One of my clients recently added a value to the "Shipping Rate Markup" field for USPS shipping (with markup type set to Addition $). But we noticed that when orders were placed, the markup wasn't applied. Turns out they had a dollar sign in the field which was causing the $markup amount in uc_usps_markup() to be completely ignored.

I'm recommending we add a little better error checking for the markup value so that this doesn't fail silently for other UC users in the future.

Suggested Fix: Create a validation function for when uc_usps_admin_settings() is submitted. This will throw an error if NOT is_numeric() for the value of uc_usps_markup.

CommentFileSizeAuthor
#2 uc_ups.admin_.inc_.patch438 bytestr
#2 uc_usps.admin_.inc_.patch517 bytestr

Comments

tr’s picture

tr commented
Version: 5.x-1.7 » 6.x-2.x-dev
Assigned: Unassigned » tr
tr’s picture

tr commented
Status: Active » Needs review
StatusFileSize
new uc_usps.admin_.inc_.patch517 bytes
new uc_ups.admin_.inc_.patch438 bytes

I rolled a patch for uc_usps and for uc_ups to fix this. The patch adds an is_numeric() check in the form validation function. I also committed a similar patch to my uc_fedex module, where I've had it in use for several weeks without a problem.

tr’s picture

tr commented

Moving above the fold ...

Island Usurper’s picture

Island Usurper commented
Category: feature » support
Status: Needs review » Fixed

Committed. Thanks.

Status: Fixed » Closed (fixed)

Automatically closed -- issue fixed for 2 weeks with no activity.