[TEP-COMMIT] CVS: catalog/catalog/includes/functions general.php,1.234,1.235

Update of /pack/cvsroots/oscommerce/catalog/catalog/includes/functions
In directory sunsite.dk:/tmp/cvs-serv14030/functions

Modified Files:
	general.php 
Log Message:
fix bug 1617 by checking that the product and attribute IDs are numerical,
and that the product exists in the database


Index: general.php
===================================================================
RCS file: /pack/cvsroots/oscommerce/catalog/catalog/includes/functions/general.php,v
retrieving revision 1.234
retrieving revision 1.235
diff -u -d -r1.234 -r1.235
--- general.php	2003/12/28 22:29:55	1.234
+++ general.php	2004/02/16 00:54:56	1.235
@@ -876,24 +876,52 @@
     if (is_numeric($prid)) {
       $uprid = $prid;
 
-      if (is_array($params)) {
+      if (is_array($params) && (sizeof($params) > 0)) {
+        $attributes_check = true;
+        $attributes_ids = '';
+
         reset($params);
         while (list($option, $value) = each($params)) {
-          $uprid .= '{' . (int)$option . '}' . (int)$value;
+          if (is_numeric($option) && is_numeric($value)) {
+            $attributes_ids .= '{' . (int)$option . '}' . (int)$value;
+          } else {
+            $attributes_check = false;
+            break;
+          }
         }
+
+        if ($attributes_check == true) {
+          $uprid .= $attributes_ids;
+        }
       }
     } else {
       $uprid = tep_get_prid($prid);
 
-      if (strpos($prid, '{') !== false) {
+      if (is_numeric($uprid)) {
+        if (strpos($prid, '{') !== false) {
+          $attributes_check = true;
+          $attributes_ids = '';
+
 // strpos()+1 to remove up to and including the first { which would create an empty array element in explode()
-        $attributes = explode('{', substr($prid, strpos($prid, '{')+1));
+          $attributes = explode('{', substr($prid, strpos($prid, '{')+1));
 
-        for ($i=0, $n=sizeof($attributes); $i<$n; $i++) {
-          $pair = explode('}', $attributes[$i]);
+          for ($i=0, $n=sizeof($attributes); $i<$n; $i++) {
+            $pair = explode('}', $attributes[$i]);
 
-          $uprid .= '{' . (int)$pair[0] . '}' . (int)$pair[1];
+            if (is_numeric($pair[0]) && is_numeric($pair[1])) {
+              $attributes_ids .= '{' . (int)$pair[0] . '}' . (int)$pair[1];
+            } else {
+              $attributes_check = false;
+              break;
+            }
+          }
+
+          if ($attributes_check == true) {
+            $uprid .= $attributes_ids;
+          }
         }
+      } else {
+        return false;
       }
     }
 
@@ -905,7 +933,11 @@
   function tep_get_prid($uprid) {
     $pieces = explode('{', $uprid);
 
-    return (int)$pieces[0];
+    if (is_numeric($pieces[0])) {
+      return $pieces[0];
+    } else {
+      return false;
+    }
   }
 
 ////



-------------------------------------------------------
SF.Net is sponsored by: Speed Start Your Linux Apps Now.
Build and deploy apps & Web services for Linux with
a free DVD software kit from IBM. Click Now!
http://ads.osdn.com/?ad_id=1356&alloc_id=3438&op=click