lat9 / encrypted_master_password

Zen Cart: Encrypted Master Password
GNU General Public License v2.0
1 stars 1 forks source link

php warning undefined index admin_pass #26

Closed torvista closed 5 years ago

torvista commented 5 years ago

php 7.3.7 Using Report All Errors Login as customer with normal login: add something to cart. Logout. Login as EMP, it goes directly to the cart, get debug error:

.....\public_html\tienda-156\includes\classes\observers\class.emp_order_observer.php on line 93

Trying to login with an incorrect password also causes a debug.

lat9 commented 5 years ago

Could you post the full contents of that log?

torvista commented 5 years ago

[22-Jul-2019 19:32:20 Europe/Madrid] PHP Notice: Undefined index: admin_pass in D:\Documents\Dropbox\Dev\public_html\tienda-156\includes\classes\observers\class.emp_order_observer.php on line 93

lat9 commented 5 years ago

I don't see how that's possible (nor can I recreate the issue). Starting at line 87 (and ending with 93):

                    $check = $db->Execute(
                        "SELECT admin_id, admin_pass 
                           FROM " . TABLE_ADMIN . " 
                          WHERE admin_id = " . (int)EMP_LOGIN_ADMIN_ID . "
                          LIMIT 1"
                    );
                    if (!$check->EOF && (zen_validate_password($p2, $check->fields['admin_pass'])) || zen_validate_password($pwd2, $check->fields['admin_pass'])) {

If the query was successful (the first clause), then the admin_pass field was pulled from the database and is available for use. I'm obviously missing something, but I can't explain what you're seeing.

torvista commented 5 years ago

It's generated when the password is incorrect: if (!$check->EOF && (zen_validate_password($p2, $check->fields['admin_pass'])) || zen_validate_password($pwd2, $check->fields['admin_pass'])) and so the OR latter part of the clause gets parsed.

lat9 commented 5 years ago

The problem was a misplaced right-parentheses; I've got to get my glasses cleaned.

lat9 commented 5 years ago

@torvista, since you opened this issue it's yours to close if you feel that it's been corrected.