Script error after upgrade to 10.0.3

[Sadcase]

I've just updated our site to 10.0.3 from 10.0.2, which went without a hitch.

However, I've just discovered an issue that occurs on adding a product to the basket when there was no issue on 10.0.2.

In certain situations (discussed below), adding to cart generates a general script error: "Error: Input contains invalid characters (Error 2)".

After conducting experiments, I know the cause of the issue, but it has wider implications that the products involved.

It occurs because some of our product references have an ampersand '&' in the reference. However, these product names have not changed since we first set up the site under version 7; nor has it been a problem running it using version 8, 9, or 10.0.1 or 10.0.2.

However, the wider implications mentioned are the fact that it generates the script error when adding any product from the section containing the product with the ampersand in the reference. So, if there is one product with an ampersand in a section containing twenty products, the script error will occur when adding any of those twenty products to the cart - even though they don't have an ampersand in the reference. There are other products that have spaces, hyphens '-' or forward slashes '/' in the reference, but the error doesn't affect those products or sections.

However, if the offending product is hidden on the site, the issue goes away.

Unfortunately, these products are exported from Sage Line 50, and have a long audit trail, which means it's not an option to simply change the reference. At the moment, I've hidden all the offending products to allow people to order other items in the same section, but is it just a case of reverting certain scripts to the 10.0.2 version?

If so, which scripts should I revert?

All help gratefully received.

[Mike Hughes]

It's hard to say which bit is causing the problem and I'm not sure it's wise to try and mix and match older scripts with 10.0.3.

This sounds like a bug as the ampersand is an allowable character:

http://community.actinic.com/showthread.php?t=44788

You probably need to report it to Actinic as a bug and see if they can provide a temporary workaround until they issue a release with it fixed.

Mike

[leehack]

The & is an integral part of a URL formation and therefore because actinic uses it in URLs, it should probably be stopped at all from being used in the prod ref field. Pretty sure this has been brought up before but nothing seems to have been done in this instance. Downgrading scripts will not be an option I suspect, it will negate some of the improvements and changes made. You could of course run 10.0.2 in its entirety.

Ultimately, you need to stop using & in your prod refs and actinic need to disallow it as a legal character, i note that the tooltip still does not say you cannot use it, so they need to get on with that part. I don't see that you have any other viable/logical option.

[Sadcase]

Thanks both. I'm going to call Actinic Cover and see what they say. I appreciate that mixing and matching script versions is not the way forward, but unfortunately removing the ampersand from the product references in Sage is not possible either. It was good to see that it is an allowable character, but I'm not surprised it's a problem due to it being used in URLs, as you mentioned, Lee. It seems that they've got a bit stricter in the 10.0.3 scripts than they were before.

EDIT:
They're referring it to the developers for further investigation.

[EdHarrison]

Just to confirm - is this the ref only or the short product description as the ref is usually just numbers / letters?


thanks

[Sadcase]

Just to confirm - is this the ref only or the short product description as the ref is usually just numbers / letters?


thanks

This is the ref only - in my experience anyway.

[Sadcase]

I've just heard back from Actinic, and I've had to make a minor change (remove two characters) from the Actinic.pm script, which has fixed the issue.

Specifically, Actinic has added in protection for cross-site-scripting attacks into version 10.0.3. This means that certain, originally-acceptable, characters (like '&') generate a script error, as they can be used for malicious code injection.

Removing two characters from the script mentioned above allows the use of that character, but obviously increases the risk of XSS attacks. The fix is useful in the short term, but for mid to long term, it would be better to remove all references to the ampersand and revert the script back to the original.

EDIT:
I've added the complete list of disallowed characters, which are -

< greater than
> less than
( left parenthesis
) right parenthesis
& ampersand
; semicolon

- together with the reason for their rejection, to the Knowledgebase article referred to by Mike above: http://community.actinic.com/showthread.php?t=44788

[Steve G Griggs]

Thats worth knowing about although I tend to avoid ampersands in Actinic as they seem as if they can cause a few glitches

[martinkay]

I've just had a customer phoning through card details because when he went to go from the Actinic checkout to the Netbanx payment screens, his browser threw up a cross-site scripting error and wouldn't allow him to continue. But I don't have any ampersands anywhere in my products. Although I then tried buying the same item as he did and I didn't have a problem from my computer. So I'm not sure what is going on here - I'm still on 10.0.1, is this the issue that the fix mentioned above solves?

[Sean Williams]

V10.03
We had four products with parentheses in the Reference field, so we were getting the "Error: Input contains invalid characters (Error 2)" error when adding the product to the Cart.
We replaced the parentheses with '[]' square brackets and everything was fine again - products added to the cart and then through the checkout process without error.
However, trial and error has now shown that if you click on the product description while in the Cart (i.e. to have a look at the product page again), this error comes up: The specified product reference (A620 [A34 D45] /u) couldn't be found and then after a few seconds the dreaded white screen of doom comes up with : A General Script Error Occurred
Error: The input is NULL

Any ideas anyone?

Here's the link to one of the products: http://www.mistergear.co.uk/acatalog/A620_screen.html

Thanks

[NormanRouxel]

Try losing the "+" character from the reference. That's a special character in search strings (often denotes a space) and is apparently being replaced by a space when you link back from the Cart.

[NormanRouxel]

It's definitely that "+" character.

I've reported the problem with "+" in Product References on http://community.actinic.com/showthread.php?p=319492

[Sean Williams]

Thanks Norman - I'll give that a whirl and confirm

[Sean Williams]

We omitted the + sign and replaced the () with [] and all works perfectly.
Thanks for the help Norman

[nanodac]

I have had a similar problem today on one of our products, bringing up the following error.



A General Script Error Occurred

--------------------------------------------------------------------------------
Error: Error loading configuration file ../httpdocs/acatalog/A000194.cat. syntax error at (eval 30) line 13, near "+,"
--------------------------------------------------------------------------------
Press the Browser back button and try again or contact the site owner



I am VERY inexperienced at editing what is mentioned above. could anyone talk me through what I need to do in simple terms please?