martyyn

Hi Yvonne,

I haven’t gotten to the bottom of this yet as I’ve had a few other things take priority.

I have three sites using Woocommerce but only one has been affected, that I can see.

The affected one was fixed by re-entering the regions for each shipping rule where I noticed the codes where now three digits and not too.

I posted this elsewhere and was pointed to this which may be useful.

https://github.com/woocommerce/woocommerce/issues/35535

Can I please add to @gothamdev comment. I use OnePress on 20+ sites and to add JQuery Migrate to all of them is not really a solution I’m looking forward to.

[edit]
I’ve just seen v2.2.5 with FIXED: Remove deprecated functions

I’ve updated one of the site to this and it seems to be ok now ??

• This reply was modified 4 years, 3 months ago by martyyn.

Hi Dan,

Sorry for my late reply.

The issue is you can give an entire delivery address but use an incorrect region to get a cheaper shipping amount when placing the order. I would expect the delivery to be made because the street address, town and postcode are all correct.

It also assumes the person completing the order knows their geography and checks the address.

I think the solution for us is to use an address validator to update the fields and remove the ability for the customer to edit the REGION field.

Many thanks

Thanks Dan,

1. I searched for hours yesterday trying to find that solution and came up with nothing ??

2. I tried this later in the day. Whilst you can add validation to select and pre-fill the region it still allows a customer to change the region and receive a cheaper shipping price.

After talking with my client last night I think we will first make it a required field and will see how often people choose the wrong one. If it’s still a problem after that we will add address verification. That would mean only people trying to cheat would be the ones with the wrong region.

Thanks
Martyn

Screenshots:

Woocommerce settings

Shipping zones

WBS rules

Checkout page

Hi @longnguyen,

Has their been any update to this ?

Thanks
Martyn

Hi @longnguyen,

What would you like to see ? I only have access to a basic error log. This is what I am seeing.

[Sun Dec 22 19:49:11.422192 2019] [:error] [pid 1022383:tid 139919078643456] [client 59.120.34.106:49749] [client 59.120.34.106] ModSecurity: Access denied with code 403 (phase 2). detected XSS using libinjection. [file “/etc/apache2/conf.d/modsecurity.d/12_asl_adv_xss_rules.conf”] [line “49”] [id “341257”] [rev “1”] [msg “JS WAF Rules: Possible Cross Site Scripting attack (detectXSS) in URL/URI”] [data “/wp-tss/wp-content/plugins/onepress-plus/onepress-plus.css?ver=2.1.8”] [severity “CRITICAL”] [hostname “domain.co.nz”] [uri “/wp-tss/wp-content/plugins/onepress-plus/onepress-plus.css”] [unique_id “XgAPByX9woPdfhm1Oz4KHQAAABE”], referer: https://domain.co.nz/
[Sun Dec 22 19:49:11.715010 2019] [:error] [pid 1022383:tid 139919045072640] [client 59.120.34.106:49749] [client 59.120.34.106] ModSecurity: Access denied with code 403 (phase 2). detected XSS using libinjection. [file “/etc/apache2/conf.d/modsecurity.d/12_asl_adv_xss_rules.conf”] [line “49”] [id “341257”] [rev “1”] [msg “JS WAF Rules: Possible Cross Site Scripting attack (detectXSS) in URL/URI”] [data “/wp-tss/wp-content/plugins/onepress-plus/assets/js/onepress-plus.js?ver=2.1.8”] [severity “CRITICAL”] [hostname “domain.co.nz”] [uri “/wp-tss/wp-content/plugins/onepress-plus/assets/js/onepress-plus.js”] [unique_id “XgAPByX9woPdfhm1Oz4KLgAAADk”], referer: https://domain.co.nz/

Thank you.

In the end I used different images and text positioning based on breakpoints to get around it.

Thanks for the reply.

In the end I wrote my own piece of code using an empty <div> in the section content and css styles to ensure it’s responsive for all screens.

Took a bit of trial and error but seems to work ok.

Hi shrimp2t,

Yep, I’ve done that with no change.

But….I’ve just done it again and opened the site in Chrome’s incognito mode and it’s fine again !

Thanks

Yep me too. It’s not displaying on the login form and no-one can log in so I’ve had to disable it.

I’ll try and set it up somewhere quiet, my main site has people logging in all the time.