Known Bugs (and fixes) with v1.5.4

This thread is an announcement area where any bugs detected for v1.5.4 will be summarized.

The first is that the docs in the /docs/ folder have been reported to still contain the v1.5.3 docs in some cases.

You can find the latest docs online at www.zen-cart.com/docs ... where you'll see the v1.5.4 documentation for easy access.

NOTE: This is ONLY necessary if you're using PHP 5.2.x (but you should upgrade your PHP instead!)

If your server is still using PHP version 5.2.x (which is VERY OLD and now officially obsolete since 2011) and you try to use ZC v1.5.4 you may encounter an error akin to the following when trying to access the Admin area:

Error:
PHP Parse error: syntax error, unexpected T_STATIC in /admin/includes/classes/class.admin.zcObserverLogEventListener.php on line 118

**Fix:
**1. The BEST fix is to upgrade your PHP version to 5.4 or 5.5.
If you're using a hosting company which uses cPanel to manage your sites, such as Hostgator or Bluehost or Hostmonster etc, you can change PHP versions by logging in to cPanel, choosing the "PHP Configuration" icon, and choosing a newer version of PHP from the dropdown menu there.
Consult your hosting company for any assistance you need in changing PHP versions.

2. In the meantime, as a TEMPORARY fix, on line 118 of /admin/includes/classes/class.admin.zcObserverLogEventListener, change:

  $levels = static::$levels;

to:

  $levels = self::$levels;

Remember: PHP 5.2.x is obsolete and officially no longer supported by anybody. You should be upgrading your server's PHP version ASAP.

NOTE: This is ONLY necessary if you're getting this specific error, and have STRICT_ALL_TABLES enabled in MySQL.**
Symptom: **
1. When trying to go to admin this generic error appears: "WARNING: An Error occurred, please refresh the page and try again."
2. Upon inspecting the /logs/ folder, the details of the error are described as:
> PHP Fatal error: 1101:BLOB/TEXT column 'logmessage' can't have a default value

IMPORTANT: YOU SHOULD USE v1.5.5 instead of continuing to use the old unsupported v1.5.4

**NOTES: **
This only happens when MySQL 5.5 or 5.6 is configured with sql_mode=STRICT_ALL_TABLES
And THAT IS RARE, since this is not presently enabled by default for most distributions.

If you're encountering it, chances are it's on Windows: some Windows distributions might have this enabled, or your server administrator might have enabled it in the server's my.cnf config settings.

Solution:
Edit the file "/your_renamed_admin/includes/classes/class.admin.zcObserverLogWriterDatabase.php"
around line 87 change the following code:

from:

    if (!$found_logmessage)
    {
      $sql = "ALTER TABLE " . TABLE_ADMIN_ACTIVITY_LOG . " ADD COLUMN logmessage mediumtext NOT NULL default ''";
      $db->Execute($sql);
    }
    // add 'severity' field of type varchar(9)

to:

    if (!$found_logmessage)
    {
      $sql = "ALTER TABLE " . TABLE_ADMIN_ACTIVITY_LOG . " ADD COLUMN logmessage mediumtext NOT NULL";
      $db->Execute($sql);
    }
    // add 'severity' field of type varchar(9)

*Credit to @lhungil -- *http://www.zen-cart.com/showthread.php?215713-fatal-error-1101&p=1268453#post1268453

NOTE: THIS IS UNNECESSARY IF YOU'RE USING AN HTML5 TEMPLATE

Symptom:
Some changes introduced for smarter jQuery and Ajax support in v1.5.4 may throw warnings in the W3C validator if you're using an XHTML/HTML4 template.

**Resolution:
**
a) If you ARE using an HTML5 template on your site: no changes necessary!

b) If you're not putting an HTML5 template onto your site and you need it to pass XHTML validation in the W3C validator, you can make the changes I posted here:
http://www.zen-cart.com/showthread.php?215734&p=1268671#post1268671

NOTE: This is only relevant IF your PHP configuration includes XCACHE and has it enabled
You can determine xcache availability by reviewing phpinfo for your site.

