Bug in editproduct.php

[mawby]

Hi, new here so forgive me if I'm being stupid but I think there's a bug in editproduct.php. I only downloaded the software yesterday so I should have the lastest copy. Anyway, this file handles the editing, sale, relisting and various other product editing functions. However, towards the top is the following...

Content visible to verified customers only.

...which is used to ensure that the product belongs to the user and that the product number is valid. However, this only works if the user is editing the product. If they want to mark it has sold, or to relist it, then the parameters used to pass the product ID to this are called are called $sold and $resell respectively. This means that $phoedit will always be zero for these actions, and this causes both the $User['nopost'] and $ueditpho == 0 to be true and therefore the user is prevented from using these options unless they have admin rights. Furthermore, after the error message the user is taken to a blank screen because it then tries to re-direct them back to looking at the product they were on, except zero is passed so that then fails.

I have fixed this bug on my system by removing the code above and inserting it in three different places, once within the "if ( isset($sold) ) {" clause with $phoedit replaced with $sold, then within the "if ( isset($resell) ) {" clause with $phoedit replaced with $resell, and finally within the ELSE block of "if ( $edit != "yes" ) {" with no substitutions.

[Chuck S]

I think your logic is a bit garbled above here when I read it on this issue here. It says if $User['nopost'] is 1 OR $editpho is 0

Your stating they come back both 0 and yes thats perfectly fine as it will only show for users where nopost is 1 or the photo is 0 and they are not admin

Thus if nopost is 0 then the above can not be triggered EVER if $ueditpho is empty

Basically in your integration file $User['nopost'] is always set to 1 then on login a user is set accordingly to 0

if ( $checkpass == 1 ) {
$gologin = 0;
$User['nopost'] = 0;
$User['userid'] = $userid;

So given this I would ensure your cookie settings are right and people are actually cookied/logged in as I do not see any issue here with that line.

[mawby]

Sorry, the $User['nopost'] I mentioned above was, I beleive, a red herring. If you ignore that part the rest of what I've said should make more sense. The editproduct.php file is called with the following 3 URLs depending of whether you are editing, marking as sold, or relisting a product...

http://www.mkivsupra.net/pp-classifi...php?phoedit=18
http://www.mkivsupra.net/pp-classifi...ct.php?sold=18
http://www.mkivsupra.net/pp-classifi....php?resell=18

$ueditpho is then set using intval($phoedit) regardless of which parameter is actually being used to pass in the product ID. So for editing it worked, but the SOLD IT! and RELIST IT! options didn't work. To further prove this was the problem, the URL that the user was then redirected to after the error message was...

http://www.mkivsupra.net/pp-classifi....php?product=0

...which just displays a blank page because the product is zero. It was actually this that pointed me in the direction of where the problem may lie.

I can revert this file back if you would like to see for yourself?

[Chuck S]

Hello sold and resell work fine and nothing needs to be recoded that I see. Your overlooking this whole big block of code in editproduct.php which handles those tasks.

Content visible to verified customers only.

Notice the queries are fine

$query = "SELECT userid,price,isauction FROM {$Globals['pp_db_prefix']}products WHERE id=$sold LIMIT 1";

$query = "SELECT userid,price,duration,isauction FROM {$Globals['pp_db_prefix']}products WHERE id=$resell LIMIT 1";

[Chuck S]

I dont know what this url is suppose to prove

http://www.mkivsupra.net/pp-classifi....php?product=0

If you click sold it or relist it will give you urls like this

http://www.mkivsupra.net/pp-classifi....php?resell=25

http://www.mkivsupra.net/pp-classifi...ct.php?sold=25

I suggest you replace any files you have tried editing with the base distribution

[mawby]

Originally Posted by omegatron

I dont know what this url is suppose to prove

http://www.mkivsupra.net/pp-classifi....php?product=0

If you click sold it or relist it will give you urls like this

http://www.mkivsupra.net/pp-classifi....php?resell=25

http://www.mkivsupra.net/pp-classifi...ct.php?sold=25

I suggest you replace any files you have tried editing with the base distribution

I've not missed that code you've quoted, the problem is it never gets reached because of the code quoted in my first post that appears above everything else.

The product=0 URL shows that the code in the first quote is failing because $phoedit = 0 because unless you are editing the product it's not $phoedit that gets set it's $sold and $resell.

Tell you what, I'll put a fresh copy of the files on our server and give you user and admin logins (via PM) and you can see for yourself what I mean.

[mawby]

For reference to others, this bug is now being discussed in this thread.