AdminRequestSanitizer Error Log

When using edit orders Zen Cart v1.5.4
I'm getting the following error, edit orders does not save properly so not sure is this something edit orders needs to address or is this an issue with the AdminRequestSanitizer.php file?

[18-Mar-2016 09:23:18 America/New_York] PHP Warning: htmlspecialchars() expects parameter 1 to be string, array given in /var/admin/includes/classes/AdminRequestSanitizer.php on line 319

For capacity reasons the sanitizer could not be tested with all plugins. So, this needs investigation, and probably an update to Edit Orders to address it.
Which feature of Edit Orders were you using to trigger this? It appears to be a problem with something that would have multiple level depths, such as checkboxes or multiple levels of languages within groups.

In addition to describing which feature of EO you were using, you could also obtain more info about what data needs parsing differently by making a small TEMPORARY code change:

In that Admin Sanitizer class file, insert a new line around line 330, as shown here:```
foreach ($_GET as $key => $value) {
if (!in_array($key, $getToIgnore)) {
if (is_array($value)) {
foreach($value as $key2 => $val2){
[B]if (is_array($val2)) die('Value of ['.$key2.'] found to be array: <pre>' . print_r($value, true));[/B]
$_GET[$key][$key2] = htmlspecialchars($val2);
}
} else {

And then it should dump out to your admin screen the values it's trying to process.

Hello DrByte,

I tried to edit an order using edit orders and the onetime discount mod to show a a refund that I issued to a customer. Once I saved it, the product on the order for whatever reason was deleted and the refund that was entered was not saved. I then tried to add the product that was deleted back and save it and it would not save it just kept generating that error. I had to remove the AdminRequestSanitizer.php and revert back to the original init_sanitize.php file for edit orders to start working again.

Ok will do it now and report back.

Hi

As a temporary fix

see https://docs.zen-cart.com/Developer_Documentation/v1.5.5/code_docs/admin_sanitization#disabling-strict-sanitization

I'll take a look at the plugin to see if there is a better fix.

Ok DrByte,

I applied your code change, but it did not display anything to me. Something happens when I edited the the order and tried to give a discount using edit orders/onetime discount it says "Success: Order has been successfully updated" however the discount does not save and it removes the product that was purchased on the order leaving only the shipping.

Same error log is generated:

[18-Mar-2016 15:42:36 America/New_York] PHP Warning: htmlspecialchars() expects parameter 1 to be string, array given in /var/admin/includes/classes/AdminRequestSanitizer.php on line 319

wilt just tried your temp solution and it does work.

marcopolo:

Ok DrByte,

I applied your code change, but it did not display anything to me.
Argh, cuz I gave you the wrong lines :(

At line 319 insert the new line shown:```
foreach ($_POST as $key => $value) {
if (!in_array($key, $postToIgnore)) {
if (is_array($value)) {
foreach($value as $key2 => $val2){
[B]if (is_array($val2)) die('Value of ['.$key2.'] found to be array: <pre>' . print_r($value, true));[/B]
$_POST[$key][$key2] = htmlspecialchars($val2);
}
} else {
$_POST[$key] = htmlspecialchars($value);
}
}
}
foreach ($_GET as $key => $value) {

Below is the output however I do not think it's executing all the way as nothing is saving.

Value of [127213] found to be array:

Array
(
    [127213] => Array
        (
            [qty] => 1
            [name] => Test Item
            [model] => G10
            [tax] => 2
            [final_price] => 12.00
        )

)

also not error logs are being generated.

marcopolo:

Below is the output however I do not think it's executing all the way as nothing is saving.
Right. It's just to get an idea of what data needs treatment.

Thanks, that info is helpful.
Remove those lines I suggested, as they're just for collecting data. Use wilt's temporary suggestion until a proper fix is determined.

Ok thanks

Does it make sense just to add a third layer?

        foreach ($_POST as $key => $value) {
            if (!in_array($key, $postToIgnore)) {
                if (is_array($value)) {
                    foreach($value as $key2 => $val2){
                        if (is_array($val2)) {
                           foreach($val2 as $key3 => $val3){
                              $_POST[$key][$key2][$key3] = htmlspecialchars($val3);
                           }
                        } else {
                           $_POST[$key][$key2] = htmlspecialchars($val2);
                        }
                    }
                } else {
                    $_POST[$key] = htmlspecialchars($value);
                }
            }
        }

As far as I can tell this fixes the log.

Edit orders fabricates the order totals in a multilayered structure. It probably does other things like this too.

[noparse]
Array
(
    [0] => Array
        (
            [code] => ot_combination_discounts
            [title] => Combination Discounts :
            [value] => 3.0000
        )

    [1] => Array
        (
            [code] => ot_fuelsurcharge
            [title] => Fuel Surcharge:
            [value] => 8.5753
        )

    [2] => Array
        (
            [code] => ot_shipping
            [shipping_module] => flat
            [title] => Regular Shipping (Basic shipping included):
            [value] => 0.0000
        )

    [3] => Array
        (
            [code] => ot_snqd
            [title] =>
            [value] =>
            [shipping_module] =>
        )

)[/noparse]

A recursive approach could be taken instead of "planning" for depth... Also, it seems that since ZC 1.5.1 the use of htmlspecialchars has been expanded to include other "directives", should those not be added to that code instead of letting things go as defaulted?

Hi

I do have a pending commit that uses recursion.
https://github.com/zencart/zencart/pull/886/files

Wilt's fix has been merged into the v155 branch on github ... and is now part of core code since the 03-29-2016 zip of v155.

Please run it with Edit Orders. I think the only potential "issue" with it is that it might mangle any HTML in product names when editing one of those in an order.

marcopolo:

When using edit orders Zen Cart v1.5.4
I'm getting the following error, edit orders does not save properly so not sure is this something edit orders needs to address or is this an issue with the AdminRequestSanitizer.php file?

[18-Mar-2016 09:23:18 America/New_York] PHP Warning: htmlspecialchars() expects parameter 1 to be string, array given in /var/admin/includes/classes/AdminRequestSanitizer.php on line 319

Add this code on top of edit_order.php

define('DO_STRICT_SANITIZATION', false);

cvhainb:

Add this code on top of edit_order.php

define('DO_STRICT_SANITIZATION', false);

This is a poor coding recommendation at this point especially with an overall fix provided, further it goes against the information provided at the [Developer's Documentation area](http://docs.zen-cart.com/Developer_Documentation/v1.5.5/code_docs/admin_sanitization) specifically on the use of this define.