Post by HAO » Wed Oct 16, 2024 8:40 am

Hello!

I found some error messages in my error log, Can someone tell me how to fix this error?

Thank you for your help!

error log

Code: Select all

2024-10-16 7:16:09 - PHP Notice:  Undefined index: firstname in /home/***/storage/modification/catalog/controller/account/register.php on line 245
2024-10-16 7:16:09 - PHP Notice:  Undefined index: lastname in /home/***/storage/modification/catalog/controller/account/register.php on line 249
2024-10-16 7:16:09 - PHP Notice:  Undefined index: telephone in /home/***/storage/modification/catalog/controller/account/register.php on line 261
2024-10-16 7:16:09 - PHP Notice:  Undefined index: confirm in /home/***/storage/modification/catalog/controller/account/register.php on line 291
2024-10-16 7:16:47 - PHP Notice:  Undefined index: name in /home/***/public_html/catalog/controller/information/contact.php on line 145
2024-10-16 7:16:47 - PHP Notice:  Undefined index: enquiry in /home/***/public_html/catalog/controller/information/contact.php on line 153
The following are listed as lines from the original file:

catalog/controller/account/register.php
private function validate() {
if ((utf8_strlen(trim($this->request->post['firstname'])) < 1) || (utf8_strlen(trim($this->request->post['firstname'])) > 32)) { on line 221
$this->error['firstname'] = $this->language->get('error_firstname');
}

if ((utf8_strlen(trim($this->request->post['lastname'])) < 1) || (utf8_strlen(trim($this->request->post['lastname'])) > 32)) { on line 225
$this->error['lastname'] = $this->language->get('error_lastname');
}

if ((utf8_strlen($this->request->post['email']) > 96) || !filter_var($this->request->post['email'], FILTER_VALIDATE_EMAIL)) {
$this->error['email'] = $this->language->get('error_email');
}

if ($this->model_account_customer->getTotalCustomersByEmail($this->request->post['email'])) {
$this->error['warning'] = $this->language->get('error_exists');
}

if ((utf8_strlen($this->request->post['telephone']) < 3) || (utf8_strlen($this->request->post['telephone']) > 32)) { on line 237
$this->error['telephone'] = $this->language->get('error_telephone');
}

// Customer Group
if (isset($this->request->post['customer_group_id']) && is_array($this->config->get('config_customer_group_display')) && in_array($this->request->post['customer_group_id'], $this->config->get('config_customer_group_display'))) {
$customer_group_id = $this->request->post['customer_group_id'];
} else {
$customer_group_id = $this->config->get('config_customer_group_id');
}

// Custom field validation
$this->load->model('account/custom_field');

$custom_fields = $this->model_account_custom_field->getCustomFields($customer_group_id);

foreach ($custom_fields as $custom_field) {
if ($custom_field['location'] == 'account') {
if ($custom_field['required'] && empty($this->request->post['custom_field'][$custom_field['location']][$custom_field['custom_field_id']])) {
$this->error['custom_field'][$custom_field['custom_field_id']] = sprintf($this->language->get('error_custom_field'), $custom_field['name']);
} elseif (($custom_field['type'] == 'text') && !empty($custom_field['validation']) && !filter_var($this->request->post['custom_field'][$custom_field['location']][$custom_field['custom_field_id']], FILTER_VALIDATE_REGEXP, array('options' => array('regexp' => $custom_field['validation'])))) {
$this->error['custom_field'][$custom_field['custom_field_id']] = sprintf($this->language->get('error_custom_field'), $custom_field['name']);
}
}
}

if ((utf8_strlen(html_entity_decode($this->request->post['password'], ENT_QUOTES, 'UTF-8')) < 4) || (utf8_strlen(html_entity_decode($this->request->post['password'], ENT_QUOTES, 'UTF-8')) > 40)) {
$this->error['password'] = $this->language->get('error_password');
}

