Multiple myDEBUG files, similar errors

This might not the proper place to put this but I couldn't find any other category to put it.

2 different myDEBUG files multiple times within the timeframe of a PCI scan in progress, so I'm assuming that something related to the PCI scan caused the files to be generated.

Are these to be expected or is the PCI scan causing unexpected problems?

[09-Aug-2014 09:35:08 America/Los_Angeles] PHP Fatal error:  Call to a member function get_template_dir() on a non-object in /home/HOSTINGNAME/public_html/includes/languages/english/credit_cards.php on line 46

[09-Aug-2014 09:34:28 America/Los_Angeles] PHP Warning:  trim() expects parameter 1 to be string, array given in /home/HOSTINGNAME/public_html/includes/functions/functions_general.php on line 63

v1.5.3 installed using hotfix1 version w/DB upgrade from v1.3.9H
PHP 5.3.28
MySQL 5.1.73

The fact that the upgrade wasn't done by using the package available from this website may be a reason for the errors. Regarding the right place to post, I thought this thread was intended to post bugs with the core code, not necessarily problems encountered with operating the store, though at the moment perhaps that's how it seems.

mc12345678:

The fact that the upgrade wasn't done by using the package available from this website.

take a look & see that IS the latest download version before telling someone they did not install using a proper fileset which is why I specified the Version instead of just saying "I used the latest version"

Why couldn't that be a bug to the core causing a debug error instead of taking intended, protective action for an attempted security breach?

So, which category would you suggest this belongs?

RixStix:

take a look & see that IS the latest download version before telling someone they did not install using a proper fileset which is why I specified the Version instead of just saying "I used the latest version"

Why couldn't that be a bug to the core causing a debug error instead of taking intended, protective action for an attempted security breach?

So, which category would you suggest this belongs?

My interpretation of the "hotfix1 version" was that modified someone that referred to either themselves or the newly created version as the hotfix1 version. There have been a few that have gone and made autoinstall versions of ZC 1.5.3 that do not operate as intended (an example is one that allows access to the admin area without providing login credentials, not the same thing being reported here, but...). I did decide to go out on a limb and assume that the version discussed was not one from this site to get straight to possible solutions rather than lobbing questions back and forth. Limb broke. :)

So, onto the other aspects of what you investigated, if not mistaken, part of the PCI scan is to see what can be done to potentially cause mischief and if successful at getting to somewhere that they shouldn't, then the scan would/should provide an alert to identify that there is a problem with the site. It appears that in one case an error did occur which would terminate further processing in presenting that portion of the page, though I am racking my brain as to how/why there is code in the languages directory to permit something going wrong, but I do remember something "special" about credit_cards.php. Can't find it in the online docs available from this site/docs, but no matter.

All that said, yeah, the messages could be from a legit PCI scan or someone posing as such. The other part of the reporting is that I think a typical review of the actor causing the trouble is supposed to include a review of said activity at least a couple of seconds, possibly a couple of minutes in advance of the error. (Have seen others suggest up to five minutes in advance of the error message.) So it could be one or more of those individuals before the log was created that could have caused it.

My initial thought for something that doesn't clearly fall within a specific category such as a question about a payment module or a shipping module is the general questions area. I have posted here before after being able to reproduce a problem that goes back to even a vanilla install (not indicated that plugins were/were not installed above). For example on ZC 1.5.1, I can't remember the specific setting necessary regarding whether to go or not go to the shopping cart after adding a product, but I think it was to not go to the cart, if a non product default item was added to the cart, then the customer was taken to the product not found page. Unfortunately for me, that had already been identified under a different description, but it was easily repeatable and was a bug with the code that has since been corrected. So, is it necessarily a bug that an error log or warning log is generated when bad data is provided to the cart? I wouldn't necessarily call the error generation a bug, now if it went on to something else unexpected/undesired, then yes I would call it a bug. If the errors arise while naturally navigating the site, yeah probably consider it a bug.

I would say though that perhaps upon this initial notification the bug report section may lead to identifying an issue that needs to be corrected, so that's why I tried to indicate that perhaps this is the right location until "proven" or determined that it is not a bug and that the code is operating as expected.

I realize/know that you've been working with ZC for a long while and hopefully there has/will be enough information associated with the setup for a more thorough investigation into this to identify if this is a bug or not... I would say that if there was mischief assumed to have occurred (ie, doubt that the visitor was PCI scanning), then the more appropriate location would have been the help I think I have been hacked area. :) but this does not appear to be the case at the moment. :)

Thanks for reporting these.

