Edit Orders v4.0 Support Thread

Danielle:

Just wondering if there are any plans to update this module to be compatible with the new admin sanitizer, as per this thread:

https://www.zen-cart.com/showthread.php?219747

Thanks!
When the solution is posted to that thread, my guess is that no further change will be required of Edit Orders.

Please test it: https://www.zen-cart.com/showthread.php?219747-AdminRequestSanitizer-Error-Log&p=1307377#post1307377

Will do; it'll be tomorrow.

Has anyone tried adding multiline comments during an order edit? It seems to keep the ASCII carriage control in the database. So instead of

Line1
Line2
Line3

You get

Line1\r\nLine2\r\nLine3

lat9:

Will do; it'll be tomorrow.
No go. I've merged the EO 4.1.4 code with the 3/29 update for Zen Cart 1.5.5, added a product to the order and saw that the foreach log was generated. Applied wilt's update and added another product to the order -- still getting that warning.

I added a product with attributes (Matrox G200 MMS) and the attributes don't show upon completion of the addition. I made a teeny change to the requestSanitizer class to also dump the $_GET and $_POST variables on entry; here's the log that's created after I've chosen the attributes to add to the product:

Mar-30-2016 09:42:02
=================================

Running Admin Sanitizers: Array
(
    [page] => 1
    [oID] => 3
    [action] => add_prdct
)
Array
(
    [securityToken] => 929ab5ecab8c7436fbd535d9fc431c06
    [id] => Array
        (
            [3] => Array
                (
                    [value] => 4
                    [type] => 0
                )

            [4] => Array
                (
                    [value] => 3
                    [type] => 0
                )

        )

    [add_product_categories_id] => 4
    [add_product_products_id] => 1
    [search] => 
    [step] => 4
)


SANITIZER BUILTIN == filterSimpleAlphanumPlus

PROCESSING SIMPLE_ALPHANUM_PLUS == action

PROCESSING SIMPLE_ALPHANUM_PLUS == oID

PROCESSING SIMPLE_ALPHANUM_PLUS == page

SANITIZER BUILTIN == filterConvertInt

PROCESSING CONVERT_INT (POST) == id

SANITIZER BUILTIN == filterFileDirRegex

SANITIZER BUILTIN == filterAlphanumDashUnderscore

PROCESSING ALPHANUM_DASH_UNDERSCORE (GET) == action

PROCESSING ALPHANUM_DASH_UNDERSCORE (GET) == page

SANITIZER BUILTIN == filterWordsAndSymbolsRegex

SANITIZER BUILTIN == filterMetaTags

SANITIZER BUILTIN == filterSanitizeEmail

SANITIZER BUILTIN == filterProductDescRegex

PROCESSING PRODUCT_DESC_REGEX == products_description

PROCESSING PRODUCT_DESC_REGEX == coupon_desc

PROCESSING PRODUCT_DESC_REGEX == file_contents

PROCESSING PRODUCT_DESC_REGEX == categories_description

PROCESSING PRODUCT_DESC_REGEX == message_html

PROCESSING PRODUCT_DESC_REGEX == banners_html_text

PROCESSING PRODUCT_DESC_REGEX == pages_html_text

PROCESSING PRODUCT_DESC_REGEX == comments

SANITIZER BUILTIN == filterProductUrlRegex

SANITIZER BUILTIN == filterCurrencyValueRegex

SANITIZER BUILTIN == filterProductNameDeepRegex

SANITIZER BUILTIN == filterStrictSanitizeValues

PROCESSING STRICT_SANITIZE_VALUES == securityToken

PROCESSING STRICT_SANITIZE_VALUES == id

PROCESSING STRICT_SANITIZE_VALUES == add_product_categories_id

PROCESSING STRICT_SANITIZE_VALUES == add_product_products_id

PROCESSING STRICT_SANITIZE_VALUES == search

PROCESSING STRICT_SANITIZE_VALUES == step

PROCESSING STRICT_SANITIZE_VALUES == page

PROCESSING STRICT_SANITIZE_VALUES == oID

PROCESSING STRICT_SANITIZE_VALUES == action

SANITIZER BUILTIN == filterStrictSanitizeKeys

swguy:

Has anyone tried adding multiline comments during an order edit? It seems to keep the ASCII carriage control in the database. So instead of

Line1
Line2
Line3

You get

Line1\r\nLine2\r\nLine3
Yep, we've got some "over preparation" of the data; I'm getting " output when the input order contained simply "

When use edit order with version 1.5.5. You can not update your product. To fix that, add this code on top of edit_order.php

define('DO_STRICT_SANITIZATION', false);

cvhainb:

When use edit order with version 1.5.5. You can not update your product. To fix that, add this code on top of edit_order.php

define('DO_STRICT_SANITIZATION', false);

If this advice is followed it should only be to temporarily continue operation until the underlying code is corrected.  For those interested and have not yet seen the [Developer's Documentation area](http://docs.zen-cart.com/Developer_Documentation/v1.5.5/code_docs/admin_sanitization), there is information there on the use of this define.

cvhainb:

When use edit order with version 1.5.5. You can not update your product. To fix that, add this code on top of edit_order.php

define('DO_STRICT_SANITIZATION', false);

PLEASE DO NOT DO THIS.

