[$i][$j] != '') {

1570

-

�� $xtra_headers[] = $headers[$i][$j];

1571

-

�� }

1572

-

�� }

1573

-

�� }

1574

-

1575

-

�� if ($headers[$i] != '') {

1576

-

�� $xtra_headers[] = $headers[$i];

1577

-

�� }

1578

-

� }

1579

-

1580

-

� if (!isset($xtra_headers)) {

1581

-

�� $xtra_headers = array();

1582

-

� }

1583

-

1584

-

� if (EMAIL_TRANSPORT == 'smtp') {

1585

-

�� return mail($to_addr, $subject, $this->output, 'From: ' . $from .

1586

-

$this->lf . 'To: ' . $to . $this->lf . implode($this->lf,

1587

-

$this->headers) . $this->lf . implode($this->lf, $xtra_headers));

1588

-

� } else {

1589

-

�� return mail($to, $subject, $this->output, 'From:

1590

-

'.$from.$this->lf.implode($this->lf, $this->headers).$this->lf.implode($this->lf,

1591

-

$xtra_headers));

1592

-

� }

1593

-

}

1594

-

1595

-

<br clear=all

1596

-

style='page-break-before:always'>

1597

-

1598

-

1599

-

<h1><a name="_Toc119693712"></a><a name="_Toc119693038">Contact Us Form XSS

1600

-

Issue</a></h1>

1601

-

1602

-

<a href="http://www.oscommerce.com/community/bugs,2422">http://www.oscommerce.com/community/bugs,2422</a>

1603

-

1604

-

1605

-

1606

-

<h3>Problem:</h3>

1607

-

1608

-

1609

-

1610

-

By using malicious data it is possible to

1611

-

inject HTML into the page.

1612

-

1613

-

1614

-

1615

-

<h3>Solution:</h3>

1616

-

1617

-

1618

-

1619

-

Lines 221-225 in catalog/includes/functions/html_output.php

1620

-

must be changed from:

1621

-

1622

-

1623

-

1624

-

<span style='font-size:9.0pt;font-family:"Courier New";

1625

-

color:blue'>if ( (isset($GLOBALS[$name])) && ($reinsert_value == true)

1626

-

) {

1627

-

1628

-

<span style='font-size:9.0pt;font-family:"Courier New";

1629

-

color:blue'>� $field .= stripslashes($GLOBALS[$name]);

1630

-

1631

-

<span style='font-size:9.0pt;font-family:"Courier New";

1632

-

color:blue'>} elseif (tep_not_null($text)) {

1633

-

1634

-

<span style='font-size:9.0pt;font-family:"Courier New";

1635

-

color:blue'>� $field .= $text;

1636

-

1637

-

<span style='font-size:9.0pt;font-family:"Courier New";

1638

-

color:blue'>}

1639

-

1640

-

1641

-

1642

-

to:

1643

-

1644

-

1645

-

1646

-

<span style='font-size:9.0pt;font-family:"Courier New";

1647

-

color:blue'>if ( (isset($GLOBALS[$name])) && ($reinsert_value == true)

1648

-

) {

1649

-

1650

-

<span style='font-size:9.0pt;font-family:"Courier New";

1651

-

color:blue'>� $field .= tep_output_string_protected(stripslashes($GLOBALS[$name]));

1652

-

1653

-

<span style='font-size:9.0pt;font-family:"Courier New";

1654

-

color:blue'>} elseif (tep_not_null($text)) {

1655

-

1656

-

<span style='font-size:9.0pt;font-family:"Courier New";

1657

-

color:blue'>� $field .= tep_output_string_protected($text);

1658

-

1659

-

<span style='font-size:9.0pt;font-family:"Courier New";

1660

-

color:blue'>}

1661

-

1662

-

1663

-

1664

-

Lines 244-248 in

1665

-

catalog/admin/includes/functions/html_output.php must be changed from:

1666

-

1667

-

1668

-

1669

-

<span style='font-size:9.0pt;font-family:"Courier New";

1670

-

color:blue'>if ( (isset($GLOBALS[$name])) && ($reinsert_value == true)

1671

-

) {

1672

-

1673

-

<span style='font-size:9.0pt;font-family:"Courier New";

1674

-

color:blue'>� $field .= stripslashes($GLOBALS[$name]);

1675

-

1676

-

<span style='font-size:9.0pt;font-family:"Courier New";

1677

-

color:blue'>} elseif (tep_not_null($text)) {

1678

-

1679

-

<span style='font-size:9.0pt;font-family:"Courier New";

1680

-

color:blue'>� $field .= $text;