if ($this->request->post['confirm'] != $this->request->post['password']) { on line 267
$this->error['confirm'] = $this->language->get('error_confirm');
}
catalog/controller/information/contact.php
protected function validate() {
if ((utf8_strlen($this->request->post['name']) < 3) || (utf8_strlen($this->request->post['name']) > 32)) { on line 145
$this->error['name'] = $this->language->get('error_name');
}

if (!filter_var($this->request->post['email'], FILTER_VALIDATE_EMAIL)) {
$this->error['email'] = $this->language->get('error_email');
}

if ((utf8_strlen($this->request->post['enquiry']) < 10) || (utf8_strlen($this->request->post['enquiry']) > 3000)) { on line 153
$this->error['enquiry'] = $this->language->get('error_enquiry');
}

HAO
Active Member

Posts

Joined
Fri Jun 03, 2011 2:52 pm

Post by nonnedelectari » Wed Oct 16, 2024 11:23 am

Those are caused by direct bot posts (not using you web form) without providing the fields with it.
When checking those fields it gives a warning that they do not exist.
So, check that first (using the empty function, !empty means not empty), for example for your contact controller:

Code: Select all

protected function validate() {
	if (!empty($this->request->post['name']))
		if ((utf8_strlen($this->request->post['name']) < 3) || (utf8_strlen($this->request->post['name']) > 32)) {
			$this->error['name'] = $this->language->get('error_name');
		}
	} else {
		$this->error['name'] = $this->language->get('error_name');
	}
	
	if (!empty($this->request->post['email'])) {
		if (!filter_var($this->request->post['email'], FILTER_VALIDATE_EMAIL)) {
			$this->error['email'] = $this->language->get('error_email');
		}
	} else {
		$this->error['email'] = $this->language->get('error_email');
	}
	
	if (!empty($this->request->post['enquiry'])) {
		if ((utf8_strlen($this->request->post['enquiry']) < 10) || (utf8_strlen($this->request->post['enquiry']) > 3000)) {
			$this->error['enquiry'] = $this->language->get('error_enquiry');
		}
	} else {
		$this->error['enquiry'] = $this->language->get('error_enquiry');
	}
}

Active Member

Posts

Joined
Thu Mar 04, 2021 6:34 pm

Post by JNeuhoff » Wed Oct 16, 2024 4:53 pm

Your errors are originating from a modified catalog/controller/account/register.php, are you using any 3rd party extensions or OCmod-based scripts?

Export/Import Tool * SpamBot Buster * Unused Images Manager * Instant Option Price Calculator * Number Option * Google Tag Manager * Survey Plus * OpenTwig


User avatar
Guru Member

Posts

Joined
Wed Dec 05, 2007 3:38 am


Post by HAO » Thu Oct 17, 2024 10:08 pm

I think it has something to do with this, Thank you, I will contact the developer.

HAO
Active Member

Posts

Joined
Fri Jun 03, 2011 2:52 pm

Post by nonnedelectari » Thu Oct 17, 2024 10:39 pm

HAO wrote:
Thu Oct 17, 2024 10:08 pm
I think it has something to do with this, Thank you, I will contact the developer.
The same issue is present in default OC, nothing to do with the extension.

Active Member

Posts

Joined
Thu Mar 04, 2021 6:34 pm

Post by HAO » Sat Oct 19, 2024 10:10 pm

If so, I think you need to repair such a bug, Does anyone know how to repair it?

HAO
Active Member

Posts

Joined
Fri Jun 03, 2011 2:52 pm

Post by by mona » Sat Oct 19, 2024 11:12 pm

Are you asking for every bot to register with your site ?

DISCLAIMER:
You should not modify core files .. if you would like to donate a cup of coffee I will write it in a modification for you.


https://www.youtube.com/watch?v=zXIxDoCRc84


User avatar
Expert Member

Posts

Joined
Mon Jun 10, 2019 9:31 am

Post by HAO » Sat Oct 19, 2024 11:53 pm

I have already installed and purchased Google reCAPTCHA v3 service, However, no cases of cracking have been found so far.

