Forums / Bug Reports / [Done v1.3.9d] No numeric check for quantity update on shopping_cart page

[Done v1.3.9d] No numeric check for quantity update on shopping_cart page

Locked

Views: 1,240

Results 1 to 2 of 2
This thread is locked. New replies are disabled.
18 May 2010, 10:33 AM
#1
lat9 avatar

lat9

Administrator

Join Date:
Sep 2009
Location:
Stuart, FL
Posts:
14,119
Plugin Contributions:
56

[Done v1.3.9d] No numeric check for quantity update on shopping_cart page

v1.3.9b, fresh install.

When the quantity boxes are shown on the shopping cart (for quantity update), there is no numeric checking for the value typed into the box. Entering a non-numeric value, like 'a', and then pressing the Update icon results in the product being deleted from the cart.

22 May 2010, 9:06 AM
#2
drbyte avatar

drbyte

Sensei

Join Date:
Jan 2004
Posts:
63,515
Plugin Contributions:
176

Re: [Done v1.3.9d] No numeric check for quantity update on shopping_cart page

/includes/classes/shopping_cart.php
around line 1530 you'll see this section of code.
Add the new lines as shown:```
function actionUpdateProduct($goto, $parameters) {
global $messageStack;

for ($i=0, $n=sizeof($_POST['products_id']); $i<$n; $i++) {
  $adjust_max= 'false';
 [B] if (!is_numeric($_POST['cart_quantity'][$i]) || $_POST['cart_quantity'][$i] < 0) {
    $messageStack->add_session('header', ERROR_CORRECTIONS_HEADING . ERROR_PRODUCT_QUANTITY_UNITS_SHOPPING_CART . zen_get_products_name($_POST['products_id'][$i]), 'error');
    continue;
  }[/B]

.
Zen Cart - putting the dream of business ownership within reach of anyone!
Donate to: DrByte directly or to the Zen Cart team as a whole

Remember: Any code suggestions you see here are merely suggestions. You assume full responsibility for your use of any such suggestions, including any impact ANY alterations you make to your site may have on your PCI compliance.
Furthermore, any advice you see here about PCI matters is merely an opinion, and should not be relied upon as "official". Official PCI information should be obtained from the PCI Security Council directly or from one of their authorized Assessors.