EdsGoodStuff:
[30-Nov-2012 21:41:11] PHP Warning: constant() [function.constant]: Couldn't find constant in /home/content/html/admin/includes/functions/admin_access.php on line 38
I checked in /admin/includes/functions/admin_access.php and this is what it says on line 38:
if (constant($result->fields['main_page']) == $page && $result->fields['page_params'] == $page_params) {
EdsGoodStuff:
Seem to have found a solution.
I went to Admin Access Management> Admin Profiles and clicked on Edit for the Administrator User Profile. The BOX_HEADING_PRODUCT_TYPES category at the bottom of the page has four check-boxes of which three were checked by default- Product-Music, Document-General, and Document-Product. When I uncheck these boxes and update the profile I can log in as Administrator and not get any myDebug errors.
lat9:
I've traced this down to the following conditions:
-
- The currently signed-in admin is not a superuser.
- The admin profile associated with that admin has one or more of the 'Product Types' enabled.
For that set of conditions, the check_page function in admin_access.php is choking on the (non-existent) constant associated with the enabled Product Type. In that case, the main_page value returned for the enabled product type by the SQL query at line 29 of /ADMIN/includes/functions/admin_access.php is empty because there's no such key (e.g. _productTypes_product_music) to associate.
With the changes in red, the debug logs no longer are created ... but I'm not sure if (a) it's an appropriate change and (b) if it's a complete change.
$sql = "SELECT ap.main_page, ap.page_params
FROM " . TABLE_ADMIN . " a
LEFT JOIN " . TABLE_ADMIN_PAGES_TO_PROFILES . " ap2p ON ap2p.profile_id = a.admin_profile
LEFT JOIN " . TABLE_ADMIN_PAGES . " ap ON ap.page_key = ap2p.page_key
WHERE admin_id = :adminId:";
$sql = $db->bindVars($sql, ':adminId:', $_SESSION['admin_id'], 'integer');
$result = $db->Execute($sql);
$retVal = FALSE;
while (!$result->EOF) {
/// FIX: add the zen_not_null() check here
$pageName = zen_not_null($result->fields['main_page']) ? constant($result->fields['main_page']) : '';
if (($pageName == $page || basename($pageName, '.php') == $page) && $result->fields['page_params'] == $page_params) {
$retVal = TRUE;
}
$result->MoveNext();
}
> I also noticed during my "playing" with this that it's not possible to check 'Product Types', 'Product - Free Shipping' in an admin profile and have it remain checked after clicking the Update button.
> **lat9:**
>
> The issue here is that the page_key value created in the admin_pages_to_profiles table (_productTypes_product_free_shipping) is 35 characters long and doesn't quite fit into the field that's defined as varchar(32).:(
> **lat9:**
>
> A better solution is to improve the query to 'weed out' the erroneous selection in the first place:
> ```
$sql = "SELECT ap.main_page, ap.page_params
FROM " . TABLE_ADMIN . " a
LEFT JOIN " . TABLE_ADMIN_PAGES_TO_PROFILES . " ap2p ON ap2p.profile_id = a.admin_profile
LEFT JOIN " . TABLE_ADMIN_PAGES . " ap ON ap.page_key = ap2p.page_key
WHERE admin_id = :adminId:
AND ap2p.page_key NOT LIKE '_productTypes_%'";
/// FIX: added the AND line above
$sql = $db->bindVars($sql, ':adminId:', $_SESSION['admin_id'], 'integer');
$result = $db->Execute($sql);
$retVal = FALSE;
while (!$result->EOF) {
$pageName = constant($result->fields['main_page']);
if (($pageName == $page || basename($pageName, '.php') == $page) && $result->fields['page_params'] == $page_params) {
$retVal = TRUE;
}
$result->MoveNext();
}
Moved to Bug Reports area for further investigation.
.
Zen Cart - putting the dream of business ownership within reach of anyone!
Donate to: DrByte directly or to the Zen Cart team as a whole
Remember: Any code suggestions you see here are merely suggestions. You assume full responsibility for your use of any such suggestions, including any impact ANY alterations you make to your site may have on your PCI compliance.
Furthermore, any advice you see here about PCI matters is merely an opinion, and should not be relied upon as "official". Official PCI information should be obtained from the PCI Security Council directly or from one of their authorized Assessors.
