Bug in OSC stores - Can checkout by paying 0

[211655]

Now i know there may be a way you can turn off multiple currency checkouts but if you add this / append this to the URL on ur site

 

&currency=eur

 

such as www.urstore.com/product_info.php?products_id=232&currency=eur

 

or

 

such as www.urstore.com/product_info.php?currency=eur&products_id=232

 

 

etc....

 

 

The price will become 0

 

you can now chekcout anything you want for 0.

 

Damm mee.....

[211655]

Actually i just checked a lot of stores. Yes it is a bug in all stores. I ran test on about 20 stores and yes you can checkout for zero price.

[211655]

ok, problem comes up when u use the currecny=xxx

in smal caps. so use usd instead of USD etc....

[burt]

It doesn't do it in mine. I'll PM you my URL in case I am not doing exactly what you are doing...

[mark27uk3]

It does it in mine too, I dont think this will cause many problems for me, although a fix would be nice!

 

Mark

[211655]

verdict: yes it does in some stores and doesnt in some....

i have checked stores of some ppl that i know have osc stores and i wont disclose ny of them here but if ny mods want to get the list, plz pm me.

[211655]

Thanks to Burt:P

 

Open includes/Application_top.php

 

 

find

 

//currency

if (!tep_session_is_registered('currency') || isset($HTTP_GET_VARS['currency']) || ( (USE_DEFAULT_LANGUAGE_CURRENCY == 'true') && (LANGUAGE_CURRENCY != $currency) ) ) {
   if (!tep_session_is_registered('currency')) tep_session_register('currency');

 

add following code above //currency

if (isset($HTTP_GET_VARS['currency'])) {
      $HTTP_GET_VARS['currency'] = strtoupper($HTTP_GET_VARS['currency']);
}

[Guest]

I'm a little late it seems :)

 

or (alternative to the above, maybe it helps to find the cause):

 

change (inlcudes/funtions/general.php)

////
// Checks to see if the currency code exists as a currency
// TABLES: currencies
 function tep_currency_exists($code) {
   $code = tep_db_prepare_input($code);
   $currency_code = tep_db_query("select currencies_id from " . TABLE_CURRENCIES . " where code = '" . tep_db_input($code) . "'");
   if (tep_db_num_rows($currency_code)) {   
     return $code;
   } else {
     return false;
   }
 }

to

////
// Checks to see if the currency code exists as a currency
// TABLES: currencies
 function tep_currency_exists($code) {
   $code = tep_db_prepare_input($code);
   $currency_code = tep_db_query("select currencies_id from " . TABLE_CURRENCIES . " where code = '" . tep_db_input($code) . "'");
   if (tep_db_num_rows($currency_code)) {   
     return strtoupper($code);
   } else {
     return false;
   }
 }

it's allmost the same fix (as posted 1 post above): "return strtoupper($code);"

 

Don't understand why the lowercase is accepted as valid currency though, some how the db query seems case insensitive :huh:

[radders]

Very good spot Dan,

 

It would have affected mine too if I hadn't disabled multicurrency checkout.

Have you filed a bug report?

[Guest]

Hi David,

It would have affected mine too if I hadn't disabled multicurrency checkout.

<{POST_SNAPBACK}>

Could you please explain how multicurrency checkout can be disabled?

[boxtel]

Hi David,

 

Could you please explain how multicurrency checkout can be disabled?

<{POST_SNAPBACK}>

 

 

by only having 1 currency.

[Guest]

by only having 1 currency.

<{POST_SNAPBACK}>

I do have only one currency, and the bug was there (until I added strtoupper($code) ). On the other hand David's shop accepts multiple currencies but does not have this bug (or was the shop I saw already fixed? www.taichifinder.co.uk/catalog/ ).

:huh:

[boxtel]

I do have only one currency, and the bug was there (until I added strtoupper($code) ). On the other hand David's shop accepts multiple currencies but does not have this bug (or was the shop I saw already fixed? www.taichifinder.co.uk/catalog/ ).

:huh:

<{POST_SNAPBACK}>

 

 

I have multi currency and I had the same bug.

[Guest]

I still don't understand what david ment with "disabled multicurrency checkout", having only one currency does not help :(

 

 

I do understand the cause of the bug now though :)

 

MySQL searches appear to be case insensitive by default, and so the currency check (in tep_currency_exists) does not check the case, and so it returns the $code weather it's the same case or not.

 

So it seems that, to do it right, the actual value should be checked (case sensitive) using PHP, or the the currency code column fields should be declared BINARY in the database. (or the currency could be made case insensitive for the calculations too of course)

[211655]

I will file the bug report but if someone is already doing or has done let me know so i wont do it then.

