XSS protection patch - Nov 30 2009

While XSS or CSRF attacks are difficult to trigger and may not manifest very often, it is still important to protect against the ill effects which could be caused by them.

As such, the following XSS patches are advised in order to protect yourself from a recently-reported vulnerability:

The following edits should be made to the respective files.
THESE UPDATES APPLY TO ALL VERSIONS OF ZEN CART UP TO (& including)v1.3.8a (although line numbers may vary)

NOTE: These updates should be made EVEN if you've renamed your admin folder. (Merely renaming your admin folder will NOT protect you from XSS issues.)

**/admin/index.php
**Add the new lines shown, around approx line 135:```
while (!$customers->EOF) {
[B] $customers->fields['customers_firstname'] = zen_output_string_protected($customers->fields['customers_firstname']);
$customers->fields['customers_lastname'] = zen_output_string_protected($customers->fields['customers_lastname']);[/B]
echo ' <div class="row"><span class="left"><a href="' . zen_href_link(FILENAME_CUSTOMERS ....[I](code snipped here for brevity)[/I]........

**/admin/customers.php
**Add the new line shown, around approx line 1173:```
    default:
      if (isset($cInfo) && is_object($cInfo)) {
[B]        if (isset($_GET['search'])) $_GET['search'] = zen_output_string_protected($_GET['search']);[/B]
        $customers_orders = $db->Execute("select o.orders_id, o.date_purchased, o.order_total, o.currency, o.currency_value,

/admin/sqlpatch.php* (ONLY relevant for v1.3.5 to (including) v1.3.8a)*
Add the "(bool)" as shown here on line 808:```

*
Thanks to Pedro Joaquín at webvuln for the alert.*