1681

-

1682

-

<span style='font-size:9.0pt;font-family:"Courier New";

1683

-

color:blue'>}

1684

-

1685

-

1686

-

1687

-

to:

1688

-

1689

-

1690

-

1691

-

<span style='font-size:9.0pt;font-family:"Courier New";

1692

-

color:blue'>if ( (isset($GLOBALS[$name])) && ($reinsert_value == true)

1693

-

) {

1694

-

1695

-

<span style='font-size:9.0pt;font-family:"Courier New";

1696

-

color:blue'>� $field .= tep_output_string_protected(stripslashes($GLOBALS[$name]));

1697

-

1698

-

<span style='font-size:9.0pt;font-family:"Courier New";

1699

-

color:blue'>} elseif (tep_not_null($text)) {

1700

-

1701

-

<span style='font-size:9.0pt;font-family:"Courier New";

1702

-

color:blue'>� $field .= tep_output_string_protected($text);

1703

-

1704

-

<span style='font-size:9.0pt;font-family:"Courier New";

1705

-

color:blue'>}

1706

-

1707

-

<br clear=all

1708

-

style='page-break-before:always'>

1709

-

1710

-

1711

-

<h1><a name="_Toc119693713"></a><a name="_Toc119693039">Open Redirector</a></h1>

1712

-

1713

-

<a href="http://www.oscommerce.com/community/bugs,2970">http://www.oscommerce.com/community/bugs,2970</a>

1714

-

1715

-

1716

-

1717

-

<h3>Problem:</h3>

1718

-

1719

-

1720

-

1721

-

There is no URL checking being performed on the redirection

1722

-

page, and allows external sources to use the page as an open redirect relay.

1723

-

1724

-

1725

-

1726

-

<h3>Solution:</h3>

1727

-

1728

-

1729

-

1730

-

Lines 27-29 in catalog/redirect.php must be changed from:

1731

-

1732

-

1733

-

1734

-

<span style='font-size:9.0pt;font-family:"Courier New";

1735

-

color:blue'>if (isset($HTTP_GET_VARS['goto']) &&

1736

-

tep_not_null($HTTP_GET_VARS['goto'])) {

1737

-

1738

-

<span style='font-size:9.0pt;font-family:"Courier New";

1739

-

color:blue'>� tep_redirect('http://' . $HTTP_GET_VARS['goto']);

1740

-

1741

-

<span style='font-size:9.0pt;font-family:"Courier New";

1742

-

color:blue'>}

1743

-

1744

-

1745

-

1746

-

to:

1747

-

1748

-

1749

-

1750

-

<span style='font-size:9.0pt;font-family:"Courier New";

1751

-

color:blue'>if (isset($HTTP_GET_VARS['goto']) && tep_not_null($HTTP_GET_VARS['goto']))

1752

-

{

1753

-

1754

-

<span style='font-size:9.0pt;font-family:"Courier New";

1755

-

color:blue'>� $check_query = tep_db_query("select products_url from "

1756

-

. TABLE_PRODUCTS_DESCRIPTION . " where products_url = '" .

1757

-

tep_db_input($HTTP_GET_VARS['goto']) . "' limit 1");

1758

-

1759

-

<span style='font-size:9.0pt;font-family:"Courier New";

1760

-

color:blue'>� if (tep_db_num_rows($check_query)) {

1761

-

1762

-

<span style='font-size:9.0pt;font-family:"Courier New";

1763

-

color:blue'>�� tep_redirect('http://' . $HTTP_GET_VARS['goto']);

1764

-

1765

-

<span style='font-size:9.0pt;font-family:"Courier New";

1766

-

color:blue'>� }

1767

-

1768

-

<span style='font-size:9.0pt;font-family:"Courier New";

1769

-

color:blue'>}

1770

-

1771

-

<br clear=all

1772

-

style='page-break-before:always'>

1773

-

1774

-

1775

-

<h1><a name="_Toc119693714"></a><a name="_Toc119693040">Extra Slashes In New

1776

-

Products</a></h1>

1777

-

1778

-

1779

-

1780

-

<h3>Problem:</h3>

1781

-

1782

-

1783

-

1784

-

When new products are entered and previewed, hitting the

1785

-

back button to edit the product data again adds extra slashes to apostrophes in

1786

-

the products name and description.

1787

-

1788

-

1789

-

1790

-

<h3>Solution:</h3>

1791

-

1792

-

1793

-

1794

-

The following lines must be replaced in catalog/admin/categories.php:

1795

-

1796

-

1797

-

1798

-

Line 504, from:

1799

-

1800

-

1801

-

1802

-

<span style='font-size:9.0pt;font-family:"Courier New";

1803

-

color:blue'><td class="main"><?php echo

1804

-

tep_image(DIR_WS_CATALOG_LANGUAGES . $languages[$i]['directory'] . '/images/' .

