How can an order be valid without $_SESSION['shipping'] being set?

I've noted zc156 since I'm chasing an issue on a site with zc156c installed, but the question is still valid for zc157+.

Notice that the zc157c version of the order.php class (lines 312 thru 326):

Code:

---

    $shipping_module_code = '';
    // A shipping-module's 'code', if present in the session, **must** contain a '_' character, separating
    // the shipping module's name from the selected method, e.g. 'module_method'.  That '_' cannot be the first
    // character of the 'code' value.
    //
    // If that's not the case, issue a PHP Notice and reset the shipping to its unselected state.
    //
    if (isset($_SESSION['shipping'])) {
        if (!empty($_SESSION['shipping']['id']) && strpos((string)$_SESSION['shipping']['id'], '_')) {
            $shipping_module_code = $_SESSION['shipping']['id'];
        } else {
            trigger_error('Malformed value for session-based shipping module; customer will need to re-select: ' . json_encode($_SESSION['shipping']), E_USER_NOTICE);
            unset($_SESSION['shipping']);
        }
    }

---

... defaults that shipping_module_code to a blank string if the session's shipping information isn't set, which ultimately leads to a 0-value shipping being applied. Can anyone identify a scenario where a valid order doesn't have a shipping selection registered in $_SESSION['shipping']?

It shouldn't happen.

I don't know why it's happening. I know I've dug around a bit and came up with nothing. I think it's related to specific modules.

The trigger_error call was added so that the invalid situation would log itself and take the shopper back through shipping selection before completing the order.

Yes, but that trigger_error is only going to be hit if the $_SESSION['shipping'] is set!

Not hijacking, just wondering if this is part of the reason for this log file. Using only Store Pickup and USPS.

Code:

---

PHP Notice: Malformed value for session-based shipping module; customer will need to re-select: false in /includes/classes/order.php on line 323

---

Quote:

---

Originally Posted by dbltoe

Not hijacking, just wondering if this is part of the reason for this log file. Using only Store Pickup and USPS.

Code:

---

[17-Apr-2021 10:41:12 US/Central] PHP Notice: Malformed value for session-based shipping module; customer will need to re-select: false in /includes/classes/order.php on line 323

---

---

It's more a question of why (and where) the 'malformed' value was set in the first place! What version of Zen Cart and what payment methods are involved?

1.5.7c with PayPal, Square and Cash on Pickup

If you scan the site's file-set for storefront occurrences of $_SESSION['shipping'] = false ... where's that being set?

Re: @dbltoe question - this is related: https://www.zen-cart.com/showthread....based-shipping

not finding anything. Probably not searching correctly.

Quote:

---

Originally Posted by lat9

If you scan the site's file-set for storefront occurrences of $_SESSION['shipping'] = false ... where's that being set?

---

Quote:

---

Originally Posted by dbltoe

not finding anything. Probably not searching correctly.

---

i can not speak to whether dbltoe searched correctly... i can surmise he probably did. i have done some searching in various file sets and have not found the requested code.

i did determine that the result of json_encode could be false if the data being encoded is not UTF-8. there are other possibilities as well...

perhaps there is a need to call json_last_error() to find out what the error was if the return is false?

not sure if this helps with the OP....