Author Topic: Possible bug: Table "_virtuemart_order_histories"  (Read 395 times)

EsSa55

  • Beginner
  • *
  • Posts: 48
    • 4FootyFans & 4MovieTVmusicFans
  • Skype Name: talk2-4footyfans
  • VirtueMart Version: Live: 3.2.14
Possible bug: Table "_virtuemart_order_histories"
« on: July 30, 2018, 16:57:07 pm »
A bug or the way in which html is handled in v3.2.14

php: 5.6.36
jm:  3.8.10
vm: 3.2.14

I have re-checked and the following issue does not occur in v3.2.12

Until we updated to the latest version, comments, including html, were properly formatted:

e.g.

A comment such as:

Tracking link: <a href="https://www.royalmail.com/track-your-item?trackNumber=FR123456789GB">FR123456789GB</a>

would appear in the table Comments field as above, and visually in the backend order Comments box as

Tracking link: FR964332376GB

with the consignment number clickable.

Since updating, the same code will appear in the table Comments field as:

Tracking link: &#60;a href=&#34;https://www.royalmail.com/track-your-item?trackNumber=FR123456789GB&#34;&#62;FR123456789GB&#60;/a&#62;

and visually in the backend order Comments box as

Tracking link: <a href="https://www.royalmail.com/track-your-item?trackNumber=FR123456789GB">FR123456789GB</a>

The same applies to any html included in this field.

I hope this is an easy to resolve issue as we use the field to send tracking links to customers.

TIA

Studio 42

  • Contributing Developer
  • Sr. Member
  • *
  • Posts: 3248
  • Joomla & Virtuemart addon developper
    • Studio 42 - Virtuemart & Joomla extentions
  • VirtueMart Version: 2.6 &amp; 3.0.x.y
Re: Possible bug: Table "_virtuemart_order_histories"
« Reply #1 on: July 30, 2018, 23:09:36 pm »
I have see that the team added escaping for some fields(or all?).
I think it's why you have now this.
I hope that my own Vm extensions are not affected.

EsSa55

  • Beginner
  • *
  • Posts: 48
    • 4FootyFans & 4MovieTVmusicFans
  • Skype Name: talk2-4footyfans
  • VirtueMart Version: Live: 3.2.14
Re: Possible bug: Table "_virtuemart_order_histories"
« Reply #2 on: August 02, 2018, 08:20:52 am »
"I have see that the team added escaping for some fields(or all?)."

Which files have been changed?

Milbo

  • Virtuemart Projectleader
  • Administrator
  • Super Hero
  • *
  • Posts: 9608
  • VM3.2 Cached and Optimized
    • VM3 Extensions
  • VirtueMart Version: VirtueMart 3 on joomla 3
Re: Possible bug: Table "_virtuemart_order_histories"
« Reply #3 on: August 02, 2018, 11:26:34 am »
We could only allow it per hidden config, or an acl. From my point of view it was a vulnerability. Means it could lead to leak, the way now is safer.
I should fix your bug, please support the VirtueMart project and become a member
______________________________________
Extensions approved by the core team: http://extensions.virtuemart.net/

Studio 42

  • Contributing Developer
  • Sr. Member
  • *
  • Posts: 3248
  • Joomla & Virtuemart addon developper
    • Studio 42 - Virtuemart & Joomla extentions
  • VirtueMart Version: 2.6 &amp; 3.0.x.y
Re: Possible bug: Table "_virtuemart_order_histories"
« Reply #4 on: August 02, 2018, 13:19:14 pm »
Max only double quotes need to be escaped, not all special chars.
If you use db->quote, i think it use right escaping for all database to prevent vulnerabilities.
To prevent other vulnerabilities as injected javascript, it don't change something, because you have to revert the change you do when you need to display it in some case(eg if you edit it)
So yes double quotes need to be escaped, i already modifed it for a VM shop, because customer needed it to add double quotes in some product fields.
But i never had any problems with other special chars.