I just want to make sure I can resolve this error message?

HAO
Active Member

Posts

Joined
Fri Jun 03, 2011 2:52 pm

Post by by mona » Sun Oct 20, 2024 1:40 am

nonnedelectari provided you with a solution.
Besides, error reporting should be turned off on a live site.

DISCLAIMER:
You should not modify core files .. if you would like to donate a cup of coffee I will write it in a modification for you.


https://www.youtube.com/watch?v=zXIxDoCRc84


User avatar
Expert Member

Posts

Joined
Mon Jun 10, 2019 9:31 am

Post by calderwood » Sat Jun 28, 2025 6:47 am

I'm seeing these same errors on line 263 of /account/register.php in my logs. There is a depreciation for php8.2

If someone submits a form with no password, $this->request->post['password'] the code expects it always to be a string (even an empty one) before passing it to html_entity_decode(). Instead of posting an error message, it logs an php error to the logs, as the password was missing.
I haven't tried this yet as its in the core file, but something like:

if ((utf8_strlen(html_entity_decode($this->request->post['password'] ?? '', ENT_QUOTES, 'UTF-8')) < 8) || (utf8_strlen(html_entity_decode($this->request->post['password'] ?? '', ENT_QUOTES, 'UTF-8')) > 40)) {
$this->error['password'] = $this->language->get('error_password');
}

Thoughts? I would love to get rid of the errors in the logs (bots?) as it fills up the error logs with junk.

David C.
I wonder if the sun is shining outside? :laugh:


User avatar
New member

Posts

Joined
Tue Jan 03, 2012 7:59 am
Location - Somerville, NJ

Post by by mona » Sat Jun 28, 2025 9:20 pm

calderwood wrote:
Sat Jun 28, 2025 6:47 am
I'm seeing these same errors on line 263 of /account/register.php in my logs. There is a depreciation for php8.2

If someone submits a form with no password, $this->request->post['password'] the code expects it always to be a string (even an empty one) before passing it to html_entity_decode(). Instead of posting an error message, it logs an php error to the logs, as the password was missing.
I haven't tried this yet as its in the core file, but something like:

if ((utf8_strlen(html_entity_decode($this->request->post['password'] ?? '', ENT_QUOTES, 'UTF-8')) < 8) || (utf8_strlen(html_entity_decode($this->request->post['password'] ?? '', ENT_QUOTES, 'UTF-8')) > 40)) {
$this->error['password'] = $this->language->get('error_password');
}

Thoughts? I would love to get rid of the errors in the logs (bots?) as it fills up the error logs with junk.
My thoughts
1. No OC version
2. If someone submits a REGISTER form with no password it should be rejected not passed as empty. To hide the error completely misses the point & purpose of the depreciation.
3. Having error logging turned on anywhere with a live site is A SECURITY RISK

There are commercial extensions to prevent bot registration - being the underlying cause, but the issue of having error logging turned on for a live site is the urgent issue to be addressed.

DISCLAIMER:
You should not modify core files .. if you would like to donate a cup of coffee I will write it in a modification for you.


https://www.youtube.com/watch?v=zXIxDoCRc84


User avatar
Expert Member

Posts

Joined
Mon Jun 10, 2019 9:31 am

Post by JNeuhoff » Sat Jun 28, 2025 9:50 pm

Looks like the account/register page is hit by spambots, in which case our SpamBot Buster should prove an effective solution for this.

Export/Import Tool * SpamBot Buster * Unused Images Manager * Instant Option Price Calculator * Number Option * Google Tag Manager * Survey Plus * OpenTwig


User avatar
Guru Member

Posts

Joined
Wed Dec 05, 2007 3:38 am

Who is online

Users browsing this forum: No registered users and 5 guests