 

thanks to burt & paul for the code. I am using only USD and not even showing the currency options but as i was playing with it, it turned out to be wierd. so hopefully ppl should be able to fix it.

 

I am guessing that a lot of people would have this issue ...

[wheeloftime]

I will file the bug report but if someone is already doing or has done let me know so i wont do it then.

 

thanks to burt & paul for the code. I am using only USD and not even showing the currency options but as i was playing with it, it turned out to be wierd. so hopefully ppl should be able to fix it.

 

I am guessing that a lot of people would have this issue ...

<{POST_SNAPBACK}>

 

Can you explain a bit more how to test for this ? Do I understand correctly you have to add '&currency=eur' to the URL while in your product_info page and than press add to cart ? If I do that the product just gets added to the cart with the normal price and I do have multiple currencies.

 

Thanks

[burt]

Howard - I am sorry, I just made a test order in your wheeloftime shop. "Test Testy". Check the price of the order...

 

Again, apologies for this - but at least now you know your Store has this problem!

[♥akmac]

Thanks to Burt:P

 

Open includes/Application_top.php

find

 

//currency

if (!tep_session_is_registered('currency') || isset($HTTP_GET_VARS['currency']) || ( (USE_DEFAULT_LANGUAGE_CURRENCY == 'true') && (LANGUAGE_CURRENCY != $currency) ) ) {
? ?if (!tep_session_is_registered('currency')) tep_session_register('currency');

 

add following code above //currency

if (isset($HTTP_GET_VARS['currency'])) {
? ? ? $HTTP_GET_VARS['currency'] = strtoupper($HTTP_GET_VARS['currency']);
}

<{POST_SNAPBACK}>

 

When I did this I got the Unexpected T string error. Any Idea why? I just pasted it above the //currency as specified...

[wheeloftime]

Howard - I am sorry, I just made a test order in your wheeloftime shop.  "Test Testy".  Check the price of the order...

 

Again, apologies for this - but at least now you know your Store has this problem!

<{POST_SNAPBACK}>

 

Damn, damn, I thought this was my day :D :D

 

Burt, no problem ! I am glad you checked and so I see my shop does also suffer from this bug. But I still don't understand how to do it so any more specific direction of how to achieve this would be welcomed so I can try it myself also before applying one of the solutions.

[Guest]

Howard just append ?currency=eur or &currency=eur to the url and hit ENTER, all the prices will change to 0, and the worst is the customer wil be able to check out and have it all for free!

 

(it does not seem to happen under all circumstances, but after a few tries it should)

 

like: www.yourstore.index.php?currency=eur

 

or: www.yourstore.index.php?wahtever=blabla&currency=eur

 

(eur may be any available currency, but using lowercase i.s.o. uppercase)

[211655]

Damn, damn, I thought this was my day  :D  :D

 

Burt, no problem ! I am glad you checked and so I see my shop does also suffer from this bug. But I still don't understand how to do it so any more specific direction of how to achieve this would be welcomed so I can try it myself also before applying one of the solutions.

<{POST_SNAPBACK}>

 

 

 

go to your website:

 

www.your site.com/index.php

 

after index.php append this

 

?currecny = eur

 

so it will be like www.site.com/index.php?currecny = eur

 

 

see then

[211655]

When I did this I got the Unexpected T string error. Any Idea why?  I just pasted it above the //currency  as specified...

<{POST_SNAPBACK}>

 

 

u sure that u didnt replace it. i just said to add it not replace.

 

make sure that u ahve the file as i told, open it and then look for

//currency

followed by rest of the info.

 

when u have found it, do what i have said, add the new line of code right after // currency

 

 

else try what another person has suggested. post ur url if u can

[wheeloftime]

go to your website:

 

www.your site.com/index.php

 

after index.php append this

 

?currecny = eur

 

so it will be like www.site.com/index.php?currecny = eur

see then

<{POST_SNAPBACK}>

 

Thanks Dan, Paul ! Now I see the prices getting zero after hitting a few times Enter (one time wasn't enough as I tried before).

Going to apply the fix now...

[♥akmac]

add following code above //currency

add the new line of code right after // currency

 

I tried pasting it below and above, and get the error: Parse error: parse error, unexpected T_STRING in includes/application_top.php on line 315

 

this line reads:

 

$HTTP_GET_VARS['currency'] = strtoupper($HTTP_GET_VARS['currency']);

[radders]

Yes my shop was fixed earlier but also I have this extra line in my checkout_process.php and a couple of other files around the checkout:

 

after the line

 

include('includes/application_top.php');

 

  $currency = DEFAULT_CURRENCY;

So really it is a single currency store that allows you to browse in other currencies but only check out in GBP.