RixStix:

Are these to be expected or is the PCI scan causing unexpected problems?None should be "expected". But knowing what exactly was done to trigger them is very important in order to confirm that the problem is fixed.

RixStix:

[09-Aug-2014 09:35:08 America/Los_Angeles] PHP Fatal error: Call to a member function get_template_dir() on a non-object in /home/HOSTINGNAME/public_html/includes/languages/english/credit_cards.php on line 46

So, need to know what's triggering it ...

> **RixStix:**
>
> ```
[09-Aug-2014 09:34:28 America/Los_Angeles] PHP Warning:  trim() expects parameter 1 to be string, array given in /home/HOSTINGNAME/public_html/includes/functions/functions_general.php on line 63
```Ajeh and I were investigating that very same error message, but I can't recall if it was occurring in the same place.  It was a few weeks ago. Can't remember what we discovered, or if it was inconclusive.

DrByte:

PHP Warning: trim() expects parameter 1 to be string, array given in /home/HOSTINGNAME/public_html/includes/functions/functions_general.php on line 63
Ajeh and I were investigating that very same error message, but I can't recall if it was occurring in the same place. It was a few weeks ago. Can't remember what we discovered, or if it was inconclusive.

I've also spent some time investigating this error. Although I can't remember the conditions that caused it, my solution was to change:

  function zen_parse_input_field_data($data, $parse) { 
return strtr(trim($data), $parse);
  }

To

  function zen_parse_input_field_data($data, $parse) {  
    if(is_array($data))  $data =  $data[0];

 return strtr(trim($data), $parse);
  }

I've not observed any ill effects.

Cheers
RodG

You could install the myDebug Backtrace (http://www.zen-cart.com/showthread.php?213695-myDEBUG-Backtrace-Support-Thread) plugin, which will enable the debug-log files to report the caller(s) of zen_parse_input_data that are supplying the invalid data.

lat9:

You could install the myDebug Backtrace (http://www.zen-cart.com/showthread.php?213695-myDEBUG-Backtrace-Support-Thread) plugin, which will enable the debug-log files to report the caller(s) of zen_parse_input_data that are supplying the invalid data.

Done. Scheduled another scan, so we will see in a couple of hours what happens.

MyDebug Backtrace for the functions_general.php logfile

[10-Aug-2014 06:40:47 America/Los_Angeles] #1  trim() called at [/home/XXXXXXXX/public_html/includes/functions/functions_general.php:63]
#2  zen_parse_input_field_data() called at [/home/XXXXXXXX/public_html/includes/functions/functions_general.php:77]
#3  zen_output_string() called at [/home/XXXXXXXX/public_html/includes/functions/html_output.php:466]
#4  zen_draw_hidden_field() called at [/home/XXXXXXXX/public_html/includes/modules/sideboxes/currencies_header.php:30]
#5  require(/home/XXXXXXXX/public_html/includes/modules/sideboxes/currencies_header.php) called at [/home/XXXXXXXX/public_html/includes/templates/westminster_new/common/tpl_header.php:85]
#6  require(/home/XXXXXXXX/public_html/includes/templates/westminster_new/common/tpl_header.php) called at [/home/XXXXXXXX/public_html/includes/templates/westminster_new/common/tpl_main_page.php:182]
#7  require(/home/XXXXXXXX/public_html/includes/templates/westminster_new/common/tpl_main_page.php) called at [/home/XXXXXXXX/public_html/index.php:97]

[10-Aug-2014 06:40:47 America/Los_Angeles] PHP Warning:  trim() expects parameter 1 to be string, array given in /home/XXXXXXXX/public_html/includes/functions/functions_general.php on line 63

No MyDebug Backtrace generated for the credit_cards.php logfile.

I have the server, last300, errorlog during the scan.
I can get both server logs during the scan.

FWIW, in a weeks worth of normal operation, no logfiles were generated. These logfiles have only been generated during a PCI scan and the same number of logfiles were generated each time.

RodG:

To

function zen_parse_input_field_data($data, $parse) {
if(is_array($data)) $data = $data[0];

return strtr(trim($data), $parse);
}

> 
> I've not observed any ill effects. 
> 
> Cheers
> RodG

Rod,  I'll make that edit and run another scan to see if there is any difference.

Also, I checked and verified that the functions_general.php and credit_cards.php files are unedited from the fresh install files.

RixStix:

