Description
Preconditions (*)
- Magento 2.3.0
- Magneto 1.x
Steps to reproduce (*)
- Use this url http:://www.domain.com/catalog/product_compare/index/items/ab
Expected result (*)
- should display 404 or another error message or it shouldn't even reach to the sql insertion point. I know this link is not anywhere in the site, however, intruders are trying this link. There might be some vulnerability too (I haven't come across yet).
Actual result (*)
2 exception(s):
Exception #0 (Zend_Db_Statement_Exception): SQLSTATE[23000]: Integrity constraint violation: 1452 Cannot add or update a child row: a foreign key constraint fails (database_name
.catalog_compare_item
, CONSTRAINTCATALOG_COMPARE_ITEM_PRODUCT_ID_SEQUENCE_PRODUCT_SEQUENCE_VALUE
FOREIGN KEY (product_id
) REFERENCESsequence_product
(sequence_value
)), query was: INSERT INTOcatalog_compare_item
(customer_id
,store_id
) VALUES (?, ?)
Exception #1 (PDOException): SQLSTATE[23000]: Integrity constraint violation: 1452 Cannot add or update a child row: a foreign key constraint fails (database_name
.catalog_compare_item
, CONSTRAINTCATALOG_COMPARE_ITEM_PRODUCT_ID_SEQUENCE_PRODUCT_SEQUENCE_VALUE
FOREIGN KEY (product_id
) REFERENCESsequence_product
(sequence_value
))Exception #0 (Zend_Db_Statement_Exception): SQLSTATE[23000]: Integrity constraint violation: 1452 Cannot add or update a child row: a foreign key constraint fails (
database_name
.catalog_compare_item
, CONSTRAINTCATALOG_COMPARE_ITEM_PRODUCT_ID_SEQUENCE_PRODUCT_SEQUENCE_VALUE
FOREIGN KEY (product_id
) REFERENCESsequence_product
(sequence_value
)), query was: INSERT INTOcatalog_compare_item
(customer_id
,store_id
) VALUES (?, ?)
#0 /vendor/magento/framework/DB/Statement/Pdo/Mysql.php(93): Zend_Db_Statement_Pdo->_execute(Array)
#1 /vendor/magento/zendframework1/library/Zend/Db/Statement.php(303): Magento\Framework\DB\Statement\Pdo\Mysql->_execute(Array)
#2 /vendor/magento/zendframework1/library/Zend/Db/Adapter/Abstract.php(480): Zend_Db_Statement->execute(Array)
#3 /vendor/magento/zendframework1/library/Zend/Db/Adapter/Pdo/Abstract.php(238): Zend_Db_Adapter_Abstract->query('INSERT INTOca...', Array) #4 /vendor/magento/framework/DB/Adapter/Pdo/Mysql.php(541): Zend_Db_Adapter_Pdo_Abstract->query('INSERT INTO
ca...', Array)
#5 /vendor/magento/framework/DB/Adapter/Pdo/Mysql.php(615): Magento\Framework\DB\Adapter\Pdo\Mysql->_query('INSERT INTOca...', Array) #6 /vendor/magento/zendframework1/library/Zend/Db/Adapter/Abstract.php(576): Magento\Framework\DB\Adapter\Pdo\Mysql->query('INSERT INTO
ca...', Array)
#7 /vendor/magento/framework/Model/ResourceModel/Db/AbstractDb.php(774): Zend_Db_Adapter_Abstract->insert('catalog_compare...', Array)
#8 /vendor/magento/framework/Model/ResourceModel/Db/AbstractDb.php(416): Magento\Framework\Model\ResourceModel\Db\AbstractDb->saveNewObject(Object(Magento\Catalog\Model\Product\Compare\Item))
#9 /vendor/magento/framework/Model/AbstractModel.php(648): Magento\Framework\Model\ResourceModel\Db\AbstractDb->save(Object(Magento\Catalog\Model\Product\Compare\Item))
#10 /vendor/magento/module-catalog/Model/Product/Compare/ListCompare.php(95): Magento\Framework\Model\AbstractModel->save()
#11 /vendor/magento/module-catalog/Model/Product/Compare/ListCompare.php(111): Magento\Catalog\Model\Product\Compare\ListCompare->addProduct('ab')
#12 /vendor/magento/module-catalog/Controller/Product/Compare/Index.php(90): Magento\Catalog\Model\Product\Compare\ListCompare->addProducts(Array)
