svekweb.co.uk

December 22, 2006

Security loophole fixed in oscommerce shop

Filed under: — kevin_svek @ 8:56 am

Thanks to one of their customers, plugged a problem in license to frill shop where if someone passed in a lower / mixed case version of the currency to any items, the item would show prices as zero.
Fixed by modifying the database to make the column lookup up in the database binary instead of character so invalid case is not found and defaults to the default currency.
Details of the bug are in the oscommerce forum and there are two alternative fixes – one via the database and the other by forcing the currency to always be in upper case. This isn’t actually a new bug, just that it doesn’t always fire first time so it’s probably better just to fix it in the database after installing oscommerce.
To summarise – to fix it in the database

alter table currencies modify code char(3) binary not null default ”;

December 6, 2006

Pays to keep a close eye on your sites….

Filed under: — kevin_svek @ 7:22 pm

Unfortunately the SSL certificate ran out on one of my customers sites a couple of weeks ago – they ignored the SSL expired message though and never got round to telling me about it – all back up and running now. But shows you need to keep on top of things. Site is License to Frill Lingerie

Powered by WordPress