Can't See Shopping Cart! (BIG PROBLEM)

[kyleprohaska]

Hello,

 

I'm having a problem with a website that uses osCommerce 2.2. For whatever reason a day ago this problem started happening. If you add ANY film to our shopping cart your taking to a blank page that says "What's in your cart?" You can't even click the cart button upper right and see your cart...so you can't see what's in your cart or remove it.

 

http://www.christianmovies.com

 

Try it for yourself. We are losing money everyday...please if anyone knows what might be the issue please tell me.

[germ]

Hello,

 

I'm having a problem with a website that uses osCommerce 2.2. For whatever reason a day ago this problem started happening. If you add ANY film to our shopping cart your taking to a blank page that says "What's in your cart?" You can't even click the cart button upper right and see your cart...so you can't see what's in your cart or remove it.

 

http://www.christianmovies.com

 

Try it for yourself. We are losing money everyday...please if anyone knows what might be the issue please tell me.

At the top of /includes/application_top.php change:

 

// set the level of error reporting
 error_reporting(E_ALL & ~E_NOTICE);

to

 

// set the level of error reporting
//  error_reporting(E_ALL & ~E_NOTICE);
 error_reporting(E_ALL | E_STRICT);

To see if you can get the server to spit out an error.

 

You're shooting in the dark without an error message to chase the problem down.

 

BACKUP THE FILE BEFOR MAKING ANY EDITS.

[kyleprohaska]

K changed, where do I look to see any errors? Should they show up on the page or in the admin center? As far as I can tell after playing with the catalog, the site displays no errors visibly.

[kyleprohaska]

K changed, where do I look to see any errors? Should they show up on the page or in the admin center? As far as I can tell after playing with the catalog, the site displays no errors visibly.

 

Nvm, realized I should be looking on the hosting control panel...I'll chime back in later.

[germ]

K changed, where do I look to see any errors? Should they show up on the page or in the admin center? As far as I can tell after playing with the catalog, the site displays no errors visibly.

Well that bites...

:huh:

 

Look at the posts in this thread by steve_s about how to get the site to make an error log file.

 

It was written for admin problems but you can do the same thing on the catalog side and it will work (seen it done)

[kyleprohaska]

Well...I found the error log. It's massive. This is a friends site, and has been around for YEARS...thousands of users and such so it was bound to have a lot of problems but phew, this is insane.

 

I see a common error given for application_top on line 74...

 

// set the application parameters

$configuration_query = tep_db_query('select configuration_key as cfgKey, configuration_value as cfgValue from ' . TABLE_CONFIGURATION);

while ($configuration = tep_db_fetch_array($configuration_query)) {

define($configuration['cfgKey'], $configuration['cfgValue']);

}

 

Something wrong there somewhere?

 

Idk, what's odd is nobody has touched these files since the error started. What could cause a sudden error like that?

[kyleprohaska]

I FIXED IT!

 

However...a file had been changed and I replaced it with a backup. HOWEVER, the normal web guy changed the file by adding this:

 

<? /**/eval(base64_decode('randomnumbersandsuchhere')); ?>

 

What is that? Whatever it is it's what caused everything to break...

 

Also it was added to the very top of the page, was he right and adding it but just put it in the wrong place or what?

[BryceJr]

I FIXED IT!

Good for you.

 

Unfortunately, somebody broke it.

However...a file had been changed and I replaced it with a backup. HOWEVER, the normal web guy changed the file by adding this:

 

<? /**/eval(base64_decode('randomnumbersandsuchhere')); ?>

 

You've been hacked. If I were you, I'll take that not so normal web guy to the cops for adding malicious code to hack your store.

 

Follow the links in these topics in securing your site.

 

This ->here and this ->one

 

Don't ever trust "the normal web guy".