lat9:
So, I performed the upgrade from 1.14.3 to 1.15.3 ... including the core-file updates this time. My comments:
-
- The upgrade did not preserve my original settings. Luckily, I installed first on a local copy so that I could see what the settings were on the live site.
- Clicking through on the order_status page link in a customer email didn't go to the order's history. A couple of updates were needed to /includes/modules/pages/order_status/header_php.php:```
<?php
/**
*
* @package page
* @copyright Copyright 2003-2005 Zen Cart Development Team
* @copyright Portions Copyright 2003 osCommerce
* @license http://www.zen-cart.com/license/2_0.txt GNU Public License V2.0
* @version $Id: J_Schilz for Integrated COWOA - 14 April 2007
*/
// This should be first line of the script:
$zco_notifier->notify('NOTIFY_HEADER_START_ACCOUNT_HISTORY_INFO');
if (!isset($_REQUEST['order_id']) || (isset($_REQUEST['order_id']) && !is_numeric($_REQUEST['order_id'])))
$errorInvalidID=TRUE;
$query_email_address = trim($_REQUEST['query_email_address']);
if(!isset($query_email_address) || zen_validate_email($query_email_address) == false)
$errorInvalidEmail=TRUE;
if(!$errorInvalidID && !$errorInvalidEmail)
{
$customer_info_query = "SELECT customers_email_address, delivery_name, delivery_company, delivery_street_address, delivery_suburb, delivery_city, delivery_postcode, delivery_state, delivery_country,
billing_name, billing_company, billing_street_address, billing_suburb, billing_city, billing_postcode, billing_state, billing_country
FROM " . TABLE_ORDERS . "
WHERE orders_id = :ordersID";
$customer_info_query = $db->bindVars($customer_info_query, ':ordersID',
$_REQUEST['order_id'], 'integer'); //-20140929-lat9-Changed from $_POST to $_REQUEST
$customer_info = $db->Execute($customer_info_query);
if (isset($query_email_address) && $customer_info->fields['customers_email_address'] != $query_email_address && $customer_info->fields['customers_email_address'] != $query_email_address . '.')
$errorNoMatch=TRUE;
else
{
$statuses_query = "SELECT os.orders_status_name, osh.date_added, osh.comments
FROM " . TABLE_ORDERS_STATUS . " os, " . TABLE_ORDERS_STATUS_HISTORY . " osh
WHERE osh.orders_id = :ordersID
AND osh.orders_status_id = os.orders_status_id
AND os.language_id = :languagesID
AND osh.customer_notified >= 0
ORDER BY osh.date_added";
$statuses_query = $db->bindVars($statuses_query, ':ordersID', $_POST['order_id'], 'integer');
$statuses_query = $db->bindVars($statuses_query, ':languagesID', $_SESSION['languages_id'], 'integer');
$statuses = $db->Execute($statuses_query);
while (!$statuses->EOF) {
$statusArray[] = array('date_added'=>$statuses->fields['date_added'],
'orders_status_name'=>$statuses->fields['orders_status_name'],
'comments'=>$statuses->fields['comments']);
$statuses->MoveNext();
}
require(DIR_WS_CLASSES . 'order.php');
$order = new order(
$_REQUEST['order_id']); //-20140929-lat9-Changed from $_POST to $_REQUEST
}
}
require(DIR_WS_MODULES . zen_get_module_directory('require_languages.php'));
$breadcrumb->add(NAVBAR_TITLE_1, zen_href_link(FILENAME_ACCOUNT, '', 'SSL'));
// This should be last line of the script:
$zco_notifier->notify('NOTIFY_HEADER_END_ACCOUNT_HISTORY_INFO');
?>
>
Thanks lat9 for debugging and resolving this issue. In your quoted text I see one other case that also needed to be updated on line 44. We will include this in the next release.
