Plus sign (+) injection bug from the admin towards catalog.

Legendary Member

Posts

Joined

Mon Nov 14, 2011 11:38 pm

Location

Canada, ON

Post by straightlight » Mon Dec 12, 2011 3:39 am

Thanks to chiris from this topic: http://forum.opencart.com/viewtopic.php?f=161&t=48214

by addressing this important bug issue. Some users also reported an odd problem regarding the output of the '+' sign versus the '-' sign. The reason this problematic occurs is due to a decline methodology prevented by mySQL.

Here are the proper corrections in order to get rid of these problems:

In admin/view/template/catalog/product_form.tpl file,

find all instances of:

Code: Select all

<?php if ($product_option_value['price_prefix'] == '+') { ?>
<?php if ($product_option_value['weight_prefix'] == '+') { ?>

replace them all with:

Code: Select all

<?php if ($product_option_value['price_prefix'] == 'a') { ?>
<?php if ($product_option_value['weight_prefix'] == 'a') { ?>

Then, find all instances of:

Code: Select all

<?php if ($product_option_value['price_prefix'] == '-') { ?>
<?php if ($product_option_value['weight_prefix'] == '-') { ?>

replace them all with:

Code: Select all

<?php if ($product_option_value['price_prefix'] == 's') { ?>
<?php if ($product_option_value['weight_prefix'] == 's') { ?>

Then, find all instances of:

Code: Select all

<option value="+"

Replace them all with:

Code: Select all

<option value="add"

Then, find all instances of:

Code: Select all

<option value="-"

replace with:

Code: Select all

<option value="subtract"

In system/library/cart.php file,

find all instances of:

Code: Select all

if ($option_value_query->row['price_prefix'] == '+') {
if ($option_value_query->row['weight_prefix'] == '+') {

replace them all with:

Code: Select all

if ($option_value_query->row['price_prefix'] == 'a') {
if ($option_value_query->row['weight_prefix'] == 'a') {

Then, find all instances of:

Code: Select all

} elseif ($option_value_query->row['price_prefix'] == '-') {
} elseif ($option_value_query->row['weight_prefix'] == '-') {

replace them all with:

Code: Select all

} elseif ($option_value_query->row['price_prefix'] == 's') {
} elseif ($option_value_query->row['weight_prefix'] == 's') {

Then, in catalog/view/theme/default/template/product/product.tpl file,

find all instances of:

Code: Select all

<?php if ($option_value['price']) { ?>
            (<?php echo $option_value['price_prefix']; ?><?php echo $option_value['price']; ?>)
            <?php } ?>

replace them all with:

Code: Select all

<?php if ($option_value['price']) { ?>
				<?php if ($option_value['price_prefix'] == 'a') { ?>
					(+<?php echo $option_value['price']; ?>)
					
				<?php } elseif ($option_value['price_prefix'] == 's') { ?>
					(-<?php echo $option_value['price']; ?>)
				<?php } ?>
            <?php } ?>

Then, find:

Code: Select all

<td><label for="option-value-<?php echo $option_value['product_option_value_id']; ?>"><img src="<?php echo $option_value['image']; ?>" alt="<?php echo $option_value['name'] . ($option_value['price'] ? ' ' . $option_value['price_prefix'] . $option_value['price'] : ''); ?>" /></label></td>

replace with:

Code: Select all

<td><label for="option-value-<?php echo $option_value['product_option_value_id']; ?>"><img src="<?php echo $option_value['image']; ?>" alt="<?php echo $option_value['name'] . ($option_value['price'] ? ' ' . ($option_value['price_prefix'] == 'a' ? '+' . $option_value['price'] : '-' . $option_value['price']) : ''); ?>" /></label></td>

As you may notice, the 'subtract' entry doesn't necessarily need to replace the previous minus sign since this character is tolerated by mySQL team but it is just to avoid confusion between a word and a character in the future.

Last edited by straightlight on Mon Dec 12, 2011 4:12 am, edited 2 times in total.

Dedication and passion goes to those who are able to push and merge a project.

Regards,
Straightlight
Programmer / Opencart Tester

Legendary Member

Posts

Joined

Mon Nov 14, 2011 11:38 pm

Location - Canada, ON

Re: Plus sign (+) injection bug from the admin towards catal

Legendary Member

Posts

Joined

Mon Nov 14, 2011 11:38 pm

Location

Canada, ON

Post by straightlight » Mon Dec 12, 2011 3:53 am

One more step added (last step) on the above.
- Corrected the condition statement from words to a letter since the field only support one character on anyhow.
- Added the weight steps for the admin template modifications rather than just the price steps since both are required to be changed.

Last edited by straightlight on Mon Dec 12, 2011 4:13 am, edited 1 time in total.

Dedication and passion goes to those who are able to push and merge a project.

