Hack attempt when generating PDF invoices

[KasperFP]

Hi all!

 

Whenever I try to generate multiple PDF invoices under the "Orders -> Invoice" tab, I get a "Hack attempt" error.

It's version 1.2.5 of Prestashop. Unfortunately, we've had so many extra features developed that it's not possible for us to upgrade.

 

I've tried to trace my way down to where it fails, and I think its in the "PDF::invoice" line of PDF.php class:

public static function multipleInvoices($invoices)
{
 $pdf = new PDF('P', 'mm', 'A4');
 foreach ($invoices AS $id_order)
 {
  $orderObj = new Order(intval($id_order));
  if (Validate::isLoadedObject($orderObj))
   PDF::invoice($orderObj, 'D', true, $pdf);

 }
 return $pdf->Output('invoices.pdf', 'D');
}

 

Can anyone help? We're willing to pay to have this fixed quickly. (PM me if applicable)

[CDflyers]

I'm having this same problem, did you get it fixed?

[bellini13]

in v1.2.5, whenever the application encounters an error and tries to display an error message, it will show "hack attempt" by default, if a distinct error message was not provided.

 

This is a function in Tools.php class, as you can see the $string defaults to "Hack attempt" if the calling object does not provide a message.

static public function displayError($string = 'Hack attempt', $htmlentities = true)

 

So now you need to further trace into the PDF class to see where it is failing, and calling the Tools::displayError function, without passing a message.

 

In the default PDF class, that exists in 2 places.

The first is if you do not have any languages defined in the store. Highly unlikely this is your problem

    private function _initPDFFonts()
   {
       if (!$languages = Language::getLanguages())
           die(Tools::displayError());

 

The second occurs if the invoice address cannot be matched to a Shipping Zone.

   public function TaxTab()
   {
       if (!$id_zone = Address::getZoneById(intval(self::$order->id_address_invoice)))
           die(Tools::displayError());

 

You could update the Tools::displayError() in both locations so that instead it says something like

Tools::displayError("no languages")
Tools::displayError("no zones")

 

This will help narrow down the problem. Now if your PDF class was customized, you may have additional references to

Tools::displayError(), in which case you should revise them to have a unique message as well.

 

If this is all over your head, send me a PM as I do offer paid services, and we can work through the details.