AdminRequestSanitizer Error Log

        foreach ($_GET as $key => $value) {
            if (!in_array($key, $getToIgnore)) {
                if (is_array($value)) {
                    foreach($value as $key2 => $val2){
if (is_array($val2)) die('Value of ['.$key2.'] found to be array: <pre>' . print_r($value, true));
                        $_GET[$key][$key2] = htmlspecialchars($val2);
                    }
                } else {

marcopolo:

Ok DrByte,

I applied your code change, but it did not display anything to me.

        foreach ($_POST as $key => $value) {
            if (!in_array($key, $postToIgnore)) {
                if (is_array($value)) {
                    foreach($value as $key2 => $val2){
if (is_array($val2)) die('Value of ['.$key2.'] found to be array: <pre>' . print_r($value, true));
                        $_POST[$key][$key2] = htmlspecialchars($val2);
                    }
                } else {
                    $_POST[$key] = htmlspecialchars($value);
                }
            }
        }
        foreach ($_GET as $key => $value) {

Array
(
    [127213] => Array
        (
            [qty] => 1
            [name] => Test Item
            [model] => G10
            [tax] => 2
            [final_price] => 12.00
        )

)

marcopolo:

Below is the output however I do not think it's executing all the way as nothing is saving.

        foreach ($_POST as $key => $value) {
            if (!in_array($key, $postToIgnore)) {
                if (is_array($value)) {
                    foreach($value as $key2 => $val2){
                        if (is_array($val2)) {
                           foreach($val2 as $key3 => $val3){
                              $_POST[$key][$key2][$key3] = htmlspecialchars($val3);
                           }
                        } else {
                           $_POST[$key][$key2] = htmlspecialchars($val2);
                        }
                    }
                } else {
                    $_POST[$key] = htmlspecialchars($value);
                }
            }
        }

[noparse]
Array
(
    [0] => Array
        (
            [code] => ot_combination_discounts
            [title] => Combination Discounts :
            [value] => 3.0000
        )

    [1] => Array
        (
            [code] => ot_fuelsurcharge
            [title] => Fuel Surcharge:
            [value] => 8.5753
        )

    [2] => Array
        (
            [code] => ot_shipping
            [shipping_module] => flat
            [title] => Regular Shipping (Basic shipping included):
            [value] => 0.0000
        )

    [3] => Array
        (
            [code] => ot_snqd
            [title] =>
            [value] =>
            [shipping_module] =>
        )

)[/noparse]

marcopolo:

When using edit orders Zen Cart v1.5.4
I'm getting the following error, edit orders does not save properly so not sure is this something edit orders needs to address or is this an issue with the AdminRequestSanitizer.php file?

[18-Mar-2016 09:23:18 America/New_York] PHP Warning: htmlspecialchars() expects parameter 1 to be string, array given in /var/admin/includes/classes/AdminRequestSanitizer.php on line 319

cvhainb:

Add this code on top of edit_order.php
[PHP]define('DO_STRICT_SANITIZATION', false);[/PHP]