Review writting page accessed by bots not logged in.

I have just recieved 900 of these in one day since yesterday:

[26-Sep-2026 13:06:21 Asia/Tokyo] Request URI: /index.php?main_page=product_reviews_write&cPath=1_33&products_id=637, IP address: 83.99.206.191, Language id 2
#0 ..\includes\modules\pages\product_reviews_write\header_php.php(45): zen_debug_error_handler()
#1 ..\index.php(40): require('...')
--> PHP Warning: Undefined array key "customer_id" in ..\includes\modules\pages\product_reviews_write\header_php.php on line 45.

[26-Sep-2026 13:06:21 Asia/Tokyo] Request URI: /index.php?main_page=product_reviews_write&cPath=1_33&products_id=637, IP address: 83.99.206.191, Language id 2
#0 ..\includes\templates\bootstrap\templates\tpl_product_reviews_write_default.php(83): zen_debug_error_handler()
#1 ..\includes\templates\bootstrap\common\tpl_main_page.php(233): require('...')
#2 ..\index.php(109): require('...')
--> PHP Warning: Undefined array key "customers_firstname" in ..\includes\templates\bootstrap\templates\tpl_product_reviews_write_default.php on line 83.

[26-Sep-2026 13:06:21 Asia/Tokyo] Request URI: /index.php?main_page=product_reviews_write&cPath=1_33&products_id=637, IP address: 83.99.206.191, Language id 2
#0 ..\includes\templates\bootstrap\templates\tpl_product_reviews_write_default.php(83): zen_debug_error_handler()
#1 ..\includes\templates\bootstrap\common\tpl_main_page.php(233): require('...')
#2 ..\index.php(109): require('...')
--> PHP Warning: Undefined array key "customers_lastname" in ..\includes\templates\bootstrap\templates\tpl_product_reviews_write_default.php on line 83.

Looking at file \includes\modules\pages\product_reviews_write\header_php.php There is a test to check if the customer is logged in. When not there should have been a redirect, but looking at those error logs, bots are going through.
The zen_is_logged_in() function seems to fail. The only way I see this possible is through the notifier in the function that allows you to change the result of the function to true.

It is not a big security issue but there is a week point here.
Forgot this: I use ZC v2.2.2, no reviews got through, just Debug logs. No plugin concerning reviews is installed.Each log has a different IP and try to let a review on different products.

Where within the storefront files in your installation is the NOTIFY_ZEN_IS_LOGGED_IN notification being monitored/modified?

No where! There is no observer installed in catalog side that monitor this notifier.

The only one I found is in plugin Edit Order in admin side.

A fresh download of includes/modules/pages/product_reviews/header_php.php from ZC 2.2.2 doesn't reference customer_id. Are these customizations you have made?

swguy:

A fresh download of includes/modules/pages/product_reviews/header_php.php from ZC 2.2.2 doesn't reference customer_id. Are these customizations you have made?

It is in the file includes/modules/pages/product_reviews_write/header_php.php.

I found another type of log that appears from time to time:

[27-Sep-2026 00:13:31 Asia/Tokyo] Request URI: /index.php?main_page=redirect&action=product&products_id=2847, IP address: 116.179.32.45, Language id 2

#0 ..\includes\templates\bootstrap\common\tpl_main_page.php(233): zen_debug_error_handler()

#1 ..\includes\templates\bootstrap\common\tpl_main_page.php(233): require()

#2 ..\index.php(109): require('...')

--> PHP Warning: require(includes/templates/template_default/templates/tpl_redirect_default.php): Failed to open stream: No such file or directory in ..\includes\templates\bootstrap\common\tpl_main_page.php on line 233.

[27-Sep-2026 00:13:31 Asia/Tokyo] PHP Fatal error:  Uncaught Error: Failed opening required 'includes/templates/template_default/templates/tpl_redirect_default.php' (include_path='.;C:\php\pear') in ..\includes\templates\bootstrap\common\tpl_main_page.php:233

Stack trace:

#0 ..\index.php(109): require()

#1 {main}

Perhaps the problem is not in the test for logged user but in the redirect that fails. In this log the file name for the redirect is 'redirect'. That might just be a different attack type not related to the first one.

For now logs are still coming, but at rate slowing down.

Perhaps the problem is not in the test for logged user but in the redirect that fails.

You could insert a log after the redirect to test this hypothesis:

error_log("Redirect failed");

Excellent idea. I did it and got the "Redirect failed" message in the log! Then just after I got the 2 other types of logs cited above.

They are able to make the redirect fail... I don't know how because the file name is a constant here (FILENAME_LOGIN).

If I look at the redirect Debug log above (which seems to be a different redirect fail), the page name for the redirect is based on $PHP_SELF which in this case is coming from $_SERVER['SCRIPT_NAME']. There are some XSS attacks based on $_SERVER['PHP_SELF'] manipulation, it most probably works the same way here.

I found the problem, it comes from one of my plugins... Post Code Auto fill! In last version I added a 'redirect stopper' using the NOTIFY_ZEN_REDIRECT notifier to solve a compatibility problem with the plugin Admin Add Customer. I did not realized this has a global range.

Admin Add Customer redirect all the Ajax requests from Postcode Auto when Customer enterr his first address resulting in the display of the page HTML code...

For now I could not find a way to avoid that except that redirect block.

Scott, could you take down the release v2.0.7 of Postcode auto fill Part 1? I will submit v2.0.8 soon.

Done and 2.0.8 approved.

swguy:

Done and 2.0.8 approved.

Thanks! that was fast.