Return Authorization Module (RMA)

[dw08gm]

Re: zen_output_string_protected

The function has to do with averting "sql-injection" and "XSS vulnerability" in Zen Cart.

The function is still widely used in 151 on both admin and catalog sides, including a small number of header_php.php and tpl_whatever_default.php files on catalog side, including tpl_account_history_info_default.php.

However I remain unsure whether it should be applied to the RMA files, or any form-producing files for that matter, but suspect it should where inputs are extracted from or written to the database by the form files, or where other interacting files or mod, such as tpl_account_history or Email_Archive_Manager, are involved. However, its presence does not seem to affect the processing of the forms.


I found this thread dating from 25 October 2008, although it is unclear to me whether the parts highlighted are relevant to RMA.
http://www.zen-cart.com/showthread.p...ring_protected
Post 3 Dr Byte

If the customer has entered text information for an attribute field such as a filename or a text-input field, if that information is to be displayed again for verification/edit, you certainly want that information sanitized before it's displayed.

Would the redisplay of inputs (eg info inserted into RMA form fields from database, eg oID, name), say in going from the account_history_info_default to the RMA page, or proceeding from input to error checking to error correction in the RMA page, constitute a "displayed again for verification/edit" case?

Post 7 Dr Byte

I would think that the output-protected approach should be run anytime the content of user-collected data is being re-displayed, so that if any sql-injection or other attack would be averted.

Would the redisplay of inputs (eg info inserted into RMA form fields from database, eg oID, name), say in going from the account_history_info_default to the RMA page, or proceeding from input to error checking to error correction in the RMA page, constitute an "output-protected approach should be run anytime the content of user-collected data is being re-displayed" case?

Post 9 Dr Byte

Will have to do some further investigation. Here's a related post: http://www.zen-cart.com/forum/showthread.php?t=64115

This last thread dates from 25 April 2007 and specifically refers to XSS vulnerability in and provides fixes for Zen Cart 1.3.7 (and prior versions).


Re: error messaging
I found displaying error messaging within the form, as opposed to displaying same within a message stack, disrupts the layout of the form - with longer error messages causing greater disruption - which can make the overall form difficult to rescan for errors or alterations.

As online forms and associated error message stacks have been around for ages, I am sure the majority of internet users are quite familiar with navigating their way through them. So from my long experience, displaying error messaging within the form is just a change for change sake.

Let us not lose sight of the fact that we are only talking about a Returns form that is applied post-purchase. Sure, it may be convenient for customer relations, but displaying error messaging within a form does not provide for greater sales.

cheers

[DivaVocals]

As online forms and associated error message stacks have been around for ages, I am sure the majority of internet users are quite familiar with navigating their way through them. So from my long experience, displaying error messaging within the form is just a change for change sake.

Let us not lose sight of the fact that we are only talking about a Returns form that is applied post-purchase. Sure, it may be convenient for customer relations, but displaying error messaging within a form does not provide for greater sales.

cheers

It does provide for BETTER usability.. It's a frustrating user experience to fill out a form only to find out that it's missing data, and to have NO indication what the issue is... You cannot assume that people will just KNOW and figure it out because you assume that they SHOULD know.

Again we'll have to agree to disagree.. A returns form by it's very nature isn't helping sales, so I fail to see how providing the end user some indication that the form is not filled out correctly correlates to sales.. Displaying a generic validation message without ANY indication where the error in fact lies is not a great user experience.. In my long experience working in software development, when a form is submitted without all the required information you do need to display some indication to the end user where that error lies.. You call it change for change sake, but improving user experience is not in my opinion a bad thing..

Again clearly you do not agree with this logic..

[rbarbour]

Whether it be via message-stack or inline form error messages, these error messages need to be displayed one way or another (if you want required fields).

This mod uses inline error messages, IMHO, i do not think this was change for change sake, with so many forms using CSS tool-tips and jQuery to display inline error messages, I think it was to give the form a more up-to-date presence.

If one chooses to convert to message-stack by all means, try my MessageStack LightAlert Light Box.

I have to agree with @DivaVocals, the inline error messages do provide better usability hence all the new CSS tool-tips and jQuery form builders.

A Return form DOES help sales and confidence with a customer IMHO.

[dw08gm]

A Return form DOES help sales and confidence with a customer IMHO.

We are not disputing the value of Return forms, but rather only where the error messages in the updated mod are to be placed.

My comment regarding form layout dirsuption seems to have been overlooked.

cheers

[rbarbour]

We are not disputing the value of Return forms, but rather only where the error messages in the updated mod are to be placed.

My comment regarding form layout dirsuption seems to have been overlooked.

cheers

Not overlooked, I ran into the same issue on a site I updated - def something to reconsider as far as adding constraints for the displayed (span) error which should be easily accomplished as I used css.

[DivaVocals]

My comment regarding form layout dirsuption seems to have been overlooked.

cheers

Not sure what you are referring to here.. what layout "disruption" (not sure if this is misspelled or not in your post) are you referring to???

[DivaVocals]

Whether it be via message-stack or inline form error messages, these error messages need to be displayed one way or another (if you want required fields).

This mod uses inline error messages, IMHO, i do not think this was change for change sake, with so many forms using CSS tool-tips and jQuery to display inline error messages, I think it was to give the form a more up-to-date presence.

If one chooses to convert to message-stack by all means, try my MessageStack LightAlert Light Box.

I have to agree with @DivaVocals, the inline error messages do provide better usability hence all the new CSS tool-tips and jQuery form builders.

A Return form DOES help sales and confidence with a customer IMHO.

I agree.. inline messages are used more often in applications these days because they ensure that end users have fewer issues understanding EXACTLY what is required when a form fails validation on submit. It's not change for change sake at all.. it is IMPROVED usability, and I don't understand how that is a BAD thing..

[dw08gm]

you do need to display some indication to the end user where that error lies

But error messages should provide for that:

eg Postcode input requires a minimum of 3 characters,

where "Postcode", in this instance, is the name of the input field.

Cheers

[DivaVocals]

But error messages should provide for that:

eg Postcode input requires a minimum of 3 characters,

where "Postcode", in this instance, is the name of the input field.

Cheers

and those error messages are what is displayed in the current RMA form.. Why is this a BAD thing???:

[dw08gm]

Why is this a BAD thing???:

I seem to have misplaced by reading glasses.

Cheers