News:

Wondering if this will always be free?  See why free is better.

Main Menu

[4835] Found the Paid Subscriptions BUG.

Started by Krashsite, September 29, 2011, 01:22:48 AM

Previous topic - Next topic

Sir Osis of Liver

There are multiple threads on the board dating back months describing this problem, so I won't go into detail.  Basically, the subscription fails after successful payment, resulting in an inactive subscription with a 'pending payment' message in the member's profile.  The cause turns out to be a configuration conflict.

Ready?

If you have disallowed guests from browsing the forum, paid subs will not work.  If you change the setting to allow guest access, it works fine.

Try it.  The setting is Admin -> Features and Options -> Allow guests to browse the forum.  I've confirmed it on two forums in two different domains.

Ashes and diamonds, foe and friend,
 we were all equal in the end.

                                     - R. Waters

Aleksi "Lex" Kilpinen

That actually makes sense. If anyone can confirm this - then it's definitely a bug to be fixed.
Slava
Ukraini!
"Before you allow people access to your forum, especially in an administrative position, you must be aware that that person can seriously damage your forum. Therefore, you should only allow people that you trust, implicitly, to have such access." -Douglas

How you can help SMF

vbgamer45

It looks true looking at SSI code does a check for $ssi_guest_access and subscriptions.php calls SSI
Community Suite for SMF - Take your forum to the next level built for SMF, Gallery,Store,Classifieds,Downloads,more!

SMFHacks.com -  Paid Modifications for SMF

Mods:
EzPortal - Portal System for SMF
SMF Gallery Pro
SMF Store SMF Classifieds Ad Seller Pro

Sir Osis of Liver

Ashes and diamonds, foe and friend,
 we were all equal in the end.

                                     - R. Waters

live627

Code (Find in Subscriptions.php) Select
require_once(dirname(__FILE__) . '/SSI.php');

Code (Add before the searched string) Select
$ssi_guest_access = true;

Ricky.

#5
Finally Krash you pin-pointed it :)

Aleksi "Lex" Kilpinen

Can someone confirm if the workaround offered above works? If it does, then that seems like a perfectly safe way to temporarily fix this until the devs have figured out all the details on this :)
Slava
Ukraini!
"Before you allow people access to your forum, especially in an administrative position, you must be aware that that person can seriously damage your forum. Therefore, you should only allow people that you trust, implicitly, to have such access." -Douglas

How you can help SMF

emanuele

Good job Krash!
Thank you for your perseverance! :)

Tracked to be sure it doesn't get lost.

Didn't tested, but the fix should work as expected.
Thanks live too!


Take a peek at what I'm doing! ;D




Hai bisogno di supporto in Italiano?

Aiutateci ad aiutarvi: spiegate bene il vostro problema: no, "non funziona" non è una spiegazione!!
1) Cosa fai,
2) cosa ti aspetti,
3) cosa ottieni.

Sir Osis of Liver

Quote from: live627 on September 29, 2011, 02:13:58 AM
Code (Find in Subscriptions.php) Select
require_once(dirname(__FILE__) . '/SSI.php');

Code (Add before the searched string) Select
$ssi_guest_access = true;

Confirmed - it werks gud!

Nice hack, live. 
Ashes and diamonds, foe and friend,
 we were all equal in the end.

                                     - R. Waters

antoniosaucedo

If have allowed guests from browsing the forum, but still have the problem.

If I had installed the mod: Hide Topics from Guests     , could this be generating this problem to?

SMF 2.0

Thanks.

Sir Osis of Liver

Ashes and diamonds, foe and friend,
 we were all equal in the end.

                                     - R. Waters

Joshua Dickerson

Before that gets committed, whomever does commit it should take extra time to ensure that doesn't inject any vulnerabilities. That seems like it is very prone to doing so.
Come work with me at Promenade Group



Need help? See the wiki. Want to help SMF? See the wiki!

Did you know you can help develop SMF? See us on Github.

How have you bettered the world today?


Joshua Dickerson

Come work with me at Promenade Group



Need help? See the wiki. Want to help SMF? See the wiki!

Did you know you can help develop SMF? See us on Github.

How have you bettered the world today?

live627

How is it a vuln? The fix I posted just opens ssi for thee paid subs. It could be a problem if people call subscriptions.php along with ssi.php, but that wouldn't really be normal flow.

Joshua Dickerson

I didn't say it is. I said that we should triple check that to make sure it isn't. Sleepy committed it.
Come work with me at Promenade Group



Need help? See the wiki. Want to help SMF? See the wiki!

Did you know you can help develop SMF? See us on Github.

How have you bettered the world today?

edchapman

Not sure if this is the same problem I'm having. When users choose reoccurring subscriptions everything seems to work fine. However, if they pick non reoccurring subscriptions... the payment goes through but I have to manually add the subscription. I get an email from paypal but not the forum.

Advertisement: