Hi,

I found a DOS-Vulnerability in litecart. If an attacker sends random URL's to LiteCart, those URLs (if unique) are saved to the file logs/note_found.log. Unfortunatly this file is fully loaded to RAM if a not existing URL is called.

By sending a large number of invalid request to litecart, the file size can be increased infinite. Then every call to litecart, that has an invalid url takes the full available memory and causes a lot of IO.

Recommendations The entries should be logged to dababase. An upsert command can be used to create or update the entries in the db.

How can you protect your system, until a bugfix is published? E.g. create a cron that empties the not_found.log file.

Best Regards mschop

What were you trying to do? sending email to customer after purchase

What was expected to happen?

What was the actual result - what exactly did happen? problem is in smtp.php with AUTH not working...

Which LiteCart version are you running? any 2.0 version...

What were you trying to do? live

What was expected to happen? not much

What was the actual result - what exactly did happen? a bunch of chinese crap email is coming in

Which LiteCart version are you running? the one on litecart's website

hey TiM hope you are doing well, it seems that someone is spamming the litecart site with chinese garbage and that is going out to email inboxes of people who subscribe...

line 68 if (!$image->write($options['destination'], $options['quality'], !empty($options['interlaced']))) return; Path into writing the image should be the same than the one returned after. But the one after is the one resolved by realpath(); So it should be: if (!$image->write(realpath($options['destination']), $options['quality'], !empty($options['interlaced']))) return; Or better maybe better, the following line: return preg_replace('#^('. preg_quote(FS_DIR_APP, '#') .')#', '', str_replace('\\', '/', $options['destination']));

What were you trying to do? Opening a product in the modal view. Opening the cart after I have added a product.

What was expected to happen? Nothing special

What was the actual result - what exactly did happen? I got the following error Notice: Undefined index: name in ~/includes/library/lib_cart.inc.php on line 164

I also get the following error when opening the product modal on my test product. Notice: Undefined index: name in ~/pages/product.inc.php on line 142

Which LiteCart version are you running? 2.0-rc1

when you save category or product you get problem with timestamps and default values. Example:

Fatal error: 1364 - Field 'parent_id' doesn't have a default value insert into tvojshop.lc_categories (date_created) values ('2017-08-23 14:12:33'); in ~/includes/library/lib_database.inc.php on line 220

What were you trying to do? We want to add two emails to the Order Copy Receipients field.

As it states:

Send order copies to the following e-mail addresses. Separate by semi-colons.

What was expected to happen? We expected to receive emails at each valid address

What was the actual result - what exactly did happen? No email is sent to those emails, after an order is placed. Note: the usual admin email set in Store Email does receive an order alert email.

Which LiteCart version are you running? LiteCart® 1.3.4.1

What were you trying to do? in the cart, I try to increase the product quantity's product ordered,, so I press "+" What was expected to happen? As a potential client, I supose the quantity being updated What was the actual result - what exactly did happen? Quantity is not updated until I clic on update button Can you add some JS to allow quantity being auto updated? think is a must for mobile usability thanks!

When ordering a product with stock option, the quantity changes only in global default item, but not in the individual option items. Tested on the clean install of Litecart 2.2.3.6 Petr

The category picker (see edit product) is incovenient if the merchant has a bigger list of categories. A better category picker would solve the problem. Maybe inspired by the product picker when editing order?

SMTP with GMail works fine for me. I will be pushing some commits later this evening that enables a log file being created for your last SMTP session. You might wanna check it out.

Your error message says only a character "C"is all that was identified from the following:

        if (preg_match('#250.AUTH ([^\R]+)#', $this->_last_response, $matches)) {
          $auths = explode(' ', $matches[1]);
        }

Makes me wonder if your smtp server returned: 250.AUTH C

Originally posted by @timint in https://github.com/litecart/litecart/issues/98#issuecomment-350834990

There is a discrepancy when adding product options with different prices, and some are more than the base price and some are less than the base price—the + is written before the currency symbol sign, and the - is displayed after the currency symbol.

This proposal puts both the + and - before the currency symbol.

Description

File : public_html/pages/ajax/checkout_customer.inc.php
Line Number: 104

Function array_replace_recursive invoked with 1 parameter, at least 2 required.

LiteCart Version

Master

PHP Version

8

Error/Backtrace

No response

Is this a problem that can be reproduced in the demo platform?

No response

If this problem could be related to a browser. Which one?

No response

When printable order copy does not fit in one page the list of products overlaps the page and also the footer.

Of course, when printing everything is more or less ok.

Here is the replication in demo:

Small issue with "Name" translation in Lithuanian language (possibly other too) name for people is "vardas" and name for places or things is "pavadinimas".. something similar to "title_customer_name" should be added

If you have multiple pictures in one product there is no arrow for moving forward or back (gallery function). Is this intentional or missing css style?

v2.0