X-Cart forums

[Duramax 6.6L]

There is a bug in 4.1.9 where the image verification is missing in order to update the administration profile.

In /skin1/admin/main/register.tpl

After this line:

{if $active_modules.News_Management and $newslists}
{include file="modules/News_Management/register_newslists.tpl" userinfo=$userinfo}
{/if}


Add this:

{if $active_modules.Image_Verification and $show_antibot.on_registration eq 'Y' and $display_antibot}
{assign var="antibot_err" value=$reg_antibot_err}
{include file="modules/Image_Verification/spambot_arrest.tpl" mode="advanced" id=$antibot_sections.on_registration}
{/if}


Hope this helps everyone.

[carpeperdiem]

There is a bug in 4.1.9 where the image verification is missing in order to update the administration profile.

Image verification has NEVER been included in the admin. This is not a bug.

Moving this to completed custom mods...

[balinor]

Why would you need image verification in admin? If a spam bot is in there, you have some serious security problems

[Duramax 6.6L]

The image verification is for changing password, ect. When I tried to change the admin password, I was received an error message about the image verification. I reported the error to xcart and they replied that it was a bug and that they had fixed it.

Xcart said that it was a bug, and they didn't charge me for the fix.

I posted the fix here.

The image verification might be new to 4.1.9?

[carpeperdiem]

There is no image verification code in the admin (nor should there be). 4.1.8; 4.1.9 -- code hasn't changed. WHY ON EARTH would you need an image verification for the admin? if a spambot is in your admin, as Padraic said, you have much bigger fish to fry.

[Duramax 6.6L]

Here is the reply from xcart about the error message in the admin section. Either they put code in that was not needed in the first place, or they put the image verification in on purpose.

Dear Francis J,

> Aministration error concerning image verification.
> One more thing that I noticed is that my administration user profile does not
> have the ability to change any of the user info as there is no image or place >to enter the image for authentication.

I've investigated the issue. It was caused by a bug in X-Cart.
I've modified "<x-cart root>/skin1/admin/main/register.tpl" template. After this code block:

{if $active_modules.News_Management and $newslists}
{include file="modules/News_Management/register_newslists.tpl" userinfo=$userinfo}
{/if}

I've added the following code:

{if $active_modules.Image_Verification and $show_antibot.on_registration eq 'Y' and $display_antibot}
{assign var="antibot_err" value=$reg_antibot_err}
{include file="modules/Image_Verification/spambot_arrest.tpl" mode="advanced" id=$antibot_sections.on_registration}
{/if}

Now the verification image is displayed on the admin registration page and you can modify your profile.
Of course, we won't take any points for this ticket.

Please feel free to contact me if you have any questions or notes.
--

Sincerely yours,
Dmitry Demeschuk,
Support engineer


Please let me know what is going on here, You all say that it is not needed, but xcart says it is there.

[Duramax 6.6L]

Here is my stock admin/register.tpl file Before xcart changed it. This may have something to do with having news subscriptions available.


{* $Id: register.tpl,v 1.34.2.2 2007/08/02 07:51:57 zaa Exp $ *}
{if $js_enabled eq 'Y'}
{include file="check_email_script.tpl"}
{include file="check_zipcode_js.tpl"}
{include file="generate_required_fields_js.tpl"}
{include file="check_required_fields_js.tpl"}
{if $config.General.use_js_states eq 'Y'}
{include file="change_states_js.tpl"}
{/if}
{/if}

{if $newbie eq "Y"}
{assign var="title" value=$lng.lbl_modify_profile}
{else}
{if $main eq "user_add"}
{assign var="title" value=$lng.lbl_create_admin_profile}
{else}
{assign var="title" value=$lng.lbl_modify_admin_profile}
{/if}
{/if}

{include file="page_title.tpl" title=$title}

<!-- IN THIS SECTION -->

{if $newbie ne "Y"}
{include file="dialog_tools.tpl"}
{/if}

<!-- IN THIS SECTION -->

<font class="Text">

{if $newbie ne "Y"}
<br />
{if $main eq "user_add"}
{$lng.txt_create_admin_profile}
{else}
{$lng.txt_modify_admin_profile}
{/if}
<br /><br />
{/if}

{$lng.txt_fields_are_mandatory}

</font>

<br /><br />

{capture name=dialog}

{if $newbie ne "Y" and $main ne "user_add" and ($usertype eq "P" and $active_modules.Simple_Mode eq "Y" or $usertype eq "A")}
<div align="right">{include file="buttons/button.tpl" button_title=$lng.lbl_return_to_search_results href="users.php?mode=search"}</div>
{/if}

{assign var="reg_error" value=$top_message.reg_error}
{assign var="error" value=$top_message.error}
{assign var="emailerror" value=$top_message.emailerror}

{if $registered eq ""}
{if $reg_error}
<font class="Star">
{if $reg_error eq "F" }
{$lng.txt_registration_error}
{elseif $reg_error eq "E" }
{$lng.txt_email_already_exists}
{elseif $reg_error eq "U" }
{$lng.txt_user_already_exists}
{/if}
</font>
<br />
{/if}

{if $error ne ""}
<font class="Star"><strong>
{if $error eq "b_statecode"}
{$lng.err_billing_state}
{elseif $error eq "s_statecode"}
{$lng.err_shipping_state}
{elseif $error eq "b_county"}
{$lng.err_billing_county}
{elseif $error eq "s_county"}
{$lng.err_shipping_county}
{elseif $error eq "email"}
{$lng.txt_email_invalid}
{elseif $error eq "username"}
{$lng.err_username_invalid}
{else}
{$error}
{/if}
</strong></font>
<br />
{/if}

<form action="{$register_script_name}?{$smarty.server.QU ERY_STRING|amp}" method="post" name="registerform"{if $js_enabled} onsubmit="javascript: if (check_zip_code(){if $default_fields.email.required eq 'Y'} && checkEmailAddress(document.registerform.email){/if} && checkRequired(requiredFields)) return true; else return false;"{/if}>
{if $config.Security.use_https_login eq "Y"}
<input type="hidden" name="{$XCARTSESSNAME}" value="{$XCARTSESSID}" />
{/if}

<table cellspacing="1" cellpadding="2" width="100%">

{include file="main/register_personal_info.tpl" userinfo=$userinfo}

{include file="main/register_billing_address.tpl" userinfo=$userinfo}

{include file="main/register_shipping_address.tpl" userinfo=$userinfo}

{include file="main/register_contact_info.tpl" userinfo=$userinfo}

{include file="main/register_additional_info.tpl" section='A'}

{include file="main/register_account.tpl" userinfo=$userinfo}


{if $active_modules.News_Management and $newslists}
{include file="modules/News_Management/register_newslists.tpl" userinfo=$userinfo}
{/if}

<tr>
<td colspan="2">&nbsp;</td>
<td>

<br /><br /><br />

<font class="FormButton">
{if $smarty.get.mode eq "update"}
<input type="hidden" name="mode" value="update" />
{/if}
<input type="hidden" name="anonymous" value="{$anonymous}" />

<input type="submit" value=" {$lng.lbl_save|strip_tags:false|escape} " />

</td>
</tr>

</table>

<input type="hidden" name="usertype" value="{if $smarty.get.usertype ne ""}{$smarty.get.usertype|escape:"html"}{else}{$use rtype}{/if}" />
</form>

<br /><br />

{$lng.txt_user_registration_bottom}

<br />

{else}

{if $smarty.post.mode eq "update" or $smarty.get.mode eq "update"}
{$lng.txt_profile_modified}
{else}
{$lng.txt_profile_created}
{/if}

{/if}

{/capture}
{include file="dialog.tpl" title=$lng.lbl_profile_details content=$smarty.capture.dialog extra='width="100%"'}

[carpeperdiem]

This makes NO sense.

There is no justification for image verification in the admin.

[Duramax 6.6L]

I know this makes no sence but it is there. I don't understand it also. Did you try with a news letter available. Does it show up on your install.

[Jonjolt1]

Originally Posted by carpeperdiem

This makes NO sense.

There is no justification for image verification in the admin.

It makes perfect sense, Qualiteam must have reused some code to create the form, the problem being is the template file being re-used is looking for the image check.