1805

-

$languages[$i]['image'], $languages[$i]['name']) . '&nbsp;' .

1806

-

tep_draw_input_field('products_name[' . $languages[$i]['id'] . ']',

1807

-

(isset($products_name[$languages[$i]['id']]) ? $products_name[$languages[$i]['id']]

1808

-

: tep_get_products_name($pInfo->products_id, $languages[$i]['id'])));

1809

-

?></td>

1810

-

1811

-

1812

-

1813

-

to:

1814

-

1815

-

1816

-

1817

-

<span style='font-size:9.0pt;font-family:"Courier New";

1818

-

color:blue'><td class="main"><?php echo

1819

-

tep_image(DIR_WS_CATALOG_LANGUAGES . $languages[$i]['directory'] . '/images/' .

1820

-

$languages[$i]['image'], $languages[$i]['name']) . '&nbsp;' .

1821

-

tep_draw_input_field('products_name[' . $languages[$i]['id'] . ']',

1822

-

(isset($products_name[$languages[$i]['id']]) ? stripslashes($products_name[$languages[$i]['id']])

1823

-

: tep_get_products_name($pInfo->products_id, $languages[$i]['id'])));

1824

-

?></td>

1825

-

1826

-

1827

-

1828

-

Line 538, from:

1829

-

1830

-

1831

-

1832

-

<span style='font-size:9.0pt;font-family:"Courier New";

1833

-

color:blue'><td class="main"><?php echo

1834

-

tep_draw_textarea_field('products_description[' . $languages[$i]['id'] . ']',

1835

-

'soft', '70', '15', (isset($products_description[$languages[$i]['id']]) ? <span

1836

-

style='background:yellow'>$products_description[$languages[$i]['id']] :

1837

-

tep_get_products_description($pInfo->products_id, $languages[$i]['id'])));

1838

-

?></td>

1839

-

1840

-

1841

-

1842

-

to:

1843

-

1844

-

1845

-

1846

-

<span style='font-size:9.0pt;font-family:"Courier New";

1847

-

color:blue'><td class="main"><?php echo tep_draw_textarea_field('products_description['

1848

-

. $languages[$i]['id'] . ']', 'soft', '70', '15',

1849

-

(isset($products_description[$languages[$i]['id']]) ? <span style='background:

1850

-

yellow'>stripslashes($products_description[$languages[$i]['id']]) :

1851

-

tep_get_products_description($pInfo->products_id, $languages[$i]['id'])));

1852

-

?></td>

1853

-

1854

-

<br clear=all

1855

-

style='page-break-before:always'>

1856

-

1857

-

1858

-

Line 574, from:

1859

-

1860

-

1861

-

1862

-

<span style='font-size:9.0pt;font-family:"Courier New";

1863

-

color:blue'><td class="main"><?php echo

1864

-

tep_image(DIR_WS_CATALOG_LANGUAGES . $languages[$i]['directory'] . '/images/' .

1865

-

$languages[$i]['image'], $languages[$i]['name']) . '&nbsp;' .

1866

-

tep_draw_input_field('products_url[' . $languages[$i]['id'] . ']',

1867

-

(isset($products_url[$languages[$i]['id']]) ? $products_url[$languages[$i]['id']]

1868

-

: tep_get_products_url($pInfo->products_id, $languages[$i]['id'])));

1869

-

?></td>

1870

-

1871

-

1872

-

1873

-

to:

1874

-

1875

-

1876

-

1877

-

<span style='font-size:9.0pt;font-family:"Courier New";

1878

-

color:blue'><td class="main"><?php echo

1879

-

tep_image(DIR_WS_CATALOG_LANGUAGES . $languages[$i]['directory'] . '/images/' .

1880

-

$languages[$i]['image'], $languages[$i]['name']) . '&nbsp;' .

1881

-

tep_draw_input_field('products_url[' . $languages[$i]['id'] . ']',

1882

-

(isset($products_url[$languages[$i]['id']]) ? stripslashes($products_url[$languages[$i]['id']])

1883

-

: tep_get_products_url($pInfo->products_id, $languages[$i]['id'])));

1884

-

?></td>

1885

-

1886

-

<br clear=all

1887

-

style='page-break-before:always'>

1888

-

1889

-

1890

-

<h1><a name="_Toc119693715"></a><a name="_Toc119693041">Order Status Filtering</a></h1>

1891

-

1892

-

<a href="http://www.oscommerce.com/community/bugs,1543">http://www.oscommerce.com/community/bugs,1543</a>

1893

-

1894

-

1895

-

1896

-

<h3>Problem:</h3>

1897

-

1898

-

1899

-

1900

-

After changing the order status filtering on the

1901

-

Administration Tool -> Customers -> Orders page, selecting "All

1902

-

Orders" would show an empty listing of orders.

