OpenCart v1.4.9.2 (PATCH ONLY!)

[Qphoria]

As there are about 10 confirmed bugs in v1.4.9.1, mostly minor, I've decided to release a v1.4.9.2 PATCH ONLY
This means
- this is NOT a full version of 1.4.9.2. I may or may not make one
- This is a patch from 1.4.9.1 to 1.4.9.2 ONLY. Any other versions need to upgrade to 1.4.9.1 FIRST
- BACKUP ANY MODIFICATIONS TO THE CHANGED FILES BEFORE PATCHING

Included Support files:
- delta.txt - Lists all changed files since previous version
- changed.txt - Lists all bug fixes and new features
- Readme.txt - Read it!


Fixes:
- BUG: Deleting orders throws error "Notice: Undefined index: subtract"
- BUG: Email address fields do not support "-" dash characters.
- BUG: Guest Checkout adds store tax even when from a non-taxable address
- BUG: Images with uppercase extensions don't resize properly
- BUG: CSRF vulnerability in 1.4.8, 1.4.9, and 1.4.9.1
- BUG: Geo Zones not deleting properly
- BUG: Search parameters not correctly encoded such as # character
- BUG: USPS has some typos and incorrect tax class
- BUG: Editing customer removes default shipping address designation
- BUG: Sales report not calculating tax

Added:
- new "default" radio button in customer edit (as part of fix above)
- email regex pattern is now defined one time as a constant instead of being redefined in 8 places as a variable. Now it can be edited in the system/startup.php file
- Added Cumbria to the UK zone list


CHANGED FILES:

Code: Select all

upload\admin\controller\common\login.php
upload\admin\controller\sale\customer.php
upload\admin\index.php
upload\admin\language\english\sale\customer.php
upload\admin\model\localisation\geo_zone.php
upload\admin\model\report\purchased.php
upload\admin\model\sale\customer.php
upload\admin\model\sale\order.php
upload\admin\view\template\sale\customer_form.tpl
upload\catalog\controller\account\account.php
upload\catalog\controller\account\create.php
upload\catalog\controller\account\edit.php
upload\catalog\controller\account\forgotten.php
upload\catalog\controller\account\login.php
upload\catalog\controller\account\logout.php
upload\catalog\controller\account\success.php
upload\catalog\controller\checkout\guest_step_1.php
upload\catalog\controller\checkout\guest_step_3.php
upload\catalog\controller\information\contact.php
upload\catalog\controller\payment\pp_standard.php
upload\catalog\controller\product\search.php
upload\catalog\model\catalog\review.php
upload\catalog\model\shipping\usps.php
upload\catalog\view\theme\default\template\mail\order_confirm.tpl
upload\catalog\view\theme\default\template\payment\pp_standard.tpl
upload\install\controller\step_3.php
upload\install\opencart.sql
upload\install\upgrade.sql
upload\system\library\image.php
upload\system\startup.php
upload\.htaccess.txt
upload\index.php


Installation:
Read the included README.txt
YOU DONT NEED THE INSTALL FOLDER, IT IS JUST INCLUDED BECAUSE THERE WAS A SMALL CHANGE TO INCLUDE CUMBRIA

[i2Paq]

Like you promised, thanks Qphoria!

[jones]

thanks

[websteer]

Thank you.

[dramony]

Thank you!

[mayor21]

thank you Q
i would like to know what is the function for install folder?
as the warning appear asking me to delete the install folder.
Thank you

[Qphoria]

It has a change for the sql but isn't really needed. just delete it.

[i2Paq]

Should this patch not be added to the Official download section of OpenCart.com, so new users of OpenCart know that there is a patch for 1.4.9.1?

[fido-x]

You missed updating the email pattern validation in "admin/controller/sale/customer.php" (lines 909 to 913). Shouldn't they be:

Code: Select all

if ((strlen(utf8_decode($this->request->post['email'])) > 96) || (!preg_match(EMAIL_PATTERN, $this->request->post['email']))) {
    $this->error['email'] = $this->language->get('error_email');
} 

[Qphoria]

You missed updating the email pattern validation in "admin/controller/sale/customer.php" (lines 909 to 913). Shouldn't they be:

Code: Select all

if ((strlen(utf8_decode($this->request->post['email'])) > 96) || (!preg_match(EMAIL_PATTERN, $this->request->post['email']))) {
    $this->error['email'] = $this->language->get('error_email');
} 

Thanks!

[polyducts]

Hi Q,

I am not able to enter our email address "sv-uk@gmx.com" in system > settings > e-mail. Could you please include a fix for this in the next patch? Thanks!

[Qphoria]

Hi Q,

I am not able to enter our email address "sv-uk@gmx.com" in system > settings > e-mail. Could you please include a fix for this in the next patch? Thanks!

Very strange. Ok I'll look into this. For now you can just remove the validation check in the admin/controller/setting/setting.php for the EMAIL_PATTERN

[maxisgsm]

Hello Q,

I've done doing the patch .. now i can see my OC 1.4.9.2.
But sometimes, i face problem when i at Admin section. When i save any changes i make at Modules setting, it bring me back to login page and gave me an error " Invalid token session. Please login again. "

Should i modify the login.php as per this page??
viewtopic.php?f=31&t=20659#p102070

[Qphoria]

No. that change is already in there. The error you are seeing typically is due to your custom modules not being up to date with the token code

[Lao]

Hi!

In Dreamweaver I opened file customer_form.php from admin/view/template/sale and it gave me the following error. Don't if it actually exists, but I thought I mention it here:

"There is a syntax error on line 176. Code hinting may not work until you fix this error". Bellow you have line 176:

Code: Select all

$('select[name=\'addresses[<?php echo $address_row; ?>][zone_id]\']').load('index.php?route=sale/customer/zone&token=<?php echo $token; ?>&country_id=<?php echo $address['country_id']; ?>&zone_id=<?php echo $address['zone_id']; ?>');

[Kengun]

Thank you very much for the upgrade

Just a little request: I think it would be great if it was possible to get a emailnotify from this forum when there are a new upgrade patch ready. Maybe a simple newsletter signup is all that is needed for this. Espesially this is important if there are any security upgrades that might be very important to install.

Edit: Oh by the way; Why is there a install folder in this upgrade when that's not needed? FTP files/folders is enough.

[Johnathan]

There's an "install" folder because some of the files inside of it were changed between 1.4.9.1 and 1.4.9.2. If you are upgrading (which you only can with patch) you don't need it, but to build a complete version of 1.4.9.2, you'd need to overwrite the 1.4.9.1 "install" files with the new ones.

[ScottBohler]

Thank you. The patch installed very easily per your instructions. However, I still have a problem.

I have the Flat Rate shipping module enabled and use Paypal Standard. In my Checkout page the order shows the "Flat Rate: $5.00", but upon confirming the order the Paypal page does not list OpenCart's $5.00 Flat Rate. Paypal only shows the purchased item and it's price.

I don't want Paypal to calculate any shipping. I want it to simply line-item our specified Flat Rate fee. What am I doing wrong?



Store URL: http://www.twistedgroove.com/shops/twistedgroove

Please help, and thanks,
Scott

[Qphoria]

Check the pay pal documentation in the documentation area under extensions> payments

[ScottBohler]

Thanks! Checking now...

Ok, I did all that and... Bingo! It was the Shipping Calculations config. After clearing them Paypal now shows my Flat Rate as intended.

Thanks Q! You rock. I liked you on Start Trek too.