Bug Special Characters not properly escaped

[Stephen De Chellis]

I have some users that have special characters in their names and when someone tries to gift them an item in the store I get a db error because the special characters are not properly escaped for the db query.

 

[Mokonzi]

Can you post the error?

 

[Fillip H.]

And the special characters, without either of this information I have no way of looking into this.

 

[Stephen De Chellis]

Username: "skylar<3"

Error: Fatal error:
The following users were not found:
skylar&lt
3
Unable to proceed with save while $errors array is not empty in class vB_DataManager_PM in [path]/includes/class_dm.php on line 849
#0 vb_error_handler(256,
The following users were not found:
skylar&lt
3

After that is a huge series of error messages that is too large to post.

 

[Fillip H.]

I'll look into it

 

[Fillip H.]

I've been unable to confirm this issue on vBulletin 4.1.4

I went to the inventory -> clicked Gift on an item -> filled out username field -> hit OK -> no errors and the item was successfully awarded to the recipient.

Please let me know if you followed different steps to produce the error.

If not, please try disabling all other mods and see if that stops the issue from occurring.

 

[Stephen De Chellis]

This is occurring in the shop itself, not an inventory page.

When the user tries to buy something for someone else.

 

[Fillip H.]

Oh, I didn't notice you were using an old version. Unfortunately v1.2.1 is not supported, only v2.2.0 is

 

[Stephen De Chellis]

I attempted to upgrade the software this morning and got an error message during the upgrade about the cache clearing function and then my entire board went dead once I activated the plugin:

Warning: require_once([path]) [function.require-once]: failed to open stream: Success in [path]/dbtech/vbshop/includes/class_core.php on line 427

Fatal error: require_once() [function.require]: Failed opening required '/home/pokefarm/domains/pokefarm.com/public_html/forum' (include_path='.:/usr/local/lib/php') in /home/pokefarm/domains/pokefarm.com/public_html/forum/dbtech/vbshop/includes/class_core.php on line 427

 

[Fillip H.]

The "cache clearing" error is probably the cause of that. Try re-installing the product if you can't find me the error message you left out

 

[Stephen De Chellis]

Here is the error message during install. Occurs after merging templates:

Fatal error: Class 'VBSHOP_CACHE' not found in /home/pokefarm/domains/pokefarm.com/public_html/forum/dbtech/vbshop/actions/admin/repaircache.php on line 24

 

[Stephen De Chellis]

When trying to edit an item from the previous version I get this error message:

Warning: require_once([path]) [function.require-once]: failed to open stream: Success in [path]/dbtech/vbshop/includes/class_core.php on line 427

Fatal error: require_once() [function.require]: Failed opening required '/home/pokefarm/domains/pokefarm.com/public_html/forum' (include_path='.:/usr/local/lib/php') in /home/pokefarm/domains/pokefarm.com/public_html/forum/dbtech/vbshop/includes/class_core.php on line 427

 

[Stephen De Chellis]

Once I try to edit a previous item the entire forum goes dead and every page displays the previous error message. This then requires me to deactivate the plugin directly in the database. Which does not restore my board.

Instead I have to restore from a backup that I created before updating the software.

 

[Fillip H.]

Could you please write down your current item configuration and try uninstalling v1.2.x and reinstalling v2.2.0?

 

[Stephen De Chellis]

Could you please write down your current item configuration and try uninstalling v1.2.x and reinstalling v2.2.0?

That was going to be my next step.

 

[Stephen De Chellis]

I have now successfully installed the new version of the shop. I now have a new problem, my custom items no longer work.

In the past I used a php file full of db queries to do *something* when an item was purchased. How do I do this now with the inventory system and other changes made?

 

[Fillip H.]

Open /dbtech/vbshop/includes/class_items_core.php and check out the various functions there (purchase, activate, configure).

 

[Stephen De Chellis]

Previously I used:

class vBShop_Item_ingameitem extends vBShop_Item_Core

and...

    protected function pre_purchase(&$buyer, &$recipient)
...
if($this->config['title']=="in game item name")
        {
           $this->registry->db->query_write("QUERY");
        }

when an item was purchased. I do not want these items to appear in an inventory or otherwise continue to exist after the db query is executed. Is there a way to quickly do this at the point of purchase in the current code base?

 

[Fillip H.]

I guess you could call the discard function directly after its function has been carried out, though you'd need to test it out.