Redirect to Home Page When Previewing Products in Admin

A couple of our clients using Zen Cart 1.5.1 have reported that occasionally, when editing products, they will go to click the "Preview" button and end up getting redirected to their admin index page and all of the work they did on that product will be lost.

The only code I can find is related to the securityToken which could be an issue related to handling of sessions. Has anyone else noticed this bug?

Code from /YOUR_ADMIN/includes/init_includes/init_sessions.php:

// lets start our session
  zen_session_start();
  $session_started = true;

if (! isset ( $_SESSION ['securityToken'] ))
{
  $_SESSION ['securityToken'] = md5 ( uniqid ( rand (), true ) );
}
if ((isset ( $_GET ['action'] ) || isset($_POST['action']) ) && $_SERVER['REQUEST_METHOD'] == 'POST')
{
  if ((! isset ( $_SESSION ['securityToken'] ) || ! isset ( $_POST ['securityToken'] )) || ($_SESSION ['securityToken'] !== $_POST ['securityToken']))
  {
    zen_redirect ( zen_href_link ( FILENAME_DEFAULT, '', 'SSL' ) );
  }
}

BTW, the product page form does have the securityToken and the page has no HTML nesting errors and most of the time there is no issue.

My users have the very same problem. It's rare but it's happening (as they claim)...
Has anyone ever found out what was wrong? I'd love to hear it!
Many thanks

The redirect to the admin homepage can be caused by a missing securityToken in the form which had been POSTed as described here:
http://www.zen-cart.com/showthread.php?130410-June-2009-Admin-Security-Patch-vs-some-Addons-Contributions

However, there's a second reason for this to be happening... One of my users kept complaining about it and it took me ages to find out what it was. He was simply using the admin from a few different browser tabs at once. If you open a (post) form in one browser tab and then browse the admin pages from a second tab then the new security code can be generated on the server from the new tab and when you submit the form in the original tab it will fail the validation (maybe you need to logout/timeout and log back in in the second tab to achieve the error).

Hopefully it will save some time for someone with creative admin-users. It took me ages to find out :-/

numinix:

A couple of our clients using Zen Cart 1.5.1 have reported that occasionally, when editing products, they will go to click the "Preview" button and end up getting redirected to their admin index page and all of the work they did on that product will be lost.

The only code I can find is related to the securityToken which could be an issue related to handling of sessions. Has anyone else noticed this bug?

I noticed this same thing with my client, however to save data, dont go back to category and then open the product, in place of that just press back button on browser and you will see all data intact on product page, then you can press preview and update and it will work.

~Time

If you check the web console in Firefox, you may notice a 500 Internal Server Error when the home page loads. Often the culprit is invalid post data that PHP wasn't able to handle. If you are creating product descriptions in another program, it could be adding invalid characters or formatting that is causing the error.

The best way to avoid this is to use either plain text and create your HTML code directly in the textarea, or use a WYSIWYG editor that is integrated into Zen Cart such as CK Editor.

with this new security addition as documented here:

http://www.zen-cart.com/showthread.php?130410

no logging gets done. basically this patch says there is a problem with the security, and we are just going to redirect you to the admin home page. why the maintainers of zen chose to not log this security breach is a mystery to me.