Scary bug/flaw? Showing checkout

Justin,

This is happening for me too: WP 4.2.2 and WPEC 3.9.3

It’s almost certainly not a caching issue. It seems that the function wpsc_get_current_customer_id() is returning the information for the previous customer – unless the user is logged in, in which case it correctly finds their stored information.

For the moment I have used jQuery to clear the fields, but apart from being an inelegant hack and ignoring the root issue, it doesn’t remove the information from the source code.

We really need to get this sorted quickly. Did you get anywhere with codynew’s issue?

Thanks very much

Safari produces this:

[HTTP_USER_AGENT] => Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_3) AppleWebKit/600.6.3 (KHTML, like Gecko) Version/8.0.6 Safari/600.6.3

Firefox (developer edition) this:

[HTTP_USER_AGENT] => Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:39.0) Gecko/20100101 Firefox/39.0

They look pretty sound to me. I’m logging from wpsc-includes/customer.php in wpsc_get_current_customer_id() – here’s the line (repeated a few times throughout the function):

fwrite( $log, __LINE__.': '.$_SERVER['REMOTE_ADDR'].' : '.$visitor_id."\n" );

__LINE__ so I can keep track of which condition is being met; $_SERVER[‘REMOTE_ADDR’] so I can make sure I’m seeing me and not an actual robot or crawler; and $visitor_id (or $id in one case) so I can see what’s being returned. Every single user is being assigned the ID 1 – here’s a single page load from the log, with xs where my own IP address shows up:

56: xx.xx.xx.xx : 1
80: xx.xx.xx.xx : 1
48: xx.xx.xx.xx : 1
48: xx.xx.xx.xx : 1
48: xx.xx.xx.xx : 1
48: xx.xx.xx.xx : 1
48: xx.xx.xx.xx : 1
48: xx.xx.xx.xx : 1
48: xx.xx.xx.xx : 1
48: xx.xx.xx.xx : 1
48: xx.xx.xx.xx : 1
48: xx.xx.xx.xx : 1
48: xx.xx.xx.xx : 1
48: xx.xx.xx.xx : 1
48: xx.xx.xx.xx : 1
48: xx.xx.xx.xx : 1
48: xx.xx.xx.xx : 1
48: xx.xx.xx.xx : 1
48: xx.xx.xx.xx : 1
48: xx.xx.xx.xx : 1
48: xx.xx.xx.xx : 1

Line 56 is where this happens:

if ( _wpsc_is_bot_user() ) {
		$visitor_id = WPSC_BOT_VISITOR_ID;

…the line number would be lower except for my debugging strings. Basically, the first time the function gets called it determines I’m a bot, assigns me the id 1 on that basis, and subsequent calls just return that.

So it’s definitely because your system thinks I’m a bot. I can’t see anything iffy in the user agent string, though.

What do you think? This pretty much eliminates cookies, I think?

Thanks again for your help.

what is the url of your store?

Jeff et al.,

There are no references to wpsc_bot_user_agents or wpsc_is_bot_user anywhere except in the shopping cart:

bash-3.2$ grep -r wpsc_bot_user_agents ~/public_html/wp-content/
~/public_html/wp-content/plugins/wp-e-commerce/wpsc-includes/customer-private.php:			$bot_agent_strings = apply_filters( 'wpsc_bot_user_agents', $bot_agent_strings );
bash-3.2$ grep -r wpsc_is_bot_user  ~/public_html/wp-content/
~/public_html/wp-content/plugins/wp-e-commerce/wpsc-includes/customer-private.php:	if ( _wpsc_is_bot_user() ) {
~/public_html/wp-content/plugins/wp-e-commerce/wpsc-includes/customer-private.php:function _wpsc_is_bot_user() {
~/public_html/wp-content/plugins/wp-e-commerce/wpsc-includes/customer-private.php:	$is_bot = apply_filters( 'wpsc_is_bot_user', $is_bot );
~/public_html/wp-content/plugins/wp-e-commerce/wpsc-includes/customer.php:	if ( _wpsc_is_bot_user() ) {
bash-3.2$

Here’s $_COOKIE. I’m echoing this at the beginning of _wpsc_is_bot_user(), and the page I’m loading is the checkout:

Array
(
    [ADMINDYNSRV] => lin113
    [PHPSESSID] => 3354e8cd3570a0d1dcb73df044633b55
    [wp-settings-8] => editor=html&libraryContent=browse
    [wp-settings-time-8] => 1433422588
    [wpsc_attempted_validate] => Tue Jun 09 2015 10:12:34 GMT 0100 (BST)
    [wpsc_customer_cookie_de4edf5e10836d598091518036358b5f] => 1|1434014028|068ebb51b8b032a0a35156729d8927d5
    [__unam] => 81c065-14dbe747038-4bb9b915-66
    [__utma] => 100069506.1441442529.1415100215.1415100215.1415178910.2
    [_ga] => GA1.2.1441442529.1415100215
    [_gat] => 1
)

…and here’s another one using a different browser:

Array
(
    [PHPSESSID] => 1d5202077e07522550aca52e6b4c2c3c
    [wpsc_attempted_validate] => Tue Jun 09 2015 10:20:35 GMT 0100 (BST)
    [ADMINDYNSRV] => lin234
    [_gat] => 1
    [wpsc_customer_cookie_de4edf5e10836d598091518036358b5f] => 1|1434014569|df241bc16f7aa9e41875e000790ac85c
    [_ga] => GA1.2.1954724724.1433421944
    [__unam] => 81c065-14dbe9b17f9-79df4d08-11
)

Interesting that the wp-settings ones don’t show up in the second browser, but I don’t imagine that’s significant. The value of wpsc_customer_cookie_de4edf5e10836d598091518036358b5f] is different, which seems right. I don’t really know how to interpret any of this – it looks OK to me, is there something wrong here?

Thanks.