Closed (fixed)
Project:
Table Quote - Shipping cost based on total ranges
Version:
6.x-2.0
Component:
Code
Priority:
Critical
Category:
Bug report
Assigned:
Reporter:
Created:
12 Apr 2010 at 13:22 UTC
Updated:
23 May 2010 at 09:20 UTC
Line 264:
<?php
if ($rate > 0) {
$quotes[] = array('rate' => $rate, 'format' => uc_currency_format($rate), 'option_label' => $method['tablequote']['quote']['accessorials'][0]);
} else {
$quotes[] = array('rate' => $rate, 'format' => uc_currency_format($rate), 'option_label' => $method['tablequote']['quote']['accessorials'][0]);
}
?>Whether $rate > 0 or not, the same code is executed!
Thus uc_tablequote doesn't check any limit and may return an absolutly wrong quote.
This is a critical bug that can lead to security issues.
Comments
Comment #1
anrikun commentedThere's a patch that fixes this issue here:
http://drupal.org/node/743050#comment-2836530
Comment #2
anrikun commentedComment #3
anrikun commentedThis is fixed in 6.x-2.x-dev.