#13 /generated/code/Magento/Catalog/Controller/Product/Compare/Index/Interceptor.php(24): Magento\Catalog\Controller\Product\Compare\Index->execute()
#14 /vendor/magento/framework/App/Action/Action.php(108): Magento\Catalog\Controller\Product\Compare\Index\Interceptor->execute()
#15 /vendor/magento/framework/Interception/Interceptor.php(58): Magento\Framework\App\Action\Action->dispatch(Object(Magento\Framework\App\Request\Http))
#16 /vendor/magento/framework/Interception/Interceptor.php(138): Magento\Catalog\Controller\Product\Compare\Index\Interceptor->___callParent('dispatch', Array)
#17 /vendor/magento/module-customer-segment/Model/App/Action/ContextPlugin.php(81): Magento\Catalog\Controller\Product\Compare\Index\Interceptor->Magento\Framework\Interception{closure}(Object(Magento\Framework\App\Request\Http))
#18 /vendor/magento/framework/Interception/Interceptor.php(135): Magento\CustomerSegment\Model\App\Action\ContextPlugin->aroundDispatch(Object(Magento\Catalog\Controller\Product\Compare\Index\Interceptor), Object(Closure), Object(Magento\Framework\App\Request\Http))
#19 /vendor/magento/framework/Interception/Interceptor.php(153): Magento\Catalog\Controller\Product\Compare\Index\Interceptor->Magento\Framework\Interception{closure}(Object(Magento\Framework\App\Request\Http))
#20 /generated/code/Magento/Catalog/Controller/Product/Compare/Index/Interceptor.php(52): Magento\Catalog\Controller\Product\Compare\Index\Interceptor->___callPlugins('dispatch', Array, Array)
#21 /vendor/magento/framework/App/FrontController.php(159): Magento\Catalog\Controller\Product\Compare\Index\Interceptor->dispatch(Object(Magento\Framework\App\Request\Http))
#22 /vendor/magento/framework/App/FrontController.php(99): Magento\Framework\App\FrontController->processRequest(Object(Magento\Framework\App\Request\Http), Object(Magento\Catalog\Controller\Product\Compare\Index\Interceptor))
#23 /vendor/magento/framework/Interception/Interceptor.php(58): Magento\Framework\App\FrontController->dispatch(Object(Magento\Framework\App\Request\Http))
#24 /vendor/magento/framework/Interception/Interceptor.php(138): Magento\Framework\App\FrontController\Interceptor->___callParent('dispatch', Array)
#25 /vendor/magento/module-store/App/FrontController/Plugin/RequestPreprocessor.php(94): Magento\Framework\App\FrontController\Interceptor->Magento\Framework\Interception{closure}(Object(Magento\Framework\App\Request\Http))
#26 /vendor/magento/framework/Interception/Interceptor.php(135): Magento\Store\App\FrontController\Plugin\RequestPreprocessor->aroundDispatch(Object(Magento\Framework\App\FrontController\Interceptor), Object(Closure), Object(Magento\Framework\App\Request\Http))
#27 /vendor/magento/module-page-cache/Model/App/FrontController/BuiltinPlugin.php(69): Magento\Framework\App\FrontController\Interceptor->Magento\Framework\Interception{closure}(Object(Magento\Framework\App\Request\Http))
#28 /vendor/magento/framework/Interception/Interceptor.php(135): Magento\PageCache\Model\App\FrontController\BuiltinPlugin->aroundDispatch(Object(Magento\Framework\App\FrontController\Interceptor), Object(Closure), Object(Magento\Framework\App\Request\Http))
#29 /vendor/magento/framework/Interception/Interceptor.php(153): Magento\Framework\App\FrontController\Interceptor->Magento\Framework\Interception{closure}(Object(Magento\Framework\App\Request\Http))