Symptom:

• Blank screen during zc_install
• No details in /logs/zcInstall-xxxxxx.log files

Fix:
One small change to zc_install/index.php as shown in this post:
http://www.zen-cart.com/showthread.php?215741-Hitting-a-wall-with-installation-blank-screen&p=1268753#post1268753

NOTE: THIS ONLY APPLIES IF YOU'VE ENABLED THIS SETTING:
In your Admin->Configuration->Customer Details you've set Customer Approval Status - Authorization Pending to **1 **(1 = Must be Authorized to Browse)

Symptoms:

• Possible symptom: visiting the site (or clicking "home") while not already logged in as an approved customer, the login page appears multiple times in the browser if the Authorization Pending setting is not set to 0
• Possible symptom: if using PayPal IPN then IPNs may not be getting processed if the Authorization Pending setting is not set to 0
• Possible symptom: any other scripts using the built-in ajax handler are not processing if the Authorization Pending setting is not set to 0

Easiest Fix:

1. If you don't need that Customer Approval option, then TURN IT OFF (set it to 0).

Code Fix:
2. But if you need the feature, you will need to make the following edits to /includes/init_includes/init_customer_auth.php, by adding the additional code as highlighted here:

Around line 55 you'll find a "switch" loop:

switch (true) {
 /**
  * bypass redirects for these scripts, to processing regardless of store mode or cust auth mode
  */
 case (preg_match('|_handler\.php$|', $_SERVER['SCRIPT_NAME'])):
 case (preg_match('|ajax\.php$|', $_SERVER['SCRIPT_NAME'])):
 break;


  case ($down_for_maint_flag && DOWN_FOR_MAINTENANCE_TYPE == 'strict'):

Around line 111 is another "switch" loop:

switch (true) {
/**
 * check store status before authorizations
 */
  case (STORE_STATUS != 0):
    break;


 /**
  * bypass redirects for these scripts, to processing regardless of store mode or cust auth mode
  */
case (preg_match('|_handler\.php$|', $_SERVER['SCRIPT_NAME'])):
case (preg_match('|ajax\.php$|', $_SERVER['SCRIPT_NAME'])):
break;


  case (CUSTOMERS_APPROVAL_AUTHORIZATION == '1' and $_SESSION['customer_id'] == ''):

Credit to @lhungil for suggestions

NOTE: THIS ONLY APPLIES IF YOU ARE ADDING ANOTHER LANGUAGE

**Symptom: **
When you use the Admin page for adding a new language, it should normally copy all your English product/category descriptions to the descriptions in the new language, as defaults. (so that the descriptions aren't blank if a shopper chooses the new language for viewing).
If it ends up blank, it could be due to this bug.

Fix:
Make the simple code change posted here: http://www.zen-cart.com/showthread.php?215842-Insertion-of-an-additional-language-does-not-copy-existing-category-product-texts&p=1269562#post1269562

NOTE: This is ONLY necessary if you're using PHP 5.2.x (but you should upgrade your PHP instead!)

If your server is still using PHP version 5.2.x (which is VERY OLD and now officially obsolete since 2011) and you try to use ZC v1.5.4 you may encounter an error akin to the following when trying to access the Admin area:

Symptom:
Admin page, after login, is blank, and if you View Source on the page, it stops after displaying the time and IP address and a <br> tag.

**Fix:
**1. The BEST fix is to upgrade your PHP version to 5.4 or 5.5.
If you're using a hosting company which uses cPanel to manage your sites, such as Hostgator or Bluehost or Hostmonster etc, you can change PHP versions by logging in to cPanel, choosing the "PHP Configuration" icon, and choosing a newer version of PHP from the dropdown menu there.
Consult your hosting company for any assistance you need in changing PHP versions.