Regards,
Straightlight
Programmer / Opencart Tester

Legendary Member

Posts

Joined

Mon Nov 14, 2011 11:38 pm

Location - Canada, ON

Re: Plus sign (+) injection bug from the admin towards catal

chiris

Newbie

Posts

Joined

Sat Dec 10, 2011 5:58 am

Post by chiris » Mon Dec 12, 2011 4:11 am

Thank you for all! You are the best!

chiris

Newbie

Posts

Joined

Sat Dec 10, 2011 5:58 am

Re: Plus sign (+) injection bug from the admin towards catal

Administrator

Posts

Joined

Tue Jul 22, 2008 3:02 am

Post by Qphoria » Mon Dec 12, 2011 1:21 pm

It seems odd that after 5+ years, this would suddenly be an issue. You are saying mySql doesn't like

Code: Select all

price_prefix = '+'

Administrator

Posts

Joined

Tue Jul 22, 2008 3:02 am

Re: Plus sign (+) injection bug from the admin towards catal

rph

Expert Member

Posts

4102

Joined

Fri Jan 08, 2010 5:05 am

Location

Lincoln, Nebraska

Post by rph » Mon Dec 12, 2011 2:42 pm

Yeah, I'm interested to see exactly what this is supposed to be fixing too.

-Ryan

rph

Expert Member

Posts

4102

Joined

Fri Jan 08, 2010 5:05 am

Location - Lincoln, Nebraska

Re: Plus sign (+) injection bug from the admin towards catal

Legendary Member

Posts

Joined

Mon Nov 14, 2011 11:38 pm

Location

Canada, ON

Post by straightlight » Mon Dec 12, 2011 10:31 pm

Qphoria wrote:It seems odd that after 5+ years, this would suddenly be an issue. You are saying mySql doesn't like
Code: Select all
price_prefix = '+'
?

That is correct. With this field type from what the + and - has been used for, mySQL rejects this methodology with + but, again, the minuses does work but the reason I did made the changes on the minuses was simply to avoid confusion on why the pluses would change since it was needed but why the minuses wouldn't also need to be changed (a letter with a sign injected).

Dedication and passion goes to those who are able to push and merge a project.

Regards,
Straightlight
Programmer / Opencart Tester

Legendary Member

Posts

Joined

Mon Nov 14, 2011 11:38 pm

Location - Canada, ON

Re: Plus sign (+) injection bug from the admin towards catal

Administrator

Posts

Joined

Tue Jul 22, 2008 3:02 am

Post by Qphoria » Mon Dec 12, 2011 11:05 pm

I cannot find any information about this issue and I've never seen or heard of it.
The plus sign is wrapped in single quotes. So they are read in as literals and normal text.
If you are seeing a blank for + then I could only fathom that some mod is in effect causing a urldecode() function to convert the "+" to a <space> during transfer. But that should only be for "GET" methods and opencart is all POST for database and ajax calls from the product page.

Sorry but until there is some real evidence of a problem, this will not be adopted as an official issue or fix. I currently recommend that nobody use this fix as it will only cause future upgrade issues when all your "a" are expected to be "+" in a future version.

Administrator

Posts

Joined

Tue Jul 22, 2008 3:02 am

Re: Plus sign (+) injection bug from the admin towards catal

Legendary Member

Posts

Joined

Mon Nov 14, 2011 11:38 pm

Location

Canada, ON

Post by straightlight » Mon Dec 12, 2011 11:11 pm

The plus sign is wrapped in single quotes.

It doesn't seem to be enough. Ever since I did fixed this issue for this user, he did reported complete satisfaction on the above and now works accordingly. Regarding the POST and the GET / urlencode issue, that may be a possible cause though. What I do can tell is that if these were true, the minuses would also be affected and not only the pluses since they are both being injected into the database at the same time over the same mySQL field type.

Dedication and passion goes to those who are able to push and merge a project.

Regards,
Straightlight
Programmer / Opencart Tester

Legendary Member

Posts

Joined

Mon Nov 14, 2011 11:38 pm

Location - Canada, ON

Re: Plus sign (+) injection bug from the admin towards catal

Administrator

Posts

Joined

Tue Jul 22, 2008 3:02 am

Post by Qphoria » Mon Dec 12, 2011 11:18 pm

No.. pluses are the only thing converted in urlencode/decode because they are used in place of spaces.

$str = urlencode("This is my string");
would yield:
"This+is+my+string"

echo urldecode($str);
would change it back to:
"This is my string"

But if you had something like:

$str = urlencode("This is 1+1");
It would end up as:
"This+is+1+1"

Then if you did:
echo urldecode($str);
it would lose the all pluses with:
"This is 1 1"

So it sounds like urlencode/decode is the culprit somewhere, but that data should be encoded for the ajax callback.

Is the user running 1.5.1.3 or some version of the SVN?

Administrator

Posts