MyDebug Backtrace for the functions_general.php logfile

[10-Aug-2014 06:40:47 America/Los_Angeles] #1 trim() called at [/home/XXXXXXXX/public_html/includes/functions/functions_general.php:63]
#2 zen_parse_input_field_data() called at [/home/XXXXXXXX/public_html/includes/functions/functions_general.php:77]
#3 zen_output_string() called at [/home/XXXXXXXX/public_html/includes/functions/html_output.php:466]
#4 zen_draw_hidden_field() called at [/home/XXXXXXXX/public_html/includes/modules/sideboxes/currencies_header.php:30]
#5 require(/home/XXXXXXXX/public_html/includes/modules/sideboxes/currencies_header.php) called at [/home/XXXXXXXX/public_html/includes/templates/westminster_new/common/tpl_header.php:85]
#6 require(/home/XXXXXXXX/public_html/includes/templates/westminster_new/common/tpl_header.php) called at [/home/XXXXXXXX/public_html/includes/templates/westminster_new/common/tpl_main_page.php:182]
#7 require(/home/XXXXXXXX/public_html/includes/templates/westminster_new/common/tpl_main_page.php) called at [/home/XXXXXXXX/public_html/index.php:97]

[10-Aug-2014 06:40:47 America/Los_Angeles] PHP Warning: trim() expects parameter 1 to be string, array given in /home/XXXXXXXX/public_html/includes/functions/functions_general.php on line 63

> 
> No MyDebug Backtrace generated for the credit_cards.php logfile.
> 
> I have the server, last300, errorlog during the scan.
> I can get both server logs during the scan.
> 
> FWIW, in a weeks worth of normal operation, no logfiles were generated.  These logfiles have only been generated during a PCI scan and the same number of logfiles were generated each time.
What's at line 30 in /includes/modules/sideboxes/currencies_header.php?

So, after making RodG's edit, run PCI scan a 3rd time and making the assumption that the scans were identical in the line items and in the order of line items.

There was only 1 instead of 7 logfiles generated for the functions_general.php error.

There were still 2 logfiles generated for the credit_cards.php error

AND an additional logfile (probably unrelated to the PCI scan)

[10-Aug-2014 08:58:49 America/Los_Angeles] #1 trigger_error() called at [/home/XXXXXXXX/public_html/includes/classes/db/mysql/query_factory.php:155]
#2 queryFactory->show_error() called at [/home/XXXXXXXX/public_html/includes/classes/db/mysql/query_factory.php:132]
#3 queryFactory->set_error() called at [/home/XXXXXXXX/public_html/includes/classes/db/mysql/query_factory.php:262]
#4 queryFactory->Execute() called at [/home/XXXXXXXX/public_html/includes/classes/cache.php:131]
#5 cache->sql_cache_store() called at [/home/XXXXXXXX/public_html/includes/classes/db/mysql/query_factory.php:239]
#6 queryFactory->Execute() called at [/home/XXXXXXXX/public_html/includes/init_includes/init_db_config_read.php:19]
#7 require(/home/XXXXXXXX/public_html/includes/init_includes/init_db_config_read.php) called at [/home/XXXXXXXX/public_html/includes/autoload_func.php:48]
#8 require(/home/XXXXXXXX/public_html/includes/autoload_func.php) called at [/home/XXXXXXXX/public_html/includes/application_top.php:158]
#9 require(/home/XXXXXXXX/public_html/includes/application_top.php) called at [/home/XXXXXXXX/public_html/index.php:26]

[10-Aug-2014 08:58:49 America/Los_Angeles] PHP Fatal error: 1062:Duplicate entry 'zc_cc21d2f64edffccfe06d12dd3327bf64' for key 'PRIMARY' :: insert into db_cache set cache_entry_name = 'zc_cc21d2f64edffccfe06d12dd3327bf64', I didn't post the additional 96kb of random characters associated with this logfile.

Sorry, I missed your earlier post. We must have been replying at the same time.

lat9:

What's at line 30 in /includes/modules/sideboxes/currencies_header.php?

          $hidden_get_variables .= zen_draw_hidden_field($key, $value);

RixStix:

Sorry, I missed your earlier post. We must have been replying at the same time.

      $hidden_get_variables .= zen_draw_hidden_field($key, $value);

OK, how about the lines in the file prior to line 30, too!

Sorry. Lines 28 - 32

while (list($key, $value) = each($_GET)) {
if ( ($key != 'currency') && ($key != zen_session_name()) && ($key != 'x') && ($key != 'y') ) {
$hidden_get_variables .= zen_draw_hidden_field($key, $value);
}
}

RixStix:

Sorry. Lines 28 - 32
How about a couple more lines up; does the module check to see if any $_GET variables are set?

It's such a short file, I should have realized that pasting the entire file would have been more beneficial.

