For DR Byte

[BlushFashions]

Hello Dr Byte

I have completed your new secirity bug fix:

http://www.zen-cart.com/forum/showthread.php?t=43579

However could I confim that where you mention

should be several lines:
Code:
$sql = "SELECT *
FROM " . TABLE_PAYPAL_SESSION . "
WHERE session_id = :sessionID";
$sql = $db->bindVars($sql, ':sessionID', $session_stuff[1], 'string');

There is only 4 lines of code

Also how can we test these fixes..... what screens should we use?

Yours Blushfashions

[DrByte]

---------------------------

includes/modules/payment/paypal/paypal_functions.php
line 35:

    $sql = "select * from " . TABLE_PAYPAL_SESSION . " where session_id = '" . $session_stuff[1] . "'";

should be replaced with these lines:

    $sql = "SELECT * 
            FROM " . TABLE_PAYPAL_SESSION . " 
            WHERE session_id = :sessionID";
    $sql = $db->bindVars($sql, ':sessionID', $session_stuff[1], 'string');

---------------------------

replace the one line ... with the several lines shown.

[BlushFashions]

Many thanks for the quick response

I tried adding an item to the shopping cart and all worked fine, however I did not test the purchase button.

Yours BlushFashions