EsSa55

  • Beginner
  • *
  • Posts: 48
    • 4FootyFans & 4MovieTVmusicFans
  • Skype Name: talk2-4footyfans
  • VirtueMart Version: Live: 3.2.14
Re: Possible bug: Table "_virtuemart_order_histories"
« Reply #5 on: August 02, 2018, 15:06:45 pm »
I am interested just in the Order->Comments field, so which edits do I need to make to present html correctly?

I notice that if I paste the code directly into the table field it then displays correctly but that is not a practical solution.

TIA

GJC Web Design

  • 3rd party VirtueMart Developer
  • Super Hero
  • *
  • Posts: 7885
  • Virtuemart, Joomla & php developer
    • GJC Web Design
  • VirtueMart Version: 2.6.22 & 3.2.14
Re: Possible bug: Table "_virtuemart_order_histories"
« Reply #6 on: August 02, 2018, 15:48:41 pm »
Hi Eddie,

try surrounding the comment in the email template with

 htmlspecialchars_decode($str, ENT_COMPAT);

<?php echo vmText::sprintf('COM_VIRTUEMART_MAIL_SHOPPER_QUESTION',nl2br(htmlspecialchars_decode($this->orderDetails['details']['BT']->customer_note, ENT_COMPAT))) ?>

or maybe    ENT_QUOTES
GJC Web Design
VirtueMart and Joomla Developers - php developers http://www.gjcwebdesign.com
VM3 AusPost Shipping Plugin - e-go Shipping Plugin - VM3 Postcode Shipping Plugin - Radius Shipping Plugin - VM3 NZ Post Shipping Plugin - AusPost Estimator
Samport Payment Plugin - EcomMerchant Payment Plugin - ccBill payment Plugin
VM2 Product Lock Extension - VM2 Preconfig Adresses Extension - TaxCloud USA Taxes Plugin - Virtuemart  Product Review Component
http://extensions.joomla.org/profile/profile/details/67210
Contact for any VirtueMart or Joomla development & customisation

EsSa55

  • Beginner
  • *
  • Posts: 48
    • 4FootyFans & 4MovieTVmusicFans
  • Skype Name: talk2-4footyfans
  • VirtueMart Version: Live: 3.2.14
Re: Possible bug: Table "_virtuemart_order_histories"
« Reply #7 on: August 02, 2018, 16:52:14 pm »
Hello John

Thanks for the reply.

The issue is actually in the backend Order Status/Comments field.

See attached screenshots.

The 'correct' one is VM 3.2.12; the 'incorrect' one is 3.2.14.

Best

Eddie

Jörgen

  • Global Moderator
  • Full Member
  • *
  • Posts: 1608
    • Kreativ Fotografi
  • VirtueMart Version: 3.2.12
Re: Possible bug: Table "_virtuemart_order_histories"
« Reply #8 on: August 02, 2018, 16:57:50 pm »
This view is possible to override, administrator/templates/isis/html/com_virtuemart/orders

regards

Jörgen @ Kreativ Fotografi.se
Joomla 3.8.3
Virtuemart 3.2.12
Olympiantheme Hera (customized)

EsSa55

  • Beginner
  • *
  • Posts: 48
    • 4FootyFans & 4MovieTVmusicFans
  • Skype Name: talk2-4footyfans
  • VirtueMart Version: Live: 3.2.14
Re: Possible bug: Table "_virtuemart_order_histories"
« Reply #9 on: August 02, 2018, 17:11:07 pm »
Thank You, Jörgen.

However, there is currently no such folder as:

"administrator/templates/isis/html/com_virtuemart/orders"

Or, should I copy over the same folder from another location?