#30 /generated/code/Magento/Framework/App/FrontController/Interceptor.php(26): Magento\Framework\App\FrontController\Interceptor->___callPlugins('dispatch', Array, NULL)
#31 /vendor/magento/framework/App/Http.php(135): Magento\Framework\App\FrontController\Interceptor->dispatch(Object(Magento\Framework\App\Request\Http))
#32 /generated/code/Magento/Framework/App/Http/Interceptor.php(24): Magento\Framework\App\Http->launch()
#33 /vendor/magento/framework/App/Bootstrap.php(258): Magento\Framework\App\Http\Interceptor->launch()
#34 /index.php(39): Magento\Framework\App\Bootstrap->run(Object(Magento\Framework\App\Http\Interceptor))
#35 {main}Exception #1 (PDOException): SQLSTATE[23000]: Integrity constraint violation: 1452 Cannot add or update a child row: a foreign key constraint fails (
database_name
.catalog_compare_item
, CONSTRAINTCATALOG_COMPARE_ITEM_PRODUCT_ID_SEQUENCE_PRODUCT_SEQUENCE_VALUE
FOREIGN KEY (product_id
) REFERENCESsequence_product
(sequence_value
))
#0 /vendor/magento/zendframework1/library/Zend/Db/Statement/Pdo.php(228): PDOStatement->execute(Array)
#1 /vendor/magento/framework/DB/Statement/Pdo/Mysql.php(93): Zend_Db_Statement_Pdo->_execute(Array)
#2 /vendor/magento/zendframework1/library/Zend/Db/Statement.php(303): Magento\Framework\DB\Statement\Pdo\Mysql->_execute(Array)
#3 /vendor/magento/zendframework1/library/Zend/Db/Adapter/Abstract.php(480): Zend_Db_Statement->execute(Array)
#4 /vendor/magento/zendframework1/library/Zend/Db/Adapter/Pdo/Abstract.php(238): Zend_Db_Adapter_Abstract->query('INSERT INTOca...', Array) #5 /vendor/magento/framework/DB/Adapter/Pdo/Mysql.php(541): Zend_Db_Adapter_Pdo_Abstract->query('INSERT INTO
ca...', Array)
#6 /vendor/magento/framework/DB/Adapter/Pdo/Mysql.php(615): Magento\Framework\DB\Adapter\Pdo\Mysql->_query('INSERT INTOca...', Array) #7 /vendor/magento/zendframework1/library/Zend/Db/Adapter/Abstract.php(576): Magento\Framework\DB\Adapter\Pdo\Mysql->query('INSERT INTO
ca...', Array)
#8 /vendor/magento/framework/Model/ResourceModel/Db/AbstractDb.php(774): Zend_Db_Adapter_Abstract->insert('catalog_compare...', Array)
#9 /vendor/magento/framework/Model/ResourceModel/Db/AbstractDb.php(416): Magento\Framework\Model\ResourceModel\Db\AbstractDb->saveNewObject(Object(Magento\Catalog\Model\Product\Compare\Item))
#10 /vendor/magento/framework/Model/AbstractModel.php(648): Magento\Framework\Model\ResourceModel\Db\AbstractDb->save(Object(Magento\Catalog\Model\Product\Compare\Item))
#11 /vendor/magento/module-catalog/Model/Product/Compare/ListCompare.php(95): Magento\Framework\Model\AbstractModel->save()
#12 /vendor/magento/module-catalog/Model/Product/Compare/ListCompare.php(111): Magento\Catalog\Model\Product\Compare\ListCompare->addProduct('ab')
#13 /vendor/magento/module-catalog/Controller/Product/Compare/Index.php(90): Magento\Catalog\Model\Product\Compare\ListCompare->addProducts(Array)
#14 /generated/code/Magento/Catalog/Controller/Product/Compare/Index/Interceptor.php(24): Magento\Catalog\Controller\Product\Compare\Index->execute()
#15 /vendor/magento/framework/App/Action/Action.php(108): Magento\Catalog\Controller\Product\Compare\Index\Interceptor->execute()
#16 /vendor/magento/framework/Interception/Interceptor.php(58): Magento\Framework\App\Action\Action->dispatch(Object(Magento\Framework\App\Request\Http))
#17 /vendor/magento/framework/Interception/Interceptor.php(138): Magento\Catalog\Controller\Product\Compare\Index\Interceptor->___callParent('dispatch', Array)
