OpenCart Community

What is also odd on that file is the token being parametered but the api_id is the key being validated in the api folder other than the login file ... shouldn't the token be verified in the API folders rather than the API ID is the answer I'd like to know from the OC developers ...

straightlight wrote:

labeshops wrote:

straightlight wrote:Try this new solution, it has been published momentarily: http://forum.opencart.com/viewtopic.php ... 20#p613358

my ip is shown correctly in the database. every other check that uses the api works fine - I can add new orders, edit orders, etc. I can do anything and everything EXCEPT change the order status and update the order history. That's the only time I get " Warning: You do not have permission to access the API! "

Seems to me the problem is somewhere in the api check for order history, but I don't know anything about how ajax works to know how to fix it.

Do you use openbay by changing the order status?

No, I don't use openbay for anything. Have no use for it at all and it is not installed. This error is when I try to change the status from the regular opencart v2.2 order_info.tpl page. and FYI all the other ajax calls on the page also work with no errors - adding invoice number, commission, etc.

I also do not have any fraud mods or anything else (though I did try clicking on the override checkbox) - just the plain old sale/order/info

I see. The reason I was asking is because the order info page relies on openbay for change status ... however, it is still left to know by the OC developers on why the token is being parametered while the API ID is what the api controllers from the store-front end being validated in exchange ... the API ID should rather be queried instead of the token since the token is only useful knowing if the API login was successful. Afterwards, to rely on the API ID. Although, the token is sticked in which is probably the cause of the "JSON Error" window on why it's happening ...

@Developers: The API ID should be used with POST rather than the session data between the admin order page and the API controllers. The session data should only be useful to pass the information to the post within the API. Otherwise, what if the administrative user is not logged in to the API yet? How can the token be distinguished if it's ... not initialized yet from other actions in the admin-end?

So the api on that page is only used to communicate with openbay???

Is it possible to remove the check entirely then??

labeshops wrote:So the api on that page is only used to communicate with openbay???

Is it possible to remove the check entirely then??

No, the API is not for Openbay. Openbay out of the box does not communicate with the API.

Okay, confused by your previous post then. Guess its just too techno speak for me.

labeshops wrote:Okay, confused by your previous post then. Guess its just too techno speak for me.

It is a bug with the API right now, that is what this is about here and the OC developers needs to fix it so that no one gets affected on future releases.

I agree. Having to keep track of order statues on a notepad is getting to be a HUGE pita.

API = Automatic Problem Injector ?

So there is NO fix yet?

Not that I've found. I've tried every suggested fix I could find and still doens't work.

All I would need is an access to one server compared to where all people does encounter those pop-ups from JSON. I could probably fix this due to the size of the admin order templates with different cases reported, some testing would need to be done. At least, it would be a start.

I'm amazed with all these SJON errors.

It must be related to the server OC runs on as I have none so far.

i2Paq wrote:I'm amazed with all these SJON errors.

It must be related to the server OC runs on as I have none so far.

Nevertheless, JSON pop-up window means that one of the admin order template, in this case, returns an error from the error: handler which is unable to complete a request which is still part of an unvalidated event.

I haven't gotten the json popup errors. Only error I have is the stupid "You don't have permission to access the api" Which is enough since it's preventing me from changing order statuses. Only time I've seen the json error is when I tried some of the fixes for the api issue but undoing the "fix" resolves it.

labeshops wrote:I haven't gotten the json popup errors. Only error I have is the stupid "You don't have permission to access the api" Which is enough since it's preventing me from changing order statuses. Only time I've seen the json error is when I tried some of the fixes for the api issue but undoing the "fix" resolves it.

That is another issue aside the JSON pop-up window, indeed.

labeshops wrote:I haven't gotten the json popup errors. Only error I have is the stupid "You don't have permission to access the api" Which is enough since it's preventing me from changing order statuses. Only time I've seen the json error is when I tried some of the fixes for the api issue but undoing the "fix" resolves it.

I was having this same issue, with same error, and I did the following, and was able to Add History to my orders.

system > users > api
edited the Default API user,
pressed generate to geneate a new key,
then on IP addresses tab I added my ip address
enabled and saved.

Then go to:
system > settings > option tab >

under checkout section - select API User as Default

Though this worked, I am still confused as to why I need to do it. Is this a requirement now that you add this API user to be able to edit orders.

Did these settings I have set here going to have some other impact on my checkout?

Though this worked, I am still confused as to why I need to do it. Is this a requirement now that you add this API user to be able to edit orders.

That is because a reversed psychology was used when developing the API for Opencart. Instead of linking the store ID with the generated API form, the developers rather decided to create a redundancy process to link the API from the store - > option tabs.

Although, this methodology still doesn't explain my observation above regarding the use of a logged in token instead of the API ID to the URL instead of using a POST for the results through Ajax request while the store-front end controller acquires the API ID.

Anyone know if any of the order history mods bypasses this error? Like the popup order history, mass order history updator, etc? Getting kinda desperate here as I know I'm going to mess up someone's order or forget to ship something.

labeshops wrote:Anyone know if any of the order history mods bypasses this error? Like the popup order history, mass order history updator, etc? Getting kinda desperate here as I know I'm going to mess up someone's order or forget to ship something.

By Mods, if you're referring to extensions, there is no way to predict between fixes or upgrades on what each releases are going to affect.