[HOLOCMS] HoloShop-Ajax based web catalogue & badge store [2.0 BETA ALPHA RELEASED]

[TomSpit]

Excellent, can't wait for final release. I will be adding them :)

[Pure]

Struggling with manage a badge... but nothing i cant handle..

[TomSpit]

Excellent, the final release is not far away, I am told.

[Pure]

I've just sent tom, HoloShop 2.0: Beta Alpha... If all goes to plan.. It will shortly be released.(Under an hour) Hopefully.

[Pure]

BAM: Here you go enjoy...
Please bear in mind this is still a beta product.. glitches may occur.

[Hejula]

This is great, I love your work,, it is great :D thankyou so much :)

[TheCameHH1]

Yeah, hope you make more like this.

[Pure]

[PHP]
<?php
/*===================================================+
|| # HoloCMS - Website and Content Management System
|+===================================================+
|| # Copyright

[TomSpit]

All seems to be working, well done.

[Relapse]

how do you edit the badge catogories

[Pure]

how do you edit the badge catogories

Basicly, you need to get the images from somewhere

Then get it's CCT name...

Such as:

barchair_silo*7

Replace the * with a _ (because of windows not like the charator _)
So it will come out like

barchair_silo_7

[Relapse]

I want to replace all of these

Achievements
Australia
Campaign
Canada
China
Finland
France
General
Italy
Netherlands
Others
Singapore
Spain
United Kingdom
USA

And repalce them with 'Ceon Badges' but i want to able to add one badge at a time

[TheCameHH1]

So great, omg, i love your work, make pls more soon!

All working 100 %

[GMROCKS]

If anyone uses this, people will start popping up with thrones and typos from no where.

because...
You use:

    if ($furnicat['minrank'] <= $user_rank) { 

To check if the user can buy this furni.
Which is defined by:

$furnicat = mysql_fetch_assoc(mysql_query("SELECT * FROM catalogue_pages WHERE indexid ='" .
    $_GET['category'] . "'")); 

Which is a USER CONTROLLED variable from the outside. (Thisshouldnevereverhappen!)

So If I was to inject via POST the itemID of a admin only rare, with a quantity, then add in the GET category ID of a category any user is allowed to access.. I would be able to buy it!

Always double check everything server-side.

Also you use a mysql query to find the users rank and use $user_rank anyways, which bugs the heck out of me.

You should make it so you can only buy furni from furni with categories higher than 1. (Type in "-1" for categories and see where that brings you).

Personally, I'm not good at GUI - backend stuff. So you did a lot better with that than I would have. Change these though.

[Pure]

If anyone uses this, people will start popping up with thrones and typos from no where.

because...
You use:

    if ($furnicat['minrank'] <= $user_rank) { 

To check if the user can buy this furni.
Which is defined by:

$furnicat = mysql_fetch_assoc(mysql_query("SELECT * FROM catalogue_pages WHERE indexid ='" .
    $_GET['category'] . "'")); 

Which is a USER CONTROLLED variable from the outside. (Thisshouldnevereverhappen!)

So If I was to inject via POST the itemID of a admin only rare, with a quantity, then add in the GET category ID of a category any user is allowed to access.. I would be able to buy it!

Always double check everything server-side.

Also you use a mysql query to find the users rank and use $user_rank anyways, which bugs the heck out of me.

You should make it so you can only buy furni from furni with categories higher than 1. (Type in "-1" for categories and see where that brings you).

Personally, I'm not good at GUI - backend stuff. So you did a lot better with that than I would have. Change these though.

Wanna bet babe?
You think i has one Security feature? Fuck that i have loads..
I'd suggest you've have a look at the whole code. You would have seen this...
The GUI was basic html/css LOL @ You.
Considering how many lines of code i've added, one line of code errored isnt half bad? no PHP errors?
Unless(You didnt run the correct upgrade.php)
I'll be patching the < 1 for categories... now, if i see it's bad :D

EDIT: <1 does jack shit >;D