Use my fix: <https://www.zen-cart.com/showthread.php?219747-AdminRequestSanitizer-Error-Log&p=1307338#post1307338>
which works fine and allows you to use Edit Orders and benefit from the XSS Fixes.

Security is not optional.  There are plenty of bad people with nothing better to do than attack your site, and if you don't stay updated with the latest security fixes, you WILL be hacked.  I have seen it dozens and dozens of times.

OK, I've created a GitHub repository (https://github.com/lat9/edit_orders) for the plugin, initialized with EO 4.1.4 and updated with each of the bugfixes that I found while painfully scrolling through the postings.

I'm not sending this to the Zen Cart Plugins until I've had a chance to fully vet the changes; any help would be appreciated. Please continue to use this support-thread to report any issues found, making sure that you identify that you're using the GitHub version and note the date/time that you downloaded the repo's file-set.

I've updated the EO github site with a work-around for the Zen Cart 1.5.5 admin-sanitizer issue and verified that it's operating properly on a fresh Zen Cart 1.5.5-20160329 install with EO only. Additional eyes would help. I'll package this up as EO 4.1.4a sometime next week unless some calamity hits.

I was wondering if anyone would have a chance to look at my post #869 of page 87 (https://www.zen-cart.com/showthread.php?200407-Edit-Orders-v4-0-Support-Thread&p=1306017#post1306017). I am having problems with my taxes being messed up and I can not figure out what file I've screwed up.

Any help would be greatly appreciated.

Colleen, check your PMs.

It turns out that using the setting Configuration->My Store->Show Split Tax Lines (when set to 'true') is the basis for the issue that Colleen is experiencing. When that setting is active, there are multiple instances of the ot_tax order-total where EO 4.1.4 is expecting that each order-total occurs once per order.

Found a bug in the latest Github version (https://github.com/lat9/edit_orders).

PHP Fatal error: Call to undefined function zen_product_in_category() in /admin/includes/functions/extra_functions/edit_orders_functions.php on line 326

Category-restricted coupons were not adding into the total after editing the order. In addition to the bugfix found in post #495, I needed to do the following as well.

In this file:
admin/includes/functions/extra_functions/edit_orders_functions.php

Change this:

			if (($coupons->fields['category_id'] !=0) && (zen_product_in_category($product_id, $coupons->fields['category_id'])) && ($coupons->fields['coupon_restrict']=='Y')) return false;
			// if category is not restricted(allow) and product not in category deny
			if (($coupons->fields['category_id'] !=0) && (!zen_product_in_category($product_id, $coupons->fields['category_id'])) && ($coupons->fields['coupon_restrict']=='N')) return false;
			return true;

To this:

			if (($coupons->fields['category_id'] !=0) && (validate_for_category($product_id, $coupons->fields['category_id'])) && ($coupons->fields['coupon_restrict']=='Y')) return false;
			// if category is not restricted(allow) and product not in category deny
			if (($coupons->fields['category_id'] !=0) && (!validate_for_category($product_id, $coupons->fields['category_id'])) && ($coupons->fields['coupon_restrict']=='N')) return false;
			return true;

Jackie, thanks for that! I'll get that updated.

Jackie, I've looked and your proposal is not good since it's modifying the functionality that's being ported from that function in the functions_general.php file in the storefront.

There's something funky going on with the function insertions that I need to investigate.

When did you download the EO fileset from GitHub? I'd made a change on 4/1 that added those "missing" functions. Please re-download the plugin's files as I think it's all better now.

@lat9, should the issues noted in Github which are flagged "fix provided" not just be closed?

I noticed the product select did not account for products_status, so I added that and submitted a PR. I will keep testing. Thanks for fixing my carriage control issue reported here:
https://www.zen-cart.com/showthread.php?200407-Edit-Orders-v4-0-Support-Thread&p=1307485#post1307485

but I believe there is still an issue (reported on https://www.zen-cart.com/showthread.php?219484-Unwanted-characters-showing-up-in-Comments-section-of-Admin-Orders/page2)

@swguy, I'm keeping the "fix provided" status until there's a release candidate (and associated GitHub release) so that I can verify that I've got the readme and install/uninstall handling updated.

I'll need to consider the change you submitted via PR, as it's not clear whether the behavior you're looking to change is a bug or a feature! There might, for example, be shop-owners that use that behavior to add otherwise-disabled products to a customer's order as part of a rewards program.

Regarding the multi-line break characters, I'm not seeing that using Zen Cart 1.5.5 (2016-03-29) plus the 2016-04-12 versions of AdminRequestSanitizer.php and init_sanitize.php and the current code-set from the EO GitHub repository. What admin-level plugins do you have installed in addition to Edit Orders?