1903

-

1904

-

1905

-

1906

-

<h3>Solution:</h3>

1907

-

1908

-

1909

-

1910

-

Line 357 in catalog/admin/orders.php must be changed from:

1911

-

1912

-

1913

-

1914

-

<span style='font-size:9.0pt;font-family:"Courier New";

1915

-

color:blue'>} elseif (isset($HTTP_GET_VARS['status'])) {

1916

-

1917

-

1918

-

1919

-

to:

1920

-

1921

-

1922

-

1923

-

<span style='font-size:9.0pt;font-family:"Courier New";

1924

-

color:blue'>} elseif (isset($HTTP_GET_VARS['status']) <span style='background:

1925

-

yellow'>&& is_numeric($HTTP_GET_VARS['status']) &&

1926

-

($HTTP_GET_VARS['status'] > 0)) {

1927

-

1928

-

<br clear=all

1929

-

style='page-break-before:always'>

1930

-

1931

-

1932

-

<h1><a name="_Toc119693716"></a><a name="_Toc119693042">MySQL 5.0 Compatibility</a></h1>

1933

-

1934

-

1935

-

1936

-

<h3>Problem:</h3>

1937

-

1938

-

1939

-

1940

-

MySQL 5.0 introduces Server SQL modes as part of its SQL

1941

-

2003 standards support, and uses a more stricter approach to executing SQL

1942

-

queries. This is performed by default with setting STRICT_TRANS_TABLES as a

1943

-

Server SQL mode.

1944

-

1945

-

1946

-

1947

-

Due to this new setting, MySQL fails on certain SQL queries

1948

-

and produces error messages on the screen.

1949

-

1950

-

1951

-

1952

-

<h3>Solution:</h3>

1953

-

1954

-

1955

-

1956

-

Lines 213-223 in catalog/advanced_search_result.php must be

1957

-

changed from:

1958

-

1959

-

1960

-

1961

-

<span style='font-size:9.0pt;font-family:"Courier New";

1962

-

color:blue'>$from_str = "from " . TABLE_PRODUCTS . " p left join

1963

-

" . TABLE_MANUFACTURERS . " m using(manufacturers_id) left join

1964

-

" . TABLE_SPECIALS . " s on p.products_id = s.products_id, " .

1965

-

TABLE_PRODUCTS_DESCRIPTION . " pd, " . TABLE_CATEGORIES . " c,

1966

-

" . TABLE_PRODUCTS_TO_CATEGORIES . " p2c";

1967

-

1968

-

<span style='font-size:9.0pt;font-family:"Courier New";

1969

-

color:blue'>

1970

-

1971

-

<span style='font-size:9.0pt;font-family:"Courier New";

1972

-

color:blue'>if ( (DISPLAY_PRICE_WITH_TAX == 'true') &&

1973

-

(tep_not_null($pfrom) || tep_not_null($pto)) ) {

1974

-

1975

-

<span style='font-size:9.0pt;font-family:"Courier New";

1976

-

color:blue'>� if (!tep_session_is_registered('customer_country_id')) {

1977

-

1978

-

<span style='font-size:9.0pt;font-family:"Courier New";

1979

-

color:blue'>�� $customer_country_id = STORE_COUNTRY;

1980

-

1981

-

<span style='font-size:9.0pt;font-family:"Courier New";

1982

-

color:blue'>�� $customer_zone_id = STORE_ZONE;

1983

-

1984

-

<span style='font-size:9.0pt;font-family:"Courier New";

1985

-

color:blue'>� }

1986

-

1987

-

<span style='font-size:9.0pt;font-family:"Courier New";

1988

-

color:blue'>� $from_str .= " left join " . TABLE_TAX_RATES . "

1989

-

tr on p.products_tax_class_id = tr.tax_class_id left join " .

1990

-

TABLE_ZONES_TO_GEO_ZONES . " gz on tr.tax_zone_id = gz.geo_zone_id and

1991

-

(gz.zone_country_id is null or gz.zone_country_id = '0' or gz.zone_country_id =

1992

-

'" . (int)$customer_country_id . "') and (gz.zone_id is null or

1993

-

gz.zone_id = '0' or gz.zone_id = '" . (int)$customer_zone_id .

