Quote Originally Posted by Ajeh View Post
Works pretty well, nice job ...
However, hacker that I am, there is a way to trick it on going to a products_info page by changing the URL cPath ...

Interesting enough, removing the cPath and just using the products_id IS protected ...

Something to play with:
/index.php?main_page=product_info&cPath=69&products_id=186 <-- blocked

/index.php?main_page=product_info&cPath=2&products_id=186 <-- sneaks in

Granted you have to really want to get in there and are not a "good" customer ... so, this might not be worth the hassel to try to fix ... otherwise, somewhere you may need one more check that evil is not being committed ...
Thank you for your kind comments Ajeh!

It is the 'good hackers' that reveal flaws - so many thanks for that, I have a go at this in v2.1. No doubt more comments will surface from fellow zenners....

Cheers / Frank