Forums / Reports of Security Problems / cron job on admin application that logs events

cron job on admin application that logs events

Views: 43

Results 1 to 1 of 1
28 Oct 2019, 6:53 PM
#1
mc12345678 avatar

mc12345678

Totally Zenned

Join Date:
Jul 2012
Posts:
16,908
Plugin Contributions:
2

cron job on admin application that logs events

Pointed out in the logs associated with running a cron job file that has been added to EasyPopulate v4, when an import operation is performed, the variable $_SESSION['securityToken'] is not set. In php 7.xish, this causes messages to be generated. Line 158 of admin/includes/classes/class.admin.zcObserverLogEventListener.php tries to not log information that should remain excluded from logs. In that attempt, the variable is referenced, but not evaluated to prevent the issues logged.

I was considering to prepare a PR to split addressing the session variables as a second line prefacing with a test to see if the session variable is set and then to perform the same action as the previous line. Seeing though how securityToken had been otherwise split up, it seemed like this change should be more covert. I.e. Without the explanation of how to repeat and what happens when the session variable is missing.

If this is a non-issue, then I'll proceed, but I thought I would "ask" first.

The post where this can somewhat be seen is:
https://www.zen-cart.com/showthread.php?190417-EasyPopulate-4-0-Support-Thread&p=1362976#post1362976

ZC Installation/Maintenance Support <- Site
Contribution for contributions welcome...