Make sure customer cookie value is url decoded prior to use

wpsc-core/js/wp-e-commerce.js

@@ -31,6 +31,7 @@ if ( typeof wpsc_vars !== 'undefined' ) {
 	var WPSC_IMAGE_URL           = wpsc_vars.WPSC_IMAGE_URL;
 	var WPSC_CORE_IMAGES_URL     = wpsc_vars.WPSC_CORE_IMAGES_URL;
 	var fileThickboxLoadingImage = wpsc_vars.fileThickboxLoadingImage;
+    var wpsc_debug               = wpsc_vars.hasOwnProperty( 'debug' );
 }
 // end of variable definitions
 ///////////////////////////////////////////////////////////////////////////////////////////////
@@ -79,11 +80,19 @@ function wpsc_var_get( name ) {
  * @return boolean          Whether or not element is visible.
  */
 function wpsc_element_is_visible( el ) {
-	var top   = jQuery( window ).scrollTop(),
-	bottom    = top + jQuery( window ).height(),
-	elTop     = el.offset().top;
 
-	return ( (elTop >= top ) && ( elTop <= bottom ) && ( elTop <= bottom ) && ( elTop >= top ) ) && el.is( ':visible' );
+    // check to be sure the form element exists, it may have been passed to us unveriified in a callback
+    if ( typeof el !== 'undefined' && el.length ) {
+        var top = jQuery(window).scrollTop(),
+            bottom = top + jQuery(window).height(),
+            elTop = el.offset().top;
+
+        visible = ( (elTop >= top ) && ( elTop <= bottom ) && ( elTop <= bottom ) && ( elTop >= top ) ) && el.is(':visible');
+    } else {
+        visible = false;
+    }
+
+    return visible;
 }
 
 /**
@@ -134,6 +143,13 @@ function wpsc_var_set( name, value ) {
 // a global variable used to hold the current users visitor id,
 // if you are going to user it always check to be sure it is not false
 var wpsc_visitor_id = false;
+    var i, cookieName, cookieValue, docCookies = document.cookie.split( ';' );
+    for ( i = 0; i < docCookies.length; i++ ) {
+        cookieName  = docCookies[i].substr( 0, docCookies[i].indexOf( '=' ) );
+        cookieName  = cookieName.replace( /^\s+|\s+$/g, '' );
+        cookieValue = docCookies[i].substr( docCookies[i].indexOf('=') + 1);
+            var cookieValueClean = decodeURI(cookieValue);
+            var idAsText = cookieValueClean.substr(0,cookieValueClean.indexOf( '|' ) );
 
 if ( document.cookie.indexOf("wpsc_customer_cookie") < 0 ) {
 	if ( document.cookie.indexOf("wpsc_attempted_validate") < 0 ) {
@@ -156,14 +172,26 @@ if ( document.cookie.indexOf("wpsc_customer_cookie") < 0 ) {
 		// Note that we cannot set a timeout on synchronous requests due to XMLHttpRequest limitations
 		wpsc_http.send();
 
+            if ( wpsc_debug && window.console ) {
 		// we did the request in synchronous mode so we don't need the on load or ready state change events	to check the result
 		if (wpsc_http.status == 200) {
 			 var result = JSON.parse( wpsc_http.responseText );
 			 if ( result.valid && result.id ) {
 				 wpsc_visitor_id = result.id;
-			 }
-		}
-	}
+                    if ( wpsc_debug ) {
+                        console.log("The new WPeC visitor id is " + wpsc_visitor_id);
+                    }
+                }
+                if ( wpsc_debug ) {
+                    console.log("The HTTP request to validate the WPeC validate visitor id  was not successful, HTTP error " + wpsc_http.status);
+                }
+            }
+        }
+        if ( wpsc_debug ) {
+            console.log("The existing WPeC visitor id is " + wpsc_visitor_id);
+        }
+    }
+}
 }
 // end of setting up the WPEC customer identifier
 ///////////////////////////////////////////////////////////////////////////////////////////////
@@ -192,9 +220,11 @@ function wpsc_update_customer_data( meta_key, meta_value, response_callback ) {
 		var ajax_data = {action: 'wpsc_customer_updated_data', meta_key : meta_key, meta_value : meta_value };
 		wpsc_do_ajax_request( ajax_data, response_callback );
 	} catch ( err ) {
-		if ( window.console && window.console.log ) {
-			console.log( err );
-		}
+        if ( wpsc_debug ) {
+            if (window.console && window.console.log) {
+                console.log(err);
+            }
+        }
 	}
 