#18 /vendor/magento/module-customer-segment/Model/App/Action/ContextPlugin.php(81): Magento\Catalog\Controller\Product\Compare\Index\Interceptor->Magento\Framework\Interception{closure}(Object(Magento\Framework\App\Request\Http))
#19 /vendor/magento/framework/Interception/Interceptor.php(135): Magento\CustomerSegment\Model\App\Action\ContextPlugin->aroundDispatch(Object(Magento\Catalog\Controller\Product\Compare\Index\Interceptor), Object(Closure), Object(Magento\Framework\App\Request\Http))
#20 /vendor/magento/framework/Interception/Interceptor.php(153): Magento\Catalog\Controller\Product\Compare\Index\Interceptor->Magento\Framework\Interception{closure}(Object(Magento\Framework\App\Request\Http))
#21 /generated/code/Magento/Catalog/Controller/Product/Compare/Index/Interceptor.php(52): Magento\Catalog\Controller\Product\Compare\Index\Interceptor->___callPlugins('dispatch', Array, Array)
#22 /vendor/magento/framework/App/FrontController.php(159): Magento\Catalog\Controller\Product\Compare\Index\Interceptor->dispatch(Object(Magento\Framework\App\Request\Http))
#23 /vendor/magento/framework/App/FrontController.php(99): Magento\Framework\App\FrontController->processRequest(Object(Magento\Framework\App\Request\Http), Object(Magento\Catalog\Controller\Product\Compare\Index\Interceptor))
#24 /vendor/magento/framework/Interception/Interceptor.php(58): Magento\Framework\App\FrontController->dispatch(Object(Magento\Framework\App\Request\Http))
#25 /vendor/magento/framework/Interception/Interceptor.php(138): Magento\Framework\App\FrontController\Interceptor->___callParent('dispatch', Array)
#26 /vendor/magento/module-store/App/FrontController/Plugin/RequestPreprocessor.php(94): Magento\Framework\App\FrontController\Interceptor->Magento\Framework\Interception{closure}(Object(Magento\Framework\App\Request\Http))
#27 /vendor/magento/framework/Interception/Interceptor.php(135): Magento\Store\App\FrontController\Plugin\RequestPreprocessor->aroundDispatch(Object(Magento\Framework\App\FrontController\Interceptor), Object(Closure), Object(Magento\Framework\App\Request\Http))
#28 /vendor/magento/module-page-cache/Model/App/FrontController/BuiltinPlugin.php(69): Magento\Framework\App\FrontController\Interceptor->Magento\Framework\Interception{closure}(Object(Magento\Framework\App\Request\Http))
#29 /vendor/magento/framework/Interception/Interceptor.php(135): Magento\PageCache\Model\App\FrontController\BuiltinPlugin->aroundDispatch(Object(Magento\Framework\App\FrontController\Interceptor), Object(Closure), Object(Magento\Framework\App\Request\Http))
#30 /vendor/magento/framework/Interception/Interceptor.php(153): Magento\Framework\App\FrontController\Interceptor->Magento\Framework\Interception{closure}(Object(Magento\Framework\App\Request\Http))
#31 /generated/code/Magento/Framework/App/FrontController/Interceptor.php(26): Magento\Framework\App\FrontController\Interceptor->___callPlugins('dispatch', Array, NULL)
#32 /vendor/magento/framework/App/Http.php(135): Magento\Framework\App\FrontController\Interceptor->dispatch(Object(Magento\Framework\App\Request\Http))
#33 /generated/code/Magento/Framework/App/Http/Interceptor.php(24): Magento\Framework\App\Http->launch()
#34 /vendor/magento/framework/App/Bootstrap.php(258): Magento\Framework\App\Http\Interceptor->launch()
#35 /index.php(39): Magento\Framework\App\Bootstrap->run(Object(Magento\Framework\App\Http\Interceptor))
#36 {main}