[HOLOCMS] HoloShop-Ajax based web catalogue & badge store [2.0 BETA ALPHA RELEASED]

Excellent, can't wait for final release. I will be adding them :)

Struggling with manage a badge... but nothing i cant handle..

Excellent, the final release is not far away, I am told.

I've just sent tom, HoloShop 2.0: Beta Alpha... If all goes to plan.. It will shortly be released.(Under an hour) Hopefully.

BAM: Here you go enjoy...
Please bear in mind this is still a beta product.. glitches may occur.

This is great, I love your work,, it is great :D thankyou so much :)

Yeah, hope you make more like this.

[PHP]
<?php
/*===================================================+
|| # HoloCMS - Website and Content Management System
|+===================================================+
|| # Copyright

All seems to be working, well done.

how do you edit the badge catogories

Quote:

---

Originally Posted by Relapse

how do you edit the badge catogories

---

Basicly, you need to get the images from somewhere

Then get it's CCT name...

Such as:

Code:

---

barchair_silo*7

---

Replace the * with a _ (because of windows not like the charator _)
So it will come out like

Code:

---

barchair_silo_7

---

I want to replace all of these

Achievements
Australia
Campaign
Canada
China
Finland
France
General
Italy
Netherlands
Others
Singapore
Spain
United Kingdom
USA

And repalce them with 'Ceon Badges' but i want to able to add one badge at a time

So great, omg, i love your work, make pls more soon!

All working 100 %

If anyone uses this, people will start popping up with thrones and typos from no where.

because...
You use:

PHP Code:

---

    if ($furnicat['minrank'] <= $user_rank) { 


---

To check if the user can buy this furni.
Which is defined by:

PHP Code:

---

$furnicat = mysql_fetch_assoc(mysql_query("SELECT * FROM catalogue_pages WHERE indexid ='" .
    $_GET['category'] . "'")); 


---

Which is a USER CONTROLLED variable from the outside. (Thisshouldnevereverhappen!)

So If I was to inject via POST the itemID of a admin only rare, with a quantity, then add in the GET category ID of a category any user is allowed to access.. I would be able to buy it!

Always double check everything server-side.

Also you use a mysql query to find the users rank and use $user_rank anyways, which bugs the heck out of me.

You should make it so you can only buy furni from furni with categories higher than 1. (Type in "-1" for categories and see where that brings you).

Personally, I'm not good at GUI - backend stuff. So you did a lot better with that than I would have. Change these though.

Quote:

---

Originally Posted by GMROCKS

If anyone uses this, people will start popping up with thrones and typos from no where.

because...
You use:

PHP Code:

---

    if ($furnicat['minrank'] <= $user_rank) { 


---

To check if the user can buy this furni.
Which is defined by:

PHP Code:

---

$furnicat = mysql_fetch_assoc(mysql_query("SELECT * FROM catalogue_pages WHERE indexid ='" .
    $_GET['category'] . "'")); 


---

Which is a USER CONTROLLED variable from the outside. (Thisshouldnevereverhappen!)

So If I was to inject via POST the itemID of a admin only rare, with a quantity, then add in the GET category ID of a category any user is allowed to access.. I would be able to buy it!

Always double check everything server-side.

Also you use a mysql query to find the users rank and use $user_rank anyways, which bugs the heck out of me.

You should make it so you can only buy furni from furni with categories higher than 1. (Type in "-1" for categories and see where that brings you).

Personally, I'm not good at GUI - backend stuff. So you did a lot better with that than I would have. Change these though.

---

Wanna bet babe?
You think i has one Security feature? Fuck that i have loads..
I'd suggest you've have a look at the whole code. You would have seen this...
The GUI was basic html/css LOL @ You.
Considering how many lines of code i've added, one line of code errored isnt half bad? no PHP errors?
Unless(You didnt run the correct upgrade.php)
I'll be patching the < 1 for categories... now, if i see it's bad :D

EDIT: <1 does jack shit >;D