By going to the url 'user/$uid/addresses/$aid/delete' where you replace with uid with a user id and the aid with the address id of default address, you are able to delete the preferred address. Just removing the link from the address listings isn't enough. Maybe a check if the aid is the default address in uc_addresses_delete_address_confirm($uid, $aid) would do it? I believe so.

Here is the code that I added after the check to see if the aid is valid:

  if($aid == _uc_addresses_get_default_address_id($uid)){
    $_SESSION['add_address'] = NULL;
    unset($_SESSION['add_address']);
    drupal_set_message('You cannot delete your default address.', 'error');
    drupal_goto('user/'. $uid .'/addresses/');
  }

Comments

freixas’s picture

freixas commented
Assigned: Unassigned » freixas

Thanks for catching this.

I thought it might be better to put the check at a lower level, to avoid any case where an error could slip through. So I rewrote _uc_addresses_db_delete_address:

function _uc_addresses_db_delete_address($aid) {
  $count =
    db_result(
      db_query("SELECT COUNT(*) FROM {uc_adresses_defaults} WHERE "
	       ."aid = %d", $aid));
  if ($count > 0) {
    drupal_set_message(t('You cannot delete your default address'));
    return FALSE;
  }
  else {
    db_query("DELETE FROM {uc_addresses} WHERE aid = %d", $aid);
    return TRUE;
  }
}

As soon as I get time to test this, I'll check it in.

freixas’s picture

freixas commented
Status: Active » Fixed

This problem has been fixed. The solution was a bit more extensive than the above code—in addition to correcting the misspelling of "adresses".

The low-level protection was left in place, but the code also catches an attempted deletion before asking the user to confirm an address deletion.

So where is the fixed code? It's checked in to the DRUPAL--5 branch. I continue to be a bit confused about how the Drupal CVS tags and branches work, and I'll wait a day to see if a 5.x-2.x-dev release is automatically generated.

Status: Fixed » Closed (fixed)

Automatically closed -- issue fixed for two weeks with no activity.