Rounding price custom fields problem after update to Joomla 2.5.16

[jurajvt]

I sanitized comma to HTML entity , in my quick fix above... But, it doesn't resolve the security problem, I think.

[Milbo]

So the conditions that it happens are quite clear now.

If there is a currency, which is ending at the value and not the currency sign and it is using Comma, then you get this problem. Solution is maybe to use instead of the comma, this

Code Select Expand

&#44 ;
yehe remove the space between 44 and ; , but the forum is replacing it directly

[Milbo]

I sanitized comma to HTML entity , in my quick fix above... But, it doesn't resolve the security problem, I think.

This is the right method. We could now always for all calls using JText::_ or the dropdown list use this replacement.

But I just think the solution of joomla is wrong.

[jurajvt]

I think, that it is Joomla core fast fix, which will be replaced in new version. It is first time, when some minor change break logic of framework...

If you are interesting in JS XSS vulnerability, try this test http://escape.alf.nu/

[Milbo]

Code Select Expand


if (!(strpos($string, ',') === false))
{
$test = substr($string, strpos($string, ','));
if (strtoupper($test) === $test)
{
$strs = explode(',', $string);
foreach ($strs as $i => $str)

This means look in the String for a Comma. For example we have "16x digitaal + €100,00"

if there is a comma cut the part after this comma into a new string => we get "00".

Then it is checked if "00" is equal if we create an upper case out of it "00" => "00"

If yes, then start to filter all segments. So it filters ""16x digitaal + €100" and "00". The 00 is assumingly filtered as octal.

[Margriet]

Finally seems like one of the Joomla developers has a different opinion:
http://joomlacode.org/gf/project/joomla/tracker/?action=TrackerItemEdit&tracker_id=8103&tracker_item_id=32612

[Milbo]

I updated the tracker on joomlacode http://joomlacode.org/gf/project/joomla/tracker/?action=TrackerItemEdit&tracker_id=8103&tracker_item_id=32612

[Milbo]

LOL, can anyone tell me why we need this?

http://joomlacode.org/gf/project/joomla/tracker/?action=TrackerItemEdit&tracker_item_id=31587

A feature added into a core feature having side effects. A very, very old core feature. I know, we have this also sometimes. But ... why changing this behaviour?

Instead of doing:
SOME_STRING="Hello %s, Welcome to %s. You can log in with %s (%s)"

You can now do:
SOME_STRING="Hello [[%1:name]], Welcome to [[%2:sitename]]. You can log in with [[%3:username]] ([[%4:password]])"

I am interested how it impacts speed and memory use.

[Margriet]

  You're right. I think there are more important things to develop! Makes it a little bit easier to see what's the meaning of the %s in the language strings, but if this breaks other important extensions..........................................

[Lockerbie]

To be clear and to help you search for a good solution, here are my screenshots.

Right after the update to Joomla 2.5.16:
(img1) and (img2)
The costs of the wrapping (€ 1,50) were added to the productprice, but weren't showing in the custom field dropdowns.

After the update and replacing the decimal sign from comma to point (dot):
(img3)

I don't know if it helps, but yes: I have the €-sign behind the amount. And there's also a space between the amount and the currency-sign, as was before.

[attachment cleanup by admin]

[postkat]

I have the same problem.
Virtuemart 2.0.24 and Joomla  2.5.16
I need to add eco tax for a French webshop but € 0,12 is rounded to € 0.
To be shure i tested it with € 0,90 and this is rounded to € 1
Really  looks like this problem is a bug in Virtuemart.

[jenkinhill]

postkat if you revert to J2.0.14 you will see the problem no more........

VM2.0.24a will have a "fix" for the change in Joomla code.

[Lockerbie]

@ Postkat: you can keep the update, but be sure to use a point/dot as decimal-sign in VM, instead of a comma.

@ Jenkinhill: where can we find the 2.0.24a, or when can we expect this version?

[jenkinhill]

In SVN or wait a few hours for the release.

[Lockerbie]

Thanks! I'll look into it in the morning.