1994

-

"')";

1995

-

1996

-

<span style='font-size:9.0pt;font-family:"Courier New";

1997

-

color:blue'>}

1998

-

1999

-

<span style='font-size:9.0pt;font-family:"Courier New";

2000

-

color:blue'>

2001

-

2002

-

<span style='font-size:9.0pt;font-family:"Courier New";

2003

-

color:blue'>$where_str = " where p.products_status = '1' and p.products_id

2004

-

= pd.products_id and pd.language_id = '" . (int)$languages_id . "'

2005

-

and p.products_id = p2c.products_id and p2c.categories_id = c.categories_id

2006

-

";

2007

-

2008

-

2009

-

2010

-

<br clear=all

2011

-

style='page-break-before:always'>

2012

-

2013

-

2014

-

to:

2015

-

2016

-

2017

-

2018

-

<span style='font-size:9.0pt;font-family:"Courier New";

2019

-

color:blue'>$from_str = "from " . TABLE_PRODUCTS . " p left join

2020

-

" . TABLE_MANUFACTURERS . " m using(manufacturers_id) left join

2021

-

" . TABLE_SPECIALS . " s on p.products_id = s.products_id";

2022

-

2023

-

<span style='font-size:9.0pt;font-family:"Courier New";

2024

-

color:blue'>

2025

-

2026

-

<span style='font-size:9.0pt;font-family:"Courier New";

2027

-

color:blue'>if ( (DISPLAY_PRICE_WITH_TAX == 'true') &&

2028

-

(tep_not_null($pfrom) || tep_not_null($pto)) ) {

2029

-

2030

-

<span style='font-size:9.0pt;font-family:"Courier New";

2031

-

color:blue'>� if (!tep_session_is_registered('customer_country_id')) {

2032

-

2033

-

<span style='font-size:9.0pt;font-family:"Courier New";

2034

-

color:blue'>�� $customer_country_id = STORE_COUNTRY;

2035

-

2036

-

<span style='font-size:9.0pt;font-family:"Courier New";

2037

-

color:blue'>�� $customer_zone_id = STORE_ZONE;

2038

-

2039

-

<span style='font-size:9.0pt;font-family:"Courier New";

2040

-

color:blue'>� }

2041

-

2042

-

<span style='font-size:9.0pt;font-family:"Courier New";

2043

-

color:blue'>� $from_str .= " left join " . TABLE_TAX_RATES . "

2044

-

tr on p.products_tax_class_id = tr.tax_class_id left join " .

2045

-

TABLE_ZONES_TO_GEO_ZONES . " gz on tr.tax_zone_id = gz.geo_zone_id and

2046

-

(gz.zone_country_id is null or gz.zone_country_id = '0' or gz.zone_country_id =

2047

-

'" . (int)$customer_country_id . "') and (gz.zone_id is null or

2048

-

gz.zone_id = '0' or gz.zone_id = '" . (int)$customer_zone_id .

2049

-

"')";

2050

-

2051

-

<span style='font-size:9.0pt;font-family:"Courier New";

2052

-

color:blue'>}

2053

-

2054

-

<span style='font-size:9.0pt;font-family:"Courier New";

2055

-

color:blue'>

2056

-

2057

-

<span style='font-size:9.0pt;font-family:"Courier New";

2058

-

color:blue'>$from_str .= ", " . TABLE_PRODUCTS_DESCRIPTION . "

2059

-

pd, " . TABLE_CATEGORIES . " c, " . TABLE_PRODUCTS_TO_CATEGORIES

2060

-

. " p2c";

2061

-

2062

-

<span style='font-size:9.0pt;font-family:"Courier New";

2063

-

color:blue'>

2064

-

2065

-

<span style='font-size:9.0pt;font-family:"Courier New";

2066

-

color:blue'>$where_str = " where p.products_status = '1' and p.products_id

2067

-

= pd.products_id and pd.language_id = '" . (int)$languages_id . "'

2068

-

and p.products_id = p2c.products_id and p2c.categories_id = c.categories_id

2069

-

";

2070

-

2071

-

2072

-

2073

-

The following lines must be replaced in catalog/index.php:

2074

-

2075

-

2076

-

2077

-

Line 175, from:

2078

-

2079

-

2080

-

2081

-

<span style='font-size:9.0pt;font-family:"Courier New";

2082

-

color:blue'>$listing_sql = "select " . $select_column_list . "

2083

-

p.products_id, p.manufacturers_id, p.products_price, p.products_tax_class_id,

2084

-

IF(s.status, s.specials_new_products_price, NULL) as

2085

-

specials_new_products_price, IF(s.status, s.specials_new_products_price,

2086

-

p.products_price) as final_price from " . TABLE_PRODUCTS . " p,

2087

-

" . TABLE_PRODUCTS_DESCRIPTION . " pd, " . TABLE_MANUFACTURERS .