2. In the meantime, as a TEMPORARY fix, on line 236 of /admin/includes/header.php, add the // as shown below:

[B]//[/B]  echo @gethostname(); //what server am I working on?

Remember: PHP 5.2.x is obsolete and officially no longer supported by anybody. You should be upgrading your server's PHP version ASAP.
DO IT NOW! Yes, it IS that important!!!!!

Symptom:
On the last page of checkout customers may intermittently encounter the "Whoops your session timed out. Please log in." message (or some variation of it).

Fix:
/includes/functions/sessions.php
On 3 lines, add ,- into the pattern, as shown below:

Line #111 : if (preg_replace('/[a-zA-Z0-9,-]/', '', session_id()) != '')

Line #125 : if (preg_replace('/[a-zA-Z0-9,-]/', '', $tempSessid) != '')

Line #138 : if (preg_replace('/[a-zA-Z0-9,-]/', '', $tempName) == '') return session_name($name); 
```


Affects Zen Cart v1.3.9, 1.5.0, 1.5.1, 1.5.2, 1.5.3, 1.5.4 on PHP 5.0-and-newer if your PHP configuration has *session.hash_bits_per_character* set to 6. 
The fix is the same for all versions, although the line numbers may be different, and in 1.3.9 some may be missing (and if you're using 1.3.9 you SHOULD be upgrading ASAP).



*Credit to gunnzo for debugging this on a Dreamhost server. Thanks!*

Symptom:
Normally during checkout you want it to auto-select the cheapest shipping option for your customer.
But in some configurations this may not happen, and thus no radio-buttons are pre-selected.
This affects versions v1.5.3 and v1.5.4.

Cause:
There was a condition missed when rewriting that section of the code for PHP 5.4 compatibility.

Fix:
The solution is simple:

/includes/modules/pages/checkout_shipping/header_php.php, line 212:

Change this:```
if ( !isset($_SESSION['shipping']) && (zen_count_shipping_modules() > 1) ) $_SESSION['shipping'] = $shipping_modules->cheapest();

to this:

if ((!isset($_SESSION['shipping']) || (!isset($_SESSION['shipping']['id']) || $_SESSION['shipping']['id'] == '') && zen_count_shipping_modules() >= 1)) $_SESSION['shipping'] = $shipping_modules->cheapest();

Symptom: intermittent errors in logs, specifically for the db_cache or sessions tables, matching the following patterns:

PHP Fatal error: 1062: Duplicate entry 'zc_xxxxxx' for key 1 :: insert into db_cache set cache_entry_name = 'zc_xxxxxx' ...

PHP Fatal error: 1062: Duplicate entry 'xxxxxx' for key 'PRIMARY' :: insert into sessions ...

NOTE: THIS IS NOT for any general "1062 Duplicate entry" error. This is SPECIFIC to the db_cache and sessions tables. If you've got a "1062 Duplicate entry" message for another table, that is a SEPARATE ISSUE, which you will need to fix separately!

FIX: Apply the code changes shown in BOTH of these posts:
https://github.com/zencart/zencart/pull/244/files
and
https://github.com/zencart/zencart/pull/245/files

(On that site, the text in red is stuff that was removed. Text in green is stuff that was added/changed.
Basically, remove all the lines that are shown as starting with a "-", and replace/add all lines that are shown as starting with a "+". The red and green are just clarifying guides.)

This also affects older versions. The above fixes are included in v1.6.0

Symptom:
Getting error message:
*PHP Fatal error: Function name must be a string in /includes/modules/payment/paypal/paypal_functions.php on line 919
*

Fix:

1. **THE RECOMMENDED FIX IS to use PayPal Express Checkout **... because it is a much better experience for the customer, and is a more reliable technology. (PayPal Standard can sometimes be blocked by various factors, thus resulting in orders not recorded in your store even though they've been paid for. Express Checkout doesn't have the technical limitations that Standard has, so is a MUCH better choice.)