<?php
/** Academe Template - currencies_header.php
 *
 * @copyright Copyright 2007 iChoze Internet Solutions http://ichoze.com
 * @copyright Portions Copyright 2003-2006 Zen Cart Development Team
 * @copyright Portions Copyright 2003 osCommerce
 * @license http://www.zen-cart.com/license/2_0.txt GNU Public License V2.0
 * @version $Id: currencies.php 2834 2006-01-11 22:16:37Z birdbrain $
 */

$cur_header_status = $db->Execute("select layout_box_name from " . TABLE_LAYOUT_BOXES . " where (layout_box_status=1 or layout_box_status_single=1) and layout_template ='" . $template_dir . "' and layout_box_name='currencies_header.php'");

  if ($cur_header_status->RecordCount() != 0) {
    $show_currencies_header= true;
  }

  if ($show_currencies_header == true) {
    if (isset($currencies) && is_object($currencies)) {

      reset($currencies->currencies);
      $currencies_array = array();
      while (list($key, $value) = each($currencies->currencies)) {
        $currencies_array[] = array('id' => $key, 'text' => $value['title']);
      }

      $hidden_get_variables = '';
      reset($_GET);
      while (list($key, $value) = each($_GET)) {
        if ( ($key != 'currency') && ($key != zen_session_name()) && ($key != 'x') && ($key != 'y') ) {
          $hidden_get_variables .= zen_draw_hidden_field($key, $value);
        }
      }

      require($template->get_template_dir('tpl_currencies_header.php',DIR_WS_TEMPLATE, $current_page_base,'sideboxes'). '/tpl_currencies_header.php');
      $title =  BOX_HEADING_CURRENCIES;
      $title_link = false;
      $text = 'Currencies:';
      require($template->get_template_dir('tpl_box_header.php',DIR_WS_TEMPLATE, $current_page_base,'common'). '/tpl_box_header.php');
    }
  }
?>

There are times, like the initial landing on your store's main page, where there are no $_GET variables. Make the following changes:

<?php
/** Academe Template - currencies_header.php
 *
 * @copyright Copyright 2007 iChoze Internet Solutions http://ichoze.com
 * @copyright Portions Copyright 2003-2006 Zen Cart Development Team
 * @copyright Portions Copyright 2003 osCommerce
 * @license http://www.zen-cart.com/license/2_0.txt GNU Public License V2.0
 * @version $Id: currencies.php 2834 2006-01-11 22:16:37Z birdbrain $
 */

$cur_header_status = $db->Execute("select layout_box_name from " . TABLE_LAYOUT_BOXES . " where (layout_box_status=1 or layout_box_status_single=1) and layout_template ='" . $template_dir . "' and layout_box_name='currencies_header.php'");

  if ($cur_header_status->RecordCount() != 0) {
    $show_currencies_header= true;
  }

  if ($show_currencies_header == true) {
    if (isset($currencies) && is_object($currencies)) {

      reset($currencies->currencies);
      $currencies_array = array();
      while (list($key, $value) = each($currencies->currencies)) {
        $currencies_array[] = array('id' => $key, 'text' => $value['title']);
      }

      $hidden_get_variables = '';
    if (is_array ($_GET)) {
      reset($_GET);
      while (list($key, $value) = each($_GET)) {
        if ( ($key != 'currency') && ($key != zen_session_name()) && ($key != 'x') && ($key != 'y') ) {
          $hidden_get_variables .= zen_draw_hidden_field($key, $value);
        }
      }
    }

      require($template->get_template_dir('tpl_currencies_header.php',DIR_WS_TEMPLATE, $current_page_base,'sideboxes'). '/tpl_currencies_header.php');
      $title =  BOX_HEADING_CURRENCIES;
      $title_link = false;
      $text = 'Currencies:';
      require($template->get_template_dir('tpl_box_header.php',DIR_WS_TEMPLATE, $current_page_base,'common'). '/tpl_box_header.php');
    }
  }
?>

TNX Lat9

change made, scan scheduled & should complete within an hour.
That's the only way I know of testing since no customer visit in the last week caused the error to be generated. The PCI scanner must be doing something special.

If RodG edit took care of 6 logfiles and this takes care of the last logfile, that will be 7 down, 3 to go.

That is something that I would never have been able to do on my own.

If this is not the proper category to bring this up, I would appreciate a pointer so that I can create the thread in the proper category.

It's probably a safe assumption that the languages_header.php in the same template needs a similar edit?