Best

Eddie




GJC Web Design

  • 3rd party VirtueMart Developer
  • Super Hero
  • *
  • Posts: 7885
  • Virtuemart, Joomla & php developer
    • GJC Web Design
  • VirtueMart Version: 2.6.22 & 3.2.14
Re: Possible bug: Table "_virtuemart_order_histories"
« Reply #10 on: August 02, 2018, 17:38:50 pm »
yep .. copy from
administrator\components\com_virtuemart\views\orders\tmpl\order_item.php

to

administrator/templates/isis/html/com_virtuemart/orders/order_item.php
GJC Web Design
VirtueMart and Joomla Developers - php developers http://www.gjcwebdesign.com
VM3 AusPost Shipping Plugin - e-go Shipping Plugin - VM3 Postcode Shipping Plugin - Radius Shipping Plugin - VM3 NZ Post Shipping Plugin - AusPost Estimator
Samport Payment Plugin - EcomMerchant Payment Plugin - ccBill payment Plugin
VM2 Product Lock Extension - VM2 Preconfig Adresses Extension - TaxCloud USA Taxes Plugin - Virtuemart  Product Review Component
http://extensions.joomla.org/profile/profile/details/67210
Contact for any VirtueMart or Joomla development & customisation

EsSa55

  • Beginner
  • *
  • Posts: 48
    • 4FootyFans & 4MovieTVmusicFans
  • Skype Name: talk2-4footyfans
  • VirtueMart Version: Live: 3.2.14
Re: Possible bug: Table "_virtuemart_order_histories"
« Reply #11 on: August 02, 2018, 17:44:21 pm »
Phew!

Thanks John and Everyone Else.....

Best

Eddie

EsSa55

  • Beginner
  • *
  • Posts: 48
    • 4FootyFans & 4MovieTVmusicFans
  • Skype Name: talk2-4footyfans
  • VirtueMart Version: Live: 3.2.14
Re: Possible bug: Table "_virtuemart_order_histories"
« Reply #12 on: August 02, 2018, 17:58:39 pm »
Except and unfortunately, that makes no difference to the resulting format.

GJC Web Design

  • 3rd party VirtueMart Developer
  • Super Hero
  • *
  • Posts: 7885
  • Virtuemart, Joomla & php developer
    • GJC Web Design
  • VirtueMart Version: 2.6.22 & 3.2.14
Re: Possible bug: Table "_virtuemart_order_histories"
« Reply #13 on: August 02, 2018, 19:35:16 pm »
hmmmm...

really don't think it matters how it displays in the admin

more the problem is the client email is not rendered as a link

if u change in

templates\gjc_j3_v5\html\com_virtuemart\invoice\mail_html_shopper.php

to

echo vmText::sprintf('COM_VIRTUEMART_MAIL_SHOPPER_QUESTION',nl2br(htmlspecialchars_decode($this->orderDetails['history'][$nb-1]->comments, ENT_COMPAT)));

I get a proper link in the email






GJC Web Design
VirtueMart and Joomla Developers - php developers http://www.gjcwebdesign.com
VM3 AusPost Shipping Plugin - e-go Shipping Plugin - VM3 Postcode Shipping Plugin - Radius Shipping Plugin - VM3 NZ Post Shipping Plugin - AusPost Estimator
Samport Payment Plugin - EcomMerchant Payment Plugin - ccBill payment Plugin
VM2 Product Lock Extension - VM2 Preconfig Adresses Extension - TaxCloud USA Taxes Plugin - Virtuemart  Product Review Component
http://extensions.joomla.org/profile/profile/details/67210
Contact for any VirtueMart or Joomla development & customisation

EsSa55

  • Beginner
  • *
  • Posts: 48
    • 4FootyFans & 4MovieTVmusicFans
  • Skype Name: talk2-4footyfans
  • VirtueMart Version: Live: 3.2.14
Re: Possible bug: Table "_virtuemart_order_histories"
« Reply #14 on: August 02, 2018, 20:01:20 pm »
Ah! being a lay-person, at best, it is difficult not to react to visual differences.

This is what I have in my template file: "mail_html_shopper.php":

<?php echo vmText::sprintf('COM_VIRTUEMART_MAIL_SHOPPER_QUESTION',nl2br($this->orderDetails['details']['BT']->customer_note)) ?>

Ok to replace from 'echo' to '))' with your command?

Best

Eddie