2. Or, if you are strongly opposed to using the recommended more reliable method, then you can make the following change in PHP:
   Edit /includes/modules/paypal/paypal_functions.php ... line 919
   Change $ipn_logging( to ipn_logging( (just removing the $).

Symptom: Payments made using Authorize.net AIM don't record the "card type" (ie: visa, mastercard, etc) in the order details as shown in your Admin console.

This issue affects only v1.5.4.

FIX:
Change this: /includes/modules/payment/authorizenet_aim.php line 291:

$processButton = array('ccFields'=>array('cc_number'=>'authorizenet_aim_cc_number', 'cc_owner'=>'authorizenet_aim_cc_owner', 'cc_cvv'=>'authorizenet_aim_cc_cvv', 'cc_expires'=>array('name'=>'concatExpiresFields', 'args'=>"['authorizenet_aim_cc_expires_month','authorizenet_aim_cc_expires_year']"), 'cc_expires_month'=>'authorizenet_aim_cc_expires_month', 'cc_expires_year'=>'authorizenet_aim_cc_expires_year'), 'extraFields'=>array(zen_session_name()=>zen_session_id()));

To this:

$processButton = array('ccFields'=>array('cc_number'=>'authorizenet_aim_cc_number', 'cc_owner'=>'authorizenet_aim_cc_owner', 'cc_cvv'=>'authorizenet_aim_cc_cvv', 'cc_expires'=>array('name'=>'concatExpiresFields', 'args'=>"['authorizenet_aim_cc_expires_month','authorizenet_aim_cc_expires_year']"), 'cc_expires_month'=>'authorizenet_aim_cc_expires_month', 'cc_expires_year'=>'authorizenet_aim_cc_expires_year'), 'extraFields'=>array(zen_session_name()=>zen_session_id(), 'cc_type' => $this->cc_card_type));

Someone sent me logs from an instance where this error came up:

We are sorry for the inconvenience; however, at the present time we are unable to use PayPal to process orders from the geographic region you selected as your PayPal address. Please continue using normal checkout and select from the available payment methods to complete your order.

In the past most of the research to determine its cause was geared around customer address info. But in this case something else stood out, and the following fix worked for them.

I've not had a chance to do extensive testing with all possible configurations, but I'm offering this for others to try out and share feedback:

/includes/modules/payment/paypalwpp.php
Line 1755 (as of v1.5.4)
Change this:

$order->info['total'] = urldecode($response['AMT']);

to the following, which basically just adds some conditional checks in front of the existing logic on that line:

if ($order->info['total'] < 0.01 && urldecode($response['AMT']) > 0) $order->info['total'] = urldecode($response['AMT']);

Discussion on this can be continued at: https://www.zen-cart.com/showthread.php?217225

Symptom:
When DISPLAY_PRICE_WITH_TAX is false but DISPLAY_PRICE_WITH_TAX_ADMIN is true, product prices do not include tax in the products price manager.

Resolution:

Change line 948 of /admin/products_price_manager.php from

  if (DISPLAY_PRICE_WITH_TAX == 'true') {

to

  if (DISPLAY_PRICE_WITH_TAX_ADMIN == 'true') {

Discussion on this may be continued at https://www.zen-cart.com/showthread.php?217377-Products-Price-Manager-using-store-side-tax-definition

SYMPTOM:
If a customer has a cart with a free shipping item included after previously getting to the checkout_payment screen with an item that is to be shipped, the cost of shipping is not reset to 0.00 when returning to checkout with only free shipping (no cost shipping) other than store pickup.

Affects v1.5.3 and v1.5.4.

SOLUTION:
In includes/modules/pages/checkout_shipping/header_php.php

// if the order contains only virtual products, forward the customer to the billing page as
// a shipping address is not needed
if ($order->content_type == 'virtual') {
 [B]$_SESSION['shipping'] = array();[/B]
 $_SESSION['shipping']['id'] = 'free_free';
 $_SESSION['shipping']['title'] = 'free_free';
 [B]$_SESSION['shipping']['cost'] = 0;[/B]
 $_SESSION['sendto'] = false;