 }
@@ -213,9 +243,11 @@ function wpsc_get_customer_data( response_callback ) {
 		var ajax_data = {action: 'wpsc_get_customer_meta' };
 		wpsc_do_ajax_request( ajax_data, response_callback );
 	} catch ( err ) {
-		if ( window.console && window.console.log ) {
-			console.log( err );
-		}
+        if ( wpsc_debug ) {
+            if (window.console && window.console.log) {
+                console.log(err);
+            }
+        }
 	}
 }
 

wpsc-core/wpsc-functions.php

@@ -215,6 +215,12 @@ function wpsc_javascript_localizations( $localizations = false ) {
 		$localizations['WPSC_CORE_IMAGES_URL']     = WPSC_CORE_IMAGES_URL;
 		$localizations['fileThickboxLoadingImage'] = WPSC_CORE_IMAGES_URL . '/loadingAnimation.gif';
 		$localizations['msg_shipping_need_recalc'] = __( 'Please click the <em>Calculate</em> button to refresh your shipping quotes, as your shipping information has been modified.', 'wpsc' );
+
+		// if we are in debug mode tell the script it is ok to log messages and such
+		if ( wpsc_in_debug_mode()) {
+			$localizations['debug'] = '1';
+		}
+
 	}
 
 	/**
@@ -955,3 +961,51 @@ function _wpsc_clear_wp_cache_on_version_change() {
 }
 
 add_action( 'admin_init', '_wpsc_clear_wp_cache_on_version_change', 1 );
+
+/**
+ * Check if awe are in 'debug' mode, use if you want to conditionally output messages to the error log
+ * or admistrator console
+ *
+ * Debug mode will be enabled if WordPress debug mode is enabled
+ * Debug mode will be set if the constant WPSC_DEBUG is defined and evaluates to true
+ * Debug mode can be set by a logged in administrative user by appending '?wpsc_debug_mode=1' to the end of any site url
+ *
+ * @return bool
+ */
+function wpsc_in_debug_mode() {
+	$wpsc_debug_mode = false;
+
+	// is WordPress debug mode on?
+	if ( defined( 'WP_DEBUG') && WP_DEBUG ) {
+		$wpsc_debug_mode = true;
+	}
+
+	// is WPeC debug mode on?
+	if ( defined( 'WPSC_DEBUG') && WPSC_DEBUG ) {
+		$wpsc_debug_mode = true;
+	}
+
+	// get the value of the debug mode option, if it is not defined create it so that
+	// the option is cached and debug mode can be determined with greate haste
+	$debug_mode_option = intval( get_option( 'wpsc_debug_mode', -1 ) );
+	if( -1 == $debug_mode_option ) {
+		$debug_mode_option = 0;
+		update_option( 'wpsc_debug_mode', $debug_mode_option );
+	}
+
+	// has debug mode been enabled from a url request by an administrator
+	if (  isset( $_REQUEST['wpsc_debug_mode'] ) ) {
+		if ( funtion_exists( 'current_user_can' ) && current_user_can( 'manage_options' ) ) {
+			$debug_mode_option = intval( $_REQUEST['wpsc_debug_mode'] );
+			update_option( 'wpsc_debug_mode', $debug_mode_option );
+		}
+	}
+
+	// has debug mode been previously enabled by an administrator request
+	if ( $debug_mode_option ) {
+		$wpsc_debug_mode = true;
+	}
+
+	return $wpsc_debug_mode;
+
+}

wpsc-includes/customer-private.php

@@ -218,7 +218,7 @@ function _wpsc_validate_customer_cookie() {
 		return false;
 	}
 
-	$cookie = $_COOKIE[ WPSC_CUSTOMER_COOKIE ];
+	$cookie = urldecode( $_COOKIE[ WPSC_CUSTOMER_COOKIE ] );
 
 	list( $id, $expire, $visitor_hash_from_cookie ) = $x = explode( '|', $cookie );
 
@@ -331,7 +331,6 @@ function _wpsc_merge_cart() {
 	$id_from_customer_meta = wpsc_get_customer_meta( 'merge_cart_vistor_id' );
 	wpsc_delete_customer_meta( 'merge_cart_vistor_id' );
 
-
 	$old_cart = wpsc_get_customer_cart( $id_from_customer_meta );
 	$items    = $old_cart->get_items();