2088

-

" m, " . TABLE_PRODUCTS_TO_CATEGORIES . " p2c <span

2089

-

style='background:yellow'>left join " . TABLE_SPECIALS . " s on

2090

-

p.products_id = s.products_id where p.products_status = '1' and

2091

-

p.manufacturers_id = m.manufacturers_id and m.manufacturers_id = '" .

2092

-

(int)$HTTP_GET_VARS['manufacturers_id'] . "' and p.products_id =

2093

-

p2c.products_id and pd.products_id = p2c.products_id and pd.language_id =

2094

-

'" . (int)$languages_id . "' and p2c.categories_id = '" .

2095

-

(int)$HTTP_GET_VARS['filter_id'] . "'";

2096

-

2097

-

2098

-

2099

-

to:

2100

-

2101

-

2102

-

2103

-

<span style='font-size:9.0pt;font-family:"Courier New";

2104

-

color:blue'>$listing_sql = "select " . $select_column_list . "

2105

-

p.products_id, p.manufacturers_id, p.products_price, p.products_tax_class_id,

2106

-

IF(s.status, s.specials_new_products_price, NULL) as

2107

-

specials_new_products_price, IF(s.status, s.specials_new_products_price,

2108

-

p.products_price) as final_price from " . TABLE_PRODUCTS . " p <span

2109

-

style='background:yellow'>left join " . TABLE_SPECIALS . " s on

2110

-

p.products_id = s.products_id, " . TABLE_PRODUCTS_DESCRIPTION .

2111

-

" pd, " . TABLE_MANUFACTURERS . " m, " .

2112

-

TABLE_PRODUCTS_TO_CATEGORIES . " p2c where p.products_status = '1' and

2113

-

p.manufacturers_id = m.manufacturers_id and m.manufacturers_id = '" .

2114

-

(int)$HTTP_GET_VARS['manufacturers_id'] . "' and p.products_id =

2115

-

p2c.products_id and pd.products_id = p2c.products_id and pd.language_id =

2116

-

'" . (int)$languages_id . "' and p2c.categories_id = '" .

2117

-

(int)$HTTP_GET_VARS['filter_id'] . "'";

2118

-

2119

-

2120

-

2121

-

<br clear=all

2122

-

style='page-break-before:always'>

2123

-

2124

-

2125

-

Line 178, from:

2126

-

2127

-

2128

-

2129

-

<span style='font-size:9.0pt;font-family:"Courier New";

2130

-

color:blue'>$listing_sql = "select " . $select_column_list . "

2131

-

p.products_id, p.manufacturers_id, p.products_price, p.products_tax_class_id,

2132

-

IF(s.status, s.specials_new_products_price, NULL) as

2133

-

specials_new_products_price, IF(s.status, s.specials_new_products_price,

2134

-

p.products_price) as final_price from " . TABLE_PRODUCTS . " p,

2135

-

" . TABLE_PRODUCTS_DESCRIPTION . " pd, " . TABLE_MANUFACTURERS .

2136

-

" m left join " . TABLE_SPECIALS .

2137

-

" s on p.products_id = s.products_id where p.products_status = '1'

2138

-

and pd.products_id = p.products_id and pd.language_id = '" .

2139

-

(int)$languages_id . "' and p.manufacturers_id = m.manufacturers_id and

2140

-

m.manufacturers_id = '" . (int)$HTTP_GET_VARS['manufacturers_id'] .

2141

-

"'";

2142

-

2143

-

2144

-

2145

-

to:

2146

-

2147

-

2148

-

2149

-

<span style='font-size:9.0pt;font-family:"Courier New";

2150

-

color:blue'>$listing_sql = "select " . $select_column_list . "

2151

-

p.products_id, p.manufacturers_id, p.products_price, p.products_tax_class_id,

2152

-

IF(s.status, s.specials_new_products_price, NULL) as

2153

-

specials_new_products_price, IF(s.status, s.specials_new_products_price,

2154

-

p.products_price) as final_price from " . TABLE_PRODUCTS . " p <span

2155

-

style='background:yellow'>left join " . TABLE_SPECIALS . " s on

2156

-

p.products_id = s.products_id, " . TABLE_PRODUCTS_DESCRIPTION .