 zen_redirect(zen_href_link(FILENAME_CHECKOUT_PAYMENT, '', 'SSL'));
}

Discussed at: https://www.zen-cart.com/showthread.php?215820-1-5-3-and-1-5-4-removal-of-shipped-product-with-free-shipping-item-remaining&p=1269364#post1269364

On servers where PHP is not configured with any timezone at all, you might get an error saying "it's not safe to use the default timezone".

The fix involves 2 parts:

1. Set a timezone in /includes/extra_configures/set_time_zone.php (This part is not a bug.)

2. Then apply this simple bugfix so the error doesn't appear on the admin login page:
   Edit /admin/login.php
   Find line 16:

require ('includes/application_top.php');

and move it up above line 9 (or at least above line 13 where strtotime() is being called).

Discussed at [Done v1.5.5] Admin timezone error on login page

THIS IS A DUPLICATE OF THE POST MADE BY DRBYTE ON Nov 26, 2015

While it's never pleasant to report about security problems, a few patches which should be applied

1. Problem with /ajax.php in v1.5.4 only - Severity: High
In Zen Cart v1.5.4 the /ajax.php file has a vulnerability which can be used to cause a server exploit under very specific conditions.
The patch is simple: replace the /ajax.php file with the one attached below.

QUICK PATCH TO APPLY: /ajax.php --> click here: Attachment #15828

Below are some additional lower-severity patches affecting prior versions, which should be reviewed carefully for your site, to merge with existing customizations you may have made:

2. XSS problem for unsanitized comment field - Severity: Medium
In Zen Cart versions up to and including v1.5.4 an XSS problem exists with the order-comments field.
XSS problems are where someone can drop in executable/javascript code that can cause problems later when that content is output back to the screen.
The fix for this is a simple one-line patch to /includes/modules/pages/checkout_confirmation/header_php.php, as shown in this code diff: XSS fix
Thanks to Trustwave Security for alerting us to this issue.
The attached checkout_confirmation header_php.php is for v1.3.9-thru-v1.5.4 only. Older versions should be patched manually using the code diff in the link above.
Patched file: /includes/modules/pages/checkout_confirmation/header_php.php --> click here: Attachment #15825

3. Failed customer login puts password back in input box - Severity: Low
When attempting a login with an invalid password, the resulting response contains that invalid password.
The fix for this is a simple edit to the /includes/functions/html_output.php file, as shown in this code diff: XSS fix
For v1.5.4 one can apply the attached html_output.php file to /includes/functions/html_output.php ... or if you've customized that file via plugins, use the above code-diff link to find the one line to change.
Patched file: /includes/functions/html_output.php --> click here: Attachment #15826

.

THIS MAY OR MAY NOT AFFECT various v1.5.0 implementations. We're posting it here "in case". Implementing this fix is safe either way.

Symptom: Admin Login "broken" in v1.5.0 - v1.5.5a with Google Chrome error: "Aw, snap"

Google Chrome 54.0.2840.59 is now forcefully disallowing the use of javascript function declarations of 'animate'. This interferes with the "spinner" that appears during admin login since v1.5.0

The fix is simple:

1. Open /admin/login.php in a code-safe text editor, such as Sublime Text:
2. Find and replace "animate(" with "waiting_spinner(". There will be 3 occurrences.
3. Save
   That's it. Login should now work again.

For a visual example of the changes, see: https://github.com/zencart/zencart/pull/1321/files
(exact position and line numbers may differ between Zen Cart versions)

Ref: https://www.zen-cart.com/showthread.php?221226-Chrome-Browser-54-0-2840-59-64-bit-windows-cannot-log-into-admin