{"action":"created","issue":{"url":"https://api.github.com/repos/woothemes/woocommerce/issues/8210","labels_url":"https://api.github.com/repos/woothemes/woocommerce/issues/8210/labels{/name}","comments_url":"https://api.github.com/repos/woothemes/woocommerce/issues/8210/comments","events_url":"https://api.github.com/repos/woothemes/woocommerce/issues/8210/events","html_url":"https://github.com/woothemes/woocommerce/issues/8210","id":79567249,"number":8210,"title":"Lack of Server-Side Price Data Type Checking Results in Wrong Price","user":{"login":"zschuessler","id":302097,"avatar_url":"https://avatars.githubusercontent.com/u/302097?v=3","gravatar_id":"","url":"https://api.github.com/users/zschuessler","html_url":"https://github.com/zschuessler","followers_url":"https://api.github.com/users/zschuessler/followers","following_url":"https://api.github.com/users/zschuessler/following{/other_user}","gists_url":"https://api.github.com/users/zschuessler/gists{/gist_id}","starred_url":"https://api.github.com/users/zschuessler/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/zschuessler/subscriptions","organizations_url":"https://api.github.com/users/zschuessler/orgs","repos_url":"https://api.github.com/users/zschuessler/repos","events_url":"https://api.github.com/users/zschuessler/events{/privacy}","received_events_url":"https://api.github.com/users/zschuessler/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":3,"created_at":"2015-05-22T18:50:05Z","updated_at":"2015-05-29T14:04:31Z","closed_at":"2015-05-28T10:35:49Z","body":"**Issue**\r\n\r\nPrice data type is not checked in multiple locations. This can sometimes result in a bug where price is a string. In this scenario, a string that contains a comma will cause the PHP compiler to incorrectly cast the string to a number or float value.\r\n\r\n**Reproduce**\r\n\r\nSpecific example with this function:\r\nhttps://github.com/woothemes/woocommerce/blob/c6dae2b2866dfd42db2b092a426d01d1f3b49892/includes/abstracts/abstract-wc-product.php#L798\r\n\r\nThis line specifically:\r\n\r\n    $price = $price * $qty;\r\n\r\nLack of type checking will result in the following pricing error:\r\n\r\n    $price = '2,000';\r\n    $qty = 5;\r\n    $price = $price * $qty; // results in '10'\r\n\r\n\r\n**Solution**\r\n\r\nThis issue is mitigated in the admin UI by not allowing commas. However, custom imports and custom pricing-related code could fall victim to this. Data type checking/casting would be ideal to provide further integrity in pricing functions.\r\n\r\nNote that the \"Quick Edit\" feature on the Product list page in the admin UI also does not have validation, so it's another point of failure without type checking."},"comment":{"url":"https://api.github.com/repos/woothemes/woocommerce/issues/comments/106815398","html_url":"https://github.com/woothemes/woocommerce/issues/8210#issuecomment-106815398","issue_url":"https://api.github.com/repos/woothemes/woocommerce/issues/8210","id":106815398,"user":{"login":"mikejolley","id":90977,"avatar_url":"https://avatars.githubusercontent.com/u/90977?v=3","gravatar_id":"","url":"https://api.github.com/users/mikejolley","html_url":"https://github.com/mikejolley","followers_url":"https://api.github.com/users/mikejolley/followers","following_url":"https://api.github.com/users/mikejolley/following{/other_user}","gists_url":"https://api.github.com/users/mikejolley/gists{/gist_id}","starred_url":"https://api.github.com/users/mikejolley/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mikejolley/subscriptions","organizations_url":"https://api.github.com/users/mikejolley/orgs","repos_url":"https://api.github.com/users/mikejolley/repos","events_url":"https://api.github.com/users/mikejolley/events{/privacy}","received_events_url":"https://api.github.com/users/mikejolley/received_events","type":"User","site_admin":false},"created_at":"2015-05-29T14:04:31Z","updated_at":"2015-05-29T14:04:31Z","body":"@zschuessler The problem is only slightly mitigated if we sanitise price on retrieval via product class. If you're access that through post meta it still may be malformed, which again is an issue for plugins.\r\n\r\nI personally feel it should be formatted on input only.\r\n\r\nBTW, the reason commas may be saving for you is that your locale is setup to use real decimals, in which case , may not be removed. Is this the case?"}}