2157

-

" pd, " . TABLE_MANUFACTURERS . " m where p.products_status =

2158

-

'1' and pd.products_id = p.products_id and pd.language_id = '" . (int)$languages_id

2159

-

. "' and p.manufacturers_id = m.manufacturers_id and m.manufacturers_id =

2160

-

'" . (int)$HTTP_GET_VARS['manufacturers_id'] . "'";

2161

-

2162

-

2163

-

2164

-

Line 184, from:

2165

-

2166

-

2167

-

2168

-

<span style='font-size:9.0pt;font-family:"Courier New";

2169

-

color:blue'>$listing_sql = "select " . $select_column_list . "

2170

-

p.products_id, p.manufacturers_id, p.products_price, p.products_tax_class_id,

2171

-

IF(s.status, s.specials_new_products_price, NULL) as

2172

-

specials_new_products_price, IF(s.status, s.specials_new_products_price,

2173

-

p.products_price) as final_price from " . TABLE_PRODUCTS . " p,

2174

-

" . TABLE_PRODUCTS_DESCRIPTION . " pd, " . TABLE_MANUFACTURERS .

2175

-

" m, " . TABLE_PRODUCTS_TO_CATEGORIES . " p2c <span

2176

-

style='background:yellow'>left join " . TABLE_SPECIALS . " s on

2177

-

p.products_id = s.products_id where p.products_status = '1' and

2178

-

p.manufacturers_id = m.manufacturers_id and m.manufacturers_id = '" . (int)$HTTP_GET_VARS['filter_id']

2179

-

. "' and p.products_id = p2c.products_id and pd.products_id =

2180

-

p2c.products_id and pd.language_id = '" . (int)$languages_id . "' and

2181

-

p2c.categories_id = '" . (int)$current_category_id . "'";

2182

-

2183

-

2184

-

2185

-

to:

2186

-

2187

-

2188

-

2189

-

<span style='font-size:9.0pt;font-family:"Courier New";

2190

-

color:blue'>$listing_sql = "select " . $select_column_list . "

2191

-

p.products_id, p.manufacturers_id, p.products_price, p.products_tax_class_id,

2192

-

IF(s.status, s.specials_new_products_price, NULL) as

2193

-

specials_new_products_price, IF(s.status, s.specials_new_products_price,

2194

-

p.products_price) as final_price from " . TABLE_PRODUCTS . " p <span

2195

-

style='background:yellow'>left join " . TABLE_SPECIALS . " s on

2196

-

p.products_id = s.products_id, " . TABLE_PRODUCTS_DESCRIPTION .

2197

-

" pd, " . TABLE_MANUFACTURERS . " m, " .

2198

-

TABLE_PRODUCTS_TO_CATEGORIES . " p2c where p.products_status = '1' and

2199

-

p.manufacturers_id = m.manufacturers_id and m.manufacturers_id = '" .

2200

-

(int)$HTTP_GET_VARS['filter_id'] . "' and p.products_id = p2c.products_id

2201

-

and pd.products_id = p2c.products_id and pd.language_id = '" .

2202

-

(int)$languages_id . "' and p2c.categories_id = '" . (int)$current_category_id

2203

-

. "'";

2204

-

2205

-

2206

-

2207

-

<br clear=all

2208

-

style='page-break-before:always'>

2209

-

2210

-

2211

-

Line 187, from:

2212

-

2213

-

2214

-

2215

-

<span style='font-size:9.0pt;font-family:"Courier New";

2216

-

color:blue'>$listing_sql = "select " . $select_column_list . "

2217

-

p.products_id, p.manufacturers_id, p.products_price, p.products_tax_class_id,

2218

-

IF(s.status, s.specials_new_products_price, NULL) as

2219

-

specials_new_products_price, IF(s.status, s.specials_new_products_price,

2220

-

p.products_price) as final_price from " . TABLE_PRODUCTS_DESCRIPTION .

2221

-

" pd, " . TABLE_PRODUCTS . " p left join " .

2222

-

TABLE_MANUFACTURERS . " m on p.manufacturers_id = m.manufacturers_id,

2223

-

" . TABLE_PRODUCTS_TO_CATEGORIES . " p2c <span style='background:

2224

-

yellow'>left join " . TABLE_SPECIALS . " s on p.products_id =

2225

-

s.products_id where p.products_status = '1' and p.products_id =

2226

-

p2c.products_id and pd.products_id = p2c.products_id and pd.language_id =

2227

-

'" . (int)$languages_id . "' and p2c.categories_id = '" .

