Forums / Reports of Security Problems / HTML can be inputted in to order comment and is active code within admin.

HTML can be inputted in to order comment and is active code within admin.

Views: 55

Results 1 to 7 of 7
2 Feb 2024, 2:22 AM
#1
oj_simon avatar

oj_simon

Zen Follower

Join Date:
Nov 2023
Location:
Hounslow
Posts:
129
Plugin Contributions:
0

HTML can be inputted in to order comment and is active code within admin.

[Note: remember to include site URL, ZC version, list of plugins, PHP version, etc ... read the Posting Tips shown above for information to include in your post here.
And, remove this comment before actually posting!]

HTML can be inputted in to order comment and is active html code within admin -> Customers -> Orders
order list when you select a order and the option right hand panel shows.
it is just text in all other places.

2 Feb 2024, 3:45 PM
#2
wilt avatar

wilt

Oji-san

Join Date:
Jun 2003
Location:
Newcastle UK
Posts:
1,927
Plugin Contributions:
3

Re: HTML can be inputted in to order comment and is active code within admin.

Thanks for the report.

Can you confirm the Zen Cart version and whether this is a clean install.

4 Feb 2024, 6:42 AM
#3
oj_simon avatar

oj_simon

Zen Follower

Join Date:
Nov 2023
Location:
Hounslow
Posts:
129
Plugin Contributions:
0

Re: HTML can be inputted in to order comment and is active code within admin.

ZC V1.5.8b and it was on a fresh install but since I'v installed some add-on's

4 Feb 2024, 11:32 AM
#4
swguy avatar

swguy

Administrator

Join Date:
Feb 2006
Location:
Tampa Bay, Florida
Posts:
10,729
Plugin Contributions:
56

Re: HTML can be inputted in to order comment and is active code within admin.

HTML is permitted for order status history updates done through the admin. It is not output for the initial order status history entry, which comes from the comments box on the checkout screens.

That Software Guy. My Store: Zen Cart Support
Available for hire - See my ad in Services
Plugin Moderator, Documentation Curator, Chief Cook and Bottle-Washer.
Do you benefit from Zen Cart? Then please support the project.

6 Feb 2024, 1:13 AM
#5
oj_simon avatar

oj_simon

Zen Follower

Join Date:
Nov 2023
Location:
Hounslow
Posts:
129
Plugin Contributions:
0

Re: HTML can be inputted in to order comment and is active code within admin.

if you go to your test site and go to the front end and place an order and add a html link tag within html code in to the order comment box then complete the order.
Then go to the admin and view the list of orders and select (not edit) where it displays the comments the html link will be live and not displayed only as readonly as it should be (because live code can be anything given how good codes are now days).
then go into the order edit and you will see it is displayed as read only the current way.

6 Feb 2024, 2:48 AM
#6
lat9 avatar

lat9

Administrator

Join Date:
Sep 2009
Location:
Stuart, FL
Posts:
14,119
Plugin Contributions:
56

Re: HTML can be inputted in to order comment and is active code within admin.

FWIW, I'm not seeing that behavior on the current zc200-alpha. The comments in that side-pane are properly sanitized.

6 Feb 2024, 10:55 AM
#7
swguy avatar

swguy

Administrator

Join Date:
Feb 2006
Location:
Tampa Bay, Florida
Posts:
10,729
Plugin Contributions:
56

Re: HTML can be inputted in to order comment and is active code within admin.

Testing 1.5.8a also looks good. The comments are in the sidebox when a particular order is selected but are displayed read-only.

Would you please check your admin/orders.php to see if it has been modified?

That Software Guy. My Store: Zen Cart Support
Available for hire - See my ad in Services
Plugin Moderator, Documentation Curator, Chief Cook and Bottle-Washer.
Do you benefit from Zen Cart? Then please support the project.