Administrator
- Join Date:
- Sep 2009
- Location:
- Stuart, FL
- Posts:
- 14,097
- Plugin Contributions:
- 56
account_edit: Duplicate phpbb email addresses allowed
In an unmodified v1.5.1 Zen Cart with a phpbb linkage established (v3.0.11), create an account in the Zen Cart. Attempting to create an account with the email address of the phpbb administrator (which has no Zen Cart account) is properly denied with a "duplicate email address" error. Continue to create the Zen Cart account with a different email address.
Upon account creation, go to "Your Account" and click "View or change my account information". Within the account_edit screen, change the email address associated with the account to the phpbb administrator's email address. The value is improperly accepted.
The problem lies (starting at line 70) in /includes/modules/pages/account_edit/header_php.php:
$check_email_query = "SELECT count(*) AS total
FROM " . TABLE_CUSTOMERS . "
WHERE customers_email_address = :emailAddress
AND customers_id != :customersID";
$check_email_query = $db->bindVars($check_email_query, ':emailAddress', $email_address, 'string');
$check_email_query = $db->bindVars($check_email_query, ':customersID', $_SESSION['customer_id'], 'integer');
$check_email = $db->Execute($check_email_query);
if ($check_email->fields['total'] > 0) {
$error = true;
$messageStack->add('account_edit', ENTRY_EMAIL_ADDRESS_ERROR_EXISTS);
// check phpBB for duplicate email address
if ($phpBB->phpbb_check_for_duplicate_email(zen_db_input($email_address)) == 'already_exists' ) {
$error = true;
$messageStack->add('account_edit', 'phpBB-'.ENTRY_EMAIL_ADDRESS_ERROR_EXISTS);
}
}
The check for a phpbb duplicate email is being performed only if there's a duplicate email address in the Zen Cart database. Making the following changes to move the phpbb-check outside of the other if-clause corrects the issue:
$check_email_query = "SELECT count(*) AS total
FROM " . TABLE_CUSTOMERS . "
WHERE customers_email_address = :emailAddress
AND customers_id != :customersID";
$check_email_query = $db->bindVars($check_email_query, ':emailAddress', $email_address, 'string');
$check_email_query = $db->bindVars($check_email_query, ':customersID', $_SESSION['customer_id'], 'integer');
$check_email = $db->Execute($check_email_query);
if ($check_email->fields['total'] > 0) {
$error = true;
$messageStack->add('account_edit', ENTRY_EMAIL_ADDRESS_ERROR_EXISTS);
}
// check phpBB for duplicate email address
if ($phpBB->phpbb_check_for_duplicate_email(zen_db_input($email_address)) == 'already_exists' ) {
$error = true;
$messageStack->add('account_edit', 'phpBB-'.ENTRY_EMAIL_ADDRESS_ERROR_EXISTS);
}
P.S. The 'advanced' post editing controls seem have to have disappeared again ...