2228

-

(int)$current_category_id . "'";

2229

-

2230

-

2231

-

2232

-

to:

2233

-

2234

-

2235

-

2236

-

<span style='font-size:9.0pt;font-family:"Courier New";

2237

-

color:blue'>$listing_sql = "select " . $select_column_list . "

2238

-

p.products_id, p.manufacturers_id, p.products_price, p.products_tax_class_id,

2239

-

IF(s.status, s.specials_new_products_price, NULL) as specials_new_products_price,

2240

-

IF(s.status, s.specials_new_products_price, p.products_price) as final_price

2241

-

from " . TABLE_PRODUCTS_DESCRIPTION . " pd, " . TABLE_PRODUCTS .

2242

-

" p left join " . TABLE_MANUFACTURERS . " m on

2243

-

p.manufacturers_id = m.manufacturers_id left

2244

-

join " . TABLE_SPECIALS . " s on p.products_id = s.products_id,

2245

-

" . TABLE_PRODUCTS_TO_CATEGORIES . " p2c where p.products_status =

2246

-

'1' and p.products_id = p2c.products_id and pd.products_id = p2c.products_id

2247

-

and pd.language_id = '" . (int)$languages_id . "' and p2c.categories_id

2248

-

= '" . (int)$current_category_id . "'";

2249

-

2250

-

2251

-

2252

-

Line 292 in catalog/admin/categories.php must be changed

2253

-

from:

2254

-

2255

-

2256

-

2257

-

<span style='font-size:9.0pt;font-family:"Courier New";

2258

-

color:blue'>tep_db_query("insert into " . TABLE_PRODUCTS . "

2259

-

(products_quantity, products_model,products_image, products_price,

2260

-

products_date_added, products_date_available, products_weight, products_status,

2261

-

products_tax_class_id, manufacturers_id) values ('" .

2262

-

tep_db_input($product['products_quantity']) . "', '" .

2263

-

tep_db_input($product['products_model']) . "', '" .

2264

-

tep_db_input($product['products_image']) . "', '" .

2265

-

tep_db_input($product['products_price']) . "',� now(), <span

2266

-

style='background:yellow'>'" .

2267

-

tep_db_input($product['products_date_available']) . "', '" .

2268

-

tep_db_input($product['products_weight']) . "', '0', '" .

2269

-

(int)$product['products_tax_class_id'] . "', '" .

2270

-

(int)$product['manufacturers_id'] . "')");

2271

-

2272

-

2273

-

2274

-

to:

2275

-

2276

-

2277

-

2278

-

<span style='font-size:9.0pt;font-family:"Courier New";

2279

-

color:blue'>tep_db_query("insert into " . TABLE_PRODUCTS . "

2280

-

(products_quantity, products_model,products_image, products_price,

2281

-

products_date_added, products_date_available, products_weight, products_status,

2282

-

products_tax_class_id, manufacturers_id) values ('" .

2283

-

tep_db_input($product['products_quantity']) . "', '" .

2284

-

tep_db_input($product['products_model']) . "', '" .

2285

-

tep_db_input($product['products_image']) . "', '" .

2286

-

tep_db_input($product['products_price']) . "',� now(), <span

2287

-

style='background:yellow'>" . (empty($product['products_date_available'])

2288

-

? "null" : "'" .

2289

-

tep_db_input($product['products_date_available']) . "'") . ",

2290

-

'" . tep_db_input($product['products_weight']) . "', '0', '" .

2291

-

(int)$product['products_tax_class_id'] . "', '" .

2292

-

(int)$product['manufacturers_id'] . "')");

2293

-

2294

-

2295

-

2296

-

The following SQL queries need to be performed:

2297

-

2298

-

2299

-

2300

-

<span style='font-size:9.0pt;font-family:"Courier New";

2301

-

color:blue'>ALTER TABLE whos_online MODIFY COLUMN last_page_url VARCHAR(255)

2302

-

NOT NULL;

2303

-

2304

-

<span style='font-size:9.0pt;font-family:"Courier New";

2305

-

color:blue'>

2306

-

2307

-

<span style='font-size:9.0pt;font-family:"Courier New";

2308

-

color:blue'>ALTER TABLE customers MODIFY COLUMN customers_default_address_id

2309

-

INTEGER;

2310

-

2311

-

<span style='font-size:9.0pt;font-family:"Courier New";

2312

-

color:blue'>

2313

-

2314

-

<span style='font-size:9.0pt;font-family:"Courier New";

2315

-

color:blue'>ALTER TABLE customers_basket MODIFY COLUMN final_price

2316

-

DECIMAL(15,4);

2317

-

2318

-

</div>

2319

-

2320

-

</body>

2321

-

2322

-

</html>

FishEye

Mode

Context

Other Diffs

Ignore

Diff